Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 571:

  Your network contains an Active Directory domain named contoso.com. The network contains client computers that run either Windows Vista or Windows 7. Active Directory Rights Management Services (AD RMS) is deployed on the network.

  You create a new AD RMS template that is distributed by using the AD RMS pipeline. The template is updated every month.

  You need to ensure that all the computers can use the most up-to-date version of the AD RMS template.

  You want to achieve this goal by using the minimum amount of administrative effort.

  What should you do?

  A. Upgrade all of the Windows Vista computers to Windows 7.
  B. Upgrade all of the Windows Vista computers to Windows Vista Service Pack 2 (SP2).
  C. Assign the Microsoft Windows Rights Management Services (RMS) Client Service Pack 2 (SP2) to all users by using a Software Installation extension of Group Policy.
  D. Assign the Microsoft Windows Rights Management Services (RMS) Client Service Pack 2 (SP2) to all computers by using a Software Installation extension of Group Policy.
  B. Upgrade all of the Windows Vista computers to Windows Vista Service Pack 2 (SP2).

• Question 572:

  Your network contains an Active Directory domain named contoso.com. The domain contains an enterprise certification authority (CA). You plan to deploy certificates to all of the domain users. The certificates will be based on a custom

  Smartcard Logon template.

  You need to recommend a solution to ensure that the users can log on to the domain by using smart cards.

  What should you include in the recommendation?

  A. From Certificate Templates, set the minimum certificate key size to 512.
  B. From Active Directory Users and Computers, select Use Kerberos DES encryption types for this account.
  C. From Certificate Templates, include the user principal name (UPN) in the subject alternate name (SAN) of the template.
  D. From Active Directory Users and Computers, configure Published Certificates for user accounts.
  C. From Certificate Templates, include the user principal name (UPN) in the subject alternate name (SAN) of the template.

  ---

  Request a smart card certificate from the third-party CA.

  Enroll for a certificate from the third-party CA that meets the stated requirements. The method for enrollment varies by the CA vendor.

  The smart card certificate has specific format requirements:

  *

  Subject Alternative Name = Other Name: Principal Name= (UPN). For example:

  UPN = [email protected]

  The UPN OtherName OID is : "1.3.6.1.4.1.311.20.2.3"

  The UPN OtherName value: Must be ASN1-encoded UTF8 string

  *

  Subject = Distinguished name of user.

  *

  The CRL Distribution Point (CDP) location (where CRL is the Certification Revocation List) must be populated, online, and available.

  *

  Key Usage = Digital Signature

  *

  Basic Constraints [Subject Type=End Entity, Path Length Constraint=None] (Optional)

  *

  Enhanced Key Usage

• Question 573:

  Your network contains an Active Directory-integrated zone. All DNS servers that host the zone are domain controllers.

  You add multiple DNS records to the zone.

  You need to ensure that the records are replicated to all DNS servers.

  Which tool should you use?

  A. Dnslint
  B. Ldp
  C. Nslookup
  D. Repadmin
  D. Repadmin

  ---

  To make sure that the new DNS records are replicated to all DNS servers we can use the repadmin tool.

  Reference:

  http://technet.microsoft.com/en-us/library/cc811569.aspx

  Forcing Replication Sometimes it becomes necessary to forcefully replicate objects and entire partitions between domain controllers that may or may not have replication agreements. Force a replication event with all partners The repadmin /

  syncall command synchronizes a specified domain controller with all replication partners.

  Syntax

  repadmin /syncall [] []

  Parameters

  Specifies the host name of the domain controller to synchronize with all replication partners. Specifies the distinguished name of the directory partition.

  Performs specific actions during the replication.

• Question 574:

  Your network contains a server named Server1. The Active Directory Rights Management Services (AD RMS) server role is installed on Server1.

  An administrator changes the password of the user account that is used by AD RMS.

  You need to update AD RMS to use the new password.

  Which console should you use?

  A. Active Directory Rights Management Services
  B. Active Directory Users and Computers
  C. Component Services
  D. Services
  A. Active Directory Rights Management Services

  ---

  http://social.technet.microsoft.com/wiki/contents/articles/13034.ad-rms-how-to-change-the-rms- serviceaccount-password.aspx

  AD RMS How To: Change the RMS Service Account Password The Active Directory Rights Management Services management console provides a wizard to change or update the AD RMS service account. The most common use for this process is to update the service account password when it has been changed. It is important to use this process to update or change the AD RMS service account. This ensures the necessary components are updated properly. These processes include, but are not limited to the following items. Ensure the service account meets the criteria (is a domain account, is not the domain account that provisioned RMS, and etc.) Temporarily suspends RMS functionality on the server during the change Updates the RMS local groups Updates the database role for the service account Updates and restarts the MSMQ and logging services Updates the service account for the _DRMSAppPool1 web application pool Updates appropriate AD RMS configuration database tables There are important requirements to run this wizard. Must be logged on to the AD RMS server Account running the wizard must be:

  *

  A local administrator on the RMS server,

  *

  A member of the AD RMS Enterprise Administrators group, and

  *

  A SQL SysAdmin on the AD RMS instance Lastly, this must be performed on each server of the AD RMS cluster

  

  

• Question 575:

  Your company has an Active Directory domain that has an organizational unit named Sales. The Sales organizational unit contains two global security groups named sales managers and sales executives.

  You need to apply desktop restrictions to the sales managers group. You must not apply these desktop restrictions to the sales executive group.

  You create a GPO named DesktopLockdown and link it to the Sales organizational unit.

  What should you do next?

  A. Configure the Deny Apply Group Policy permission for Authenticated Users on the DesktopLockdown GPO.
  B. Configure the Allow Apply Group Policy permission for Authenticated Users on the DesktopLockdown GPO.
  C. Configure the Deny Apply Group Policy permission for the sales executives on the DesktopLockdown GPO.
  D. Configure the Deny Apply Group Policy permission for the sales managers on the DesktopLockdown GPO.
  C. Configure the Deny Apply Group Policy permission for the sales executives on the DesktopLockdown GPO.

• Question 576:

  Company has an Active Directory forest with six domains. The company has 5 sites. The company requires a new distributed application that uses a custom application directory partition named ResData for data replication.

  The application is installed on one member server in five sites.

  You need to configure the five member servers to receive the ResData application directory partition for data replication.

  What should you do?

  A. Run the Dcpromo utility on the five member servers.
  B. Run the Regsvr32 command on the five member servers
  C. Run the Webadmin command on the five member servers
  D. Run the RacAgent utility on the five member servers
  A. Run the Dcpromo utility on the five member servers.

  ---

  http://technet.microsoft.com/en-us/library/cc732887%28v=ws.10%29.aspx Dcpromo Syntax dcpromo [/answer[:] | /unattend[:] | /unattend | /adv] /uninstallBinaries [/CreateDCAccount | /UseExistingAccount:Attach] /? /?[:

  {Promotion | CreateDCAccount | UseExistingAccount |Demotion}]dcpromo Promotion operation parameters:

  ApplicationPartitionsToReplicate:""

  Specifies the application directory partitions that dcpromo will replicate. Use the following format:

  "partition1" "partition2" "partitionN"

  Use * to replicate all application directory partitions.

• Question 577:

  Your network contains an Active Directory domain named fabrikam.com. The domain has one Active Directory site.

  The domain contains an organizational unit (OU) named SalesOU. SalesOU contains all of the user accounts for the sales department. Some of the sales users are temporary employees. You apply a Group Policy object (GPO) named

  SalesGPO to SalesOU.

  You need to prevent SalesGPO from being applied to the temporary sales employees. All other sales employees must have SalesGPO applied to them.

  What should you do?

  A. Configure the permissions on the user accounts of the temporary sales employees.
  B. Configure the permissions of SalesGPO.
  C. Link SalesGPO to the site and remove the link for SalesGPO from SalesOU.
  D. Disable the computer configurations of SalesGPO.
  B. Configure the permissions of SalesGPO.

• Question 578:

  Exhibit:

  

  Company servers run Windows Server 2008. It has a single Active Directory domain. A server called S4 has file services role installed. You install some disk for additional storage. The disks are configured as shown in the exhibit.

  To support data stripping with parity, you have to create a new drive volume.

  What should you do to achieve this objective?

  A. Build a new spanned volume by combining Disk0 and Disk1
  B. Create a new Raid-5 volume by adding another disk.
  C. Create a new virtual volume by combining Disk 1 and Disk 2
  D. Build a new striped volume by combining Disk0 and Disk 2
  B. Create a new Raid-5 volume by adding another disk.

  ---

  https://sort.symantec.com/public/documents/sf/5.0/solaris/html/vxvm_admin/ag_ch_intro_vm17.html

  

• Question 579:

  Company has a server with Active Directory Rights Management Services (AD RMS) server installed. Users have computers with Windows Vista installed on them with an Active Directory domain installed at Windows Server 2003 functional level.

  As an administrator at Company, you discover that the users are unable to benefit from AD RMS to protect their documents.

  You need to configure AD RMS to enable users to use it and protect their documents.

  What should you do to achieve this functionality?

  A. Configure an email account in Active Directory Domain Services (AD DS) for each user.
  B. Add and configure ADRMSADMIN account in local administrators group on the user computers
  C. Add and configure the ADRMSSRVC account in AD RMS server's local administrator group
  D. Reinstall the Active Directory domain on user computers
  E. All of the above
  A. Configure an email account in Active Directory Domain Services (AD DS) for each user.

  ---

  http://technet.microsoft.com/en-us/library/cc753531%28v=ws.10%29.aspx AD RMS Step-by-Step Guide

  For each user account and group that you configure with AD RMS, you need to add an e-mail address and then assign the users to groups.

• Question 580:

  Your company has an Active Directory domain. All servers run Windows Server 2008 R2. Your company runs an Enterprise Root certification authority (CA).

  You need to ensure that only administrators can sign code.

  Which two tasks should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Edit the local computer policy of the Enterprise Root CA to allow only administrators to manage Trusted Publishers.
  B. Modify the security settings on the template to allow only administrators to request code signing certificates.
  C. Edit the local computer policy of the Enterprise Root CA to allow users to trust peer certificates and allow only administrators to apply the policy.
  D. Publish the code signing template.
  B. Modify the security settings on the template to allow only administrators to request code signing certificates.
  D. Publish the code signing template.

  ---

  http://techblog.mirabito.net.au/?p=297

  Generating and working with code signing certificates A code signing certificate is a security measure designed to assist in the prevention of malicious code execution. The intention is that code must be "signed" with a certificate that is trusted by the machine on which the code is executed. The trust is verified by contacting the certification authority for the certificate, which could be either a local (on the machine itself, such as a self-signed certificate), internal (on the domain, such as an enterprise certification authority) or external certification authority (third party, such as Verisign or Thawte).

  For an Active Directory domain with an enterprise root certification authority, the enterprise root certification authority infrastructure is trusted by all machines that are a member of the Active Directory domain, and therefore any certificates issued by this certification authority are automatically trusted.

  In the case of code signing, it may be necessary also for the issued certificate to be in the "Trusted Publishers" store of the local machine in order to avoid any prompts upon executing code, even if the certificate was issued by a trusted certification authority. Therefore, it is required to ensure that certificates are added to this store where user interaction is unavailable, such as running automated processes that call signed code.

  A certificate can be assigned to a user or a computer, which will then be the "publisher" of the code in question.

  Generally, this should be the user, and the user will then become the trusted publisher. As an example, members of the development team in your organisation will probably each have their own code signing certificate, which would all be added to the "Trusted Publishers" store on the domain machines. Alternatively, a special domain account might exist specifically for signing code, although one of the advantages of code signing is to be able to determine the person who signed it.