Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 81:

  Your network contains an Active Directory domain named contoso.com.

  The network contains a public key infrastructure (PKI).

  You deploy a new certificate revocation list (CRL) distribution point (CDP) to a server named Server1.

  You discover that users cannot download delta CRLs from Server1.

  You verify that the users can download the complete CRL successfully. You need to ensure that the users can download delta CRLs from Server1.

  Which command should you run?

  A. Appcmd set config "Default Web Site" /section:system.webServer/Security/requestFiltering -allowDoubleEscaping:True
  B. Appcmd set config "Certificates" /section:system.webServer/Security/requestFiltering -allowDoubleEscaping:False
  C. Certutil -setreg CA\CRLDeltaPeriod "Days"
  D. Certutil -setreg CA\CRLOverlapPeriod "Days"
  A. Appcmd set config "Default Web Site" /section:system.webServer/Security/requestFiltering -allowDoubleEscaping:True

• Question 82:

  Your network contains an Active Directory domain named contoso.com. You need to audit changes to a service account. The solution must ensure that the audit logs contain the before and after values of all the changes.

  Which security policy setting should you configure?

  A. Audit Sensitive Privilege Use
  B. Audit User Account Management
  C. Audit Directory Service Changes
  D. Audit Other Account Management Events
  C. Audit Directory Service Changes

  ---

  Reference 1:

  http://technet.microsoft.com/en-us/library/dd772641.aspx

  Audit Directory Service Changes

  This security policy setting determines whether the operating system generates audit events when changes are made to objects in Active Directory Domain Services (AD DS).

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc731607.aspx

  AD DS Auditing Step-by-Step Guide

  This guide includes a description of the new Active Directory?Domain Services (AD DS) auditing feature in Windows Server?2008. With the new auditing feature, you can log events that show old and new values; for example, you can show

  that Joe's favorite drink changed from single latte to triple-shot latte.

• Question 83:

  Your network contains an Active Directory forest. The forest contains a single domain. You want to access resources in a domain that is located in another forest.

  You need to configure a trust between the domain in your forest and the domain in the other forest.

  What should you create?

  A. an incoming external trust
  B. an incoming realm trust
  C. an outgoing external trust
  D. an outgoing realm trust
  A. an incoming external trust

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc816877.aspx A one-way, incoming, external trust allows users in your domain (the domain that you are logged on to at the time that you run the New Trust Wizard) to access resources in another

  Active Directory domain (outside your forest).

• Question 84:

  You are the systems administrator of a large organization that has recently implemented Windows Server 2008 R2.

  You have a few remote sites that do not have very tight security.

  You have decided to implement read-only domain controllers (RODC).

  What forest functional levels does the network need for you to do the install? (Choose Three)

  A. Windows 2000 Mixed
  B. Windows 2008 R2
  C. Windows 2003
  D. Windows 2008
  B. Windows 2008 R2
  C. Windows 2003
  D. Windows 2008

  ---

  http://technet.microsoft.com/en-us/library/cc731243%28v=ws.10%29.aspx Prerequisites for Deploying an RODC

  Ensure that the forest functional level is Windows Server 2003 or higher.

  ..

  Deploy at least one writable domain controller running Windows Server 2008 or Windows Server 2008 R2 in the same domain as the RODC and ensure that the writable domain controller is also a DNS server that has registered a name

  server (NS) resource record for the relevant DNS zone. An RODC must replicate domain updates from a writable domain controller running Windows Server 2008 or Windows Server 2008 R2.

• Question 85:

  Your network contains an Active Directory domain. The domain contains two domain controllers named DC1 and DC2.

  You perform a full backup of the domain controllers every night by using Windows Server Backup.

  You update a script in the SYSVOL folder.

  You discover that the new script fails to run properly. You need to restore the previous version of the script in the SYSVOL folder. The solution must minimize the amount of time required to restore the script.

  What should you do first?

  A. Run the Restore-ADObject cmdlet.
  B. Restore the system state to its original location.
  C. Restore the system state to an alternate location.
  D. Attach the VHD file created by Windows Server Backup.
  D. Attach the VHD file created by Windows Server Backup.

  ---

  http://technet.microsoft.com/en-us/magazine/2008.05.adbackup.aspx Active Directory Backup and Restore in Windows Server 2008

  NTBACKUP vs. Windows Server Backup As an added bonus, Windows Server Backup stores its backup images in Microsoft?Virtual Hard Disk (VHD) format. You can actually take a backup image and mount it as a volume in a virtual machine running under Microsoft Virtual Server 2005. You can simply mount the VHDs in a virtual machine and browse for a particular file rather than having to perform test restores of tapes to see which one has the file is on it. (A note of caution: you can't take a backup image and boot a virtual machine from it. Since the backed-up hardware configuration doesn't correspond to the virtual machine's configuration, you can't use Windows Server Backup as a physical-to-virtual migration tool.)

• Question 86:

  As an administrator at Company, you have installed an Active Directory forest that has a single domain. You have installed an Active Directory Federation services (AD FS) on the domain member server.

  What should you do to configure AD FS to make sure that AD FS token contains information from the active directory domain?

  A. Add a new account store and configure it.
  B. Add a new resource partner and configure it
  C. Add a new resource store and configure it
  D. Add a new administrator account on AD FS and configure it
  E. None of the above
  A. Add a new account store and configure it.

  ---

  http://technet.microsoft.com/en-us/library/cc772309%28v=ws.10%29.aspx Step 3: Installing and Configuring AD FS Now that you have configured the computers that will be used as federation servers, you are ready to install Active Directory Federation Services (AD FS) components on each of the computers. This section includes the following procedures: Install the Federation Service on ADFS-RESOURCE and ADFS-ACCOUNT Configure ADFS-ACCOUNT to work with AD RMS Configure ADFS-RESOURCE to Work with AD RMS

• Question 87:

  Your network contains an Active Directory forest named contoso.com. The forest contains six domains.

  You need to ensure that the administrators of any of the domains can specify a user principal name (UPN) suffix oflitwareinc.com when they create user accounts by using Active Directory Users and Computers.

  Which tool should you use?

  A. Active Directory Administrative Center
  B. Set-ADDomain
  C. Active Directory Sites and Services
  D. Set-ADForest
  D. Set-ADForest

  ---

  We would use the following command to achieve this: Set-ADForest -UPNSuffixes @{Add="contoso.com"}

  Reference 1: http://technet.microsoft.com/en-us/library/dd391925.aspx Creating a UPN Suffix for a Forest

  This topic explains how to use the Active Directory module for Windows PowerShell to create a new user principal name (UPN) suffix for the users in a forest.

  Creating an additional UPN suffix helps simplify the names that are used to log on to another domain in the forest.

  Example

  The following example demonstrates how to create a new UPN suffix for the users in the Fabrikam.com forest:

  Set-ADForest -UPNSuffixes @{Add="headquarters.fabrikam.com"} Reference 2

  http://technet.microsoft.com/en-us/library/ee617221.aspx

  Set-ADForest Modifies an Active Directory forest.

  Parameter

  UPNSuffixes Modifies the list of user principal name (UPN) suffixes of the forest. This parameter sets the multi-valued msDS-UPNSuffixes property of the cross-

  reference container. This parameter uses the following syntax to add remove, replace, or clear UPN suffix values.

  Syntax:

  To add values:

  -UPNSuffixes @{Add=value1,value2,...}

• Question 88:

  A corporate network includes an Active Directory-integrated zone. All DNS servers that host the zone are domain controllers.

  You add multiple DNS records to the zone.

  You need to ensure that the new records are available on all DNS servers as soon as possible.

  Which tool should you use?

  A. Repadmin
  B. Ldp
  C. Dnscmd
  D. Ntdsutil
  D. Ntdsutil

• Question 89:

  Company has an active directory forest on a single domain.

  Company needs a distributed application that employs a custom application. The application is directory partition software named PARDAT.

  You need to implement this application for data replication.

  Which two tools should you use to achieve this task? (Choose two answers. Each answer is a part of a complete solution)

  A. Dnscmd.
  B. Ntdsutil.
  C. Ipconfig
  D. Dnsutil
  E. All of the above
  A. Dnscmd.
  B. Ntdsutil.

  ---

  http://support.microsoft.com/kb/884116 How to create and apply a custom application directory partition on an Active Directory integrated DNS zone in Windows Server 2003 You can create a custom Active Directory partition by using the DnsCmd command. If the new naming context that you created does not appear in the Repadmin output, you can verify the state of this naming context by using the Ntdsutil command.

• Question 90:

  Your network contains an Active Directory domain. The domain is configured as shown in the following table.

  

  Users in Branch2 sometimes authenticate to a domain controller in Main. You need to ensure that users in Branch2 only authenticate to the domain controllers in Branch1.

  What should you do?

  A. On DC1 and DC2, set the AutoSiteCoverage value to 1.
  B. On DC1 and DC2, set the AutoSiteCoverage value to 0.
  C. On DC3, set the AutoSiteCoverage value to 0.
  D. On DC3, set the AutoSiteCoverage value to 1.
  B. On DC1 and DC2, set the AutoSiteCoverage value to 0.