Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 451:

  Your network contains an enterprise root certification authority (CA). You need to ensure that a certificate issued by the CA is valid. What should you do?

  A. Run syskey.exe and use the Update option.
  B. Run sigverif.exe and use the Advanced option.
  C. Run certutil.exe and specify the -verify parameter.
  D. Run certreq.exe and specify the -retrieve parameter.
  C. Run certutil.exe and specify the -verify parameter.

  ---

  http://blogs.technet.com/b/pki/archive/2006/11/30/basic-crl-checking-with-certutil.aspx Basic CRL checking with certutil

  Certutil.exe is the command-line tool to verify certificates and CRLs. To get reliable verification results, you must use certutil.exe because the Certificate MMC Snap-In does not verify the CRL of certificates. A certificate might be wrongly shown in the MMC snap-in as valid but once you verify it with certutil.exe you will see that the certificate is actually invalid.

• Question 452:

  Your network contains an Active Directory domain. All domain controllers run Windows Server 2008. The functional level of the domain is Windows Server 2003.

  All client computers run Windows 7. You install Windows Server 2008 R2 on a server named Server1.

  You need to perform an offline domain join of Server1.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. From Server1, run djoin.exe.
  B. From Server1, run netdom.exe.
  C. From a Windows 7 computer, run djoin.exe.
  D. Upgrade one domain controller to Windows Server 2008 R2.
  E. Raise the functional level of the domain to Windows Server 2008.
  A. From Server1, run djoin.exe.
  C. From a Windows 7 computer, run djoin.exe.

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) pages 217, 218 Offline Domain Join

  Offline domain join is also useful when a computer is deployed in a lab or other disconnected environment.

  When the computer is connected to the domain network and started for the first time, it will already be a member of the domain. This also helps to ensure that Group Policy settings are applied at the first startup.

  Four major steps are required to join a computer to the domain by using offline domain join:

  1.

  Log on to a computer in the domain that is running Windows Server 2008 R2 or Windows 7 with an account that has permissions to join computers to the domain.

  2.

  Use the DJoin command to provision a computer for offline domain join. This step prepopulates Active Directory with the information that Active Directory needs to join the computer to the domain, and exports the information called a blob to a text file.

  3.

  At the offline computer that you want to join the domain use DJoin to import the blob into the Windows directory.

  4.

  When you start or restart the computer, it will be a member of the domain.

• Question 453:

  Your network contains two Active Directory forests named contoso.com and fabrikam.com. Each forest contains a single domain.

  A two-way forest trust exists between the forests. Selective authentication is enabled on the trust.

  Contoso.com contains a group named Group 1.

  Fabrikam.com contains a server named Server1.

  You need to ensure that users in Group1 can access resources on Server1.

  What should you modify?

  A. the permissions of the Group1 group
  B. the UPN suffixes of the contoso.com forest
  C. the UPN suffixes of the fabrikam.com forest
  D. the permissions of the Server1 computer account
  A. the permissions of the Group1 group

  ---

  Group1 must get the 'Allowed To Authenticate' permission on Server1, so I'd go for A, as given. Answer D may sound tempting, but it speaks of permissions of the Server1 computer account.

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) pages 643, 644 After you have selected Selective Authentication for the trust, no trusted users will be able to access resources in the trusting domain, even if those

  users have been given permissions. The users must also be assigned the Allowed To Authenticate permission on the computer object in the domain.

  1.

  Open the Active Directory Users And Computers snap-in and make sure that Advanced Features is selected on the View menu.

  2.

  Open the properties of the computer to which trusted users should be allowed to authenticate--that is, the computer that trusted users will log on to or that contains resources to which trusted users have been given permissions.

  3.

  On the Security tab, add the trusted users or a group that contains them and select the Allow check box for the Allowed To Authenticate permission.

• Question 454:

  ABC.com has a network that consists of a single Active Directory domain.Windows Server 2008 is installed on all domain controllers in the network.

  You are instructed to capture all replication errors from all domain controllers to a central location.

  What should you do to achieve this task?

  A. Initiate the Active Directory Diagnostics data collector set
  B. Set event log subscriptions and configure it
  C. Initiate the System Performance data collector set
  D. Create a new capture in the Network Monitor
  B. Set event log subscriptions and configure it

  ---

  http://technet.microsoft.com/en-us/library/cc748890.aspx Configure Computers to Forward and Collect Events

  Before you can create a subscription to collect events on a computer, you must configure both the collecting computer (collector) and each computer from which events will be collected (source). http://technet.microsoft.com/en-us/library/ cc749183.aspx Event Subscriptions Event Viewer enables you to view events on a single remote computer. However, troubleshooting an issue might require you to examine a set of events stored in multiple logs on multiple computers. Windows Vista includes the ability to collect copies of events from multiple remote computers and store them locally. To specify which events to collect, you create an event subscription. Among other details, the subscription specifies exactly which events will be collected and in which log they will be stored locally. Once a subscription is active and events are being collected, you can view and manipulate these forwarded events as you would any other locally stored events. Using the event collecting feature requires that you configure both the forwarding and the collecting computers. The functionality depends on the Windows Remote Management (WinRM) service and the Windows Event Collector (Wecsvc) service. Both of these services must be running on computers participating in the forwarding and collecting process. http://technet.microsoft.com/en-us/library/cc961808.aspx Replication Issues

• Question 455:

  Your company has an Active Directory forest. You plan to install an Enterprise certification authority (CA) on a dedicated stand-alone server.

  When you attempt to add the Active Directory Certificate Services (AD CS) server role, you find that the EnterpriseCA option is not available.

  You need to install the AD CS server role as an EnterpriseCA.

  What should you do first?

  A. Add the DNS Server server role.
  B. Add the Active Directory Lightweight Directory Services (AD LDS) server role.
  C. Join the server to the domain.
  D. Add the Web Server (IIS) server role and the AD CS server role.
  C. Join the server to the domain.

• Question 456:

  Your network contains an Active Directory forest. The forest contains two domains named contoso.com and east.contoso.com.

  The contoso.com domain contains a domain controller named DC1. The east.contoso.com domain contains a domain controller namedDC2. DC1 and DC2 have the DNS Server server role installed.

  You need to create a DNS zone that is available on DC1 and DC2. The solution must ensure that zone transfers are encrypted. What should you do?

  A. Create a primary zone on DC1 and store the zone in a zone file. Configure IPSec on DC1 and DC2. Create a secondary zone on DC2 and select DC1 as the master.
  B. Create a primary zone on DC1 and store the zone in the DC=DomainDNSZones,DC=Contoso,DC=com naming context. Create a secondary zone on DC2 and select DC1 as the master.
  C. Create a primary zone on DC1 and store the zone in a zone file. Configure Encrypting File System (EFS) encryption. Create a secondary zone on DC2 and select DC1 as the master.
  D. Create a primary zone on DC1 and store the zone in the DC=Contoso,DC=com naming context. Create a secondary zone on DC2 and select DC1 as the master.
  B. Create a primary zone on DC1 and store the zone in the DC=DomainDNSZones,DC=Contoso,DC=com naming context. Create a secondary zone on DC2 and select DC1 as the master.

  ---

  *DomainDnsZones

  DNS application directory partition for each domain in the forest. DNS zones stored in this application directory partition are replicated to all DNS servers running on domain controllers in the domain.

• Question 457:

  You create a new Active Directory domain. The functional level of the domain is Windows Server 2008 R2. The domain contains five domain controllers.

  You need to monitor the replication of the group policy template files.

  Which tool should you use?

  A. Dfsrdiag
  B. Fsutil
  C. Ntdsutil
  D. Ntfrsutl
  A. Dfsrdiag

  ---

  With domain functional level 2008 you have available dfs-r sysvol replication. So with DFL2008 you can use the DFSRDIAG tool. It is not available with domain functional level 2003. With domain functional level 2003 you can only use Ntfrsutl.

• Question 458:

  Your network contains 50 domain controllers that runs Windows Server 2008 R2. You need to create a script that resets the Directory Services Restore Mode (DSRM) password on all of the domain controllers. The solution must NOT maintain passwords in the script.

  Which two tools should you use? (Each correct answer presents part of the solution. Choose two.)

  A. Active Directory Users and Computers
  B. Ntdsutil
  C. Dsamain
  D. Local Users and Groups
  B. Ntdsutil
  D. Local Users and Groups

  ---

  B: You can also NTDSUTIL command tool to reset DSRM password. In an elevated CMD prompt where you have logged on as a Domain Admin, run: NTDSUTIL SET DSRM PASSWORD SYNC FROM DOMAIN ACCOUNT Q Q D (not A): There comes a day in nearly every administrator's life where they will need to boot a domain controller into DS Restore Mode. Whether it's to perform an authoritative restore or fix database issues, you will need the local administrator password.

• Question 459:

  Your network contains an Active Directory domain named contoso.com. The domain contains a file server named Server1. Server1 has a shared folder named Profiles.

  You plan to create a new user template named User_Template. You need to ensure that when you copy User_Temptate, the new user account has a unique profile folder created in the Profiles share.

  Which value should you specify for the profile path?

  A. %Userprofile%\Server1\profiles
  B. \\Server1\profiles\%username%
  C. \\Server1\%userprofile%\
  D. \\Server1\profiles\username
  B. \\Server1\profiles\%username%

• Question 460:

  Your company has an Active Directory domain.

  You plan to install the Active Directory Certificate Services (AD CS) server role on a member server that runs Windows Server 2008 R2.

  You need to ensure that members of the Account Operators group are able to issue smartcard credentials.They should not be able to revoke certificates.

  Which three actions should you perform? (Each correct answer presents part of the solution. Choose three.)

  A. Create an Enrollment Agent certificate.
  B. Create a Smartcard logon certificate.
  C. Restrict enrollment agents for the Smartcard logon certificate to the Account Operator group.
  D. Install the AD CS role and configure it as an Enterprise Root CA.
  E. Install the AD CS role and configure it as a Standalone CA.
  F. Restrict certificate managers for the Smartcard logon certificate to the Account Operator group.
  B. Create a Smartcard logon certificate.
  C. Restrict enrollment agents for the Smartcard logon certificate to the Account Operator group.
  D. Install the AD CS role and configure it as an Enterprise Root CA.

  ---

  http://technet.microsoft.com/en-us/library/cc753800%28v=ws.10%29.aspx AD CS: Restricted Enrollment Agent The restricted enrollment agent is a new functionality in the Windows Server?2008 Enterprise operating system that allows limiting the permissions that users designated as enrollment agents have for enrolling smart card certificates on behalf

  of other users.

  What does the restricted enrollment agent do?

  Enrollment agents are one or more authorized individuals within an organization. The enrollment agent needs to be issued an enrollment agent certificate, which enables the agent to enroll for smart card certificates on behalf of users.

  Enrollment agents are typically members of the corporate security, Information Technology (IT) security, or help desk teams because these individuals have already been trusted with safeguarding valuable resources. In some organizations,

  such as banks that have many branches, help desk and security workers might not be conveniently located to perform this task. In this case, designating a branch manager or other trusted employee to act as an enrollment agent is required to

  enable smart card credentials to be issued from multiple locations. On a Windows Server 2008 Enterprise-based certification authority (CA), the restricted enrollment agent features allow an enrollment agent to be used for one or many

  certificate templates. For each certificate template, you can choose which users or security groups the enrollment agent can enroll on behalf of. You cannot constrain an enrollment agent based on a certain Active Directory?organizational unit

  (OU) or container; you must use security groups instead. The restricted enrollment agent

  is not available on a Windows

  http://technet.microsoft.com/en-us/library/cc776874%28v=ws.10%29.aspx

  Enterprise certification authorities

  The Enterprise Administrator can install Certificate Services to create an enterprise certification authority (CA).

  Enterprise CAs can issue certificates for purposes such as digital signatures, secure e-mail using S/MIME (Secure Multipurpose Internet Mail Extensions), authentication to a secure Web server using Secure Sockets Layer (SSL) or Transport

  Layer Security (TLS) and logging on to a Windows Server 2003 family domain using a smart card.

  An enterprise CA has the following features:

  An enterprise CA requires the Active Directory directory service. When you install an enterprise root CA, it uses Group Policy to propagate its certificate to the Trusted Root Certification Authorities certificate store for all users and computers

  in the domain. You must be a Domain Administrator or be an administrator with write access to Active Directory to install an enterprise root CA.

  Certificates can be issued for logging on to a Windows Server 2003 family domain using smart cards. The enterprise exit module publishes user certificates and the certificate revocation list (CRL) to Active Directory. In order to publish

  certificates to Active Directory, the server that the CA is installed on must be a member of the Certificate Publishers group. This is automatic for the domain the server is in, but the server must be delegated the proper security permissions to

  publish certificates in other domains. For more information about the exit module, see Policy and exit modules.

  An enterprise CA uses certificate types, which are based on a certificate template. The following functionality is possible when you use certificate templates:

  Enterprise CAs enforce credential checks on users during certificate enrollment. Each certificate template has a security permission set in Active Directory that determines whether the certificate requester is authorized to receive the type of

  certificate they have requested. The certificate subject name can be generated automatically from the information in Active Directory or supplied explicitly by the requestor.

  The policy module adds a predefined list of certificate extensions to the issued certificate. The extensions are defined by the certificate template. This reduces the amount of information a certificate requester has to provide about the

  certificate and its intended use. http://technet.microsoft.com/en-us/library/cc780501%28WS.10%29.aspx Stand-alone certification authorities

  You can install Certificate Services to create a stand-alone certification authority (CA). Stand-alone CAs can issue certificates for purposes such as digital signatures, secure e-mail using S/MIME (Secure Multipurpose Internet Mail

  Extensions) and authentication to a secure Web server using Secure Sockets Layer (SSL) or Transport Layer Security (TLS).

  A stand-alone CA has the following characteristics:

  Unlike an enterprise CA, a stand-alone CA does not require the use of the Active Directory directory service. Stand-alone CAs are primarily intended to be used as Trusted Offline Root CAs in a CA hierarchy or when extranets and the Internet

  are involved. Additionally, if you want to use a custom policy module for a CA, you would first install a stand-alone CA and then replace the stand-alone policy module with your custom policy module.

  When submitting a certificate request to a stand-alone CA, a certificate requester must explicitly supply all identifying information about themselves and the type of certificate that is wanted in the certificate request. (This does not need to be

  done when submitting a request to an enterprise CA, since the enterprise user's information is already in Active Directory and the certificate type is described by a certificate template). The authentication information for requests is obtained

  from the local computer's Security Accounts Manager database.

  By default, all certificate requests sent to the stand-alone CA are set to Pending until the administrator of the stand-alone CA verifies the identity of the requester and approves the request. This is done for security reasons, because the

  certificate requester's credentials are not verified by the stand-alone CA.

  Certificate templates are not used.

  No certificates can be issued for logging on to a Windows Server 2003 family domain using smart cards, but other types of certificates can be issued and stored on a smart card. The administrator has to explicitly distribute the stand-alone

  CA's certificate to the domain user's trusted root store or users must perform that task themselves. When a stand-alone CA uses Active Directory, it has these additional features:

  If a member of the Domain Administrators group or an administrator with write access to Active Directory, installs a stand-alone root CA, it is automatically added to the Trusted Root Certification Authorities certificate store for all users and

  computers in the domain. For this reason, if you install a stand-alone root CA in an Active Directory domain, you should not change the default action of the CA upon receiving certificate requests (which marks requests as Pending).

  Otherwise, you will have a trusted root CA that automatically issues certificates without verifying the identity of the certificate requester.

  If a stand-alone CA is installed by a member of the Domain Administrators group of the parent domain of a tree in the enterprise, or by an administrator with write access to Active Directory, then the stand- alone CA will publish its CA

  certificate and the certificate revocation list (CRL) to Active Directory.