Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 611:

  Your network contains an Active Directory forest named contoso.com. The forest contains 10 domains. Each domain contains 50 domain controllers that run Windows Server 2008 R2. The domain functional level is Windows Server 2008.

  You need to raise the domain functional level of all the domains to Windows Server 2008 R2.

  What should you do?

  A. Run the dsadd.exe command
  B. Run the nltest.exe command.
  C. Run the Set-AdDomain cmdlet.
  D. Run the dsmove.exe command.
  E. Run the dcpromo.exe command.
  F. Run the Move-AdDirectoryServer cmdlet.
  G. Use the Active Directory Schema snap-in.
  H. Use the Active Directory Users and Computers console.
  H. Use the Active Directory Users and Computers console.

• Question 612:

  Your network contains an Active Directory domain named adatum.com. All servers run Windows Server 2008 R2.

  The network contains an enterprise certification authority (CA). You need to ensure that all of the members of a group named Managers can view the event log entries for Certificate Services.

  Which snap-in should you use?

  A. Active Directory Administrative Center
  B. Authorization Manager
  C. Certificate Templates
  D. Certificates
  E. Certification Authority
  F. Enterprise PKI
  G. Group Policy Management
  H. Security Configuration Wizard
  I. Share and Storage Management
  G. Group Policy Management

  ---

  We can make the Group1 group a member of the Event Log Readers Group, giving them read access to all event logs, thus including the Certificate Services events. We can do that by using Group Policy Management.

  Reference 1:

  It's a bit hard to find some good, clear reference for this. There's nothing wrong with doing it yourself, so here's what I did in VMWare, using a domain controller and a member server. Click along if you want!

  In VMWare I have setup a domain controller, DC01 and a member server MEM01, both belonging to the contoso.com domain. I have placed MEM01 in an OU named Events. I have created a global security group, named TESTGROUP, and

  I want to make it a member of the built-in Event Log Readers group on MEM01.

  1.

  Start the Group Policy Management console on DC01.

  2.

  Right-click the Events OU and choose "Create a GPO in this domain, and Link it here..."

  3.

  I named the GPO "EventLog_TESTGROUP"

  4.

  Right-click the "EventLog_TESTGROUP" GPO and choose "Edit..."

  5.

  Go to Computer Configuration \ Policies\ Windows Settings \ Security Settings and select "Restricted Groups"

  6.

  Right-click "Restricted Groups" and choose "Add Group..."

  7.

  Now there are two ways to do this. We can select TESTGROUP and make it a member of the Event Log Readers group, or we can select the Event Log Readers group and add TESTGROUP as a member. Let's do the second one. Click the Browse button and go find the Event Log Readers group. Click OK.

  8.

  Click the Browse button next to "Members of this group", search for the TESTGROUP group and add it.

  9.

  Click OK.

  10.

  10. On MEM01 open a command prompt and run gpupdate /force.

  11.

  Check the Event Log Readers group properties and see that the TESTGROUP group is now a member.

  Reference 2:

  http://blogs.technet.com/b/janelewis/archive/2010/04/30/giving-non-administrators-permission-to-read-event- logs-windows-2003-and-windows-2008.aspx

  Giving Non Administrators permission to read Event Logs Windows 2003 and Windows 2008

  So if you want to give Non-Administrator users access remotely to Event logs if the Servers or Domain Controllers they are accessing are Windows 2003 follow the steps below.

  (...)

  Windows 2008 is much easier as long as you are giving the users and groups in question read access to all event logs. If that is the case just add them to the Built in Event Log Readers group.

• Question 613:

  Your network contains an Active Directory forest. The forest contains one domain named contoso.com.

  You attempt to run adprep /forestprep and the operation fails. You discover that the first domain controller deployed to the forest failed.

  You need to run adprep /forestprep successfully.

  What should you do?

  A. Move the PDC emulator role.
  B. Move the RID master role.
  C. Move the infrastructure master role.
  D. Move the schema master role.
  E. Move the global catalog server.
  F. Move the bridgehead server.
  G. Install a read-only domain controller (RODC).
  H. Deploy an additional global catalog server.
  I. Restart the Active Directory Domain Services (AD DS) service.
  D. Move the schema master role.

• Question 614:

  Your network contains an Active Directory forest named contoso.com. The forest contains four computers. The computers are configured as shown in the following table.

  

  An administrator creates a script that contains the following commands:

  

  You need to identity which computers can successfully run all of the commands in the script.

  Which two computers should you identify? (Each correct answer presents part of the solution. Choose two.)

  A. Computer1
  B. Server1
  C. Computer2
  D. Server2
  C. Computer2
  D. Server2

  ---

  Original answer was B, D ("Server1", "Server2").

  According to Technet the "Auditpol /resourceSACL" command applies only to Windows 7 and Windows

  Server 2008 R2 (and I suppose Windows 8 and Windows Server 2012), so the answer should be Computer2 and Server2

  Reference:

  http://technet.microsoft.com/en-us/library/ff625687.aspx

  Auditpol resourceSACL

  Applies only to Windows 7 and Windows Server 2008 R2.

• Question 615:

  Your network contains an Active Directory forest. The functional level of the forest is Windows Server 2008 R2.

  Your company's corporate security policy states that the password for each user account must be changed at least every 45 days.

  You have a user account named Service1. Service1 is used by a network application named Application1.

  Every 45 days, Application1 fails.

  After resetting the password for Service1, Application1 runs properly. You need to resolve the issue that causes Application1 to fail. The solution must adhere to the corporate security policy.

  What should you do?

  A. Run the cmdlet.
  B. Run the Set-ADServiceAccount cmdlet.
  C. Create a new password policy.
  D. Create a new Password Settings object (PSO).
  B. Run the Set-ADServiceAccount cmdlet.

  ---

  http://technet.microsoft.com/en-us/library/ee617252.aspx Set-ADServiceAccount Syntax

  Set-ADServiceAccount [-Identity] [-AccountExpirationDate ] [-AccountNotDelegated ] [-Add ] [-Certificates] [-Clear ] [Description ] [-DisplayName ] [-Enabled ] [-HomePage ] [-Remove ] [- Replace ] [-SamAccountName ] [-ServicePrincipalNames ] [-TrustedForDelegation ] [-AuthType{ | }] [-Credential ] [-Partition ] [-PassThru ] [-Server] [-Confirm] [-WhatIf] []Detailed Description The Set-ADServiceAccount cmdlet modifies the properties of an Active Directory service account. You can modify commonly used property values by using the cmdlet parameters. Property values that are not associated with cmdlet parameters can be modified by using the Add, Replace, Clear and Remove parameters. The Identity parameter specifies the Active Directory service account to modify. You can identify a service account by its distinguished name (DN), GUID, security identifier (SID), or Security Accounts Manager (SAM) account name. You can also set the Identity parameter to an object variable such as $, or you can pass an object through the pipeline to the Identity parameter. For example, you can use the Get-ADServiceAccount cmdlet to retrieve a service account object and then pass the object through the pipeline to the Set-ADServiceAccount cmdlet. The Instance parameter provides a way to update a service account object by applying the changes made to a copy of the object. When you set the Instance parameter to a copy of an Active Directory service account object that has been modified, the Set-ADServiceAccount cmdlet makes the same changes to the original service account object. To get a copy of the object to modify, use the Get- ADServiceAccount object. When you specify the Instance parameter you should not pass the Identity parameter. For more information about the Instance parameter, see the Instance parameter description.

• Question 616:

  Your network contains a single Active Directory domain. All client computers run Windows Vista Service Pack 2 (SP2).

  You need to prevent all users from running an application named App1.exe.

  Which Group Policy settings should you configure?

  A. Application Compatibility
  B. AppLocker
  C. Software Installation
  D. Software Restriction Policies
  D. Software Restriction Policies

  ---

  http://gpfaq.se/2007/09/30/how-to-using-software-restriction-policies/ How-to: Using Software Restriction Policies

  Using SRP is not that common today and what I will write here is a small how-to so that you can start trying it today and maybe even sometime soon apply it in your production environment.

  

  First thing to notice is that SRP is a very powerful tool so try in a test-environment before you apply it to users in production. First you need to choose your default level which you do at Security Levels:

  

  Default when you start using this, the default level is "Unrestricted" which allows all programs to run. Which means you can use SRP to block specific programs but the power is that you can change this so "Disallowed" is the default level

  which means you specify which programs you can run (all others are blocked) instead of blocking specific programs.

  So to start with change so "Disallowed" is default. Double-click on "Disallowed" and press the button "Set as Default"

  

  This means that all clients affected by this policy now would be able to run anything except what you define as exclusions which you do at "Additional rules":

  

  As you can see in the above picture you have two default values already included. These two values are registry paths which makes all programs defined in these two registry paths to unrestricted which of course makes them available to run even if you selected "Disallowed" as your default choice in the above selection at "Security Levels". There are four different choices on how to enable/disable programs to run: Hash-rule Path-rule Network zone-rule Certificate-rule The normal ones to use is HASH or PATH. HASH is always something you should prefer to use since if the user tries to run a program it looks at the hash-value and evaluates if you can run the program or not. Sometimes when you have different versions of a program for example it might be a problem to use HASH, then you use PATH instead. Also if you don't have the program installed in the same location on each computer but you know somewhere in the registry where it types the path to the program you can use PATH and use the registry location instead. I will show you the two ways of allowing Windows Live Messenger to run Hash:

  

  As what you can see above is that it takes the values from the executable and stores the hash-value of the file.

  When someone tries to run the program the system evaluates this hash-value and compare it with the one you defined and then selecting if you can run the program or not.

  Path:

  

  As you can see above is that you need to select the path to the executable. This path needs to be same on each computer you would like to use this on but of course you can use environment variables as I have done in the above picture.

  You could also use a registry location if you did know where the path to the program where stored.

  You can of course also use this to block programs instead of allowing them. This is not really the preferred method on how to use SRP but fully functional.

  On my computer I have "Unrestricted" as my default and I added an application on my desktop named radio.exe as "Disallowed"

  

  So the result if I'm trying to run the file is:

  

  As conclusion you can see that this is a powerful way of giving your users minimal rights in the system with the result that your users will have a large problem messing up the computer :) This only covers some parts of SRP. For example

  local administrators also get these rules but that you can exclude in the "Enforcement" choice and also dll-files are excluded by default but you can change that too.

  Make sure to try this in a safe environment before applying it to production as you might get a big headache if you have made some wrong turns in setting this up. :)

• Question 617:

  You need to create a Password Settings object (PSO).

  Which tool should you use?

  A. Active Directory Users and Computers
  B. ADSI Edit
  C. Group Policy Management Console
  D. Ntdsutil
  B. ADSI Edit

  ---

  http://technet.microsoft.com/en-us/library/cc754461.aspx You can create Password Settings objects (PSOs): using the Active Directory module for Windows PowerShell using ADSI Edit using ldifde

• Question 618:

  Your network contains an Active Directory forest.

  You add an additional user principal name (UPN) suffix to the forest. You need to modify the UPN suffix of all users. You want to achieve this goal by using the minimum amount of administrative effort.

  What should you use?

  A. the Active Directory Domains and Trusts console
  B. the Active Directory Users and Computers console
  C. the Csvde tool
  D. the Ldifde tool
  D. the Ldifde tool

• Question 619:

  Your network contains an Active Directory forest named adatum.com. All client computers used by the marketing department are in an organizational unit (OU) named Marketing Computers. All user accounts for the marketing department are in an OU named Marketing Users.

  You purchase a new application.

  You need to ensure that every user in the domain who logs on to a marketing department computer can use the application. The application must only be available from the marketing department computers.

  What should you do?

  A. Create and link a Group Policy object (GPO) to the Marketing Users OU. Copy the installation package to a shared folder on the network. Assign the application.
  B. Create and link a Group Policy object (GPO) to the Marketing Computers OU. Copy the installation package to a shared folder on the network. Assign the application.
  C. Create and link a Group Policy object (GPO) to the Marketing Computers OU. Copy the installation package to a local drive on each marketing department computer. Publish the application.
  D. Create and link a Group Policy object (GPO) to the Marketing Users OU. Copy the installation package to a folder on each marketing department computer. Publish the application.
  B. Create and link a Group Policy object (GPO) to the Marketing Computers OU. Copy the installation package to a shared folder on the network. Assign the application.

  ---

  The software must only be available on the marketing department computers, so we must link the GPO to the Marketing Computers OU. Next we need to assign the application to the Marketing Computers OU.

  Reference: MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) page 399 Assigning Software to Computers When you assign software to computers, it is available to all authenticated users of the computer, regardless of their group membership or privileges. The software package is installed when the computer is next restarted after the package has been assigned. For example, suppose that you have a design application that should be available on all computers in the Engineering OU but not to computers elsewhere on your network. You would assign this application to computers in a Group Policy object (GPO) linked to the Engineering OU.

• Question 620:

  You had installed an Active Directory Federation Services (AD FS) role on a Windows server 2008 in your organization.

  Now you need to test the connectivity of clients in the network to ensure that they can successfully reach the new Federation server and Federation server is operational.

  What should you do? (Select all that apply)

  A. Go to Services tab, and check if Active Directory Federation Services is running
  B. In the event viewer, Applications, Event ID column look for event ID 674.
  C. Open a browser window, and then type the Federation Service URL for the new federation server.
  D. None of the above
  B. In the event viewer, Applications, Event ID column look for event ID 674.
  C. Open a browser window, and then type the Federation Service URL for the new federation server.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc734875.aspx Verify

  Verify that a specific event (ID 674) was generated on the federation server proxy computer. This event is generated when the federation server proxy is able to successfully communicate with the Federation Service.

  To perform this procedure, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority.

  1.

  Log on to a client computer with Internet access.

  2.

  Open a browser window, and then type the Uniform Resource Locator (URL) for the Federation Service endpoint, along with the path to the clientlogon.aspx page that is stored on the federation server proxy.

  3.

  Press ENTER.

  Note -At this point your browser should display the error Server Error in '/adfs' Application. This step is necessary to generate event message 674 to verify that the clientlogon.aspx page is being loaded properly by Internet Information

  Services (IIS).

  4.

  Log on to the federation server proxy.

  5.

  Click Start, point to Administrative Tools, and then click Event Viewer.

  6.

  In the details pane, double-click Application.

  7.

  In the Event column, look for event ID 674.