Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 591:

  You are the network administrator for an organization that has all Windows Server 2008 R2 domain controllers.

  You need to capture all replication errors that occur between all domain controllers.

  What should you do?

  A. Use System Performance data collector sets.
  B. Use ntdsutil.
  C. Configure event log subscriptions.
  D. Use the ADSI Edit tool.
  C. Configure event log subscriptions.

  ---

  http://technet.microsoft.com/en-us/library/cc748890.aspx Configure Computers to Forward and Collect Events Before you can create a subscription to collect events on a computer, you must configure both the collecting computer (collector) and each computer from which events will be collected (source).

  http://technet.microsoft.com/en-us/library/cc749183.aspx

  Event Subscriptions Event Viewer enables you to view events on a single remote computer. However, troubleshooting an issue might require you to examine a set of events stored in multiple logs on multiple computers. Windows Vista includes the ability to collect copies of events from multiple remote computers and store them locally. To specify which events to collect, you create an event subscription. Among other details, the subscription specifies exactly which events will be collected and in which log they will be stored locally. Once a subscription is active and events are being collected, you can view and manipulate these forwarded events as you would any other locally stored events. Using the event collecting feature requires that you configure both the forwarding and the collecting computers. The functionality depends on the Windows Remote Management (WinRM) service and the Windows Event Collector (Wecsvc) service. Both of these services must be running on computers participating in the forwarding and collecting process. http://technet.microsoft.com/en-us/library/cc961808.aspx

• Question 592:

  Your network contains an Active Directory forest named contoso.com. You need to identify whether a fine-grained password policy is applied to a specific group.

  Which tool should you use?

  A. Active Directory Sites and Services
  B. Authorization Manager
  C. Local Security Policy
  D. ADSI Edit
  D. ADSI Edit

  ---

  Use ADSI Edit to determine the value of the msDS-PSOApplied attribute of the specific group:

  1.

  Open the Properties windows for the group in ADSI Edit

  2.

  On the Attribute Editor tab click Filter

  3.

  Ensure that the Show attributes/Optional check box is selected.

  4.

  Ensure that the Show read-only attributes/Backlinks check box is selected.

  5.

  Locate the value of msDS-PSOApplied in the Attributes list.

  Reference: http://technet.microsoft.com/en-us/library/cc754544.aspx

  Defining the scope of fine-grained password policies A PSO can be linked to a user (or inetOrgPerson) or a group object that is in the same domain as the PSO: (...) A new attribute named msDS-PSOApplied has been added to the user and group objects in Windows Server 2008. The msDS-PSOApplied attribute contains a back-link to the PSO. Because the msDSPSOApplied attribute has a back-link, a user or group can have multiple PSOs applied to it. As stated previously, in Windows Server 2008, a user or group can have multiple PSOs applied to it since the msDS-PSOApplied attribute of the user and group objects has a back-link to the PSO.

• Question 593:

  Your network contains an Active Directory Rights Management Services (AD RMS) cluster.

  You have several custom policy templates. The custom policy templates are updated frequently. Some users report that it takes as many as 30 days to receive the updated policy templates.

  You need to ensure that users receive the updated custom policy templates within seven days.

  What should you do?

  A. Modify the registry on the AD RMS servers.
  B. Modify the registry on the users' computers.
  C. Change the schedule of the AD RMS Rights Policy Template Management (Manual) scheduled task.
  D. Change the schedule of the AD RMS Rights Policy Template Management (Automated) scheduled task.
  B. Modify the registry on the users' computers.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc771971.aspx

  Configuring the AD RMS client The automated scheduled task will not query the AD RMS template distribution pipeline each time that this scheduled task runs. Instead, it checks updateFrequency DWORD value registry entry. This registry entry specifies the time interval (in days) after which the client should update its rights policy templates. By default the registry key is not present on the client computer. In this scenario, the client checks for new, deleted, or modified rights policy templates every 30 days. To configure an interval other than 30 days, create a registry entry at the following location: HKEY_CURRENT_USER\Software\Policies\Microsoft\MSDRM \TemplateManagement. In this registry key, you can also configure the updateIfLastUpdatedBeforeTime, which forces the client computer to update its rights policy templates.

• Question 594:

  You install a read-only domain controller (RODC) named RODC1. You need to ensure that a user named User1 can administer RODC1. The solution must minimize the number of permissions assigned to User1.

  Which tool should you use?

  A. Active Directory Administrative Center
  B. Active Directory Users and Computers
  C. Dsadd
  D. Dsmgmt
  B. Active Directory Users and Computers

  ---

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc755310.aspx

  Delegating local administration of an RODC

  Administrator Role Separation (ARS) is an RODC feature that you can use to delegate the ability to administer an RODC to a user or a security group. When you delegate the ability to log on to an RODC to a user or a security group, the user

  or group is not added the Domain Admins group and therefore does not have additional rights to perform directory service operations.

  Steps and best practices for setting up ARS

  You can specify a delegated RODC administrator during an RODC installation or after it.

  To specify the delegated RODC administrator after installation, you can use either of the following options:

  Modify the Managed By tab of the RODC account properties in the Active Directory Users and Computers snap-in, as shown in the following figure. You can click Change to change which security principal is the delegated RODC

  administrator. You can choose only one security principal. Specify a security group rather than an individual user so you can control RODC administration permissions most efficiently. This method changes the managedBy attribute of the

  computer object that corresponds to the RODC to the SID of the security principal that you specify. This is the recommended way to specify the delegated RODC administrator account because the information is stored in AD DS, where it can

  be centrally managed by domain administrators.

  

  Use the ntdsutil local roles command or the dsmgmt local roles command. You can use this command to view, add, or remove members from the Administrators group and other built-in groups on the RODC. [See also the second reference

  for more information on how to use dsmgmt.]

  Using ntdsutil or dsmgmt to specify the delegated RODC administrator account is not recommended because the information is stored only locally on the RODC.

  Therefore, when you use ntdsutil local roles to delegate an administrator for the RODC, the account that you specify does not appear on the Managed By tab of the RODC account properties. As a result, using the Active Directory Users and

  Computers snap-in or a similar tool will not reveal that the RODC has a delegated administrator.

  In addition, if you demote an RODC, any security principal that you specified by using ntdsutil local roles remains stored in the registry of the server. This can be a security concern if you demote an RODC in one domain and then promote it to

  be an RODC again in a different domain. In that case, the original security principal would have administrative rights on the new RODC in the different domain.

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc732301.aspx

  Administrator Role Separation Configuration

  This section provides procedures for creating a local administrator role for an RODC and for adding a user to that role.

  To configure Administrator Role Separation for an RODC

  1.

  Click Start, click Run, type cmd, and then press ENTER.

  2.

  At the command prompt, type dsmgmt.exe, and then press ENTER.

  3.

  At the DSMGMT prompt, type local roles, and then press ENTER.

  4.

  For a list of valid parameters, type ?, and then press ENTER. By default, no local administrator role is defined on the RODC after AD DS installation. To add the local administrator role, use the Add parameter.

  5.

  Type add \ For example, type add CONTOSO\testuser administrators

• Question 595:

  Your company has two domain controllers that are configured as internal DNS servers. All zones on the DNS servers are Active Directory-integrated zones. The zones allow all dynamic updates.

  You discover that the contoso.com zone has multiple entries for the host names of computers that do not exist.

  You need to configure the contoso.com zone to automatically remove expired records.

  What should you do?

  A. Enable only secure updates on the contoso.com zone,
  B. Enable scavenging and configure the refresh interval on the contoso.com zone.
  C. From the Start of Authority tab, decrease the default refresh interval on the contoso.com zone.
  D. From the Start of Authority tab, increase the default expiration interval on the contoso.com zone
  B. Enable scavenging and configure the refresh interval on the contoso.com zone.

  ---

  http://www.it-support.com.au/configure-aging-and-scavenging-of-a-dns-server/2012/12/ Configure aging and scavenging of a DNS Server

  Resource records that are either outdated or decayed from DNS zone data are removed through the use of the Server aging and scavenging feature in Windows Server 2008. Issues develop if decayed resource records are not dealt with,

  such as:

  Zone transfers take longer as the DNS server disk space contains a large number of stale records The accumulation of stale records degrades the DNS server performance and response time Potential conflicts can occur, if an IP address in a

  dynamic DNS environment is assigned to a different host. By default, the aging and scavenging feature is disabled. In order to use this particular feature, the user is required to enable the operations on the zone and at the DNS server. In

  addition, a user is able to manually enable individual resource records to be aged and scavenged. This process involves permitting the records to use the current (non-zero) timestamp value. The aging and scavenging operation figures out

  when the records should be cleared by reviewing their timestamps. The DNS Server uses a simple equation when setting a time value on a record: current server time + refresh interval.

  Procedure:

  Navigate to Start - Administrative Tools DNS Manager. Right click the relevant DNS server and select Set Aging/Scavenging for All Zones from the drop down list.

  

  The Server Aging/Scavenging Properties dialog box opens. Tick the option Scavenge stale resource records.

  Under the No-refresh interval heading, specify the duration for which the server must not refresh its records.

  Configuring this setting reduces replication traffic as unnecessary updates to existing records are prevented.

  Under the Refresh interval heading, specify the duration for which the server must refresh its records. The fresh interval is the time required between when a no-refresh interval expires and when a record is considered stale.

  When you have configured these settings, click OK to continue.

  

  A confirmation box appears showing a summary of your settings. Tick the Apply these settings to the existing Active Directory-integrated zones option and click OK.

  

  The Aging and Scavenging intervals have now been configured for all zones managed by the DNS server.

  http://blogs.technet.com/b/networking/archive/2008/03/19/don-t-be-afraid-of-dns-scavenging-just- bepatient.aspx

  Don't be afraid of DNS Scavenging. Just be patient.

  http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/bb556cfb-3217-4dcf-af4f- 460366faa1b8 Answered Best Practices configuration for DNS server on Windows 2008 R2 Server (aging/scavenging, etc.)

• Question 596:

  Your company has an Active Directory domain. You install a new domain controller in the domain. Twenty users report that they are unable to log on to the domain.

  You need to register the SRV records.

  Which command should you run on the new domain controller?

  A. Run the netsh interface reset command.
  B. Run the ipconfig /flushdns command.
  C. Run the dnscmd /EnlistDirectoryPartition command.
  D. Run the sc stop netlogon command followed by the sc start netlogon command.
  D. Run the sc stop netlogon command followed by the sc start netlogon command.

  ---

  MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) page 62

  The SRV resource records for a domain controller are important in enabling clients to locate the domain controller. The Netlogon service on domain controllers registers this resource record whenever a domain controller is restarted. You can also re-register a domain controller's SRV resource records by restarting this service from the Services branch of Server Manager or by typing net start netlogon. An exam Question might ask you how to troubleshoot the nonregistration of SRV resource records.

• Question 597:

  Your network contains an Active Directory domain. All domain controllers run Windows Server 2008 R2. Client computers run either Windows XP Service Pack 3 (SP3) or Windows Vista. You need to ensure that all client computers can apply Group Policy preferences.

  What should you do?

  A. Upgrade all Windows XP client computers to Windows 7.
  B. Create a central store that contains the Group Policy ADMX files.
  C. Install the Group Policy client-side extensions (CSEs) on all client computers.
  D. Upgrade all Windows Vista client computers to Windows Vista Service Pack 2 (SP2).
  C. Install the Group Policy client-side extensions (CSEs) on all client computers.

  ---

  http://www.microsoft.com/en-us/download/details.aspx?id=3628 Group Policy Preference Client Side Extensions for Windows XP (KB943729) Multiple Group Policy Preferences have been added to the Windows Server 2008 Group Policy Management Console (which are also available through the Remote Server Administration Toolset (RSAT) for Windows Vista SP1).

  Multiple Group Policy Preferences have been added to the Windows Server 2008 Group Policy Management Console (which are also available through the Remote Server Administration Toolset (RSAT) for Windows Vista SP1). Group Policy Preferences enable information technology professionals to configure, deploy, and manage operating system and application settings they previously were not able to manage using Group Policy. After you install this update, your computer will be able to process the new Group Policy Preference extensions. http://www.petenetlive.com/KB/Article/0000389.htm

  Server 2008 Group Policy Preferences and Client Side Extensions Problem Group Policy Preferences (GPP) first came in with Server 2008 and were enhanced for Server 2008 R2, To be able to apply them to older Windows clients, you need to install the "Client side Extensions" (CSE), You can either script this, deploy with a group policy, or if you have WSUS you can send out the update that way.

  

  Solution You may not have noticed, but if you edit or create a group policy in Server 2008 now, you will see there is a "Preferences" branch. Most IT Pro's will have seen the addition of the "Policies" folder some time ago because it adds an extra level to get to the policies that were there before :) OK Cool! What can you do with them?

  

  1.

  Computer Preferences: Windows Settings

  Environment: Lets you control, and send out Environment variables via Group Policy. Files: Allows you to copy, modify the attributes, replace or delete a file (for folders see the next section).

  Folder: As above, but for folders.

  Ini Files: Allows you to Create, Replace, Update or Delete an ini file. Registry: Allows you to Create, Replace, Update or Delete a Registry value, You can either manually type in the reference use a Wizard, or extract the key(s) values you

  want to send them out via group policy.

  Network Shares: Allow you to Create, Replace, Update, or Delete shares on clients via group policy. Shortcuts: Allows you to Create, Replace, Update, or Delete shortcuts on clients via group policy.

  2.

  Computer Preferences: Control Panel Settings

  Data Sources: Allows you to Create, Replace, Update, or Delete, Data Sources and ODBC settings via group policy. (Note: there's a bug if your using SQL authentication see here). Devices: Lets you enable and disable hardware devices by

  type and class, to be honest it's a little "clunky".

  Folder Options: Allows you to set "File Associations" and set the default programs that will open particular file extensions.

  Local Users and Groups: Lets you Create, Replace, Update, or Delete either local users OR local groups.

  Handy if you want to create an additional admin account, or reset all the local administrators passwords via group policy.

  Network Options: Lets you send out VPN and dial up connection settings to your clients, handy if you use PPTP Windows Server VPN's.

  Power Options: With XP these are Power Options and Power Schemes, With Vista and later OS's they are Power Plans. This is much needed, I've seen many "Is there a group policy for power options?" or disabling hibernation questions in

  forums. And you can use the options Tab, to target particular machine types (i.e. only apply if there is a battery present). Printers: Lets you install printers (local or TCP/IP), handy if you want all the machines in accounts to have the accounts

  printer.

  Scheduled Tasks: Lets you create a scheduled task or an immediate task (Vista or Later), this could be handy to deploy a patch or some virus/malware removal process. Service: Essentially anything you can do in the services snap in you

  can push out through group policy, set services to disables or change the logon credentials used for a service. In addition you can set the recovery option should a service fail.

  3.

  User Configuration: Windows Settings

  Applications: Answers on a Postcard? I can't work out what these are for! Drive Mappings: Traditionally done by login script or from the user object, but use this and you can assign mapped drives on a user/group basis.

  Environment: As above lets you control and send out Environment variables via Group Policy, but on a user basis.

  Files: As above. allows you to copy, modify the attributes, replace or delete a file (for folders see the next section), but on a user basis.

  Folders: As above, but for folders on a user by user basis. Ini Files: As above, allows you to Create, Replace, Update or Delete an ini file, on a user by user basis.

  Registry: As above, allows you to Create, Replace, Update or Delete a Registry value, You can either manually type in the reference use a Wizard, or extract the key(s) values you want to send out via group policy, this time for users not

  computers.

  Shortcuts: As Above, allows you to Create, Replace, Update, or Delete shortcuts on clients via group policy for users.

  4.

  User Configuration: Control Panel Settings

  All of the following options are covered above on "Computer Configuration" Data Sources

  Devices

  Folder Options

  Local Users and Groups

  Network Options

  Power Options

  Printers

  Scheduled Tasks

  Internet Settings: Using this Group Policy you can specify Internet Explorer settings/options on a user by user basis.

  Regional Options: Designed so you can change a users Locale, handy if you have one user who wants an American keyboard.

  Start Menu: Provides the same functionality as right clicking your task bar > properties > Start Menu > Customise, only set user by user.

  References:

  http://technet.microsoft.com/en-us/library/dd367850%28WS.10%29.aspx Group Policy Preferences

• Question 598:

  Your network contains an Active Directory domain named contoso.com.

  You have a server named Server1 that is configured as an enterprise root certification authority (CA).

  You need to ensure that private keys can be archived on Server1.

  Which three actions should you perform in sequence? (To answer, move the appropriate three actions from the list of actions to the answer area and arrange them in the correct order.)

  Select and Place:

  

  

  ---

  Note:

  This topic includes requirements and procedures for implementing key archival using Active Directory Certificate Services (AD CS) and the Windows Server 2008 operating system.

  Review and complete each of the following sections to implement key archival:

  * (step 1) Configuring a key recovery agent certificate template

  * (Step 1) Adding a key recovery agent certificate template to an enterprise CA

  * (Step 2) Enrolling key recovery agents / Enrolling key recovery agents /Issuing a key recovery agent certificate

  * Configuring a CA for key archival and recovery / Adding key recovery agent certificates to a CA / (step 3) Configuring certificate templates for key archival Certificate templates can be individually configured to require key archival. Your organization's security or data recovery policies should specify criteria to determine which certificate templates can be configured for key archival.

  This procedure should be completed on an enterprise CA.

  1. Start the Certificate Templates snap-in.

  2. Right-click a certificate template, and then click Properties.

  3. On the Request Handling tab, click Archive subject's encryption private key, and then click OK.

  Reference: Implementing Key Archival

• Question 599:

  Your company has a main office and a branch office. The branch office contains a read-only domain controller named RODC1.

  You need to ensure that a user named Admin1 can install updates on RODC1. The solution must prevent Admin1 from logging on to other domain controllers.

  What should you do?

  A. Run ntdsutil.exe and use the Roles option.
  B. Run dsmgmt.exe and use the Local Roles option.
  C. From Active Directory Sites and Services, modify the NTDS Site Settings.
  D. From Active Directory Users and Computers, add the user to the Server Operators group.
  B. Run dsmgmt.exe and use the Local Roles option.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc732301.aspx

  Administrator Role Separation Configuration

  This section provides procedures for creating a local administrator role for an RODC and for adding a user to that role.

  To configure Administrator Role Separation for an RODC

  1.

  Click Start, click Run, type cmd, and then press ENTER.

  2.

  At the command prompt, type dsmgmt.exe, and then press ENTER.

  3.

  At the DSMGMT prompt, type local roles, and then press ENTER.

• Question 600:

  Your company has an Active Directory domain.

  You log on to the domain controller. The Active Directory Schema snap-in is not available in the Microsoft Management Console (MMC). You need to access the Active Directory Schema snap-in.

  What should you do?

  A. Add the Active Directory Lightweight Directory Services (AD LDS) role to the domain controller by using Server Manager.
  B. Log off and log on again by using an account that is a member of the Schema Administrators group.
  C. Use the Ntdsutil.exe command to connect to the Schema Master operations master and open the schema for writing.
  D. Register Schmmgmt.dll.
  D. Register Schmmgmt.dll.

  ---

  http://technet.microsoft.com/en-us/library/cc732110.aspx Install the Active Directory Schema Snap-In

  You can use this procedure to first register the dynamic-link library (DLL) that is required for the Active Directory Schema snap-in. You can then add the snap-in to Microsoft Management Console (MMC).

  To install the Active Directory Schema snap-in

  1.

  To open an elevated command prompt, click Start, type command prompt and then right-click Command

  Prompt when it appears in the Start menu. Next, click Run as administrator and then click OK. To open an elevated command prompt in Windows Server 2012, click Start, type cmd, right click cmd and then click Run as administrator.

  2.

  Type the following command, and then press ENTER:

  regsvr32 schmmgmt.dll

  3.

  Click Start, click Run, type mmc and then click OK.

  4.

  On the File menu, click Add/Remove Snap-in.

  5.

  Under Available snap-ins, click Active Directory Schema, click Add and then click OK.

  6.

  To save this console, on the File menu, click Save.

  7.

  In the Save As dialog box, do one of the following:

  *

  To place the snap-in in the Administrative Tools folder, in File name, type a name for the snap-in, and then click Save.

  *

  To save the snap-in to a location other than the Administrative Tools folder, in Save in navigate to a location for the snap-in. In File name, type a name for the snap-in, and then click Save