Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 61:

  Your company has a main office and a branch office. Your network contains a single Active Directory domain.

  An Active Directory site exists for each office. All domain controllers run Windows Server 2008 R2.

  You plan to modify the DNS infrastructure. You need to plan the new DNS infrastructure to meet the following requirements:

  -Ensure that the DNS service is available even if a single server fails

  -Encrypt the synchronization data that is sent between DNS servers

  -Support dynamic updates to all DNS servers

  What should you include in your plan?

  A. Install the DNS Server server role on two servers. Create a primary zone on the DNS server in the main office. Create a secondary zone on the DNS server in the branch office.
  B. Install the DNS Server server role on a domain controller in the main office and on a domain controller in the branch office. Configure DNS to use Active Directory integrated zones.
  C. Install the DNS Server server role on a domain controller in the main office and on a Readonly Domain Controller (RODC) in the branch office. Configure DNS to use Active Directory integrated zones.
  D. Install the DNS Server server role on two servers. Create a primary zone and a GlobalNames zone on the DNS server in the main office. Create a GlobalNames zone on the DNS server in the branch office.
  B. Install the DNS Server server role on a domain controller in the main office and on a domain controller in the branch office. Configure DNS to use Active Directory integrated zones.

  ---

  http://searchwindowsserver.techtarget.com/tip/DNS-Primer-Tips-for-understanding-Active-Directory-integratedzone-design-and-configuration http://technet.microsoft.com/en-us/library/cc772101.aspx

  In an ADI primary zone, rather than keeping the old zone file on a disk, the DNS records are stored in the AD, and Active Directory replication is used rather than the old problematic zone transfer. If all DNS servers were to die or become inaccessible, you could simply install DNS on any domain controller (DC) in the domain. The records would be automatically populated and your DNS server would be up without the messy import/export tasks of standard DNS zone files.

  Windows 2000 and 2003 allow you to put a standard secondary zone (read only) on a member server and use one of the ADI primary servers as the master.

  

  When you decide which replication scope to choose, consider that the broader the replication scope, the greater the network traffic caused by replication. For example, if you decide to have AD DS-integrated DNS zone data replicated to all DNS servers in the forest, this will produce greater network traffic than replicating the DNS zone data to all DNS servers in a single AD DS domain in that forest.

  AD DS-integrated DNS zone data that is stored in an application directory partition is not replicated to the global catalog for the forest. The domain controller that contains the global catalog can also host application directory partitions, but it will not replicate this data to its global catalog.

  AD DS-integrated DNS zone data that is stored in a domain partition is replicated to all domain controllers in its AD DS domain, and a portion of this data is stored in the global catalog. This setting is used to support Windows 2000. If an application directory partition's replication scope replicates across AD DS sites, replication will occur with the same intersite replication schedule as is used for domain partition data.

  By default, the Net Logon service registers domain controller locator (Locator) DNS resource records for the application directory partitions that are hosted on a domain controller in the same manner as it registers domain controller locator (Locator) DNS resource records for the domain partition that is hosted on a domain controller.

  Close integration with other Windows services, including AD DS, WINS (if enabled), and DHCP (including DHCPv6) ensures that Windows 2008 DNS is dynamic and requires little or no manual configuration. Windows 2008 DNS is fully compliant with the dynamic update protocol defined in RFC 2136. Computers running the DNS Client service register their host names and IPv4 and IPv6 addresses (although not link-local IPv6 addresses) dynamically. You can configure the DNS Server and DNS Client services to perform secure dynamic updates. This ensures that only authenticated users with the appropriate rights can update resource records on the DNS server.

  

  Figure 2-22 shows a zone being configured to allow only secure dynamic updates.

  Figure 2-22Allowing only secure dynamic updates MORE INFODynamic update protocol For more information about the dynamic update protocol, see http://www.ietf.org/rfc/rfc2136.txt and http://www.ietf.org/rfc/rfc3007 NOTE Secure dynamic updates Secure dynamic updates are only available for zones that are integrated with AD DS.

• Question 62:

  You need to recommend a strategy for delegating administrative rights to Admin1. The strategy must support the company's planned changes. What should you include in the recommendation?

  A. the Authorization Manager snapin on Node1 and Node2
  B. the Authorization Manager snapin on the VMs
  C. the Network Configuration Operators local group on each VM
  D. the Network Configuration Operators local group on Node1 and Node2
  A. the Authorization Manager snapin on Node1 and Node2

  ---

  http://technet.microsoft.com/en-us/library/cc731364.aspx An authorization store can contain authorization policy information for many applications in a single policy store. All applications in one authorization store can access all of the groups defined at the store level. You must be assigned to the Authorization Manager Administrator user role to complete this procedure. By default, Administrators is the minimum Windows group membership assigned to this role. Review the details in "Additional

  considerations" in this topic

• Question 63:

  Your network consists of a single Active Directory domain. The functional level of the domain is Windows Server 2008 R2.

  All domain controllers run Windows Server 2008 R2. A corporate policy requires that the users from the research department have higher levels of account and password security than other users in the domain.

  You need to recommend a solution that meets the requirements of the corporate policy. Your solution must minimize hardware and software costs.

  What should you recommend?

  A. Create a new Active Directory site. Deploy a Group Policy object (GPO) to the site.
  B. Create a new Password Settings Object (PSO) for the research department's users.
  C. Create a new organizational unit (OU) named Research in the existing domain. Deploy a Group Policy object (GPO) to the Research OU.
  D. Create a new domain in the forest. Add the research department's user accounts to the new domain. Configure a new security policy in the new domain.
  B. Create a new Password Settings Object (PSO) for the research department's users.

  ---

  http://technet.microsoft.com/en-us/library/cc770842%28WS.10%29.aspx http://technet.microsoft.com/en-us/library/cc754461%28WS.10%29.aspx

  

  

• Question 64:

  You are planning to upgrade the operating systems of the client computers in the finance department. You need to recommend a solution for App1 that meets the company's technical requirements.

  What should you include in the recommendation?

  A. Microsoft Application Virtualization (AppV)
  B. RemoteApp and Desktop Connection
  C. RD Gateway
  D. Windows XP Mode
  D. Windows XP Mode

  ---

  http://www.microsoft.com/oem/en/products/windows/pages/windows_xp_mode.aspx

  Windows XP Mode: Providing Flexibility For You and Your Customers

  We're committed to providing a smooth transition as your customers move to the Windows 7 operating system.

  Many of them will upgrade from Windows XP and will require the flexibility to run their current Windows XP applications.

  We're focused on providing you with the right tools to help customers achieve their goals to:

  Maximize productivity.

  Manage their technology infrastructure and total cost of ownership.

  Designed for Small Business

  Windows XP Mode is a new feature of Windows 7 Professional, Ultimate, and Enterprise. Many applications designed for Windows XP will run in Windows 7, but some legacy applications may not be compatible.

  Windows XP Mode allows many of these applications to run right from the Windows 7 desktop.

  Benefits include:

  Ease of use: Time is precious for small-business customers. Windows XP Mode utilizes Windows Virtual PC to launch Windows XP applications with a single click directly from the Windows 7 desktop.

  Business continuity: In addition to enabling customers to run Windows XP applications virtually on a Windows 7-based PC, Windows XP Mode also supports many Windows XP devices--for instance, those connected to USB ports. Cost management: Windows XP Mode extends the life of existing Windows XP applications and devices, and reduces the learning curve by using many familiar applications and devices.

  Windows XP Mode Now Supported on PCs Without Virtualization-Enabled Processors Microsoft has removed the virtualization-enabled processor requirement for Windows XP Mode on Windows 7 Professional and Ultimate. Windows XP Mode continues to use hardware virtualization such as Intel Virtualization Technology (Intel?VT) or the AMD-VTM chipset when available but it no longer requires them.

  Microsoft has released an update that enables PCs without hardware virtualization to also take advantage of Windows XP Mode.

• Question 65:

  You need to identify which operating system must be installed on the HyperV server in the new branch office. Which operating system should you identify?

  A. a Server Core installation of Windows Server 2008 R2 Enterprise
  B. a Server Core installation of Windows Server 2008 R2 Standard
  C. Windows Server 2008 R2 Enterprise
  D. Windows Server 2008 R2 Standard
  A. a Server Core installation of Windows Server 2008 R2 Enterprise

  ---

  Hyper-V has specific requirements. Hyper-V requires an x64-based processor, hardware-assisted virtualization, and hardware data execution prevention (DEP). Hyper-V is available in x64-based versions of Windows Server 2008-specifically, the x64-based versions of Windows Server 2008 Standard, Windows Server 2008 Enterprise, and Windows Server 2008 Datacenter technical requirements include minimizing attach surface, Server Core achieves this. so should

  you use Enterprise or Standard as Hyper V can be implemented on both x64 versions?

  http://www.directionsonmicrosoft.com/sample/DOMIS/update/2008/02feb/0208ws2plp_ch.htm

  1 Windows Server 2008 Standard, Enterprise, and Datacenter are also offered in "without Hyper-V" editions that do not include the hypervisor technology.

  2 When customers exercise the maximum number of OS instances permitted by the server license, the physical OS instance may not be used to run any workload beyond hosting the virtual machines.

  3 A single package contains both 32-bit and 64-bit versions. The server license grants the customer the option to use either the 32-bit version or the 64-bit version of the software.

  4 Supports hot addition of memory, but not hot replacement of memory, nor hot add or replacement of processors.

  5 Use of Windows Server 2008's new Terminal Services Gateway capability is limited to 250 connections.

  6 Includes restrictions limiting scalability.

  7 Volume licensing customers typically receive additional discounts of 10% to 30%.

  8 Client Access Licenses (CALs) retail for US$40 apiece but are offered to volume customers for as much as 50% off. External Connectors are available only via volume licensing programs. Pricing for an External Connector starts at

  approximately US$1,800 in the least-discounted programs

  Under the planned changes it states that each branch will have one DC, a DirectAccess Server a File Server and a Web Server and that all branches will be virtualised. therefore you will be running 4 VMs Windows server 2008 Enterprise

  allows the running of 4 VMS on one license

  So the answer is A becase Server core reduces the surface attack area and virtualization on Enterprise server will meet the VM and licensing requirements

• Question 66:

  You need to plan a scheduled daily backup of all files on TADC01. Which tools could you use? (Choose all that Apply.)

  A. NTBackup
  B. BITSAdmin
  C. Windows Server Backup
  D. Windows Backup
  E. WBAdmin
  F. Ntdsutil
  C. Windows Server Backup
  E. WBAdmin

• Question 67:

  You need to recommend a solution for configuring the Automatic Updates settings on the VMs. What should you include in the recommendation?

  A. block inheritance
  B. loopback processing
  C. security filtering
  D. WMI filtering
  D. WMI filtering

  ---

  http://technet.microsoft.com/en-us/library/cc947846%28WS.10%29.aspx

  To make sure that each GPO associated with a group can only be applied to computers running the correct version of Windows, use the Group Policy Management MMC snap-in to create and assign WMI filters to the GPO. Although you can create a separate membership group for each GPO, you would then have to manage the memberships of the different groups. Instead, use only a single membership group, and let WMI filters automatically ensure the correct GPO is applied to each computer.

• Question 68:

  You need to recommend a solution for deploying the custom Word dictionary. What should you include in the recommendation?

  A. Distributed File System (DFS)
  B. Group Policy preferences
  C. Offline servicing
  D. WDS
  B. Group Policy preferences

  ---

  http://support.microsoft.com/kb/943729

  This article discusses the Group Policy preferences that are new in Windows Server 2008 and how to enable down-level computers to process these new items. Group Policy preferences are made up of more than 20 new Group Policy client-side extensions (CSEs) that expand the range of configurable settings in a Group Policy object (GPO). These new preference extensions are included in the Group Policy Management Editor window of the Group Policy Management Console (GPMC). The kinds of preference items that can be created by using each extension are listed when New is selected for the extension. Examples of the new Group Policy preference extensions include the following:

  Folder Options Drive Maps Printers Scheduled Tasks Services Start Menu

• Question 69:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2. The network contains 100 servers and 5,000 client computers. The client computers run either Windows XP Service Pack 1 or Windows 7.

  You need to plan a VPN solution that meets the following requirements:

  -Stores VPN passwords as encrypted text

  -Supports Suite B cryptographic algorithms

  -Supports automatic enrollment of certificates

  -Supports client computers that are configured as members of a workgroup

  What should you include in your plan?

  A. Upgrade the client computers to Windows XP Service Pack 3. Implement a standalone certification authority (CA). Implement an IPsec VPN that uses certificate based authentication.
  B. Upgrade the client computers to Windows XP Service Pack 3. Implement an enterprise certification authority (CA) that is based on Windows Server?2008 R2. Implement an IPsec VPN that uses Kerberos authentication.
  C. Upgrade the client computers to Windows 7. Implement an enterprise certification authority (CA) that is based on Windows Server 2008 R2. Implement an IPsec VPN that uses preshared keys.
  D. Upgrade the client computers to Windows 7. Implement an enterprise certification authority (CA) that is based on Windows Server 2008 R2. Implement an IPsec VPN that uses certificate based authentication.
  D. Upgrade the client computers to Windows 7. Implement an enterprise certification authority (CA) that is based on Windows Server 2008 R2. Implement an IPsec VPN that uses certificate based authentication.

  ---

  This is as close as I could get to an answer to this.

  In essence, Enterprise CAs are fully integrated into a Windows Server 2008 environment. This type of CA makes the issuing and management of certificates for Active Directory clients as simple as possible.

  Standalone CAs do not require Active Directory. When certificate requests are submitted to Standalone CAs, the requestor must provide all relevant identifying information and manually

  specify the type of certificate needed. This process occurs automatically with an Enterprise CA. By default, Standalone CA requests require administrator approval. Administrator intervention is necessary because there is no automated method of verifying a requestor's credentials.

  Standalone CAs do not use certificate templates, limiting the ability for administrators to customize certificates for specific organizational needs.

  L2TP/IPsecL2TP connections use encryption provided by IPsec. L2TP/IPsec is the protocol that you need to deploy if you are supporting Windows XP remote access clients, because these clients cannot use SSTP. L2TP/IPsec provides per-packet data origin authentication, data integrity, replay protection, and data confidentiality.

  L2TP/IPsec connections use two levels of authentication. Computer-level authentication occurs either using digital certificates issued by a CA trusted by the client and VPN server or through the deployment of pre-shared keys. PPP authentication protocols are then used for user-level authentication. L2TP/IPsec supports all of the VPN authentication protocols available on Windows Server 2008.

  Supports Suite B cryptographic algorithms When using the Certificate Templates console, note that you cannot configure the autoenrollment permission for a level 1 certificate template. Level 1 certificates have Windows 2000 as their minimum supported CA. Level 2 certificate templates have Windows Server 2003 as a minimum supported CA. Level 2 certificate templates are also the minimum level of certificate template that supports autoenrollment. Level 3 certificates templates are supported only by client computers running Windows Server 2008 or Windows Vista. Level 3 certificate templates allow administrators to configure advanced Suite B cryptographic settings. These settings are not required to allow certificate autoenrollment and most administrators find level 2 certificate templates are adequate for their organizational needs.

• Question 70:

  You are planning the deployment of Windows Server 2008 R2 to CHDATA03 and CHDATA04.

  You have the following requirements:

  -Do not impact settings for CHDATA01 and CHDATA02.

  -

  Apply Windows Server 2008 R2-specific settings to CHDATA03 and CHDATA04 after migration.

  -

  Ensure that the ServerSettings GPO does not apply to CHDATA03 and CHDATA04 after migration.

  You need to plan a strategy that meets the requirements.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Create a GPO named MigratedServers that contains the Windows Server 2008 R2 settings. Create a WMI filter that targets Windows Server 2003 and link it to the MigratedServers GPO,
  B. Block inheritance on the CH_FileServers OU.
  C. Create a WMI filter that targets Windows Server 2003 and link it to the ServerSettings GPO.
  D. Enable loopback processing on the MigratedServers GPO.
  E. Link the MigratedServers GPO to the CH_FileServers OU.
  F. Create a GPO named MigratedServers that contains the Windows Server 2008 R2 settings. Create a WMI filter that targets Windows Server 2008 R2 and link it to the MigratedServers GPO.
  E. Link the MigratedServers GPO to the CH_FileServers OU.
  F. Create a GPO named MigratedServers that contains the Windows Server 2008 R2 settings. Create a WMI filter that targets Windows Server 2008 R2 and link it to the MigratedServers GPO.

  ---

  A WMI filter enables you to specify criteria that must be matched before the linked GPO is applied to a computer. By letting you filter the computers to which the GPO applies, this reduces the need to further subdivide your OUs in Active Directory. This technique is dynamic, in that the filter is evaluated when the computer attempts to apply the policy. So if you are filtering based on the version of Windows then upgrading the computer from Windows XP to Windows 7 requires no changes to your GPO, because the filter will automatically recognize the change and filter the computer's access to the GPO accordingly. I've just put the structure together in a DC and took a screen shot of it. this is how i interperate the information given

  

  It on the second page of the exhibit it says that the ServerSettings GPO applies to all servers not all file servers. So that means one of two things, its linked to the CH_Servers OU OR its linked higher like at a domain level because then it applies to ALL servers in all regions. as the full AD structure is not clear I'll assume its applied on all CH servers only, but either way if its applied at a domain level it shouldn't matter.

  If you first carry out step F you create the MigratedServers GPO, then you create the Server 2008 R2 WMI filter and apply that to the GPO you just created, then you carry out step E which links the MigratedServers GPO which has a Server 2008 R2 WMI filter to the CH_FileServers OU.

  NOTE: possible issue Thanks to SoK for highlighting this. the question states what 2 steps But requirement 3 says Ensure that the ServerSettings GPO does not apply to CHDATA03 and CHDATA04 after migration. So ServerSettings GPO applies IE settings to servers in the CH_Servers ou and will also be applied to any Child OUs of that and on page 2 it says that CH_FileServers is a child of CH_servers so the ServerSettings GPO will be applied to all file servers by default regardless of their OS. the settings are IE settings and as its stands those settings would apply to CHDATA03 and CHDATA04 because of the ServerSettings GPO so unless you block that GPO somehow reaching the two 2008 file servers, answer B wont work because it then blocks them for CHDATA01 and CHDATA02 which you don't want. A wont work at it is an incorrect "replacement" for F because its applying 2008 settings to 2003 servers which is as useful as tits on a bull. D is pointless in this specific case so it a[[ears that C may be required. I'm going to leave C out for the moment because the question clearly states 2 answers