Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 551:

  You create a user account template for the marketing department. When you copy the user account template, you discover that the Web page attribute is not copied.

  You need to preserve the Web page attribute when you copy the user account template.

  What should you do?

  A. From Active Directory Administrative Center, modify the value of the wWWHomePage attribute for the user account template.
  B. From the Active Directory Schema snap-in, modify the properties of the user class.
  C. From Active Directory Users and Computers, modify the value of the wWWHomePage attribute for the user account template.
  D. From ADSI Edit, modify the properties of the wWWHomePage attribute.
  B. From the Active Directory Schema snap-in, modify the properties of the user class.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc771231.aspx

  You can modify which default attributes are carried over to a newly copied user or specify additional attributes that will be copied to the new user. To do this, open the Active Directory Schema snap-in, view the desired attribute properties, and select (or clear) the Attribute is copied when duplicating user check box. You can modify or add only the attributes that are instances of the user class.

• Question 552:

  Your company has two Active Directory forests named Forest1 and Forest2, The forest functional level and the domain functional level of Forest1 are set to Windows Server 2008.

  The forest functional level of Forest2 is set to Windows 2000, and the domain functional levels in Forest2 are set to Windows Server 2003.

  You need to set up a transitive forest trust between Forest1 and Forest2.

  What should you do first?

  A. Raise the forest functional level of Forest2 to Windows Server 2003 Interim mode.
  B. Raise the forest functional level of Forest2 to Windows Server 2003.
  C. Upgrade the domain controllers in Forest2 to Windows Server 2008.
  D. Upgrade the domain controllers in Forest2 to Windows Server 2003.
  B. Raise the forest functional level of Forest2 to Windows Server 2003.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc816810.aspx

  Creating Forest Trusts

  You can link two disjoined Active Directory Domain Services (AD DS) forests together to form a one- way or two-way, transitive trust relationship.

  The following are required to create forest trusts successfully:

  You can create a forest trust between two Windows Server 2003 forests, between two Windows Server 2008 forests, between two Windows Server 2008 R2 forests, between a Windows Server 2003 forest and a Windows Server 2008 forest,

  between a Windows Server 2003 forest and a Windows Server 2008 R2 forest, or between a Windows Server 2008 forest and a Windows Server 2008 R2 forest. Forest trusts cannot be extended implicitly to a third forest. To create a forest

  trust, the minimum forest functional level for the forests that are involved in the trust relationship is Windows Server 2003.

• Question 553:

  You have a standard primary zone named contoso.com.

  You need to configure how often the zone will be transferred to servers that host a secondary copy of the zone.

  Which tab should you use? To answer, select the appropriate tab in the answer area.

  Hot Area:

  

  

• Question 554:

  Your network contains an Active Directory domain. The domain contains eight domain controllers.

  You need to verify that all the domain controllers can connect to the time server.

  Which command should you run?

  A. netdom.exe query fsmo
  B. dcdiag.exe /e /test:Topology
  C. repadmin.exe /showrepl *
  D. dcdiag.exe /a
  D. dcdiag.exe /a

• Question 555:

  Your network contains an Active Directory forest. All domain controllers run Windows Server 2008 Standard.

  The functional level of the domain is Windows Server 2003.

  You have a certification authority (CA).

  The relevant servers in the domain are configured as shown below:

  

  You need to ensure that you can install the Active Directory Certificate Services (AD CS) Certificate Enrollment Web Service on the network.

  What should you do?

  A. Upgrade Server1 to Windows Server 2008 R2.
  B. Upgrade Server2 to Windows Server 2008 R2.
  C. Raise the functional level of the domain to Windows Server 2008.
  D. Install the Windows Server 2008 R2 Active Directory Schema updates.
  D. Install the Windows Server 2008 R2 Active Directory Schema updates.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/dd759243.aspx

  Installation requirements

  Before installing the certificate enrollment Web services, ensure that your environment meets these requirements:

  ? A host computer as a domain member running Windows Server 2008 R2. ? An Active Directory forest with a Windows Server 2008 R2 schema. ? An enterprise certification authority (CA) running Windows Server 2008 R2, Windows Server 2008, or ? Windows Server 2003.

• Question 556:

  Active Directory Rights Management Services (AD RMS) is deployed on your network. You need to configure AD RMS to use Kerberos authentication. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Register a service principal name (SPN) for AD RMS.
  B. Register a service connection point (SCP) for AD RMS.
  C. Configure the identity setting of the _DRMSAppPool1 application pool.
  D. Configure the useAppPoolCredentials attribute in the Internet Information Services (IIS) metabase.
  A. Register a service principal name (SPN) for AD RMS.
  D. Configure the useAppPoolCredentials attribute in the Internet Information Services (IIS) metabase.

  ---

  Reference: http://technet.microsoft.com/en-us/library/dd759186.aspx

  If you plan to use Active Directory Rights Management Services (AD RMS) with Kerberos authentication, you must take additional steps to configure the server running AD RMS after installing the AD RMS server role and provisioning the server. Specifically, you must perform these procedures: Set the Internet Information Services (IIS) useAppPoolCredentials variable to True Set the Service Principal Names (SPN) value for the AD RMS service account

• Question 557:

  Your network contains three servers named ADFS1, ADFS2, and ADFS3 that run Windows Server 2008 R2. ADFS1 has the Active Directory Federation Services (AD FS) Federation Service role service installed.

  You plan to deploy AD FS 2.0 on ADFS2 and ADFS3.

  You need to export the token-signing certificate from ADFS1, and then import the certificate to ADFS2 and ADFS3.

  In which format should you export the certificate?

  A. Personal Information Exchange PKCS #12 (.pfx)
  B. DER encoded binary X.509 (.cer)
  C. Cryptographic Message Syntax Standard PKCS #7 (.p7b)
  D. Base-64 encoded X.S09 (.cer)
  A. Personal Information Exchange PKCS #12 (.pfx)

  ---

  Reference 1: http://technet.microsoft.com/en-us/library/ff678038.aspx

  Checklist: Migrating Settings in the AD FS 1.x Federation Service to AD FS 2.0 If the AD FS 1.x Federation Service has a token-signing certificate that was issued by a trusted certification authority (CA) and you want to reuse it, you will have to export it from AD FS 1.x.

  [The site provides also a link for instructions on how to export the token-signing certificate. That link point to the site mentioned in reference 2.]

  Reference 2: http://technet.microsoft.com/en-us/library/cc784075.aspx

  Export the private key portion of a token-signing certificate

  To export the private key of a token-signing certificate

  1.

  Click Start, point to Administrative Tools, and then click Active Directory Federation Services.

  2.

  Right-click Federation Service, and then click Properties.

  3.

  On the General tab, click View.

  4.

  In the Certificate dialog box, click the Details tab.

  5.

  On the Details tab, click Copy to File.

  6.

  On the Welcome to the Certificate Export Wizard page, click Next.

  7.

  On the Export Private Key page, select Yes, export the private key, and then click Next.

  8.

  On the Export File Format page, select Personal Information Exchange = PKCS #12 (.PFX), and then click Next.

  9.

  (...)

• Question 558:

  Your network contains an Active Directory forest named contoso.com. The functional level of the forest is Windows Server 2008 R2.

  The DNS zone for contoso.com is Active Directory-integrated. You deploy a read-only domain controller (RODC) named RODC1. You install the DNS Server server role on RODC1.

  You discover that RODC1 does not have any DNS application directory partitions.

  You need to ensure that RODC1 has a copy of the DNS application directory partition of contoso.com.

  What should you do? (Each correct answer presents a complete solution. Choose two.)

  A. From DNS Manager, right-click RODC1 and click Create Default Application Directory Partitions.
  B. Run ntdsutil.exe. From the Partition Management context, run the create nc command.
  C. Run dnscmd.exe and specify the /createbuiltindirectorypartitions parameter.
  D. Run ntdsutil.exe. From the Partition Management context, run the add nc replica command.
  E. Run dnscmd.exe and specify the /enlistdirectorypartition parameter.
  D. Run ntdsutil.exe. From the Partition Management context, run the add nc replica command.
  E. Run dnscmd.exe and specify the /enlistdirectorypartition parameter.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc742490.aspx

  RODC Post-Installation Configuration If you install DNS server after the AD DS installation, you must also enlist the RODC in the DNS application directory partitions. The RODC is not enlisted automatically in the DNS application directory partitions by design because it is a privileged operation. If the RODC were allowed to enlist itself, it would have permissions to add or remove other DNS servers that are enlisted in the application directory partitions.

  To enlist a DNS server in a DNS application directory partition

  1.

  Open an elevated command prompt.

  2.

  At the command prompt, type the following command, and then press ENTER:

  dnscmd /EnlistDirectoryPartition

  For example, to enlist RODC01 in the domain-wide DNS application directory partition in a domain named child.contoso.com, type the following command:

  dnscmd RODC01 /EnlistDirectoryPartition DomainDNSZones.child.contoso.com You might encounter the following error when you run this command:

  Command failed: ERROR_DS_COULDNT_CONTACT_FSMO 8367 0x20AF

  If this error appears, use NTDSUTIL to add the RODC for the partition to be replicated:

  1.

  ntdsutil

  2.

  partition management

  3.

  connections

  4.

  Connect to a writeable domain controller (not an RODC): connect to server .Child.contoso.com

  5.

  quit

  6.

  To enlist this server in the replication scope for this zone, run the following command: add NC Replica DC=DomainDNSZones,DC=Child,DC=Contoso,DC=Com

  .Child.

  contoso.com

  Original explanation:

  Please Check but I think this should be A and C and not A and D.

  I have changed it to A and C.

  Reason: Once the application directory partition is created, contoso.com should replicate to it. Dnscmd /enlistdirectorypartition --- Adds the DNS server to the specified directory partition's replica set.

  Dnscmd /createbuiltindirectorypartitions Creates a DNS application directory partition. When DNS is installed, an application directory partition for the service is created at the forest and domain levels. Use this command to create DNS

  application directory partitions that were deleted or never created. With no parameter, this command creates a built-in DNS directory partition for the domain.

  To create the default DNS application directory partitions

  Using the Windows interface

  Open DNS.

  In the console tree, right-click the applicable DNS server.

  Where?

  DNS/applicable DNS server

  Click Create Default Application Directory Partitions.

  Follow the instructions to create the DNS application directory partitions.

• Question 559:

  Your company has a server that runs Windows Server 2008 R2. The server runs an instance of ActiveDirectory Lightweight Directory Services (AD LDS).

  You need to replicate the AD LDS instance on a test computer that is located on the network.

  What should you do?

  A. Run the repadmin /kcc command on the test computer.
  B. Create a naming context by running the Dsmgmt command on the test computer.
  C. Create a new directory partition by running the Dsmgmt command on the test computer.
  D. Create and install a replica by running the AD LDS Setup wizard on the test computer.
  D. Create and install a replica by running the AD LDS Setup wizard on the test computer.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc771946.aspx Create a Replica AD LDS Instance

  To create an AD LDS instance and join it to an existing configuration set, use the Active Directory Lightweight Directory Services Set Wizard to create a replica AD LDS instance.

  To create a replica AD LDS instance

  1.

  Click Start, point to Administrative Tools, and then click Active Directory Lightweight Directory Services Setup Wizard.

  2.

  On the Welcome to the Active Directory Lightweight Directory Services Setup Wizard page, click Next.

  3.

  On the Setup Options page, click A replica of an existing instance, and then click Next.

  4.

  Finish creating the new instance by following the wizard instructions.

• Question 560:

  You install a standalone root certification authority (CA) on a server named Server1. You need to ensure that every computer in the forest has a copy of the root CA certificate installed in the local computer's Trusted Root Certification Authorities store.

  Which command should you run on Server1?

  A. certreq.exe and specify the -accept parameter
  B. certreq.exe and specify the -retrieve parameter
  C. certutil.exe and specify the -dspublish parameter
  D. certutil.exe and specify the -importcert parameter
  C. certutil.exe and specify the -dspublish parameter

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc732443.aspx

  Certutil.exe is a command-line program that is installed as part of Certificate Services. You can use Certutil.exe to dump and display certification authority (CA) configuration information, configure Certificate Services, back up and restore CA

  components, and verify certificates, key pairs, and certificate chains.

  Syntax

  Certutil <-parameter> [-parameter]

  Parameter

  -dsPublish

  Publish a certificate or certificate revocation list (CRL) to Active Directory