Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 181:

  You need to recommend a solution to ensure that users in the London office can access the graphics files in the main office. The solution must meet the company's business goals. What should you recommend?

  A. Configure the client computers to use BranchCache in Distributed Cache mode.
  B. Deploy a standalone Distributed File System (DFS) namespace. Configure a DFS Replication group.
  C. Deploy a domainbased Distributed File System (DFS) namespace. Configure a DFS Replication group.
  D. Deploy a BranchCache server that operates in Hosted Cache mode. Configure the client computers to use the BranchCache server.
  C. Deploy a domainbased Distributed File System (DFS) namespace. Configure a DFS Replication group.

  ---

  BranchCach is a Server 2008 R2 feature

  http://technet.microsoft.com/en-us/library/cc731545.aspx

  Review Requirements for DFS Replication

  Applies To: Windows Server 2008 R2

  Before you can deploy DFS Replication, you must configure your servers as follows:

  Extend (or update) the Active Directory Domain Services (AD DS) schema to include Windows Server 2003 R2, Windows Server 2008, or Windows Server 2008 R2 schema additions. To use read-only replicated folders, the schema must

  include the Windows Server 2008 or newer schema additions. For information about extending the AD DS schema, see the Microsoft Web site at (http://go.microsoft.com/fwlink/?LinkId=93051).

  Ensure that all servers in a replication group are located in the same forest. You cannot enable

  replication across servers in different forests.

  Verify that all members of the replication group are running Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003 R2. DFS Replication is supported on all x64 editions of Windows Server 2008 R2 and all x64 and x86

  editions of Windows Server 2008. DFS Replication is not available for Itanium-Based Systems.

  Install DFS Replication on all servers that will act as members of a replication group.

  Install the DFS Management snap-in on a server to manage replication. This server cannot run a Server Core installation of the Windows Server 2008 operating system.

  Contact your antivirus software vendor to check that your antivirus software is compatible with DFS Replication.

  Store replicated folders on NTFS volumes.

  To include a failover cluster in a replication group, the failover cluster must be running Windows Server 2008 R2. Install and configure the failover cluster feature and then use the High Availability Wizard to create a clustered File Server

  instance before adding the instance as a replication group member. For more information, see Add a Failover Cluster to a Replication Group.

  On a server that is running a version of Windows older than Windows Server 2008 R2, locate replicated folders for failover clusters in the local storage of a node. Versions of the DFS

  Replication service older than Windows Server 2008 R2 are not designed to coordinate with cluster components, and the service will not fail over to another node.

• Question 182:

  You need to recommend a solution that enables User1 to perform the required actions on the HyperV server. What should you include in the recommendation?

  A. Active Directory delegation
  B. Authorization Manager role assignment
  C. local security groups on the Hyper-V server
  D. local security groups on the VMs
  B. Authorization Manager role assignment

  ---

  http://technet.microsoft.com/en-us/library/dd283030%28v=ws.10%29.aspx

  You use Authorization Manager to provide role-based access control for Hyper-V. For instructions on implementing role-based access control.

  Authorization Manager is comprised of the following:

  Authorization Manager snap-in (AzMan.msc). You can use the Microsoft Management Console (MMC) snapin to select operations, group them into tasks, and then authorize roles to perform specific tasks. You also use it to manage tasks,

  operations, user roles, and permissions. To use the snap-in, you must first create an authorization store or open an existing store. For more information, see http://go.microsoft.com/fwlink/-LinkId=134086.

  Authorization Manager API. The API provides a simplified development model in which to manage flexible groups and business rules and store authorization policies. For more information, see Role-based Access Control (http://

  go.microsoft.com/fwlink/?LinkId=134079).

  Authorization Manager requires a data store for the policy that correlates roles, users, and access rights. This is called an authorization store. In Hyper-V, this data store can be maintained in an Active Directory database or in an XML file on

  the local server running the Hyper-V role. You can edit the store through the Authorization Manager snap-in or through the Authorization Manager API, which are available to scripting languages such as VBScript.

  If an Active Directory database is used for the authorization store, Active Directory Domain Services (AD DS) must be at the Windows Server 2003 functional level.

  The XML store does not support delegation of applications, stores, or scopes because access to the XML file is controlled by the discretionary access control list (DACL) on the file, which grants or restricts access to the entire contents of the

  file. (For more information about Authorization Manager delegation, see http://go.microsoft.com/fwlink/?LinkId=134075). Because of this, if an XML file is used for the authorization store, it is important that it is backed up regularly. The NTFS

  file system does not support applications issuing a sequence of separate write operations as a single logical write to a file when multiple applications write to the same file.

  This means an Authorization Manager policy file (XML file) could be edited simultaneously by two administrative applications and could become corrupted. The Hyper-V VSS writer will back up the authorization store with the server running

  the Hyper-V role.

  http://technet.microsoft.com/en-us/library/cc725995%28WS.10%29.aspx A role assignment is a virtual container for application groups whose members are authorized for the role. A role assignment is based on a single role definition, and a single role definition can be the basis of many role assignments. The most common procedure that administrators carry out is the assignment of application groups, or Windows users and groups, to a role. For step-by-step instructions, see Assign a Windows User or Group to a Role or Assign an

  Application Group to a Role.

• Question 183:

  Your company has a main office and three branch offices. The network consists of a single Active Directory domain. Each office contains an Active Directory domain controller. You need to create a DNS infrastructure for the network that meets the following requirements:

  -

  The DNS infrastructure must allow the client computers in each office to register DNS names within their respective offices.

  -

  The client computers must be able to resolve names for hosts in all offices. What should you do?

  A. Create an Active Directory-integrated zone at the main office site.
  B. Create a standard primary zone at the main office site and at each branch office site.
  C. Create a standard primary zone at the main office site. Create a secondary zone at each branch office site.
  D. Create a standard primary zone at the main office site. Create an Active Directory-integrated stub zone at each branch office site.
  A. Create an Active Directory-integrated zone at the main office site.

  ---

  http://searchwindowsserver.techtarget.com/tip/DNS-Primer-Tips-for-understanding-Active-Directory-integratedzone-design-and-configuration http://technet.microsoft.com/en-us/library/cc772101.aspx

  In an ADI primary zone, rather than keeping the old zone file on a disk, the DNS records are stored in the AD, and Active Directory replication is used rather than the old problematic zone transfer. If all DNS servers were to die or become inaccessible, you could simply install DNS on any domain controller (DC) in the domain. The records would be automatically populated and your DNS server would be up without the messy import/export tasks of standard DNS zone files.

  Windows 2000 and 2003 allow you to put a standard secondary zone (read only) on a member server and use one of the ADI primary servers as the master.

  

  When you decide which replication scope to choose, consider that the broader the replication scope, the greater the network traffic caused by replication. For example, if you decide to have AD DS-integrated DNS zone data replicated to all

  DNS servers in the forest, this will produce greater network traffic than replicating the DNS zone data to all DNS servers in a single AD DS domain in that forest.

  AD DS-integrated DNS zone data that is stored in an application directory partition is not replicated to the global catalog for the forest. The domain controller that contains the global

  catalog can also host application directory partitions, but it will not replicate this data to its global catalog.

  AD DS-integrated DNS zone data that is stored in a domain partition is replicated to all domain controllers in its AD DS domain, and a portion of this data is stored in the global catalog. This setting is used to support Windows 2000.

  If an application directory partition's replication scope replicates across AD DS sites, replication will occur with the same intersite replication schedule as is used for domain partition data.

  By default, the Net Logon service registers domain controller locator (Locator) DNS resource records for the application directory partitions that are hosted on a domain controller in the same manner as it registers domain controller locator

  (Locator) DNS resource records for the domain partition that is hosted on a domain controller.

• Question 184:

  You plan to deploy a distributed database Application that runs on multiple Windows Server 2008 R2 servers.

  You need to design a storage strategy that meets the following requirements:

  -Allocates storage to servers as required

  -Uses the existing network infrastructure

  -Uses standard Windows management tools

  -Ensures that data is available if a single disk fails

  What should you include in your design?

  A. An iSCSI disk storage subsystem that supports Microsoft Multipath I/O. Configure the storage subsystem as a RAID?0 array.
  B. An iSCSI disk storage subsystem that supports Virtual Disk Service (VDS). Configure the storage subsystem as a RAID?5 array.
  C. A Fibre Channel (FC) disk storage subsystem that supports Microsoft Multipath I/O. Configure the storage subsystem as a RAID?0 array.
  D. A Fibre Channel (FC) disk storage subsystem that supports the Virtual Disk Service (VDS). Configure the storage subsystem as a RAID?5 array.
  B. An iSCSI disk storage subsystem that supports Virtual Disk Service (VDS). Configure the storage subsystem as a RAID?5 array.

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration:

  Virtual Disk Service (VDS)

  Virtual Disk Service (VDS) provides a standard set of application programming interfaces (APIs) that provide a single interface through which disks can be managed. VDS provides a complete solution for managing storage hardware and

  disks and enables you to create volumes on those disks. This means that you can use a single tool to manage devices in a mixed storage environment rather than tools provided by different hardware vendors. Before you can manage a LUN

  using Storage Manager For SANs, you must install its VDS hardware provider. This will usually be provided by the hardware vendor. Prior to purchasing a storage device to be used on your organization's SAN, you should verify that a

  compatible VDS hardware provider exists.

  VDS defines a software and a hardware provider interface. Each of these providers implements a different portion of the VDS API. The software provider is a program that runs on the host and is supported by a kernelmode driver. Software

  providers operate on volumes, disks, and partitions.

  The hardware provider manages the actual storage subsystem. Hardware providers are usually disk array or adapter cards that enable the creation of logical disks for each LUN type. The LUN type that can be configured will depend on the

  options allowed by the VDS hardware provider. For example, some VDS hardware providers will allow the RAID-5 (Striped with Parity) LUN type to be implemented, while others might be limited to providing the Mirrored or Spanned LUN

  types.

  MORE INFO More on VDS

  For more information on the functionality of VDS, consult the following TechNet article:http://technet2.microsoft.com/windowsserver/en/library/dc77e7c7-ae44-4483-878b- 6bc3819e64dc1033.mspx?mfr=true

  Storage Manager For SANs

  You can use the Storage Manager For SANs console to create LUNs on Fibre Channel and iSCSI storage arrays. You install Storage Manager For SANs as a Windows Server 2008 feature. To use Storage Manager For SANs to manage

  LUNs, the following criteria must be met:

  The storage subsystems that you are going to manage must support VDS.

  The VDS hardware provider for each subsystem must already be installed on the Windows Server 2008 computer. When you open Storage Manager For SANs from the Administrative Tools menu, you are presented with three main nodes,

  which have the following functionality:

  LUN ManagementThis node lists all of the LUNs created with Storage Manager For SANs. From this node you can create new LUNs, extend the size of existing LUNs, assign and unassign LUNs, and delete LUNs. You can also use this node

  to configure the Fibre Channel and iSCSI connections that servers use to access LUNs.

  SubsystemsThis node lists all of the storage subsystems currently discovered within the SAN environment. You can rename subsystems using this node.

  DrivesThis node lists all of the drives in the storage subsystems discovered in the SAN. You can identify drives that you are working with by making the drive light blink from this node.

  You can use any LUN type that is supported by the storage subsystem that you are deploying.

  The different

  LUN types are:

  SimpleA simple LUN uses either an entire physical drive or a portion of that drive. The failure of a disk in a simple LUN means that all data stored on the LUN is lost.

  SpannedA spanned LUN is a simple LUN that spans multiple physical drives. The failure of any one disk in a spanned LUN means that all data stored on the LUN is lost.

  StripedData is written across multiple physical disks. This type of LUN, also known as RAID-0 has improved I/O performance because data can be read and written to multiple disks simultaneously, but like a spanned LUN, all data will be lost

  in the event that one disk in the array fails.

  MirroredThis LUN type, also known as RAID-1, is fault tolerant. Identical copies of the LUN are created on two physical drives. All read and write operations occur concurrently on both drives. If one disk fails, the LUN continues to be available

  on the unaffected disk. Striped with ParityThis LUN type, also known as RAID-5, offers fault tolerance and improved read performance, although write performance is hampered by parity calculation. This type requires a minimum of three disks and the equivalent of one disk's worth of storage is lost to the storage of parity information across the disk set. This LUN type will retain data if one disk is lost, but all data will be lost if two disks in the array fail at the same time. In the event that one disk fails, it should be replaced as quickly as possible.

• Question 185:

  Your network consists of an Active Directory domain. The domain controllers run Windows Server

  2008 R2. Client computers run Windows 7.

  You need to implement Encrypting File System (EFS) for all client computers.

  You want to achieve this goal while meeting the following requirements:

  -

  You must minimize the amount of data that is transferred across the network when a user logs on to or off from a client computer.

  -

  Users must be able to access their EFS certificates on any client computers.

  -

  If a client computer's disk fails, EFS certificates must be accessible. What should you do?

  A. Enable credential roaming.
  B. Enable roaming user profiles.
  C. Enable a Data Recovery Agent.
  D. Issue smart cards to all users.
  A. Enable credential roaming.

  ---

  Configuring Credential Roaming

  Credential roaming allows for the storage of certificates and private keys within Active Directory.

  For example, a user's encrypting file system certificate can be stored in Active Directory and provided to the user when she logs on to different computers within the domain. The same EFS certificate will always be used to encrypt files.

  This means that the user can encrypt files on an NTFS-formatted USB storage device on one computer and then decrypt them on another, because the EFS certificate will be transferred to the second computer's certificate store during the

  logon process.Credential roaming also allows for all of a user's certificates and keys to be removed when he logs off of the computer.

  Credential roaming is enabled through the Certificate Services Client policy, located under User Configuration\Policies\Windows Settings\Security Settings\Public Key Policies and shown in

  Figure 10-4.

  

  Figure 10-4Credential Roaming Policy

  Credential roaming works in the following manner. When a user logs on to a client computer in a domain where the Credential Roaming Policy has been enabled, the certificates in the user's store on the client computer are compared to

  certificates stored for the user within Active Directory.

  If the certificates in the user's certificate store are up to date, no further action is taken.

  If more recent certificates for the user are stored in Active Directory, these credentials are copied to the client computer.

  If more recent certificates are located in the user's store, the certificates stored in Active Directory are updated.

  Credential roaming synchronizes and resolves any conflicts between certificates and private keys from any number of client computers that a user logs on to, as well as certificates and private keys stored within Active Directory. Credential

  roaming is triggered whenever a private key or certificate in the local certificate store changes, whenever the user locks or unlocks a computer, and whenever Group Policy refreshes. Credential roaming is supported on Windows Vista,

  Windows Server 2008, Windows XP SP2, and Windows Server 2003

  SP1.

  MORE INFO More on credential roaming

  For more information on configuring credential roaming, consult the following TechNet

  link:http://technet2.microsoft.com/windowsserver2008/en/library/fabc1c44-f2a2-43e1-b52e-9b12a1f19a331 033.mspx?mfr=true

• Question 186:

  Your network contains an Active Directory domain. You have a server that runs Windows Server 2008 R2 and has the Remote Desktop Services server role enabled. All client computers run Windows 7.

  You need to plan the deployment of a new line of business application to all client computers.

  The deployment must meet the following requirements:

  -

  Users must access the application from an icon on their desktops.

  -

  Users must have access to the application when they are not connected to the network.

  What should you do?

  A. Publish the application as a RemoteApp.
  B. Publish the application by using Remote Desktop Web Access (RD Web Access).
  C. Assign the application to the Remote Desktop Services server by using a Group Policy object (GPO).
  D. Assign the application to all client computers by using a Group Policy object (GPO).
  D. Assign the application to all client computers by using a Group Policy object (GPO).

  ---

  http://support.microsoft.com/kb/816102

  Assign a Package

  To assign a program to computers that are running Windows Server 2003, Windows 2000, or Microsoft Windows XP Professional, or to users who are logging on to one of these workstations:

  1.

  Start the Active Directory Users and Computers snap-in. To do this, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

  2.

  In the console tree, right-click your domain, and then click Properties.

  3.

  Click the Group Policy tab, select the group policy object that you want, and then click Edit.

  4.

  Under Computer Configuration, expand Software Settings.

  5.

  Right-click Software installation, point to New, and then click Package.

  6.

  In the Open dialog box, type the full Universal Naming Convention (UNC) path of the shared installer package that you want. For example, \\file server\share\file name.msi. Important Do not use the Browse button to access the location. Make sure that you use the UNC path to the shared installer package.

  7.

  Click Open.

  8.

  Click Assigned, and then click OK. The package is listed in the right pane of the Group Policy window.

  9.

  Close the Group Policy snap-in, click OK, and then quit the Active Directory Users and Computers snap-in.

  10.

  When the client computer starts, the managed software package is automatically installed.

• Question 187:

  You need to configure Windows Update to meet the company's technical requirements. What should you do?

  A. Configure WSUS2 as an autonomous server.
  B. Create a Network Load Balancing (NLB) cluster.
  C. Create multiple Host (A) records and use round robin DNS.
  D. Configure multiple service location (SRV) records and use round robin DNS.
  A. Configure WSUS2 as an autonomous server.

  ---

  http://technet.microsoft.com/en-us/library/dd939896%28WS.10%29.aspx

  Network load balancing (NLB) is an optional feature of Windows Server that load balances network traffic for high availability. You can install Windows Server Update Services (WSUS) 3.0 SP2 in a network that uses NLB, but this configuration requires that you perform additional steps during WSUS setup.

• Question 188:

  Your network consists of a single Active Directory domain. All domain controllers run Windows

  Server 2008 R2. All servers run Windows Server 2008 R2. All client computers run Windows 7.

  You need to generate a monthly report on the status of software updates for the client computers.

  Your solution must meet the following requirements:

  -

  Display all of the operating system updates that installed successfully

  -

  Display all of the Microsoft Application updates that installed successfully

  -

  Display all of the operating system updates that failed to install

  -

  Display all of the Microsoft Application updates that failed to install

  -

  Minimize administrative effort

  -

  Minimize costs

  What should you do?

  A. Install Microsoft System Center Essentials (Essentials) 2007. Deploy management agents on all client computers.
  B. Install Microsoft System Center Configuration Manager (SysMgr) 2007. Deploy management agents on all client computers.
  C. Install Windows Server Update Services (WSUS) 3.0 SP2. Configure Windows Update by using a Group Policy object (GPO).
  D. Deploy Microsoft Baseline Security Analyzer (MBSA) 2.1 on the client computers. Run MBSA on each client computer, and save the report to a shared folder on the network.
  C. Install Windows Server Update Services (WSUS) 3.0 SP2. Configure Windows Update by using a Group Policy object (GPO).

  ---

  http://technet.microsoft.com/en-us/library/dd939886%28WS.10%29.aspx What's new in this release?

  

  Integration with Windows Server?2008 R2

  Support for the BranchCache?feature in Windows Server 2008 R2

  

  

  Support for Windows?7 client computers New features

  

  Automatic approval rules include the ability to specify the approval deadline date and time for all computers or for specific computer groups.

  

  Improved handling of language selection for downstream servers includes a new warning dialog that appears when you decide to download updates only for specified languages.

  

  New Update and Computer Status reports let you filter updates that are approved for installation.

  

  You can run these reports from the WSUS administration console or use the application programming interface (API) to incorporate this functionality into your own reports.

  Windows Update Agent improvements

  

  Client computer scan time is faster than previous versions.

  

  Computers that are managed by WSUS servers can now run "scoped" scans against those servers, instead of performing a full scan. This results in faster scans for applications that use Microsoft Update APIs such as Windows Defender.

  

  User experience improvements help users organize updates and provide greater clarity on update value and behavior.

  

  Imaged computers are more clearly displayed in the WSUS administration console.

  

  For more information, see article 903262 in the Microsoft Knowledge Base.

  

  Prevents APIs that are called by non-local system callers in a non-interactive session from failing.

  

  Prevents error code 0x80070057 when you try to install 80 or more updates at the same time from the Windows Update Web page or from the Microsoft Update Web page.

  

  Improves scan times for Windows Update

  

  Improves the speed at which signature updates are delivered

  

  Enables support for Windows Installer reinstallation functionality

  

  Improves error messaging

• Question 189:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2. There are five Windows Server 2003 SP2 servers that have the Terminal Server component installed. A firewall server runs Microsoft Internet Security and Acceleration (ISA) Server 2006.

  You plan to give remote users access to the Remote Desktop Services servers.

  You need to create a remote access strategy for the Remote Desktop Services servers that meets the following requirements:

  -Restricts access to specific Remote Desktop Services servers

  -Encrypts all connections to the Remote Desktop Services servers

  -Minimizes the number of open ports on the firewall server

  What should you do?

  A. Implement SSL bridging on the ISA Server. Require authentication on all inbound connections to the ISA Server.
  B. Implement port forwarding on the ISA Server. Require authentication on all inbound connections to the ISA Server.
  C. Upgrade a Windows Server 2003 SP2 server to Windows Server 2008 R2. On the Windows Server 2008 R2 server, implement the Remote Desktop Gateway (RD Gateway) role service, and configure a Remote Desktop resource authorization policy (RD RAP).
  D. Upgrade a Windows Server 2003 SP2 server to Windows Server 2008 R2. On the Windows Server 2008 R2 server, implement the Remote Desktop Gateway (RD Gateway) role service, and configure a Remote Desktop connection authorization policy (RD CAP).
  C. Upgrade a Windows Server 2003 SP2 server to Windows Server 2008 R2. On the Windows Server 2008 R2 server, implement the Remote Desktop Gateway (RD Gateway) role service, and configure a Remote Desktop resource authorization policy (RD RAP).

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration:

  Terminal Services Gateway TS Gateway allows Internet clients secure, encrypted access to Terminal Servers behind your organization's firewall without having to deploy a Virtual Private Network (VPN) solution. This means that you can have users interacting with their corporate desktop or applications from the comfort of their homes without the problems that occur when VPNs are configured to run over multiple Network Address Translation (NAT) gateways and the firewalls of multiple vendors.

  TS Gateway works using RDP over Secure Hypertext Transfer Protocol (HTTPS), which is the same protocol used by Microsoft Office Outlook 2007 to access corporate Exchange Server 2007 Client Access Servers over the Internet. TS Gateway Servers can be configured with connection authorization policies and resource authorization policies as a way of differentiating access to Terminal Servers and network resources.

  Connection authorization policies allow access based on a set of conditions specified by the administrator; resource authorization policies grant access to specific Terminal Server resources based on user account properties.

  Resource Authorization Policies Terminal Services resource authorization policies (TS-RAPs) are used to determine the specific resources on an organization's network that an incoming TS Gateway client can connect to. When you create a TS-RAP you specify a group of computers that you want to grant access to and the group of users that you will allow this access to. For example, you could create a group of computers called AccountsComputers that will be accessible to members of the Accountants user group. To be granted access to internal resources, a remote user must meet the conditions of at least one TS-CAP and at least one TS-RAP.

• Question 190:

  You are planning to deploy new servers that will run Windows Server 2008 R2. Each server will have 32 GB of RAM. The servers must support installation of the following role services:

  -Routing and Remote Access

  -

  Remote Desktop Services Gateway

  You need to deploy the minimum edition of Windows Server 2008 R2 that meets the requirements.

  What should you recommend? (More than one answer choice may achieve the goal. Select the BEST answer.)

  A. Windows Server 2008 R2 Standard
  B. Windows Server 2008 R2 Enterprise
  C. Windows Server 2008 R2 Web
  D. Windows Server 2008 R2 Datacenter
  A. Windows Server 2008 R2 Standard

  ---

  http://www.microsoft.com/en-us/server-cloud/windows-server/2008-r2-standard.aspx R2 Standard provides these services and is the minimum edition they are available on.

  32 GB RAM is also supported if its a 64 bit version http://technet.microsoft.com/en-us/windowsserver/bb414778.aspx