Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 51:

  You network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2.

  You need to reset the Directory Services Restore Mode (DSRM) password on a domain controller.

  What tool should you use?

  A. Active Directory Users and Computers snap-in
  B. ntdsutil
  C. Local Users and Groups snap-in
  D. dsmod
  B. ntdsutil

  ---

  http://technet.microsoft.com/en-us/library/cc753343%28v=ws.10%29.aspx Ntdsutil

  Ntdsutil.exe is a command-line tool that provides management facilities for Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS). You can use the ntdsutil commands to perform database

  maintenance of AD DS, manage and control single master operations, and remove metadata left behind by domain controllers that were removed from the network without being properly uninstalled. This tool is intended for use by

  experienced administrators.

  ..

  Commands set DSRM password - Resets the Directory Services Restore Mode (DSRM) administrator password.

  Further information:

  http://technet.microsoft.com/en-us/library/cc754363%28v=ws.10%29.aspx Set DSRM password

  Resets the Directory Services Restore Mode (DSRM) password on a domain controller. At the Reset DSRM Administrator Password: prompt, type any of the parameters listed under "Syntax." This is a subcommand of Ntdsutil and Dsmgmt.

  Ntdsutil and Dsmgmt are command-line tools that are built into Windows Server 2008 and Windows Server 2008 R2. Ntdsutil is available if you have the Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory

  Services (AD LDS) server role installed.

  Dsmgmt is available if you have the AD LDS server role installed. These tools are also available if you install the Active Directory Domain Services Tools that are part of the Remote Server Administration Tools (RSAT).

• Question 52:

  Your network contains an Active Directory domain. The domain is configured as shown in the exhibit. (Click the Exhibit button.)

  

  You have two Group Policy objects (GPOs) named GPO1 and GPO2. GPO1 and GPO2 are linked to the Finance organizational unit (OU) and contain multiple settings.

  You discover that GPO2 has a setting that conflicts with a setting in GPO1. When the policies are applied, the setting in GPO2 takes effect.

  You need to ensure that the settings in GPO1 supersede the settings in GPO2. The solution must ensure that all non-conflicting settings in both GPOs are applied.

  What should you do?

  A. Modify the Group Policy permissions.
  B. Enable block inheritance.
  C. Configure the link order.
  D. Enable loopback processing in merge mode.
  E. Enable loopback processing in replace mode.
  F. Configure WMI filtering.
  G. Configure Restricted Groups.
  H. Configure Group Policy Preferences.
  I. Link the GPO to the Finance OU.
  J. Link the GPO to the Human Resources OU.
  C. Configure the link order.

• Question 53:

  Your network contains a domain controller that runs Windows Server 2008 R2.

  You need to change the location of the Active Directory log files.

  Which tool should you use?

  A. Dsamain
  B. Dsmgmt
  C. Dsmove
  D. Ntdsutil
  D. Ntdsutil

  ---

  http://support.microsoft.com/kb/257420 How To Move the Ntds.dit File or Log Files Moving a Database or Log File

  1.

  Restart the domain controller.

  2.

  Press F8 at the Startup menu, and then click Directory Services Restore Mode.

  3.

  Select the appropriate installation if more than one exists, and then log on as an administrator at the logon prompt.

  4.

  Start a command prompt, and then type ntdsutil.exe.NOTE: To get a list of commands that you can use at the Ntdsutil prompt, type ?

  5.

  At a Ntdsutil prompt, type files.

  6.

  At the File Maintenance prompt, use one or both of the following procedures:

  *

  To move a database, type move db to %s, where %s is the drive and folder where you want the database moved.

  *

  To move log files, type move logs to %s, where %s is the drive and folder where you want the log files moved.

  7.

  To view the log files or database, type info. To verify the integrity of the database at its new location, type integrity.

  8.

  Type quit, and then type quit to return to a command prompt.

  9.

  Restart the computer in Normal mode.

  NOTE: When you move the database and log files, you must back up the domain controller.

• Question 54:

  Your network contains an Active Directory forest named contoso.com. The forest contains six domains.

  You need to ensure that the administrators of any of the domains can specify a user principal name (UPN) suffix of litwareinc.com when they create user accounts by using Active Directory Users and Computers.

  Which tool should you use?

  A. Set-ADAccountControl
  B. Active Directory Domains and Trusts
  C. Set-ADDomain
  D. Active Directory Users and Computers
  C. Set-ADDomain

• Question 55:

  You have an enterprise subordinate certification authority (CA). You have a custom certificate template that has a key length of 1,024 bits. The template is enabled for autoenrollment.

  You increase the template key length to 2,048 bits.

  You need to ensure that all current certificate holders automatically enroll for a certificate that uses the new template.

  Which console should you use?

  A. Active Directory Administrative Center
  B. Certification Authority
  C. Certificate Templates
  D. Group Policy Management
  C. Certificate Templates

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc771246.aspx

  Re-Enroll All Certificate Holders

  This procedure is used when a critical change is made to the certificate template and you want all subjects that hold a certificate that is based on this template to re-enroll as quickly as possible. The next time the subject verifies the version of

  the certificate against the version of the template on the certification authority (CA), the subject will re-enroll.

  Membership in Domain Admins or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. For more information, see Implement Role-Based Administration.

  To re-enroll all certificate holders

  1.

  Open the Certificate Templates snap-in.

  2.

  Right-click the template that you want to use, and then click Reenroll All Certificate Holders.

• Question 56:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1.

  You install Active Directory Lightweight Directory Services (AD LDS) on a member server named Server2. On Server2, you create a directory partition named fabrikam.com.

  You need to configure the MS-AdamSyncConfig.xml file to synchronize data from contoso.com to fabrikam.com.

  What should you do? (To answer, select the appropriate options in the answer area.)

  Hot Area:

  

  

• Question 57:

  As the Company administrator you had installed a read-only domain controller (RODC) server at remote location. The remote location doesn't provide enough physical security for the server.

  What should you do to allow administrative accounts to replicate authentication information to Read- Only Domain Controllers?

  A. Remove any administrative accounts from RODC's group
  B. Add administrative accounts to the domain Allowed RODC Password Replication group
  C. Set the Deny on Receive as permission for administrative accounts on the RODC computer account Security tab for the Group Policy Object (GPO)
  D. Configure a new Group Policy Object (GPO) with the Account Lockout settings enabled. Link the GPO to the remote location. Activate the Read Allow and the Apply group policy Allow permissions for the administrators on the Security tab for the GPO.
  E. None of the above
  B. Add administrative accounts to the domain Allowed RODC Password Replication group

  ---

  

  http://technet.microsoft.com/en-us/library/cc730883%28v=ws.10%29.aspx Password Replication Policy When you initially deploy an RODC, you must configure the Password Replication Policy on the writable domain controller that will be its replication partner. The Password Replication Policy acts as an access control list (ACL). It determines if an RODC should be permitted to cache a password. After the RODC receives an authenticated user or computer logon request, it refers to the Password Replication Policy to determine if the password for the account should be cached. The same account can then perform subsequent logons more efficiently. The Password Replication Policy lists the accounts that are permitted to be cached, and accounts that are explicitly denied from being cached. The list of user and computer accounts that are permitted to be cached does not imply that the RODC has necessarily cached the passwords for those accounts. An administrator can, for example, specify in advance any accounts that an RODC will cache. This way, the RODC can authenticate those accounts, even if the WAN link to the hub site is offline. .. Password Replication Policy Allowed and Denied lists Two new built-in groups are introduced in Windows Server 2008 Active Directory domains to support RODC operations. These are the Allowed RODC Password Replication Group and Denied RODC Password Replication Group. These groups help implement a default Allowed List and Denied List for the RODC Password Replication Policy. By default, the two groups are respectively added to the msDS- RevealOnDemandGroup and msDSNeverRevealGroup Active Directory attributes mentioned earlier. By default, the Allowed RODC Password Replication Group has no members. Also by default, the Allowed List attribute contains only the Allowed RODC Password Replication Group. By default, the Denied RODC Password Replication Group contains the following members: Enterprise Domain Controllers Enterprise Read-Only Domain Controllers Group Policy Creator Owners Domain Admins Cert Publishers Enterprise Admins Schema Admins Domain-wide krbtgt account By default, the Denied List attribute contains the following security principals, all of which are built-in groups: Denied RODC Password Replication Group Account Operators Server Operators Backup Operators Administrators The combination of the Allowed List and Denied List attributes for each RODC and the domain-wide Denied RODC Password Replication Group and Allowed RODC Password Replication Group give administrators great flexibility. They can decide precisely which accounts can be cached on specific RODCs. The following table summarizes the three possible administrative models for the Password Replication Policy.

  

• Question 58:

  You are the network administrator for an organization that has two locations, New York and London.

  Each location has multiple domains but all domains fall under the same tree, Stellacon.com. Users in the NY.us.stellacon.com domain need to access resources in the London.uk.stellacon.comdomain.

  You need to reduce the amount of time it takes for authentication when users from NY.us.stellacon.com access resources in London.uk.stellacon.com.

  What can you do?

  A. Set up a one-way shortcut trust from London.uk.stellacon.com to NY.us.stellacon.com.
  B. Set up a one-way shortcut trust from NY.us.stellacon.com to London.uk.stellacon.com.
  C. Enable Universal Group Membership Caching in NY.us.stellacon.com.
  D. Enable Universal Group Membership Caching in London.uk.stellacon.com.
  A. Set up a one-way shortcut trust from London.uk.stellacon.com to NY.us.stellacon.com.

  ---

  Basically the same as B/Q7.

  http://technet.microsoft.com/en-us/library/cc754538.aspx

  Understanding When to Create a Shortcut Trust

  When to create a shortcut trust

  Shortcut trusts are one-way or two-way, transitive trusts that administrators can use to optimize the authentication process.

  Authentication requests must first travel a trust path between domain trees. In a complex forest this can take time, which you can reduce with shortcut trusts. A trust path is the series of domain trust relationships that authentication requests

  must traverse between any two domains. Shortcut trusts effectively shorten the path that authentication requests travel between domains that are located in two separate domain trees.

  Shortcut trusts are necessary when many users in a domain regularly log on to other domains in a forest.

  Using the following illustration as an example, you can form a shortcut trust between domain B and domain D, between domain A and domain 1, and so on.

  

  Using one-way trusts A one-way, shortcut trust that is established between two domains in separate domain trees can reduce the time that is necessary to fulfill authentication requests--but in only one direction. For example, when a oneway, shortcut trust is established between domain A and domain B, authentication requests that are made in domain A to domain B can use the new one-way trust path. However, authentication requests that are made in domain B to domain A must still travel the longer trust path.

  Using two-way trusts A two-way, shortcut trust that is established between two domains in separate domain trees reduces the time that is necessary to fulfill authentication requests that originate in either domain. For example, when a two-way trust is established between domain A and domain B, authentication requests that are made from either domain to the other domain can use the new, two-way trust path.

• Question 59:

  Your network contains an Active Directory domain. The domain contains two sites named Site1 and Site2. Site 1 contains five domain controllers. Site2 contains one read-only domain controller (RODC). Site1 and Site2 connect to each other by using a slow WAN link.

  You discover that the cached password for a user named User1 is compromised on the RODC. On a domain controller in Site1, you change the password for User1.

  You need to replicate the new password for User1 to the RODC immediately. The solution must not replicate other objects to the RODC.

  Which tool should you use?

  A. Active Directory Sites and Services
  B. Active Directory Users and Computers
  C. Repadmin
  D. Replmon
  C. Repadmin

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc742095.aspx

  Repadmin /rodcpwdrepl

  Triggers replication of passwords for the specified users from a writable Windows Server 2008 source domain controller to one or more read-only domain controllers (RODCs).

  Example:

  The following example triggers replication of the passwords for the user account named JaneOh from the source domain controller named source-dc01 to all RODCs that have the name prefix dest-rodc:

  repadmin /rodcpwdrepl dest-rodc* source-dc01 cn=JaneOh,ou=execs,dc=contoso,dc=com

• Question 60:

  Your company has an Active Directory forest. Each branch office has an organizational unit and a child organizational unit named Sales.

  The Sales organizational unit contains all users and computers of the sales department.

  You need to install an Office 2007 application only on the computers in the Sales organizational unit.

  You create a GPO named SalesApp GPO.

  What should you do next?

  A. Configure the GPO to assign the application to the computer account. Link the SalesAPP GPO to the Sales organizational unit in each location.
  B. Configure the GPO to assign the application to the computer account. Link the SalesAPP GPO to the domain.
  C. Configure the GPO to publish the application to the user account. Link the SalesAPP GPO to the Sales organizational unit in each location.
  D. Configure the GPO to assign the application to the user account. Link the SalesAPP GPO to the Sales organizational unit in each location.
  A. Configure the GPO to assign the application to the computer account. Link the SalesAPP GPO to the Sales organizational unit in each location.