Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 601:

  Your company has an Active Directory forest that runs at the functional level of Windows Server 2008. You implement Active Directory Rights Management Services (AD RMS). You install Microsoft SQL Server 2005. When you attempt to open the AD RMS administration Web site, you receive the following error message: "SQL Server does not exist or access denied." You need to open the AD RMS administration Web site.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Restart IIS.
  B. Manually delete the Service Connection Point in AD DS and restart AD RMS.
  C. Install Message Queuing.
  D. Start the MSSQLSVC service.
  A. Restart IIS.
  D. Start the MSSQLSVC service.

  ---

  http://technet.microsoft.com/en-us/library/cc747605%28v=ws.10%29.aspx#BKMK_1 RMS Administration Issues "SQL Server does not exist or access denied" message received when attempting to open the RMS Administration Web site

  If you have installed RMS by using a new installation of SQL Server 2005 as your database server the SQL Server Service might not be started. In SQL Server 2005, the MSSQLSERVER service is not configured to automatically start when the server is started. If you have restarted your SQL Server since installing RMS and have not configured this service to automatically restart RMS will not be able to function and only the RMS Global Administration page will be accessible. After you have started the MSSQLSERVER service, you must restart IIS on each RMS server in the cluster to restore RMS functionality.

• Question 602:

  Your network contains an Active Directory domain named contoso.com. You plan to deploy a child domain named sales.contoso.com. The domain controllers in sales.contoso.com will be DNS servers for sales.contoso.com. You need to ensure that users in contoso.com can connect to servers in sales.contoso.com by using fully qualified domain names (FQDNs).

  What should you do?

  A. Create a DNS forwarder.
  B. Create a DNS delegation.
  C. Configure root hint servers.
  D. Configure an alternate DNS server on all client computers.
  B. Create a DNS delegation.

  ---

  http://technet.microsoft.com/en-us/library/cc784494%28v=ws.10%29.aspx Delegating zones

  DNS provides the option of dividing up the namespace into one or more zones, which can then be stored, distributed, and replicated to other DNS servers. When deciding whether to divide your DNS namespace to make additional zones,

  consider the following reasons to use additional zones:

  A need to delegate management of part of your DNS namespace to another location or department within your organization.

  A need to divide one large zone into smaller zones for distributing traffic loads among multiple servers, improve DNS name resolution performance, or create a more fault-tolerant DNS environment. A need to extend the namespace by adding

  numerous subdomains at once, such as to accommodate the opening of a new branch or site.

  If, for any of these reasons, you could benefit from delegating zones, it might make sense to restructure your namespace by adding additional zones. When choosing how to structure zones, you should use a plan that reflects the structure of

  your organization.

  When delegating zones within your namespace, be aware that for each new zone you create, you will need delegation records in other zones that point to the authoritative DNS servers for the new zone. This is necessary both to transfer

  authority and to provide correct referral to other DNS servers and clients of the new servers being made authoritative for the new zone. When a standard primary zone is first created, it is stored as a text file containing all resource record

  information on a single DNS server. This server acts as the primary master for the zone. Zone information can be replicated to other DNS servers to improve fault tolerance and server performance. When structuring your zones, there are

  several good reasons to use additional DNS servers for zone replication:

  1.

  Added DNS servers provide zone redundancy, enabling DNS names in the zone to be resolved for clients if a primary server for the zone stops responding.

  2.

  Added DNS servers can be placed so as to reduce DNS network traffic. For example, adding a DNS server to the opposing side of a low-speed WAN link can be useful in managing and reducing network traffic.

  3.

  Additional secondary servers can be used to reduce loads on a primary server for a zone.

  Example: Delegating a subdomain to a new zone

  As shown in the following figure, when a new zone for a subdomain (example.microsoft.com) is created, delegation from the parent zone (microsoft.com) is needed.

  

  In this example, an authoritative DNS server computer for the newly delegated example.microsoft.com subdomain is named based on a derivative subdomain included in the new zone (ns1.us.example.microsoft.com). To make this server

  known to others outside of the new delegated zone, two RRs are needed in the microsoft.com zone to complete delegation to the new zone.

  These RRs include:

  An NS RR to effect the delegation. This RR is used to advertise that the server named ns1.us.example.microsoft.com is an authoritative server for the delegated subdomain. An A RR (also known as a glue record) is needed to resolve the

  name of the server specified in the NS RR to its IP address. The process of resolving the host name in this RR to the delegated DNS server in the NS RR is sometimes referred to as glue chasing.

  Note When zone delegations are correctly configured, normal zone referral behavior can sometimes be circumvented if you are using forwarders in your DNS server configuration.

• Question 603:

  There are 100 servers and 2000 computers present at your company's headquarters.

  The DHCP service is installed on a two-node Microsoft failover cluster named CKMFO to ensure the high availability of the service.

  The nodes are named as CKMFON1 and CKMFON2.

  The cluster on CKMFO has one physical shared disk of 400 GB capacity.

  A 200GB single volume is configured on the shared disk.

  Company has decided to host a Windows Internet Naming Service (WINS) on CKMFON1. The DHCP and WINS services will be hosted on other nodes.

  Using High Availability Wizard, you begin creating the WINS service group on cluster available on CKMFON1 node.

  The wizard shows an error "no disks are available" during configuration.

  Which action should you perform to configure storage volumes on CKMFON1 to successfully add the WINS Service group to CKMFON1?

  A. Backup all data on the single volume on CKMFON1 and configure the disk with GUID partition table and create two volumes. Restore the backed up data on one of the volumes and use the other for WINS service group
  B. Add a new physical shared disk to the CKMFON1 cluster and configure a new volume on it. Use this volume to fix the error in the wizard.
  C. Add new physical shared disks to CKMFON1 and EMBFON2. Configure the volumes onthese disk and direct CKMOFONI to use CKMFON2 volume for the WINS service group
  D. Add and configure a new volume on the existing shared disk which has 400GB of space. Use this volume to fix the error in the wizard
  E. None of the above
  B. Add a new physical shared disk to the CKMFON1 cluster and configure a new volume on it. Use this volume to fix the error in the wizard.

  ---

  http://class10e.com/Microsoft/which-action-should-you-perform-to-configure-storage-volumes-on- ckmfon1-tosuccessfully-add-the-wins-service-group-to-ckmfon1/

  To configure storage volumes on CKMFON1 to successfully add the WINS Service group to CKMFON1, you need to add a new physical shared disk to the CKMFON1 cluster and configure a new volume on it.

  Use this volume to fix the error in the wizard.

  This is because a cluster does not use shared storage.

  A cluster must use a hardware solution based either on shared storage or on replication between nodes.

• Question 604:

  You create a standard primary zone for contoso.com.

  You need to specify a user named Admin1 as the person responsible for managing the zone.

  What should you do? (Each correct answer presents a complete solution. Choose two.)

  A. Open the %Systemroot\System32\DNS\Contoso.com.dns file by using Notepad and change all instances of "hostmaster.contoso.com" to "admin1.contoso.com".
  B. From DNS Manager, open the properties of the Start of Authority (SOA) record ofcontoso.com, Specify admin1.contoso.com as the responsible person.
  C. Open the %Systemroot\System32\DNS\Contoso.com.dns file by using Notepad and change all instances of "[email protected]" to "[email protected]".
  D. From DNS Manager, open the properties of the Start of Authority (SOA) record ofcontoso.com.Specify [email protected] as the responsible person.
  A. Open the %Systemroot\System32\DNS\Contoso.com.dns file by using Notepad and change all instances of "hostmaster.contoso.com" to "admin1.contoso.com".
  B. From DNS Manager, open the properties of the Start of Authority (SOA) record ofcontoso.com, Specify admin1.contoso.com as the responsible person.

  ---

  Reference 1: http://technet.microsoft.com/en-us/library/cc816941.aspx

  To modify the start of authority (SOA) resource record for a zone using the Windows interface

  1.

  Open DNS Manager.

  2.

  In the console tree, right-click the applicable zone, and then click Properties.

  3.

  Click the Start of Authority (SOA) tab.

  4.

  As needed, modify properties for the start of authority (SOA) resource record.

  5.

  Click OK to save the modified properties.

  Reference 2:

  http://technet.microsoft.com/en-us/library/dd197495.aspx

  The SOA resource record contains the following information:

  SOA resource record fields

  Responsible person The e-mail address of the person responsible for administering the zone. A period (.) is used instead of an at sign (@) in this e-mail name.

  (...)

• Question 605:

  Your network contains an Active Directory forest. The forest contains one domain named contoso.com.

  You discover the following event in the Event log of client computers: "The time provider NtpClient was unable to find a domain controller to use as a time source.

  NtpClient will try again in %1 minutes."

  You need to ensure that the client computers can synchronize their clocks properly.

  What should you do?

  A. Move the domain naming master role.
  B. Restart Active Directory Domain Services (AD DS) service.
  C. Move the PDC emulator role.
  D. Move the infrastructure master role.
  E. Move the global catalog server.
  F. Move the RID master role.
  G. Move the bridgehead server.
  H. Move the schema master role.
  I. Deploy an additional global catalog server.
  J. Install a read-only domain controller (RODC).
  C. Move the PDC emulator role.

  ---

  It could be that the server holding the PDC Emulator role has failed. Whatever the cause, we need to move the PDC Emulator role to another domain controller to restore time synchronization in the domain.

  Reference 1:

  http://www.microsoft.com/technet/support/ee/transform.aspx? ProdName=Windows+Operating+SystemandProdVer=5.2andEvtID=14andEvtSrc=w32timeandLCID=1033

  Event ID

  Message

  The time provider NtpClient was unable to find a domain controller to use as a time source. NtpClient will try again in %1 minutes.

  Windows Time Service is configured to use the domain hierarchy to locate its time source. It could not locate a domain controller that is a suitable time source. The time service will continue to search for an acceptable domain controller. If the

  time service cannot locate a time source after the maximum number of attempts, the Win32Time 49 message will be logged.

  Reference 2:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 531 PDC Emulator Role

  The PDC Emulator role performs multiple, crucial functions for a domain:

  (...)

  Provides a master time source for the domain - Active Directory, Kerberos, File Replication Service (FRS), and Distributed File System Replication (DFS-R) each rely on timestamps, so synchronizing the time across all systems in a domain is

  crucial. The PDC emulator in the forest root domain is the time master for the entire forest, by default. The PDC emulator in each domain synchronizes its time with the forest root PDC emulator. Other domain controllers in the domain

  synchronize their clocks against that domain's PDC emulator. All other domain members synchronize their time with their preferred domain controller. This hierarchical structure of time synchronization, all implemented through the Win32Time

  service, ensures consistency of time. Coordinated Universal Time (UTC) is synchronized, and the time displayed to users is adjusted based on the time zone setting of the computer.

• Question 606:

  Your network contains an Active Directory domain. The domain contains five sites. One of the sites contains a read-only domain controller (RODC) named RODC1.

  You need to identify which user accounts can have their password cached on RODC1.

  Which tool should you use?

  A. Repadmin
  B. Dcdiag
  C. Get-ADDomainControllerPasswordReplicationPolicyUsage
  D. Adtest
  A. Repadmin

  ---

  Original answer was C ("Get-ADDomainControllerPasswordReplicationPolicyUsage"). On why it's not correct, I quote the original explanation:

  "The Get-ADDomainControllerPasswordReplicationPolicyUsage gets the user or computer accounts that are authenticated by a read-only domain controller (RODC) or that have passwords that are stored on that RODC. The list of accounts

  that are stored on a RODC is known as the revealed list." So, this revealed list has a list of accounts whose passwords are cached on RODC's. But we don't need the accounts that are cached on RODC1, but the ones that can be cached on

  RODC1. Those are in the allowed list, and we can get it using repadmin.

  Reference:

  http://technet.microsoft.com/en-us/library/cc835090.aspx

  Repadmin /prp

  Lists and modifies the Password Replication Policy (PRP) for read-only domain controllers (RODCs).

  Syntax

  repadmin /prp view {|}

  Displays the security principals in the specified list or displays the current PRP setting (allowed or denied) for a specified user.

  Parameters

  Specifies the host name of the RODC. You can specify the single-label host name or the fully qualified domain name. In addition, you can use an asterisk (*) as a wildcard character to specify multiple RODCs in one domain.

  Specifies all the security principals that are in the list that you want to view. The valid list names are as follows:

  auth2: The list of security principals that the RODC has authenticated. reveal: The list of security principals for which the RODC has cached passwords. allow: The list of security principals in the msDS-RevealOnDemandGroup attribute. The

  RODC can cache

  passwords for this list of security principals only.

  deny: The list of security principals in the msDS-NeverRevealGroup attribute. The RODC cannot cache passwords for any security principals in this list.

  Original explanation for answer C:

  The Get-ADDomainControllerPasswordReplicationPolicyUsage gets the user or computer accounts that are authenticated by a read-only domain controller (RODC) or that have passwords that are stored on that RODC. The list of accounts

  that are stored on a RODC is known as the revealed list.

  http://technet.microsoft.com/en-us/library/ee617194.aspx

• Question 607:

  Your network contains an Active Directory forest named contoso.com. The forest contains two sites named Seattle and Montreal. The Seattle site contains two domain controllers. The domain controllers are configured as shown in the following table.

  

  The Montreal site contains a domain controller named DC3. DC3 is the only global catalog server in the forest.

  You need to configure DC2 as a global catalog server.

  Which object's properties should you modify? To answer, select the appropriate object in the answer area.

  Hot Area:

  

  

  ---

  http://technet.microsoft.com/en-us/library/cc794934.aspx To designate a domain controller to be a global catalog server

  1. Click Start, point to Administrative Tools, and then click Active Directory Sites and Services.

  2. In the console tree, expand the Sites container, and then expand the site in which you are designating a global catalog server.

  3. Expand the Servers container, and then expand the Server object for the domain controller that you want to designate as a global catalog server.

  4. Right-click the NTDS Settings object for the target server, and then click Properties.

  5. Select the Global Catalog check box, and then click OK.

• Question 608:

  Your company has two offices. The offices are located in Miami and London.

  The network contains an Active Directory forest named contoso.com. The forest contains two child domains named miami.contoso.com and london.contoso.com.

  The domain contains 50 domain controllers that run Windows Server 2008 R2. Each office is configured as an Active Directory site.

  The forest contains a custom attribute named SecurityAccessCode.

  You recently configured a domain controller named DC22 as a global catalog server.

  You need to verify that SecurityAccessCode is configured to replicate to DC22.

  What should you do?

  A. Run the dsadd.exe command
  B. Run the nltest.exe command.
  C. Run the Set-AdDomain cmdlet.
  D. Run the dsmove.exe command.
  E. Run the dcpromo.exe command.
  F. Run the Move-AdDirectoryServer cmdlet.
  G. Use the Active Directory Schema snap-in.
  H. Use the Active Directory Users and Computers console.
  G. Use the Active Directory Schema snap-in.

• Question 609:

  Your company, Contoso, Ltd., has a main office and a branch office. The offices are connected by a WAN link.Contoso has an Active Directory forest that contains a single domain named ad.contoso.com.

  The ad.contoso.com domain contains one domain controller named DC1 that is located in the main office. DC1 is configured as a DNS server for the ad.contoso.com DNS zone. This zone is configured as a standard primary zone.

  You install a new domain controller named DC2 in the branch office. You install DNS on DC2. You need to ensure that the DNS service can update records and resolve DNS queries in the event that aWAN link fails.

  What should you do?

  A. Create a new secondary zone named ad.contoso.com on DC2.
  B. Create a new stub zone named ad.contoso.com on DC2.
  C. Configure the DNS server on DC2 to forward requests to DC1.
  D. Convert the ad.contoso.com zone on DC1 to an Active Directory-integrated zone.
  D. Convert the ad.contoso.com zone on DC1 to an Active Directory-integrated zone.

  ---

  Three answers don't make sense, leaving us with the one that works.

  Create a new secondary zone named ad.contoso.com on DC2.

  This would create a read-only zone, so it couldn't be updated Create a new stub zone named ad.contoso.com on DC2.

  This stub zone would contain source information about authoritative name servers for its zone only, being DC1, but that one would be unavailable in the WAN link fails. Configure the DNS server on DC2 to forward requests to DC1. This

  doesn't help if the WAN link fails and DC1 is unavailable.

• Question 610:

  Your network contains an Active Directory domain named contoso.com. The network contains 10 subnets.

  You install a Web server on three different subnets. Each Web server hosts a web application accessed by using an FQDN of webl.contoso.com.

  For webl.contoso.com, you create three host (A) records that each points to one of the Web servers. You need to configure the DNS settings to meet the following requirements:

  1. Users who access webl.contoso.com from a subnet that contains one of the Web servers must connect to the server on their local subnet.

  2. When users connect from a subnet that does not contain a Web server hosting the web application, the connections must be balanced between the three Web servers. Which two settings should you modify? (To answer, select the two appropriate settings in the answer area.)

  Hot Area: