Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 61:

  Your network contains an Active Directory domain named contoso.com. The domain contains two domain controllers named Serverl and Server2. DNS Manager on Server2 is shown in the exhibit. (Click the Exhibit button.)

  

  To answer, complete each statement according to the information presented in the exhibit. Each correct selection is worth one point.

  Hot Area:

  

  

• Question 62:

  Your network contains a single Active Directory domain named contoso.com. An administrator accidentally deletes the _msdsc.contoso.com zone. You recreate the _msdsc.contoso.com zone.

  You need to ensure that the _msdsc.contoso.com zone contains all of the required DNS records.

  What should you do on each domain controller?

  A. Restart the Netlogon service.
  B. Restart the DNS Server service.
  C. Run dcdiag.exe /fix.
  D. Run ipconfig.exe /registerdns.
  A. Restart the Netlogon service.

  ---

  Reference 1:

  http://support.microsoft.com/kb/817470

  To register the required records to the single root domain controller, restart the Net Logon service on all the domain controllers. The replication works correctly if the replication window is not less than the default DNS Time to Live (TTL) entry.

  To restart the Net Logon service, follow these steps:

  1.

  Click Start, click Run, type cmd in the Open box, and then press ENTER.

  2.

  At the command prompt, type the following command, and then press ENTER: net stop netlogon

  3.

  Type net start netlogon, and then press ENTER.

  Reference 2:

  http://serverfault.com/questions/383915/how-do-i-manually-create-the-msdcs-dns-zone-for-a-domain- that-wascreated-pre-s

  Be sure to restart the Netlogon services on all DC's when the zone has been replicated to them. This forces the DC's to register their SRV records in the _msdcs zone.

• Question 63:

  Your network contains an Active Directory domain. The domain contains two file servers. The file servers are configured as shown in the following table.

  

  You create a Group Policy object (GPO) named GPO1 and you link GPO1 to OU1.

  You configure the advanced audit policy.

  You discover that the settings are not applied to Server1. The settings are applied to Server2. You need to ensure that access to the file shares on Server1 is audited.

  What should you do?

  A. From Active Directory Users and Computers, modify the permissions of the computer account for Server1.
  B. From GPO1, configure the Security Options.
  C. From Active Directory Users and Computers, add Server1 to the Event Log Readers group.
  D. On Server1, run seceditexe and specify the /configure parameter.
  E. On Server1, run auditpol.exe and specify the /set parameter.
  E. On Server1, run auditpol.exe and specify the /set parameter.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/ff182311.aspx

  What are the differences in auditing functionality between versions of Windows? Basic audit policy settings are available in all versions of Windows since Windows 2000 and can be applied locally or by using Group Policy. Advanced audit

  policy settings were introduced in Windows Vista and Windows Server 2008, but the settings can only be applied by using logon scripts. In Windows 7 and Windows Server 2008 R2, advanced audit policy settings can be configured and

  applied by using local and domain Group Policy settings.

  Reference:

  http://technet.microsoft.com/en-us/library/cc755264.aspx

  Auditpol set

  Sets the per-user audit policy, system audit policy, or auditing options.

• Question 64:

  You are the network administrator for the ABC Company.

  Your network consists of two DNS servers named DNS1 and DNS2.

  The users who are configured to use DNS2 complain because they are unable to connect to Internet websites.

  The following table shows the configuration of both servers:

  

  The users connected to DNS2 need to be able to access the Internet.

  What needs to be done?

  A. Build a new Active Directory Integrated zone on DNS2.
  B. Delete the .(root) zone from DNS2 and configure Conditional forwarding on DNS2.
  C. Delete the current cache.dns file.
  D. Update your cache.dns file and root hints.
  B. Delete the .(root) zone from DNS2 and configure Conditional forwarding on DNS2.

  ---

  http://support.microsoft.com/kb/298148

  How To Remove the Root Zone (Dot Zone)

  When you install DNS on a Windows 2000 server that does not have a connection to the Internet, the zone for the domain is created and a root zone, also known as a dot zone, is also created. This root zone may prevent access to the

  Internet for DNS and for clients of the DNS. If there is a root zone, there are no other zones other than those that are listed with DNS, and you cannot configure forwarders or root hint servers. For these reasons, you may have to remove the

  root zone.

• Question 65:

  Your network contains an Active Directory forest.

  The DNS infrastructure fails.

  You rebuild the DNS infrastructure.

  You need to force the registration of the Active Directory Service Locator (SRV) records in DNS.

  Which service should you restart on the domain controllers? To answer, select the appropriate service in the answer area.

  Hot Area:

  

  

  ---

  Reference:

  MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) page 62

  The SRV resource records for a domain controller are important in enabling clients to locate the domain controller. The Netlogon service on domain controllers registers this resource record whenever a domain controller is restarted. You can also re-register a domain controller's SRV resource records by restarting this service from the Services branch of Server Manager or by typing net start netlogon. An exam question might ask you how to troubleshoot the nonregistration of SRV resource records.

• Question 66:

  Your company has one main office and four branch offices.

  The main office contains a standard primary DNS zone named adatum.com. Each branch office contains a copy of the adatum.com zone.

  When records are added to the adatum.com zone, you discover that it takes up to one hour before the changes replicate to each zone in the branch offices.

  You need to minimize the amount of time it takes for the records to be updated in the branch offices.

  What should you do?

  A. On the DNS server in the main office, configure the Notify settings.
  B. On the DNS servers in the branch offices, configure the Notify settings.
  C. On the DNS servers in the branch offices, configure the Zone Aging/Scavenging Properties.
  D. On the DNS server in the main office, configure the Zone Aging/Scavenging Properties.
  A. On the DNS server in the main office, configure the Notify settings.

• Question 67:

  Your network contains an Active Directory domain. The domain contains four domain controllers.

  You modify the Active Directory schema.

  You need to verify that all the domain controllers received the schema modification.

  Which command should you run?

  A. dcdiag.exe /a
  B. netdom.exe query fsmo
  C. repadmin.exe /showrepl *
  D. sc.exe query ntds
  C. repadmin.exe /showrepl *

  ---

  http://blogs.technet.com/b/askds/archive/2009/07/01/getting-over-replmon.aspx Getting Over Replmon

  Status Checking Replmon had the option to generate a status report text file. It could tell you which servers were configured to replicate with each other, if they had any errors, and so on. It was pretty useful actually, and one of the main

  reasons people liked the tool. Repadmin.exe offers similar functionality within a few of its command line options. For example, we can get a summary report:

  Repadmin /replsummary *

  

  Several DCs have been taken offline. Repadmin shows the correct error of 58 that the other DCs are not available and cannot tell you their status.

  You can also use more verbose commands with Repadmin to see details about which DCs are or are not replicating:

  Repadmin /showrepl *

  

• Question 68:

  Your network contains an Active Directory forest named contoso.com. The functional level of the forest is Windows Server 2008 R2. The forest contains a single domain.

  You need to ensure that objects can be restored from the Active Directory Recycle Bin.

  Which tool should you use?

  A. Ntdsutil
  B. Dsamain
  C. Ldp
  D. Add-PSSnapin
  C. Ldp

• Question 69:

  Your network contains an Active Directory forest named contoso.com. The password policy of the forest requires that the passwords for all of the user accounts be changed every 30 days.

  You need to create user accounts that will be used by services. The passwords for these accounts must be changed automatically every 30 days.

  Which tool should you use to create these accounts? To answer, select the appropriate tool in the answer area.

  Hot Area:

  

  

  ---

  Use the New-ADServiceAccount cmdlet in PowerShell to create the new accounts as managed service accounts. Managed service accounts offer Automatic password management, making password management easier.

  Reference 1:

  http://technet.microsoft.com/en-us/library/dd367859.aspx

  What are the benefits of new service accounts?

  In addition to the enhanced security that is provided by having individual accounts for critical services, there are four important administrative benefits associated with managed service accounts:

  Unlike with regular domain accounts in which administrators must reset passwords manually, the network passwords for these accounts will be reset automatically.

  Reference 2:

  http://technet.microsoft.com/en-us/library/dd391964.aspx

  Use the Active Directory module for Windows PowerShell to create a managed service account.

  Reference 3:

  http://technet.microsoft.com/en-us/library/dd548356.aspx

  To create a new managed service account

  1. On the domain controller, click Start, and then click Run. In the Open box, type dsa.msc, and then click OK to open the Active Directory Users and Computers snap-in. Confirm that the Managed Service Account container exists.

  2. Click Start, click All Programs, click Windows PowerShell 2.0, and then click the Windows PowerShell icon.

  3. Run the following command: New-ADServiceAccount [-SAMAccountName ] [-Path].

  Reference 4:

  http://technet.microsoft.com/en-us/library/hh852236.aspx

  Use the -ManagedPasswordIntervalInDays parameter with New-ADServiceAccount to specify the number of days for the password change interval.

  -ManagedPasswordIntervalInDaysSpecifies the number of days for the password change interval. If set to 0 then the default is used. This can only be set on object creation. After that the setting is read only. This value returns the msDSManagedPasswordInterval of the group managed service account object.

  The following example shows how to specify a 90 day password changes interval:

  -ManagedPasswordIntervalInDays 90

• Question 70:

  Your network contains an Active Directory forest. The forest contains three domains. All domain controllers have the DNS Server server role installed.

  The forest contains three sites named Site1, Site2, and Site3. Each site contains the users, client computers, and domain controllers of each domain. Site1 contains the first domain controller deployed to the forest.

  The sites connect to each other by using unreliable WAN links. The users in Site2 and Site3 report that is takes a long time to log on to their client computer when they use their user principal name (UPN). The users in Site1 do not experience

  the same issue.

  You need to reduce the amount of time it takes for the Site2 users and the Site3 users to log on to their client computer by using their UPN.

  What should you do?

  A. Configure a global catalog server in Site2 and a global catalog server in Site3.
  B. Reduce the replication interval of the site links.
  C. Move a primary domain controller (PDC) emulator to Site2 and to Site3.
  D. Add additional domain controllers to Site2 and to Site3.
  E. Reduce the cost of the site links.
  F. Enable universal group membership caching in Site2 and in Site3.
  A. Configure a global catalog server in Site2 and a global catalog server in Site3.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc728188.aspx

  Common Global Catalog Scenarios

  The following events require a global catalog server:

  (...) User logon. In a forest that has more than one domain, two conditions require the global catalog during user authentication:

  1.

  When a user principal name (UPN) is used at logon and the forest has more than one domain, a global catalog server is required to resolve the name.

  2.

  (...)