Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 471:

  You have an enterprise subordinate certification authority (CA). You have a custom certificate template that has a key length of 1,024 bits. The template is enabled for autoenrollment.

  You increase the template key length to 2,048 bits.

  You need to ensure that all current certificate holders automatically enroll for a certificate that uses the new template.

  Which console should you use?

  A. Group Policy Management MMC Snap-In
  B. Certificates MMC Snap-In on the Certificate Authority
  C. Certificate Templates MMC Snap-In
  D. Certification Authority MMC Snap-In
  C. Certificate Templates MMC Snap-In

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc771246.aspx

  Re-Enroll All Certificate Holders This procedure is used when a critical change is made to the certificate template and you want all subjects that hold a certificate that is based on this template to re-enroll as quickly as possible. The next time the subject verifies the version of the certificate against the version of the template on the certification authority (CA), the subject will re-enroll.

  Membership in Domain Admins or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. For more information, see Implement Role-Based Administration. To re-enroll all certificate holders

  1.

  Open the Certificate Templates snap-in.

  2.

  Right-click the template that you want to use, and then click Reenroll All Certificate Holders.

• Question 472:

  Your network contains an Active Directory domain named adatum.com. The functional level of the domain is Windows Server 2003. All domain controllers run Windows Server 2008 R2.

  You mount an Active Directory snapshot.

  You need to ensure that you can connect to the snapshot by using LDAP.

  What should you do?

  A. Run the Get-ADDomain cmdlet.
  B. Run the dsget.exe command.
  C. Run the ntdsutil.exe command.
  D. Run the ocsetup.exe command.
  E. Run the dsamain.exe command.
  F. Run the eventcreate.exe command,
  G. Create a Data Collector Set (DCS).
  H. Create custom views from Event Viewer.
  I. Configure subscriptions from Event Viewer.
  J. Import the Active Directory module for Windows PowerShell.
  E. Run the dsamain.exe command.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc753609.aspx

  The Active Directory database mounting tool (Dsamain.exe) can improve recovery processes for your organization by providing a means to compare data as it exists in snapshots that are taken at different times so that you can better decide

  which data to restore after data loss. This eliminates the need to restore multiple backups to compare the Active Directory data that they contain.

  Requirements for using the Active Directory database mounting tool You do not need any additional software to use the Active Directory database mounting tool.

  All the tools that are required to use this feature are built into Windows Server 2008 and are available if you have the AD DS or the AD LDS server role installed.

  These tools include the following: (...) Dsamain.exe, which you can use to expose the snapshot data as an LDAP server Existing LDAP tools, such as Ldp.exe and Active Directory Users and Computers

• Question 473:

  Your network contains an Active Directory domain named contoso.com. Contoso.com contains a member server that runs Windows Server 2008 Standard.

  You need to install an enterprise subordinate certification authority (CA) that supports private key archival.

  You must achieve this goal by using the minimum amount of administrative effort.

  What should you do first?

  A. Initialize the Trusted Platform Module (TPM).
  B. Upgrade the member server to Windows Server 2008 R2 Standard.
  C. Install the Certificate Enrollment Policy Web Service role service on the member server.
  D. Run the Security Configuration Wizard (SCW) and select the Active Directory Certificate Services - Certification Authority server role template check box.
  B. Upgrade the member server to Windows Server 2008 R2 Standard.

  ---

  Not sure about this one. See my thoughts below.

  to MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) key archival is not available in the Windows Server 2008 R2 Standard edition, so that would leave out answer B.

  

  Another dump gives the following for answer B:

  "Upgrade the menber [sic] server to Windows Server 2008 R2 Enterprise." Should the actual exam mention to upgrade to the Enterprise edition for answer B, I'd go for that. In this VCE it doesn't seem to make sense to go for B as it shouldn't

  work, I think. Certificate Enrollment Policy Web Service role of answer C was introduced in Windows Server 2008 R2, so that would not be an option on the mentioned Windows Server 2008 machine. Trusted Platform Module is "a secure

  cryptographic integrated circuit (IC), provides a hardware-based approach to manage user authentication, network access, data protection and more that takes security to higher level than software-based security."

  (http://www.trustedcomputinggroup.org/resources/

  how_to_use_the_tpm_a_guide_to_hardwarebased_endpoint_security/) Pfff... I'm bothered that answer B speaks of the Standard edition, and not the Enterprise edition. Hope the VCE is wrong.

• Question 474:

  Your network contains an Active Directory domain named contoso.com. Contoso.com contains two domain controllers named DC1 and DC2. DC1 and DC2 are configured as DNS servers and host the Active Directoryintegrated zone for contoso.com.

  From DNS Manager on DC1, you enable scavenging for the contoso.com zone.

  You discover stale DNS records in the zone.

  You need to ensure that the stale DNS records are deleted from contoso.com.

  What should you do?

  A. From DNS Manager, enable scavenging on DC1.
  B. From DNS Manager, reload the zone.
  C. Run dnscmd.exe and specify the ageallrecords parameter.
  D. Run dnscmd.exe and specify the startscavenging parameter.
  A. From DNS Manager, enable scavenging on DC1.

  ---

  According to Technet the answer should be A ("From DNS Manager, enable scavenging on DC1"). Scavenging has been enabled for the zone, but it also needs te be enabled on the server.

  Reference: http://technet.microsoft.com/en-us/library/cc771677.aspx Prerequisites for aging and scavenging

  Before you can use the aging and scavenging features of DNS, several conditions must be met: Scavenging and aging must be enabled, both at the DNS server and on the zone.

• Question 475:

  Your company, Contoso Ltd has a main office and a branch office. The offices are connected by a WAN link. Contoso has an Active Directory forest that contains a single domain named ad.contoso.com.

  The ad.contoso.com domain contains one domain controller named DC1 that is located in the main office. DC1 is configured as a DNS server for the ad.contoso.com DNS zone. This zone is configured as a standard primary zone.

  You install a new domain controller named DC2 in the branch office. You install DNS on DC2. You need to ensure that the DNS service can update records and resolve DNS queries in the event that aWAN link fails.

  What should you do?

  A. Create a new stub zone named ad.contoso.com on DC2.
  B. Create a new standard secondary zone named ad.contoso.com on DC2.
  C. Configure the DNS server on DC2 to forward requests to DC1.
  D. Convert the ad.contoso.com zone on DC1 to an Active Directory-integrated zone.
  D. Convert the ad.contoso.com zone on DC1 to an Active Directory-integrated zone.

  ---

  Answer: Convert the ad.contoso.com zone on DC1 to an Active Directory-integrated zone.

  http://technet.microsoft.com/en-us/library/cc726034.aspx Understanding Active Directory Domain Services Integration The DNS Server service is integrated into the design and implementation of Active Directory Domain Services (AD DS).

  AD DS provides an enterprise-level tool for organizing, managing, and locating resources in a network.

  How DNS integrates with AD DS

  When you install AD DS on a server, you promote the server to the role of a domain controller for a specified domain. As part of this process, you are prompted to specify a DNS domain name for the AD DS domain which you are joining and

  for which you are promoting the server, and you are offered the option to install the DNS Server role. This option is provided because a DNS server is required to locate this server or other domain controllers for members of an AD DS domain.

  Benefits of AD DS integration

  For networks that deploy DNS to support AD DS, directory-integrated primary zones are strongly recommended. They provide the following benefits:

  DNS features multimaster data replication and enhanced security based on the capabilities of AD DS. In a standard zone storage model, DNS updates are conducted based on a single-master update model. In this model, a single

  authoritative DNS server for a zone is designated as the primary source for the zone.

  This server maintains the master copy of the zone in a local file. With this model, the primary server for the zone represents a single fixed point of failure. If this server is not available, update requests from DNS clients are not processed for

  the zone. With directory-integrated storage, dynamic updates to DNS are sent to any AD DS-integrated DNS server and are replicated to all other AD DS-integrated DNS servers by means of AD DS replication. In this model, any AD DS-

  integrated DNS servercan accept dynamic updates for the zone. Because the master copy of the zone is maintained in the AD DS database, which is fully replicated to all domain controllers, the zone can be updated by the DNS servers

  operating at any domain controller for the domain. With the multimaster update model of AD DS, any of the primary servers for the directoryintegrated zone can process requests from DNS clients to update the zone as long as a domain

  controller is available and reachable on the network.

  Also, when you use directory-integrated zones, you can use access control list (ACL) editing to secure a dnsZone object container in the directory tree. This feature provides detailed access to either the zone or a specified resource record in

  the zone. For example, an ACL for a zone resource record can be restricted so that dynamic updates are allowed only for a specified client computer or a secure group, such as a domain administrators group. This security feature is not

  available with standard primary zones.

  Zones are replicated and synchronized to new domain controllers automatically whenever a new one is added to an AD DS domain.

  By integrating storage of your DNS zone databases in AD DS, you can streamline database replication planning for your network.

  Directory-integrated replication is faster and more efficient than standard DNS replication.

  Further information.

• Question 476:

  Your network contains an Active Directory forest. The functional level of the forest is Windows Server 2008 R2.

  Your company's corporate security policy states that the password for each user account must be changed at least every 45 days.

  You have a user account named Service 1. Servicel is used by a network application named Application1.

  Every 45 days, Applicationl fails.

  After resetting the password for Servicel, Applicationl runs properly. You need to resolve the issue that causes Applicationl to fail. The solution must adhere to the corporate security policy.

  What should you do?

  A. Create a new password policy.
  B. Run the Set-ADServiceAccount cmdlet.
  C. Run the Set-ADAccountControl cmdlet.
  D. Create a new Password Settings object (PSO).
  B. Run the Set-ADServiceAccount cmdlet.

• Question 477:

  A corporate network includes a single Active Directory Domain Services (AD DS) domain. All regular user accounts reside in an organizational unit (OU) named Employees. All administrator accounts reside in an OU named Admins.

  You need to ensure that any time an administrator modifies an employee's name in AD DS, the change is audited.

  What should you do first?

  A. Enable the Audit directory service access setting in the Default Domain Controllers Policy Group PolicyObject.
  B. Create a Group Policy Object with the Audit directory service access setting enabled and link it to the Employees OU.
  C. Enable the Audit directory service access setting in the Default Domain Policy Group Policy Object.
  D. Modify the searchFlags property for the User class in the schema.
  A. Enable the Audit directory service access setting in the Default Domain Controllers Policy Group PolicyObject.

  ---

  To audit changes made to objects in AD DS we have to use Directory Service Changes auditing, which indicates the old and new values of the changed properties of the objects that were changed. DirectoryService Changes auditing is a

  subcategory of Audit directory service access, and is not enabled by default.

  To use it we have to enable it first, and we can do that specifically for Directory Service Changes by using auditpol.exe, or we can use Group Policy Management to enable Audit directory service access, which enables all subcategories,

  including Directory Service Changes. You do this by modifying the Default Domain Controllers Policy.

  Reference:

  http://technet.microsoft.com/en-us/library/cc731607.aspx

  In Windows 2000 Server and Windows Server 2003, there was one audit policy, Audit directory service access, that controlled whether auditing for directory service events was enabled or disabled. In Windows Server 2008, this policy is

  divided into four subcategories:

  

  Directory Service Access

  

  Directory Service Changes

  

  Directory Service Replication

  

  Detailed Directory Service Replication

  This step includes procedures to enable change auditing with either the Windows interface or a command line:

  By using Group Policy Management, you can turn on the global audit policy, Audit directory service access, which enables all the subcategories for AD DS auditing.

  To enable the global audit policy using the Windows interface

  1.

  Click Start, point to Administrative Tools, and then Group Policy Management.

  2.

  In the console tree, double-click the name of the forest, double-click Domains, double-click the name of your domain, double-click Domain Controllers, right-click Default Domain Controllers Policy, and then click Edit.

  3.

  Under Computer Configuration, double-click Policies, double-click Windows Settings, double-click Security Settings, double-click Local Policies, and then click Audit Policy.

  4.

  In the details pane, right-click Audit directory service access, and then click Properties.

  5.

  Select the Define these policy settings check box.

  6.

  Under Audit these attempts, select the Success, check box, and then click OK.

• Question 478:

  A server named DC1 has the Active Directory Domain Services (AD DS) role and the Active Directory Lightweight Directory Services (AD LDS) role installed. An AD LDS instance named LDS1 stores its data on the C: drive.

  You need to relocate the LDS1 instance to the D: drive.

  Which three actions should you perform in sequence? (To answer, move the three appropriate actions from the list of actions to the answer area and arrange them in the correct order.)

  Select and Place:

  

  

  ---

  Reference:

  http://www.ucertify.com/blog/windows-server-2008-tools-used-for-configuring-and-maintaining-activedirectory.html

  NTDSUTIL

  NTDSUTIL.EXE is a command-line tool that is used to manage Active Directory.

  Important Usage

  To relocate AD LDS directory partition, use the NTDSUTIL tool. Take the following steps:

  Stop the LDS by using the net stop command.

  Move the Database file through NTDSUTIL tool.

  Start the directory service using the net start command.

• Question 479:

  You are hired as a consultant by ABC Corporation to implement a Windows Server 2008 R2 computer onto their Windows Server 2003 domain.

  All of the client machines are Windows 7.

  You install Windows Server 2008 R2 onto a new computer and join that computer to the Windows 2003 domain.

  You want to upgrade the Windows Server 2008 R2 to a domain controller.

  What should you do first?

  A. On the new server, run adprep /domainprep.
  B. On the new server, run adprep /forestprep.
  C. On a Windows Server 2003 domain controller, run adprep /domainprep.
  D. On a Windows Server 2003 domain controller, run adprep /forestprep.
  D. On a Windows Server 2003 domain controller, run adprep /forestprep.

  ---

  http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/9931e32f-6302-40f0-a7a1- 2598a96cd0c1/ DC promotion and adprep/forestprep

  Q: I've tried to dcpromo a new Windows 2008 server installation to be a Domain Controller, running in an existing domain. I am informed that, first, I must run adprep/forestprep ("To install a domain controller into this Active Directory forest, you must first perpare the forest using "adprep/forestprep". The Adprep utility is available on the Windows Server 2008 installation media in the Windows\sources\adprep folder"

  A1:

  You can run adprep from an existing Windows Server 2003 domain controller. Copy the contents of the\sources\adprep folder from the Windows Server 2008 installation DVD to the schema master role holder and run Adprep from there.

  A2:

  to introduce the first W2K8 DC within an AD forest....

  (1)

  no AD forest exists yet:

  --> on the stand alone server execute: DCPROMO

  --> and provide the information needed

  (2)

  an W2K or W2K3 AD forest already exists:

  --> ADPREP /Forestprep on the w2k/w2k3 schema master (both w2k/w2k3 forests) --> ADPREP /rodcprep on the w2k3 domain master (only w2k3 forests) -->ADPREP /domainprep on the w2k3 infrastructure master (only w2k3 domains) -->

  ADPREP /domainprep /gpprep on the w2k infrastructure master (only w2k domains) --> on the stand alone server execute: DCPROMO

  --> and provide the information needed

• Question 480:

  Your network contains two servers named Server1 and Server2 that run Windows Server 2008 R2. Server1 has Active Directory Federation Services (AD FS) 2.0 installed.

  Server1 is a member of an AD FS farm. The AD FS farm is configured to use a configuration database that is stored on a separate Microsoft SQL Server.

  You install AD FS 2.0 on Server2.

  You need to add Server2 to the existing AD FS farm.

  What should you do?

  A. On Server1, run fsconfig.exe.
  B. On Server1, run fsconfigwizard.exe.
  C. On Server2, run fsconfig.exe.
  D. On Server2, run fsconfigwizard.exe.
  C. On Server2, run fsconfig.exe.

  ---

  http://technet.microsoft.com/en-us/library/adfs2-help-how-to-configure-a-new-federation-server.aspx

  Configure a New Federation Server To configure a new federation server using the command line

  1.

  Open a Command Prompt window.

  2.

  Change the directory to the path where AD FS 2.0 was installed.

  3.

  To configure this computer as a federation server, type the applicable syntax using either of the following command parameters, and then press ENTER:

  fsconfig.exe {StandAlone|CreateFarm| CreateSQLFarm|JoinFarm|JoinSQLFarm} [deployment specific parameters] Parameter JoinSQLFarm Joins this computer to an existing federation server farm that is using SQL Server.