Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 221:

  You need to delegate print administration to meet the company requirements.

  What should you do?

  To answer, select the appropriate check boxes in the dialog box.

  Hot Area:

  

  

  ---

  The two levels of print server permissions are:

  View Server

  The View Server permission assigns the ability to view the print server. Without the View Server permission, users cannot see the printers that are managed by the server. By default, this permission is given to members of the Everyone group.

  Manage Server

  The Manage Server permission assigns the ability to create and delete print queues (with already installed drivers), add or delete ports, and add or delete forms. A standard user with this permission is called a “delegated print administrator.”

  The three levels of printer permissions are:

  Print

  The Print permission assigns the ability for users to connect to printers and to print, pause, resume, start, and cancel their own documents. By default, this permission is given to members of the Everyone group when a print queue is created.

  Manage Documents

  The Manage Documents permission assigns the ability to control job settings for all documents and to pause, restart, and delete all documents.

  Manage Printers

  The Manage Printer permission assigns the ability to pause and restart the printer, change spooler settings, share a printer, adjust printer permissions, and change printer properties.

  To create a full delegated print administrator Click Start, click Administrative Tools, right-click Print Management, and then click Run as administrator.

  In the left pane, click Print Servers, right-click the applicable print server, and then click Properties.

  In Print Server Properties, click the Security tab.

  To configure permissions for a new group or user, click Add. Type the name of the group or user that you want to set permissions for by using the following format: domain name\username. Click OK to close the dialog box.

  highlight the user or group name that you just added, and in Permissions for , click Allow for the Manage Server permission. (The View Server permission is assigned too.)

  Select the Allow check boxes for the Print, Manage Documents, and Manage Printers permissions.

  To create a partial delegated print administrator

  To enable an administrator to add printers:

  Follow the previous instructions, but select the Allow check boxes for the Manage Server and Print permissions. (View Server permission is assigned automatically too.) To enable an administrator to manage existing print queues:

  Follow the previous instructions, but select the Allow check boxes for the View Server, Print, Manage Documents, and Manage Printer permissions. Print-related permissions and the tasks they enable

• Question 222:

  You need to recommend a strategy for managing the domain controllers in the branch offices that meets the company security requirements. What should you include in the recommendation?

  A. Configure Administration Role Separation.
  B. Add the BranchAdmins group to the Domains Admins group.
  C. Add the BranchAdmins group to the Server Operators group.
  D. Assign the permission for the domain controller computer objects to the BranchAdmins group.
  B. Add the BranchAdmins group to the Domains Admins group.

• Question 223:

  You need to recommend an RD Gateway configuration that meets the company's technical requirements. What should you recommend?

  A. Create two Remote Desktop connection authorization policies (RD CAPs) and one Remote Desktop resource authorization policy (RD RAP).
  B. Create one Remote Desktop connection authorization policy (RD CAP) and two Remote Desktop resource authorization policies (RD RAPs).
  C. Create one Remote Desktop resource authorization policy (RD RAP) and deploy the Remote Desktop Connection Broker (RD Connection Broker) role service.
  D. Create one Remote Desktop connection authorization policy (RD CAP) and deploy the Remote Desktop Connection Broker (RD Connection Broker) role service.
  B. Create one Remote Desktop connection authorization policy (RD CAP) and two Remote Desktop resource authorization policies (RD RAPs).

  ---

  CAP=who can connect RAP=what resources are available

  Connection Authorization Policies (CAP)

  Terminal Services connection authorization policies (TS-CAPs) specify which users are allowed to connect through the TS Gateway Server to resources located on your organization's internal network. This is usually done by specifying a local

  group on the TS Gateway Server or a group within Active Directory. Groups can include user or computer accounts. You can also use TS-CAPs to specify whether remote clients use password or smart-card authentication to access internal

  network resources through the TS Gateway Server. You can use TS-CAPs in conjunction with NAP; this scenario is covered in more detail by the next lesson.

  Resource Authorization Policies (RAP)

  Terminal Services resource authorization policies (TS-RAPs) are used to determine the specific resources on an organization's network that an incoming TS Gateway client can connect to. When you create a TS-RAP you specify a group of

  computers that you want to grant access to and the group of users that you will allow this access to. For example, you could create a group of computers called AccountsComputers that will be accessible to members of the Accountants user

  group. To be granted access to internal resources, a remote user must meet the conditions of at least one TS-CAP and at least one TS-RAP.

• Question 224:

  Your network contains several Windows Server 2008 R2 servers that run Windows Server Update Services (WSUS). The WSUS servers distribute updates to all computers on the internal network. Remote users connect from their personal

  computers to the internal network by using a splittunnel VPN connection.

  You need to plan a strategy for patch management that deploys updates on the remote users' computers.

  Your strategy must meet the following requirements:

  -Minimize bandwidth use over the VPN connections

  -

  Require updates to be approved on the WSUS servers before they are installed on the client computers. What should you include in your plan?

  A. Create a Group Policy object (GPO) to perform clientside targeting.
  B. Create a computer group for the remote users' computers. Configure the remote users' computers to use the internal WSUS server.
  C. Create a custom connection by using the Connection Manager Administration Kit (CMAK). Deploy the custom connection to all of the remote users' computers.
  D. Deploy an additional WSUS server. Configure the remote users' computers to use the additional WSUS server. Configure the additional WSUS server to leave the updates on the Microsoft Update Web site.
  D. Deploy an additional WSUS server. Configure the remote users' computers to use the additional WSUS server. Configure the additional WSUS server to leave the updates on the Microsoft Update Web site.

  ---

  Performance and Bandwidth Optimization

  Branch offices with slow WAN connections to the central server but broadband connections to the Internet can be configured to get metadata from the central server and update content from the Microsoft Update Web site.

• Question 225:

  You need to recommend a deployment strategy for App1. What should you recommend?

  A. Assign App1 to users by using a Group Policy.
  B. Publish App1 to users by using a Group Policy.
  C. Deploy App1 as a RemoteApp program by using an MSI file.
  D. Deploy App1 as a RemoteApp program by using an RDP file.
  C. Deploy App1 as a RemoteApp program by using an MSI file.

  ---

  http://technet.microsoft.com/en-us/library/cc753844%28WS.10%29.aspx

  USERS SHOLD NOT BE ALLOWED ACCESS ANY EXE FILES ETC so A andB are out What does TS RemoteApp do?

  RemoteApp programs are programs that are accessed remotely through Terminal Services and appear as if they are running on the end user's local computer. Users can run RemoteApp programs side by side with their local programs. A

  user can minimize, maximize, and resize the program window, and can easily start multiple programs at the same time. If a user is running more than one RemoteApp program on the same terminal server, the RemoteApp programs will share

  the same Terminal Services session.

  Users can run RemoteApp programs in a number of ways. They can:

  Double-click a Remote Desktop Protocol (.rdp) file that has been created and distributed by their administrator.

  Double-click a program icon on their desktop or Start menu that has been created and distributed by their administrator with a Windows Installer (.msi) package.

  Double-click a file whose extension is associated with a RemoteApp program. (This can be ed by their administrator with a Windows Installer package.)

  Access a link to the RemoteApp program on a Web site by using TS Web Access.

  The .rdp files and Windows Installer packages contain the settings needed to run RemoteApp programs. After opening the RemoteApp program on a local computer, the user can interact with the program that is running on the terminal server

  as if it were running locally.

• Question 226:

  Your network consists of a single Active Directory forest. The forest contains one Active Directory

  domain. The domain contains eight domain controllers. The domain controllers run Windows Server 2003 Service Pack 2.

  You upgrade one of the domain controllers to Windows Server 2008 R2.

  You need to recommend an Active Directory recovery strategy that supports the recovery of deleted objects.

  The solution must allow deleted objects to be recovered for up to one year after the date of deletion.

  What should you recommend?

  A. Increase the tombstone lifetime for the forest.
  B. Increase the interval of the garbage collection process for the forest.
  C. Configure daily backups of the Windows Server 2008 R2 domain controller.
  D. Enable shadow copies of the drive that contains the Ntds.dit file on the Windows Server 2008 R2 domain controller.
  A. Increase the tombstone lifetime for the forest.

  ---

  The tombstone lifetime must be substantially longer than the expected replication latency between the domain controllers. The interval between cycles of deleting tombstones must be at least as long as the maximum replication propagation delay across the forest. Because the expiration of a tombstone lifetime is based on the time when an object was deleted logically, rather than on the time when a particular server received that tombstone through replication, an object's tombstone is collected as garbage on all servers at approximately the same time. If the tombstone has not yet replicated to a particular domain controller, that DC never records the deletion. This is the reason why you cannot restore a domain controller from a backup that is older than the tombstone lifetime

  By default, the Active Directory tombstone lifetime is sixty days. This value can be changed if necessary. To change this value, the tombstoneLifetime attribute of the CN=Directory Service object in the configuration partition must be modified.

  This is related to server 2003 but should still be relelvant http://www.petri.co.il/changing_the_tombstone_lifetime_windows_ad.htm

  Authoritative Restore When a nonauthoritative restore is performed, objects deleted after the backup was taken will again be deleted when the restored DC replicates with other servers in the domain. On every other DC the object is marked as deleted so that when replication occurs the local copy of the object will also be marked as deleted. The authoritative restore process marks the deleted object in such a way that when replication occurs, the object is restored to active status across the domain. It is important to remember that when an object is deleted it is not instantly removed from Active Directory, but gains an attribute that marks it as deleted until the tombstone lifetime is reached and the object is removed. The tombstone lifetime is the amount of time a deleted object remains in Active Directory and has a default value of 180 days.

  To ensure that the Active Directory database is not updated before the authoritative restore takes place, you use the Directory Services Restore Mode (DSRM) when performing the authoritative restore process. DSRM allows the administrator to perform the necessary restorations and mark the objects as restored before rebooting the DC and allowing those changes to replicate out to other DCs in the domain.

• Question 227:

  You need to protect the confidential data files on File2 against unauthorized offline access. What should you use?

  A. Encrypting File System (EFS) on File2
  B. file screens on Node1 and Node2
  C. NTFS permissions on File2
  D. Windows BitLocker Drive Encryption (BitLocker) on Node1 and Node2
  A. Encrypting File System (EFS) on File2

  ---

  http://technet.microsoft.com/en-us/library/cc749610%28WS.10%29.aspx

  Per-user encryption of offline files Offline copies of files from remote servers can also be encrypted by using EFS. When this option is enabled, each file in the offline cache is encrypted with a public key from the user who cached the file. Thus, only that user has access to the file, and even local administrators cannot read the file without having access to the user's private keys.

• Question 228:

  Your network consists of a single Active Directory domain. All servers run Windows Server 2008 R2. A server named Server1 has the Remote Desktop Services server role installed.

  You notice that several users consume more than 30 percent of the CPU resources throughout the day. You need to prevent users from consuming more than 15 percent of the CPU resources. Administrators must not be limited by the amount of CPU resources that they can consume.

  What should you do?

  A. Implement Windows System Resource Manager (WSRM), and configure user policies.
  B. Implement Windows System Resource Manager (WSRM), and configure session policies.
  C. Configure Performance Monitor, and create a userdefined Data Collector Set.
  D. Configure Performance Monitor, and create an Event Trace Session Data Collector Set.
  A. Implement Windows System Resource Manager (WSRM), and configure user policies.

  ---

  You can use tools such as the Windows System Resource Manager and Performance Monitor to determine memory and processor usage of Terminal Services clients. Once you understand how the Terminal Server's resources are used, you can determine the necessary hardware resources and make a good estimate as to the Terminal Server's overall client capacity. Terminal Server capacity directly influences your deployment plans: A server that has a capacity of 100 clients is not going to perform well when more than 250 clients attempt to connect. Monitoring tools are covered in more detail in "Monitoring Terminal Services" later in this lesson.

  

  Windows System Resource Manager Windows System Resource Manager (WSRM) is a feature that you can install on a Windows Server 2008 computer that controls how resources are allocated. The WSRM console, shown in Figure 5-9, allows an administrator to apply WSRM policies. WSRM includes four default policies and also allows administrators to create their own. The two policies that will most interest you as someone responsible for planning and deploying Terminal Services infrastructure are Equal_Per_User and Equal_Per_Session.

  The Equal_Per_User WSRM policy ensures that each user is allocated resources equally, even when one user has more sessions connected to the Terminal Server than other users. Apply this policy when you allow users to have multiple sessions to the Terminal Server--it stops any one user from monopolizing hardware resources by opening multiple sessions. The Equal_Per_Session policy ensures that each session is allocated resources equally. If applied on a Terminal Server where users are allowed to connect with multiple sessions, this policy can allow those users to gain access to a disproportionate amount of system resources in comparison to users with single sessions.

• Question 229:

  Your network contains an Active Directory domain. The domain contains a Remote Desktop

  Services server that runs Windows Server 2008 R2. All client computers run Windows 7.

  You need to deploy a new line of business application.

  The deployment must meet the following requirements:

  -

  Users must have access to the application from the company portal.

  -

  Users must always have access to the latest version of the application.

  -

  You must minimize the number of applications installed on the client computers. What should you do?

  A. Publish the application to the users by using a Group Policy object (GPO).
  B. Publish the application as a RemoteApp. Enable Remote Desktop Web Access (RD Web Access).
  C. Assign the application to the client computers by using a Group Policy object (GPO).
  D. Deploy the application by using Microsoft System Center Configuration Manager (SCCM) 2007 R2.
  B. Publish the application as a RemoteApp. Enable Remote Desktop Web Access (RD Web Access).

  ---

  http://technet.microsoft.com/en-us/library/cc753844%28WS.10%29.aspx

  http://technet.microsoft.com/en-us/library/cc730673%28WS.10%29.aspx

  Terminal Services RemoteApp (TS RemoteApp)

  Terminal Services RemoteApp (TSRemoteApp) enables organizations to provide access to standard Windows?based programs from virtually any location to users with computers running WindowsVista? WindowsServer?008, or WindowsXP

  with Service Pack3 (SP3). TSRemoteApp is also available to users with computers running WindowsXP with Service Pack2 (SP2), Windows Server2003 with Service Pack1 (SP1), or Windows Server2003 with SP2 that have the new Remote

  Desktop Connection (RDC) client installed.

  What does TSRemoteApp do?

  RemoteApp programs are programs that are accessed remotely through Terminal Services and appear as if they are running on the end user's local computer. Users can run RemoteApp programs side by side with their local programs. A

  user can minimize, maximize, and resize the program window, and can easily start multiple programs at the same time. If a user is running more than one RemoteApp program on the same terminal server, the RemoteApp programs will share

  the same Terminal Services session.

  Users can run RemoteApp programs in a number of ways. They can:

  Double-click a Remote Desktop Protocol (.rdp) file that has been created and distributed by their administrator.

  Double-click a program icon on their desktop or Start menu that has been created and distributed by their administrator with a Windows Installer (.msi) package.

  Double-click a file whose extension is associated with a RemoteApp program. (This can be configured by their administrator with a Windows Installer package.) Access a link to the RemoteApp program on a Web site by using TSWeb Access.

  The .rdp files and Windows Installer packages contain the settings needed to run RemoteApp programs. After opening the RemoteApp program on a local computer, the user can interact with the program that is running on the terminal server

  as if it were running locally.

  Key scenarios for TSRemoteApp

  TSRemoteApp is especially useful in scenarios such as the following:

  Remote users. Users often need to access programs from remote locations, such as while working from home or while traveling. If you want users to access RemoteApp programs over an Internet connection, you can allow access through a

  Virtual Private Network (VPN), or you can deploy TSRemoteApp together with Terminal Services Gateway (TSGateway) to help secure remote access to the programs.

  Branch offices. In a branch office environment, there may be limited local IT support and limited network bandwidth. By using TSRemoteApp, you can centralize the management of your applications and improve remote program performance

  in limited bandwidth scenarios.

  Line-of-business (LOB) applications deployment. Companies often need to run consistent LOB applications on computers that are running different Windows versions and configurations.

  Instead of deploying the LOB applications to all the computers in the company, which can be expensive in terms of time and cost, you can install the LOB applications on a terminal server and make them available through TSRemoteApp.

  Application deployment. With TSRemoteApp you do not have to deploy and maintain different versions of the same program for individual computers. If employees need to use multiple versions of a program, you can install those versions on

  one or more terminal servers, and users can access them through TSRemoteApp.

  Roaming users. In a company with a flexible desk policy, users can work from different computers. In some cases, the computer where a user is working may not have the necessary

  programs installed locally.

  By using TSRemoteApp, you can install the programs on a terminal server and make them available to users as if those programs were installed locally.

• Question 230:

  You are planning a recovery strategy in the event that a file server is unable to boot into Windows.

  You need to ensure that file servers can be restored from backups.

  What should the recovery strategy include?

  A. Deploy backups by using WDS.
  B. Boot from the Windows Server 2008 R2 DVD into the Recovery Environment, then restore from file server backups by using WBAdmin.
  C. Reinstall Windows Server 2008 R2 from DVD, then restore from file server backups by using Windows Server Backup.
  D. Restore from file server backups by using NTBackup.
  A. Deploy backups by using WDS.

  ---

  Thanks to Testy for highlighting this one.

  NTBackup is not compatible with Server 2008 R2.

  Your requirements are for remote backup and remote restore.

  The network has WDS installed and uses PXE boot on the servers so WDS could be used to deploy a backup.

  Windows Recovery Environment (Windows RE) is an extensible recovery platform based on Windows Preinstallation Environment (Windows PE). When the computer fails to start, Windows automatically fails over into this environment, and

  the Startup Repair tool in Windows RE automates the diagnosis and repair of an unbootable Windows Vista installation. Furthermore, Windows RE is a starting point for various tools for manual system recovery. The primary audience of this

  technology includes original equipment manufacturers (OEMs), original device manufacturers (ODMs), and corporate IT professionals.

  Image-based Recovery from Windows RE In the event that the Windows installation cannot be repaired with Startup Repair or other manual repair steps, Windows RE can be used to launch an image-based recovery tool.

  User-created Recovery Image

  Windows Vista provides end users with the ability to create a backup image of their entire operating system.

  End users can do this by using the Backup tool. The system image can be stored on an external hard disk, on a hard disk partition other than those imaged, or on a DVD. To restore the computer by using this system image, users must

  launch the restore interface from the list of Windows RE manual tools.

  Factory-created Recovery Image To facilitate restoring a computer to its factory state, a recovery image can be placed on the Windows RE partition. This eliminates the need for a separate recovery media in most cases.

  If the Windows image format is used in the manufacturing process, the same operating system image can be used for recovery as well. A computer manufacturer can develop an application by using the Imaging APIs for Windows and the

  Windows image to restore the operating system volume. This application can be launched from the Windows RE user interface (UI) by using customizations provided by the ODM.