Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 241:

  Your network consists of a single Active Directory domain. The network includes a branch office named Branch1. Branch1 contains a Read only Domain Controller (RODC) named Server1. A global group named Branch1admins contains the

  user accounts for administrators. Administrators manage the client computers and servers in Branch1.

  You need to recommend a solution for delegating control of Server1.

  Your solution must meet the following requirements:

  - Allow the members of the Branch1admins group to administer Server1 including, change device drivers and install operating system updates by using Windows Update.

  -Provide the Branch1admins group rights on Server1 only.

  -

  Prevent Branch1admins group from modifying Active Directory objects. What should you recommend?

  A. Add the Branch1admins global group to the Server Operators builtin local group.
  B. Add the members of the Branch1admins global group to the Administrators builtin local group of Server1.
  C. Grant Full Control permission on the Server1 computer object in the domain to the Branch1admins group
  D. Move the Server1 computer object to a new organizational unit (OU) named Branch1servers. Grant Full Control permission on the Branch1servers OU to the Branch1admins group.
  B. Add the members of the Branch1admins global group to the Administrators builtin local group of Server1.

  ---

  http://technet.microsoft.com/en-us/library/cc753223%28WS.10%29.aspx

  Administrator role separation Administrator role separation specifies that any domain user or security group can be delegated to be the local administrator of an RODC without granting that user or group any rights for the domain or other domain controllers. Accordingly, a delegated administrator can log on to an RODC to perform maintenance work, such as upgrading a driver, on the server. But the delegated administrator is not able to log on to any other domain controller or perform any other administrative task in the domain. In this way, a security group that comprises branch users, rather than members of the Domain Admins group, can be delegated the ability to effectively manage the RODC in the branch office, without compromising the security of the rest of the domain.

• Question 242:

  You need to recommend a delegation solution for CA1 that meets the company's security requirements. What should you include in the recommendation?

  A. accessbased enumeration (ABE)
  B. Active Directory delegation
  C. Authorization Manager
  D. role separation
  D. role separation

  ---

  http://technet.microsoft.com/en-us/library/cc732590(v=ws.10).aspx You can use role-based administration to organize certification authority (CA) administrators into separate, predefined CA roles, each with its own set of tasks. Roles are assigned by using each user's security settings. You assign a role to a user by assigning that user the specific security settings that are associated with the role. A user that has one type of permission, such as Manage CA permission, can perform specific CA tasks that a user with another

  type of permission, such as Issue and Manage Certificates permission, cannot perform.

• Question 243:

  Your company has a main office and a branch office. The offices connect by using WAN links. The network consists of a single Active Directory domain. An Active Directory site exists for each office. Servers in both offices run Windows

  Server 2008 R2 Enterprise. You plan to deploy a failover cluster solution to service users in both offices.

  You need to plan a failover cluster to meet the following requirements:

  -Maintain the availability of services if a single server fails

  -Minimize the number of servers required

  What should you include in your plan?

  A. Deploy a failover cluster that contains one node in each office.
  B. Deploy a failover cluster that contains two nodes in each office.
  C. In the main office, deploy a failover cluster that contains one node. In the branch office, deploy a failover cluster that contains one node.
  D. In the main office, deploy a failover cluster that contains two nodes. In the branch office, deploy a failover cluster that contains two nodes.
  A. Deploy a failover cluster that contains one node in each office.

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration:

  Failover Clustering Failover clustering is a technology that allows another server to continue to service client requests in the event that the original server fails. Clustering is covered in more detail in Chapter 11, "Clustering and High Availability." You deploy failover clustering on mission-critical servers to ensure that important resources are available even if a server hosting those resources fails. Failover clustering The Failover Clustering feature enables multiple servers to work together to increase the availability of services and applications. If one of the clustered servers (or nodes) fails, another node provides the required service

  through failover and is available in Windows Server 2008 Enterprise and Datacenter editions and is not available in Windows Server 2008 Standard or Web editions.

  Failover clustering - Formerly known as server clustering, Failover Clustering creates a logical grouping of servers, also known as nodes, that can service requests for applications with shared data stores.

  

• Question 244:

  You need to recommend a Group Policy strategy for the Remote Desktop servers. What should you include in the recommendation?

  A. block inheritance
  B. loopback processing
  C. security filtering
  D. WMI filtering
  B. loopback processing

  ---

  http://support.microsoft.com/?id=231287

  Group Policy applies to the user or computer in a manner that depends on where both the user and the computer objects are located in Active Directory. However, in some cases, users may need policy applied to them based on the location of the computer object alone. You can use the Group Policy loopback feature to apply Group Policy Objects (GPOs) that depend only on which computer the user logs on to. http://technet.microsoft.com/en-us/windowsserver/cc817587

  Managing Terminal Services What is loopback processing? Group Policy loopback processing can be used to alter the application of GPOs to a user by including GPOs based on the location of the computer object. The typical way to use loopback processing is to apply GPOs that depend on the

  computer to which the user logs on.

• Question 245:

  You need to configure Internet Explorer to meet the company's technical requirements.

  Which GPO or GPOs should you modify?

  A. Default Domain Policy
  B. GPO1
  C. GPO2 and GPO3
  D. GPO4 and GPO5
  D. GPO4 and GPO5

  ---

  The company has 2 sites

  He following list contains example applications of policy:

  A GPO linked to a site applies to all users and computers in the site.

  A GPO applied to a domain applies to all users and computers in the domain and, by inheritance, to all users and computers in child organizational units. Be aware that policy is not inherited across domains.

  A GPO applied to an organizational unit applies directly to all users and computers in the organizational unit and, by inheritance, to all users and computers in child organizational units.

• Question 246:

  You need to recommend a solution to provision new Applications on the VMs for the planned virtual desktop pool deployment. What should you recommend?

  A. Deploy the Applications to the VMs by using AppV streaming.
  B. Deploy the Applications to the VMs by using Group Policy Software Installation.
  C. Deploy a MEDV workspace to each VM. Deploy the Applications to the workspace.
  D. Deploy the Applications by using RemoteApp. Create a RemoteApp and Desktop Connection for each VM.
  D. Deploy the Applications by using RemoteApp. Create a RemoteApp and Desktop Connection for each VM.

  ---

  The client PCs are using Windows XP which are x86 architecture and the app is x64

• Question 247:

  A company has Remote Desktop Services (RDS) servers that run Windows Server 2008 R2 and client computers that run Windows 7.

  You are designing a non-production remote desktop infrastructure that you will use for evaluation purposes for 180 days. The remote desktop infrastructure must meet the following requirements:

  -Maximize the security of remote desktop connections.

  -Minimize changes to the company's firewall configuration.

  - Provide external users with a secure connection from the Windows 7 Remote Desktop client to the RDS environment.

  You need to design a temporary remote desktop infrastructure that meets the requirements.

  Which services should you recommend? (More than one answer choice may achieve the goal. Select the BEST answer.)

  A. Remote Desktop Gateway, Remote Desktop Licensing, and Remote Desktop Session Host
  B. Remote Desktop Licensing, Remote Desktop Session Host, and Remote Desktop Web Access
  C. Only Remote Desktop Gateway and Remote Desktop Session Host
  D. Only Remote Desktop Session Host and Remote Desktop Web Access
  C. Only Remote Desktop Gateway and Remote Desktop Session Host

  ---

  Its true that the evaluation period for RD is only 120 days and your requirements are 180 days.

  Maybe the question is inaccurate and it actually states 120 days?

  But if you read http://technet.microsoft.com/en-us/library/cc738962%28WS.10%29.aspx it says To allow ample time for you to deploy a Terminal Server license server, Terminal Server provides a licensing grace period, during which no

  license server is required. During this grace period, a terminal server can accept connections from unlicensed clients without contacting a license server. The grace period begins the first time the terminal server accepts a client connection. It

  ends after you deploy a license server and that license server issues its first permanent client access license (CAL), or after 120 days, whichever comes first. In order for a license server to issue permanent CALs, you must activate the license

  server and then purchase and install the appropriate number of permanent CALs. If a license server is not activated, it issues temporary licenses. These temporary licenses allow clients to connect to the terminal server for 90 days.

  So is that the solution?

  If you feel licensing is required then A is your answer, if you don't then C is your answer.

  Remote Desktop Gateway (RD Gateway), formerly Terminal Services Gateway (TS Gateway), is a role service in the Remote Desktop Services server role included with Windows Server?2008 R2 that enables authorized remote users to

  connect to resources on an internal corporate or private network, from any Internetconnected device that can run the Remote Desktop Connection (RDC) client. The network resources can be Remote Desktop Session Host (RD Session

  Host) servers, RD Session Host servers running RemoteApp programs, or computers and virtual desktops with Remote Desktop enabled. RD Gateway uses the Remote Desktop Protocol (RDP) over HTTPS to establish a secure, encrypted

  connection between remote users on the Internet and internal network resources

  Why use Remote Desktop Gateway?

  RD Gateway provides many benefits, including:

  RD Gateway enables remote users to connect to internal network resources over the Internet, by using an encrypted connection, without needing to configure virtual private network (VPN) connections.

  RD Gateway provides a comprehensive security configuration model that enables you to control access to specific internal network resources. RD Gateway provides a point-to-point RDP connection, rather than allowing remote users access

  to all internal network resources.

  RD Gateway enables most remote users to connect to internal network resources that are hosted behind firewalls in private networks and across network address translators (NATs). With RD Gateway, you do not need to perform additional

  configuration for the RD Gateway server or clients for this scenario.

  Prior to this release of Windows Server, security measures prevented remote users from connecting to internal network resources across firewalls and NATs. This is because port 3389, the port used for RDP connections, is typically blocked

  for network security purposes. RD Gateway transmits RDP traffic to port 443 instead, by using an HTTP Secure Sockets

  Layer/Transport Layer Security (SSL/TLS) tunnel. Because most corporations open port 443 to enable Internet connectivity, RD Gateway takes advantage of this network design to provide remote access connectivity across multiple firewalls.

  The Remote Desktop Gateway Manager enables you to configure authorization policies to define conditions that must be met for remote users to connect to internal network resources. For example, you can specify:

  Who can connect to internal network resources (in other words, the user groups who can connect).

  What network resources (computer groups) users can connect to.

  Whether client computers must be members of Active Directory security groups.

  Whether device redirection is allowed.

  Whether clients need to use smart card authentication or password authentication, or whether they can use either method.

  You can configure RD Gateway servers and Remote Desktop Services clients to use Network Access Protection (NAP) to further enhance security. NAP is a health policy creation,

  enforcement, and remediation technology that is included in Windows Server?2008 R2, Windows Server?2008, Windows?7, Windows Vista? and Windows?XP Service Pack 3. With NAP, system administrators can enforce health

  requirements, which can include software requirements, security update requirements, required computer configurations, and other settings.

  A Remote Desktop Session Host (RD Session Host) server is the server that hosts Windows-based programs or the full Windows desktop for Remote Desktop Services clients. Users can connect to an RD Session Host server to run

  programs, to save files, and to use network resources on that server. Users can access an RD Session Host server by using Remote Desktop Connection or by using RemoteApp.

  Remote Desktop Licensing

  http://technet.microsoft.com/en-us/library/hh553157%28v=ws.10%29

  Operating System Grace Period

  Windows Server 2008 R2 120 days

  Windows Server 2008 120 days

  Windows Server 2003 R2 / Windows Server 2003 120 days

  Windows 2000 Server 90 days

  There has been some debate about licensing and some suggest you needed a license server.

  however take a look here: http://support.microsoft.com/kb/948472

  Evaluating Windows Server 2008 software does not require product activation. Any edition of Windows Server 2008 may be installed without activation, and it may be evaluated for 60 days.

  Additionally, the 60-day evaluation period may be reset (re-armed) three times. This action extends the original 60-day evaluation period by up to 180 days for a total possible evaluation time of 240 days.

• Question 248:

  You need to recommend a solution for managing the address information of the user accounts.

  The solution must meet the company's security requirements.

  What should you include in the recommendation?

  A. Active Directory delegation
  B. Authorization Manager
  C. built-in security groups
  D. user rights assignments
  A. Active Directory delegation

  ---

  Delegation of control means you can give fine grained rights to specific tasks to specific users or groups within AD. So a single user or group can be delegated permissions to create new user accounts within a specific OU or Site within your AD forest or domain Topic 6, City Power and Light Scenario: COMPANY OVERVIEW Overview City Power and Light is an international utilities company. The company has a sales department, a finance department, and a production department. Physical Location The company has a main office and a branch office.

  EXISTING ENVIRONMENT Network Infrastructure The network contains the following servers:

  -

  A server named Server1 that runs Windows Server 2008 R2 Enterprise and has the Hyper-V role installed. Server1 hosts three virtual machines (VMs) that run Windows Server 2008 R2 Enterprise. The VMs always run.

  -

  A Windows Server Update Services (WSUS) server in the main office. The WSUS server manages updates for the client computers in the main office only.

  -

  Several file servers that store data on an iSCSI Storage Area Network (SAN). The file servers have multiple network cards.

  -

  An enterprise root certification authority (CA) named CA1 that runs Windows Server 2008 R2.

  The branch office connects to the main office by using a WAN link. The WAN link is highly saturated. All client computers on the network connect to the Internet by using a single Internet connection at the main office.

  Problem Statements

  All client computers run Microsoft Office 2003. The client computers for the users in the sales department run a 64-bit version of Windows 7. Sales users must be able to run a 64-bit version of Office 2010 and Office 2003 concurrently when

  they work offline. Office 2010 must be deployed by using the minimum amount of administrative effort.

  REQUIREMENTS

  Business Goal

  City Power and Light has the following business goals:

  -

  Software and hardware costs must be minimized, whenever possible.

  -

  Due to power restrictions at the data center in the main office, all new servers must be deployed on VMs, whenever possible.

  Planned Changes

  City Power and Light plans to implement the following changes in their network:

  -

  A WSUS server in the branch office.

  -

  A robotic-based tape library for the file servers.

  - A document management system that supports the following requirements: o Retains multiple versions of a document

  o Automatically App1ies access policies to documents

  - A solution for managing Group Policy objects (GPOs) that supports the following: o Version tracking

  o Offline modification

  o Role-based access control

  -

  Nine VMs that run Windows Server 2008 R2 Enterprise. Only five VMs will run concurrently.

  -

  Two Microsoft SQL Server 2008 Enterprise servers in a failover cluster. The cluster will be attached to a hardware RAID-5 array that has five 2-terabyte drives.

  -

  Five additional physical servers for the finance department. The new servers will use native-boot virtual hard disks (VHDs). The VHD images will contain a single partition.

  Technical Requirements

  City Power and Light must meet the following technical requirements:

  -

  The file servers must maintain their connection to the SAN if a network card fails.

  -

  The bandwidth utilization between the main office and the branch office must be minimized.

  -

  Administrators in the main office must approve or reject updates for all of the client computers in all of the offices.

  Security Requirements

  City Power and Light must meet the following security requirements:

  -

  All help desk technicians must be able to approve certificate requests and revoke certificates. The help desk technicians must be prevented from modifying the properties of the CA.

  -

  All telecommunications technicians must be able to manage the virtual networks of Server1. The telecommunications technicians must be prevented from performing all other Hyper-V management task.

  All of the documents created by users in the finance department must be shared with all of the managers in the company. After 30 days, only those who created the documents must be able to access the documents.

• Question 249:

  Your company has a main office and a branch office. You plan to deploy a Readonly Domain Controller (RODC) in the branch office. You need to plan a strategy to manage the RODC. Your plan must meet the following requirements:

  -

  Allow branch office support technicians to maintain drivers and disks on the RODC

  -

  Prevent branch office support technicians from managing domain user accounts What should you include in your plan?

  A. Configure the RODC for Administrator Role Separation.
  B. Configure the RODC to replicate the password for the branch office support technicians.
  C. Set NTFS permissions on the Active Directory database to Read and Execute for the branch office support technicians.
  D. Set NTFS permissions on the Active Directory database to Deny Full Control for the branch office support technicians.
  A. Configure the RODC for Administrator Role Separation.

  ---

  http://technet.microsoft.com/en-us/library/cc753170%28WS.10%29.aspx

  

• Question 250:

  You need to recommend a solution for the USB storage devices on the client computers. The solution must meet the company's security requirements. What should you include in the recommendation?

  A. Encrypted File System (EFS)
  B. the App1ocker Group Policy settings
  C. the Enhanced Storage Access settings
  D. Windows BitLocker Drive Encryption (BitLocker)
  C. the Enhanced Storage Access settings

  ---

  What is Enhanced Storage?

  http://windows.microsoft.com/en-us/windows7/What-is-Enhanced-Storage

  There are different types of storage devices, such as USB flash drives or external hard drives.

  Some have no particular security enhancements, while others have built-in safety features.

  Enhanced Storage devices have built-in safety features that let you control who can access the data on the device by using a password or a certificate (if the device is being used in a workplace).

  Once someone has access to the device, they have access to the data because the data on the device is not encrypted. Some device manufacturers might offer encryption on Enhanced Storage devices. Check the device packaging or

  documentation to see if the device includes encryption.

  An Enhanced Storage device can be an external USB hard drive or a USB flash drive. When you purchase a USB hard drive or flash drive, the packaging might indicate that it's an Enhanced Storage device.

  The first time that you plug the device into your computer, you'll be prompted to create a password or use a certificate with the device. Once the password is entered or the certificate is retrieved, the data on the device is accessible. It's

  important to use a strong password to help keep your data secure.

  In addition to the device access password, you can set a recovery password, which you can use to reset the device access password. You can create the recovery password when you create the device access password or by right-clicking

  the device in the Computer folder, and then selecting Set password.

  You can also use the recovery password as an administrator password. Administrators can choose to set a device password for the user of the device, and then use the recovery password as an administrator password.

  This way, the administrator can unlock the storage device if the person using it forgets their password.

  Enhanced Storage Access settings

  http://technet.microsoft.com/en-us/library/dd560657%28WS.10%29.aspx Enhanced Storage devices are devices that support the IEEE 1667 protocol to provide functions such as authentication at the hardware level of the storage device. These devices can be very small, such as USB flash drives, to provide a convenient way to store and carry data. At the same time, the small size makes it very easy for the device to be lost, stolen, or misplaced.