Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 111:

  You need to recommend a security strategy for WebApp2 that meets the company's Application requirements. What should you include in the recommendation?

  A. Basic authentication and connection security rules
  B. Basic authentication and SSL
  C. Digest authentication and connection security rules
  D. Digest authentication and SSL
  B. Basic authentication and SSL

• Question 112:

  You need to recommend a backup strategy for HyperV. What should you recommend?

  A. Take a snapshot of each VM, and then run a full backup of the HyperV hosts by using Windows Server Backup.
  B. Shut down the VMs, and then run a full backup of the HyperV hosts by using Windows Server Backup. Restart the VMs when the backup is complete.
  C. From each VM, run a full backup by using Windows Server Backup, and then run a full backup of the HyperV hosts by using Windows Server Backup.
  D. From each VM, run a full backup by using Windows Server Backup. Shut down the VMs, and then run a full backup of the HyperV hosts by using Windows Server Backup. Restart the VMs when the backup is complete.
  C. From each VM, run a full backup by using Windows Server Backup, and then run a full backup of the HyperV hosts by using Windows Server Backup.

  ---

  http://technet.microsoft.com/en-us/library/dd252619%28WS.10%29.aspx There are two basic methods you can use to perform a backup. You can: Perform a backup from the server running Hyper-V. We recommend that you use this method to perform a full server backup because it captures more data than the other method. If the backup application is compatible with Hyper-V and the

  Hyper-V VSS writer, you can perform a full server backup that helps protect all of the data required to fully restore the server, except the virtual networks. The data included in such a backup includes the configuration of virtual machines,

  snapshots associated with the virtual machines, and virtual hard disks used by the virtual machines. As a result, using this method can make it easier to recover the server if you need to, because you do not have to recreate virtual machines

  or reinstall Hyper-V. However, virtual networks are not included in a full server backup. You will need to reconfigure the virtual networking by recreating the virtual networks and then reattaching the virtual network adapters in each virtual

  machine to the appropriate virtual network. As part of your backup planning, make sure you document the configuration and all relevant settings of your virtual network if you want to be able to recreate it.

  Perform a backup from within the guest operating system of a virtual machine. Use this method when you need to back up data from storage that is not supported by the Hyper-V VSS writer.

  When you use this method, you run a backup application from the guest operating system of the virtual machine. If you need to use this method, you should use it in addition to a full server backup and not as an alternative to a full server

  backup.

  Perform a backup from within the guest operating system before you perform a full backup of the server running Hyper-V. For more information about storage considerations, see the following section.

  Topic 13, Wingtip Toys

  Scenario

  COMPANY OVERVIEW

  Wingtip Toys is an international company that has a main office and several branch offices. The main office is located in Moscow. The branch offices are located throughout Europe. The main office has 500 users. Each branch office has 4 to

  70 users.

  PLANNED CHANGES

  Wingtip Toys opens a new branch office that contains a file server. You plan to promote the file server to a Read-only Domain Controller (RODC).

  Wingtip Toys plans to hire a consulting firm to manage its Web site. The consulting firm must only be permitted to manage the Web site and must be prevented from accessing to all other server resources.

  Wingtip Toys plans to purchase a high-resolution printer that will be connected to a print server in the main office. Users must be charged for each page that they print on the printer.

  You plan to present additional storage to a two node failover cluster in the main office. The storage will be used by the file server instance.

  EXISTING ENVIRONMENT

  All servers run either Windows Server 2008 or Windows Server 2008 R2. All client computers run either Windows Vista Enterprise or Windows 7 Enterprise.

  Existing Network Infrastructure

  The network contains an internal network and a perimeter network.

  The company Web site is hosted on a standalone server in the perimeter network.

  The main office connects to each branch office by using a 1-Mbps WAN link.

  Existing Active Directory Environment

  The network contains a single Active Directory domain named wingtiptoys.com. An Active

  Directory site exists for each office. Each Active Directory site contains a single subnet.

  The main office has two domain controllers. Each branch office has a single domain controller.

  REQUIREMENTS Technical Requirements Wingtip Toys must meet the following technical requirements:

  -

  Minimize network utilization.

  -

  Minimize WAN link utilization.

  -

  Ensure that the file servers can access additional storage as a local drive.

  -

  Ensure that changes to the network are transparent to users whenever possible.

  -

  Ensure that new storage solutions are supported by Windows Failover Clustering.

  -

  Ensure that each user can access his Documents folder from any client computer.

  -

  Automatically organize the files on the file servers according to the contents of the files.

  -

  Ensure that storage can be provisioned without causing any downtime of the file servers.

  -

  Ensure that the data on the file servers is protected by using Windows BitLocker Drive Encryption (BitLocker).

  Problem Statements

  All users store their documents and other data in the Documents folder on their respective client computers. The users report that when they log on to a computer that is not their own, their documents are unavailable.

• Question 113:

  You are designing a recovery solution for file servers that run Windows Server 2008 R2. File servers have the operating system and settings on volume C and shared data on other volumes.

  The recovery solution must meet the following requirements:

  -

  Create restorable point-in-time copies of files stored in shared folders on the file servers.

  -

  Provide users the ability to compare versions of an open file.

  You need to design a recovery solution that meets the requirements.

  What should you recommend? (More than one answer choice may achieve the goal. Select the BEST answer.)

  A. Enable the windows Server Backup feature and schedule a backup of the shared folders on the file servers.
  B. Enable Shadow Copies on all file server volumes.
  C. Enable the Windows Server Backup feature and schedule a backup of the file server system state data.
  D. Enable Shadow Copies on only file server volumes that contain shared folders.
  D. Enable Shadow Copies on only file server volumes that contain shared folders.

  ---

  Windows Server 2008 Volume Shadow Copy is a mechanism whereby the contents of shared folders can be automatically backed up at pre-determined intervals to a shadow volume. Once implemented, shadow copy will backup the previous 64 versions of each file in the shadowed volume and provide users with the ability to restore files from any of the previous 64 versions without administrator intervention, enabling users to independently restore deleted, damaged or overwritten files. In addition to restoring individual files to a previous version, shadow copy also provides the ability to restore an entire volume.

  The requirement is to enable this on shared folders only so answer D meets this requirement best.

• Question 114:

  You need to recommend a solution for managing GPOs. The solution must meet the company's technical requirements. What should you include in the recommendation?

  A. Desktop Optimization Pack
  B. Forefront EndPoint Protection
  C. System Center Configuration Manager
  D. System Center Operations Manager
  A. Desktop Optimization Pack

  ---

  http://technet.microsoft.com/en-us/library/ee532079.aspx

  Imagine a tool that could help you take control of Group Policy. What would this tool do? It could help you delegate who can review, edit, approve, and deploy Group Policy objects (GPOs). It might help prevent widespread failures that can result from editing GPOs in production environments. You could use it to track each version of each GPO, just as developers use version control to track source code. Any tool that provided these capabilities, cost little, and was easy to deploy would certainly be worth a closer look.

  Such a tool indeed exists, and it is an integral part of the Microsoft?Desktop Optimization Pack (MDOP) for Software Assurance. MDOP can help organizations reduce the cost of deploying applications, deliver applications as services, and better manage desktop configurations.

  Together, the MDOP applications shown in Figure 1 can give Software Assurance customers a highly cost-effective and flexible solution for managing desktop computers.

  

  Microsoft Advanced Group Policy Management (AGPM) is the MDOP application that can help customers overcome the challenges that can affect Group Policy management in any organization, particularly those with complex information technology (IT) environments. A robust delegation model, role-based administration, and change-request approval provide granular administrative control. For example, you can delegate Reviewer, Editor, and Approver roles to other users--even users who do not typically have access to production GPOs. (Editors can edit GPOs but cannot deploy them; Approvers can deploy GPO changes.)

  AGPM can also help reduce the risk of widespread failures. You can use AGPM to edit GPOs offline, outside of the production environment, and then audit changes and easily find differences between GPO versions. In addition, AGPM supports effective change control by providing version tracking, history capture, and quick rollback of deployed GPO changes. It even supports a management workflow by allowing you to create GPO template libraries and send GPO change e-mail notifications.

  This white paper describes the key features of AGPM, such as change control and role-based delegation. The paper then describes how Software Assurance customers can begin evaluating AGPM today.

  Offline Editing The AGPM archive provides offline storage for GPOs. As Figure 2 shows, changes that you make to GPOs in the archive do not affect the production environment until you deploy the GPOs. By limiting changes to the archive, you can edit GPOs and test them in a safe environment, without affecting the production environment.

  After reviewing and approving the changes, you can then deploy them with the knowledge that you can quickly roll them back if they have an undesired effect.

  

  GPMC Integration AGPM has a server component (the AGPM Service) and a client component (the AGPM snap-in), each of which you install separately. First, you install Microsoft Advanced Group Policy Management - Server on a system that has access to the policies that you want to manage. Then, you install the Microsoft Advanced Group Policy Management - Client on any system from which Group Policy administrators will review, edit, and deploy GPOs.

  The AGPM snap-in integrates completely with the Group Policy Management Console (GPMC), as Figure 3 shows. Click Change Control in the console tree to open AGPM in the details pane and to manage the AGPM archive on the Contents tab. Here, you can review, edit, and deploy controlled GPOs (that is, GPOs in the archive). You can also take control of uncontrolled GPOs (that is, GPOs that are not in the archive), approve pending changes, and manage GPO templates. On the Domain Delegation tab, AGPM Administrators (Full Control) delegate roles to AGPM users and configure e-mail notifications. Configure the AGPM Server connection on the AGPM Server tab. AGPM 3.0 introduced the Production Delegation tab, which AGPM Administrators can use to delegate permission to edit GPOs in the production environment.

  

  Change Control AGPM provides advanced change control features that can help you manage the lifecycle of GPOs. Many of the AGPM change control concepts will be familiar to administrators who have experience using common version-control tools, such as the version control feature in Microsoft Office SharePoint?Server 2007. The following steps are necessary to change and deploy a GPO:

  1.

  Check out the GPO from the archive.

  2.

  Edit the GPO as necessary.

  3.

  Check in the GPO to the archive.

  4.

  Deploy the GPO to production.

  Change control means more than locking a GPO to prevent multiple users from changing it at the same time. AGPM keeps a history of changes for each GPO, as shown in Figure 4. You can deploy any version of a GPO to production, so you can quickly roll back a GPO to an earlier version if necessary. AGPM can also compare different versions of a GPO, showing added, changed, or deleted settings. Therefore, you can easily review changes before approving and deploying them to the production environment. In addition, a complete history of each GPO enables you to audit not only changes but also all activities related to that GPO.

  

  Role-Based Delegation Group Policy already provides a rich delegation model that allows you to delegate administration to regional and task-oriented administrators. However, Group Policy also lets administrators approve their own changes. In contrast, AGPM provides a role-based delegation model that adds a review and approval step to the workflow, as shown in Figure 5.

  

  An AGPM Administrator has full control of the AGPM archive. In addition to the AGPM Administrator role, AGPM defines three special roles to support its delegation model:

  -Reviewer. Reviewers can view and compare GPOs. They cannot edit or deploy GPOs.

  -Editor. Editors can view and compare GPOs. They can also check out GPOs from the archive, edit GPOs, and check in GPOs to the archive. Editors can request deployment of a GPO.

  -Approver. Approvers can approve the creation and deployment of GPOs. (When Approvers create or deploy a GPO, approval is automatic.)

  As an AGPM Administrator, you can delegate these roles to users and groups for all controlled GPOs within the domain (domain delegation). For example, you can delegate the Reviewer role to users, allowing them to review any controlled

  GPO in the domain. You can also delegate these roles to users for individual controlled GPOs. Rather than allow users to edit any controlled GPO in the domain, for example, you can give them permission to edit a specific controlled GPO by

  delegating the Editor role for that GPO only.

  Search and Filter

  AGPM 4.0 introduces the ability to filter the list of GPOs that it displays. For example, you can filter the list by name, status, or comment. You can even filter the list to show GPOs that were changed by a particular user or on a specific date.

  AGPM displays partial matches, and searches are not case sensitive.

  AGPM supports complex search strings using the format column: string, where column is the name of the column by which to search and string is the string to match. For example, to display GPOs that were checked in by Jerry, type state:

  "checked in" changed by: Jerry in the Search box.

  Figure 6 shows another example. You can also filter the list by GPO attributes by using the format attribute: string, where attribute is the name of the GPO attribute to match. To display all GPOs that use the Windows?Management

  Instrumentation (WMI) filter called MyWMIFilter, type wmi filter: mywmifilter in the Search box.

  When searching for GPOs, you can use special terms to search by date, dynamically. These special terms are the same terms that you can use when using Windows Explorer to search for files. For example, you can filter the list to display

  GPOs that were changed today, yesterday, this week, last week, and so on.

  Cross-Forest Management

  In addition to filtering, AGPM 4.0 also introduces cross-forest management. You can use the following process to copy a controlled GPO from a domain in one forest to a domain in a second forest:

  

  1.

  Export the GPO from a domain in the first forest to a CAB file, by using AGPM (Figure 7).

  2.

  On a computer in a domain in the first forest, copy the CAB file to a portable storage device.

  3.

  Insert the portable storage device into a computer in a domain in the second forest.

  4.

  Import the GPO into the archive in a domain in the second forest, by using AGPM.

  When you import the GPO into the second forest, you can import it as a new controlled GPO. You can also import it to replace the settings of an existing GPO that is checked out of the archive. The obvious benefit of cross-forest management is testing. Combined with offline editing and change control, cross-forest management enables you to test GPOs in a controlled test environment (the first forest). After verifying the GPO, you can move it into the production environment (the second forest).

  Windows Support Three versions of AGPM are available: AGPM 2.5, AGPM 3.0, and AGPM 4.0. Each is incompatible with the others and supports different Windows operating systems. For more information about choosing the right version of AGPM for your environment and about the Windows operating systems that each supports, see Choosing Which Version of AGPM to Install.

  AGPM 4.0 introduces support for Windows 7 and Windows Server?2008 R2. Additionally, AGPM 4.0 still supports Windows Vista?with Service Pack 1 (SP1) and Windows Server 2008. Table 1 describes limitations in mixed environments that include newer and older Windows operating systems.

• Question 115:

  Your company has several branch offices.

  Your network consists of a single Active Directory domain. Each branch office contains domain controllers and member servers. The domain controllers run Windows Server 2003 SP2. The member servers run Windows Server 2008 R2.

  Physical security of the servers at the branch offices is a concern.

  You plan to implement Windows BitLocker Drive Encryption (BitLocker) on the member servers.

  You need to ensure that you can access the BitLocker volume if the BitLocker keys are corrupted on the member servers. The recovery information must be stored in a central location.

  What should you do?

  A. Upgrade all domain controllers to Windows Server 2008 R2. Use Group Policy to configure Public Key Policies.
  B. Upgrade all domain controllers to Windows Server 2008 R2. Use Group Policy to enable Trusted Platform Module (TPM) backups to Active Directory.
  C. Upgrade the domain controller that has the schema master role to Windows Server 2008 R2. Use Group Policy to enable a Data Recovery Agent (DRA).
  D. Upgrade the domain controller that has the primary domain controller (PDC) emulator role to Windows Server 2008 R2. Use Group Policy to enable a Data Recovery Agent (DRA).
  B. Upgrade all domain controllers to Windows Server 2008 R2. Use Group Policy to enable Trusted Platform Module (TPM) backups to Active Directory.

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration:

  Planning BitLocker Deployment

  Windows BitLocker and Drive Encryption (BitLocker) is a feature that debuted in Windows Vista Enterprise and Ultimate Editions and is available in all versions of Windows Server 2008.

  BitLocker serves two purposes:

  protecting server data through full volume encryption and providing an integrity-checking mechanism to ensure that the boot environment has not been tampered with.

  Encrypting the entire operating system and data volumes means that not only are the operating system and data protected, but so are paging files, applications, and application configuration data. In the event that a server is stolen or a hard

  disk drive removed from a server by third parties for their own nefarious purposes, BitLocker ensures that these third parties cannot recover any useful data. The drawback is that if the BitLocker keys for a server are lost and the boot

  environment is compromised, the data stored on that server will be unrecoverable.

  To support integrity checking, BitLocker requires a computer to have a chip capable of supporting the Trusted Platform Module (TPM) 1.2 or later standard. A computer must also have a BIOS that supports the TPM standard. When BitLocker

  is implemented in these conditions and in the event that the condition of a startup component has changed, BitLocker-protected volumes are locked and cannot be unlocked unless the person doing the unlocking has the correct digital keys.

  Protected startup components include the BIOS, Master Boot Record, Boot Sector, Boot Manager, and Windows Loader.

  From a systems administration perspective, it is important to disable BitLocker during maintenance periods when any of these components are being altered. For example, you must disable BitLocker during a BIOS upgrade. If you do not, the

  next time the computer starts, BitLocker will lock the volumes and you will need to initiate the recovery process. The recovery process involves entering a 48-character password that is generated and saved to a specified location when

  running the BitLocker setup wizard. This password should be stored securely because without it the recovery process cannot occur. You can also configure BitLocker to save recovery data directly to Active Directory; this is the recommended

  management method in enterprise environments.

  You can also implement BitLocker without a TPM chip. When implemented in this manner there is no startup integrity check. A key is stored on a removable USB memory device, which must be present and supported by the computer's BIOS

  each time the computer starts up. After the computer has successfully started, the removable USB memory device can be removed and should then be stored in a secure location. Configuring a computer running Windows Server 2008 to use

  a removable USB memory device as a BitLocker startup key is covered in the second practice at the end of this lesson.

  BitLocker Group Policies

  BitLocker group policies are located under the Computer Configuration\Policies\ Administrative Templates\Windows Components\BitLocker Drive Encryption node of a Windows Server 2008 Group Policy object. In the event that the

  computers you want to deploy BitLocker on do not have TPM chips, you can use the Control Panel Setup: Enable Advanced Startup Options policy, which is shown in Figure 1-7. When this policy is enabled and configured, you can implement

  BitLocker without a TPM being present. You can also configure this policy to require that a startup code be entered if a TPM chip is present, providing another layer of security.

  

  Figure 1-7Allowing BitLocker without the TPM chip Other BitLocker policies include:

  Turn On BitLocker Backup To Active Directory Domain Services When this policy is enabled, a computer's recovery key is stored in Active Directory and can be recovered by an authorized administrator.

  Control Panel Setup: Configure Recovery Folder When enabled, this policy sets the default folder to which computer recovery keys can be stored.

• Question 116:

  You need to recommend a backup strategy for the servers in the San Francisco office. The strategy must meet the company's technical requirements. What should you include in the recommendation?

  A. native-boot virtual hard disks (VHDs)
  B. Microsoft System Center Data Protection Manager 2010
  C. system restore points
  D. Windows Server Backup
  D. Windows Server Backup

  ---

  You need to recommend a backup strategy for the servers in the San Francisco office. The strategy must meet the company's technical requirement.

  Technical Requirement: Ensure that you can perform a bare metal recovery in the San Francisco Office Business Goal: Minimize costs whenever possible So the correct answer is Windows Server Backup because you can deploy Bare Metal

  backups Previous answer below ...

  http://technet.microsoft.com/en-us/library/ff399260.aspx

  What is Data Protection Manager?

  Microsoft System Center Data Protection Manager (DPM) 2010 is a member of the Microsoft System Center family of management products, designed to help IT professionals manage their Windows environment. DPM provides Windows

  backup and recovery--delivering seamless data protection for Microsoft application and file servers by using integrated disk and tape media. DPM performs replication, synchronization, and recovery point creation to provide reliable protection

  and rapid recovery of data for both system administrators and end-users.

• Question 117:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2.

  All client computers run Windows 7. All user accounts are stored in an organizational unit (OU) named Staff. All client computer accounts are stored in an OU named Clients. You plan to deploy a new Application.

  You need to ensure that the Application deployment meets the following requirements:

  -

  Users must access the Application from an icon on the Start menu.

  -

  The Application must be available to remote users when they are offline. What should you do?

  A. Publish the Application to users in the Staff OU.
  B. Publish the Application to users in the Clients OU.
  C. Assign the Application to computers in the Staff OU.
  D. Assign the Application to computers in the Clients OU.
  D. Assign the Application to computers in the Clients OU.

  ---

  http://www.youtube.com/watch?v=hQkRN96cKkM

  Group policy objects can be applied either to users or to computers. Deploying applications through the Active Directory is also done through the use of group policies, and therefore applications are deployed either on a per user basis or on a per computer basis. There are two different ways that you can deploy an application through the Active Directory. You can either publish the application or you can assign the application. You can only publish applications to users, but you can assign applications

  to either users or to computers. The application is deployed in a different manner depending on which of these methods you use.

  Publishing an application doesn't actually install the application, but rather makes it available to users. For example, suppose that you were to publish Microsoft Office. Publishing is a group policy setting, so it would not take effect until the

  next time that the user logs in. When the user does log in though, they will not initially notice anything different. However, if the user were to open the Control Panel and click on the Add / Remove Programs option, they will find that Microsoft

  Office is now on the list. A user can then choose to install Microsoft office on their machine.

  One thing to keep in mind is that regardless of which deployment method you use, Windows does not perform any sort of software metering. Therefore, it will be up to you to make sure that you have enough licenses for the software that you

  are installing.

  Assigning an application to a user works differently than publishing an application. Again, assigning an application is a group policy action, so the assignment won't take effect until the next time that the user logs in.

  When the user does log in, they will see that the new application has been added to the Start menu and / or to the desktop.

  Although a menu option or an icon for the application exists, the software hasn't actually been installed though.

  To avoid overwhelming the server containing the installation package, the software is not actually installed until the user attempts to use it for the first time.

  This is also where the self healing feature comes in. When ever a user attempts to use the application, Windows always does a quick check to make sure that the application hasn't been damaged. If files or registry settings are missing, they

  are automatically replaced.

  Assigning an application to a computer works similarly to assigning an application to a user. The main difference is that the assignment is linked to the computer rather than to the user, so it takes effect the next time that the computer is

  rebooted. Assigning an application to a computer also differs from user assignments in that the deployment process actually installs the application rather than just the application's icon. as assigning installs the application the next time a

  computer reboots the app will be available when at next login regardless of which user logs in. also as its being assigned to a computer the GPO needs to be linked to the Clients OU as this is where the computer accounts are located.

  Assigning Software to a group.

  http://support.microsoft.com/kb/324750

  Create a folder to hold the Windows Installer package on a server. Share the folder by applying permissions that let users and computers read and run these files. Then, copy the MSI package files into this location.

  From a Windows Server 2003-based computer in the domain, log on as a domain administrator, and then start Active Directory Users and Computers.

  In Active Directory Users and Computers, right-click the container to which you want to link the GPOs, and then click Properties.

  Click the Group Policy tab, and then click New to create a new GPO for installing the Windows Installer package. Give the new GPO a descriptive name.

  Click the new GPO, and then click Edit.

  The Group Policy Object Editor starts.

  Right-click the Software Settings folder under either Computer Configuration or User Configuration, point to New, and then click Package.

• Question 118:

  Your network consists of a single Active Directory domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. Users store all of their files in their Documents folder.

  Many users store large files.

  You plan to implement roaming user profiles for all users by using Group Policy. You need to recommend a solution that minimizes the amount of time it takes users to log on and log off of the computers that use the roaming user profiles.

  What should you recommend?

  A. Modify the Group Policy object (GPO) to include folder redirection.
  B. Modify the Group Policy object (GPO) to include Background Intelligent Transfer Service (BITS) settings.
  C. On the server that hosts the roaming user profiles, enable caching on the profiles share.
  D. On any server, install and configure the Background Intelligent Transfer Service (BITS) server extensions.
  A. Modify the Group Policy object (GPO) to include folder redirection.

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration:

  Planning and Managing Group Policy

  Planning your Group Policy is in part planning your organizational structure. If you have a huge number of OUs--some inheriting policies, others blocking inheritance, several OUs linking to the same GPO, and several GPOs linking to the

  same OU--you have a recipe for disaster. While too few OUs and GPOs is also a mistake, most of us err on the side of having too many. Keep your structures simple. Do not link OUs and GPOs across site boundaries. Give your OUs and

  GPOs meaningful names.

  When you are planning Group Policy you need to be aware of the Group Policy settings that are provided with Windows Server 2008. These are numerous and it is not practical to memorize all of them, but you should know what the various

  categories are. Even if you do not edit any policies, exploring the Group Policy structure in Group Policy Management Editor is worthwhile. You will develop a feel for what is available and whether you need to generate custom policies by

  creating ADMX files.

  You also need a good understanding of how Group Policy is processed at the client. This happens in the following two phases:

  Core processing When a client begins to process Group Policy, it must determine whether it can reach a DC, whether any GPOs have been changed, and what policy settings must be processed.

  The core Group Policy engine performs the processing of this in the initial phase.

  Client-side extension (CSE) processing In this phase, Group Policy settings are placed in various categories, such as Administrative Templates, Security Settings, Folder Redirection, Disk Quota, and Software Installation. A specific CSE

  processes the settings in each category, and each CSE has its own rules for processing settings. The core Group Policy engine calls the CSEs that are required to process the settings that apply to the client.

  CSEs cannot begin processing until core Group Policy processing is completed. It is therefore important to plan your Group Policy and your domain structure so that this happens as quickly and reliably as possible. The troubleshooting section

  later in this lesson discusses some of the problems that can delay or prevent core Group Policy processing.

• Question 119:

  Your company has a main office and two branch offices. Each office has a domain controller and file servers. Your network consists of a single Active Directory domain. All servers run Windows Server 2008 R2. You need to plan the deployment of Distributed File System (DFS) to meet the following requirements: -Ensure that users see only the folders to which they have access -Ensure that users can access the data locally -Minimize the bandwidth required to replicate data What should you include in your plan?

  A. Deploy a stand-alone DFS namespace. Enable access-based enumeration and use DFS Replication.
  B. Deploy a stand-alone DFS namespace. Enable access-based enumeration and use File Replication Service (FRS).
  C. Deploy a domain-based DFS namespace and use DFS Replication. Modify each share to be a hidden share.
  D. Deploy a domain-based DFS namespace and use File Replication Service (FRS). Modify each share to be a hidden share.
  A. Deploy a stand-alone DFS namespace. Enable access-based enumeration and use DFS Replication.

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration:

  Distributed File System (DFS) DFS is considerably enhanced in Windows Server 2008. It consists of two technologies, DFS Namespaces and DFS Replication, that you can use (together or independently) to provide fault-tolerant and flexible

  file sharing and replication services.

  DFS Namespaces lets you group shared folders on different servers (and in multiple sites) into one or more logically structured namespaces. Users view each namespace as a single shared folder with a series of subfolders. The underlying

  shared folders structure is hidden from users, and this structure provides fault tolerance and the ability to automatically connect users to local shared folders, when available, instead of routing them over wide area network (WAN) connections.

  DFS Replication provides a multimaster replication engine that lets you synchronize folders on multiple servers across local or WAN connections. It uses the Remote Differential Compression (RDC) protocol to update only those files that

  have changed since the last replication. You can use DFS Replication in conjunction with DFS Namespaces or by itself.

  This lesson summarizes DFS only very briefly as part of your planning considerations. Lesson 2 of this chapter discusses the topic in much more depth.

  Exam TipPrevious Windows Server examinations have contained a high proportion of DFS questions. There is no reason to believe 70-646 will be any different.

  You can also use Share And Storage Management to view and modify the properties of a shared folder or volume, including the local NTFS permissions and the network access permissions for that shared resource. To do this you again

  select the shared resource on the Shares tab and select Properties in the Actions pane.

  Figure 6-6 shows the Properties dialog box for the share folder Public. The Permissions tab lets you specify share and NTFS permissions. Clicking Advanced lets you configure user limits and caching and disable or enable access-based

  enumeration (ABE). ABE is enabled by default and lets you hide files and folders from users who do not have access to them.

  

• Question 120:

  Which NAP enforcement method should you recommend?

  A. 802.1x
  B. DHCP
  C. IPSec
  D. VPN
  C. IPSec

  ---

  Requirements/information:

  Implement Network Access Protection (NAP) for all of the client computers on the internal network and for all of the client computers that connect remotely

  Some users work remotely. To access the company's internal resources, the remote users use a VPN connection to NPAS1.

  The network contains network switches and wireless access points (WAPs) from multiple vendors Some of the network devices are more than 10 years old and do not support portbased authentication.

  Network Access Protection (NAP) is a feature in Windows Server 2008 that controls access to network resources based on a client computer's identity and compliance with corporate

  governance policy. NAP allows network administrators to define granular levels of network access based on who a client is, the groups to which the client belongs, and the degree to which that client is compliant with corporate governance

  policy. If a client is not compliant, NAP provides a mechanism to automatically bring the client back into compliance and then dynamically increase its level of network access.

  NAP Enforcement Methods

  When a computer is found to be noncompliant with the enforced health policy, NAPenforces limited network access. This is done through an Enforcement Client (EC). Windows Vista,

  Windows XP Service Pack 3, and Windows Server 2008 include NAPEC support for IPsec, IEEE 802.1X, Remote Access VPN, and DHCP enforcement methods. Windows Vista and Windows Server 2008 also support NAP enforcement for

  Terminal Server Gateway connections.

  NAP enforcement methods can either be used individually or can be used in conjunction with each other to limit the network access of computers that are found not to be in compliance with configured health policies. Hence you can apply the

  remote access VPN and IPsec enforcement methods to ensure that internal clients and clients coming in from the Internet are only granted access to resources if they meet the appropriate client health benchmarks.

  802.1X step-by-step guide.

  http://www.microsoft.com/downloads/en/details.aspx?FamilyID=8a0925ee-ee06-4dfbbba2-07605eff0608anddisplaylang=en

  802. 802.1X Enforcement

  When 802.1X is used--over either wired or wireless networks--the client device's access is restricted by network infrastructure devices such as wireless connection points and switches. Until the device has demonstrated its compliance, client

  access is restricted.

  Restriction is enforced on the network access device using an access control list (ACL) or by placing the client device on restricted virtual local area networks (VLANs). The 802.1X standard is more complex to deploy than DHCP, but it

  provides a high degree of protection.

  as a requirement of 802.1 is port authentication and some of the devices ate 10+ years old and do not support this then then this rules out this method

  IPSEC ENFORCEMENT

  IPsec enforcement works by applying IPsec rules. Only computers that meet health compliance requirements are able to communicate with each other. IPsec enforcement can be applied on a per-IP address, per-TCP port number, or per-

  UDP port number basis. For example: You can use IPsec enforcement to block RDP access to a web server so that only computers that are healthy can connect to manage that server but allow clients that do not meet health requirements to

  connect to view Web pages hosted by the same web server.

  IPsec is the strongest method of limiting network access communication through NAP. Where it might be possible to subvert other methods by applying static addresses or switching ports, the IPsec certificate used for encryption can be

  obtained by a host only when it passes the health check. No IPsec certificate means that communication with other hosts that encrypt their communications using a certificate issued from the same CA is impossible.

  VPN Enforcemement

  VPN enforcement is used on connecting VPN clients as a method of ensuring that clients granted access to the internal network meet system health compliance requirements. VPN enforcement works by restricting network access to

  noncompliant clients through the use of packet filters.

  Rather than being able to access the entire network, incoming VPN clients that are noncompliant have access only to the remediation server group.

  As is the case with 802.1X enforcement, the health status of a connected client is monitored continuously. If a client becomes noncompliant, packet filters restricting network access will be applied. If a noncompliant client becomes compliant,

  packet filters restricting network access will be removed. VPN enforcement requires an existing remote access infrastructure and an NPS server. The enforcement method uses the VPN EC, which is included with Windows 7, Windows Vista,

  Windows Server 2008, Windows Server 2008 R2, and Windows XP SP3.

  DHCP NAP Enforcement

  DHCP NAP enforcement works by providing unlimited-access IPv4 address information to compliant computers and limited-access IPv4 address information to noncompliant computers.

  Unlike VPN and 802.1X enforcement methods, DHCP NAP enforcement is applied only when a client lease is obtained or renewed. Organizations using this method of NAP enforcement should avoid configuring long DHCP leases because

  this will reduce the frequency at which compliance checks are made.

  To deploy DHCP NAP enforcement, you must use a DHCP server running Windows Server 2008 or Windows Server 2008 R2 because this includes the DHCP Enforcement Service (ES). The DHCP EC is included in the DHCP Client service

  on Windows 7, Windows Vista, Windows Server 2008, Windows Server 2008 R2, and Windows XP SP3.

  The drawback of DHCP NAP enforcement is that you can get around it by configuring a client's IP address statically. Only users with local administrator access can configure a manual IP, but if your organization gives users local administrator

  access, DHCP NAP enforcement may not be the most effective method of keeping these computers off the network until they are compliant.