Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 151
Your company has an Active Directory domain. All servers run Windows Server. You deploy a Certification Authority (CA) server. You create a new global security group named CertIssuers.
You need to ensure that members of the CertIssuers group can issue, approve, and revoke certificates. What should you do?

A.    Assign the Certificate Manager role to the CertIssuers group
B.    Place CertIssuers group in the Certificate Publisher group
C.    Run the certsrv -add CertIssuers command promt of the certificate server
D.    Run the add -member-membertype memberset CertIssuers command by using Microsoft Windows Powershell

Answer: A

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 141
Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2.
You need to identify the Lightweight Directory Access Protocol (LDAP) clients that are using the largest amount of available CPU resources on a domain controller.
What should you do?

A.    Review performance data in Resource Monitor.
B.    Review the Hardware Events log in the Event Viewer.
C.    Run the Active Directory Diagnostics Data Collector Set. Review the Active Directory Diagnostics report.
D.    Run the LAN Diagnostics Data Collector Set. Review the LAN Diagnostics report.

Answer: C

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 131
Your company, Contoso Ltd, has offices in North America and Europe. Contoso has an Active Directory forest that has three domains. You need to reduce the time required to authenticate users from the labs.eu.contoso.com domain when they access resources in the eng.na.contoso.com domain. What should you do?

A.    Decrease the replication interval for all Connection objects.
B.    Decrease the replication interval for the DEFAULTIPSITELINK site link.
C.    Set up a one-way shortcut trust from eng.na.contoso.com to labs.eu.contoso.com.
D.    Set up a one-way shortcut trust from labs.eu.contoso.com to eng.na.contoso.com.

Answer: C

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 121
You configure and deploy a Group Policy object (GPO) that contains AppLocker settings. You need to identify whether a specific application file is allowed to run on a computer.
Which Windows PowerShell cmdlet should you use?

A.    Get-AppLockerFileInformation
B.    Get-GPOReport
C.    Get-GPPermissions
D.    Test-AppLockerPolicy

Answer: D

QUESTION 122
You create a Password Settings object (PSO).
You need to apply the PSO to a domain user named User1.
What should you do?

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 111
Your network contains an Active Directory forest.
You set the Windows PowerShell execution policy to allow unsigned scripts on a domain controller in the network. You create a Windows PowerShell script named new-users.ps1 that contains the following lines:

new-aduser user1
new-aduser user2
new-aduser user3
new-aduser user4
new-aduser user5

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 101
Your company has a main office and a branch office.
The network contains an Active Directory domain.
The main office contains a writable domain controller named DC1. The branch office contains a read- only domain controller (RODC) named DC2.
You discover that the password of an administrator named Admin1 is cached on DC2. You need to prevent Admin1’s password from being cached on DC2.
What should you do?

A.    Modify the NTDS Site Settings.
B.    Modify the properties of the domain.
C.    Create a Password Setting object (PSO).
D.    Modify the properties of DC2’s computer account.

Answer: D

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 91
Your network contains an Active Directory domain. The domain is configured as shown in the following table.

Users in Branch2 sometimes authenticate to a domain controller in Branch1. You need to ensure that users in Branch2 only authenticate to the domain controllers in Main.
What should you do?

A.    On DC3, set the AutoSiteCoverage value to 0.
B.    On DC3, set the AutoSiteCoverage value to 1.
C.    On DC1 and DC2, set the AutoSiteCoverage value to 0.
D.    On DC1 and DC2, set the AutoSiteCoverage value to 1.

Answer: A

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 81
Your network contains a single Active Directory forest. The forest contains two domains named contoso.com and sales.contoso.com. The domain controllers are configured as shown in the following table.

All domain controllers run Windows Server 2008 R2. All zones are configured as Active Directory- integrated zones.
You need to ensure that contoso.com records are available on DC3.
Which command should you run?

A.    dnscmd.exe DC1.contoso.com /ZoneChangeDirectoryPartition contoso.com /domain
B.    dnscmd.exe DC1.contoso.com /ZoneChangeDirectoryPartition contoso.com /forest
C.    dnscmd.exe DC3.contoso.com /ZoneChangeDirectoryPartition contoso.com /domain
D.    dnscmd.exe DC3.contoso.com /ZoneChangeDirectoryPartition contoso.com /forest

Answer: B

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 71
Your network contains an Active Directory domain named contoso.com. The domain contains the servers shown in the following table.

The functional level of the forest is Windows Server 2003. The functional level of the domain is Windows Server 2003.
DNS1 and DNS2 host the contoso.com zone.
All client computers run Windows 7 Enterprise.
You need to ensure that all of the names in the contoso.com zone are secured by using DNSSEC.
What should you do first?

A.    Change the functional level of the forest.
B.    Change the functional level of the domain.
C.    Upgrade DC1 to Windows Server 2008 R2.
D.    Upgrade DNS1 to Windows Server 2008 R2.

Answer: D

(more…)

Vendor: Microsoft
Exam Code: 70-640
Exam Name: TS: Windows Server 2008 Active Directory, Configuring
Version: 14.91

QUESTION 61
Your company has two Active Directory forests as shown in the following table.

Forest name    Forest functional level    Domain(s)
contoso.com    Windows Server 2008    contoso.com
fabrikam.com    Windows Server 2008    fabrikam.com    eng.fabrikam.com

The forests are connected by using a two-way forest trust. Each trust direction is configured with forest-wide authentication. The new security policy of the company prohibits users from the eng.fabrikam.com domain to access resources in the contoso.com domain. You need to configure the forest trust to meet the new security policy requirement.
What should you do?

A.    Delete the outgoing forest trust in the contoso.com domain.
B.    Delete the incoming forest trust in the contoso.com domain.
C.    Change the properties of the existing incoming forest trust in the contoso.com domain from Forest-wide
authentication to Selective authentication.
D.    Change the properties of the existing outgoing forest trust in the contoso.com domain to exclude *.eng.
fabrikam.com from the Name Suffix Routing trust properties.

Answer: D

(more…)