Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 231:

  A company currently has a Remote Desktop Services (RDS) farm consisting of three Remote Desktop Session Hosts (RD Session Hosts) and one Remote Desktop Session Broker (RD Session Broker). The RD Session Hosts are configured to use Windows Network Load Balancing.

  The RDS servers run slowly every Monday morning between 9:00 A.M. and 11:00 A.M.

  You establish that your third-party backup solution is running on the RDS servers at these times and is causing the poor performance. Company policy mandates that the backup must occur at this time.

  You have the following requirements:

  1. Implement Windows System Resource Manager (WSRM) on each of the RDS servers to minimize the system resources utilized by the backup Application.

  2. Ensure that WSRM runs only when required.

  You need to configure WSRM.

  Which actions should you perform in sequence?

  To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. (Use only actions that Apply.)

  Select and Place:

  

  

  ---

  Process Matching Criteria

  The WSRM process-matching criteria performance object, installed with Windows System Resource Manager (WSRM), consists of counters that monitor the CPU usage and memory usage of the processes matched by the process-matching criteria. The criteria are included in the managing resource-allocation policy. Each object will have as many instances as the number of process-matching criteria within the current active policy.

  Resource Allocation Policy

  Allocate processor and memory resources to processes that are specified by the process matching criteria that you create.

  Also see http://www.techrepublic.com/article/use-windows-system-resource-manager-to-control-aserverspowers/5178054

• Question 232:

  A company wants to prevent employees who access the company's Remote Desktop Session

  Hosts (RD Session Hosts) from introducing malware onto the corporate network.

  You have the following requirements:

  -

  Ensure that only client computers that have an up-to-date antivirus program installed can connect to the RD Session Hosts.

  -

  Display a notification when a client computer that does not meet the antivirus requirements attempts to connect to an RD Session Host. Provide information about how to resolve the connection problem.

  -

  Ensure that client computers can access only the RD Session Hosts.

  You need to recommend a Remote Desktop Services (RDS) management strategy that meets the requirements.

  What should you recommend? (More than one answer choice may achieve the goal. Select the BEST answer.)

  A. Deploy a Remote Desktop Gateway in a perimeter network. Install and configure a Network Policy and Access Services server. Configure the System Health Validator. Enable the Remote Desktop Gateway Network Access Protection Enforcement Client. Configure Remote Desktop Connection Authorization Policies and Remote Desktop Resource Authorization Polices.
  B. Deploy the Routing and Remote Access Service in a perimeter network to support VPN connections. Install and configure a Network Policy and Access Services server. Enable the Network Access Protection VPN Enforcement Client. Configure the System Health Validator. Configure static routes on the VPN server to allow access only to the RD Session Hosts.
  C. Deploy a Remote Desktop Gateway in a perimeter network. Configure Remote Desktop Connection Authorization Policies and Remote Desktop Resource Authorization Polices. Configure a logon message.
  D. Deploy the Routing and Remote Access Service in a perimeter network to support VPN connections. Configure Connection Request Policies to specify which computers can connect to the corporate network. Configure static routes on the VPN server to allow access only to the RD Session Hosts.
  A. Deploy a Remote Desktop Gateway in a perimeter network. Install and configure a Network Policy and Access Services server. Configure the System Health Validator. Enable the Remote Desktop Gateway Network Access Protection Enforcement Client. Configure Remote Desktop Connection Authorization Policies and Remote Desktop Resource Authorization Polices.

  ---

  NAP with SHVs configured will ensure that the AV is installed and up to date. if they ar not you can direct them to a quarantine/remediation server to update http://www.techrepublic.com/article/solutionbase-configuring-network-access-protection-for-windows-server-2008/178022

  RD RAP Remote Desktop resource authorization policies (RD RAPs) allow you to specify the internal network resources (computers) that remote users can connect to through an RD Gateway server. http://technet.microsoft.com/en-us/library/cc730630

  RD CAP Remote Desktop connection authorization policies (RD CAPs) allow you to specify who can connect to an RD

  Gateway server http://technet.microsoft.com/en-us/library/cc731544

• Question 233:

  You need to recommend a solution for promoting the RODC in the new branch office. What should you include in the recommendation?

  A. Active Directory snapshots
  B. an unattended answer file
  C. Install From Media (IFM)
  D. Answer ID D
  C. Install From Media (IFM)

  ---

  http://technet.microsoft.com/en-us/library/cc816722%28WS.10%29.aspx

  When you install Active Directory Domain Services (AD DS) by using the install from media (IFM) method, you can reduce the replication traffic that is initiated during the installation of an additional domain controller in an Active Directory

  domain. Reducing the replication traffic reduces the time that is necessary to install the additional domain controller.

  Topic 14, Blue Yonder Airlines

  Scenario

  COMPANY OVERVIEW

  Blue Yonder Airlines has a main office and four branch offices. Each branch office has six satellite offices. The main office is located in Sydney. The branch offices are located in London, New York, Bangkok, and Istanbul. The main office has

  1,000 users. Each branch office has 500 users. Each satellite office has 50 to 100 users.

  PLANNED CHANGES

  Each satellite office will have a single server deployed. The servers will have the following server roles installed:

  -File server

  -Print server

  -Read-only Domain Controller (RODC)

  Each satellite office will have a local support technician who performs the following tasks:

  -Manages printers.

  -Manages server backups.

  -Manages updates on the server.

  Each support technician will only be permitted to manage the server located in his office.

  You plan to implement a backup and recovery solution to restore deleted Active Directory objects.

  The solution must ensure that the attributes of the deleted objects are restored to the same state they were in before they were deleted.

  You plan to deploy a custom sales Application named App2 to the portable computers of all company sales consultants. The setup program of App2 requires local administrative privileges.

  App2 will be updated monthly.

  BUSINESS GOALS

  Blue Yonder Airlines has the following business goals:

  -Minimize server downtime.

  -Minimize administrative effort.

  Minimize interruptions to users caused by WAN link failures.

  EXISTING ENVIRONMENT

  The network contains servers that run either Windows Server 2008 R2 or Windows Server 2008.

  All client computers were recently replaced with new computers that run Windows 7 Enterprise.

  Users do not have local administrator rights on the client computers.

  Existing Active Directory/Directory Services

  The network contains a single Active Directory domain named blueyonderairlines.com. The functional level of the domain is Windows Server 2008. All domain controllers run Windows Server 2008.

  Existing Network Infrastructure

  All offices have wired and wireless networks.

  The main office has a file server that stores large graphics files. The files are used by all of the users in all of the offices.

  A Group Policy is used to assign an Application named App1 to all of the users in the domain.

  The branch offices contain public computers on which temporary employees can browse the Internet and view electronic brochures. When the employees log on to the public computers, they must all receive the same user settings.

  App1 must not be installed on the public computers. The computer accounts for all of the public computers are in an organizational unit (OU) name Public.

  REQUIREMENTS

  Security Requirements

  All computers in the domain must have a domain-level security Group Policy object (GPO) App1ied.

  You plan to implement Network Access Protection (NAP) by using switches and wireless access points (WAPs) as NAP enforcement points.

  The public computers must meet the following security requirements:

  -Only authorized Applications must be run.

  -Automatic updates must be enabled and App1ied automatically.

  Users must be denied access to the local hard disk drives and the network shares from the public computers.

  Technical Requirements

  The file server in each branch office is configured as shown in the following table.

  

  Each user is allocated 1 GB of storage on the Users share in their local office.

  Each user must be prevented from storing files larger than 500 MB on the Data share in their local office.

  Blue Yonder Airlines must meet the following requirements for managing App2:

  -Sales consultants must use the latest version of the Application.

  -When a new version of App2 is installed, the previous version must be uninstalled. Sales consultants must be able to run App2 when they are disconnected from the network.

• Question 234:

  Your network contains a single Active Directory domain. You have 100 servers that run Windows Server 2008 R2 and 5,000 client computers that run Windows 7. You plan to deploy Applications to the client computers.

  You need to recommend an Application deployment strategy that meets the following requirements:

  -Applications must be deployed only to client computers that meet the minimum hardware

  requirements.

  -Deployments must be scheduled to occur outside business hours.

  -Detailed reports on the success or failure of the Application deployments must be provided.

  What should you recommend?

  A. Deploy Applications by using Group Policy.
  B. Implement Windows Server Update Services (WSUS).
  C. Implement Microsoft System Center Operations Manager (SCOM) 2007 R2.
  D. Implement Microsoft System Center Configuration Manager (SCCM) 2007 R2.
  D. Implement Microsoft System Center Configuration Manager (SCCM) 2007 R2.

  ---

  http://technet.microsoft.com/en-us/library/bb680651.aspx

  Welcome to Microsoft System Center Configuration Manager 2007. Configuration Manager 2007 contributes to a more effective Information Technology (IT) department by enabling secure and scalable operating system and application

  deployment and desired configuration management, enhancing system security, and providing comprehensive asset management of servers, desktops, and mobile devices.

  Post-Setup Configuration Tasks

  After Setup has run, there are still a few tasks you must perform to have a functioning Configuration Manager 2007 site. For example, you might need to assign new site system roles

  and install clients. For more information, see Checklist for Required Post Setup Configuration Tasks.

  Common Configuration Manager Tasks

  For more information about how to do common Configuration Manager 2007 tasks, see the following topics.

• Question 235:

  You need to recommend a strategy for delegating administration to the consulting firm. What should you recommend?

  A. Create local user accounts.
  B. Create domain user accounts.
  C. Create IIS Manager user accounts.
  D. Implement Active Directory Lightweight Directory Services (AD LDS).
  C. Create IIS Manager user accounts.

  ---

  http://technet.microsoft.com/en-us/library/cc732621%28WS.10%29.aspx

  Add an IIS Manager user account in IIS Manager when you want to allow a user to connect to a site or an application on your server, but you do not want to create a Windows user account or add the user to a Windows group. IIS Manager

  user credentials consist of a user name and password that are created in IIS Manager and are used exclusively for IIS Manager to access the IIS configuration files.

  After you create an IIS Manager user account, you can allow the user to connect to sites and applications. The user can then configure delegated features in those sites and applications.

• Question 236:

  You need to recommend changes to the existing environment that meet the company's security requirements for the file server on the main campus.

  What should you recommend?

  A. Deploy Network Policy Server (NPS) and create a network policy.
  B. Deploy Print and Document Services and create a custom printer filter.
  C. Deploy File Server Resource Manager (FSRM) and create a file classification rule.
  D. Deploy Active Directory Rights Management Services (AD RMS) and create an AD RMS rights policy template.
  D. Deploy Active Directory Rights Management Services (AD RMS) and create an AD RMS rights policy template.

  ---

  http://technet.microsoft.com/en-us/library/dd996658%28WS.10%29.aspx

  Rights policy templates are used to control the rights that a user or group has on a particular piece of rightsprotected content. Active Directory Rights Management Services (AD RMS) stores rights policy templates in the configuration database. Optionally, it may maintain a copy of all rights policy templates in a shared folder that you specify.

• Question 237:

  You are evaluating whether to deploy Hyper-V.

  Which technical requirement is NOT met by a HyperV deployment?

  A. Allocate CPU resources between VMs.
  B. Simplify the management of all hardware.
  C. Ensure that the VMs can connect to multiple VLANs.
  D. Minimize the amount of administrative effort required to convert physical servers to VMs.
  D. Minimize the amount of administrative effort required to convert physical servers to VMs.

• Question 238:

  You need to recommend a domain controller deployment strategy for Branch2 that meets the museum's technical requirements. What should you recommend for Branch2?

  A. Deploy two writable domain controllers in ad.baldwinmuseumofscience. Configure both domain controllers as global catalog servers.
  B. Deploy two read only domain controllers (RODCs) in ad.baldwin museum of science. Configure both RODCs as global catalog servers.
  C. Deploy one writable domain controller in baldwinmuseumofscience.com and one writable domain controller in ad.baldwinmuseumofscience. Enable universal group membership caching.
  D. Deploy one read only domain controller (RODC) in baldwinmuseumofscience.com and one writable domain controller in ad.baldwinmuseumofscience. Enable universal group membership caching.
  A. Deploy two writable domain controllers in ad.baldwinmuseumofscience. Configure both domain controllers as global catalog servers.

  ---

  http://technet.microsoft.com/en-us/library/dd735489%28WS.10%29.aspx

  Read-only domain controllers (RODCs) do not introduce any significant new considerations for determining whether to make a branch domain controller a global catalog server. Global catalog placement generally requires planning unless you have a single-domain forest. In a single-domain forest, you can configure all domain controllers as global catalog servers without causing any additional replication or an increase in disk size or CPU usage.

  However, only domain controllers that are designated as global catalog servers can respond to global catalog queries on the global catalog Lightweight Directory Access Protocol (LDAP) port 3268. Designating all domain controllers as global catalog servers eliminates server or network capacity planning concerns about which domain controllers can respond to global catalog queries by applications or other domain controllers.

  In a multiple-domain forest, deciding whether a domain controller should be a global catalog server takes extra planning. As a general rule, it is best to make branch-office domain controllers (including branch-office RODCs) be global catalog servers so that authentication--and, generally, any global catalog query--can be performed by using just the RODC. This comes, however, at the price of replicating the partial attribute set for objects from every domain in the forest to the branch office, which may be expensive in terms of network and disk usage if some domains have large amounts of users, computers, or groups with a high rate of updates.

  If you determine that you cannot make the branch-office domain controller a global catalog server, you should enable universal group caching in that site. With universal group membership enabled, a domain controller must connect to a global catalog server across a wide area network (WAN) link only for initial logons in the site.

  Thereafter, universal group membership can be checked from a local cache.

• Question 239:

  You need to recommend a security strategy for WebApp2 that meets the company's Application requirements. What should you include in the recommendation?

  A. Basic authentication and SSL
  B. Digest authentication and SSL
  C. Digest authentication and SSL VPN
  D. Basic authentication and SSL VPN
  A. Basic authentication and SSL

  ---

  You must support multiple browsers and one advantage of the basic access authentication is all web browsers support it. But due to the fact that the username and password are passed in cleartext, it is rarely used by itself on publicly accessible Internet web sites. However, it is somewhat commonly found on publicly accessible sites if combined with SSL/TLS (HTTPS). The use of SSL/TLS to encrypt the entire connection mitigates the fact that the Basic passwords themselves are not encrypted. Most browsers will actually display an alert of some kind if a site uses Basic Auth without SSL/TLS, but will not display an alert when Basic Auth is used on a connection that has SSL/TLS enabled.

• Question 240:

  You need to recommend a strategy for using managed service accounts on the Web servers.

  Which managed service accounts should you recommend?

  A. One account for all the web servers.
  B. One account for each web server.
  C. One account for the parent domain and one account for both child domains.
  D. One account for the parent domain and one account for each child domain.
  B. One account for each web server.

  ---

  There are 5 web servers in total, 3 in the forest root domain and 1 in each child domain.

  Service Account Vulnerability

  The practice of configuring services to use domain accounts for authentication leads to potential security exposure. The degree of risk exposure is dependent on various factors, including:

  The number of servers that have services that are configured to use service accounts. The vulnerability profile of a network increases for every server that has domain account authenticated services that run on that server. The existence of

  each such server increases the odds that an attacker might compromise that server, which can be used to escalate privileges to other resources on a network.

  The scope of privileges for any given domain account that services use. The larger the scope of privileges that a service account has, the greater the number of resources that can be

  compromised by that account.

  Domain administrator level privileges are a particularly high risk, because the scope of vulnerability for such accounts includes any computer on the network, including the domain

  controllers. Because such accounts have administrative privileges to all member servers, the compromise of such an account would be severe and all computers and data in the domain would be suspect.

  The number of services configured to use domain accounts on any given server. Some services have unique vulnerabilities, which make them somewhat more susceptible to attacks. Attackers will usually attempt to exploit known

  vulnerabilities first. Use of a domain account by a vulnerable service presents an escalated risk to other systems, which could have otherwise been isolated to a single server.

  The number of domain accounts that are used to run services in a domain. Monitoring and managing the security of service accounts requires more diligence than ordinary user accounts, and each additional domain account in use by

  services only complicates administration of those accounts. Given that administrators and security administrators need to know where each service account is used to detect suspicious activity highlights the need to minimize the number of

  those accounts.

  The preceding factors lead to several possible vulnerability scenarios that can exist, each with a different level of potential security risk. The following diagram and table describe these scenarios.

  For these examples it is assumed that the service accounts are domain accounts and each account has at least one service on each server using it for authentication. The following

  information describes the domain accounts shown in the following figure.

  Account A has Administrator-equivalent privileges to more than one domain controller.

  Account B has administrator-equivalent privileges on all member servers.

  Account C has Administrator-equivalent privileges on servers 2 and 3.

  Account D has Administrator-equivalent privileges on servers 4 and 5.

  Account E has Administrator-equivalent privileges on a single member server only.