Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 461:

  Your company has an Active Directory forest that contains eight linked Group Policy Objects (GPOs). One of these GPOs publishes applications to user objects. A user reports that the application is not available for installation.

  You need to identify whether the GPO has been applied.

  What should you do?

  A. Run the Group Policy Results utility for the user.
  B. Run the GPRESULT /S /Z command at the command prompt.
  C. Run the GPRESULT /SCOPE COMPUTER command at the command prompt.
  D. Run the Group Policy Results utility for the computer.
  A. Run the Group Policy Results utility for the user.

  ---

  Personal note:

  You run the utility for the user and not for the computer because the application publishes to user objects

  http://technet.microsoft.com/en-us/library/bb456989.aspx How to Use the Group Policy Results (GPResult.exe) Command Line Tool Intended for administrators, the Group Policy Results (GPResult.exe) command line tool verifies all policy

  settings in effect for a specific user or computer. Administrators can run GPResult on any remote computer within their scope of management. By default, GPResult returns settings in effect on the computer on which GPResult is run.

  To run GPResult on your own computer:

  1.

  Click Start, Run, and enter cmd to open a command window.

  2.

  Type gpresult and redirect the output to a text file as shown in Figure 1 below:

  3.

  Enter notepad gp.txt to open the file. Results appear as shown in the figure below.

  

  

• Question 462:

  Your network contains an Active Directory domain named contoso.com.

  You need to view which password setting object is applied to a user.

  Which filter option in Attribute Editor should you enable? To answer, select the appropriate filter option in the answer area.

  Hot Area:

  

  

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc770848.aspx

  View a Resultant PSO for a User or a Global Security Group You can view the resultant Password Settings object (PSO) for a user object: Viewing the resultant PSO for users using the Active Directory module for Windows PowerShell Viewing the resultant PSO for users using the Windows interface Viewing the resultant PSO for users from the command line using dsget

  To view the resultant PSO for a user using Windows interface

  1. Open Active Directory Users and Computers.

  2. On the View menu, ensure that Advanced Features is checked.

  3. In the console tree, click Users.

  4. In the details pane, right-click the user account for which you want to view the resultant PSO, and then click Properties.

  5. Click the Attribute Editor tab, and then click Filter.

  6. Ensure that the Show attributes/Optional check box is selected.

  7. Ensure that the Show read-only attributes/Constructed check box is selected.

  8. Locate the value of the msDS-ResultantPSO attribute in the Attributes list.

• Question 463:

  Your network contains an Active Directory forest. The forest schema contains a custom attribute for user objects.

  You need to give the human resources department a file that contains the last logon time and the custom attribute values for each user in the forest.

  What should you use?

  A. the Dsquery tool
  B. the Export-CSV cmdlet
  C. the Get-ADUser cmdlet
  D. the Net.exe user command
  C. the Get-ADUser cmdlet

  ---

  References:

  https://devcentral.f5.com/weblogs/Joe/archive/2009/01/09/powershell-abcs---o-is-for-output.aspx http://social.technet.microsoft.com/Forums/en-US/winserverpowershell/thread/8d8649d9-f591-4b44- b838-e0f5f3a591d7

  http://kpytko.wordpress.com/2012/07/30/lastlogon-vs-lastlogontimestamp/

  Export-Csv

  Reference:

  http://technet.microsoft.com/en-us/library/ee176825.aspx

  Saving Data as a Comma-Separated Values File

  The Export-Csv cmdlet makes it easy to export data as a comma-separated values (CSV) file; all you need to do is call Export-Csv followed by the path to the CSV file. For example, thiscommand uses Get-Process to grab information about

  all the processes running on the computer,then uses Export-Csv to write that data to a file named C:\Scripts\Test.txt:

  Get-Process | Export-Csv c:\scripts\test.txt.

  Net User

  Reference:

  http://technet.microsoft.com/en-us/library/cc771865.aspx

  Adds or modifies user accounts, or displays user account information.

  DSQUERY

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc754232.aspx

  Parameters

  { | forestroot | domainroot}

  Specifies the node in the console tree where the search starts. You can specify the forest root (forestroot), domain root (domainroot), or distinguished name of a node as the start node .

  If you specify

  forestroot, AD DS searches by using the global catalog.

  -attr { | *}

  Specifies that the semicolon separated LDAP display names included in for each entry in the result set. If you specify the value of this parameter as a wildcard character (*), this parameter displays all attributes that are present

  on the object in the result set. In addition, if you specify a *, this parameter uses the default output format (a list), regardless of whether you specify the -l parameter.

  The default is a distinguished name.

  Reference 2:

  http://social.technet.microsoft.com/Forums/eu/winserverDS/thread/dda5fcd6-1a10-4d47-9379- 02ca38aaa65b

  Gives an example of how to find a user with certain attributes using Dsquery. Note that it uses domainroot as the startnode, instead of forestroot what we need.

  Reference 3:

  http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/c6fc3826-78e1-48fd-ab6f- 690378e0f787/

  List all last login times for all users, regardless of whether they are disabled. dsquery * -filter "(and(objectCategory=user)(objectClass=user))" -limit 0 -attr givenName

  sn sAMAccountName

  lastLogon>>c:\last_logon_for_all.txt

• Question 464:

  Your network contains an Active Directory domain. The domain contains 3,000 client computers. All of the client computers run Windows 7.

  Users log on to their client computers by using standard user accounts.

  You plan to deploy a new application named App1.

  The vendor of App1 provides a Setup.exe file to install App1. Setup.exe requires administrative rights to run.

  You need to deploy App1 to all client computers. The solution must meet the following requirements:

  

  App1 must automatically detect and replace corrupt application files.

  

  App1 must be available from the Start menu on each client computer.

  What should you do first?

  A. Create a logon script that calls Setup.exe for App1.
  B. Create a .zap file.
  C. Create a startup script that calls Setup.exe for App1.
  D. Repackage App1 as a Windows Installer package.
  D. Repackage App1 as a Windows Installer package.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc739578.aspx

  Windows Installer features Diagnoses and repairs corrupted applications--An application can query Windows Installer to determine whether an installed application has missing or corrupted files. If any are detected, Windows Installer repairs

  the application by recopying only those files found to be missing or corrupted.

• Question 465:

  You deploy a certification authority (CA) named CA1. CA1 will be used to issue a large number of temporary certificates to provide users with access to public wireless access points (WAPs).

  You create a certificate template named Template1. You enable the Do not store certificates and requests in the CA database option.

  You need to configure CA1 to ensure that certificate requests and issued certificates for Template1 are not stored in the CA database.

  Which command should you run?

  A. certutil -setreg DBFlags +DBFLAGS_MAXCACHESIZEX100
  B. certutil -setreg DBFlags +DBFLAGS_CREATEIFNEEDED
  C. certutil -setreg DBFlags -DBFLAGS_LOGBUFFERSHUGE
  D. certutil -setreg DBFlags +DBFLAGS_ENABLEVOLATILEREQUESTS
  D. certutil -setreg DBFlags +DBFLAGS_ENABLEVOLATILEREQUESTS

• Question 466:

  You are the network administrator for your organization.

  Your company uses a Windows Server 2008 R2 Enterprise Root CA.

  The company has issued a new policy that prevents port 443 and port 80 from being opened on domain controllers and on issuing CAs.

  Your users need to request certificates from a web interface.

  You have already installed the AD CS role.

  What do you need to do next?

  A. Configure the Certificate Authority Web Enrollment Service on a member server.
  B. Configure the Certificate Authority Web Enrollment Service on a domain server.
  C. Configure AD FS on member server to allow secure web-based access.
  D. Configure AD FS on domain controller to allow secure web-based access.
  A. Configure the Certificate Authority Web Enrollment Service on a member server.

  ---

  Basically the same as A/Q41:

  http://technet.microsoft.com/en-us/library/dd759209.aspx

  Certificate Enrollment Web Service Overview

  The Certificate Enrollment Web Service is an Active Directory Certificate Services (AD CS) role service that enables users and computers to perform certificate enrollment by using the HTTPS protocol. Together with the Certificate Enrollment

  Policy Web Service, this enables policy-based certificate enrollment when the client computer is not a member of a domain or when a domain member is not connected to the domain.

  Personal note:

  Since domain controllers are off-limits (regarding open ports), you are left to install the Certificate Enrollment Web Service role service on a plain member server

• Question 467:

  Your network contains an Active Directory forest. The forest contains multiple domains.

  You need to ensure that users in the human resources department can search for employees by using the employeeNumber attribute.

  What should you do?

  A. From Active Directory Sites and Services, modify the properties of each global catalog server.
  B. From the Active Directory Schema snap-in, modify the properties of the user object class.
  C. From Active Directory Sites and Services, modify the NTDS Settings objectof each global catalog server.
  D. From the Active Directory Schema snap-in, modify the properties of the employeeNumber attribute.
  D. From the Active Directory Schema snap-in, modify the properties of the employeeNumber attribute.

  ---

  Reference: http://technet.microsoft.com/en-us/library/how-global-catalog-servers-work.aspx Global Catalog Replication of Additions to the Partial Attribute Set Each global catalog server in an AD DS forest hosts a copy of every existing object in that forest. For the objects of its own domain, a global catalog server has information related to all attributes that are associated with those objects. For the objects in domains other than its own, a global catalog server has only information that is related to the set of attributes that are marked in the AD DS schema to be included in the partial attribute set (PAS). As described earlier, the PAS is defined by Microsoft as those attributes that are most likely to be used for searches. These attributes are replicated to every global catalog server in an AD DS forest." "The attributes that are replicated to the global catalog by default include a base set that have been defined by Microsoft as the attributes that are most likely to be used in searches. Administrators can use the Microsoft Management Console (MMC) Active Directory Schema snap-in to specify additional attributes to meet the needs of their installation. In the Active Directory Schema snap-in, you can select the Replicate this attribute to the global catalog check box to designate an attributeSchema object as a member of the PAS, which sets the value of the isMemberOfPartialAttributeSet attribute to TRUE.

• Question 468:

  All vendors belong to a global group named vendors.

  You place three file servers in a new organizational unit (OU) named ConfidentialFileServers. The three file servers contain confidential data located in shared folders.

  You need to record any failed attempts made by the vendors to access the confidential data.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Create a new Group Policy Object (GPO) and link it to the ConfidentialFileServers OU. Configure the Audit object access failure audit policy setting.
  B. Create a new Group Policy Object (GPO) and link it to the ConfidentialFileServers OU. Configure the Audit privilege use Failure audit policy setting.
  C. On each shared folder on the three file servers, add the Vendors global group to the Auditing tab. Configure Failed Full control setting in the AuditingEntry dialog box.
  D. On each shared folder on the three file servers, add the three servers to the Auditing tab. Configure Failed Full control setting in the AuditingEntry dialog box.
  E. Create a new Group Policy Object (GPO) and link it to the ConfidentialFileServers OU. Configure the Deny access to this computer from the network user rights setting for the Vendors global group.
  A. Create a new Group Policy Object (GPO) and link it to the ConfidentialFileServers OU. Configure the Audit object access failure audit policy setting.
  C. On each shared folder on the three file servers, add the Vendors global group to the Auditing tab. Configure Failed Full control setting in the AuditingEntry dialog box.

  ---

  Reference:

  Windows Server 2008 R2 Unleashed (SAMS, 2010) page 671

  Auditing Resource Access Object access can be audited, although it is not one of the recommended settings. Auditing object access can place a significant load on the servers, so it should only be enabled when it is specifically needed.

  Auditing object access is a two-step process: Step one is enabling "Audit object access" and step two is selecting the objects to be audited. When enabling Audit object access, you need to decide if both failure and success events will be

  logged. The two options are as follows:

  Audit object access failure enables you to see if users are attempting to access objects to which they have no rights. This shows unauthorized attempts.

  Audit object access success enables you to see usage patterns. This shows misuse of privilege. After object access auditing is enabled, you can easily monitor access to resources such as folders, files, and printers.

  Auditing Files and Folders

  The network administrator can tailor the way Windows Server 2008 R2 audits files and folders through the property pages for those files or folders. Keep in mind that the more files and folders that are audited, the more events that can be

  generated, which can increase administrative overhead and system resource requirements.

  Therefore, choose wisely which files and folders to audit. To audit a file or folder, do the following:

  1.

  In Windows Explorer, right-click the file or folder to audit and select Properties.

  2.

  Select the Security tab and then click the Advanced button.

  3.

  In the Advanced Security Settings window, select the Auditing tab and click the Edit button.

  4.

  Click the Add button to display the Select User or Group window.

  5.

  Enter the name of the user or group to audit when accessing the file or folder. Click the Check Names button to verify the name.

• Question 469:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2.

  You need to capture all replication errors from all domain controllers to a central location.

  What should you do?

  A. Start the Active Directory Diagnostics data collector set.
  B. Start the System Performance data collector set.
  C. Install Network Monitor and create a new a new capture.
  D. Configure event log subscriptions.
  D. Configure event log subscriptions.

  ---

  http://technet.microsoft.com/en-us/library/cc748890.aspx Configure Computers to Forward and Collect Events

  Before you can create a subscription to collect events on a computer, you must configure both the collecting computer (collector) and each computer from which events will be collected (source). http://technet.microsoft.com/en-us/library/ cc749183.aspx Event Subscriptions

  Event Viewer enables you to view events on a single remote computer. However, troubleshooting an issue might require you to examine a set of events stored in multiple logs on multiple computers. Windows Vista includes the ability to collect copies of events from multiple remote computers and store them locally. To specify which events to collect, you create an event subscription. Among other details, the subscription specifies exactly which events will be collected and in which log they will be stored locally. Once a subscription is active and events are being collected, you can view and manipulate these forwarded events as you would any other locally stored events. Using the event collecting feature requires that you configure both the forwarding and the collecting computers.

  The functionality depends on the Windows Remote Management (WinRM) service and the Windows Event Collector (Wecsvc) service. Both of these services must be running on computers participating in the forwarding and collecting process.

  http://technet.microsoft.com/en-us/library/cc961808.aspx Replication Issues

• Question 470:

  Your network contains an Active Directory domain named contoso.com.

  A portion of the Group Policy object (GPO) settings for a computer in the contoso.com domain is configured as shown in the following exhibit. (Click the Exhibit button.)

  

  To answer, complete each statement according to the information presented in the exhibit.

  Hot Area: