Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 211:

  You need to recommend the minimum number of logical unit numbers (LUNs) that must be provisioned for Cluster1. The recommendation must support the company's planned changes. Which number should you recommend?

  A. 1
  B. 2
  C. 8
  D. 9
  B. 2

  ---

  LUN Stands for "Logical Unit Number." LUNs are used to identify SCSI devices, such as external hard drives, connected to a computer. Each device is assigned a LUN, from 0 to 7, which serves as the device's unique address.

  LUNs can also be used for identifying virtual hard disk partitions, which are used in RAID configurations. For example, a single hard drive may be partitioned into multiple volumes. Each volume can then be assigned a unique LUN.

  A failover cluster is a group of independent computers that work together to increase the availability of applications and services. The clustered servers (called nodes) are connected by

  physical cables and by software. If one of the cluster nodes fails, another node begins to provide service (a process known as failover).

  Users experience a minimum of disruptions in service.

  In simple terms, the quorum for a cluster is the number of elements that must be online for that cluster to continue running. In effect, each element can cast one "vote" to determine whether the cluster continues running. The voting elements

  are nodes or, in some cases, a disk witness or file share witness. Each voting element (with the exception of a file share witness) contains a copy of the cluster configuration, and the Cluster service works to keep all copies synchronized at all

  times.

  There are four quorum modes:

  Node Majority: Each node that is available and in communication can vote. The cluster functions only with a majority of the votes, that is, more than half.

  Node and Disk Majority: Each node plus a designated disk in the cluster storage (the "disk witness") can vote, whenever they are available and in communication. The cluster functions only with a majority of the votes, that is, more than half.

  Node and File Share Majority: Each node plus a designated file share created by the administrator (the "file share witness") can vote, whenever they are available and in communication. The cluster functions only with a majority of the votes,

  that is, more than half.

  No Majority: Disk Only: The cluster has quorum if one node is available and in communication with a specific disk in the cluster storage.

  Choosing the quorum mode for a particular cluster

  The following table describes clusters based on the number of nodes and other cluster characteristics, and lists the quorum mode that is recommended in most cases.

  A "multi-site" cluster is a cluster in which an investment has been made to place sets of nodes and storage in physically separate locations, providing a disaster recovery solution.

  

  as the Quorum will be set to Node And Disk Majority this means we need an even number of nodes which we have (node1 and node2)

• Question 212:

  You need to recommend a backup solution for the VMs that meets the museum's technical requirements.

  What should you include in the recommendation?

  A. On each VM, perform a full server backup by using Windows Server Backup.
  B. On each physical node, perform a full server backup by using Windows Server Backup.
  C. Deploy Microsoft System Center Data Protection Manager 2010 and create a new protection group.
  D. Deploy Microsoft System Center Virtual Machine Manager (VMM) 2008 R2 and schedule checkpoints
  C. Deploy Microsoft System Center Data Protection Manager 2010 and create a new protection group.

  ---

  http://technet.microsoft.com/en-us/library/ff399260.aspx

  What is Data Protection Manager?

  Microsoft System Center Data Protection Manager (DPM) 2010 is a member of the Microsoft System Center family of management products, designed to help IT professionals manage their Windows environment. DPM provides Windows

  backup and recovery--delivering seamless data protection for Microsoft application and file servers by using integrated disk and tape media. DPM performs replication, synchronization, and recovery point creation to provide reliable protection

  and rapid recovery of data for both system administrators and endusers.

  What is a custom volume?

  You can assign a custom volume to a protection group member, in place of the DPM storage pool.

  A custom volume is a volume that is not in the DPM storage pool and is specified to store the replica and recovery points for a protection group member.

  Any volume that is attached to the DPM server can be selected as a custom volume, except the volume that contains the system and program files. To use custom volumes for a protection group member, two custom volumes must be

  available: one volume to store the replica and one volume to store the recovery points

• Question 213:

  You need to ensure that Admin1 can administer the Web servers to meet the company's technical requirements. To which group should you add Admin1?

  A. the Administrators local group on each Web server
  B. the Backup Operators domain local group
  C. the Backup Operators local group on each Web server
  D. the Domain Admins global group
  C. the Backup Operators local group on each Web server

  ---

  The requirements are:

  Restarting all of the Web servers.

  Backing up and restoring the files on all of the Web servers

  Backup Operators

  Members of this group can back up and restore files on a computer, regardless of any permissions that protect those files. This is because the right to perform a backup takes precedence over all file permissions. Members of this group

  cannot change security settings.

  1.

  Access this computer from the network

  2.

  Allow logon locally

  3.

  Back up files and directories

  4.

  Bypass traverse checking

  5.

  Log on as a batch job

  6.

  Restore files and directories

  7.

  Shut down the system Topic 10, Litware, Inc Scenario COMPANY OVERVIEW Litware, Inc. is a manufacturing company that has a main office and two branch office. The main office is located in Montreal. The branch offices are located in Seattle and New York. The main office has 4,000 users. The branch offices each

  have 500 users.

  PLANNED CHANGES

  Litware plans to open a new sales office. The sales office will have a direct connection to the

  Internet. The sales office will have a single server.

  The sales office requires a connection to the Montreal office. The connection to the Montreal office must use either TCP port 80 or TCP port 443.

  The network currently contains a Fibre Channel Storage Area Network (SAN). A new iSCSI SAN will be implemented during the next month. The current SAN and the new SAN are from different manufacturers. Both SANs use a virtual disk

  service (VDS) interface.

  EXISTING ENVIRONMENT

  All servers run Windows Server 2008 R2. All client computers run Windows 7 Enterprise.

  The main office has a single DHCP server. The IP addresses for all of the client computers must be assigned from the DHCP server.

  All software is installed from a central software distribution point in the main office. Software deployments for the branch offices frequently fail due to bandwidth limitations.

  Existing Active Directory/Directory Services

  The network contains a single Active Directory domain named litwareinc.com. Each office has two domain controllers.

  Current Administration Model

  Currently, all help desk users have full administrator rights to the servers. The help desk users use Remote Desktop to log on to the servers and perform tasks such as managing Active Directory user accounts and creating DHCP

  reservations.

  TECHNICAL REQUIREMENTS

  Windows Firewall must be managed by using the minimum amount of administrative effort.

  Windows Firewall configurations must be duplicated easily between servers that have the same server role.

  Litware must centralize the monitoring of critical system events. The monitoring solution must use the existing infrastructure.

  Litware plans to prevent help desk users from interactively logging on to servers. Help desk users must not have full administrator rights to the servers.

  The software deployment process must be updated to meet the following requirements:

  -Application source files must be centrally managed.

  - Software deployments to the offices in Seattle and New York must remain unaffected if a WAN link fails.

  The SANs must be administered by using a single tool.

• Question 214:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2. There are five Windows Server 2003 SP2 servers that have the Terminal Server component installed. A firewall server runs Microsoft Internet Security and Acceleration (ISA) Server 2006.

  You need to create a remote access strategy for the Remote Desktop Services servers that meets the following requirements:

  -Restricts access to specific users

  -Minimizes the number of open ports on the firewall

  - Encrypts all remote connections to the Remote Desktop Services servers

  What should you do?

  A. Implement SSL bridging on the ISA Server. Require authentication on all inbound connections to the ISA Server.
  B. Implement port forwarding on the ISA Server. Require authentication on all inbound connections to the ISA Server.
  C. Upgrade a Windows Server 2003 SP2 server to Windows Server 2008 R2. On the Windows Server 2008 R2 server, implement the Remote Desktop Gateway (RD Gateway) role service, and configure a Remote Desktop resource authorization policy (RD RAP).
  D. Upgrade a Windows Server 2003 SP2 server to Windows Server 2008 R2. On the Windows Server 2008 R2 server, implement the Remote Desktop Gateway (RD Gateway) role service, and configure a Remote Desktop connection authorization policy (RD CAP).
  D. Upgrade a Windows Server 2003 SP2 server to Windows Server 2008 R2. On the Windows Server 2008 R2 server, implement the Remote Desktop Gateway (RD Gateway) role service, and configure a Remote Desktop connection authorization policy (RD CAP).

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration:

  Terminal Services Gateway TS Gateway allows Internet clients secure, encrypted access to Terminal Servers behind your organization's firewall without having to deploy a Virtual Private Network (VPN) solution. This means that you can have users interacting with their corporate desktop or applications from the comfort of their homes without the problems that occur when VPNs are configured to run over multiple Network Address Translation (NAT) gateways and the firewalls of multiple vendors.

  TS Gateway works using RDP over Secure Hypertext Transfer Protocol (HTTPS), which is the same protocol used by Microsoft Office Outlook 2007 to access corporate Exchange Server 2007 Client Access Servers over the Internet. TS Gateway Servers can be configured with connection authorization policies and resource authorization policies as a way of differentiating access to Terminal Servers and network resources.

  Connection authorization policies allow access based on a set of conditions specified by the administrator; resource authorization policies grant access to specific Terminal Server resources based on user account properties.

  Connection Authorization Policies Terminal Services connection authorization policies (TS-CAPs) specify which users are allowed to connect through the TS Gateway Server to resources located on your organization's internal network. This is usually done by specifying a local group on the TS Gateway Server or a group within Active Directory. Groups can include user or computer accounts. You can also use TS- CAPs to specify whether remote clients use password or smart-card authentication to access internal network resources through the TS Gateway Server. You can use TS-CAPs in conjunction with NAP; this scenario is covered in more detail by the next lesson.

• Question 215:

  You need to deploy a WSUS server in the branch office that meets the company's technical requirements. What should you deploy?

  A. an autonomous WSUS server that is configured to download updates from Microsoft Update
  B. an autonomous WSUS server that is configured to download updates from the WSUS server in the main office
  C. a WSUS server running in replica mode that is configured to download updates from Microsoft Update
  D. a WSUS server running in replica mode that is configured to download updates from the WSUS server in the main office
  D. a WSUS server running in replica mode that is configured to download updates from the WSUS server in the main office

  ---

  http://technet.microsoft.com/en-us/library/dd939820%28WS.10%29.aspx

  All clients computers on the network connect to the main office via a highly saturated link, they don't have an independant link so updates must come from HQ Replica mode (centralized administration) In replica mode, an upstream WSUS server shares updates, approval status, and computer groups with downstream servers. Downstream replica servers inherit update approvals and are not administered separately from the upstream WSUS server.

  The following image shows how you might deploy replica WSUS servers in a branch office environment.

  

  It says that all branch PCs on the network connect to the internet by using a single internet connection at the main office.

  To me that implies that all traffic to the branch travels thorugh the main office so if the branch updated from MS it has to come through the main office so you'd be downloading the same patches twice, that is wasting bandwidth and one requirement is to minimize bandwidth usage

• Question 216:

  You need to recommend changes to the name resolution infrastructure that meet the company's technical requirements.

  What should you recommend?

  A. Create a stub zone on all of the DNS servers in the branch offices.
  B. Create a secondary zone on all of the DNS servers in the branch offices.
  C. Move the DNS zone of the root domain to the ForestDnsZones Application directory partition.
  D. Move the DNS zone of each branch office to the ForestDnsZones Application directory partition.
  C. Move the DNS zone of the root domain to the ForestDnsZones Application directory partition.

  ---

  To reduce replication traffic and the amount of data stored in the global catalog, you can use application directory partitions for Active Directory璱ntegrated DNS zones. http://technet.microsoft.com/en-us/library/cc772101.aspx

  All domain controllers in a specified application directory partition

  Replicates zone data according to the replication scope of the specified application directory partition. For a zone to be stored in the specified application directory partition, the DNS server hosting the zone must be enlisted in the specified application directory partition. Use this scope when you want zone data to be replicated to domain controllers in multiple domains but you do not want the data to replicate to the entire forest.

• Question 217:

  You are designing a monitoring solution to log performance for servers that run Windows Server 2008 R2.

  The monitoring solution must allow members of the Performance Log Users group to create and modify Data Collector Sets.

  You need to grant members of the Performance Log Users group the necessary permissions.

  Which User Rights Assignment policy should you configure?

  To answer, select the appropriate User Rights Assignment policy in the answer area.

  Hot Area:

  

  

  ---

  Log on as a batch job

  http://technet.microsoft.com/en-us/library/dd349804%28v=ws.10%29.aspx#BKMK_30

  This policy setting determines which accounts can log on by using a batch-queue tool such as the Task Scheduler service. When an administrator uses the Add Scheduled Task wizard to schedule a task to run under a particular user name and password, that user is automatically assigned the Log on as a batch job user right. When the scheduled time arrives, the Task Scheduler service logs the user on as a batch job instead of as an interactive user, and the task runs in the user's security context.

  Possible values:

  User-defined list of accounts

  Not Defined

  Vulnerability

  The Log on as a batch job user right presents a low-risk vulnerability. For most organizations, the default setting of Not Defined is sufficient. Members of the local Administrators group have this right by default.

  Countermeasure

  You should allow the computer to manage this logon right automatically if you want to allow scheduled tasks to run for specific user accounts. If you do not want to use the Task Scheduler in this manner, configure the Log on as a batch job user right for only the Local Service account.

  For IIS servers, you should configure this policy locally instead of through domain–based Group Policy settings so that you can ensure that the local IUSR_ and IWAM_ accounts have this logon right.

  Potential impact

  If you configure the Log on as a batch job setting by using domain-based Group Policy settings, the computer cannot assign the user right to accounts that are used for scheduled jobs in the Task Scheduler. If you install optional components such as ASP.NET or IIS, you may need to assign this user right to additional accounts that are required by those components. For example, IIS requires assignment of this user right to the IIS_WPG group and the IUSR_, ASPNET, and IWAM_ accounts. If this user right is not assigned to this group and these accounts, IIS cannot run some COM objects that are necessary for proper functionality.

• Question 218:

  You need to recommend a solution for controlling access to the Internet. The solution must meet the museum's security policy. What should you include in the recommendation?

  A. File Server Resource Manager (FSRM) file screens and Group Policy objects (GPOs)
  B. Microsoft Forefront Threat Management Gateway (TMG) 2010
  C. Microsoft Forefront Unified Access Gateway (UAG) 2010
  D. Windows Firewall with Advanced Security and Group Policy objects (GPOs)
  B. Microsoft Forefront Threat Management Gateway (TMG) 2010

  ---

  http://www.microsoft.com/download/en/details.aspx?displaylang=enandid=14238 Forefront Threat Management Gateway 2010 allows employees to safely and productively use the Internet without worrying about malware and other threats.

  It provides multiple protection capabilities including URL filtering*, antimalware inspection*, intrusion prevention, application- and network-layer firewall, and HTTP/HTTPS inspection ?that are integrated into a unified, easy to manage gateway,

  reducing the cost and complexity of Web security.

  http://www.isaserver.org/tutorials/Creating-Web-Access-Policy-Forefront-Threat-Management-Gateway-TMGBeta-1-Part1.html

• Question 219:

  You need to recommend an update management strategy for the Chicago campus that meets the company's technical requirements. What should you recommend?

  A. Deploy a WSUS server in replica mode, and then configure the server's reporting rollup settings.
  B. Deploy a WSUS server in replica mode, and then configure the server's email notification settings.
  C. Deploy a WSUS server in autonomous mode, and then configure the server's reporting rollup settings.
  D. Deploy a WSUS server in autonomous mode, and then configure the server's email notification settings.
  D. Deploy a WSUS server in autonomous mode, and then configure the server's email notification settings.

  ---

  http://technet.microsoft.com/en-us/library/dd939820%28WS.10%29.aspx

  Autonomous mode (distributed administration)

  Distributed management by using autonomous mode is the default installation option for WSUS. In autonomous mode, an upstream WSUS server shares updates with downstream servers during synchronization. Downstream WSUS servers

  are administered separately and they do not receive update approval status or computer group information from the upstream server. By using the distributed management model, each WSUS server administrator selects update languages,

  creates computer groups, assigns computers to groups, tests and approves updates, and makes sure that the correct updates are installed to the appropriate computer groups.

  The following image shows how you might deploy autonomous WSUS servers in a branch office environment:

  

• Question 220:

  You need to recommend a server build for the Web servers.

  Which server build should you recommend?

  A. Class 1
  B. Class 2
  C. Class 3
  D. Class 4
  A. Class 1

  ---