Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 71:

  Your company has a main office and a branch office.

  The network contains a single Active Directory domain.

  The main office contains a domain controller named DC1.

  You need to install a domain controller in the branch office by using an offline copy of the Active Directory database.

  What should you do first?

  A. From the Ntdsutil tool, create an IFM media set.
  B. From the command prompt, run djoin.exe /loadfile.
  C. From Windows Server Backup, perform a system state backup.
  D. From Windows PowerShell, run the get-ADDomainController cmdlet.
  A. From the Ntdsutil tool, create an IFM media set.

  ---

  http://technet.microsoft.com/en-us/library/cc816722%28v=ws.10%29.aspx

  Installing an Additional Domain Controller by Using IFM When you install Active Directory Domain Services (AD DS) by using the install from media (IFM) method, you can reduce the replication traffic that is initiated during the installation of an additional domain controller in an Active Directory domain. Reducing the replication traffic reduces the time that is necessary to install the additional domain controller. Windows Server 2008 and Windows Server 2008 R2 include an improved version of the Ntdsutil tool that you can use to create installation media for an additional domain controller. You can use Ntdsutil.exe to create installation media for additional domain controllers that you are creating in a domain. The IFM method uses the data in the installation media to install AD DS, which eliminates the need to replicate every object from a partner domain controller. However, objects that were modified, added, or deleted since the installation media was created must be replicated. If the installation media was created recently, the amount of replication that is required is considerably less than the amount of replication that is required for a regular AD DS installation.

• Question 72:

  You are one of two network administrators for your organization.

  Your IT partner does most of the work in Active Directory.

  While working in Active Directory, your partner accidently deleted a user from the Sales OU. You recover the user from tape backup but you want to help prevent this from happening again in the future.

  What can you do?

  A. Enable the Active Directory Recycle Bin.
  B. Use ADSI Edit to restore the user.
  C. Take away all rights from the other administrator.
  D. Use the Directory Services Restore Mode Lockout command.
  A. Enable the Active Directory Recycle Bin.

  ---

  http://technet.microsoft.com/en-us/library/dd392261%28v=ws.10%29.aspx Active Directory Recycle Bin Step-by-Step Guide

  Active Directory Recycle Bin helps minimize directory service downtime by enhancing your ability to preserve and restore accidentally deleted Active Directory objects without restoring Active Directory data from backups, restarting Active Directory Domain Services (AD DS), or rebooting domain controllers.

  When you enable Active Directory Recycle Bin, all link-valued and non-link-valued attributes of the deleted Active Directory objects are preserved and the objects are restored in their entirety to the same consistent logical state that they were in immediately before deletion. For example, restored user accounts automatically regain all group memberships and corresponding access rights that they had immediately before deletion, within and across domains.

  Active Directory Recycle Bin is functional for both AD DS and Active Directory Lightweight Directory Services (AD LDS) environments.

  Important By default, Active Directory Recycle Bin in Windows Server 2008 R2 is disabled. To enable it, you must first raise the forest functional level of your AD DS or AD LDS environment to Windows Server 2008 R2, which in turn requires all forest domain controllers or all servers that host instances of AD LDS configuration sets to be running Windows Server 2008 R2. After you set the forest functional level of your environment to Windows Server 2008 R2, you can use the instructions in this guide to enable Active Directory Recycle Bin. In this release of Windows Server 2008 R2, the process of enabling Active Directory Recycle Bin is irreversible. After you enable Active Directory Recycle Bin in your environment, you cannot disable it.

• Question 73:

  You have a domain controller named DC1 that runs Windows Server 2008 R2. DC1 is configured as a DNS Server for contoso.com.

  You install the DNS Server role on a member server named Server1 and then you create a standard secondary zone for contoso.com.

  You configure DC1 as the master server for the zone.

  You need to ensure that Server1 receives zone updates from DC1.

  What should you do?

  A. On DC1, modify the permissions of contoso.com zone.
  B. On Server1, add a conditional forwarder.
  C. On DC1, modify the zone transfer settings for the contoso.com zone.
  D. Add the Server1 computer account to the DNSUpdateProxy group.
  C. On DC1, modify the zone transfer settings for the contoso.com zone.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc771652.aspx

  Modify Zone Transfer Settings

  You can use the following procedure to control whether a zone will be transferred to other servers and which servers can receive the zone transfer.

  To modify zone transfer settings using the Windows interface

  1.

  Open DNS Manager.

  2.

  Right-click a DNS zone, and then click Properties.

  3.

  On the Zone Transfers tab, do one of the following:

  To disable zone transfers, clear the Allow zone transfers check box. To allow zone transfers, select the Allow zone transfers check box.

  4.

  If you allowed zone transfers, do one of the following:

  To allow zone transfers to any server, click To any server. To allow zone transfers only to the DNS servers that are listed on the Name Servers tab, click Only to servers listed on the Name Servers tab.

  To allow zone transfers only to specific DNS servers, click Only to the following servers, and then add the IP address of one or more DNS servers.

• Question 74:

  Your network contains an Active Directory forest named fabrikam.com. You perform a test installation of an enterprise certification authority (CA). After the installation, you discover that the Issuer Statement option on every certificate issued

  by the CA is unavailable.

  You need to ensure that the Issuer Statement option is available when you install the enterprise CA to the production environment.

  What should you do?

  A. Before you install the enterprise CA, install the Certification Authority Web Enrollment role service.
  B. After you install the enterprise CA, modify the Authority Information Access (AIA) extension settings.
  C. During the installation of the enterprise CA, click the Allow administrator interaction when the private key is accessedby the CA cryptographic option.
  D. Before you install the enterprise CA, create a custom CAPolicy.inf file and place the file in the Windows directory.
  D. Before you install the enterprise CA, create a custom CAPolicy.inf file and place the file in the Windows directory.

• Question 75:

  The corporate network of Company consists of a Windows Server 2008 single Active Directory domain. The domain has two servers named Company 1 and Company 2. To ensure central monitoring of events you decided to collect all the

  events on one server, to collect events from Company, and transfer them to Company 1.

  You configure the required event subscriptions.

  You selected the Normal option for the Event delivery optimization setting by using the HTTP protocol.

  However, you discovered that none of the subscriptions work.

  Which of the following actions would you perform to configure the event collection and event forwarding on the two servers? (Select three. Each answer is a part of the complete solution).

  A. Run window execute the winrm quickconfig command on Company 2.
  B. Run window execute the wecutil qc command on Company 2.
  C. Add the Company 1 account to the Administrators group on Company 2.
  D. Run window execute the winrm quickconfig command on Company 1.
  E. Add the Company 2 account to the Administrators group on Company 1.
  F. Run window execute the wecutil qc command on Company 1.
  A. Run window execute the winrm quickconfig command on Company 2.
  C. Add the Company 1 account to the Administrators group on Company 2.
  F. Run window execute the wecutil qc command on Company 1.

  ---

  We need to do three things:

  1 - run winrm quickconfig on the source computer (Company 2) 2 - run wecutil qc on the collector computer (Company 1) 3 - add the computer account of the collector computer to the local Administrators group on the source computer

  Had the Event delivery optimization setting been set to Minimize Bandwidth or Minimize Latency, then we would need to run winrm quickconfig on the collector computer too. Because it's set to Normal we can skip that step.

  If the HTTPS protocol had been used we also would have had to configure Windows Firewall exceptions for port 443. But it's not, and it's not even listed, so that's cool.

  Reference:

  http://technet.microsoft.com/en-us/library/cc748890.aspx

  Configure Computers to Forward and Collect Events

  Before you can create a subscription to collect events on a computer, you must configure both the collecting computer (collector) and each computer from which events will be collected (source). To configure computers in a domain to forward

  and collect events

  1.

  Log on to all collector and source computers. It is a best practice to use a domain account with administrative privileges.

  2.

  On each source computer, type the following at an elevated command prompt: winrm quickconfig Note

  If you intend to specify an event delivery optimization of Minimize Bandwidth or Minimize Latency, then you must also run the above command on the collector computer.

  3.

  On the collector computer, type the following at an elevated command prompt: wecutil qc

  4.

  Add the computer account of the collector computer to the local Administrators group on each of the source computers.

  5.

  The computers are now configured to forward and collect events. Follow the steps in Create a New Subscription to specify the events you want to have forwarded to the collector.

• Question 76:

  You install an Active Directory domain in a test environment.

  You need to reset the passwords of all the user accounts in the domain from a domain controller.

  Which two Windows PowerShell commands should you run? (Each correct answer presents part of the solution, choose two.)

  A. $ newPassword = *
  B. Import-Module ActiveDirectory
  C. Import-Module WebAdministration
  D. Get- AdUser -filter * | Set- ADAccountPossword - NewPassword $ newPassword - Reset
  E. Set- ADAccountPossword - NewPassword - Reset
  F. $ newPassword = (Read-Host - Prompt "New Password" - AsSecureString )
  G. Import-Module ServerManager
  D. Get- AdUser -filter * | Set- ADAccountPossword - NewPassword $ newPassword - Reset
  F. $ newPassword = (Read-Host - Prompt "New Password" - AsSecureString )

  ---

  First we create a variable, $newPassword, and prompt the user for the password to assign it to the variable.

  Next we use Get-ADUser -filter * to collect all user accounts and pipe it through to SetADAccountPassword to assign the $newPassword variable to every account's new password.

  Note that Set- ADAccountPossword must be a typo.

  Reference 1:

  http://technet.microsoft.com/en-us/library/ee176935.aspx

  Prompting a User to Enter Information

  The Read-Host cmdlet enables you to interactively prompt a user for information. For example, this command prompts the user to enter his or her name, then stores that name in the variable $Name (to answer the prompt, type a name and

  then press ENTER):

  $Name = Read-Host "Please enter your name"

  Reference 2:

  http://technet.microsoft.com/en-us/library/ee617241.aspx

  Get-ADUser Gets one or more Active Directory users.

  Reference 3:

  http://technet.microsoft.com/en-us/library/ee617261.aspx

  Set-ADAccountPassword Modifies the password of an Active Directory account.

  Parameters

  NewPassword

  Specifies a new password value.

  Reset

  Specifies to reset the password on an account. When you use this parameter, you must set the NewPassword parameter. You do not need to specify the OldPassword parameter.

• Question 77:

  Your company has an Active Directory forest that contains Windows Server 2008 R2 domain controllers and DNS servers. All client computers run Windows XP SP3. You need to use your client computers to edit domain-based GPOs by using the ADMX files that are stored in the ADMX central store.

  What should you do?

  A. Add your account to the Domain Admins group.
  B. Upgrade your client computers to Windows 7.
  C. Install .NET Framework 3.0 on your client computers.
  D. Create a folder on PDC emulator for the domain in the PolicyDefinitions path. Copy the ADMX files to the PolicyDefinitions folder.
  B. Upgrade your client computers to Windows 7.

  ---

  http://technet.microsoft.com/en-us/library/cc709647%28v=ws.10%29.aspx Managing Group Policy ADMX Files Step-by-Step Guide

  Microsoft Windows Vista?and Windows Server 2008 introduce a new format for displaying registry- based policy settings. Registry-based policy settings (located under the Administrative Templates category in the Group Policy Object Editor) are defined using a standards-based, XML file format known as ADMX files. These new files replace ADM files, which used their own markup language. The Group Policy tools --Group Policy Object Editor and Group Policy Management Console--remain largely unchanged. In the majority of situations, you will not notice the presence of ADMX files during your day-to-day Group Policy administration tasks.

  http://blogs.technet.com/b/grouppolicy/archive/2008/12/17/questions-on-admx-in-windows-xp-and- windows2003-environments.aspx

  Questions on ADMX in Windows XP and Windows 2003 environments We had a question a couple of days ago about the usage of ADMX template formats in Windows XP/Server 2003 environments. Essentially the question was:

  "...What's the supported or recommended way of getting W2k8 ADMX templates applying in a W2k3 domain with or with no W2k8 DCs. What I've done in test is, created a central store in the /Sysvol/domain/policies folder on the 2k3 DC (PDC) and created and edited a GPO using GPMC from the W2k8 member server applying to a W2k8 machine and it seems to work just fine. Is this the right way to do it?..."

  The answer is Yes. Again this is one of those things that confuse people. The template format has nothing to do with the policy file that's created. Its just used to create the policy by the administrative tool itself. In the case of GPMC on Windows XP and Windows Server 2003 and previous this tool used the ADM file format. These ADM files were copied into every policy object on the SYSVOL, which represents about 4MB of duplicated bloat per policy. This was one of the areas that caused major problems with an issue called SYSVOL bloat.

  In Vista and Server 2008 this template format changed to ADMX. This was a complete change towards a new XML based format that aimed to eliminate SYSVOL bloat. It doesn't copy itself into every policy object but relies on a central or local store of these templates (Note that even in the newer tools you can still import custom ADM files for stuff like Office etc). In the question above, the person wanted to know if copying the local store, located under c:/windows/ policydefinitions, could be copied into a Windows Server 2003 domain environment as the central store and referenced by the newer admin tools. Again the domain functional mode has little to do with Group Policy. I talked about that one before. The things that we care about are the administrative tools and the client support for the policy functions. So of course it can. Here's the confusion-reducing scoop Group Policy as a platform only relies on two main factors. Active Directory to store metadata about the policy objects and to allow client discoverability for the location of the policy files. The other is the SYSVOL to store the policy files. So at its core that's LDAP and SMB file shares.

  Specific extensions on top of the policy platform may require certain domain functionality but that's very specific to that extension. Examples are the new Wireless policy and BitLocker extensions in Vista SP1. They require schema updates not GP itself. So if you don't currently use them then you don't have to update schema.

  So provided you're using Windows Vista SP1 with RSAT or Windows Server 2008 to administer the policies you get all the benefits to manage downlevel clients.

  That means eliminating SYSVOL bloat. That means all the joys of Group Policy Preferences. Honestly it amazes us the amount of IT Pros that still haven't discovered GPP...especially with the power it has to practically eliminate logon scripts! As a last point IT Pros also ask us when we will be producing an updated GPMC version for Windows XP to support all the new stuff. The answer is that we are not producing any updated GPMC versions for Windows XP and Server 2003. All the new administrative work is being done on the newer platforms. So get moving ahead! There are some really good benefits in the newer tools and very low impact to your current environment. You only need a single Windows Vista SP1 machine to start!

• Question 78:

  Your network contains an Active Directory forest named contoso.com. The domain contains two domain controllers named DC1 and DC2 that run Windows Server 2008 R2. DC2 holds the PDC emulator role.

  The power supply on DC2 fails.

  You seize the PDC emulator role to DC1.

  You replace the power supply on DC2.

  You need to bring DC2 back online as the PDC emulator as soon as possible. The solution must minimize the disruption of services for users.

  What should you do?

  A. Connect DC2 to the network. Turn on DC2, and then transfer the PDC emulator role.
  B. Reinstall Windows Server 2008 on DC2 and promote DC2 to a domain controller. Transfer the PDC emulator role.
  C. Reinstall Windows Server 2008 on DC2 and promote DC2 to a domain controller. Seize the PDC emulator role.
  D. Disconnect DC2 from the network. Turn on DC2, and then seize the PDC emulator role. Connect DC2 to the network.
  A. Connect DC2 to the network. Turn on DC2, and then transfer the PDC emulator role.

• Question 79:

  Your network contains an Active Directory domain named contoso.com. Contoso.com contains a member server that runs Windows Server 2008 R2 Standard.

  You need to create an enterprise subordinate certification authority (CA) that can issue certificates based on version 3 certificate templates.

  You must achieve this goal by using the minimum amount of administrative effort.

  What should you do first?

  A. Run the certutil.exe - addenrollmentserver command.
  B. Install the Active Directory Certificate Services (AD CS) role on the member server.
  C. Upgrade the member server to Windows Server 2008 R2 Enterprise.
  D. Run the certutil.exe - installdefaulttemplates command.
  C. Upgrade the member server to Windows Server 2008 R2 Enterprise.

• Question 80:

  Your network contains an Active Directory domain.

  You need to back up all of the Group Policy objects (GPOs), Group Policy permissions, and Group Policy links for the domain.

  What should you do?

  A. From Group Policy Management Console (GPMC), back up the GPOs.
  B. From Windows Explorer, copy the content of the %systemroot%\SYSVOL folder.
  C. From Windows Server Backup, perform a system state backup.
  D. From Windows PowerShell, run the Backup-GPO cmdlet.
  C. From Windows Server Backup, perform a system state backup.

  ---

  http://www.microsoft.com/en-us/download/details.aspx?id=22478 Planning and Deploying Group Policy (.doc)

  Links to OUs, however, are not part of the backup data and will not be restored during a restore operation.

  http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/c361339f-7266-4991-8309- c957a123a455/

  Permissions are backed up but links are not. The links are actually properties of the OU and would be backed up as part of the system state. The backup function in GPMC only backs up the properties of selected GPOs (the settings inside

  the GPOs as well as Security Filters and all other things that belong directly to the GPO). It never backs up OU / Site links -these are not properties of the GPO itself, but of the respective OUs and Sites...

  http://sdmsoftware.com/general-stuff/the-clash-of-the-gpo-links/ Group Policy links are stored within the gpLink attribute on an AD container (in the case of GP, the container is a site, domain or OU object).

  http://technet.microsoft.com/de-de/library/cc756808%28v=ws.10%29.aspx http://technet.microsoft.com/en-us/library/cc784474%28v=ws.10%29.aspx Information saved in a backup

  Backing up a GPO saves all information that is stored inside the GPO to the file system. This includes the following information:

  

  GPO globally unique identifier (GUID) and domain.

  

  GPO settings.

  

  Discretionary access control list (DACL) on the GPO.

  

  WMI filter link, if there is one, but not the filter itself.

  

  Links to IP Security Policies, if any.

  

  XML report of the GPO settings, which can be viewed as HTML from within GPMC.

  

  Date and time stamp of when the backup was taken.

  

  User-supplied description of the backup.

  

  Information not saved in a backup

  Backing up a GPO only saves data that is stored inside the GPO. Data that is stored outside the GPO is not available when the backup is restored to the original GPO or imported into a new one. This data that becomes unavailable includes the following information:

  

  Links to a site, domain, or organizational unit.

  

  WMI filter.

  

  IP Security policy.

  Reference:

  http://social.technet.microsoft.com/Forums/en/winserverGP/thread/d7c621fc-e0e9-47dd-a4df- 9082b33132a6

  For back up all of the Group Policy objets (GPOs Policy permissions, and Group Policy links for the domain) the answer is C.

  For details: System State data http://technet.microsoft.com/en-us/library/cc785306(WS.10).aspx