Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 531:

  You need to validate whether Active Directory successfully replicated between two domain controllers.What should you do?

  A. Run the DSget command.
  B. Run the Dsquery command.
  C. Run the RepAdmin command.
  D. Run the Windows System Resource Manager.
  C. Run the RepAdmin command.

  ---

  http://technet.microsoft.com/en-us/library/cc794749.aspx You can use the repadmin /showrepl command to verify successful replication to a specific domain controller.

• Question 532:

  Your network contains an Active Directory domain named contoso.com.

  The domain contains an enterprise certification authority (CA).

  You plan to delegate certificate enrollment for Smartcard Logon certificates to a user named User1. User1 is the member of a group named CONTOSO \DelegatedAdmins.

  You need to recommend a solution to provide User1 with the ability to enroll for Smartcard Logon certificates on behalf of other domain users.

  What should you include in the recommendation?

  A. Duplicate the Smartcard Logon certificate template. Modify the Extensions settings and the Request Handling settings of the new template.
  B. Modify the Issuance Requirements settings and the Security settings of the Smartcard Logon certificate template.
  C. Modify the Extensions settings and the Request Handling settings of the Smartcard Logon certificate template.
  D. Duplicate the Smartcard Logon certificate template. Modify the Issuance Requirements settings and the Security settings of the new template.
  D. Duplicate the Smartcard Logon certificate template. Modify the Issuance Requirements settings and the Security settings of the new template.

• Question 533:

  Your network contains an Active Directory domain named contoso.com.

  You need to ensure that IP addresses can be resolved to fully qualified domain names (FQDNs).

  Under which node in the DNS snap-in should you add a zone? To answer, select the appropriate node in the answer area.

  Hot Area:

  

  

  ---

  Reference:

  Mastering Microsoft Windows Server 2008 R2 (Sybex, 2010) page 193

  A forward lookup means the client provides a fully qualified domain name and the DNS server returns an IP address. A reverse lookup does the opposite: the client provides an IP address, and then the DNS server returns an FQDN.

• Question 534:

  An Active Directory database is installed on the C volume of a domain controller. You need to move the Active Directory database to a new volume.

  What should you do?

  A. Copy the ntds.dit file to the new volume by using the ROBOCOPY command.
  B. Move the ntds.dit file to the new volume by using Windows Explorer.
  C. Move the ntds.dit file to the new volume by running the Move-item command in Microsoft Windows PowerShell.
  D. Move the ntds.dit file to the new volume by using the Files option in the Ntdsutil utility.
  D. Move the ntds.dit file to the new volume by using the Files option in the Ntdsutil utility.

  ---

  Answer: Move the ntds.dit file to the new volume by using the Files option in the Ntdsutil utility.

  http://technet.microsoft.com/en-us/library/cc816720%28v=ws.10%29.aspx Move the Directory Database and Log Files to a Local Drive You can use this procedure to move Active Directory database and log files to a local drive. When you move the files to a folder on the local domain controller, you can move them permanently or temporarily. Move the files to a temporary destination if you need to reformat the original location, or move the files to a permanent location if you have additional disk space. If you reformat the original drive, use the same procedure to move the files back after the reformat is complete. Ntdsutil.exe updates the registry when you move files locally. Even if you are moving the files only temporarily, use Ntdsutil.exe so that the registry is always current.

  On a domain controller that is running Windows Server 2008, you do not have to restart the domain controller in Directory Services Restore Mode (DSRM) to move database files. You can stop the Active Directory Domain Services (AD DS) service and then restart the service after you move the files to their permanent location.

  To move the directory database and log files to a local drive: ..

  7.

  At the ntdsutil prompt, type files, and then press ENTER.

  8.

  To move the database file, at the file maintenance: prompt, use the following commands:

  ....

  Further information:

  http://servergeeks.wordpress.com/2013/01/01/moving-active-directory-database-and-logs/ Moving Active Directory Database and Logs

  Step 1

  Start the server in Directory Services Restore Mode

  Windows Server 2003/2008 Directory Service opens its files in exclusive mode. This means that the files cannot be managed while the server is operating as a domain controller. To perform any files movement related activities using ntdsutil,

  we need to start the server in Directory Services Restore Mode.

  To start the server in Directory Services Restore mode, follow these steps:

  Restart the computer.

  After the BIOS information is displayed, press F8.

  Use the DOWN ARROW to select Directory Services Restore Mode, and then press ENTER.

  

  Log on with your local administrative account and password. (Not Domain Administrative account)

  

  Note: using service control (SC.exe) you can verify quickly ntds services are running or stopped. In command prompt type SC query ntds

  

  Step 2 How to Move Active Directory Database and Logs You can move the Ntds.dit data file to a new folder. If you do so, the registry is updated so that Directory Service uses the new location when you restart the server. To move the data file to another folder, follow these steps: Click Start, click Run, type ntdsutil in the Open box, and then press ENTER.

  

  At the Ntdsutil command prompt, type activate instance ntds, and then press ENTER.

  

  At the Ntdsutil command prompt, type files, and then press ENTER.

  

  At the file maintenance command prompt, type move DB to (where new location is an existing folder that you have created for this purpose) and then press ENTER. In this case, the new location for database is C:\AD \Database Now

  

  Now to move logs , at the file maintenance command prompt, type move logs to (where new location is an existing folder that you have created for this purpose) and then press ENTER. In our case, the new location for database is C:\AD\Logs

  

  To quit file maintenance, type quit. Again to Ntdsutil, type quit to close the prompt Restart the computer. AD database and Logs are moved successfully to new location.

• Question 535:

  You are an administrator at ABC.com. Company has a RODC (read-only domain controller) server at a remote location. The remote location doesn't have proper physical security.

  You need to activate nonadministrative accounts passwords on that RODC server.

  Which of the following action should be considered to populate the RODC server with non- administrative accounts passwords?

  A. Delete all administrative accounts from the RODC's group
  B. Configure the permission to Deny on Receive for administrative accounts on the security tab for Group Policy Object (GPO)
  C. Configure the administrative accounts to be added in the Domain RODC Password Replication Denied group
  D. Add a new GPO and enable Account Lockout settings. Link it to the remote RODC server and on the security tab on GPO, check the Read Allow and the Apply group policy permissions for the administrators.
  E. None of the above
  C. Configure the administrative accounts to be added in the Domain RODC Password Replication Denied group

  ---

  

  http://technet.microsoft.com/en-us/library/cc770320%28v=ws.10%29.aspx Advantages That an RODC Can Provide to an Existing Deployment Branch office server administration. RODCs provide Administrator Role Separation (ARS), which you can use to delegate administration of an RODC to a nonadministrative user or group. This means that it is not necessary for a highly privileged administrator to log on to the domain controller in the branch office to perform routine server maintenance.

  http://technet.microsoft.com/en-us/library/cc730883%28v=ws.10%29.aspx Password Replication Policy When you initially deploy an RODC, you must configure the Password Replication Policy on the writable domain controller that will be its replication partner. The Password Replication Policy acts as an access control list (ACL). It determines if an RODC should be permitted to cache a password. After the RODC receives an authenticated user or computer logon request, it refers to the Password Replication Policy to determine if the password for the account should be cached. The same account can then perform subsequent logons more efficiently. The Password Replication Policy lists the accounts that are permitted to be cached, and accounts that are explicitly denied from being cached. The list of user and computer accounts that are permitted to be cached does not imply that the RODC has necessarily cached the passwords for those accounts. An administrator can, for example, specify in advance any accounts that an RODC will cache. This way, the RODC can authenticate those accounts, even if the WAN link to the hub site is offline. Password Replication Policy Allowed and Denied lists Two new built-in groups are introduced in Windows Server 2008 Active Directory domains to support RODC operations. These are the Allowed RODC Password Replication Group and Denied RODC Password Replication Group. The combination of the Allowed List and Denied List attributes for each RODC and the domain-wide Denied RODC Password Replication Group and Allowed RODC Password Replication Group give administrators great flexibility. They can decide precisely which accounts can be cached on specific RODCs.

  

• Question 536:

  Your company has a main office and 40 branch offices. Each branch office is configured as a separate Active Directory site that has a dedicated read-only domain controller (RODC).

  You need to identify the user accounts that can be cached on the RODC server.

  Which utility should you use?

  A. Dsmod.exe
  B. Repadmin.exe
  C. Active Directory Domain and Trusts
  D. Active Directory Sites and Services
  B. Repadmin.exe

• Question 537:

  Your network contains an Active Directory domain named adatum.com. The functional level of the domain is Windows Server 2008. All domain controllers run Windows Server 2008 R2. All client computers run Windows 7 Enterprise.

  You need to receive a notification when more than 50 Active Directory objects are deleted per second.

  What should you do?

  A. Run the Get-ADDomain cmdlet.
  B. Run the dsget.exe command.
  C. Run the ntdsutil.exe command.
  D. Run the ocsetup.exe command.
  E. Run the dsamain.exe command.
  F. Run the eventcreate.exe command.
  G. Create a Data Collector Set (DCS).
  H. Create custom views from Event Viewer.
  I. Configure subscriptions from Event Viewer.
  J. Import the Active Directory module for Windows PowerShell.
  G. Create a Data Collector Set (DCS).

  ---

  Reference: http://technet.microsoft.com/en-us/magazine/ff458614.aspx

  Configure Windows Server 2008 to Notify you when Certain Events Occur You can configure alerts to notify you when certain events occur or when certain performance thresholds are reached. You can send these alerts as network messages and as events that are logged in the application event log. You can also configure alerts to start applications and performance logs.

  To configure an alert, follow these steps:

  1.

  In Performance Monitor, under the Data Collector Sets node, right-click the User-Defined node in the left pane, point to New, and then choose Data Collector Set.

  2.

  (...)

  3.

  In the Performance Counters panel, select the first counter, and then use the Alert When Value Is text box to set the occasion when an alert for this counter is triggered. Alerts can be triggered when the counter is above or below a specific value. Select Above or Below, and then set the trigger value. The unit of measurement is whatever makes sense for the currently selected counter or counters. For example, to generate an alert if processor time is over 95 percent, select Over, and then type 95. Repeat this process to configure other counters you've selected.

• Question 538:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2. Auditing is configured to log changes made to the Managed By attribute on group objects in an organizational unit named OU1.

  You need to log changes made to the Description attribute on all group objects in OU1 only.

  What should you do?

  A. Run auditpol.exe.
  B. Modify the auditing entry for OU1.
  C. Modify the auditing entry for the domain.
  D. Create a new Group Policy Object (GPO). Enable Audit account management policy setting. Link the GPO to OU1.
  B. Modify the auditing entry for OU1.

  ---

  http://ithompson.wordpress.com/tag/organizational-unit-move/ Do you need to track who/where/when for activities done against the OU's in your AD? With Windows 2003 those were difficult questions to answer, we could get some very basic

  information from Directory Services Auditing; but it was limited and you had to read through several cryptic events (id 566).

  With the advanced auditing settings with Windows 2008 R2 you can get some better information (you can do this same thing with Windows 2008 but it has to be done via command line and applied every time servers restart).

  I don't want to bore you with Windows 2003 auditing or the command line options for Windows 2008 Domains (if you need them, I will get you the information). So let's just jump right to using Windows 2008 R2, because we can now apply the

  advanced auditing settings via Group Policy. Now when you turn on the Advanced Audit Policy Configuration you are turning OFF the basic or standard Audit Policies. The Advanced Audit Policy Configuration allows you to control what AD

  will audit at a more granular level. Now for the focus of this discussion we are only going to talk about setting up auditing for activity on our Domain Controllers, the other systems in your environment will be a different discussion.

  So where do we start so that we can answer our question at the top of this discussion? First, turn on the correct auditing. Open up Group Policy Management Editor and drill down as seen in Fig 1.

  

  For this discussion we are focusing on DS Access and its subcategories. We only want to turn on Audit Directory Service Changes, see Fig 2. This category only generates events on domain controllers and is very useful for tracking changes to Active Directory objects that have object level auditing enabled. These events not only tell you what object and property was changed and by whom but also the new value of the affected properties.

  

  Now that we have step 1 completed, setting up AD for auditing, it's time to configure WHAT we want to audit.

  This next step is done via Active Directory Users and Computers. Open up the properties of your AD and drill down to setup the auditing for Create and Delete Organizational Unit objects as seen in Fig 3.

  

  Now we need to add more granularity so we need to do this process 1 more time and this time instead of checking boxes on the Object tab we are going to check 2 boxes on the Properties tab, see Fig 4.

  

  Now that our auditing is setup what type of events can we expect to see? Here are a few examples: In this example (Fig 5), id 5137, we see an OU being created by the Administrator.

  

  Figure 6 shows a Sub OU being created.

  

  Figure 7 shows id 5139, an OU being moved.

  

  Now for the best one, this one comes as a pair of messages OU rename, part of id 5136. Figure 8 shows the first part of the rename process.

  

  Figure 9 shows the second part of the rename process.

  

  Now let's contrast all of this with an event that is part of the good old standard auditing. Let's take moving an OU; with the Advanced Auditing we get id 5139 (fig 7), nice and easy to read and understand. Now here is id 4662 that you would

  get for the same thing with standard auditing, fig 10. With standard auditing some of the other items that we looked at would be next to impossible with auditing, such as tracking when an OU is renamed and as you can see from fig 10 hard to

  read and understand if you did get an event.

  Now if your AD is in Mixed Mode (W2k8 and W2k3) you are stuck with standard auditing.

• Question 539:

  Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. The domain contains two domain controllers named DC1 and DC2 that run Windows Server 2008 R2. DC1 is configured as a global

  catalog server.

  You need to configure DC2 as the only global catalog server in the forest. The solution must maintain DC1 in the domain.

  What should you do?

  A. Run the dsadd.exe command
  B. Run the nltest.exe command.
  C. Run the Set-AdDomain cmdlet.
  D. Run the dsmove.exe command.
  E. Run the dcpromo.exe command.
  F. Run the Move-AdDirectoryServer cmdlet.
  G. Use the Active Directory Schema snap-in.
  H. Use the Active Directory Users and Computers console.
  H. Use the Active Directory Users and Computers console.

• Question 540:

  You are the administrator for a large organization with multiple remote sites.

  Your supervisor would like to have remote users log in locally to their own site, but he is nervous about security.

  What type of server can you implement to ease their concerns?

  A. Domain controller
  B. Global Catalog
  C. Read-only domain controller
  D. Universal Group Membership Caching Server
  C. Read-only domain controller

  ---

  http://technet.microsoft.com/en-us/library/cc772234%28v=ws.10%29.aspx Read-Only Domain Controllers Step-by-Step Guide An RODC makes it possible for organizations to easily deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat, such as in an extranet or in an application-facing role.