Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 621:

  Your network contains an Active Directory forest. The forest contains domain controllers that run Windows Server 2008 R2. The functional level of the forest is Windows Server 2003. The functional level of the domain is Windows Server 2008.

  From a domain controller, you need to perform an authoritative restore of an organizational unit (OU).

  What should you do first?

  A. Raise the functional level of the forest
  B. Modify the tombstone lifetime of the forest.
  C. Restore the system state.
  D. Raise the functional level of the domain.
  C. Restore the system state.

  ---

  The Recycle Bin feature cannot be applied here, see the reference below.

  Reference:

  Windows Server 2008 R2 Unleashed (SAMS, 2010) pages 1292 and 1297 Active Directory Recycle Bin Recovery

  Let's begin this section with a very clear statement: If you need to recover a deleted Active Directory object and the Active Directory Recycle Bin was not enabled before the object was deleted, skip this section and proceed to the "Active

  Directory Authoritative Restore" section.

  Active Directory Authoritative Restore

  When Active Directory has been modified and needs to be restored to a previous state, and this rollback needs to be replicated to all domain controllers in the domain and possibly the forest, an authoritative restore of Active Directory is

  required. An authoritative restore of Active Directory can include the entire Active Directory database, a single object, or a container, such as an organizational unit including all objects previously stored within the container. To perform an

  authoritative restore of Active Directory, perform the System State restore of a domain controller.

• Question 622:

  You have a DNS zone that is stored in a custom application partition.

  You need to add a domain controller to the replication scope of the custom application partition.

  Which tool should you use?

  A. DNScmd
  B. DNS Manager
  C. Server Manager
  D. Dsmod
  A. DNScmd

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc753801.aspx After you create a Domain Name System (DNS) application directory partition to store a zone, you must enlist the DNS server that hosts the zone in the application directory partition. To enlist a DNS server in a DNS application directory partition

  1.

  Open a command prompt.

  2.

  Type the following command, and then press ENTER: dnscmd / EnlistDirectoryPartition

• Question 623:

  You need to perform an offline defragmentation of an Active Directory database.

  Which four actions should you perform in sequence? (To answer, move the appropriate four actions from the list of actions to the answer area and arrange them in the correct order.)

  Select and Place:

  

  

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc794920.aspx

  Compact the database file to a local directory or remote shared folder, as follows:

  1. Open a Command Prompt as an administrator.

  2. At the command prompt, type the following command, and then press ENTER: net stop ntds

  3. Type Y to agree to stop additional services, and then press ENTER.

  4. At the command prompt, type ntdsutil, and then press ENTER.

  5. At the ntdsutil prompt, type activate instance ntds, and then press ENTER.

  6. At the ntdsutil prompt, type files, and then press ENTER.

  7. If you are compacting the database to a local drive, at the file maintenance: prompt, type compact to :\ (where :\ is the path to a location on the local computer), and then press ENTER.

  8. If defragmentation completes successfully, type quit, and then press ENTER to quit the file maintenance: prompt. Type quit again, and then press ENTER to quit Ntdsutil.exe. (...)

  Note You should make a copy of the existing Ntds.dit file if at all possible, even if you have to store that copy on a secured network drive. If the compaction of the database does not work properly, you can then easily restore the database by copying it back to the original location. Do not delete the copy of the Ntds.dit file until you have at least verified that the domain controller starts properly. If space allows, you can rename the original Ntds.dit file to preserve it. Avoid overwriting the original Ntds.dit file.

  9. Manually copy the compacted database file to the original location, as follows: copy

  “andlt;temporaryDrive>:\ntds.dit” “andlt;originalDrive>:\

  \ntds.dit”

  Ntdsutil provides the correct paths to the temporary and original locations of the Ntds.dit file.

  (...)

  10.Restart AD DS.

• Question 624:

  Your network contains two Active Directory forests named contoso.com and fabrikam.com.

  Each forest contains one domain. A two-way forest trust exists between the forests.

  You plan to add users from fabrikam.com to groups in contoso.com.

  You need to identify which group you must use to assign users in fabrikam.com access to the shared folders in contoso.com.

  To which group should you add the users? To answer, select the appropriate group in the answer area.

  Hot Area:

  

  

• Question 625:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run a Server Core installation of Windows Server 2008 R2.

  You need to identify which domain controller holds the PDC emulator role.

  Which tool should you run?

  A. Get-AdForest
  B. Netdom.exe
  C. Get-AdOptionalFeature
  D. Query.exe
  B. Netdom.exe

• Question 626:

  Your network contains an Active Directory domain named contoso.com.

  You need to create a central store for the Group Policy Administrative templates.

  What should you do?

  A. Run dfsrmig.exe /createglobalobjects.
  B. Run adprep.exe /domainprep /gpprep.
  C. Copy the %SystemRoot%\PolicyDefinitions folder to the \\contoso.com\SYSVOL\contoso.com\Policies folder.
  D. Copy the %SystemRoot%\System32\GroupPolicy folder to the \\contoso.com\SYSVOL\contoso.com \Policies folder.
  C. Copy the %SystemRoot%\PolicyDefinitions folder to the \\contoso.com\SYSVOL\contoso.com\Policies folder.

  ---

  http://www.vmadmin.co.uk/microsoft/43-winserver2008/220-svr08admxcentralstore Creating an ADMX central store for group policies

  To take advantage of the benefits of .admx files, you must create a Central Store in the SYSVOL folder. The Central Store is a location that is checked by GPMC.

  The GPMC will use .admx files that are in the Central Store. The files that are in the Central Store are replicated to all domain controllers in the domain.

  First on a domain controller (Windows Server 2008/2008 R2) the ADMX policy definitions and language template files in %SYSTEMROOT%\PolicyDefinitions need copying to %SYSTEMROOT %\SYSVOL\domain\Policies\PolicyDefinitions.

  Run the following command to copy the entire folder contents to SYSVOL. This will then replicate to all domain controllers (the default ADMX policies and EN-US language templates (ADML) are about 6.5 MB in total).

  xcopy /E "%SYSTEMROOT%\PolicyDefinitions" "%SYSTEMROOT%\SYSVOL\domain\Policies \PolicyDefinitions\"

  

  Next ensure you have remote server administration tools (RSAT) installed on your client computer you are using to edit the GPO's. This will need to be Windows Vista or Windows 7.

  For Windows Vista enable the RSAT feature (GPMC).

  For Windows 7 download and install RSAT then enable the RSAT feature (GPMC). When editing a GPO in the GMPC you will find that the Administrative Templates show as "Policy Definitions (ADMX files) retrieved from the central store".

  This confirms it is working as expected.

  

  Further information: http://support.microsoft.com/kb/929841/en-us How to create the Central Store for Group Policy Administrative Template files in Windows Vista http://msdn.microsoft.com/en-us/library/bb530196.aspx Managing Group Policy ADMX Files Step-by-Step Guide http://technet.microsoft.com/en-us/library/cc748955%28v=ws.10%29.aspx Scenario 2: Editing Domain-Based GPOs Using ADMX Files

• Question 627:

  ABC.com has a software evaluation lab. There is a server in the evaluation lab named as CKT. CKT runs Windows Server 2008 and Microsoft Virtual Server 2005 R2. CKT has 200 virtual servers running on an isolated virtual segment to

  evaluate software. To connect to the internet, it uses physical network interface card.

  ABC.com requires every server in the company to access Internet. ABC.com security policy dictates that the IP address space used by software evaluation lab must not be used by other networks. Similarly, it states the IP address space used

  by other networks should not be used by the evaluation lab network.

  As an administrator you find you that the applications tested in the software evaluation lab need to access normal network to connect to the vendors update servers on the internet. You need to configure all virtual servers on the CKT server to

  access the internet. You also need to comply with company's security policy.

  Which two actions should you perform to achieve this task? (Choose two answers. Each answer is a part of the complete solution)

  A. Trigger the Virtual DHCP server for the external virtual network and run ipconfig/renew command on each virtual server
  B. On CKT's physical network interface, activate the Internet Connection Sharing (ICS)
  C. Use ABC.com intranet IP addresses on all virtual servers on CKT.
  D. Add and install a Microsoft Loopback Adapter network interface on CKT. Use a new network interface and create a new virtual network.
  E. None of the above
  A. Trigger the Virtual DHCP server for the external virtual network and run ipconfig/renew command on each virtual server
  D. Add and install a Microsoft Loopback Adapter network interface on CKT. Use a new network interface and create a new virtual network.

  ---

  http://class10e.com/Microsoft/which-two-actions-should-you-perform-to-achieve-this-task-choose- two-answers/

  To configure all virtual servers on the CKT server to access the internet and comply with company's security policy, you should trigger the virtual DHCP server for the external virtual network and run ipconfig/renew command on each virtual

  server. Then add and install Microsoft Loopback adapter network interface on CKT.

  Create a virtual network using the new interface.

  When you configure the Virtual DHCP server for the external virtual network, a set of IP addresses are assigned to the virtual servers on CKT server. By running ipconfig/renew command, the new IP addresses will be renewed. The Microsoft

  Loopback adapter network interface will ensure that the IP address space used by other networks are not been used by the virtual servers on CKT server. You create a new virtual network on the new network interface which will enable you to

  access internet.

• Question 628:

  A corporate network includes a single Active Directory Domain Services (AD D5) domain. The domain contains 10 domain controllers. The domain controllers run Windows Server 2008 R2 and are configured as DNS servers.

  You plan to create an Active Directory-integrated zone.

  You need to ensure that the new zone is replicated to only four of the domain controllers.

  What should you do first?

  A. Create a new delegation in the ForestDnsZones application directory partition.
  B. Create a new delegation in the DomainDnsZones application directory partition.
  C. Use the dnscmd tool with the /zoneadd parameter.
  D. Use the ntdsutil tool to add a naming context.
  D. Use the ntdsutil tool to add a naming context.

• Question 629:

  Your network contains an Active Directory domain. All domain controllers run Windows Server 2008 R2.

  You need to create a snapshot of Active Directory.

  What should you do?

  A. Run the dsquery.exe command.
  B. Run the dsamain.exe command.
  C. Create custom views from Event Viewer.
  D. Configure subscriptions from Event Viewer.
  E. Create a Data Collector Set (DCS).
  F. Configure the Active Directory Diagnostics Data Collector Set (DCS).
  G. Run the repadmin.exe command.
  H. Run the ntdsutil.exe command.
  I. Run the Get-ADForest cmdlet.
  J. Run the eventcreate.exe command.
  H. Run the ntdsutil.exe command.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc753609.aspx

  To create an AD DS or AD LDS snapshot

  1.

  Log on to a domain controller as a member of the Enterprise Admins groups or the Domain Admins group.

  2.

  Click Start, right-click Command Prompt, and then click Run as administrator.

  3.

  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

  4.

  At the elevated command prompt, type the following command, and then press ENTER: ntdsutil

  5.

  At the ntdsutil prompt, type the following command, and then press ENTER: snapshot

  6.

  At the snapshot prompt, type the following command, and then press ENTER: activate instance ntds

  7.

  At the snapshot prompt, type the following command, and then press ENTER: create

• Question 630:

  Your network contains an Active Directory domain. The domain is configured as shown in the following table.

  

  Users in Branch2 sometimes authenticate to a domain controller in Branch1.

  You need to ensure that users in Branch2 only authenticate to the domain controllers in Main.

  What should you do?

  A. On DC3, set the AutoSiteCoverage value to 1.
  B. On DC1 and DC2, set the AutoSiteCoverage value to 0.
  C. On DC1 and DC2, set the AutoSiteCoverage value to 1.
  D. On DC3, set the AutoSiteCoverage value to 0.
  D. On DC3, set the AutoSiteCoverage value to 0.

  ---

  http://technet.microsoft.com/en-us/library/cc787491%28v=ws.10%29.aspx Parameters\AutoSiteCoverageHKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

  

  Description Specifies whether the system can add sites to the coverage area of this domain controller. Domain controllers cover, that is, provide services to, the site in which they reside and to other sites listed in the value of the entry SiteCoverage. In addition, when the value of AutoSiteCoverage is 1, the system can add sites that do not have domain controllers to this domain controller's coverage area.

  

  The sites added to the domain controller's coverage are stored in memory, and a new list is assembled each time the Net Logon service starts or when Netlogon is notified of the site object changes. While Net Logon runs, it updates this list at an interval specified by the value of the entry DnsRefreshInterval. ... http://technet.microsoft.com/en-us/library/cc749944.aspx Planning Active Directory for Branch Office .. Disabling AutoSiteCoverage Registration in DNS Another situation that requires configuration of SRV records results from not having a domain controller in a particular site. This may happen because there are no users needing constant logon access, or because replication to the site might be too expensive or too slow. To ensure that a domain controller can be located in the site closest to a client computer, if not the same site, Windows 2000 automatically attempts to register a domain controller in every site by using an "autositecoverage" algorithm. The algorithm determines how one site can "cover" another site when no domain controller exists in the second site. By default, the process uses the replication topology. The algorithm works as follows. Each domain controller checks all sites in the forest and then checks the replication cost matrix. A domain controller advertises itself (registers a site-related SRV record in DNS) in any site that does not have a domain controller for that domain and for which its site has the lowest-cost connections. This process ensures that every site has a domain controller even though its domain controller may not be located in that site. The domain controllers that are published in DNS are those from the closest site (as defined by the replication topology). In the branch office scenario, any computer from other sites should not discover branch office domain controllers. A client should always communicate with a local domain controller, and if that is not available, use a domain controller in the hub site. To achieve this:

  1.

  Disable AutoSiteCoverage on all of the domain controllers, not only for the branch domain controllers, but also hub domain controllers.

  2.

  Do not register generic records as described above.

  If both of these configurations (1. and 2.) are performed, then all-site clients will discover the local domain controller if it is available, or its hub domain controller (if no local domain controller is available).

  In the unusual scenario when a site with a domain controller for some domain is closer to another site than the central hub, the administrator has the ability to configure that domain controller with the specific ("close") sites to be covered using

  the following registry values: SiteCoverage, GcSiteCoverage. Alternatively, the administrator can use the following Group Policy settings:

  Sites Covered by the domain controller Locator DNS SRV Records Sites Covered by the global catalog server Locator DNS SRV Records Sites Covered by the NDNC Locator DNS SRV Records