Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 191:

  Your network contains two servers that run the Server Core installation of Windows Server 2008 R2. The two servers are part of a Network Load Balancing cluster.

  The cluster hosts a Web site. Administrators use client computers that run Windows 7.

  You need to recommend a strategy that allows the administrators to remotely manage the Network Load Balancing cluster. Your strategy must support automation.

  What should you recommend?

  A. On the servers, enable Windows Remote Management (WinRM).
  B. On the servers, add the administrators to the Remote Desktop Users group.
  C. On the Windows 7 client computers, enable Windows Remote Management (WinRM).
  D. On the Windows 7 client computers, add the administrators to the Remote Desktop Users group.
  A. On the servers, enable Windows Remote Management (WinRM).

  ---

  http://support.microsoft.com/kb/968929

  http://msdn.microsoft.com/en-us/library/aa384291%28VS.85%29.aspx

  WinRM 2.0

  WinRM is the Microsoft implementation of WS-Management Protocol, a standard Simple Object Access Protocol (SOAP)-based, firewall-friendly protocol that allows for hardware and operating systems from different vendors to interoperate.

  The WS-Management Protocol specification provides a common way for systems to access and exchange management information across an IT infrastructure.

  WinRM 2.0 includes the following new features:

  

  The WinRM Client Shell API provides functionality to create and manage shells and shell operations, commands, and data streams on remote computers.

  

  The WinRM Plug-in API provides functionality that enables a user to write plug-ins by implementing certain APIs for supported resources and operations.

  

  WinRM 2.0 introduces a hosting framework. Two hosting models are supported. One is Internet Information Services (HS)-based and the other is WinRM service-based.

  

  Association traversal lets a user retrieve instances of Association classes by using a standard filtering mechanism.

  

  Users of WinRM 2.0 can use Windows PowerShell cmdlets for system management.

  

  WinRM has added a specific set of quotas that provide a better quality of service and allocate server resources to concurrent users. The WinRM quota set is based on the quota infrastructure that is implemented for the IIS service.

  

  

  WinRM 2.0 supports delegating user credentials across multiple remote computers.

  

  USAGE

  =====

  (ALL UPPER-CASE = value that must be supplied by user.)

  winrs [-/SWITCH[:VALUE]] COMMAND

  COMMAND - Any string that can be executed as a command in the cmd.exe shell.

  SWITCHES

  ========

  (All switches accept both short form or long form. For example both -r and -remote are valid.)

  -r[emote]:ENDPOINT - The target endpoint using a NetBIOS name or the standard connect ion URL: [TRANSPORT://]TARGET[:PORT]. If not specified

  -r:localhost is used.

  -un[encrypted] - Specify that the messages to the remote shell will not be encrypted. This is useful for troubleshooting, or when the network traffic is already encrypted using ipsec, or when physical security is enforced. By default the

  messages are encrypted using Kerberos or NTLM keys. This switch is ignored when HTTPS transport is selected.

  -u[sername]:USERNAME - Specify username on command line. If not specified the tool will use Negotiate authentication or prompt for the name.

  If -username is specified, -password must be as well.

  -p[assword]:PASSWORD - Specify password on command line. If -password is not specified but - username is the tool will prompt for the password. If -password is specified, -user must be specified as well.

  -t[imeout]:SECONDS - This option is deprecated.

  -d[irectory]:PATH - Specifies starting directory for remote shell. If not specified the remote shell will start in the user's home directory defined by the environment variable %USERPROFILE%.

  -env[ironment]:STRING=VALUE - Specifies a single environment variable to be set when shell starts, which allows changing default environment for shell. Multiple occurrences of this switch must be used to specify multiple environment

  variables.

  -noe[cho] - Specifies that echo should be disabled. This may be necessary to ensure that user's answers to remote prompts are not displayed locally. By default echo is "on".

  -nop[rofile] - Specifies that the user's profile should not be loaded. By default the server will attempt to load the user profile. If the remote user is not a local administrator on the target system then this option will be required (the default will

  result in error).

  -a[llow]d[elegate] - Specifies that the user's credentials can be used to access a remote share, for example, found on a different machine than the target endpoint.

  -comp[ression] - Turn on compression. Older installations on remote machines may not support compression so it is off by default.

  -[use]ssl - Use an SSL connection when using a remote endpoint. Specifying this instead of the transport "https:" will use the default WinRM default port.

  -? - Help

  To terminate the remote command the user can type Ctrl-C or Ctrl-Break, which will be sent to the remote shell. The second Ctrl-C will force termination of winrs.exe.

  To manage active remote shells or WinRS configuration, use the WinRM tool. The URI alias to manage active shells is shell/cmd. The URI alias for WinRS configuration is winrm/conf

  ig/winrs. Example usage can be found in the WinRM tool by typing "WinRM -?".

  Examples:

  winrs -r:https://myserver.com command

  winrs -r:myserver.com -usessl command

  winrs -r:myserver command

  winrs -r:http://127.0.0.1 command

  winrs -r:http://169.51.2.101:80 -unencrypted command

  winrs -r:https://[::FFFF:129.144.52.38] command

  winrs -r:http://[1080:0:0:0:8:800:200C:417A]:80 command

  winrs -r:https://myserver.com -t:600 -u:administrator -p:$%fgh7 ipconfig

  winrs -r:myserver -env:PATH=^%PATH^%;c:\tools -env:TEMP=d:\temp config.cmd

  winrs -r:myserver netdom join myserver /domain:testdomain /userd:johns /passwordd:$%fgh789

  winrs -r:myserver -ad -u:administrator -p:$%fgh7 dir \\anotherserver\share

• Question 192:

  You need to ensure that Admin2 can administer Active Directory to meet the company's technical requirements.

  What should you do?

  A. Add Admin2 to the Domain Admins global group.
  B. Add Admin2 to the Backup Operators domain local group.
  C. Delegate full control of all objects in graphicdesigninstitute.com to Admin2.
  D. Delegate full control of all objects in the Domain Controllers organizational unit (OU) to Admin2.
  A. Add Admin2 to the Domain Admins global group.

  ---

  You can enable Active Directory Recycle Bin only if the forest functional level of your environment is set to Windows Server 2008 R2.

  Membership in Domain Admins, or equivalent, is the minimum required to use AD recycle bin

• Question 193:

  You need to ensure that all servers meet the company's security requirements. Which tool should you use?

  A. Microsoft Baseline Security Analyzer (MBSA)
  B. Microsoft Security Assessment Tool (MSAT)
  C. Resultant Set of Policy (RSoP)
  D. Security Configuration Wizard (SCW)
  A. Microsoft Baseline Security Analyzer (MBSA)

  ---

  http://technet.microsoft.com/en-us/security/cc184924

  Microsoft Baseline Security Analyzer

  Microsoft Baseline Security Analyzer (MBSA) is an easy-to-use tool designed for the IT professional that helps small- and medium-sized businesses determine their security state in

  accordance with Microsoft security recommendations and offers specific remediation guidance.

  Improve your security management process by using MBSA to detect common security misconfigurations and missing security updates on your computer systems.

• Question 194:

  You need to recommend a strategy for the file servers that meets the company's technical requirements. What should you recommend?

  A. Implement active file screens.
  B. Implement passive file screens.
  C. Configure classification rules.
  D. Configure File Server Resource Manager (FSRM) quotas
  B. Implement passive file screens.

  ---

  http://technet.microsoft.com/en-us/library/cc732349%28WS.10%29.aspx

  Create file screens to block files that belong to particular file groups from being saved on a volume or in a folder tree. A file screen affects all folders in the designated path. For example, you might create a file screen to prevent users from

  storing audio and video files in their personal folders on the server.

  You can configure File Server Resource Manager to generate e-mail or other notifications when a file screening event occurs.

  A file screen can be either active or passive:

  -Active screening prevents users from saving unauthorized file types on the server.

  -Passive screening monitors users saving specific file types and generates any configured notifications, but does not prevent users from saving files.

• Question 195:

  You need to apply a critical security update to all computers on the New Haven campus while ensuring that New Haven computers continue to receive scheduled updates from BODATA03. You must not apply the security update to any other computers.

  What should you recommend?

  A. Configure the New Haven campus client computers to synchronize hourly from Microsoft Update.
  B. Change NEDATA01 to Autonomous mode, and deploy the security update from NEDATA01.
  C. Change NEDATA01 to Autonomous mode, and deploy the security update from BODATA03.
  D. Configure only NEDATA01 as an upstream server, and deploy the security update from NEDATA01.
  C. Change NEDATA01 to Autonomous mode, and deploy the security update from BODATA03.

  ---

  There are two ways to link WSUS servers together:

  Autonomous mode: An upstream WSUS server shares updates with its downstream server or servers during synchronization, but not update approval status or computer group information. Downstream WSUS servers must be administered separately. Autonomous servers can also synchronize updates for a set of languages that is a subset of the set synchronized by their upstream server.

  Replica mode: An upstream WSUS server shares updates, approval status, and computer groups with its downstream server or servers. Downstream replica servers inherit update approvals and cannot be administered apart from their upstream WSUS server.

• Question 196:

  You need to recommend a strategy to ensure that the administration of AD LDS is encrypted. What should you include in the recommendation?

  A. a server authentication certificate
  B. client authentication certificates
  C. Digest authentication
  D. Windows Integrated authentication
  A. a server authentication certificate

  ---

  http://technet.microsoft.com/en-us/library/cc725767%28WS.10%29.aspx

  The Lightweight Directory Access Protocol (LDAP) is used to read from and write to Active Directory Lightweight Directory Services (AD LDS). By default, LDAP traffic is not transmitted securely. You can make LDAP traffic confidential and secure by using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) technology.

  To enable SSL-based encrypted connections to AD LDS, you must request and obtain a server authentication certificate from a trusted certification authority (CA) in your organization or from a trusted third-party CA. For more information about installing and using a CA, see Certificate Services (http://go.microsoft.com/fwlink/?LinkID=48952).

• Question 197:

  You need to recommend a deployment solution for Office 2010 to address the problem statements. What should you include in the recommendation?

  A. Microsoft Application Virtualization (App-V)
  B. Microsoft Enterprise Desktop Virtualization (MED-V)
  C. Microsoft HyperV Server 2008 R2
  D. Windows XP Mode
  A. Microsoft Application Virtualization (App-V)

  ---

  The users need to be able to run both Office 2003 and 2007 at the same time. so they need to run in isolation to each other. App-V provides this service http://technet.microsoft.com/en-us/library/ee958112.aspx

  Microsoft Application Virtualization (App-V) can make applications available to end user computers without having to install the applications directly on those computers. This is made possible through a process known as sequencing the application, which enables each application to run in its own self-contained virtual environment on the client computer. The sequenced applications are isolated from each other. This eliminates application conflicts, but the applications can still interact with the client computer.

• Question 198:

  You need to recommend a solution for promoting the RODC in the new branch office. What should you include in the recommendations?

  A. Implement the Windows Search service and implement a custom iFilter.
  B. Implement File Server Resource Manager (FSRM) and configure file classifications.
  C. Implement Microsoft SharePoint Foundation 2010 and create a custom workflow.
  D. Implement a Distributed File System (DFS) namespace and configure folder targets.
  B. Implement File Server Resource Manager (FSRM) and configure file classifications.

  ---

  http://technet.microsoft.com/en-us/library/ee344836%28WS.10%29.aspx

  What is the File Classification Infrastructure?

  The Windows Server 2008 R2 File Classification Infrastructure (FCI) automates classification processes so that you can manage your data more effectively. You can save money and reduce risk by storing and retaining files based on their business value or impact. The built-in solution for file classification provides expiration, custom tasks, and reporting. The extensible infrastructure enables you to meet additional customer classification needs by building rich end-to-end classification solutions that are built on the classification foundation of Windows Server in a consistent and supported way and within the existing Windows file serving platforms.

• Question 199:

  You need to recommend a solution to meet the IT security requirements and data encryption requirements for TT-FILE01 with the minimum administrative effort.

  What should you recommend? (Choose all that Apply.)

  A. Turn on BitLocker on drive X:\ and select the Automatically unlock this drive on this computer option.
  B. Migrate TT-FILE01 to Windows Server 2008 R2 Enterprise.
  C. Store BitLocker recovery information in the tailspintoys.com domain.
  D. Turn on BitLocker on the system drive.
  A. Turn on BitLocker on drive X:\ and select the Automatically unlock this drive on this computer option.
  C. Store BitLocker recovery information in the tailspintoys.com domain.

  ---

  Backing up recovery passwords for a BitLocker-protected disk volume allows administrators to recover the volume if it is locked. This ensures that encrypted data belonging to the enterprise can always be accessed by authorized users.

  Storage of BitLocker recovery information in Active Directory

  Backed up BitLocker recovery information is stored in a child object of the Computer object. That is, the Computer object is the container for a BitLocker recovery object.

  Each BitLocker recovery object includes the recovery password and other recovery information.

  More than one BitLocker recovery object can exist under each Computer object, because there can be more than one recovery password associated with a BitLocker-enabled volume.

  The name of the BitLocker recovery object incorporates a globally unique identifier (GUID) and date and time information, for a fixed length of 63 characters. The form is: