Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 171:

  You need to recommend a monitoring solution for the new printer. What should you include in the recommendation?

  A. Data Collector Sets (DCSs)
  B. event subscriptions
  C. object access auditing
  D. Print Management filters
  C. object access auditing

  ---

  http://technet.microsoft.com/en-us/library/cc766468%28WS.10%29.aspx

  Establishing audit policy is an important facet of security. Monitoring the creation or modification of objects gives you a way to track potential security problems, helps to ensure user accountability, and provides evidence in the event of a

  security breach.

  There are nine different kinds of events you can audit. If you audit any of these kinds of events, Windows?records the events in the Security log, which you can find in Event Viewer. Account logon events. Audit this to see each instance of a

  user logging on to or logging off from another computer in which this computer is used to validate the account. Account logon events are generated in the domain controller's Security log when a domain user account is authenticated on a

  domain controller. These events are separate from Logon events, which are generated in the local Security log when a local user is authenticated on a local computer. Account logoff events are not tracked on the domain controller.

  Account management. Audit this to see when someone has changed an account name, enabled or disabled an account, created or deleted an account, changed a password, or changed a user group.

  Directory service access. Audit this to see when someone accesses an Active Directory-directory service object that has its own system access control list (SACL).

  Logon events. Audit this to see when someone has logged on or off your computer (either while physically at your computer or by trying to log on over a network).

  Object access. Audit this to see when someone has used a file, folder, printer, or other object.

  While you can also audit registry keys, we don't recommend that unless you have advanced computer knowledge and know how to use the registry.

  Policy change. Audit this to see attempts to change local security policies and to see if someone has changed user rights assignments, auditing policies, or trust policies.

  Privilege use. Audit this to see when someone performs a user right.

  Process tracking. Audit this to see when events such as program activation or a process exiting occur.

  System events. Audit this to see when someone has shut down or restarted the computer, or when a process or program tries to do something that it does not have permission to do. For example, if malicious software tried to change a setting

  on your computer without your permission, system event auditing would record it.

• Question 172:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2.

  You need to implement a Certificate Services solution that meets the following requirements:

  -Automates the distribution of certificates for internal users

  -

  Ensures that the network's certificate infrastructure is as secure as possible

  -

  Gives external users access to resources that use certificate based authentication

  What should you do?

  A. Deploy an online standalone root certification authority (CA). Deploy an offline standalone root CA.
  B. Deploy an offline enterprise root certification authority (CA). Deploy an offline enterprise subordinate CA.
  C. Deploy an offline standalone root certification authority (CA). Deploy an online enterprise subordinate CA. Deploy an online standalone subordinate CA.
  D. Deploy an online standalone root certification authority (CA). Deploy an online enterprise subordinate CA. Deploy an online standalone subordinate CA.
  C. Deploy an offline standalone root certification authority (CA). Deploy an online enterprise subordinate CA. Deploy an online standalone subordinate CA.

  ---

  Certification authority hierarchies

  The Microsoft public key infrastructure (PKI) supports a hierarchical certification authority (CA) model. A certification hierarchy provides scalability, ease of administration, and consistency with a growing number of commercial and other CA

  products.

  In its simplest form, a certification hierarchy consists of a single CA. However, in general, a hierarchy will contain multiple CAs with clearly defined parent-child relationships. In this model, the child subordinate certification authorities are

  certified by their parent CA-issued certificates, which bind a certification authority's public key to its identity. The CA at the top of a hierarchy is referred to as the root authority, or root CA. The child CAs of the root CAs are called subordinate

  certification authorities (CAs).

  A root certification authority (CA) is the top of a public key infrastructure (PKI) and generates a self-signed certificate. This means that the root CA is validating itself (self-validating). This root CA could then have subordinate CAs that

  effectively trust it. The subordinate CAs receive a certificate signed by the root CA, so the subordinate CAs can issue certificates that are validated by the root CA. This establishes a CA hierarchy and trust path.

  http://social.technet.microsoft.com/wiki/contents/articles/2900.offline-root-certification-authority-ca.aspx

  Certification authority hierarchies

  The Microsoft public key infrastructure (PKI) supports a hierarchical certification authority (CA) model. A certification hierarchy provides scalability, ease of administration, and consistency with a growing number of commercial and other CA

  products.

  In its simplest form, a certification hierarchy consists of a single CA. However, in general, a hierarchy will contain multiple CAs with clearly defined parent-child relationships. In this model, the child subordinate certification authorities are

  certified by their parent CA-issued certificates, which bind a certification authority's public key to its identity. The CA at the top of a hierarchy is referred to as the root authority, or root CA. The child CAs of the root CAs are called subordinate

  certification authorities (CAs).

  Authentication and Authorization

  Stand-alone CAs use local authentication for certificate requests, mainly through the Web enrollment interface.

  Stand-alone CAs provide an ideal service provider or commercial PKI provider platform for issuing certificates to users outside of an Active Directory environment where the user identity is separately verified and examined before the request

  is submitted to the CA.

  Offline and Online CAs

  Traditionally, the decision of whether to use either an online or offline CAs involves a compromise between availability and usability versus security. The more sensitive that the key material is and the higher the security requirements are, the

  less accessible the CA should be to users.

  Specifying CA Roles

  An ideal PKI hierarchy design divides the responsibility of the CAs. A topology that is designed with requirements that have been carefully considered provides the most flexible and scalable enterprise configuration. In general, CAs are

  organized in hierarchies. Single tier hierarchies might not provide adequate security compartmentalization, extensibility and flexibility. Hierarchies with more than three tiers might not provide additional value regarding security, extensibility and

  flexibility.

  The most important consideration is protecting the highest instance of trust as much as possible.

  Single-tier hierarchies are based on the need to compartmentalize risk and reduce the attack surface that is available to users who have malicious intent. A larger hierarchy is much more difficult to administer, with little security benefit.

  Depending on the organization's necessities, a PKI should consist of two or three logical levels that link several CAs in a hierarchy. Administrators who understand the design requirements for a three-level topology may also be able to build a

  two-level topology.

  A three-tier CA hierarchy consists of the following components:

  A root CA that is configured as a stand-alone CA without a network connection

  One or more intermediate CAs that are configured as stand-alone CAs without a network connection

  One or more issuing CAs that are configured as enterprise CAs that are connected to the network

  

  Also worth a look though it refers to windows 2003 http://technet.microsoft.com/en-us/library/cc779714%28WS.10%29.aspx

• Question 173:

  A company has a print server that runs Windows Server 2003 R2 Enterprise (x86). The print server is configured with 2S0 print queues.

  You are planning to migrate the print server to a new server that runs Windows Server 2008 R2 Enterprise. The destination server has the Print and Document Services role installed.

  You need to ensure that printer queues migrate successfully.

  Which actions should you perform in sequence?

  To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order, (use only actions that Apply.)

  Select and Place:

  

  

  ---

  http://technet.microsoft.com/en-us/library/cc722360.aspx Migrating print servers Using the Windows interface Using a command prompt To migrate print servers by using Print Management Open Print Management. In left pane, click Print Servers, right-click the print server that contains the printer queues that you want to export, and then click Export printers to a file. This starts the Printer Migration Wizard.

  On the Select the file location page, specify the location to save the printer settings, and then click Next to save the printers.

  Right-click the destination computer on which you want to import the printers, and then click Import printers from a file. This launches the Printer Migration Wizard.

  On the Select the file location page, specify the location of the printer settings file, and then click Next.

  On the Select import options page, specify the following import options:

  Import mode. Specifies what to do if a specific print queue already exists on the destination computer.

  List in the directory. Specifies whether to publish the imported print queues in the Active Directory Domain Services.

  Convert LPR Ports to Standard Port Monitors. Specifies whether to convert Line Printer Remote (LPR) printer ports in the printer settings file to the faster Standard Port Monitor when importing printers.

  Click Next to import the printers.

  To migrate print servers by using a command prompt Command

  Prompt, and then click Run as administrator.

  Type:

  CD %WINDIR%\System32\Spool\Tools Printbrm -s \\ -b -f

  .printerExport

  Type: Printbrm -s \\ -r -f .printerExport

• Question 174:

  Your network contains a Webbased Application that runs on Windows Server 2003. You plan to migrate the Webbased Application to Windows Server 2008 R2. You need to recommend a server configuration to support the Webbased Application.

  The server configuration must meet the following requirements:

  - Ensure that the Application is available to all users if a single server fails

  -Support the installation of .NET Applications

  -Minimize software costs

  What should you recommend?

  A. Install the Server Core installation of Windows Server 2008 R2 Standard on two servers. Configure the servers in a Network Load Balancing cluster.
  B. Install the full installation of Windows Server 2008 R2 Web on two servers. Configure the servers in a Network Load Balancing cluster.
  C. Install the full installation of Windows Server 2008 R2 Enterprise on two servers. Configure the servers in a failover cluster.
  D. Install the full installation of Windows Server 2008 R2 Datacenter on two servers. Configure the servers in a failover cluster.
  B. Install the full installation of Windows Server 2008 R2 Web on two servers. Configure the servers in a Network Load Balancing cluster.

  ---

  Web Edition meets the requirements

  Windows Web Server 2008 R2

  Windows Web Server 2008 R2 is designed to function specifically as a Web application server.

  Other roles, such as Windows Deployment Server and Active Directory Domain Services (AD DS), are not supported on Windows Web Server 2008 R2. You deploy this server role either on a screened subnet to support a website viewable to

  external hosts or as an intranet server. As appropriate given its stripped-down role, Windows Web Server 2008 R2 does not support the high-powered hardware configurations that other editions of Windows Server 2008 R2 do.

  Windows Web Server 2008 R2 has the following properties:

  Supports a maximum of 32 GB of RAM and 4 sockets in symmetric multiprocessing (SMP) configuration

  You should plan to deploy Windows Web Server 2008 R2 in the Server Core configuration, which minimizes its attack surface, something that is very important on a server that interacts with hosts external to your network environment. You

  should plan to deploy the full version of Windows Web Server 2008 R2 only if your organization's web applications rely on features that are not available in the Server Core version of Windows Web Server 2008 R2. Unlike the Server Core

  version of Windows Web Server 2008, Windows Web Server 2008 R2 supports a greater amount of Internet Information Services (IIS) functionality.

  Configuring Windows Network Load Balancing

  While DNS Round Robin is a simple way of distributing requests, Windows Server 2008 NLB is a much more robust form of providing high availability to applications. Using NLB, an administrator can configure multiple servers to operate as a

  single cluster and control the usage ot the cluster in near real-time.

  Why Failover Cluster will not work.

  Contrast DNS Round Robin and NLB with Failover Clustering, another availability technology in Windows Server 2008. Formerly known as server clustering, Failover Clustering creates a group of computers that all have access lo the same

  data store or disk resource or network share. The applicationsjunning on aJailoverCluster must be cluster-aware. Failover Clustering has had some changes since Windows Server 2003. Lesson 2 will cover these changes.

• Question 175:

  Your network consists of a single Active Directory forest that contains a root domain and two child domains. All servers run Windows Server 2008 R2. A corporate policy has the following requirements:

  -

  All local guest accounts must be renamed and disabled.

  -

  All local administrator accounts must be renamed.

  -

  You need to recommend a solution that meets the requirements of the corporate policy. What should you recommend?

  A. Implement a Group Policy object (GPO) for each domain.
  B. Implement a Group Policy object (GPO) for the root domain.
  C. Deploy Network Policy and Access Services (NPAS) on all domain controllers in each domain
  D. Deploy Active Directory Rights Management Services (AD RMS) on the root domain controllers.
  A. Implement a Group Policy object (GPO) for each domain.

  ---

  http://www.windowsecurity.com/articles/protecting-administrator-account.html http://www.pctips3000.com/enable-or-disable-group-policy-object-in-windows-server-2008/ http://blogs.technet.com/b/chenley/archive/2006/07/13/441642.aspx

  

• Question 176:

  You need to recommend a solution for managing App1. The solution must require the minimum amount of administrative effort.

  What should you include in the recommendation?

  A. Group Policy Administrative Templates
  B. Group Policy Preferences
  C. Group Policy Software Settings
  D. Windows Remote Management (WinRM)
  B. Group Policy Preferences

  ---

  Get total application control with Windows Group Policy Preferences (GPP).

  With GPPs added to Group Policy, you'll find that your level of customized control increases substantially. The graphical interface used in creating a GPP makes the process of managing an application's configuration, mapping a drive, or

  adding a new registry key far easier as well as going far beyond what was possible using traditional Group Policy.

  Note:

  Group Policy preferences, new for the Windows Server 2008 operating system, include more than 20 new Group Policy extensions that expand the range of configurable settings within a Group Policy object (GPO). These new extensions are

  included in the Group Policy Management Editor window of the Group Policy Management Console (GPMC), under the new Preferences item.

  Examples of the new Group Policy preference extensions include folder options, mapped drives, printers, scheduled tasks, services, and Start menu settings.

  Group Policy preferences provide better targeting, through item-level targeting and action modes.

  Additionally, rich user interfaces and standards-based XML configurations provide you with more power and flexibility over managed computers when you administer GPOs.

• Question 177:

  Your company has recently implemented Windows Server Update Services (WSUS). All client computers run Windows 7 Enterprise Edition. Only some users have local administrative privileges.

  You are designing a Group Policy object (GPO) to configure the client computers. The GPO must Apply only the following settings:

  1. Updates must be downloaded from the WSUS server.

  2. Automatically download and install updates every Thursday at 12:00 P.M.

  3. Configure WSUS client-side targeting through Group Policy.

  4. Delay the installation of updates until 20 minutes after a client computer is started, if the client computer was shut down at the specified installation time.

  You need to design the GPO to meet the requirements.

  Which settings should you configure to meet the requirements?

  To answer, select the appropriate settings in the answer area.

  Hot Area:

  

  

  ---

  Configure Automatic Updates

  By enabling this setting you enable your computer to receive updates through Automatic Updates on a computer or computer group. To complete this setting, you must then select one of the following four options:

  Notify before downloading any updates and notify again before installing them.

  Download the updates automatically and notify when they are ready to be installed (default setting)

  Automatically download updates and install them on the schedule specified below

  Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates

  Best preactices http://technet.microsoft.com/en-us/library/cc720525%28v=ws.10%29.aspx

  deployment http://www.windows-noob.com/forums/index.php?/topic/588-how-can-i-configurewsus-todeploy-updates/

• Question 178:

  You need to recommend a disk configuration for the planned SQL Server deployment.

  The solution must ensure that the servers can fail over automatically.

  What should you include in the recommendation?

  A. GPT disks and basic disks
  B. GPT disks and dynamic disks
  C. MBR disks and basic disks
  D. MBR disks and dynamic disks
  A. GPT disks and basic disks

  ---

  Tnx SoK for the edditional material

  Server 2008 introduces support for GPT disks in cluster storage

  http://technet.microsoft.com/en-us/library/cc770625%28v=ws.10%29.aspx

  n Windows Server?2008 Enterprise and Windows Server?2008 Datacenter, the improvements to failover clusters (formerly known as server clusters) are aimed at simplifying clusters, making them more secure, and enhancing cluster

  stability. Cluster setup and management are easier.

  Security and networking in clusters have been improved, as has the way a failover cluster communicates with storage

  What new functionality does failover clustering provide?

  New validation feature. With this feature, you can check that your system, storage, and network configuration is suitable for a cluster.

  Support for GUID partition table (GPT) disks in cluster storage. GPT disks can have partitions larger than two terabytes and have built-in redundancy in the way partition information is stored, unlike master boot record (MBR) disks.

  http://technet.microsoft.com/en-us/library/cc770625%28WS.10%29.aspx

  Support for GPT disks in cluster storage

  GUID partition table (GPT) disks are supported in failover cluster storage. GPT disks provide increased disk size and robustness. Specifically, GPT disks can have partitions larger than two terabytes and have built-in redundancy in the way

  partition information is stored, unlike master boot record (MBR) disks. With failover clusters, you can use either type of disk.

  Why Basic disks over Dynamic?

  Only Basic discs can be used in a failover cluster

  http://technet.microsoft.com/en-us/library/cc733046.aspx

• Question 179:

  You need to recommend a solution for managing the service accounts for SQL1 and SQL2. The solution must meet the company's security requirements. What should you include in the recommendation?

  A. a custom password filter
  B. a Password Settings object (PSO)
  C. managed service accounts
  D. manual password changes
  D. manual password changes

  ---

  req - passwords to change every 60 days.

  Service account passwords are set to never expire so can not meet the above requirement, so manual intervention is required.

• Question 180:

  Your company has two branch offices that connect by using a WAN link. Each office contains a server that runs Windows Server 2008 R2 and that functions as a file server.

  Users in each office store data on the local file server. Users have access to data from the other office.

  You need to plan a data access solution that meets the following requirements:

  - Folders that are stored on the file servers must be available to users in both offices.

  -Network bandwidth usage between offices must be minimized.

  - Users must be able to access all files in the event that a WAN link fails.

  What should you include in your plan?

  A. On both servers, implement DFS Replication.
  B. On both servers, install and configure File Server Resource Manager (FSRM) and File Replication Service (FRS).
  C. On one server, install and configure File Server Resource Manager (FSRM). On the other server, install and configure File Replication Service (FRS).
  D. On one server, install and configure Distributed File System (DFS). On the other server, install and configure the Background Intelligent Transfer Service (BITS).
  A. On both servers, implement DFS Replication.

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration:

  DFS Replication provides a multimaster replication engine that lets you synchronize folders on multiple servers across local or WAN connections. It uses the Remote Differential Compression (RDC) protocol to update only those files that

  have changed since the last replication. You can use DFS Replication in conjunction with DFS Namespaces or by itself.

  File Replication Service (FRS) The File Replication Service (FRS) enables you to synchronize folders with file servers that use FRS. Where possible you should use the DFS Replication (DFSR) service. You should install FRS only if your

  Windows Server 2008 server needs to synchronize folders with servers that use FRS with the Windows Server 2003 or Windows 2000 Server implementations of DFS.

  The main tool for implementing shared folder replication in a Windows Server 2008 network is DFS Replication.

  Using DFS Namespace to Plan and Implement a Shared Folder Structure and Enhance Data Availability

  When you add the DFS Management role service to the Windows Server 2008 File Services Server role, the DFS Management console is available from the Administrative Tools menu or from within Server Manager. This console provides

  the DFS Namespaces and DFS Replication tools as shown in Figure 6-31 DFS Namespaces lets you group shared folders that are located on different servers into one or more logically structured namespaces. Each namespace appears to

  users as a single shared folder with a series of subfolders.

  This structure increases availability. You can use the efficient, multiple-master replication engine provided by DFSR to replicate a DFS Namespace within a site and across WAN links. A user connecting to files within the shared folder

  structures contained in the DFS Namespace will automatically connect to shared folders in the same AD DS site (when available) rather than across a WAN. You can have several DFS Namespace servers in a site and spread over several

  sites, so if one server goes down, a user can still access files within the shared folder structure.

  Because DFSR is multimaster, a change to a file in the DFS Namespace on any DFS Namespace server is quickly and efficiently replicated to all other DFS Namespace servers that hold that namespace. Note that DFSR replaces the File

  Replication Service (FRS) as the replication engine for DFS Namespaces, as well as for replicating the AD DS SYSVOL folder in domains that use the Windows Server 2008 domain functional level. You can install FRS Replication as part of

  the Windows Server 2003 File Services role service, but you should use it only if you need to synchronize with servers that use FRS with the Windows Server 2003 or Windows 2000 Server implementations of DFS.