Monthly Archives: November 2014

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 201
Your network contains an Active Directory forest named contoso.com. The functional level of the forest is Windows Server 2008 R2.
The DNS zone for contoso.com is Active Directory-integrated.
You deploy a read-only domain controller (RODC) named R0DC1. You install the DNS Server server role on R0DC1.
You discover that R0DC1 does not have any DNS application directory partitions.
You need to ensure that R0DC1 has a copy of the DNS application directory partition of contoso.com.
What should you do? (Each correct answer presents a complete solution. Choose two.)

A.    From DNS Manager, right-click RODC1 and click Create Default Application Directory Partitions.
B.    Run ntdsutil.exe. From the Partition Management context, run the create nc command.
C.    Run dnscmd.exe and specify the /createbuiltindirectorypartitions parameter.
D.    Run ntdsutil.exe. From the Partition Management context, run the add nc replica command.
E.    Run dnscmd.exe and specify the /enlistdirectorypartition parameter.

Answer: AC

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 191
Your network contains an Active Directory domain. The domain contains five sites. One of the sites contains a read-only domain controller (RODC) named RODC1.
You need to identify which user accounts can have their password cached on RODC1.
Which tool should you use?

A.    Repadmin
B.    Dcdiag
C.    Get-ADDomainControllerPasswordReplicationPolicyUsage
D.    Adtest

Answer: C

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 181
Your network contains two Active Directory forests named contoso.com and fabrikam.com. Each forest contains a single domain.
A two-way forest trust exists between the forests. Selective authentication is enabled on the trust.
Contoso.com contains a group named Group 1.
Fabrikam.com contains a server named Server1.
You need to ensure that users in Group1 can access resources on Server1.
What should you modify?

A.    the permissions of the Group1 group
B.    the UPN suffixes of the contoso.com forest
C.    the UPN suffixes of the fabrikam.com forest
D.    the permissions of the Server1 computer account

Answer: A

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 171
You need to ensure that users who enter three successive invalid passwords within 5 minutes are locked out for 5 minutes.
Which three actions should you perform? (Each correct answer presents part of the solution.
Choose three.)

A.    Set the Minimum password age setting to one day.
B.    Set the Maximum password age setting to one day.
C.    Set the Account lockout duration setting to 5 minutes.
D.    Set the Reset account lockout counter after setting to 5 minutes.
E.    Set the Account lockout threshold setting to 3 invalid logon attempts.
F.    Set the Enforce password history setting to 3 passswords remembered.

Answer: CDE

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 161
The default domain GPO in your company is configured by using the following account policy settings:

– Minimum password length: 8 characters
– Maximum password age: 30 days
– Enforce password history: 12 passwords remembered
– Account lockout threshold: 3 invalid logon attempts
– Account lockout duration: 30 minutes

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 151
Your company has an Active Directory domain. All servers run Windows Server. You deploy a Certification Authority (CA) server. You create a new global security group named CertIssuers.
You need to ensure that members of the CertIssuers group can issue, approve, and revoke certificates. What should you do?

A.    Assign the Certificate Manager role to the CertIssuers group
B.    Place CertIssuers group in the Certificate Publisher group
C.    Run the certsrv -add CertIssuers command promt of the certificate server
D.    Run the add -member-membertype memberset CertIssuers command by using Microsoft Windows Powershell

Answer: A

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 141
Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2.
You need to identify the Lightweight Directory Access Protocol (LDAP) clients that are using the largest amount of available CPU resources on a domain controller.
What should you do?

A.    Review performance data in Resource Monitor.
B.    Review the Hardware Events log in the Event Viewer.
C.    Run the Active Directory Diagnostics Data Collector Set. Review the Active Directory Diagnostics report.
D.    Run the LAN Diagnostics Data Collector Set. Review the LAN Diagnostics report.

Answer: C

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 131
Your company, Contoso Ltd, has offices in North America and Europe. Contoso has an Active Directory forest that has three domains. You need to reduce the time required to authenticate users from the labs.eu.contoso.com domain when they access resources in the eng.na.contoso.com domain. What should you do?

A.    Decrease the replication interval for all Connection objects.
B.    Decrease the replication interval for the DEFAULTIPSITELINK site link.
C.    Set up a one-way shortcut trust from eng.na.contoso.com to labs.eu.contoso.com.
D.    Set up a one-way shortcut trust from labs.eu.contoso.com to eng.na.contoso.com.

Answer: C

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 121
You configure and deploy a Group Policy object (GPO) that contains AppLocker settings. You need to identify whether a specific application file is allowed to run on a computer.
Which Windows PowerShell cmdlet should you use?

A.    Get-AppLockerFileInformation
B.    Get-GPOReport
C.    Get-GPPermissions
D.    Test-AppLockerPolicy

Answer: D

QUESTION 122
You create a Password Settings object (PSO).
You need to apply the PSO to a domain user named User1.
What should you do?

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 111
Your network contains an Active Directory forest.
You set the Windows PowerShell execution policy to allow unsigned scripts on a domain controller in the network. You create a Windows PowerShell script named new-users.ps1 that contains the following lines:

new-aduser user1
new-aduser user2
new-aduser user3
new-aduser user4
new-aduser user5

(more…)