Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 41:

  Your network contains an Active Directory domain named contoso.com. You have an organizational unit (OU) named Sales and an OU named Engineering. You have two Group Policy Objects (GPOs) named GPO1 and GPO2. GPO1 and GPO2 are linked to theSales OU and contain multiple settings. You discover that GPO2 has a setting that conflicts with a setting in GPO1. When the policies are applied, the setting in GPO2 takes effect. You need to ensure that the settings in GPO1 supersede the settings in GPO2. The solution must ensure that all non-conflicting settings in both GPOs are applied.

  What should you do?

  A. Configure Restricted Groups.
  B. Configure the link order.
  C. Link the GPO to the Sales OU.
  D. Link the GPO to the Engineer OU.
  E. Enable loopback processing in merge mode.
  F. Modify the Group Policy permissions.
  G. Configure WMI filtering.
  H. Configure Group Policy Permissions.
  I. Enable loopback processing in replace mode.
  J. Enable block inheritance.
  B. Configure the link order.

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 283 Precedence of Multiple Linked GPOs.

  An OU, domain, or site can have more than one GPO linked to it. In the event of multiple GPOs, the GPOs' link order determines their precedence. In Figure 6-10, two GPOs are linked to the People OU.

  

  Figure 6-10 GPO link order

  The object higher on the list, with a link order of 1, has the highest precedence. Therefore, settings that are enabled or disabled in the Power User Configuration GPO have precedence over these same settings in the Standard User

  Configuration GPO.

  To change the precedence of a GPO link:

  1.

  Select the OU, site, or domain in the GPMC console tree.

  2.

  Click the Linked Group Policy Objects tab in the details pane.

  3.

  Select the GPO.

  4.

  Use the Up, Down, Move To Top, and Move To Bottom arrow icons to change the link order of the selected GPO.

• Question 42:

  Your company has a main office and 40 branch offices. Each branch office is configured as a separate Active Directory site that has a dedicated read-only domain controller (RODC). An RODC server is stolen from one of the branch offices.

  You need to identify the user accounts that were cached on the stolen RODC server.

  Which utility should you use?

  A. Dsmod.exe
  B. Ntdsutil.exe
  C. Active Directory Sites and Services
  D. Active Directory Users and Computers
  D. Active Directory Users and Computers

  ---

  http://technet.microsoft.com/en-us/library/cc835486%28v=ws.10%29.aspx Securing Accounts After an RODC Is Stolen

  If you become aware of a stolen or otherwise compromised read-only domain controller (RODC), you should act quickly to delete the RODC account from the domain and to reset the passwords of the accounts whose current passwords are stored on the RODC. An efficient tool for removing the RODC computer account and resetting all the passwords for the accounts that were authenticated to it is the Active Directory Users and Computers snap-in.

• Question 43:

  Your network contains an Active Directory forest named contoso.com. The forest contains a single domain and 10 domain controllers. All of the domain controllers run Windows Server 2008 R2 Service Pack 1 (SP1).

  The forest contains an application directory partition named dc=app1, dc=contoso,dc=com. A domain controller named DC1 has a copy of the application directory partition.

  You need to configure a domain controller named DC2 to receive a copy of dc=app1, dc=contoso,dc=corn.

  Which tool should you use?

  A. Active Directory Sites and Services
  B. Dsmod
  C. Dcpromo
  D. Dsmgmt
  C. Dcpromo

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc732887.aspx

  Dcpromo

  Installs and removes Active Directory Domain Services (AD DS).

  Parameter

  ApplicationPartitionsToReplicate:""

  Specifies the application directory partitions that dcpromo will replicate. Use the following format:

  "partition1" "partition2" "partitionN"

  Use * to replicate all application directory partitions.

  Original explanation:

  Please Check Answer

  I don't think this is Dsmod. It is most likely Dcpromo.

  Dsmod -- Modifies an existing object of a specific type in the directory.

• Question 44:

  You need to modify the Password Replication Policy on a read-only domain controller (RODC).

  Which tool should you use? To answer, select the appropriate tool in the answer area.

  Hot Area:

  

  

  ---

  Reference: http://technet.microsoft.com/en-us/library/rodc-guidance-for-administering-the-password-replication- policy.aspx

  Administering the Password Replication Policy This topic describes the steps for viewing, configuring, and monitoring the Password Replication Policy (PRP) and password caching for read-only domain controllers (RODCs). To configure the PRP using Active Directory Users and Computers

  1. Open Active Directory Users and Computers as a member of the Domain Admins group.

  2. Ensure that you are connected to a writeable domain controller running Windows Server 2008 in the correct domain.

  3. Click Domain Controllers, and in the details pane, right-click the RODC computer account, and then click Properties.

  4. Click the Password Replication Policy tab.

  5. The Password Replication Policy tab lists the accounts that, by default, are defined in the Allowed list and the Deny list on the RODC. To add other groups that should be included in either the Allowed list or the Deny list, click Add.

  To add other accounts that will have credentials cached on the RODC, click Allow passwords for the account to replicate to this RODC.

  To add other accounts that are not allowed to have credentials cached on the RODC, click Deny passwords for the account from replicating to this RODC.

• Question 45:

  You deploy an Active Directory Federation Services (AD FS) Federation Service Proxy on a server namedServer1.

  You need to configure the Windows Firewall on Server1 to allow external users to authenticate by using AD FS.

  Which inbound TCP port should you allow on Server1?

  A. 88
  B. 135
  C. 443
  D. 445
  C. 443

• Question 46:

  Your network contains an Active Directory forest. All domain controllers run Windows Server 2008 R2 and are configured as DNS servers.

  You have an Active Directory-integrated zone for contoso.com.

  You have a Unix-based DNS server.

  You need to configure your Windows Server 2008 R2 environment to allow zone transfers of the contoso.com zone to the Unix-based DNS server.

  What should you do in the DNS Manager console?

  A. Enable BIND secondaries
  B. Create a stub zone
  C. Disable recursion
  D. Create a secondary zone
  A. Enable BIND secondaries

  ---

  http://skibbz.com/understanding-of-advance-properties-settings-in-window-server-2003-and-2008-dns- serverbind-secondaries/

  Understanding Of Advance Properties Settings In Window Server 2003 And 2008 DNS Server (BIND Secondaries)

  BIND Secondaries controls the zone transfer between different vendor DNS server. It help verifies the type of format used zone transfer, whether it is fast or slow transfer (zone transfer). The full mean of BIND is Berkeley Internet Name

  domain (BIND). BIND is a based on UNIX operating system. Two window servers do not required BIND. BIND is only required when transfer dns zone between two different dns server vendors (UNIX and Microsoft Window). If you are using

  only Window server for dns and zone transfer you will have to disable this option in the window dns server. However if you want the server to perform a slow zone transfer and uncompressed data transfer then you will have to enable BIND in

  the dns server.

  To reiterate, BIND only provide slow dns zone transfer and data compression mechanism for DNS server.

  BIND is understood to have been introduced in window server to support UNIX. System admin will normally disable this option if they want the data in their dns zone transfer to between primary and secondary dns server to be transfer faster

  in order to improve dns queries efficiency within their network environment Bind is used in a DNS window server, when the needs to configured zone transfer between window server and UNIX server or operative system.

  Bind is enabled when a window server is configured as a primary dns server and a UNIX computer is configured as a secondary dns server for zone transfer.

  BIND Secondaries need to be configured to mitigate, the problem of interoperability between the two server operating system since they are from different vendors. Note that old version of the BIND was noted to be very slow and uses an

  uncompressed zone transfer format.

  However, BIND in window server 2008 and later has improved this problem. This is because it was noted that BIND in window server 2008 and later uses faster, compressed format during zone transfer between primary and secondary DNS

  server configured in for different server operating system (UNIX and Window server).

• Question 47:

  Your network contains an Active Directory domain named contoso.com.

  The domain contains a domain controller named DC1. DC1 has the DNS namespaces configured as shown in the following table.

  

  In the table below, identify which queries will have an authoritative or non-authoritative response from DC1. Make only one selection in each row.

  Hot Area:

  

  

• Question 48:

  You are the administrator of an organization with a single Active Directory domain. One of your senior executives tries to log onto a machine and receives the error "This user account has expired. Ask your administrator to reactivate your account".

  You need to make sure this doesn't happen again to this user.

  What do you do?

  A. Configure the domain policy to disable account lockouts.
  B. Configure the password policy to extend the maximum password age to 0.
  C. Modify the user's properties to set the Account Never Expires setting.
  D. Modify the user's properties to extend the maximum password age to 0.
  C. Modify the user's properties to set the Account Never Expires setting.

  ---

  Basically the same as A/Q36:

  

  Further information:

  http://technet.microsoft.com/en-us/library/dd145547.aspx

  User Properties - Account Tab

  Account expires

  Sets the account expiration policy for this user. You can select between the following options:

  Use Never to specify that the selected account will never expire. This option is the default for new users.

  Select End of and then select a date if you want to have the user's account expire on a specified date.

• Question 49:

  Your company has an Active Directory domain. The company has purchased 100 new computers. You want to deploy the computers as members of the domain.

  You need to create the computer accounts in an OU.

  What should you do?

  A. Run the csvde -f computers.csv command
  B. Run the ldifde -f computers.ldf command
  C. Run the dsadd computer command
  D. Run the dsmod computer command
  C. Run the dsadd computer command

  ---

  http://technet.microsoft.com/en-us/library/cc754539%28v=ws.10%29.aspx Dsadd computer

  Syntax: dsadd computer [-samid ] [-desc ] [-loc ] [-memberof] [{-s | -d }] [-u ] [-p { | *}] [-q] [{-uc | -uco | -uci}]

  Personal comment: you use ldifde and csvde to import and export directory objects to Active Directory http://support.microsoft.com/kb/237677

  http://technet.microsoft.com/en-us/library/cc732101%28v=ws.10%29.aspx

• Question 50:

  Your company has a main office and a branch office. The branch office has an Active Directory site that contains a read-only domain controller (RODC).

  A user from the branch office reports that his account is locked out.

  From a writable domain controller in the main office, you discover that the user's account is not locked out. You need to ensure that the user can log on to the domain.

  What should you do?

  A. Modify the Password Replication Policy.
  B. Reset the password of the user account.
  C. Run the Knowledge Consistency Checker (KCC) on the RODC.
  D. Restore network communication between the branch office and the main office.
  D. Restore network communication between the branch office and the main office.

  ---

  Not sure if:

  Run the Knowledge Consistency Checker (KCC) on the RODC.

  or

  Restore network communication between the branch office and the main office.