Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 481:

  Your network consists of an Active Directory forest that contains one domain named contoso.com. All domain controllers run Windows Server 2008 R2 and are configured as DNS servers. You have two Active Directory-integrated zones: contoso.com and nwtraders.com.

  You need to ensure a user is able to modify records in the contoso.com zone. You must prevent the user from modifying the SOA record in the nwtraders.com zone.

  What should you do?

  A. From the Active Directory Users and Computers console, run the Delegation of Control Wizard.
  B. From the Active Directory Users and Computers console, modify the permissions of the Domain Controllers organizational unit (OU).
  C. From the DNS Manager console, modify the permissions of the contoso.com zone.
  D. From the DNS Manager console, modify the permissions of the nwtraders.com zone.
  C. From the DNS Manager console, modify the permissions of the contoso.com zone.

  ---

  Answer: From the DNS Manager console, modify the permissions of the contoso.com zone. http://technet.microsoft.com/en-us/library/cc753213.aspx Modify Security for a Directory-Integrated Zone

  You can manage the discretionary access control list (DACL) on the DNS zones that are stored in Active Directory Domain Services (AD DS). You can use the DACL to control the permissions for the Active Directory users and groups that may control the DNS zones.

  Membership in DnsAdmins or Domain Admins in AD DS, or the equivalent, is the minimum required to complete this procedure.

  To modify security for a directory-integrated zone:

  1.

  Open DNS Manager.

  2.

  In the console tree, click the applicable zone.

  Where?

  DNS/applicable DNS server/Forward Lookup Zones (or Reverse Lookup Zones)/applicable zone

  3.

  On the Action menu, click Properties.

  4.

  On the General tab, verify that the zone type is Active Directory-integrated.

  5.

  On the Security tab, modify the list of member users or groups that are allowed to securely update the applicable zone and reset their permissions as needed.

  Further information:

  http://support.microsoft.com/kb/163971

  The Structure of a DNS SOA Record

  The first resource record in any Domain Name System (DNS) Zone file should be a Start of Authority (SOA) resource record. The SOA resource record indicates that this DNS name server is the best source of information for the data within

  this DNS domain.

  The SOA resource record contains the following information:

  Source host - The host where the file was created.

  Contact e-mail - The e-mail address of the person responsible for administering the domain's zone file. Note that a "." is used instead of an "@" in the e-mail name.

  Serial number - The revision number of this zone file. Increment this number each time the zone file is changed. It is important to increment this value each time a change is made, so that the changes will be distributed to any secondary DNS

  servers.

  Refresh Time - The time, in seconds, a secondary DNS server waits before querying the primary DNS server's SOA record to check for changes. When the refresh time expires, the secondary DNS server requests a copy of the current SOA

  record from the primary. The primary DNS server complies with this request.

  The secondary DNS server compares the serial number of the primary DNS server's current SOA record and the serial number in it's own SOA record. If they are different, the secondary DNS server will request a zone transfer from the

  primary DNS server. The default value is 3,600.

  Retry time - The time, in seconds, a secondary server waits before retrying a failed zone transfer. Normally, the retry time is less than the refresh time. The default value is 600. Expire time - The time, in seconds, that a secondary server will

  keep trying to complete a zone transfer. If this time expires prior to a successful zone transfer, the secondary server will expire its zone file. This means the secondary will stop answering queries, as it considers its data too old to be reliable.

  The default value is 86,400.

  Minimum TTL - The minimum time-to-live value applies to all resource records in the zone file. This value is supplied in query responses to inform other servers how long they should keep the data in cache. The default value is 3,600.

  http://technet.microsoft.com/en-us/library/cc787600%28v=ws.10%29.aspx Modify the start of authority (SOA) record for a zone

  ..

  Notes: To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins

  group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

• Question 482:

  Your network contains an Active Directory domain named contoso.com. The network has a branch office site that contains a read-only domain controller (RODC) named RODC1. RODC1 runs Windows Server 2008 R2.

  A user named User1 logs on to a computer in the branch office site. You discover that the password of User1 is not stored on RODC1. You need to ensure that User1's password is stored on RODC1.

  What should you modify?

  A. the Member Of properties of RODC1
  B. the Member Of properties of User1
  C. the Security properties of RODC1
  D. the Security properties of User1
  B. the Member Of properties of User1

  ---

  http://technet.microsoft.com/en-us/library/rodc-guidance-for-administering-the-password-replication- policy%28v=ws.10%29.aspx

  Administering the Password Replication Policy

  Personal comment:

  Basically, these are the default settings for the Password Replication Policy of a specific RODC:

  

  So, if you would add a user to be a member of a group that is allowed to store passwords on that specific RODC, then that user's password would be stored on that RODC.

  

• Question 483:

  Your network contains an Active Directory domain. The domain contains a server named Server1.Server1 runs Windows Server 2008 R2.

  You need to mount an Active Directory Lightweight Directory Services (AD LDS) snapshot from Server1.

  What should you do?

  A. Run ldp.exe and use the Bind option.
  B. Run diskpart.exe and use the Attach option.
  C. Run dsdbutil.exe and use the snapshot option.
  D. Run imagex.exe and specify the /mount parameter.
  C. Run dsdbutil.exe and use the snapshot option.

  ---

  http://technet.microsoft.com/en-us/library/cc753151%28v=ws.10%29.aspx Dsdbutil

  Performs database maintenance of the Active Directory Domain Services (AD DS) store, facilitates configuration of Active Directory Lightweight Directory Services (AD LDS) communication ports, and views AD LDS instances that are installed on a computer. Commands snapshot Manages snapshots. http://technet.microsoft.com/en-us/library/cc731620%28v=ws.10%29.aspx snapshot Manages snapshots of the volumes that contain the Active Directory database and log files, which you can view on a domain controller without starting in Directory Services Restore Mode (DSRM). You can also run the snapshot subcommand on an Active Directory Lightweight Directory Services (AD LDS) server. This is a subcommand of Ntdsutil and Dsdbutil. Ntdsutil and Dsdbutil are command-line tools that are built into Windows Server 2008 and Windows Server 2008 R2. Syntax activate instance %s [create] [delete %s] [unmount %s] [list all] [list mounted ] [mount %s] [quit] Parameters Mount %s Mounts a snapshot with GUID %s. You can refer to an index number of any mounted snapshot instead of its GUID.

• Question 484:

  Your network contains an Active Directory domain. The domain contains several domain controllers.All domain controllers run Windows Server 2008 R2. You need to restore the Default Domain Controllers Policy Group Policy object (GPO) to the Windows Server 2008 R2 default settings.

  What should you do?

  A. Run dcgpofix.exe /target:dc.
  B. Run dcgpofix.exe /target:domain.
  C. Delete the link for the Default Domain Controllers Policy, and then run gpupdate.exe /sync.
  D. Delete the link for the Default Domain Controllers Policy, and then run gpupdate.exe /force.
  A. Run dcgpofix.exe /target:dc.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/hh875588.aspx

  Dcgpofix Recreates the default Group Policy Objects (GPOs) for a domain.

  Syntax

  DCGPOFix [/ignoreschema] [/target: {Domain | DC | Both}] [/?] /ignoreschema Ignores the version of the Active Directory?schema when you run this command.

  Otherwise, the command only works on the same schema version as the Windows version in which the command was shipped.

  /target {Domain | DC | Both} Specifies which GPO to restore. You can restore the Default Domain Policy GPO, the Default Domain Controllers GPO, or both.

  Examples

  Restore the Default Domain Controllers Policy GPO to its original state. You will lose any changes that you have made to this GPO. dcgpofix /ignoreschema /target:DC

• Question 485:

  Your network contains an Active Directory forest named contoso.com. You need to use Group Policies to deploy the applications shown in the following table.

  

  What should you do?

  To answer, drag the appropriate deployment method to the correct application in the answer area.

  Select and Place:

  

  

  ---

  Reference:

  technet.microsoft.com/en-us/library/cc783502.aspx

  Software installation You can use the Software Installation extension of Group Policy to centrally manage software distribution in your organization. You can assign and publish software

  for groups of users and computers using this extension.

  Assigning Applications

  When you assign applications to users or computers, the applications are automatically installed on their computers at logon (for user-assigned applications) or startup (for computer-assigned applications.)

  When assigning applications to users, the default behavior is that the application will be advertised to the computer the next time the user logs on. This means that the application shortcut appears on the Start menu, and the registry is updated

  with information about the application, including the location of the application package and the location of the source files

  for the installation. With this advertisement information on the user's computer, the application is installed the first time the user tries to use the application. In addition to this default behavior, Windows XP Professional and Windows Server

  2003 clients support an option to fully install the package at logon, as an alternative to installation upon first use. Note that if this option is set, it is ignored by computers running Windows 2000, which will always advertise user-assigned

  applications.

  When assigning applications to computers, the application is installed the next time the computer boots up.

  Applications assigned to computers are not advertised, but are installed with the default set of features configured for the package. Assigning applications through Group Policy requires that the application setup is authored as a Windows

  Installer (.msi) package.

  Publishing Applications

  You can also publish applications to users, making the application available for users to install.

  To install a published application, users can use Add or Remove Programs in Control Panel, which includes a list of all published applications that are available for them to install.

  Alternatively, if the administrator has selected the Auto-install this application by file extension activation feature, users can open a document file associated with a published application. For example, double clicking an .xls file will trigger the

  installation of Microsoft Excel, if it is not already installed. Publishing applications only applies to user policy; you cannot publish

  applications to computers.

• Question 486:

  You have an enterprise subordinate certification authority (CA).

  You have a group named Group1.

  You need to ensure that members of Group1 can revoke certificates.

  What should you do?

  A. Add Group1 to the Certificate Publishers group.
  B. Assign the Issue and Manage Certificates permission to Group1.
  C. Assign the Manage CA permission to Group1.
  D. Add Group1 to the local Administrators group.
  D. Add Group1 to the local Administrators group.

• Question 487:

  Your network contains three Active Directory forests named Forest1, Forest2, and Forest3. Each forest contains three domains. A two-way forest trust exists between Forest1 and Forest2. A two-way forest trust exists between Forest2 andForest3.

  You need to configure the forests to meet the following requirements:

  

  Users in Forest3 must be able to access resources in Forest1

  

  Users in Forest1 must be able to access resources in Forest3.

  

  The number of trusts must be minimized.

  What should you do?

  A. In Forest2, modify the name suffix routing settings.
  B. In Forest1 and Forest3, configure selective authentication.
  C. In Forest1 and Forest3, modify the name suffix routing settings.
  D. Create a two-way forest trust between Forest1 and Forest3.
  E. Create a shortcut trust in Forest1 and a shortcut trust in Forest3.
  D. Create a two-way forest trust between Forest1 and Forest3.

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, December 14 2012) page 639:

  Forest Trusts

  (...)

  You can specify whether the forest trust is one-way, incoming or outgoing, or two-way. As mentioned earlier, a forest trust is transitive, allowing all domains in a trusting forest to trust all domains in a trusted forest. However, forest trusts are

  not themselves transitive. For example, if the tailspintoys.com forest trusts the worldwideimporters .com forest, and the worldwideimporters.com forest trusts the northwindtraders.com forest, those two trust relationships do not allow the

  tailspintoys.com forest to trust the northwindtraders.com forest. If you want those two forests to trust each other, you must create a specific forest trust between them.

• Question 488:

  A corporate network includes a single Active Directory Domain Services (AD DS} domain. The HR department has a dedicated organization unit (OU) named HR.

  The HR OU has two sub-OUs:

  HR Users and HR Computers. User accounts for the HR department reside in the HR Users OU. Computer accounts for the HR department reside in the HR Computers OU. All HR department employees belong to a security group named

  HR Employees. All HR department computers belong to a security group named HR PCs.

  Company policy requires that passwords are a minimum of six characters.

  You need to ensure that, the next time HR department employees change their passwords, the passwords are required to have at least eight characters. The password length requirement should not change for employees of any other

  department.

  What should you do?

  A. Modify the local security policy on each computer in the HR PCs group.
  B. Create a fine-grained password policy and apply it to the HR Employees group.
  C. Create a new GPO, with the necessary password policy, and link it to the HR Computers OU.
  D. Create a fine-grained password policy and apply it to the HR Computers OU.
  C. Create a new GPO, with the necessary password policy, and link it to the HR Computers OU.

• Question 489:

  Your network contains a server that runs Windows Server 2008 R2. The server is configured as an enterprise root certification authority (CA).

  You have a Web site that uses x.509 certificates for authentication. The Web site is configured to use a manyto-one mapping.

  You revoke a certificate issued to an external partner. You need to prevent the external partner from accessing the Web site.

  What should you do?

  A. Run certutil.exe -crl.
  B. Run certutil.exe -delkey.
  C. From Active Directory Users and Computers, modify the membership of the IIS_IUSRS group.
  D. From Active Directory Users and Computers, modify the Contact object for the external partner.
  A. Run certutil.exe -crl.

  ---

  http://technet.microsoft.com/library/cc732443.aspx

  Certutil

  Certutil.exe is a command-line program that is installed as part of Certificate Services. You can use Certutil.exe to dump and display certification authority (CA) configuration information, configure Certificate Services, backup and restore CA

  components, and verify certificates, key pairs, and certificate chains.

  Verbs -CRL

  Publish new certificate revocation lists (CRLs) [or only delta CRLs] http://technet.microsoft.com/en-us/library/cc783835%28v=ws.10%29.aspx Requesting Offline Domain Controller Certificates (Advanced Certificate Enrollment and

  Management)

  If you have determined the keycontainername for a specific certificate, you can delete the key container with the following command.

  certutil.exe -delkey

  The -delkey option is supported only with the Windows Server 2003 version of certutil. On Windows 2000, you must add a prefix to the commands. The prefix is the path you have copied the Windows Server 2003 version of certutil to. In this

  white paper, the %HOMEDRIVE%\W2K3AdmPak path is used.

• Question 490:

  Your company Datum Corporation, has a single Active Directory domain named intranet.adatum.com. The domain has two domain controllers that run Windows Server 2008 R2 operating system. The domain controllers also run DNS servers.

  The intranet.adatum.com DNS zone is configured as an Active Directory-integrated zone with the Dynamic updates setting configured to Secure only.

  A new corporate security policy requires that the intranet.adatum.com DNS zone must be updated only by domain controllers or member servers.

  You need to configure the intranet.adatum.com zone to meet the new security policy requirement.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Remove the Authenticated Users account from the Security tab of the intranet.adatum.com DNS zone properties.
  B. Assign the SELF Account Deny on Write permission on the Security tab of the intranet.adatum.com DNS zone properties.
  C. Assign the server computer accounts the Allow on Write All Properties permission on the Security tab of the intranet.adatum.com DNS zone properties.
  D. Assign the server computer accounts the Allow on Create All Child Objects permission on the Security tab of the intranet.adatum.com DNS zone properties.
  A. Remove the Authenticated Users account from the Security tab of the intranet.adatum.com DNS zone properties.
  D. Assign the server computer accounts the Allow on Create All Child Objects permission on the Security tab of the intranet.adatum.com DNS zone properties.

  ---

  http://www.advicehow.com/managing-dns-dynamic-updates-in-windows-server-2008-r2/ Managing DNS Dynamic Updates in Windows Server 2008 R2

  What Is DNS Dynamic Update?

  When a DNS server is installed in a network, during the installation administrators can configure it to accept dynamic updates of client records. Dynamic updates means that DNS client computers can automatically register their names along

  with their IP addresses in the DNS server. When this happens DNS server automatically creates a Host (A) record for that client computer that contains hostname of the client and its associated IP address.

  Also, during the installation of DNS server administrators can choose an option according to which DNS server should not automatically update its records and in this condition administrators must manually create Host (A) records in the DNS

  database.

  http://www.windowsecurity.com/articles-tutorials/windows_server_2008_security/DNS-Security- Part2.html

  DNS Security (Part 2): DNS Security Steps Prior to Deploying DNSSEC In this article, then, we'll take a look at the details of the following preliminary steps you can take to help secure your Windows DNS infrastructure:

  Decide who can resolve Internet host names

  Don't co-locate internal and external zones

  Lock down the DNS cache

  Enable recursion only where needed

  Restrict DNS servers to listen on specific addresses

  Consider using a private root hints file

  Randomize your DNS source ports

  Be aware of the Global Query Block List

  Limit zone transfers

  Take advantage of Active Directory integrated zone security ..

  Take advantage of Active Directory integrated zone security Active Directory integrated zones enable you to secure the registration of resource records when dynamic name registration is enabled. Members of the Active Directory domain can

  register their resource records dynamically while non-domain members will be unable to register their names. You can also use discretionary access control lists (DACLs) to control which computers are able to register or change their

  addressing information.

  The figure below shows how you configure secure dynamic updates.

  

  http://www.tutorialspoint.com/shorttutorials/configuring-dns-server-for-secure-only-dynamic-updates/ Configuring DNS Server for Secure Only Dynamic Updates