Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 441:

  Your company has an Active Directory domain. You have a two-tier PKI infrastructure that contains an offline root CA and an online issuing CA. The Enterprise certification authority is running Windows Server 2008 R2.

  You need to ensure users are able to enroll new certificates.

  What should you do?

  A. Renew the Certificate Revocation List (CRL) on the root CA. Copy the CRL to the CertEnroll folder on the issuing CA.
  B. Renew the Certificate Revocation List (CRL) on the issuing CA, Copy the CRL to the SysternCertificates folder in the users' profile.
  C. Import the root CA certificate into the Trusted Root Certification Authorities store on all client workstations.
  D. Import the issuing CA certificate into the Intermediate Certification Authorities store on all client workstations.
  A. Renew the Certificate Revocation List (CRL) on the root CA. Copy the CRL to the CertEnroll folder on the issuing CA.

  ---

  http://social.technet.microsoft.com/wiki/contents/articles/2900.offline-root-certification-authority- ca.aspx

  Offline Root Certification Authority (CA)

  A root certification authority (CA) is the top of a public key infrastructure (PKI) and generates a self- signed certificate. This means that the root CA is validating itself (self-validating). This root CA could then have subordinate CAs that

  effectively trust it. The subordinate CAs receive a certificate signed by the root CA, so the subordinate CAs can issue certificates that are validated by the root CA. This establishes a CA hierarchy and trust path.

  CA Compromise

  If a root CA is in some way compromised (broken into, hacked, stolen, or accessed by an unauthorized or malicious person), then all of the certificates that were issued by that CA are also compromised. Since certificates are used for data

  protection, identification, and authorization, the compromise of a CA could compromise the security of an entire organizational network. For that reason, many organizations that run internal PKIs install their root CA offline. That is, the CA is

  never connected to the company network, which makes the root CA an offline root CA. Make sure that you keep all CAs in secure areas with limited access.

  To ensure the reliability of your CA infrastructure, specify that any root and non-issuing intermediate CAs must be offline. A non-issuing CA is one that is not expected to provide certificates to client computers, network devices, and so on. This

  minimizes the risk of the CA private keys becoming compromised, which would in turn compromise all the certificates that were issued by the CA.

  How Do Offline CAs issue certificates?

  Offline root CAs can issue certificates to removable media devices (e.g. floppy disk, USB drive, CD/DVD) and then physically transported to the subordinate CAs that need the certificate in order to perform their tasks. If the subordinate CA is

  a non-issuing intermediate that is offline, then it will also be used to generate a certificate and that certificate will be placed on removable media. Each CA receives its authorization to issue certificates from the CA directly above it in the CA

  hierarchy. However, you can have multiple CAs at the same level of the CA hierarchy. Issuing CAs are typically online and used to issue certificates to client computers, network devices, mobile devices, and so on. Do not join offline CAs to an

  Active Directory Domain Services domain Since offline CAs should not be connected to a network, it does not make sense to join them to an Active Directory Domain Services (AD DS) domain, even with the Offline Domain Join [This link is

  external to TechNet Wiki. It will open in a new window.] option introduced with Windows 7 and Windows Server 2008 R2.

  Furthermore, installing an offline CA on a server that is a member of a domain can cause problems with a secure channel when you bring the CA back online after a long offline period. This is because the computer account password changes

  every 30 days. You can get around this by problem and better protect your CA by making it a member of a workgroup, instead of a domain. Since Enterprise CAs need to be joined to an AD DS domain, do not attempt to install an offline CA

  as a Windows Server Enterprise CA.

  http://technet.microsoft.com/en-us/library/cc740209%28v=ws.10%29.aspx Renewing a certification authority

  A certification authority may need to be renewed for either of the following reasons:

  Change in the policy of certificates issued by the CA

  Expiration of the CA's issuing certificate

• Question 442:

  ABC.com boasts a two-node Network Load Balancing cluster which is called web.CK1.com. The purpose of this cluster is to provide load balancing and high availability of the intranet website only.

  With monitoring the cluster, you discover that the users can view the Network Load Balancing cluster in their Network Neighborhood and they can use it to connect to various services by using the name web.CK1.com.

  You also discover that there is only one port rule configured for Network Load Balancing cluster. You have to configure web.CK1.com NLB cluster to accept HTTP traffic only.

  Which two actions should you perform to achieve this objective? (Choose two answers. Each answer is part of the complete solution)

  A. Create a new rule for TCP port 80 by using the Network Load Balancing Cluster console
  B. Run the wlbs disable command on the cluster nodes
  C. Assign a unique port rule for NLB cluster by using the NLB Cluster console
  D. Delete the default port rules through Network Load Balancing Cluster console
  A. Create a new rule for TCP port 80 by using the Network Load Balancing Cluster console
  D. Delete the default port rules through Network Load Balancing Cluster console

  ---

  http://technet.microsoft.com/en-us/library/cc733056.aspx Create a new Network Load Balancing Port Rule

  Port rules control how a Network Load Balancing (NLB) cluster functions. To maximize control of various types of TCP/IP traffic, you can set up port rules to control how each port's cluster-network traffic is handled. The method by which a port's network traffic is handled is called its filtering mode. There are three possible filtering modes: Multiple hosts, Single host, and Disabled. You can also specify that a filtering mode apply to a numerical range of ports. You do this by defining a port rule with a set of configuration parameters that define the filtering mode. Each rule consists of the following configuration parameters:

  The virtual IP address that the rule should apply to The TCP or UDP port range that this rule should apply to The protocols that this rule should apply to, including TCP, UDP, or both The filtering mode that specifies how the cluster handles traffic, which is described by the port range and the protocols In addition, you can select one of three options for client affinity: None, Single, or Network. Single and Network are used to ensure that all network traffic from a particular client is directed to the same cluster host. To allow NLB to properly handle IP fragments, you should avoid using None when you select UDP or Both for your protocol setting. As an extension to the Single and Network options, you can configure a time-out setting to preserve client affinity when the configuration of an NLB cluster is changed. This extension also allows clients to keep affinity to a cluster host even if there are no active, existing connections from the client to the host.

• Question 443:

  Your network consists of an Active Directory forest that contains one domain. All domain controllers run.

  Windows Server 2008 R2 and are configured as DNS servers. You have an Active Directory- integrated zone.

  You have two Active Directory sites. Each site contains five domain controllers.

  You add a new NS record to the zone.

  You need to ensure that all domain controllers immediately receive the new NS record.

  What should you do?

  A. From the DNS Manager console, reload the zone.
  B. From the DNS Manager console, increase the version number of the SOA record.
  C. From the command prompt, run repadmin /syncall.
  D. From the Services snap-in, restart the DNS Server service.
  C. From the command prompt, run repadmin /syncall.

  ---

  http://technet.microsoft.com/en-us/library/cc835086%28v=ws.10%29.aspx Repadmin /syncall Synchronizes a specified domain controller with all of its replication partners. http://ivan.dretvic.com/2012/01/how-to-force-replication-of-domaincontrollers/ How to force replication of Domain Controllers

  From time to time its necessary to kick off AD replication to speed up a task you may be doing, or just a good too to check the status of replication between DC's.

  Below is a command to replicate from a specified DC to all other DC's. Repadmin /syncall DC_name /Aped By running a repadmin /syncall with the /A(ll partitions) P(ush) e(nterprise, cross sites) d(istinguished names) parameters, you have duplicated exactly what Replmon used to do in Windows 2003, except that you did it in one step, not many.And with the benefit of seeing immediate results on how the operations are proceeding. If I am running it on the DC itself, I don't even have to specify the server name.

• Question 444:

  Your network contains an Active Directory domain named contoso.com. Contoso.com contains a domain controller named DC1 and a read-only domain controller (RODC) namedRODC1.

  You need to view the most recent user accounts authenticated by RODC1.

  What should you do first?

  A. From Active Directory Sites and Services, right-click the Connection object for DC1, and then click Replicate Now.
  B. From Active Directory Sites and Services, right-click the Connection object for DC2, and then click Replicate Now.
  C. From Active Directory Users and Computers, right-click contoso.com, click Change DomainController, and then connect to DC1.
  D. From Active Directory Users and Computers, right-click contoso.com, click Change Domain Controller, and then connect to RODC1.
  C. From Active Directory Users and Computers, right-click contoso.com, click Change DomainController, and then connect to DC1.

  ---

  Reference: http://technet.microsoft.com/en-us/library/rodc-guidance-for-administering-the-password-replication- policy.aspx#BKMK_Auth2 To view authenticated accounts using Active Directory Users and Computers

  1.

  Open Active Directory Users and Computers. To open Active Directory Users and Computers, click Start. In Start Search, type dsa.msc, and then press ENTER.

  2.

  Ensure that you are connected to a writeable domain controller running Windows Server 2008 in the correct domain. To connect to the appropriate domain or domain controller, in the details pane, right- click the Active Directory Users and Computers object, and then click Change Domain or Change Domain Controller, respectively.

  3.

  Click Domain Controllers.

  4.

  In the details pane, right-click the RODC computer account, and then click Properties.

  5.

  Click the Password Replication Policy tab.

  6.

  Click Advanced.

  7.

  In the drop-down list, click Accounts that have been authenticated to this Read-only Domain Controller, as shown in the following illustration.

  

• Question 445:

  Your network contains an Active Directory domain that has the password policy shown in the following exhibit. (Click the Exhibit button.)

  

  To answer, complete each statement according to the information presented in the exhibit.

  Hot Area:

  

  

  ---

  Note:

  1: Minimum password age: 1 days

  2: Passwords must contain characters from three of the following five categories:

  Uppercase characters of European languages (A through Z, with diacritic marks, Greek and ꞏ Cyrillic characters)

  Lowercase characters of European languages (a through z, sharp-s, with diacritic marks, Greek ꞏ and Cyrillic characters)

  Base 10 digits (0 through 9)

  ꞏNonalphanumeric characters: ~!@#$%^and*_-+=`|\(){}[]:;"'<>,.?/ ꞏ

  Any Unicode character that is categorized as an alphabetic character but is not uppercase or ꞏ lowercase. This includes Unicode characters from Asian languages.

  3: Maximum password age: 42 days

• Question 446:

  You have an Active Directory domain named contoso.com.

  You have a domain controller named Server1 that is configured as a DNS server. Server1 hosts a standard primary zone for contoso.com. The DNS configuration of Server1 is shown in the exhibit. (Click the Exhibit button.)

  

  You discover that stale resource records are not automatically removed from the contoso.com zone.

  You need to ensure that the stale resource records are automatically removed from the contoso.com zone.

  What should you do?

  A. Set the scavenging period of Server1 to 0 days.
  B. Modify the Server Aging/Scavenging properties.
  C. Configure the aging properties for the contoso.com zone.
  D. Convert the contoso.com zone to an Active Directory-integrated zone.
  C. Configure the aging properties for the contoso.com zone.

  ---

  

  http://technet.microsoft.com/en-us/library/cc816625%28v=ws.10%29.aspx Set Aging and Scavenging Properties for a Zone The DNS Server service supports aging and scavenging features. These features are provided as a mechanism for performing cleanup and removal of stale resource records, which can accumulate in zone data over time. You can use this procedure to set the aging and scavenging properties for a specific zone using either the DNS Manager snap-in or the dnscmd command-line tool. To set aging and scavenging properties for a zone using the Windows interface

  1.

  Open DNS Manager. To open DNS Manager, click Start, point to Administrative Tools, and then click DNS.

  2.

  In the console tree, right-click the applicable zone, and then click Properties.

  3.

  On the General tab, click Aging.

  4.

  Select the Scavenge stale resource records check box.

  5.

  Modify other aging and scavenging properties as needed. To set aging and scavenging properties for a zone using a command line

  1.

  Open a command prompt. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

  2.

  At the command prompt, type the following command, and then press ENTER:

  dnscmd /Config {/Aging |/RefreshInterval |/ NoRefreshInterval }

  

• Question 447:

  Your network contains an Active Directory domain named contoso.com. The domain contains a file server named Server1 that runs Windows Server 2008 R2. Server1 has a file share named Share1.

  You plan to configure the audit policy settings of Server1 by using a Group Policy object (GPO). You need to ensure that entries are generated in the Event Log when the users in a group named Group1 successfully access or fail to access the files in Share1. The event entries must show the specific operation each user attempted. The solution must minimize the number of audit entries in the Event Log.

  Which Object Access audit policy should you configure?

  A. Audit File Share
  B. Audit Detailed File Share
  C. Audit File System
  D. Audit Other Object Access Events
  C. Audit File System

• Question 448:

  Your network contains a single Active Directory domain named contoso.com. The domain contains two domain controllers named DC1 and DC2 that run Windows Server 2008 R2. DC1 hosts a primary zone for Contoso.

  com. DC2 hosts a secondary zone for contosto.com.

  On DC1, you change the zone to an Active Directory-integrated zone and configure the zone to accept secure dynamic updates only.

  You need to ensure that DC2 can accept secure dynamic updates to the contoso.com zone.

  Which command should you run?

  A. dnscmd.exe dc2.contoso.com /createdirectorypartition dns.contoso.com
  B. dnscmd.exe dc2.contoso.com /zoneresettype contoso.com /dsprimary
  C. dnslint.exe /ql
  D. repadmin.exe /syncall /force
  B. dnscmd.exe dc2.contoso.com /zoneresettype contoso.com /dsprimary

  ---

  http://technet.microsoft.com/en-us/library/cc772069%28v=ws.10%29.aspx#BKMK_29 Dnscmd A command-line interface for managing DNS servers. This utility is useful in scripting batch files to help automate routine DNS management tasks,

  or to perform simple unattended setup and configuration of new DNS servers on your network.

  dnscmd /zoneresettype

  Changes the zone type.

  Syntax

  dnscmd [] /zoneresettype [/overwrite_mem | /overwrite_ds] Parameters

  Specifies the DNS server to manage, represented by local computer syntax, IP address, FQDN, or host name. If this parameter is omitted, the local server is used.

  Identifies the zone on which the type will be changed.

  Specifies the type of zone to create. Each type has different required parameters:

  /dsprimary Creates an Active Directoryintegrated zone. /primary /file Creates a standard primary zone. /secondary

  [,...] Creates a standard secondary zone. /stub [,...] /file Creates a file-backed stub zone. /

  dsstub [,...] Creates an Active Directoryintegrated stub zone. /forwarder ]... /

  file Specifies that the created zone forwards unresolved queries to another DNS server. /dsforwarder Specifies that the created Active Directory-

  integrated zone forwards unresolved queries to another DNS server.

  /overwrite_mem | /overwrite_ds

  Specifies how to overwrite existing data:

  /overwrite_mem Overwrites DNS data from data in AD DS.

  /overwrite_ds Overwrites existing data in AD DS.

  Remarks

  Setting the zone type as /dsforwarder creates a zone that performs conditional forwarding.

• Question 449:

  Your network contains an Active Directory domain. All servers run Windows Server 2008 R2. You need to audit the deletion of registry keys on each server.

  What should you do?

  A. From Audit Policy, modify the Object Access settings and the Process Tracking settings.
  B. From Audit Policy, modify the System Events settings and the Privilege Use settings.
  C. From Advanced Audit Policy Configuration, modify the System settings and the Detailed Tracking settings.
  D. From Advanced Audit Policy Configuration, modify the Object Access settings and the Global Object Access Auditing settings.
  D. From Advanced Audit Policy Configuration, modify the Object Access settings and the Global Object Access Auditing settings.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/dd408940.aspx

  Advanced Security Audit Policy Step-by-Step Guide

  A global object access audit policy can be used to enforce object access audit policy for a computer, file share, or registry.

• Question 450:

  Your network contains an Active Directory domain named contoso.com. The functional level of the forest is Windows Server 2008 R2.

  The Default Domain Controller Policy Group Policy object (GPO) contains audit policy settings. On a domain controller named DC1, an administrator configures the Advanced Audit Policy Configuration settings by using a local GPO.

  You need to identify what will be audited on DC1.

  Which tool should you use?

  A. Get-ADObject
  B. Secedit
  C. Security Configuration and Analysis
  D. Auditpol
  D. Auditpol

  ---

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc772576.aspx

  Auditpol get

  Retrieves the system policy, per-user policy, auditing options, and audit security descriptor object.

  Reference 2:

  Windows Server 2008 R2 Unleashed (SAMS, 2010) page 670

  You can use the AUDITPOL command to get and set the audit categories and subcategories. To retrieve a list of all the settings for the audit categories and subcategories, use the following command:

  auditpol /get /category:*