Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 581:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2008 R2. The domain contains a domain controller named DC1. DC1 hosts an Active Directory-integrated zone for contoso.com.

  You enable record scavenging for contoso.com by using the default settings. You configure scavenging to run every seven days.

  After 30 days, you discover that some DNS records of computers that were removed from the network are still present in the contoso.com zone.

  You need to ensure that the scavenging process can remove the stale records.What command should you run? (To answer, select the appropriate options in the answer area.)

  Hot Area:

  

  

• Question 582:

  Your network contains an Active Directory domain named contoso.com. You have an organizational unit (OU) named Sales and an OU named Engineering. Each OU contains over 200 user accounts.

  The Sales OU and the Engineering OU contain several user accounts that are members of a universal group named Group1.

  You have a Group Policy object (GPO) linked to the domain.

  You need to prevent the GPO from being applied to the members of Group1 only.

  What should you do?

  A. Modify the Group Policy permissions.
  B. Configure Restricted Groups.
  C. Configure WMI filtering.
  D. Configure the link order.
  E. Enable loopback processing in merge mode.
  F. Link the GPO to the Sales OU.
  G. Configure Group Policy Preferences.
  H. Link the GPO to the Engineering OU.
  I. Enable block inheritance.
  J. Enable loopback processing in replace mode.
  A. Modify the Group Policy permissions.

  ---

  "GPOs are linked to OUs, not groups. Block inheritance blocks all inherited GPOs from being applied to the OU. The security filter will only help you specify groups. So you have two choices. You could remove authenticated users in the

  security filter and add groups containing everyone except group1 members(messy solution) or you could leave authenticated users there, and specify group1 with deny apply gpo permission for the gpo(since deny will always win over allow)."

  The reference below explains a situation where the GPO only needs to be applied to one group, it's the other way around so to speak.

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 285, 286 Using Security Filtering to Modify GPO Scope

  By now, you've learned that you can link a GPO to a site, domain, or OU. However, you might need to apply GPOs only to certain groups of users or computers rather than to all users or computers within the scope of the GPO. Although you

  cannot directly link a GPO to a security group, there is a way to apply GPOs to specific security groups. The policies in a GPO apply only to users who have Allow Read and Allow Apply Group Policy permissions to the GPO.

  Each GPO has an access control list (ACL) that defines permissions to the GPO. Two permissions, Allow Read and Allow Apply Group Policy, are required for a GPO to apply to a user or computer. If a GPO is scoped to a computer (for

  example, by its link to the computer's OU), but the computer does not have Read and Apply Group Policy permissions, it will not download and apply the GPO. Therefore, by setting the appropriate permissions for security groups, you can

  filter a GPO so that its settings apply only to the computers and users you specify.

  Filtering a GPO to Apply to Specific Groups

  To apply a GPO to a specific security group, perform the following steps:

  4.

  Select the GPO in the Group Policy Objects container in the console tree.

  5.

  In the Security Filtering section, select the Authenticated Users group and click Remove.

  6.

  Click OK to confirm the change.

  7.

  Click Add.

  8.

  Select the group to which you want the policy to apply and click OK.

• Question 583:

  Your network contains an Active Directory domain named contoso.com. You have an organizational unit (OU) named Sales and an OU named Engineering.

  You have two Group Policy objects (GPOs) named GPO1 and GPO2. GPO1 and GPO2 are linked to the Sales OU and contain multiple settings. You discover that GPO2 has a setting that conflicts with a setting in GPO1. When the policies are applied, the setting in GPO2 takes effect.

  You need to ensure that the settings in GPO1 supersede the settings in GPO2. The solution must ensure that all non-conflicting settings in both GPOs are applied.

  A. Configure Restricted Groups.
  B. Configure the link order.
  C. Link the GPO to the Sales OU.
  D. Link the GPO to the Engineering OU.
  E. Enable loopback processing in merge mode.
  F. Modify the Group Policy permissions.
  G. Configure WMI Filtering.
  H. Configure Group Policy Preferences.
  I. Enable loopback processing in replace mode.
  J. Enable block inheritance.
  B. Configure the link order.

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 283 Precedence of Multiple Linked GPOs An OU, domain, or site can have more than one GPO linked to it. In the event of multiple GPOs, the GPOs' link order

  determines their precedence. In Figure 6-10, two GPOs are linked to the People OU.

  

  Figure 6-10 GPO link order The object higher on the list, with a link order of 1, has the highest precedence. Therefore, settings that are enabled or disabled in the Power User Configuration GPO have precedence over these same settings in the Standard User Configuration GPO.

  To change the precedence of a GPO link:

  1.

  Select the OU, site, or domain in the GPMC console tree.

  2.

  Click the Linked Group Policy Objects tab in the details pane.

  3.

  Select the GPO.

  4.

  Use the Up, Down, Move To Top, and Move To Bottom arrow icons to change the link order of the selected GPO.

• Question 584:

  ABC.com has a domain controller that runs Windows Server 2008. The ABC.com network boasts 40 Windows Vista client machines.

  As an administrator at ABC.com, you want to deploy Active Directory Certificate service (AD CS) to authorize the network users by issuing digital certificates.

  What should you do to manage certificate settings on all machines in a domain from one main location?

  A. Configure Enterprise CA certificate settings
  B. Configure Enterprise trust certificate settings
  C. Configure Advance CA certificate settings
  D. Configure Group Policy certificate settings
  E. All of the above
  D. Configure Group Policy certificate settings

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc725911.aspx AD CS: Policy Settings

  In the Windows Server?2008 operating system, certificate-related Group Policy settings enable administrators to manage certificate validation settings according

  to the security needs of the organization.

  What are certificate settings in Group Policy?

  Certificate settings in Group Policy enable administrators to manage the certificate settings on all the computers in the domain from a central location.

• Question 585:

  Your network contains an Active Directory forest named fabrikam.com. The forest contains the following domains:

  

  Fabrikam.com

  

  Eu.fabrikam.com

  

  Na.fabrikam.com

  

  Eu.contoso.com

  

  Na.contoso.com

  You need to configure the forest to ensure that the administrators of any of the domains can specify a user principal name (UPN) suffix o contoso.com when they create user accounts from Active Directory Users and Computers.

  Which tool should you use?

  A. Active Directory Users and Computers
  B. Active Directory Administrative Center
  C. Active Directory Domains and Trusts
  D. Set-ADAccountControl
  C. Active Directory Domains and Trusts

  ---

  To add UPN suffixes

  1.

  Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click Start , click Administrative Tools , and then click Active Directory Domains and Trusts .

  2.

  In the console tree, right-click Active Directory Domains and Trusts , and then click Properties .

  3.

  On the UPN Suffixes tab, type an alternative UPN suffix for the forest, and then click Add .

• Question 586:

  Your company has two domain controllers named DC1 and DC2. DC1 hosts all domain and forest operations master roles. DC1 fails.

  You need to rebuild DC1 by reinstalling the operating system. You also need to rollback all operations master roles to their original state.

  You perform a metadata cleanup and remove all references of DC1.

  Which three actions should you perform next? (To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.)

  Select and Place:

  

  

  ---

  First we need to seize the operations master roles from DC1 to DC2. They are important and need to be in place. Next we rebuild DC1 (not DC2, we need it) and transfer the operations master roles back to DC1.

• Question 587:

  Your network consists of a single Active Directory domain. The functional level of the forest is Windows Server 2008 R2.

  You need to create multiple password policies for users in your domain.

  What should you do?

  A. From the Group Policy Management snap-in, create multiple Group Policy objects.
  B. From the Schema snap-in, create multiple class schema objects.
  C. From the ADSI Edit snap-in, create multiple Password Setting objects.
  D. From the Security Configuration Wizard, create multiple security policies.
  C. From the ADSI Edit snap-in, create multiple Password Setting objects.

  ---

  Answer: From the ADSI Edit snap-in, create multiple Password Setting objects.

  http://technet.microsoft.com/en-us/library/cc770842%28v=ws.10%29.aspx AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide ..

  In Windows Server 2008, you can use fine-grained password policies to specify multiple password policies and apply different password restrictions and account lockout policies to different sets of users within a single domain.

  ..

  To store fine-grained password policies, Windows Server 2008 includes two new object classes in the Active

  Directory Domain Services (AD DS) schema:

  Password Settings Container

  Password Settings The Password Settings Container (PSC) object class is created by default under the System container in the domain. It stores the Password

  Settings objects (PSOs) for that domain. You cannot rename, move, or delete this container.

  ...

  Steps to configure fine-grained password and account lockout policies When the group structure of your organization is defined and implemented, you can configure and apply finegrained password and account lockout policies to users and

  global security groups. Configuring fine-grained password and account lockout policies involves the following steps:

  Step 1: Create a PSO

  Step 2: Apply PSOs to Users and Global Security Groups

  Step 3: Manage a PSO

  Step 4: View a Resultant PSO for a User or a Global Security Group http://technet.microsoft.com/en-us/library/cc754461%28v=ws.10%29.aspx Step 1: Create a PSO

  You can create Password Settings objects (PSOs):

  Creating a PSO using the Active Directory module for Windows PowerShell Creating a PSO using ADSI Edit

  Creating a PSO using ldifde

• Question 588:

  Your network contains an Active Directory domain. The domain is configured as shown in the exhibit.

  

  You have a Group Policy Object (GPO) linked to the domain.

  You need to ensure that the settings in the GPO are not processed by user accounts or computer accounts in the Finance organizational unit (OU). You must achieve this goal by using the minimum amount of administrative effort.

  What should you do?

  A. Modify the Group Policy Permission.
  B. Configure WMI filtering.
  C. Enable block inheritance.
  D. Enable loopback processing in replace mode.
  E. Configure the link order.
  F. Configure Group Policy Preferences.
  G. Link the GPO to the Human Resources OU.
  H. Configure Restricted Groups.
  I. Enable loopback processing in merge mode.
  J. Link the GPO to the Finance OU.
  C. Enable block inheritance.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc731076.aspx

  Block Inheritance

  You can block inheritance for a domain or organizational unit. Blocking inheritance prevents Group Policy objects (GPOs) that are linked to higher sites, domains, or organizational units from being automatically inherited by the child-level.

• Question 589:

  You have an enterprise subordinate certification authority (CA). The CA is configured to use a hardware security module.

  You need to back up Active Directory Certificate Services on the CA.

  Which command should you run?

  A. certutil.exe backup
  B. certutil.exe backupdb
  C. certutil.exe backupkey
  D. certutil.exe store
  B. certutil.exe backupdb

  ---

  Because a hardware security module (HSM) is used that stores the private keys, the command certutil. exe -backup would fail, since we cannot extract the private keys from the module. The HSM should have a proprietary procedure for that.

  The given commands are:

  certutil -backup

  Backup set includes certificate database, CA certificate an the CA key pair certutil -backupdb Backup set only includes certificate database certutil -backupkey Backup set only includes CA certificate and the CA key pair certutil store Provides a dump of the certificate store onscreen. Since we cannot extract the keys from the HSM we have to use backupdb. Reference 1: Microsoft Windows Server(TM) 2003 PKI and Certificate Security (Microsoft Press, 2004) page 215 For the commands listed above. Reference 2: http://technet.microsoft.com/en-us/library/cc732443.aspx Certutil.exe is a command-line program that is installed as part of Certificate Services. You can use Certutil.exe to dump and display certification authority (CA) configuration information, configure Certificate Services, back up and restore CA components, and verify certificates, key pairs, and certificate chains. Syntax Certutil <-parameter> [-parameter] Parameter -backupdb Backup the Active Directory Certificate Services database Reference 3: http://poweradmin.se/blog/2010/01/11/backup-and-restore-for-active-directory-certificate-services/

• Question 590:

  Your company has an Active Directory domain. All servers run Windows Server 2008 R2. Your company uses an Enterprise Root certificate authority (CA). You need to ensure that revoked certificate information is highly available.

  What should you do?

  A. Implement an Online Certificate Status Protocol (OCSP) responder by using an Internet Security and Acceleration Server array.
  B. Publish the trusted certificate authorities list to the domain by using a Group Policy Object (GPO).
  C. Implement an Online Certificate Status Protocol (OCSP) responder by using Network Load Balancing.
  D. Create a new Group Policy Object (GPO) that allows users to trust peer certificates. Link the GPO to the domain.
  C. Implement an Online Certificate Status Protocol (OCSP) responder by using Network Load Balancing.

  ---

  Answer: Implement an Online Certificate Status Protocol (OCSP) responder by using Network Load Balancing. http://technet.microsoft.com/en-us/library/cc731027%28v=ws.10%29.aspx AD CS: Online Certificate Status Protocol Support

  Certificate revocation is a necessary part of the process of managing certificates issued by certification authorities (CAs). The most common means of communicating certificate status is by distributing certificate revocation lists (CRLs). In the Windows Server?2008 operating system, public key infrastructures (PKIs) where the use of conventional CRLs is not an optimal solution, an Online Responder based on the Online Certificate Status Protocol (OCSP) can be used to manage and distribute revocation status information.

  What does OCSP support do?

  The use of Online Responders that distribute OCSP responses, along with the use of CRLs, is one of two common methods for conveying information about the validity of certificates. Unlike CRLs, which are distributed periodically and

  contain information about all certificates that have been revoked or suspended, an Online Responder receives and responds only to requests from clients for information about the status of a single certificate. The amount of data retrieved per

  request remains constant no matter how many revoked certificates there might be.

  In many circumstances, Online Responders can process certificate status requests more efficiently than by using CRLs.

  ..

  Adding one or more Online Responders can significantly enhance the flexibility and scalability of an organization's PKI.

  ..

  Further information:

  http://blogs.technet.com/b/askds/archive/2009/08/20/implementing-an-ocsp-responder-part-v- highavailability.aspx

  Implementing an OCSP Responder: Part V High Availability There are two major pieces in implementing the High Availability Configuration. The first step is to add the OCSP Responders to what is called an Array. When OCSP Responders are configured in an Array, the configuration of the OCSP responders can be easily maintained, so that all Responders in the Array have the same configuration. The configuration of the Array Controller is used as the baseline configuration that is then applied to other members of the Array. The second piece is to load balance the OCSP Responders. Load balancing of the OCSP responders is what actually provides fault tolerance.