Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 491:

  Your network contains an Active Directory domain that contains five domain controllers.

  You have a management computer that runs Windows 7.

  From the Windows 7 computer, you need to view all account logon failures that occur in the domain.

  The information must be consolidated on one list.

  Which command should you run on each domain controller?

  A. Wecutil.exe qc
  B. Wevtutil.exe gli
  C. Winrm.exe quickconfig
  D. Winrshost.exe
  C. Winrm.exe quickconfig

  ---

  http://blogs.technet.com/b/jonjor/archive/2009/01/09/winrm-windows-remote- managementtroubleshooting.aspx

  WinRM (Windows Remote Management) Troubleshooting

  What is WinRM?

  New in Windows Vista, Windows Server 2003 R2, Windows Server 2008 (and Server 2008 Core) are WinRM and WinRS. Windows Remote Management (known as WinRM) is a handy new remote management service.

  WinRM is the "server" component of this remote management application and WinRS (Windows Remote Shell) is the "client" for WinRM, which runs on the remote computer attempting to remotely manage the WinRM server. However, I

  should note that BOTH computers must have WinRM installed and enabled on them for WinRS to work and retrieve information from the remote system.

  ..

  How to install WinRM

  The WinRM is not dependent on any other service except WinHttp. If the IIS Admin Service is installed on the same computer, you may see messages that indicate WinRM cannot be loaded before Interent Information Services (IIS).

  However, WinRM does not actually depend on IIS: these messages occur because the load order ensures that the IIS service starts before the HTTP service. WinRM does require that WinHTTP.dll be registered.

  (Stated simply: WinRM service should be set to Automatic (Delayed Start) on Windows Vista and Server 2008) ?The WinRM service starts automatically on Windows Server 2008.

  ?On Windows Vista, the service must be started manually.

  How to configure WinRM

  To set the default configuration type:

  winrm quickconfig (or the abbreviated version, winrm qc)

  `winrm qc' performs the following operations:

  1.

  Starts the WinRM service and sets the service startup type to auto-start.

  2.

  Configures a listener for the ports that send and receive WS-Management protocol messages using either HTTP or HTTPS on any IP address.

  3.

  Defines ICF exceptions for the WinRM service and opens the ports for HTTP and HTTPS. (Note: Winrm quickconfig also configures Winrs default settings)

• Question 492:

  Your network contains an Active Directory domain. The domain contains four domain controllers.

  You create a new application directory partition.

  You need to ensure that the new application directory partition replicates to only three of the domain controllers.

  Which tool should you use?

  A. Active Directory Administrative Center
  B. Dsamain
  C. Dsmod
  D. Ntdsutil
  A. Active Directory Administrative Center

• Question 493:

  Your network contains an Active Directory domain. All domain controllers run Windows Server 2008 R2. Client computers run either Windows 7 or Windows Vista Service Pack 2 (SP2).

  You need to audit user access to the administrative shares on the client computers.

  What should you do?

  A. Deploy a logon script that runs Icacls.exe.
  B. Deploy a logon script that runs Auditpol.exe.
  C. From the Default Domain Policy, modify the Advanced Audit Policy Configuration.
  D. From the Default Domain Controllers Policy, modify the Advanced Audit Policy Configuration.
  B. Deploy a logon script that runs Auditpol.exe.

  ---

  Reference:

  http://support.microsoft.com/kb/921469

  Administrators can use the procedure that is described in this article to deploy a custom audit policy that applies detailed security auditing settings to Windows Vista-based and Windows Server 2008- based computers in a Windows Server

  2003 domain or in a Windows 2000 domain. Use the Auditpol.exe command-line tool to configure the custom audit policy settings that you want.

• Question 494:

  Your network contains an Active Directory domain. The domain contains a domain controller named DC1 that runs windows Server 2008 R2 Service Pack 1 (SP1).

  You need to implement a central store for domain policy templates.

  What should you do? To answer, select the source content that should be copied to the destination folder in the answer area.

  Hot Area:

  

  

  ---

  Copy "C:\Windows\PolicyDefinitions" to "C:\Windows\SYSVOL\domain\Policies"

  In the reference below the entire PolicyDefinitions folder gets copied. In the question we copy the contents of that PolicyDefinitions folder, which has the same result of course.

  Reference:

  http://www.petri.co.il/creating-group-policy-central-store.htm

  Creating a Central Store

  Creating a central store is actually a rather simple process. The first thing that you will have to do is to log onto a computer that is running either Windows Vista or Windows Server 2008. If you have one particular machine that has all of your group policy template files installed on it, then that machine is a good candidate.

  The next thing that you must do is to open Windows Explorer, and then go into the C:\Windows folder. Locate the PolicyDefinitions folder, right click on it, and then choose the Copy command from the shortcut menu. This will copy the folder and its contents to the Windows clipboard. The next step in the process is to map a network drive letter to the sysvol folder on a domain controller. The full path that you will need to access on the domain controller is c:\Windows\SYSVOL\domain\Policies. Finally, copy the PolicyDefinitions folder to the \Windows\SYSVOL\domain\Policies folder on the domain controller.

  You can see what this looks like in Figure A.

  

  Copy the PolicyDefinitions folder to the domain controller's \Windows\Sysvol\Domain\Policies folder.

• Question 495:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1.

  You have a member server named Server1.

  Both DC1 and Server1 have the DNS Server server role installed.

  On DC1, you create an Active Directory-integrated zone named adatum.com.

  You need to ensure that Server1 receives a copy of the zone.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Create a secondary zone on Server1.
  B. Modify the zone type of adatum.com.
  C. Modify the Zone Transfers settings of adatum.com,
  D. Add Server1 to the DNSUpdateProxy group.
  E. Create a primary zone on Server1.
  A. Create a secondary zone on Server1.
  C. Modify the Zone Transfers settings of adatum.com,

• Question 496:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run a Server Core installation of Windows Server 2008 R2.

  You need to identify which domain controller holds the PDC emulator role.

  Which tool should you run?

  A. Get-AdOptionalFeature
  B. netdom.exe
  C. Search-AdAccount
  D. dsrm.exe
  B. netdom.exe

  ---

  The FSMO role holders can be easily found by use of the Netdom command. On any domain controller, click Start, click Run, type CMD in the Open box, and then click OK. In the Command Prompt window, type netdom query /

  domain: fsmo (where is the name of YOUR domain).

  Note:

  The five FSMO roles [in Windows 2003] are:

  Schema master - Forest-wide and one per forest.

  Domain naming master - Forest-wide and one per forest.

  RID master - Domain-specific and one for each domain.

  PDC - PDC Emulator is domain-specific and one for each domain. Infrastructure master - Domain-specific and one for each domain.

• Question 497:

  Your company has a server that runs an instance of Active Directory Lightweight Directory Service (AD LDS).

  You need to create new organizational units in the AD LDS application directory partition.

  What should you do?

  A. Use the dsmod OU command to create the organizational units.
  B. Use the Active Directory Users and Computers snap-in to create the organizational units on the AD LDS application directory partition.
  C. Use the dsadd OU command to create the organizational units.
  D. Use the ADSI Edit snap-in to create the organizational units on the AD LDS application directory partition.
  D. Use the ADSI Edit snap-in to create the organizational units on the AD LDS application directory partition.

  ---

  Answer: Use the ADSI Edit snap-in to create the organizational units on the AD LDS application directory partition. http://technet.microsoft.com/en-us/library/cc773354%28v=ws.10%29.aspx ADSI Edit (adsiedit.msc)

  Active Directory?Service Interfaces Editor (ADSI Edit) is a Lightweight Directory Access Protocol (LDAP) editor that you can use to manage objects and attributes in Active Directory. ADSI Edit (adsiedit.msc) provides a view of every object and attribute in an Active Directory forest. You can use ADSI Edit to query, view, and edit attributes that are not exposed through other Active Directory Microsoft Management Console (MMC) snap-ins: Active Directory Users and Computers, Active Directory Sites and Services, Active Directory Domains and Trusts, and Active Directory Schema. http://technet.microsoft.com/en-us/library/cc730701% 28v=ws.10%29.aspx#BKMK_1 Step 4: Practice Managing AD LDS Organizational Units, Groups, and Users Create an OU To keep your AD LDS users and groups organized, you may want to place users and groups in OUs. In Active Directory Domain Services (AD DS) and in AD LDS, as well as in other Lightweight Directory Access Protocol (LDAP)based directories, OUs are most commonly used for keeping users and groups organized.

  To create an OU

  1.

  Click Start, point to Administrative Tools, and then click ADSI Edit.

  2.

  Connect and bind to the directory partition of the AD LDS instance to which you want to add an OU.

  3.

  In the console tree, double-click the o=Microsoft,c=US directory partition, right-click the container to which you want to add the OU, point to New, and then click Object.

  4.

  In Select a class, click organizationalUnit, and then click Next.

  5.

  In Value, type a name for the new OU, and then click Next.

  6.

  If you want to set values for additional attributes, click More attributes.

  Further information: http://technet.microsoft.com/en-us/library/cc754663%28v=ws.10%29.aspx Step 5: Practice Working with Application Directory Partitions The Active Directory Lightweight Directory Services (AD LDS) directory store is organized into logical directory partitions. There are three different types of directory partitions: Configuration directory partitions Schema directory partitions Application directory partitions Each AD LDS directory store must contain a single configuration directory partition and a single schema directory partition. The directory store can contain zero or more application directory partitions.

  Application directory partitions hold the data that your applications use. You can create an application directory partition during AD LDS setup or anytime after installation.

• Question 498:

  Your network contains an Active Directory forest.

  All users have a value set for the Department attribute.

  From Active Directory Users and Computers, you search a domain for all users who have a Department attribute value of Marketing. The search returns 50 users.

  From Active Directory Users and Computers, you search the entire directory for all users who have a Department attribute value of Marketing.

  The search does not return any users.

  You need to ensure that a search of the entire directory for users in the marketing department returns all of the users who have the Marketing Department attribute.

  What should you do?

  A. Install the Windows Search Service role service on a global catalog server.
  B. From the Active Directory Schema snap-in modify the properties of the Department attribute.
  C. Install the Indexing Service role service on a global catalog server.
  D. From the Active Directory Schema snap-in modify the properties of the user class.
  B. From the Active Directory Schema snap-in modify the properties of the Department attribute.

  ---

  http://technet.microsoft.com/en-us/library/how-global-catalog-servers-work.aspx Global Catalog Partial Attribute Set The attributes that are replicated to the global catalog by default include a base set that have been defined by Microsoft as the attributes that are most likely to be used in searches. Administrators can use the Microsoft Management Console (MMC) Active Directory Schema snap-in to specify additional attributes to meet the needs of their installation. In the Active Directory Schema snap-in, you can select the Replicate this attribute to the global catalog check box to designate an attributeSchema object as a member of the PAS, which sets the value of the isMemberOfPartialAttributeSet attribute to TRUE.

• Question 499:

  Your network contains an Active Directory domain named contoso.com.

  All users have laptops that run Windows 7. The laptops are joined to the domain. Windows Firewall is enabled on all the laptops.

  You need to ensure that when the users connect to unidentified networks, Windows Firewall uses the Public Profile.

  Which node in Group Policy Management Editor should you use? To answer, select the appropriate node in the answer area.

  Hot Area:

  

  

• Question 500:

  You have an enterprise subordinate certification authority (CA).

  You have a group named Group1.

  You need to allow members of Group1 to publish new certificate revocation lists. Members of Group1 must not be allowed to revoke certificates.

  What should you do?

  A. Add Group1 to the local Administrators group.
  B. Add Group1 to the Certificate Publishers group.
  C. Assign the Manage CA permission to Group1.
  D. Assign the Issue and Manage Certificates permission to Group1.
  C. Assign the Manage CA permission to Group1.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc732590.aspx

  Manage CA is a security permission belonging to the CA Administrator role. The CA Administrator can enable, publish, or configure certificate revocation list (CRL) schedules. Revoking certificates is an activity of the Certificate Manager role.