Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 131:

  A company has file servers that run a Server Core installation of Windows Server 2008.

  You are designing the migration of the file servers to Windows Server 2008 R2. After the migration, you will install the Remote Desktop Services server role on the file servers.

  You need to ensure that shared resources on the file servers are available after the migration, and minimize administrative effort.

  What should you recommend? (More than one answer choice may achieve the goal. Select the BEST answer.)

  A. Move the shared resources off of the existing file servers. Perform a clean installation of Windows Server 2008 R2 on the file servers. Move the shared resources back onto the file servers.
  B. Upgrade the existing file servers to a Server Core installation of Windows Server 2008 R2, and then upgrade the file servers to a full installation of Windows Server 2008 R2.
  C. Deploy new file servers with Windows Server 2008 R2 installed. Migrate the shared resources to the new file servers.
  D. Deploy new file servers with a Server Core installation of Windows Server 2008 R2. Migrate the shared resources to the new file servers.
  C. Deploy new file servers with Windows Server 2008 R2 installed. Migrate the shared resources to the new file servers.

  ---

  The key here is minimize effort and Remote Desktop Services.

  Server Core wouldn't allow remote desktop services as it has no GUI so that would rule out answer A you also cant upgrade from Core to Full see http://www.windowsitpro.com/article/tips/can-i-upgrade-fromserver-core-2008-to-the-fullwindows-server-2008- or http://serverfault.com/questions/92523/upgrade-fromwindows-2008-server-core-to-full-windows-2008-server upgrade considerations for Server Core installations of Windows Server 2008

  You can use the Server Core installation option only by performing a clean installation.

  You cannot upgrade from earlier versions of Windows to Server Core installations of Windows Server 2008.

  You cannot upgrade from non-Server Core installations of Windows Server 2008 to Server Core installations of Windows Server 2008.

  You cannot convert Server Core installations of Windows Server 2008 to non-Server Core installations of Windows Server 2008.

  You can upgrade Server Core installations of Windows Server 2008 only to Windows Server Core R2 when it is released.

  Answer C is possible but again you're asked to minimize effort so D would be 1 step less thus reducing your effort and possible down time.

• Question 132:

  You need to recommend a security strategy for WebApp2 that meets the company's application requirements. What should you include in the recommendation?

  A. Basic authentication and connection security rules
  B. Basic authentication and SSL
  C. Digest authentication and connection security rules
  D. Digest authentication and SSL
  B. Basic authentication and SSL

  ---

  You must support multiple browsers and one advantage of the basic access authentication is all web browsers support it. But due to the fact that the username and password are passed in cleartext, it is rarely used by itself on publicly accessible Internet web sites. However, it is somewhat commonly found on publicly accessible sites if combined with SSL/TLS (HTTPS). The use of SSL/TLS to encrypt the entire connection mitigates the fact that the Basic passwords themselves are not encrypted. Most browsers will actually display an alert of some kind if a site uses Basic Auth without SSL/TLS, but will not display an alert when Basic Auth is used on a connection that has SSL/TLS enabled.

  Topic 9, Graphic Design Institute, Case A Scenario COMPANY OVERVIEW Graphic Design Institute is a training company that has a main office and 10 branch offices. The main office is located in Bangalore. PLANNED CHANGES Graphic Design Institute plans to implement the following changes:

  -

  Deploy a new two-node failover cluster that runs the Hyper-V server role on each node.

  -

  Ensure that intra-cluster network traffic is isolated from all other network traffic.

  -

  Implement Network Access Protection (NAP) for all of the client computers on the internal network and for all of the client computers that connect remotely.

  EXISTING ENVIRONMENT

  The relevant servers in the main office are configured as shown in the following table.

  

  The server has the following configurations:

  -NPAS1 contains a static IP address pool,

  -Web1, Web2, and Web3host a copy of the corporate Web site.

  - Web1, Web2, and Web3 are located in the perimeter network and belong to a workgroup.

  All client computers run Windows XP Professional, Windows Vista Enterprise, or Windows 7 Enterprise, All client computers are members of the domain.

  Some users work remotely. To access the company's internal resources, the remote users use a VPN connection to NPAS1.

  Existing Active Directors/Directory Services

  The network contains a single-domain Active Directory forest named graphicdesigninstitute.com.

  The Active Directory Recycle Bin is enabled.

  Existing Network Infrastructure

  Graphic Design Institute has an internal network and a perimeter network.

  The network contains network switches and wireless access points (WAPs) from multiple vendors.

  Some of the network devices are more than 10 years old and do not support port-based authentication.

  TECHNICAL REQUIREMENTS

  All of the accounts used for administration must be assigned the minimum amount of permissions.

  Web1, Web2, and Web3 must have the identical configurations for the corporate Web site. The Web servers must contain a local copy of all the Web pages in the Web site. When a Web page is modified on any of the Web servers, the

  modifications must be copied automatically to all of the Web servers.

  A user named Admin1 must be responsible for performing the following tasks:

  -Restarting all of the Web servers.

  -

  Backing up and restoring the files on all of the Web servers.

  A user named Admin2 must be responsible for performing the following tasks:

  -

  Backing up the Active Directory database.

  - Recovering deleted objects from the Active Directory Recycle Bin.

• Question 133:

  You need to recommend a solution to decrease the amount of time it takes for the sales managers

  to generate reports. What should you include in the recommendation?

  A. Implement Windows System Resource Manager (WSRM) on the Remote Desktop servers.
  B. Implement File Server Resource Manager (FSRM) on the Remote Desktop servers.
  C. Implement Windows System Resource Manager (WSRM) on the web servers.
  D. Implement File Server Resource Manager (FSRM) on the web servers.
  A. Implement Windows System Resource Manager (WSRM) on the Remote Desktop servers.

  ---

  Dedulas: http://technet.microsoft.com/en-us/library/cc754150

  You can use Windows System Resource Manager to allocate processor and memory resources to applications, users, Remote Desktop Services sessions, and Internet Information Services (IIS) application pools So based upon the information given in the exhibits: the reports are CPU INTENSIVE and when there are a lot of users connected the report take longer to process.you need to reduce the time it takes for reports to be generated a bottle neck on the CPU would increase the time it takes to generate reports so the required solution would need to allocate additional CPU resources to the sales managers or else limit the CPU resources used by the regular users.

• Question 134:

  You need to recommend a VHD configuration for the virtual desktop pool VMs. What should you include in the recommendation?

  A. differencing VHDs
  B. dynamically expanding VHDs
  C. fixed-size VHDs
  D. passthrough disks
  B. dynamically expanding VHDs

  ---

  http://technet.microsoft.com/en-us/library/dd440865%28WS.10%29.aspx#dynamic

  When is it appropriate to use dynamically expanding VHDs?

  Dynamically expanding VHDs are useful in nonproduction environments where flexible storage requirements and frequently changing the VHD image is more of an advantage than the reliability of the data within the VHD. In addition,

  dynamically expanding VHDs are best for testing environments because there is less impact if you have to rebuild the VHD. For example, a test environment can use multiple dynamically expanding VHDs, each with a different Windows

  image and set of applications to test. If the VHD files are modified during testing or accidentally become corrupt, you can replace the VHDs from a safe copy and restart testing.

  Using dynamically expanding VHDs in a test environment provides the following benefits:

  Flexible use of disk space. You can use free space for the VHD to expand during native VHD boot.

  This space would have been unavailable if the volume hosted multiple VHDs in a fixed format.

  Faster transfer time when copying VHDs between locations. The file size for a dynamically expanding VHD that is not using its maximum capacity, will transfer in less time between a

  network share and a local disk than a fixed VHD of equivalent maximum size. Although rare, you may consider using dynamically expanding VHDs in production environments if

  1) all of the content of the dynamically expanding VHD can be regenerated from other sources and ritical data is stored on volumes outside the dynamically expanding VHD.

• Question 135:

  You need to recommend changes to the environment that meet the company's user requirements. What should you include in the recommendation?

  A. failover clustering
  B. Network Load Balancing (NLB)
  C. Distributed File System (DFS) Replication
  D. a BranchCache in Hosted Cache mode
  C. Distributed File System (DFS) Replication

  ---

  http://technet.microsoft.com/en-us/library/cc753479%28WS.10%29.aspx

  Distributed File System (DFS) Namespaces and DFS Replication offer simplified, highly-available access to files, load sharing, and WAN-friendly replication. In the Windows Server?2003 R2 operating system, Microsoft revised and renamed

  DFS Namespaces (formerly called DFS), replaced the Distributed File System snap-in with the DFS Management snap-in, and introduced the new DFS Replication feature. In the Windows Server?2008 operating system, Microsoft added the

  Windows Server 2008 mode of domain-based namespaces and added a number of usability and performance improvements.

  What does Distributed File System (DFS) do?

  The Distributed File System (DFS) technologies offer wide area network (WAN)-friendly replication as well as simplified, highly-available access to geographically dispersed files. The two technologies in DFS are the following:

  DFS Namespaces. Enables you to group shared folders that are located on different servers into one or more logically structured namespaces. Each namespace appears to users as a single shared folder with a series of subfolders. This

  structure increases availability and automatically connects users to shared folders in the same Active Directory Domain Services site, when available, instead of routing them over WAN connections.

  DFS Replication. DFS Replication is an efficient, multiple-master replication engine that you can use to keep folders synchronized between servers across limited bandwidth network connections.

  It replaces the File Replication Service (FRS) as the replication engine for DFS Namespaces, as well as for replicating the AD DS SYSVOL folder in domains that use the Windows Server 2008 domain functional level.

• Question 136:

  You need to recommend changes to the infrastructure to ensure that DFS meets the company's security requirements. What should you include in the recommendation?

  A. Upgrade DFS2 to Windows Server 2008 R2.
  B. Implement accessbased enumeration (ABE).
  C. Implement Authentication Mechanism Assurance.
  D. Configure the DFS namespace to use Windows Server 2008 mode.
  A. Upgrade DFS2 to Windows Server 2008 R2.

  ---

  Users must only be able to modify the financial forecast reports on DFSl. DFS2 must contain a read-only copy of the financial forecast reports. Both servers are part of the same replication group and it is in Windows 2000 server mode http://blogs.technet.com/b/filecab/archive/2009/04/01/configuring-a-read-only-replicated-folder.aspx Please read the following notes carefully before deploying the read-only replicated folders feature. a) Feature applicability: The read-only replicated folders feature is available only on replication member servers which are running Windows Server 2008 R2. In other words, it is not possible to configure a replicated folder to be read-only on a

  member server running either Windows Server 2003 R2 or Windows Server 2008.

  b) Backwards compatibility: Only the server hosting read-only replicated folders needs to be running Windows Server 2008 R2. The member server that hosts a read-only replicated folder can replicate with partners that are on Windows Server 2003 or Windows Server 2008. However, to configure and administer a replication group that has a read-only replicated folder, you need to use the DFS Management MMC snap-in on Windows Server 2008 R2. c) Administration of read-only replicated folders: In order to configure a replicated folder as read-only replicated folder, you need to use the DFS Management MMC snap-in on Windows Server 2008 R2. Older versions of the snap-in (available

  on Windows Server 2003 R2 or Windows Server 2008) cannot configure or manage a read-only replicated folder. In other words, these snap-ins will not display the option to mark a replicated folder 'read-only'.

  d) Schema updates: If you have an older version of the schema (pre-Windows Server 2008), you will need to update your Active Directory schema to include the DFS Replication schema extensions for Windows Server 2008.

  http://blogs.technet.com/b/filecab/archive/2009/01/21/read-only-replicated-folders-on-windows-server-2008-r2.aspx

  Why deploy read-only replicated folders?

  Consider the following scenario. Contoso Corporation has a replication infrastructure similar to that depicted in the diagram below. Reports are published to the datacenter server and these need to be distributed to Contoso's branch offices.

  DFS Replication is configured to replicate a folder containing these published reports between the datacenter server and branch office servers.

  The DFS Replication service is a multi-master file replication engine ?meaning that changes can be made to replicated data on any of the servers taking part in replication. The service then ensures that these changes are replicated out to all

  other members in that replication group and that conflicts are resolved using `last-writerwins' semantics.

  

  Now, a Contoso employee working in a branch office accidentally deletes the `Specs' sub-folder from the replicated folder stored on that branch office's file server. This accidental deletion is replicated by the DFS Replication service, first to the datacenter server and then via that server to the other branch offices. Soon, the `Specs' folder gets deleted on all of the servers participating in replication. Contoso's file server administrator now needs to restore the folder from a previously taken backup and ensure that the restored contents of the folder once again replicate to all branch office file servers.

  Administrators need to monitor their replication infrastructure very closely in order to prevent such situations from arising or to recover lost data if needed. Strict ACLs are a way of preventing these accidental modifications from happening, but managing ACLs across many branch office servers and for large amounts of replicated data quickly degenerates into an administrative nightmare. In case of accidental deletions, administrators need to scramble to recover data from backups (often up-to-date backups are unavailable) and in the meantime, end-users face outages leading to loss of productivity.

  

  This situation can be prevented by configuring read-only replicated folders on branch office file servers. A readonly replicated folder ensures that no local modifications can take place and the replica is kept in sync with a read-write enabled

  copy by the DFS Replication service. Therefore, read-only replicated folders enable easyto-deploy and low-administrative-overhead data publication solutions especially for branch office scenarios.

  How does all this work?

  For a read-only replicated folder, the DFS Replication service intercepts and inspects every file system operation. This is done by virtue of a file system filter driver that layers above every replicated folder that is configured to be read-only.

  Volumes that do not host read-only replicated folders or volumes hosting only readwrite replicated folders are ignored by the filter driver.

  Only modifications initiated by the service itself are allowed ?these modifications are typically caused by the service installing updates from its replication partners. This ensures that the read-only replicated folder is maintained in sync with a

  read-write enabled replicated folder on another replication partner (presumably located at the datacenter server).

  All other modification attempts are blocked ?this ensures that the contents of the read-only replicated folder cannot be modified locally. As shown in the below figure, end-users are unable to modify the contents of the replicated folder on

  servers where it has been configured to be read-only. The behavior is similar to that of a read-only SMB share ?contents can be read and attributes can be queried for all files, however, modifications are not possible.

• Question 137:

  You need to recommend a solution to minimize the amount of time it takes for users in the Boston office to log on to their client computers. What should you include in the recommendation?

  A. access based enumeration (ABE)
  B. folder redirection
  C. the Active Directory site link cost
  D. universal group membership caching
  B. folder redirection

  ---

  http://technet.microsoft.com/en-us/library/cc732275.aspx

  Folder Redirection User settings and user files are typically stored in the local user profile, under the Users folder. The files in local user profiles can be accessed only from the current computer, which makes it difficult for users who use more than one computer to work with their data and synchronize settings between multiple computers. Two technologies exist to address this problem:

  Roaming Profiles and Folder Redirection. Both technologies have their advantages, and they can be used separately or together to create a seamless user experience from one computer to another. They also provide additional options for administrators managing user data.

  When a user logs in their profile is loaded as part of the login process. the My Documents folder is part of the user profiel, by redirecting this folder to a file server it means that it does not needed to be loaded at login thus reducing the login time. while having the added benifit of enabling the company to back up these files.

• Question 138:

  You need to recommend changes to the file server on the main campus that meet the company's technical requirements.

  What should you include in the recommendation?

  A. Encrypting File System (EFS)
  B. NTFS permissions
  C. Syskey
  D. Windows BitLocker Drive Encryption (BitLocker)
  D. Windows BitLocker Drive Encryption (BitLocker)

  ---

  http://technet.microsoft.com/en-us/library/cc731549%28WS.10%29.aspx

  BitLocker Drive Encryption allows you to encrypt all data stored on the Windows operating system volume and configured data volumes, and by using a Trusted Platform Module (TPM), it can also help ensure the integrity of early startup components. BitLocker was first introduced with Windows Vista and Windows Server 2008 and subsequently updated with the release of Windows 7 and Windows Server 2008 R2.

• Question 139:

  You need to recommend a NAP enforcement method that meets the company's security requirements. Which method should you recommend?

  A. 802.1X
  B. DHCP
  C. IPSec
  D. VPN
  A. 802.1X

  ---

  Offices are both wired and wireless

  Network Access Protection

  You deploy Network Access Protection on your network as a method of ensuring that computers accessing important resources meet certain client health benchmarks. These benchmarks include (but are not limited to) having the most recent

  updates applied, having antivirus and anti-spyware software up to date, and having important security technologies such as Windows Firewall configured and functional. In this lesson, you will learn how to plan and deploy an appropriate

  network access protection infrastructure and enforcement method for your organization.

  802.1X NAP Enforcement

  802.1X enforcement makes use of authenticating Ethernet switches or IEEE 802.11 Wireless Access Points.

  These compliant switches and access points only grant unlimited network access to computers that meet the compliance requirement. Computers that do not meet the compliance requirement are limited in their communication by a restricted

  access profile. Restricted access profiles work by applying IP packet filters or VLAN (Virtual Local Area Network) identifiers. This means that hosts that have the restricted access profile are allowed only limited network communication. This

  limited network communication generally allows access to remediation servers. You will learn more about remediation servers later in this lesson.

  An advantage of 802.1X enforcement is that the health status of clients is constantly assessed.

  Connected clients that become noncompliant will automatically be placed under the restricted access profile. Clients under the restricted access profile that become compliant will have that profile removed and will be able to communicate with

  other hosts on the network in an unrestricted manner. For example, suppose that a new antivirus update comes out. Clients that have not installed the update are put under a restricted access profile until the new update is installed.

  Once the new update is installed, the clients are returned to full network access.

  A Windows Server 2008 computer with the Network Policy Server role is necessary to support 802.1X NAP enforcement. It is also necessary to have switch and/or wireless access point hardware that is 801.1xcompliant.

  Client computers must be running Windows Vista, Windows Server 2008, or Windows XP Service Pack 3 because these operating systems include the EAPHost EC.

  MORE INFO 802.1X enforcement step-by-step For more detailed information on implementing 802.1X NAP enforcement, consult the following Step-by-Step guide on TechNet: http://go.microsoft.com/fwlink/?LinkId=86036.

• Question 140:

  You need to recommend a management solution for Server1 that meets the company's security requirements. What should you include in the recommendation?

  A. accessbased enumeration (ABE)
  B. Authentication Mechanism Assurance
  C. Authorization Manager
  D. HyperV Manager
  C. Authorization Manager

  ---

  http://technet.microsoft.com/en-us/library/cc732290%28WS.10%29.aspx What does Authorization Manager do? Authorization Manager is a role-based security architecture for Windows that can be used in any application that needs role-based authorization, including ASP.NET Web applications, ASP.NET Web services, and client/server systems based

  on .NET Remoting. The role-based management model enables you to assign users to roles and gives you a central place to record permissions assigned to each role. This model is often called rolebased access control.