Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 561:

  Your company has a main office and five branch offices that are connected by WAN links. The company has an Active Directory domain named contoso.com.

  Each branch office has a member server configured as a DNS server. All branch office DNS servers host a secondary zone for contoso.com.

  You need to configure the contoso.com zone to ensure that clients cache records from the zone for 4 days.

  What should you do?

  A. Configure the Minimum (default) TTL option for the contoso.com zone to 4 days.
  B. Configure the Retry interval option for the contoso.com zone to 4 days.
  C. Configure the Refresh interval option for the contoso.com zone to 4 days.
  D. Configure the Expires after option for the contoso.com zone to 4 days.
  A. Configure the Minimum (default) TTL option for the contoso.com zone to 4 days.

• Question 562:

  A corporate environment includes two Active Directory Domain Services (AD DS) forests, as shown in the following table.

  

  You need to ensure that users in the contoso.com domain can access resources in the eng.fabrikam.com domain. What should you do?

  A. Enable selective authentication.
  B. Enable forest-wide authentication.
  C. Create an external trust between contoso.com and eng.fabrikam.com.
  D. Enable domain-wide authentication.
  C. Create an external trust between contoso.com and eng.fabrikam.com.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc816837.aspx

  Creating External Trusts You can create an external trust to form a one-way or two-way, nontransitive trust with domains that are outside your forest. External trusts are sometimes necessary when users need access to resources that are located in a Windows NT 4.0 domain or in a domain that is in a separate Active Directory Domain Services (AD DS) forest that is not joined by a forest trust.

• Question 563:

  You have two servers named Server1 and Server2. Both servers run Windows Server 2008 R2. Server1 is configured as an Enterprise Root certification authority (CA).

  You install the Online Responder role service on Server2. You need to configure Server2 to issue certificate revocation lists (CRLs) for the enterprise root CA.

  Which two tasks should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Import the enterprise root CA certificate.
  B. Import the OCSP Response Signing certificate.
  C. Add the Server1 computer account to the CertPublishers group.
  D. Set the Startup Type of the Certificate Propagation service to Automatic.
  A. Import the enterprise root CA certificate.
  B. Import the OCSP Response Signing certificate.

  ---

  Further information:

  http://technet.microsoft.com/en-us/library/cc770413%28v=ws.10%29.aspx Online Responder Installation, Configuration, and Troubleshooting Guide Public key infrastructure (PKI) consists of multiple components, including certificates,

  certificate revocation lists (CRLs) and certification authorities (CAs). In most cases, applications that depend on X.509 certificates, such as Secure/Multipurpose Internet Mail Extensions (S/MIME), Secure Sockets Layer (SSL) and smart

  cards, are required to validate the status of the certificates used when performing authentication, signing, or encryption operations. The certificate status and revocation checking is the process by which the validity of certificates is verified

  based on two main categories:

  time and revocation status.

  ..

  Although validating the revocation status of certificates can be performed in multiple ways, the common mechanisms are CRLs, delta CRLs, and Online Certificate Status Protocol (OCSP) responses.

  ...

  http://technet.microsoft.com/en-us/library/cc772393%28v=ws.10%29.aspx Active Directory Certificate Services Step-by-Step Guide http://blogs.technet.com/b/askds/archive/2009/09/01/designing-and-implementing-a-pki-part-i-designandplanning.aspx

  Designing and Implementing a PKI: Part I Design and Planning http://technet.microsoft.com/en-us/library/cc725937.aspx Set Up an Online Responder http://technet.microsoft.com/en-us/library/cc731099.aspx Creating a Revocation

  Configuration

• Question 564:

  Your network contains an Active Directory forest. The forest contains an Active Directory site for a remote office. The remote site contains a read-only domain controller (RODC). You need to configure the RODC to store only the passwords of users in the remote site.

  What should you do?

  A. Create a Password Settings object (PSO).
  B. Modify the Partial-Attribute-Set attribute of the forest.
  C. Add the user accounts of the remote site users to the Allowed RODC Password Replication Group.
  D. Add the user accounts of users who are not in the remote site to the Denied RODC Password Replication Group.
  C. Add the user accounts of the remote site users to the Allowed RODC Password Replication Group.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc730883.aspx Password Replication Policy Allowed and Denied lists Two new built-in groups are introduced in Windows Server 2008 Active Directory domains to support RODC operations. These are the Allowed RODC Password Replication Group and Denied RODC Password Replication Group.

  These groups help implement a default Allowed List and Denied List for the RODC Password Replication Policy. By default, the two groups are respectively added to the msDS- RevealOnDemandGroup and msDSNeverRevealGroup Active Directory attributes mentioned earlier.

• Question 565:

  Your network contains an Active Directory domain named contoso.com. The domain has a branch site that contains a read-only domain controller (RODC) named RODC1.

  A user named User1 is a member of the Allowed RODC Password Replication Group. User1 frequently logs on to a computer in the branchsite.

  You remove User1 from the Allowed RODC Password Replication Group. You need to ensure that the password of User1 is no longer cached on RODC1.

  What should you do?

  A. Add User1 to the Denied RODC Password Replication Group, and then force Active Directory replication.
  B. Run repadmin /rodcpwdrepl rodc2.contoso.com dc.contoso.com cn=User1,cn-users,dc=contoso,dc- com.
  C. Run repadmin /prp delete rodcl.contoso.com allow cn=User1, cn=users, dc=contoso,dc=com.
  D. Reset the password of User1, and then force Active Directory replication.
  D. Reset the password of User1, and then force Active Directory replication.

• Question 566:

  Company runs Window Server 2008 on all of its servers. It has a single Active Directory domain and it uses Enterprise Certificate Authority. The security policy at ABC.com makes it necessary to examine revoked certificate information.

  You need to make sure that the revoked certificate information is available at all times.

  What should you do to achieve that?

  A. Add and configure a new GPO (Group Policy Object) that enables users to accept peer certificates and link the GPO to the domain.
  B. Configure and use a GPO to publish a list of trusted certificate authorities to the domain
  C. Configure and publish an OCSP (Online certificate status protocol) responder through ISAS (Internet Security and Acceleration Server) array.
  D. Use network load balancing and publish an OCSP responder.
  E. None of the above
  D. Use network load balancing and publish an OCSP responder.

  ---

  http://technet.microsoft.com/en-us/library/ee619754%28v=ws.10%29.aspx How Certificate Revocation Works

• Question 567:

  Your network contains an Active Directory domain.

  A user named User1 takes a leave of absence for one year.

  You need to restrict access to the User1 user account while User1 is away.

  What should you do?

  A. From the Default Domain Policy, modify the account lockout settings.
  B. From the Default Domain Controller Policy, modify the account lockout settings.
  C. From the properties of the user account, modify the Account options.
  D. From the properties of the user account, modify the Session settings.
  C. From the properties of the user account, modify the Account options.

  ---

  Account lockout settings deal with logon security, like how many times a wrong password can be entered before an account gets locked out, or after how many minutes a locked out user can try again. To really restrict access to the User1

  account it has to be disabled, by modifying the account options.

  Reference:

  http://blogs.technet.com/b/msonline/archive/2009/08/17/disabling-and-deleting-user-accounts.aspx Disabling a user account prevents user access to e-mail and Microsoft SharePoint Online data, but retains the user's data. Disabling a user

  account also keeps the user license associated with that account. This is the best option to utilize when a person leaves an organization temporarily.

• Question 568:

  A network contains an Active Directory forest. The forest schema contains a custom attribute for user objects.

  You need to view the custom attribute value of 500 user accounts in a Microsoft Excel table.

  Which tool should you use?

  A. Dsmod
  B. Csvde
  C. Ldifde
  D. Dsrm
  B. Csvde

  ---

  We can achieve this by using csvde:

  CSVDE -f onlyusers.csv -r "objectCategory=person" -l "CN," The exported CSV file can be viewed in Excel.

  Reference:

  http://technet.microsoft.com/en-us/library/cc732101.aspx

  Csvde

  Imports and exports data from Active Directory Domain Services (AD DS) using files that store data in the comma-separated value (CSV) format. You can also support batch operations based on the CSV file format standard.

  Syntax

  Csvde [-i] [-f ] [-r ] [-l ] (...) Parameters

  -i

  Specifies import mode. If not specified, the default mode is export.

  -f

  Identifies the import or export file name.

  -r

  Creates an LDAP search filter for data export.

  -l Sets the list of attributes to return in the results of an export query. LDAP can return attributes in any order, and csvde does not attempt to impose any order on the columns. If you omit this parameter, AD DS returns all

  attributes.

• Question 569:

  Your company has a single-domain Active Directory forest. The functional level of the domain is Windows Server 2008.

  You perform the following activities:

  Create a global distribution group.

  Add users to the global distribution group.

  Create a shared folder on a Windows Server 2008 member server.

  Place the global distribution group in a domain local group that has access to the shared folder. You need to ensure that the users have access to the shared folder.

  What should you do?

  A. Add the global distribution group to the Domain Administrators group.
  B. Change the group type of the global distribution group to a security group.
  C. Change the scope of the global distribution group to a Universal distribution group.
  D. Raise the forest functional level to Windows Server 2008.
  B. Change the group type of the global distribution group to a security group.

  ---

  http://kb.iu.edu/data/ajlt.html

  In Microsoft Active Directory, what are security and distribution groups? In Microsoft Active Directory, when you create a new group, you must select a group type.

  The two group types, security and distribution, are described below:

  Security: Security groups allow you to manage user and computer access to shared resources. You can also control who receives group policy settings. This simplifies administration by allowing you to set permissions once on multiple

  computers, then to change the membership of the group as your needs change. The change in group membership automatically takes effect everywhere. You can also use these groups as email distribution lists.

  Distribution: Distribution groups are intended to be used solely as email distribution lists. These lists are for use with email applications such as Microsoft Exchange or Outlook. You can add and remove contacts from the list so that they will or

  will not receive email sent to the distribution group. You can't use distribution groups to assign permissions on any objects, and you can't use them to filter group policy settings.

  http://technet.microsoft.com/en-us/library/cc781446%28v=ws.10%29.aspx Group types

• Question 570:

  Your company has a DNS server that has 10 Active Directory integrated zones.

  You need to provide copies of the zone files of the DNS server to the security department.

  What should you do?

  A. Run the dnscmd /ZoneInfo command.
  B. Run the ipconfig /registerdns command.
  C. Run the dnscmd /ZoneExport command.
  D. Run the ntdsutil > Partition Management > List commands.
  C. Run the dnscmd /ZoneExport command.

  ---

  http://servergeeks.wordpress.com/2012/12/31/dns-zone-export/ DNS Zone Export In Non-AD Integrated DNS Zones DNS zone file information is stored by default in the %systemroot%\windows\system32\dns folder. When the DNS Server service starts it loads zones from these files. This behavior is limited to any primary and secondary zones that are not AD integrated. The files will be named as .dns.

  

  In AD Integrated DNS Zones AD-integrated zones are stored in the directory they do not have corresponding zone files i.e. they are not stored as .dns files. This makes sense because the zones are stored in, and loaded from, the directory. Now it is important task for us to take a backup of these AD integrated zones before making any changes to DNS infrastructure. Dnscmd.exe can be used to export the zone to a file. The syntax of the command is: DnsCmd /ZoneExport -- FQDN of zone to export /Cache to export cache As an example, let's say we have an AD integrated zone named habib.local, our DC is server1. The command to export the file would be: Dnscmd server1 /ZoneExport habib.local habib.local.bak

  

  

  You can refer to a complete article on DNSCMD in Microsoft TechNet website http://technet.microsoft.com/en-us/library/cc772069(v=ws.10).aspx