Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 541:

  Your network contains an Active Directory domain. The domain is configured as shown in the exhibit.

  

  You have a Group Policy Object (GPO) linked to the domain.

  You need to ensure that the settings in the GPO are not processed by user accounts or computer accounts in the Finance organizational unit (OU). You must achieve this goal by using the minimum amount of administrative effort.

  What should you do?

  A. Modify the Group Policy permissions.
  B. Configure WMI filtering.
  C. Enable block inheritance.
  D. Enable loopback processing in replace mode.
  E. Configure the link order.
  F. Configure Group Policy Preferences.
  G. Link the GPO to the Human Resources OU.
  H. Configure Restricted Groups.
  I. Enable loopback processing in merge mode.
  J. Link the GPO to the Finance OU.
  C. Enable block inheritance.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc731076.aspx

  Block Inheritance

  You can block inheritance for a domain or organizational unit. Blocking inheritance prevents Group Policy objects (GPOs) that are linked to higher sites, domains, or organizational units from being automatically inherited by the child-level.

• Question 542:

  Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. The domain contains two domain controllers named DC1 and DC2 that run Windows Server 2008 R2. DC1 is configured as the infrastructure master for contoso.com.

  You need to move the infrastructure master role from DC1 to DC2.

  What should you do?

  A. Run the dsadd.exe command
  B. Run the nltest.exe command
  C. Run the Set-AdDomain cmdlet.
  D. Run the dsmove.exe command.
  E. Run the dcpromo.exe command.
  F. Run the Move-AdDirectoryServer cmdlet.
  G. Use the Active Directory Schema snap-in.
  H. Use the Active Directory Users and Computers console.
  H. Use the Active Directory Users and Computers console.

• Question 543:

  Your network consists of a single Active Directory domain. The domain contains 10 domain controllers. The domain controllers run Windows Server 2008 R2 and are configured as DNS servers.

  You plan to create a new Active Directory-integrated zone.

  You need to ensure that the new zone is only replicated to four of your domain controllers.

  What should you do first?

  A. From the command prompt, run dnscmd and specify the /createdirectorypartition parameter.
  B. Create a new delegation in the ForestDnsZones application directory partition.
  C. From the command prompt, run dnscmd and specify the /enlistdirectorypartition parameter.
  D. Create a new delegation in the DomainDnsZones application directory partition.
  A. From the command prompt, run dnscmd and specify the /createdirectorypartition parameter.

  ---

  Practically the same question as D/Q25 and K/Q17, different set of answers. To control which servers get a copy of the zone we have to store the zone in an application directory partition.

  That application directory partition must be created before we create the zone, otherwise it won't work. So that's what we have to do first. Directory partitions are also called naming contexts and we can create one using ntdsutil.

  Here I tried to create a zone with dnscmd /zoneadd. It failed because the directory partition I wanted to use did not exist yet. To fix that I used ntdsutil to create the directory partition dc=venomous,dc=contoso,dc=com.

  Note that after creating it a new naming context had been added. Then, after a minute or two, I tried to create the new zone again, and this time it worked.

  

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc725739.aspx Store Data in an AD DS Application Partition

  You can store Domain Name System (DNS) zones in the domain or application directory partitions of Active Directory Domain Services (AD DS). An application directory partition is a data structure in AD DS that distinguishes data for different

  replication purposes. When you store a DNS zone in an application directory partition, you can control the zone replication scope by controlling the replication scope of the application directory partition.

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc730970.aspx Partition management

  Manages directory partitions for Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS).

  This is a subcommand of Ntdsutil and Dsmgmt.

  Examples To create an application directory partition named AppPartition in the contoso.com domain, complete the following steps:

  1.

  To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, rightclick Command Prompt, and then click Run as administrator.

  2.

  Type: ntdsutil

  3.

  Type: Ac in ntds

  4.

  Type: partition management

  5.

  Type: connections

  6.

  Type: Connect to server DC_Name

  7.

  Type: quit

  8.

  Type: list The following partitions will be listed: 0 CN=Configuration,DC=Contoso,DC=com 1 DC=Contoso,DC=com 2 CN=Schema,CN=Configuration,DC=Contoso,DC=com 3 DC=DomainDnsZones,DC=Contoso,DC=com 4 DC=ForestDnsZones,DC=Contoso,DC=com

  9.

  At the partition management prompt, type: create nc dc=AppPartition,dc=contoso,dc=com ConDc1.contoso.com

  10.

  Run the list command again to refresh the list of partitions.

• Question 544:

  Your network contains an Active Directory domain named contoso.com.

  The Zone Transfers settings of contoso.com are configured as shown in the Zone Transfers exhibit. (Click the Exhibit button.)

  

  The Name Servers settings of contoso.com are configured as shown in the Name Servers exhibit. (Click the Exhibit button.)

  

  To answer, complete each statement according to the information presented in the exhibits.

  Hot Area:

  

  

  ---

  Zone Transfers is allowed only to 192.168.1.100 and 192.168.2.100 / When a zone that this DNS server hosts is a stub zone, this DNS server is a source only for information about the authoritative name servers for this zone. The zone at this server must be obtained from another DNS server that hosts the zone. This DNS server must have network access to the remote DNS server to copy the authoritative name server information about the zone.

• Question 545:

  Your network contains four domain controllers. The domain controllers are configured as shown in the following table.

  

  All of the domain controllers are configured to host an Active Directory-integrated zone for their respective domain.

  A GlobalNames zone is deployed in the fabrikam.com forest.

  You add a canonical (CNAME) record named Server1 to the GlobalNames zone.

  You discover that users in the contoso.com forest cannot resolve the name Server1. The users in fabrikam.com can resolve the name Server1.

  You need to ensure that the contoso.com users can resolve names in the GlobalNames zone.

  What should you do? (Each correct answer presents part of the solution. Choose two.)

  A. Run dnscmd.exe and specify the globalnamesqueryorder parameter on CONT-DC1 and CONT-DC2.
  B. Add service location (SRV) records named _globalnames to the _msdcs.contoso.com zone.
  C. Run dnscmd.exe and specify the enableglobalnamessupport parameter on CONT-DC1 and CONT- DC2.
  D. Run dnscmd.exe and specify the globalnamesqueryorder parameter on FABR-DC1 and FABR-DC2.
  E. Run dnscmd.exe and specify the enableglobalnamessupport parameter on FABR-DC1 and FABR- DC2.
  F. Add service location (SRV) records named _globalnames to the _msdcs.fabrikam.com zone.
  B. Add service location (SRV) records named _globalnames to the _msdcs.contoso.com zone.
  C. Run dnscmd.exe and specify the enableglobalnamessupport parameter on CONT-DC1 and CONT- DC2.

• Question 546:

  A corporate network contains a Windows Server 2008 R2 Active Directory forest. You need to add a user principal name (UPN) suffix to the forest. Which tool should you use?

  A. Active Directory module for Windows PowerShell
  B. Active Directory Administrative Center console
  C. Active Directory Sites and Services console
  D. Active Directory Users and Computers console
  B. Active Directory Administrative Center console

• Question 547:

  Your network contains a server named Server1 that runs Windows Server 2008 R2. Server1 is configured as an Active Directory Federation Services (AD FS) 2.0 standalone server.

  You plan to add a new token-signing certificate to Server1.

  You import the certificate to the server as shown in the exhibit. (Click the Exhibit button.)

  

  When you run the Add Token-Signing Certificate wizard, you discover that the new certificate is unavailable.

  You need to ensure that you can use the new certificate for AD FS.

  What should you do?

  A. From the properties of the certificate, modify the Certificate Policy OIDs setting.
  B. Import the certificate to the AD FS 2.0 Windows Service personal certificate store.
  C. From the properties of the certificate, modify the Certificate purposes setting.
  D. Import the certificate to the local computer personal certificate store.
  D. Import the certificate to the local computer personal certificate store.

  ---

  Reference: http://technet.microsoft.com/en-us/library/hh341466.aspx

  When you deploy the first federation server in a new AD FS 2.0 installation, you must obtain a token- signing certificate and install it in the local computer personal certificate store on that federation server.

• Question 548:

  Your network contains an Active Directory domain named contoso.com. Contoso.com contains three servers. The servers are configured as shown in the following table.

  

  You need to ensure that users can manually enroll and renew their certificates by using the Certificate Enrollment Web Service. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Configure the policy module settings.
  B. Configure the issuance requirements for the certificate templates.
  C. Configure the Certificate Services Client - Certificate Enrollment Policy Group Policy setting.
  D. Configure the delegation settings for the Certificate Enrollment Web Service application pool account.
  B. Configure the issuance requirements for the certificate templates.
  D. Configure the delegation settings for the Certificate Enrollment Web Service application pool account.

  ---

  Reference 1:

  http://technet.microsoft.com/en-us/library/dd759245.aspx

  The Certificate Enrollment Web Service can process enrollment requests for new certificates and for certificate renewal. In both cases, the client computer submits the request to the Web service and the Web service submits the request to

  the certification authority (CA) on behalf of the client computer. For this reason, the Web service account must be trusted for delegation in order to present the client identity to the CA.

  Reference 2:

  http://social.technet.microsoft.com/wiki/contents/articles/7734.certificate-enrollment-web-services-in- active-directory-certificate-services.aspx

  Delegation is required for the Certificate Enrollment Web Service account when all of the following are true:

  The CA is not on the same computer as the Certificate Enrollment Web Service Certificate Enrollment Web Service needs to be able to process initial enrollment requests, as opposed to only processing certificate renewal requests the

  authentication type is set to Windows Integrated Authentication or Client certificate authentication

• Question 549:

  Your company has a main office and a branch office. All servers are located in the main office. The network contains an Active Directory forest named adatum.com. The forest contains a domain controller named MainDC that runs Windows Server 2008 R2 Enterprise and a member server named FileServer that runs Windows Server 2008 R2 Standard.

  You have a kiosk computer named Public_Computer that runs Windows 7. Public_Computer is not connected to the network.

  You need to join Public_Computer to the adatum.com domain.

  What should you do? To answer, move the appropriate actions from the Possible Actions list to the Necessary Actions area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Reference 1:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) pages 217, 218 Offline Domain Join Offline domain join is also useful when a computer is deployed in a lab or other disconnected environment.

  When the computer is connected to the domain network and started for the first time, it will already be a member of the domain. This also helps to ensure that Group Policy settings are applied at the first startup.

  Four major steps are required to join a computer to the domain by using offline domain join:

  1. Log on to a computer in the domain that is running Windows Server 2008 R2 or Windows 7 with an account that has permissions to join computers to the domain.

  2. Use the DJoin command to provision a computer for offline domain join. This step prepopulates Active Directory with the information that Active Directory needs to join the computer to the domain, and exports the information called a blob to a text file.

  3. At the offline computer that you want to join the domain use DJoin to import the blob into the Windows directory.

  4. When you start or restart the computer, it will be a member of the domain.

• Question 550:

  You are the network administrator for a large company that has one main site and one branch office.

  Your company has a single Active Directory forest, ABC.com.

  You have a single domain controller named ServerA in the main site that has the DNS role installed.

  ServerA is configured as a primary DNS zone.

  You have decided to place a domain controller named ServerB in the remote site and implement the DNS role on that server.

  You want to configure DNS so that if the WAN link fails, users in both sites can still update records and resolve any DNS queries.

  How should you configure the DNS servers?

  A. Configure Server B as a secondary DNS server. Set replication to occur every 5 minutes.
  B. Configure Server B as s stub zone.
  C. Configure Server B as an Active Directory Integrated zone and convert Server A to an Active Directory Integrated zone.
  D. Configure Server A as an Active Directory Integrated zone and configure Server B as a secondary zone.
  C. Configure Server B as an Active Directory Integrated zone and convert Server A to an Active Directory Integrated zone.

  ---

  http://technet.microsoft.com/en-us/library/cc726034.aspx

  Understanding Active Directory Domain Services Integration

  The DNS Server service is integrated into the design and implementation of Active Directory Domain Services (AD DS). AD DS provides an enterprise-level tool for organizing, managing, and locating resources in a network.

  How DNS integrates with AD DS

  When you install AD DS on a server, you promote the server to the role of a domain controller for a specified domain. As part of this process, you are prompted to specify a DNS domain name for the AD DS domain which you are joining and

  for which you are promoting the server, and you are offered the option to install the DNS Server role. This option is provided because a DNS server is required to locate this server or other domain controllers for members of an AD DS domain.

  Benefits of AD DS integration

  For networks that deploy DNS to support AD DS, directory-integrated primary zones are strongly recommended. They provide the following benefits:

  DNS features multimaster data replication and enhanced security based on the capabilities of AD DS. In a standard zone storage model, DNS updates are conducted based on a single-master update model. In this model, a single

  authoritative DNS server for a zone is designated as the primary source for the zone.

  This server maintains the master copy of the zone in a local file. With this model, the primary server for the zone represents a single fixed point of failure. If this server is not available, update requests from DNS clients are not processed for

  the zone.

  With directory-integrated storage, dynamic updates to DNS are sent to any AD DS-integrated DNS server and are replicated to all other AD DS-integrated DNS servers by means of AD DS replication. In this model, any AD DS-integrated DNS

  servercan accept dynamic updates for the zone. Because the master copy of the zone is maintained in the AD DS database, which is fully replicated to all domain controllers, the zone can be updated by the DNS servers operating at any

  domain controller for the domain. With the multimaster update model of AD DS, any of the primary servers for the directoryintegrated zone can process requests from DNS clients to update the zone as long as a domain controller is available

  and reachable on the network.

  Also, when you use directory-integrated zones, you can use access control list (ACL) editing to secure a dnsZone object container in the directory tree. This feature provides detailed access to either the zone or a specified resource record in the zone. For example, an ACL for a zone resource record can be restricted so that dynamic updates are allowed only for a specified client computer or a secure group, such as a domain administrators group. This security feature is not available with standard primary zones.

  Zones are replicated and synchronized to new domain controllers automatically whenever a new one is added to an AD DS domain. By integrating storage of your DNS zone databases in AD DS, you can streamline database replication planning for your network. Directory-integrated replication is faster and more efficient than standard DNS replication.