Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 101:

  Your company has a main office and two branch offices. The main office is located in London. The branch offices are located in New York and Paris.

  Your network consists of an Active Directory forest that contains three domains named contoso.com, paris.contoso.com, and newyork.contoso.com. All domain controllers run Windows Server 2008 R2 and have the DNS Server server role installed.

  The domain controllers for contoso.com are located in the London office. The domain controllers for paris.contoso.com are located in the Paris office. The domain controllers for newyork.contoso.com are located in the New York office.

  A domain controller in the contoso.com domain has a standard primary DNS zone for contoso.com. A domain controller in the paris.contoso.com domain has a standard primary DNS zone for paris.contoso.com. A domain controller in the newyork.contoso.com domain has a standard primary DNS zone for newyork.contoso.com.

  You need to plan a name resolution strategy for the Paris office that meets the following requirements:

  -

  If a WAN link fails, clients must be able to resolve hostnames for contoso.com.

  -

  If a WAN link fails, clients must be able to resolve hostnames for newyork.contoso.com.

  -

  The DNS servers in Paris must be updated when new authoritative DNS servers are added to newyork.contoso.com.

  What should you include in your plan?

  A. Configure conditional forwarding for contoso.com. Configure conditional forwarding for newyork.contoso.com.
  B. Create a standard secondary zone for contoso.com. Create a standard secondary zone for newyork.contoso.com.
  C. Convert the standard zone into an Active Directoryintegrated zone. Add all DNS servers in the forest to the root hints list.
  D. Create an Active Directoryintegrated stub zone for contoso.com. Create an Active Directoryintegrated stub zone for newyork.contoso.com.
  B. Create a standard secondary zone for contoso.com. Create a standard secondary zone for newyork.contoso.com.

  ---

  http://technet.microsoft.com/en-us/library/cc771640.aspx http://technet.microsoft.com/en-us/library/cc771898.aspx

  Understanding Zone Delegation Applies To: Windows Server 2008, Windows Server 2008 R2 Domain Name System (DNS) provides the option of dividing up the namespace into one or more zones, which can then be stored, distributed, and replicated to other DNS servers. When you are deciding whether to divide your DNS namespace to make additional zones, consider the following reasons to use additional zones:

  

  You want to delegate management of part of your DNS namespace to another location or department in your organization.

  

  You want to divide one large zone into smaller zones to distribute traffic loads among multiple servers, improve DNS name resolution performance, or create a more-fault-tolerant DNS environment.

  

  You want to extend the namespace by adding numerous subdomains at once, for example, to accommodate the opening of a new branch or site.

  Secondary zone When a zone that this DNS server hosts is a secondary zone, this DNS server is a secondary source for information about this zone. The zone at this server must be obtained from another remote DNS server computer that also hosts the zone. This DNS server must have network access to the remote DNS server that supplies this server with updated information about the zone. Because a secondary zone is merely a copy of a primary zone that is hosted on another server, it cannot be stored in AD DS.

  

• Question 102:

  You need to recommend a highavailability solution for the file servers in Branch2 that supports the museum's planned changes. What should you include in the recommendation?

  A. a standalone Distributed File System (DFS) namespace and DFS Replication
  B. a domain-based Distributed File System (DFS) namespace and DFS Replication
  C. Failover Clustering and Clustered Shared Volumes
  D. Network Load Balancing (NLB) and Storage Manager
  B. a domain-based Distributed File System (DFS) namespace and DFS Replication

  ---

  Distributed File System (DFS)

  DFS is a method of both simplifying your organization's shared folder structure and providing data redundancy through replication. DFS lets you collect shared folders located on different servers into one or more logically structured

  namespaces. Rather than having to remember which server hosts a specific shared folder, they can access the DFS namespace and find all shared folders.

  You can replicate a DFS namespace and folders within a site and across WAN links. A user connecting to files within the shared folder structures contained in the DFS namespace will connect automatically to shared folders in the same

  Active Directory Directory Services (AD DS) site (when available) rather than across a WAN. You can have several DFS Namespace servers in a site and spread over several sites, so if one server goes down a user can still access files

  within the shared folder structure. The architecture of DFS ensures that a change to a file on a DFS share is replicated quickly and efficiently to all other replicas of that DFS share.

  Creating a DFS Namespace

  You can create a namespace when you install the DFS Management role service, as shown in Figure 10-2, or create it later.

  You can add additional namespaces by right-clicking DFS Namespaces in the DFS Management console and selecting New Namespace. You can create namespaces on a member server or domain controller running Windows Server 2008.

  However, you cannot create more than one namespace on a server running Windows Server 2008 Standard edition. You can create multiple namespaces on servers running Windows Server 2008 Enterprise and Datacenter editions.

  A namespace is a virtual view of shared folders in an organization, and it has a path to a namespace similar to a Universal Naming Convention (UNC) path to a shared folder. You can

  create two types of namespaces:

  Domain-Based Namespaces

  A domain namespace uses a domain as its namespace root, such as \\adatum.com\MyNameSpace. A domainbased namespace can be hosted on multiple namespace servers to increase its availability, and its metadata is stored in AD DS.

  Domain-based namespaces can be created on one or more member servers or domain controllers in the same domain, and metadata for a domain-based namespace is stored by AD DS. Each server must contain an NTFS volume to host

  the namespace. Multiple namespace servers increase the availability of the namespace. A domain-based namespace cannot be a clustered resource in a failover cluster. However, you can locate the namespace on a server that is also a

  node in a failover cluster provided that you configure the namespace to use only local resources on that server.

  Standalone Namespaces

  A stand-alone namespace uses a namespace server as its namespace root, such as \\ServerA\MyNameSpace.

  A stand-alone namespace is hosted on only one server. You would choose a stand-alone namespace if your organization does not use AD DS, if you needed to create a single namespace with more than 5,000 DFS folders but your

  organization did not support Windows Server 2008 mode, or if you wanted to use a failover cluster to increase availability.

• Question 103:

  You need to configure the role services on all file servers that are necessary to meet the technical requirements.

  Which role services should you configure? (Choose all that Apply.)

  A. File Server Resource Manager
  B. BranchCache for network files
  C. Windows Search Service
  D. Distributed File System
  E. Services for Network File System
  B. BranchCache for network files
  D. Distributed File System

  ---

  Requirements:

  Minimize downtime for users accessing across a WAN = Branch Cache

  Files Always opened from the nearest Server =DFS

  Files at same path = DFS

  Department volumes have Quotas

  There is some debat if FSRM is needed. the original answer from Pass4Sure says that A FSRM is required.

  However if you look at the exhibit it clearly says Departmental Volumes and not departmental shares so the question is do you need FSRM to apply quotas to a Volume? the answer is No you dont. NTFS Quota will apply quota by right

  clicking on the volume then selecting properties then selecting quotas. The differences between NTFS and FSRM quotas are basically NTFS is a disk quota, so the accounts cannot use more than the allowed space on the complete disk. With

  FSRM you can use folder quotas and differentiate it for your needs. so with NTFS if you set the quotas to 3 GB on one volume then all users that save data to that volume can only have up to 3GB of data on the whole volume, with FSRM

  quotas you can set it at the volume OR folder level.

  A basic disk is a physical disk that contains primary partitions, extended partitions, or logical drives. Partitions and logical drives on basic disks are known as basic volumes. You can only create basic volumes on basic disks.

  BranchCache

  BranchCache is a wide area network (WAN) bandwidth optimization technology that is included in the Windows Server?2008 R2 and Windows?7 operating systems.

  To optimize WAN bandwidth, BranchCache copies content from your main office content servers and caches the content at branch office locations, allowing client computers at branch offices to access the content locally rather than over the

  WAN.

  At branch offices, content is cached either on servers that are running the BranchCache feature of Windows Server 2008 R2 or, when no server is available in the branch office, on computers running Windows 7. After a client computer

  requests and receives content from the main office and the content is cached at the branch office, other computers at the same branch office can obtain the content locally rather than contacting the main office over the WAN link.

  BranchCache helps improve content query response times for clients and servers in branch offices, and can also help improve network performance by reducing traffic over WAN links.

  The BranchCache for network files role service is part of the File Services server role.

  BranchCache for network files is deeply integrated with file services and allows you to deploy a BranchCache-enabled file server.

  When you deploy a BranchCache-enabled file server, BranchCache creates content information for every file in every shared folder where BranchCache is enabled.

  Distributed File System (DFS) Namespaces and DFS Replication offer simplified, highly-available access to files, load sharing, and WAN-friendly replication. In the Windows Server?2003 R2 operating system, Microsoft revised and renamed

  DFS Namespaces (formerly called DFS), replaced the Distributed File System snap-in with the DFS Management snap-in, and introduced the new DFS Replication feature. In the Windows Server?2008 operating system, Microsoft added the

  Windows Server 2008 mode of domain-based namespaces and added a number of usability and performance improvements.

  What does Distributed File System (DFS) do?

  The Distributed File System (DFS) technologies offer wide area network (WAN)-friendly replication as well as simplified, highly-available access to geographically dispersed files. The two technologies in DFS are the following:

  DFS Namespaces. Enables you to group shared folders that are located on different servers into one or more logically structured namespaces. Each namespace appears to users as a single shared folder with a series of subfolders. This

  structure increases availability and automatically connects users to shared folders in the same Active Directory Domain Services site, when available, instead of routing them over WAN connections.

  DFS Replication. DFS Replication is an efficient, multiple-master replication engine that you can use to keep folders synchronized between servers across limited bandwidth network connections. It replaces the File Replication Service (FRS)

  as the replication engine for DFS Namespaces, as well as for replicating the AD DS SYSVOL folder in domains that use the Windows Server 2008 domain functional level.

  For completion I've included details on FSRM

  FSRM

  With the increasing demand on storage resources, as organizations rely more heavily on data than ever before, IT administrators face the challenge of overseeing a larger and more complex storage infrastructure, while at the same time,

  tracking the kind of information available in it. Managing storage resources not only includes data size and availability any more but also the enforcement of company policies and a very good understanding of how existing storage is utilized,

  allowing for sound strategic planning and proper response to organizational changes.

  File Server Resource Manager is a suite of tools that allows administrators to understand, control, and manage the quantity and type of data stored on their servers. By using File Server Resource Manager, administrators can place quotas on

  folders and volumes, actively screen files, and generate comprehensive storage reports.

  This set of advanced instruments not only helps the administrator to efficiently monitor existing storage resources but it also aids in the planning and implementation of future policy changes.

• Question 104:

  You need to recommend which role services must be deployed to support the company's planned changes. Which two role services should you recommend? (Each correct answer presents part of the solution. Choose two.)

  A. Health Registration Authority (HRA)
  B. Host Credential Authorization Protocol (HCAP)
  C. Network Policy Server (NPS)
  D. Routing and Remote Access service (RRAS)
  C. Network Policy Server (NPS)
  D. Routing and Remote Access service (RRAS)

  ---

  Network Policy Server

  NPS is the Microsoft implementation of a Remote Authentication Dial-In User Service (RADIUS) server and proxy. You can use NPS to centrally manage network access through a variety of network access servers, including 802.1X

  authenticating switches and wireless access points, VPN servers, and dial-up servers. In addition, NPS is configurable as a Network Access Protection (NAP) policy server.

  Routing and Remote Access

  Using Routing and Remote Access, you can deploy Point-to-Point Tunneling Protocol (PPTP), Secure Socket Tunneling Protocol (SSTP), or Later Two Tunneling Protocol (L2TP) with Internet Protocol security (IPsec) VPN connections to

  provide end users with remote access to your organization's network.

  You can also create a site-to-site VPN connection between two servers at different locations. Health Registration Authority (HRA) HRA is a Network Access Protection (NAP) component that issues health certificates to clients that pass the

  health policy verification that is performed by NPS using the client statement of health (SoH). HRA is used only with the NAP IPsec enforcement method.

  Host Credential Authorization Protocol (HCAP)

  HCAP allows you to integrate your Microsoft NAP solution with Cisco Network Access Control Server. When you deploy HCAP with NPS and NAP, NPS can perform client health evaluation and the authorization of Cisco 802.1X access

  clients.

• Question 105:

  You need to recommend a solution that meets the following requirements:

  -Log access to all shared folders on TT-FILE02.

  -Minimize administrative effort.

  - Ensure that further administrative action is not required when new shared folders are added to TT-FILE02.

  What should you recommend?

  A. Upgrade TT-FILE02 to Windows Server 2008 Enterprise and use Application control policies in Group Policy.
  B. Add the Connection Manager Administration Kit feature on TT-FILE02.
  C. Upgrade TT-FILE02 to Windows Server 2008 R2 Standard and use Advanced Audit Policy Configuration settings in Group Policy.
  D. Add the Network Policy and Access Services role to TT-FILE02.
  C. Upgrade TT-FILE02 to Windows Server 2008 R2 Standard and use Advanced Audit Policy Configuration settings in Group Policy.

  ---

  Security auditing enhancements in Windows Server 2008 R2 and Windows 7 can help your organization audit compliance with important business-related and security-related rules by tracking precisely defined activities, such as:

  A group administrator has modified settings or data on servers that contain finance information.

  An employee within a defined group has accessed an important file.

  The correct system access control list (SACL) is applied to every file and folder or registry key on a computer or file share as a verifiable safeguard against undetected access. In Windows 7 and Windows Server 2008 R2, the number of audit settings for which success and failure can be tracked has increased to 53. Previously, there were nine basic auditing settings under Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy. These 53 new settings allow you to select only the behaviors that you want to monitor and exclude audit results for behaviors that are of little or no concern to you, or behaviors that create an excessive number of log entries. In addition, because Windows 7 and Windows Server 2008 R2 security audit policy can be applied by using domain Group Policy, audit policy settings can be modified, tested, and deployed to selected users and groups with relative simplicity.

  http://technet.microsoft.com/en-us/library/dd408940%28v=ws.10%29.aspx

• Question 106:

  You need to recommend a solution for storing user documents. What should you include in the recommendation?

  A. folder redirection
  B. home folders
  C. mandatory user profiles
  D. roaming user profiles
  A. folder redirection

  ---

  http://technet.microsoft.com/en-us/library/cc732275.aspx

  Folder Redirection User settings and user files are typically stored in the local user profile, under the Users folder. The files in local user profiles can be accessed only from the current computer, which makes it difficult for users who use more than one computer to work with their data and synchronize settings between multiple computers. Two technologies exist to address this problem:

  Roaming Profiles and Folder Redirection. Both technologies have their advantages, and they can be used separately or together to create a seamless user experience from one computer to another. They also provide additional options for administrators managing user data.

• Question 107:

  You need to recommend a solution for managing the service accounts for SQL1 and SQL2. The solution must meet the company's security requirements. What should you include in the recommendation?

  A. Configure the service accounts as standard user accounts and perform manual password changes as required.
  B. Configure the service accounts as managed service accounts.
  C. Configure the service accounts as standard user accounts and use a Password Settings object (PSO) to allow different password settings.
  D. Configure the service accounts as virtual accounts.
  A. Configure the service accounts as standard user accounts and perform manual password changes as required.

  ---

  req - passwords to change every 60 days. Service account passwords are set to never expire so can not meet the above requirement, so manual intervention is required. Topic 8, A. Datum Scenario COMPANY OVERVIEW

  A. Datum Corporation is a manufacturing company that has a main office and two branch offices. The main office is located in Denver. The branch offices are located in New York and Montreal. The main office has 10,000 users. Each branch office has approximately 200 users.

  PLANNED CHANGES

  A. Datum plans to deploy a new intranet site named Site1 in the main office. Two servers that run a Server Core installation of Windows Server 2008 R2 are requisitioned for the deployment of Site1.

  You plan to deploy a domain controller in each office.

  You have a new server named Backup1. All servers will be backed up remotely by using Windows Server Backup on Backup1.

  BUSINESS GOALS

  A. Datum has the following business goals:

  -Changes to the environment must minimize costs.

  -

  Changes to the environment must optimize the use of new hardware.

  -

  The costs to manage the network infrastructure and the servers must be minimized.

  EXISTING ENVIRONMENT

  All servers run Windows Server 2008 R2. All client computers run Windows 7 Enterprise.

  The network contains a Web server named Web1. Web1 is located in the perimeter network and is accessible from the internal network and the Internet. Web1 runs a Server Core installation of Windows Server 2008 R2 Standard.

  Existing Active Directory/Directory Services

  The network contains a single Active Directory domain named adatum.com.

  The main office has two domain controllers.

  Existing Network Infrastructure

  Each office has a file server.

  The main office connects to each branch office by using a WAN link. Users in the branch offices frequently access the file server in the main office.

  Current Administration Model

  All domain administrators work in the main office and remotely manage the servers by using their Windows 7 computers.

  A group named Branch Admins has the rights to manage all of the client computers in the branch offices.

  You have several ADMX files that contain custom Application settings.

  REQUIREMENTS

  Security Requirements

  The BranchAdmins group members must be able to install updates and drivers on the domain controllers in the branch offices.

  Passwords must not be stored by using reversible encryption.

  All authentication traffic on the network must be encrypted.

  Application Requirements

  A new Application named WebApp2 must be deployed on Web1. The WebApp2 deployment must meet the following requirements:

  -Users must be authenticated to access WebApp2.

  -WebApp2 must support Web browsers from various vendors.

  -

  WebApp2 must be accessible to internal users and Internet users.

  -

  A failure of WebApp2 must not cause other Web Applications to fail.

  -

  Internet users must be required to configure the minimum number of changes on their client computers to access WebApp2.

  Site1 must be configured to meet the following requirements:

  -

  Site1 must support the most user connections possible.

  -

  Site1 must be backed up every day by a remote server,

  -

  If a single Web server fails, users must be able to access Site1.

  -

  If a single Web server fails, users must not receive an error message when they access Site1.

  Technical Requirements

  You must ensure that domain administrators can access the ADMX files from any client computer that they use to manage Group Policies.

  You must ensure that the domain administrators are notified by e-mail each time a user copies video files to the file servers.

• Question 108:

  Your network consists of a single Active Directory domain. The network includes a branch office named Branch1. Branch1 contains 50 member servers that run Windows Server 2008 R2. An organizational unit (OU) named Branch1Servers contains the computer objects for the servers in Branch1. A global group named Branch1admins contains the user accounts for the administrators. Administrators maintain all member servers in Branch1. You need to recommend a solution that allows the members of Branch1admins group to perform the following tasks on the Branch1 member servers.

  -Stop and start services

  -

  Change registry settings What should you recommend?

  A. Add the Branch1admins group to the Power Users local group on each server in Branch1.
  B. Add the Branch1admins group to the Administrators local group on each server in Branch1.
  C. Assign the Branch1admins group change permissions to the Branch1Servers OU and to all child objects.
  D. Assign the Branch1admins group Full Control permissions on the Branch1Servers OU and to all child objects.
  B. Add the Branch1admins group to the Administrators local group on each server in Branch1.

  ---

  Local admins have these rights.

  Power Users do not

  By default, members of the power users group have no more user rights or permissions than a standard user account. The Power Users group in previous versions of Windows was designed to give users specific administrator rights and permissions to perform common system tasks. In this version of Windows, standard user accounts inherently have the ability to perform most common configuration tasks, such as changing time zones. For legacy applications that require the same Power User rights and permissions that were present in previous versions of Windows,administrators can apply a security template that enables the Power Users group to assume the same rights and permissions that were present in previous versions of Windows.

• Question 109:

  You need to recommend a solution for managing administrative rights for the branch office client computers. The solution must meet the company's technical requirements. What should you recommend configuring?

  A. Account Policies by using GPOs
  B. Local Users and Groups by using Group Policy preferences
  C. Restricted Groups by using GPOs
  D. Security Options by using Group Policy preferences
  B. Local Users and Groups by using Group Policy preferences

  ---

  http://technet.microsoft.com/en-us/library/cc731892%28WS.10%29.aspx

  Group Policy preferences, new for the Windows Server 2008 operating system, include more than 20 new Group Policy extensions that expand the range of configurable settings within a Group Policy object (GPO).

  These new extensions are included in the Group Policy Management Editor window of the Group Policy Management Console (GPMC), under the new Preferences item. Examples of the new Group Policy preference extensions include folder options, mapped drives, printers, scheduled tasks, services, and Start menu settings. http://support.microsoft.com/kb/943729

  Examples of the new Group Policy preference extensions include the following:

  Folder Options Drive Maps Printers Scheduled Tasks Services Start Menu

• Question 110:

  You need to recommend a strategy for recovering objects deleted from Active Directory that supports the planned changes. What should you include in the recommendation? (Each correct answer presents part of the solution. Choose two.)

  A. Active Directory Recycle Bin
  B. Active Directory snapshots
  C. non-authoritative restores
  D. tombstone reanimation
  B. Active Directory snapshots
  D. tombstone reanimation

  ---

  The domain level is only server 2008 so recycle bin isn't available.

  http://technet.microsoft.com/en-us/library/cc753609%28WS.10%29.aspx

  This guide shows how you can use an improved version of Ntdsutil and a new Active Directory?

  database mounting tool in Windows Server?2008 to create and view snapshots of data that is stored in Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS), without restarting the domain

  controller or AD LDS server. A snapshot is a shadow copy--created by the Volume Shadow Copy Service (VSS)--of the volumes that contain the Active Directory database and log files.

  The Active Directory database mounting tool (Dsamain.exe) can improve recovery processes for your organization by providing a means to compare data as it exists in snapshots that are taken at different times so that you can better decide

  which data to restore after data loss. This eliminates the need to restore multiple backups to compare the Active Directory data that they contain.

  This guide provides step-by-step instructions for using the Active Directory database mounting tool, including creating, listing, and mounting snapshots of AD DS; preparing them for viewing as a Lightweight Directory Access Protocol (LDAP)

  server; and viewing the data itself.

  If you have some idea which organizational unit (OU) or objects were deleted, you can look up the deleted objects in the snapshots and record the attributes and back-links that belonged to the deleted objects. You can reanimate these

  objects by using the tombstone reanimation feature on a domain controller in your production environment. Then, you must manually repopulate these objects with the stripped attributes and back-links as identified in the snapshots. For more

  information about tombstone reanimation, see Reanimating Active Directory Tombstone Objects (http://go.microsoft.com/fwlink/?LinkID=116204).