Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 161:

  Your network consists of a single Active Directory domain. The network contains five Windows Server 2008 R2 servers that host Web Applications. You need to plan a remote management strategy to manage the Web servers. Your plan must meet the following requirements:

  -Allow Web developers to configure features on the Web sites

  -

  Prevent Web developers from having full administrative rights on the Web servers What should you include in your plan?

  A. Configure request filtering on each Web server.
  B. Configure authorization rules for Web developers on each Web server.
  C. Configure the security settings in Internet Explorer for all Web developers by using a Group Policy.
  D. Add the Web developers to the Account Operators group in the domain.
  B. Configure authorization rules for Web developers on each Web server.

  ---

  http://mscerts.programming4.us/windows_server/windows%20server%202008%20%20%20contro lling%20access%20to%20web%20services%20%28part%205%29%20-%20managing%20url%20authorization%20rules.aspx

  Managing URL Authorization Rules

  Authorization is a method by which systems administrators can determine which resources and content are available to specific users Authorization relies on authentication to validate the identity of a user. Once the identity has been proven,

  authorization rules determine which actions a user or computer can perform IIS provides methods of securing different types of content using URL-based authorization. Because Web content is generally requested using a URL that includes a

  full path to the content being requested, you can configure authorization settings easily, using IIS Manager

  Creating URL Authorization Rules

  To enable URL authorization, the UrlAuthorizationModule must be enabled Authorization rules can be configured at the level of the Web server for specific Web sites, for specific Web applications, and for specific files (based on a complete

  URL path). URL authorization rules use inheritance so that lower-level objects inherit authorization settings from their parent objects (unless they are specifically overridden).

  To configure authorization settings, select the appropriate object in the left pane of IIS Manager, and then select Authorization Rules in Features View. Figure 6 shows an example of multiple rules configured for a Web site.

  Figure 6. Viewing authorization rules for a Web site

  

  There are two types of rules: Allow and Deny. You can create new rules by using the Add Allow Rule and Add Deny Rule commands in the Actions pane The available options for both types of rules are the same. (See Figure 7) When creating a new rule, the main setting is to determine to which users the rule applies. The options are:

  

  All Users

  

  All Anonymous Users

  

  Specific Roles Or User Groups

  

  Specific Users

  

  When you choose to specify users or groups to which the rule applies, you can type the appropriate names in a command-separated list. The specific users and groups are defined using NET role providers. This is a standard feature that is available to ASP NET Web developers.

  Developers can create their own roles and user accounts and can define permissions within their applications. Generally, information about users and roles is stored in a relational database or relies on a directory service such as Active Directory.

  In addition to user and role selections, you can further configure an authorization rule based on specific HTTP verbs. For example, if you want to apply a rule only for POST commands (which are typically used to send information from a Web browser to a Web server), add only the POST verb to the rule

  Managing Rule Inheritance As mentioned earlier in this section, authorization rules are inherited automatically by lower-level objects This is useful when your Web site and Web content is organized hierarchically based on intended users or groups The Entry Type column shows whether a rule has been inherited from a higher level or whether it has been defined locally IIS Manager automatically will prevent you from creating duplicate rules. You can remove rules at any level, including both Inherited and Local entry types

• Question 162:

  Your network consists of a single Active Directory domain. Your network contains 10 servers and 500 client computers. All domain controllers run Windows Server 2008 R2.

  A Windows Server 2008 R2 server has Remote Desktop Services installed. All client computers run Windows XP Service Pack 3.

  You plan to deploy a new line of business Application. The Application requires desktop themes to be enabled.

  You need to recommend a deployment strategy that meets the following requirements:

  -

  Only authorized users must be allowed to access the Application.

  -

  Authorized users must be able to access the Application from any client computer.

  -

  Your strategy must minimize changes to the client computers.

  -

  Your strategy must minimize software costs. What should you recommend?

  A. Migrate all client computers to Windows 7. Deploy the Application to all client computers by using a Group Policy object (GPO).
  B. Migrate all client computers to Windows 7. Deploy the Application to the authorized users by using a Group Policy object (GPO).
  C. Deploy the Remote Desktop Connection (RDC) 7.0 software to the client computers. Install the Application on the Remote Desktop Services server. Implement Remote Desktop Connection Broker (RD Connection Broker).
  D. Deploy the Remote Desktop Connection (RDC) 7.0 software to the client computers. Enable the Desktop Experience feature on the Remote Desktop Services server. Install the Application on the Remote Desktop Services server.
  D. Deploy the Remote Desktop Connection (RDC) 7.0 software to the client computers. Enable the Desktop Experience feature on the Remote Desktop Services server. Install the Application on the Remote Desktop Services server.

  ---

  Desktop Experience

  Configuring a Windows Server 2008 server as a terminal server lets you use Remote Desktop Connection 6.0 to connect to a remote computer from your administrator workstation and reproduces on your computer the desktop that exists on the remote computer. When you install Desktop Experience on Windows Server 2008, you can use Windows Vista features such as Windows Media Player, desktop themes, and photo management within the remote connection.

• Question 163:

  You need to recommend a solution to meet the certificate distribution requirements.

  What should you recommend?

  A. Upgrade the Wingtip Toys client computers that run Windows XP to Windows 7.
  B. Create a one-way trust from wingtiptoys.com to tailspintoys.com.
  C. Create a two-way trust between tailspintoys.com and wingtiptoys.com.
  D. Upgrade the Wingtip Toys servers that run Windows Server 2003 to Windows Server 2008 R2.
  E. Create a one-way trust from tailspintoys.com to wingtiptoys.com.
  C. Create a two-way trust between tailspintoys.com and wingtiptoys.com.

  ---

  Trusts

  A trust is a relationship, which you establish between domains, that makes it possible for users in one domain to be authenticated by a domain controller in the other domain.

  All Active Directory trusts between domains within a forest are transitive, two-way trusts.

  Therefore, both domains in a trust relationship are trusted. As shown in the following illustration, this means that if Domain A trusts Domain B and Domain B trusts Domain C, users from Domain C can access resources in Domain A (when

  they are assigned the proper permissions). Only members of the Domain Admins group can manage trust relationships.

  

  Two-way trust

  All domain trusts in an Active Directory forest are two-way, transitive trusts. When a new child domain is created, a two-way, transitive trust is automatically created between the new child domain and the parent domain. In a two-way trust,

  Domain A trusts Domain B and Domain B trusts Domain A. This means that authentication requests can be passed between the two domains in both directions. Some two-way relationships can be either nontransitive or transitive, depending

  on the type of trust that is created.

  The Automatic Enrollment Method

  Auto-enrollment makes it possible for an organization to configure the CA to automatically issue certificates to users and computers. Auto-enrollment can be defined as the process by which certificates can be obtained, updated, and stored

  for users and computers, without administrator and end user intervention.

  The auto-enrollment feature also enables the centralized management of certificates, including:

  Certificate enrollment

  Certificate renewal

  Modifying certificates

  Superseding certificates

• Question 164:

  You need to recommend a solution for managing the shared folders that meets the company's technical requirements.

  What should you include in the recommendation?

  A. Computer Management
  B. File Server Resource Manager (FSRM)
  C. Share and Storage Management
  D. Storage Explorer
  A. Computer Management

  ---

  Windows 2003 doesn't support Share and Storage Management, therefore changed to A again.

  Some of the servers run Windows 2003 if all servers were 2008 then Share And Storage Manager would be used

• Question 165:

  You need to recommend a strategy for using managed service accounts on the Web servers.

  How many managed service accounts should you recommend?

  A. 1
  B. 2
  C. 3
  D. 5
  D. 5

  ---

  There are 5 web servers in total, 3 in the forest root domain and 1 in each child domain. Q 9 in this exam actually confirms the answer is 5 Service Account Vulnerability The practice of configuring services to use domain accounts for

  authentication leads to potential security exposure. The degree of risk exposure is dependent on various factors, including:

  The number of servers that have services that are configured to use service accounts. The vulnerability profile of a network increases for every server that has domain account authenticated services that run on that server. The existence of

  each such server increases the odds that an attacker might compromise that server, which can be used to escalate privileges to other resources on a network.

  The scope of privileges for any given domain account that services use. The larger the scope of privileges that a service account has, the greater the number of resources that can be

  compromised by that account.

  Domain administrator level privileges are a particularly high risk, because the scope of vulnerability for such accounts includes any computer on the network, including the domain

  controllers. Because such accounts have administrative privileges to all member servers, the compromise of such an account would be severe and all computers and data in the domain would be suspect.

  The number of services configured to use domain accounts on any given server. Some services have unique vulnerabilities, which make them somewhat more susceptible to attacks. Attackers will usually attempt to exploit known

  vulnerabilities first. Use of a domain account by a vulnerable service presents an escalated risk to other systems, which could have otherwise been isolated to a single server.

  The number of domain accounts that are used to run services in a domain. Monitoring and managing the security of service accounts requires more diligence than ordinary user accounts, and each additional domain account in use by

  services only complicates administration of those accounts. Given that administrators and security administrators need to know where each service account is used to detect suspicious activity highlights

  The need to minimize the number of those accounts.

  The preceding factors lead to several possible vulnerability scenarios that can exist, each with a different level of potential security risk. The following diagram and table describe these scenarios.

  For these examples it is assumed that the service accounts are domain accounts and each account has at least one service on each server using it for authentication. The following

  information describes the domain accounts shown in the following figure.

  Account A has Administrator-equivalent privileges to more than one domain controller.

  Account B has administrator-equivalent privileges on all member servers.

  Account C has Administrator-equivalent privileges on servers 2 and 3.

  Account D has Administrator-equivalent privileges on servers 4 and 5.

  Account E has Administrator-equivalent privileges on a single member server only.

  

• Question 166:

  You need to recommend a solution to ensure that all of the client computers that run Windows 7 meet the company's security requirements. What should you include in the recommendation?

  A. Encrypted File System (EFS)
  B. the App1ocker Group Policy settings
  C. the IPSec enforcement method
  D. Windows BitLocker Drive Encryption (BitLocker)
  D. Windows BitLocker Drive Encryption (BitLocker)

  ---

  BitLocker Drive Encryption is a full disk encryption feature. It is designed to protect data by providing encryption for entire volumes. By default it uses the AES encryption algorithm in CBC mode with a 128 bit key, combined with the Elephant diffuser for additional disk encryption-specific security not provided by AES.

  The latest version of BitLocker, included in Windows 7 and Windows Server 2008 R2, adds the ability to encrypt removable drives. These can be read, but not written, by Windows XP using Microsoft BitLocker To Go Reader program

• Question 167:

  A company has its main office in New York and branch offices in Miami and Quebec. All sites are connected by reliable WAN links.

  You are designing a Windows Server Update Services (WSUS) deployment strategy. The deployment strategy must meet the following requirements:

  1. Download updates from Windows Update only in the New York office.

  2. Ensure that the update language can be specified for the Quebec office.

  You need to design a deployment strategy that meets the requirements.

  How should you configure the servers and hierarchy types?

  To answer, drag the appropriate server types and hierarchy types from the list to the correct location or locations in the answer area.

  Select and Place:

  

  

  ---

  The most basic WSUS deployment consists of a server inside the corporate firewall that serves client computers on a private intranet, as shown in the "Simple WSUS Deployment" illustration below. The WSUS server connects to Microsoft

  Update to download updates. This is known as synchronization. During synchronization, WSUS determines if any new updates have been made available since the last time you synchronized. If it is your first time synchronizing WSUS, all

  updates are made available for download.

  WSUS server hierarchies.

  You can create complex hierarchies of WSUS servers. Since you can synchronize one WSUS server with another WSUS server instead of with Microsoft Update, you need to have only a single WSUS server that is connected to Microsoft

  Update. When you link WSUS servers together, there is an upstream WSUS server and a downstream WSUS server, as shown in the "WSUS Server Hierarchy" illustration below.

  There are two ways to link WSUS servers together:

  Autonomous mode: An upstream WSUS server shares updates with its downstream server or servers during synchronization, but not update approval status or computer group information. Downstream WSUS servers must be administered

  separately. Autonomous servers can also synchronize updates for a set of languages that is a subset of the set synchronized by their upstream server.

  Replica mode: An upstream WSUS server shares updates, approval status, and computer groups with its downstream server or servers. Downstream replica servers inherit update approvals and cannot be administered apart from their

  upstream WSUS server.

  Centralized management

  Centrally managed WSUS servers utilize replica servers. Replica servers are not administered separately, and are used only to distribute approvals, groups, and updates. The approvals and targeting groups you create on the master server

  are replicated throughout the entire organization, as shown in the "WSUS Centralized Management (Replica Servers)" illustration below. Remember that computer group membership is not distributed throughout the replica group, only the

  computer groups themselves. In other words, you always have to load client computers into computer groups.

  

  It is possible that not all the sites in your organization require the same computer groups. The important thing is to create enough computer groups on the administered server to satisfy the needs of the rest of the organization. Computers at different sites can be moved into a group appropriate for the site. Meanwhile, computer groups inappropriate for a particular site simply remain empty. All update approvals, like computer groups, must be created on the master server.

  For step-by-step instructions, see Create Replica Servers later in this guide. You should also make sure that the upstream server is configured for all the languages required by its replica servers. If you add languages to the upstream server, you should copy the new updates to its replica servers.

  Changing language options on the upstream server alone might result in a mismatch between the number of updates that are approved on the central server and the number of updates approved on the replica servers.

  Distributed management Distributed management offers you full control over approvals and computer groups for the WSUS server, as shown in the "WSUS Distributed Management" illustration below. With the distributed management model, there is usually an administrator at each site who decides which update languages are needed, creates computer groups, assigns computers to groups, tests and approves updates, and ensures that the correct updates are installed on the right computer groups. Distributed management is the default installation option for all WSUS installations.

  

• Question 168:

  You need to recommend a solution for the Web server content that meets the company's technical requirements.

  What should you include in the recommendation?

  A. Distributed File System (DFS) Replication
  B. folder redirection
  C. HTTP redirection
  D. IIS Shared Configuration
  D. IIS Shared Configuration

  ---

  AD is a prerequisite for DFS and we have workgroup in the perimeter network By using Shared Configuration, you can share your IIS configuration across multiple servers.

  Please note that this article is focused on the back end configuration of the web servers and not the front end task of load balancing the servers.

  Shared Configuration allows you to set up Internet Information Services (IIS) quickly and easily on multiple servers so that the sites, application pools and IIS server settings are consistent across two or more servers.

  You only have to configure a server one time and then you can replicate the IIS settings. Shared Configuration is not for individual sites on a server but for the entire IIS configuration on a server.

• Question 169:

  A company has offices in New York and Seattle. Project managers from each office are in the NewYork_PM and Seattle_PM Active Directory security groups, respectively.

  You are planning to store all active IT project resources for the Project Management Office in branch-specific folders in a namespace.

  You need to ensure that project managers from each branch can see only folders from that branch in the namespace.

  Which actions should you perform in sequence?

  To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. (Use only actions that Apply.)

  Select and Place:

  

  

  ---

  DFS Services are available on all currently supported versions of Windows Server, but there are significant improvements in the Windows Server 2008 editions. The DFS namespace client is available for all currently supported versions of Windows, both client and server. Domain-based DFS namespaces require the use of Active Directory.

  DFS Namespaces

  A DFS namespace is basically a place where you will have links to all your file shares. From an administrator point of view, you should think of it as a folder structure where you keep the list of target file shares. Your users will see it as a single share with many folders and they will have no idea that they are navigating across a set of servers to get to the subfolders and files.

  

  When configuring DFS, you have a choice of using a domain-based or a stand-alone namespace.

  If you already have Active Directory deployed, you should consider using a domain-based namespace. If you’re not using Active Directory, your only choice is a stand-alone one.

  The main advantage of the domain-based namespaces is that your configuration will be stored in Active Directory and you won't have to rely on a single server to provide the namespace information to your clients.

  The path users refer to uses the name of the domain and it will not need to change because your namespace server name changed (only if you change your domain name). With a stand-alone DFS, that server name becomes part of the main

  path to the namespace.

  There are also two domain-based DFS modes: Windows Server 2008 mode and Windows Server 2000 mode.

  Windows Server 2008 mode (which requires Windows Server 2003 forest functional level, Windows Server 2008 domain functional level and Windows Server 2008 running on all namespace servers) includes support for more than 5,000

  folders with targets per namespace and access-based enumeration.

  Adding Folders to the Namespace

  After your create the namespace, you will add folders to it, specifying the associated folder target.

  This means pointing to the actual file shares, making each one appear to users as a folder under the namespace. Before you do that, you want to think long and hard about the folder structure you’re creating. A basic goal of DFS is to create a

  stable infrastructure that will not constantly change on your users.

  Multiple Targets

  It's useful to have multiple copies of the same data stored in different file servers. One reason for that is faulttolerance (if one server is unavailable, you can still access the other one). The other reason is to choose the copy of the data that is closer to you. If you’re in a branch office and you want to access a very large file, you would rather get a copy from a server in that branch. It's actually quite simple to add more folder targets to an existing folder or create the folder with multiple targets initially. All you have to do is make sure that you provide the multiple targets for the same folder in that namespace when you configure it.

  DFS Replication

  At this point, you’re probably thinking: How does the data get copied across multiple servers?

  Well, Windows Server includes a component to replicate data between file servers in case you need that. It's called DFS-R (Distributed File System Replication). DFS-R was introduced with Windows Server 2003 R2 (replacing the old NTFRS

  with many advantages). DFS-R can be used for both domain-based and stand-alone DFS.

  To replicate files between two (or more) shares, you need to create a replication group and specify a few things like which servers will replicate (members) and what they will replicate (replicated folders). DFS-R is aware of site topology. It also

  has options to control scheduling and the use of bandwidth (throttling). DFS-R uses Remote Differential Compression (RDC), meaning that only changes in the files are sent over the network, not the entire file.

  

  What does access-based enumeration do?

  Access-based enumeration displays only the files and folders that a user has permissions to access. If a user does not have Read (or equivalent) permissions for a folder, Windows hides the folder from the user's view.

  This feature is active only when viewing files and folders in a shared folder; it is not active when viewing files and folders in the local file system.

  Access-based enumeration can be enabled or disabled by using Share and Storage Management Access-based enumeration can be manually enabled or disabled on individual shared folders and volumes by using Share and Storage

  Management. This snap-in is available after a folder or volume has been shared. You can access Share and Storage Management in the File Services server role in Server Manager, and in Administrative Tools. You can also install it manually

  in Server Manager by adding the File Server role service to File Services.

  There are two ways to enable and disable access-based enumeration by using Share and Storage Management:

  Share a folder or volume by using the Provision a Shared Folder Wizard. If you select the SMB protocol on the Share Protocols page of the Provision a Shared Folder Wizard, the advanced settings options on the SMB Settings page includes

  the option to enable access-based enumeration on the shared folder or volume. (To see the advanced settings options, on the SMB Settings page of the wizard, click Advanced).

  Change the properties of an existing shared folder or volume. To change the properties of an existing shared folder or volume, on the Shares tab of Share and Storage Management, click the shared folder or volume, and then click Properties

  in the Action pane. The information under Advanced settings displays whether accessbased enumeration is enabled. Click Advanced and then select or clear the Enable access-based enumeration check box.

• Question 170:

  You need to recommend a solution that meets the company's Application provisioning requirements.

  What should you recommend?

  A. Create a new MEDV workspace.
  B. Publish a new RemoteApp program.
  C. Create an Application compatibility shim.
  D. Package a new Application by using the AppV Sequencer.
  A. Create a new MEDV workspace.

  ---

  MED-V Benefits The key benefit of MED-V is that it helps enterprises deal with incompatibility between applications and the operating system. For instance, if a user needs to run an early version of Internet Explorer and that version of Internet Explorer is not supported on Windows Vista, the administrator can use MED-V 1.0 to deploy this early version of Internet Explorer to the user as part of a Windows XP virtual image. (And when MED-V 1.0 SP1 becomes available in Q1 of 2010, the user will be able to do the same thing on computers running Windows 7.) The user can then have two copies of Internet Explorer running simultaneously on his desktop--the most recent version (running on the host computer) and the earlier version (running in the MED-V workspace). From the user's perspective, both copies of Internet Explorer appear as if they were running on the local computer.

  MED-V does this by allowing users to run legacy applications within a virtual machine that has an earlier version of Microsoft Windows installed. The user can then access these applications either from a virtual desktop (as with Virtual PC

  2007 running natively on a system) or by using application windows that are seamlessly integrated into the local desktop of the user's computer (similar to RemoteApp in Remote Desktop Services).

  MED-V Usage Scenarios The key usage scenario for MED-V is resolving application-to-operating system Incompatibility to accelerate the upgrade path to a new operating system. Businesses that need to continue to run legacy line-of-business applications on users' desktop computers can do so by using Virtual PC. Incompatibility between legacy applications and newer versions of Microsoft Windows can often be a primary blocking issue preventing an enterprise from upgrading to the latest version of Windows, such as Windows Vista, to take advantage of the many new features and enhancements offered by this version. By delivering those applications in a Virtual PC that runs a previous version of the operating system (for example, Windows XP or Windows 2000), MED-V allows administrators to break the tight dependency between a computer's underlying hardware and the operating system, and it can help remove such blocking issues so that your users can benefit from having the latest version of Windows deployed on their desktop computers. From the user's perspective, with MED-V, these applications are accessible from the Start menu and appear side by side with regular applications--so there is minimal change to the user experience.

  App1 is only xp compatible but needs to be available on win7 clients, it also needs to be centrally managed. So Med-V fits the needed requirements

  Topic 16, Proseware, Inc Scenario

  COMPANY OVERVIEW

  Proseware, Inc. is a publishing company that has a main office and a branch office. The main office is located in New York. The branch office is located in Sydney. The main office has 5,000 users. The branch office has 1,000 users.

  PLANNED CHANGES

  Proseware plans to deploy a new 64-bit Application named App2 to 10 users in the branch office. Only members of the local Administrators group can run App2.

  Proseware is evaluating whether to deploy virtual desktop pools. The virtual desktop pools must meet the following requirements:

  -Apply the settings in GPO1 to the virtual machines (VMs).

  -

  Prevent the VMs from receiving the Automatic Updates settings from GP02,

  -

  Ensure that only the host VM is affected if a virtual hard disk (VHD) file becomes corrupt.

  -Minimize the amount of storage used to support the VMs.

  - Minimize the amount of memory and CPU resources used by the VMs.

  -Minimize administrative effort.

  EXISTING ENVIRONMENT

  All servers run either Windows Server 2008 or Windows Server 2008 R2. All of the client computers in the main office run Windows 7. All of the client computers in the branch office run

  Windows XP (x86) with Service Pack 3 (SP3).

  All of the client computers in the main office are configured as Microsoft Enterprise Desktop Visualization (MED-V) and Microsoft Application Virtualization (App-V) clients.

  A two-node Hyper-V cluster is deployed in the main office. The cluster uses Clustered Shared Volumes.

  Existing Active Directory/Directory Services

  The network contains a single Active Directory domain named proseware.com. The functional level of the forest is Windows Server 2008.

  The relevant organizational units (OUs) for the domain are configured as shown in the following table.

  

  A custom Group Policy object (GPO) named GPO1 is linked to the domain, GPO1 contains corporate computer security settings.

  A custom GPO named GP02 is linked to both office OUs. GP02 contains Windows Server Update Services (WSUS) settings.

  Existing Network Infrastructure

  Each office has servers that have the following server roles or role services installed:

  -WSUS

  -Hyper-V

  -File Services

  -

  Remote Desktop Web Access (RD Web Access)

  -

  Remote Desktop Session Host (RD Session Host)

  -

  Remote Desktop Virtualization Host (RD Virtualization Host)

  -

  Remote Desktop Connection Broker (RD Connection Broker)

  REQUIREMENTS

  Technical Requirements

  When users interactively logs on to any of the client computers in the branch office, they must automatically receive the local administrator rights to that computer. When users logs off, they must lose the administrator rights.

  The disk space on all file servers must be monitored. If any file server has less than 20% free disk space on a volume, a script must run that deletes temporary files.

  Problem Statements

  The main office has a shared folder named Legal. The Legal share is only accessed by users in the legal department. Legal department users report that it takes a long time to locate files in the Legal share by using keyword searches.