Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 201:

  A company has servers that run Windows Server 2008 R2.

  You are designing a storage solution for the servers. The storage solution must meet the following requirements:

  1. Allow the use of Fibre Channel (FC), Internet SCSI (iSCSI), and Serial Attached SCSI (SAS) interfaces for connectivity to storage arrays.

  2. Support storage load balancing.

  You need to ensure that the storage solution meets the requirements.

  Which feature should you install?

  To answer, select the appropriate feature in the answer area.

  Hot Area:

  

  

  ---

  A growing number of organizations require that their data be available at all times. To meet this requirement, centralized storage must be readily available and immune to outages. Multipathing is the ability of a system to use more than one read/write path to a storage device. It is a solution that provides fault tolerance against a single point-of-failure in hardware components.

  The Microsoft® Multipath I/O (MPIO) framework helps ensure that your data is available at all times. MPIO supports multiple data paths to storage, improves the fault tolerance of the storage connection, and in some cases, provides greater aggregate throughput by using multiple paths at the same time. This helps improve system and application performance.

  Multipathing Support for High Availability Windows Server® 2008 includes many enhancements for the connectivity of a computer running a Windows server-class operating system to storage area networking (SAN) devices. Among the enhancements enabling high availability for connecting Windows-based servers to SANs is integrated Multipath I/O (MPIO) support. Microsoft MPIO architecture supports iSCSI, Fibre Channel and serial attached storage (SAS) SAN connectivity by establishing multiple sessions or connections to the storage array. Multipathing solutions use redundant physical path components — adapters, cables, and switches — to create logical paths between the server and the storage device. In the event that one or more of these components fails, causing the path to fail, multipathing logic uses an alternate path for I/O so that applications can still access their data. Each network interface card (in the iSCSI case) or HBA should be connected by using redundant switch infrastructures to provide continued access to storage in the event of a failure in a storage fabric component.

  Failover times vary by storage vendor, and can be configured by using timers in the Microsoft iSCSI Software Initiator driver, or modifying the Fibre Channel host bus adapter driver parameter settings.

  New MPIO features in Windows Server 2008 include a Device Specific Module (DSM) designed to work with storage arrays that support the asymmetric logical unit access (ALUA) controller model (as defined in SPC-3), as well as storage arrays that follow the Active/Active controller model.

• Question 202:

  New security events are not being written to the current Security event log in the tailspintoys.com domain. However, old security events are still being maintained in the log.

  You need to meet the security event log requirements for the tailspintoys.com domain.

  Which Group Policy setting or settings should you select?

  To answer, select the appropriate setting or settings in the Group Policy Management Editor.

  Hot Area:

  

  

  ---

  Backup log automatically when full

  This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the Retain old events policy setting is enabled. If you enable this policy setting and the Retain old events policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. If you disable this policy setting and the Retain old events policy setting is enabled, new events are discarded and the old events are retained.

  When this policy setting is not configured and the Retain old events policy setting is enabled, new events are discarded and the old events are retained.

  Possible values: Enabled Disabled Not Configured normally you need RETAIN OLD EVENTS enabled also But this is already set in the default domain policy per the exhibit for the testlet

• Question 203:

  You need to recommend changes to the network that address the user problems statement. What should you recommend?

  A. Deploy DirectAccess.
  B. Configure folder redirection.
  C. Create a volume mount point.
  D. Implement additional DFS targets.
  D. Implement additional DFS targets.

  ---

  Direct Access is a remote access solution and does not address the problem. Folder redirection does not address the problem Volume mount point would not solve this problem either

  The Distributed File System is used to build a hierarchical view of multiple file servers and shares on the network. Instead of having to think of a specific machine name for each set of files, the user will only have to remember one name; which will be the 'key' to a list of shares found on multiple servers on the network. Think of it as the home of all file shares with links that point to one or more servers that actually host those shares.

  DFS has the capability of routing a client to the closest available file server by using Active Directory site metrics

  Dfs target (or replica): This can be referred to as either a root or a link. If you have two identical shares, normally stored on different servers, you can group them together as Dfs Targets under the same link.

  

• Question 204:

  You need to recommend a solution that meets the following requirements:

  1. Log access to all shared folders on TT-FILE02.

  2. Minimize administrative effort.

  3. Ensure that further administrative action is not required when new shared folders are added to TT-FILE02.

  Which actions should you perform in sequence?

  To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. (Use only actions that Apply.)

  Select and Place:

  

  

• Question 205:

  Your network consists of a single Active Directory domain. The relevant portion of the Active Directory domain is configured as shown in the following diagram.

  

  The Staff organizational unit (OU) contains all user accounts except for the managers' user accounts. The Managers OU contains the managers' user accounts and the following global groups:

  -Sales

  -Finance

  -

  Engineering

  You create a new Group Policy object (GPO) named GPO1, and then link it to the Employees OU.

  Users from the Engineering global group report that they are unable to access the Run command on the Start menu. You discover that the GPO1 settings are causing the issue.

  You need to ensure that the users from the Engineering global group are able to access the Run command on the Start menu.

  What should you do?

  A. Configure GPO1 to use the Enforce Policy option.
  B. Configure Block Inheritance on the Managers OU.
  C. Configure Group Policy filtering on GPO1 for the Engineering global group.
  D. Create a new child OU named Engineering under the Employees OU. Move the Engineering global group to the new Engineering child OU.
  C. Configure Group Policy filtering on GPO1 for the Engineering global group.

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration

  No administrator likes exceptions, but we are required to implement them. Typically you might have configured security filtering, Windows Management Instrumentation (WMI) filters, block inheritance settings, no-override settings, loopback processing, and slow-link settings. You need to check that these settings are not affecting normal GPO processing.

• Question 206:

  You need to remove Marc's delegated rights.

  What would you recommend?

  A. Use the Delegation of Control Wizard.
  B. Run the Resultant Set of Policy (RSoP) tool.
  C. Run the dsacls command-line utility.
  D. Run the xcalcs command-line utility.
  C. Run the dsacls command-line utility.

  ---

  http://support.microsoft.com/kb/281146

  DSACLS is used to View or Edit ACLs (access control entries) for objects in Active Directory.

  Overview of Dsacls.exe

  DsAcls uses the following syntax:

  dsacls object [/a] [/d {user | group}:permissions [...]] [/g {user | group}:permissions [...]] [/i:{p | s | t}][/n] [/p:{y | n}][/r {user | group} [...]] [/s [/t]]

  You can use the following parameters with Dsacls.exe:

  object: This is the path to the directory services object on which to display or change the ACLs.

  This path must be a distinguished name (also known as RFC 1779 or x.500 format). For example:

  CN=Someone,OU=Software,OU=Engineering,DC=Microsoft,DC=Com

  To specify a server, add \\Servername\ before the object. For example:

  \\MyServer\CN=Someone,OU=Software,OU=Engineering,DC=Microsoft,DC=Com

  When you run the dsacls command with only the object parameter (dsacls object), the security information about the object is displayed.

  /a : Use this parameter to display the ownership and auditing information with the permissions. /d{user | group}:permissions: Use this parameter to deny specified permissions to a user or group.

  User must use either user@domain or domain\user format, and group must use either group@domain or domain\group format. You can specify more than one user or group in a

  command. For more information about the correct syntax to use for permissions, see the rmissions> Syntax section later in this article.

  /g {user | group}:permissions: Use this parameter to grant specified permissions to a user or ust use either user@domain or domain\user format, and group must use either

  group@domain or domain \group format. You can specify more than one user or group in a command. For more information about the correct syntax to use for permissions, see the

  Syntax section later in this article.

  /i:{p | s | t} : Use this parameter to specify one of the following inheritance flags:

  p: Use this option to propagate inheritable permissions one level only.

  s: Use this option to propagate inheritable permissions to subobjects only.

  t: Use this option to propagate inheritable permissions to this object and subobjects.

  /n : Use this parameter to replace the current access on the object, instead of editing it.

  /p:{y | n}: This parameter determines whether the object can inherit permissions from its parent objects. If you omit this parameter, the inheritance properties of the object are not changed. Use this parameter to mark the object as protected (y

  = yes) or not protected (n = no).

  Note This parameter changes a property of the object, not of an Access Control Entry (ACE). To determine whether an ACE is inheritable, use the /I parameter.

  /r {user | group}: Use this parameter to remove all permissions for the specified user or group. You can specify more than one user or group in a command. User must use either user@domain or domain\user format, and group must use

  either group@domain or domain\group format.

  /s: Use this parameter to restore the security on the object to the default security for that object class, as defined in the Active Directory schema.

  /t : Use this parameter to restore the security on the tree of objects to the default for each object class. This switch is valid only when you also use the /s parameter.

• Question 207:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2.

  Your company and an external partner plan to collaborate on a project. The external partner has an Active Directory domain that contains Windows Server 2008 R2 domain controllers.

  You need to design a collaboration solution that meets the following requirements:

  -

  Allows users to prevent sensitive documents from being forwarded to untrusted recipients or from being printed.

  -

  Allows users in the external partner organization to access the protected content to which they have been granted rights.

  -Sends all interorganizational traffic over port 443.

  - Minimizes the administrative effort required to manage the external users.

  What should you include in your design?

  A. Establish a federated trust between your company and the external partner. Deploy a Windows Server 2008 R2 server that has Microsoft SharePoint Foundation 2010 installed.
  B. Establish a federated trust between your company and the external partner. Deploy a Windows Server 2008 R2 server that runs Microsoft SharePoint 2010 and that has the Active Directory Rights Management Services (AD RMS) role installed.
  C. Establish an external forest trust between your company and the external partner. Deploy a Windows Server 2008 R2 server that has the Active Directory Certificate Services server role installed. Implement Encrypting File System (EFS).
  D. Establish an external forest trust between your company and the external partner. Deploy a Windows Server 2008 R2 server that has the Active Directory Rights Management Service (AD RMS) role installed and Microsoft SharePoint Foundation 2010 installed.
  B. Establish a federated trust between your company and the external partner. Deploy a Windows Server 2008 R2 server that runs Microsoft SharePoint 2010 and that has the Active Directory Rights Management Services (AD RMS) role installed.

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration:

  Active Directory Federation Services

  You can create forest trusts between two or more Windows Server 2008 forests (or Windows Server 2008 and Windows Server 2003 forests). This provides cross-forest access to resources that are located in disparate business units or

  organizations. However, forest trusts are sometimes not the best option, such as when access across organizations needs to be limited to a small subset of individuals. Active Directory Federation Services (AD FS) enables organizations to

  allow limited access to their infrastructure to trusted partners. AD

  FS acts like a cross-forest trust that operates over the Internet and extends the trust relationship to Web applications (a federated trust). It provides Web single-sign-on (SSO) technologies that can authenticate a user over the life of a single

  online session. AD FS securely shares digital identity and entitlement rights (known asclaims) across security and enterprise boundaries.

  Windows Server 2003 R2 introduced AD FS and Windows Server 2008 expands it. New AD FS features introduced in Windows Server 2008 include the following:

  Improved application supportWindows Server 2008 integrates AD FS with Microsoft Office SharePoint Server 2007 and Active Directory Rights Management Services (AD RMS).

  Improved installationAD FS is implemented in Windows Server 2008 as a server role. The installation wizard includes new server validation checks.

  Improved trust policyImprovements to the trust policy import and export functionality help to minimize configuration issues that are commonly associated with establishing federated trusts.

  AD FS extends SSO functionality to Internet-facing applications. Partners experience the same streamlined SSO user experience when they access the organization's Web-based applications as they would when accessing resources through

  a forest trust. Federation servers can be deployed to facilitate businesstobusiness (B2B) federated transactions.

  AD FS provides a federated identity management solution that interoperates with other security products by conforming to the Web Services Federation(WS-Federation) specification. This specification makes it possible for environments that

  do not use Windows to federate with Windows environments. It also provides an extensible architecture that supports the Security Assertion Markup Language (SAML) 1.1 token type and Kerberos authentication. AD FS can perform claim

  mapping--for example, modifying claims using business logic variables in an access request. Organizations can modify AD FS to coexist with their current security infrastructure and business policies.

  Finally, AD FS supports distributed authentication and authorization over the Internet. You can integrate it into an organization's existing access management solution to translate the claims that are used in the organization into claims that are

  agreed on as part of a federation. AD FS can create, secure, and verify claims that move between organizations. It can also audit and monitor the communication activity between organizations and departments to help ensure secure

  transactions.

• Question 208:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2. You need to plan an auditing strategy that meets the following requirements:

  - Audits all changes to Active Directory Domain Services (AD DS)

  -

  Stores all auditing data in a central location What should you include in your plan?

  A. Configure an audit policy for the domain. Configure Event Forwarding.
  B. Configure an audit policy for the domain controllers. Configure Data Collector Sets.
  C. Implement Windows Server Resource Manager (WSRM) in managing mode.
  D. Implement Windows Server Resource Manager (WSRM) in accounting mode.
  A. Configure an audit policy for the domain. Configure Event Forwarding.

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration:

  The configuration of a subscription filter is more like the configuration of a custom view in that you are able to specify multiple event log sources, rather than just a single Event Log source. In addition, the subscription will be saved whereas

  you need to re-create a filter each time you use one. By default, all collected Event Log data will be written to the Forwarded Event Event Log. You can forward data to other logs by configuring the properties of the subscription. Even though

  you use a filter to retrieve only specific events from source computers and place them in the destination log, you can still create and apply a custom view to data that is located in the destination log. You could create a custom view for each

  source computer, which would allow you to quickly limit events to that computer rather than viewing data from all source computers at the same time.

  You configure collector initiated subscriptions through the application of Group Policy. To do this you must configure the collector computer in the same manner as you did in the previous steps.

  When configuring the subscription type, select Source Computer Initiated rather than Collector Initiated. To set up the source computers, apply a GPO where you have configured the Computer Configuration\Policies\AdministrativeTemplates

  \Windows Components\Event Forwarding node and configure the Server Address, Refresh Interval, And Issuer Certificate policy with the details of the collector computer, as shown in Figure 7-10.

  Auditing enhancements You can use the new Directory Service Changes audit policy subcategory when auditing Windows Server 2008 AD DS. This lets you log old and new values when changes are made to AD DS objects and their

  attributes. You can also use this new feature when auditing Active Directory Lightweight Directory Services (AD LDS).

  Planning AD DS Auditing

  In Windows Server 2008, the global audit policy Audit Directory Service Access is enabled by default. This policy controls whether auditing for directory service events is enabled or disabled. If you configure this policy setting by modifying the

  Default Domain Controllers Policy, you can specify whether to audit successes, audit failures, or not audit at all. You can control what operations to audit by modifying the System Access Control List (SACL) on an object. You can set a SACL

  on an AD DS object on the Security tab in that object's Properties dialog box.

  As an administrator one of your tasks is to configure audit policy. Enabling success or failure g is a straightforward procedure. Deciding which objects to audit; whether to audit success, failure or both; and whether to record new and old

  values if changes are made is much more difficult. Auditing everything is never an option--too much information is as bad as too little. You need to be selective. In Windows 2000 Server and Windows Server 2003, you could specify only

  whether DS access was audited. Windows Server 2008 gives you more granular control. You can audit the following:

  DS access

  DS changes (old and new values)

  DS replication

• Question 209:

  You need to recommend a monitoring solution for the file server that meets the technical requirements. What should you include in the recommendation?

  A. Data Collector Sets
  B. File Server Resource Manger quotas
  C. File Server Resource Manger storage reports
  D. NTFS disk quotas
  A. Data Collector Sets

  ---

  There's some debate about the answer to this one. is it A or B? concensus is pointng to A: data collector sets Probably the most relevant info is that we must run a script when running out of free space.NTFS quota doesn't have this service.,

  FSRM Storage reports are just that reports so that leaves us with A or B

  Microsoft Self Paced Handbook:

  You can also add performance counter alerts to DCSs. This enables you to monitor a counter and detect an alert, which you can then use to start a batch file, send you an email, or call you on a pager. For example, if you configured an alert

  to trigger when free space on a logical volume falls below 30 percent, you could add this to a DCS and use it to trigger a batch file that archives the data on the volume.

  Data Collector Sets

  http://technet.microsoft.com/en-us/library/cc771692%28WS.10%29.aspx

  An important new feature in Windows Reliability and Performance Monitor is the Data Collector Set, which groups data collectors into reusable elements for use with different performance monitoring scenarios. Once a group of data collectors

  is stored as a Data Collector Set, operations such as scheduling can be applied to the entire set through a single property change. You can schedule repeated collection of a Data Collector Set to create logs, load it in Performance Monitor to

  see the data in real time, and save it as a template to use on other computers. Windows Reliability and Performance Monitor also includes default Data Collector Set templates to help you begin collecting performance data immediately.

• Question 210:

  Your company purchases 15 new 64bit servers as follows:

  -

  Five of the servers have a single processor.

  -

  Five of the servers have a single dual core processor.

  -

  Five of the servers have two quad core processors.

  You plan to deploy Windows Server 2008 R2 on the new servers by using Windows Deployment Services (WDS). You need to recommend a WDS install image strategy that meets the following requirements:

  -Minimizes the number of install images

  -Supports the deployment of Windows Server 2008 R2

  What should you recommend?

  A. one install image file that contains three install images
  B. one install image file that contains a single install image
  C. two install image files that each contain a single install image
  D. three install image files that each contain a single install image
  B. one install image file that contains a single install image

  ---

  You only need one image per processor type

  Windows Deployment Services Images

  Windows Deployment Services uses two different types of images: install images and boot images. Install images are the operating system images that will be deployed to Windows Server 2008 or Windows Vista client computers. A default installation image is located in the \Sources directory of the Windows Vista and Windows Server 2008 installation DVDs. If you are using WDS to deploy Windows Server 2008 to computers with different processor architectures, you will need to add separate installation images for each architecture to the WDS server. Architecture-specific images can be found on the architecture-specific installation media. For example, the Itanium image is located on the Itanium installation media and the x64 default installation image is located on the x64 installation media. Although you can create custom images, you only need to have one image per processor architecture. For example, deploying Windows Server 2008 Enterprise Edition x64 to a computer with 1 x64 processor and to a computer with 8 x64 processors in SMP configuration only requires access to the default x64 installation image. Practice exercise 2 at the end of this lesson covers the specifics ol adding a default installation image to a WDS server.