100% Correct 70-640 Exam Questions 2021

NEW QUESTION 1
Your network contains a domain controller that runs Windows Server 2008 R2. You run the following command on the domain controller:
dsamain.exe C dbpath c:$SNAP_201006170326_VOLUMEC$WindowsNTDSntds.dit C ldapport 389 -allowNonAdminAccess
The command fails.
You need to ensure that the command completes successfully.
How should you modify the command?

• A. Change the value of the -dbpath paramete
• B. Include the path to Dsamai
• C. Change the value of the -ldapport paramete
• D. Remove the CallowNonAdminAccess paramete

Answer: C

Explanation: MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 690 Use the AD DS database mounting tool to load the snapshot as an LDAP server. dsamain -dbpath c:$SNAP_datetime_VOLUMEC$windowsntdsntds.dit -ldapport portnumber Be sure to use ALL CAPS for the -dbpath value and use any number beyond 40,000 for the
-ldapport value to ensure that you do not conflict with AD DS.
Also note that you can use the minus (–) sign or the slash (/) for the options in the
command.

NEW QUESTION 2
Your network contains an Active Directory domain named contoso.com.
You have an organizational unit (OU) named Sales and an OU named Engineering.
You have a Group Policy object (GPO) linked to the domain.
You need to ensure that the settings in the GPO are not processed by user accounts or computer accounts in the Sales OU. You must achieve this goal by using the minimum amount of administrative effort.
What should you do?

• A. Modify the Group Policy permission
• B. Enable block inheritanc
• C. Configure the link orde
• D. Enable loopback processing in merge mod
• E. Enable loopback processing in replace mod
• F. Configure WMI filterin
• G. Configure Restricted Group
• H. Configure Group Policy PExplanation
• I. Link the GPO to the Sales O
• J. Link the GPO to the Engineering O

Answer: B

Explanation:
http://technet.microsoft.com/en-us/library/cc731076.aspx
Block Inheritance You can block inheritance for a domain or organizational unit. Blocking inheritance prevents Group Policy objects (GPOs) that are linked to higher sites, domains, or organizational units from being automatically inherited by the child-level.

NEW QUESTION 3
You have a domain controller that runs Windows Server 2008 R2. The Windows Server Backup feature is installed on the domain controller.
You need to perform a non-authoritative restore of the domain controller by using an existing backup file.
What should you do?

• A. Restart the domain controller in Directory Services Restore Mod
• B. Use the WBADMIN command to perform a critical volume restor
• C. Restart the domain controller in Directory Services Restore Mod
• D. Use the Windows Server Backup snap-in to perform a critical volume restor
• E. Restart the domain controller in safe mod
• F. Use the Windows Server Backup snap-in to perform a critical volume restor
• G. Restart the domain controller in safe mod
• H. Use the WBADMIN command to perform a critical volume restor

Answer: A

Explanation:
Almost identical to B26 http://technet.microsoft.com/en-us/library/cc816627%28v=ws.10%29.aspx Performing Nonauthoritative Restore of Active Directory Domain Services A nonauthoritative restore is the method for restoring Active Directory Domain Services (AD DS) from a system state, critical-volumes, or full server backup. A nonauthoritative restore returns the domain controller to its state at the time of backup and then allows normal replication to overwrite that state with any changes that occurred after the backup was taken. After you restore AD DS from backup, the domain controller queries its replication partners. Replication partners use the standard replication protocols to update AD DS and associated information, including the SYSVOL shared folder, on the restored domain controller. You can use a nonauthoritative restore to restore the directory service on a domain controller without reintroducing or changing objects that have been modified since the backup. The most common use of a nonauthoritative restore is to reinstate a domain controller, often after catastrophic or debilitating hardware failures. In the case of data corruption, do not use nonauthoritative restore unless you have confirmed that the problem is with AD DS. Nonauthoritative Restore Requirements You can perform a nonauthoritative restore from backup on a Windows Server 2008 system that is a standalone server, member server, or domain controller. On domain controllers that are running Windows Server 2008, you can stop and restart AD DS as a service. Therefore, in Windows Server 2008, performing offline defragmentation and other database management tasks does not require restarting the domain controller in Directory Services Restore Mode (DSRM). However, you cannot perform a nonauthoritative restore after simply stopping the AD DS service in regular startup mode. You must be able to start the domain controller in Directory Services Restore Mode (DSRM). If the domain controller cannot be started in DSRM, you must first reinstall the operating system. To perform a nonauthoritative restore, you need one of the following types of backup for your backup source: System state backup: Use this type of backup to restore AD DS. If you have reinstalled the operating system, you must use a critical-volumes or full server backup. If you are restoring a system state backup, use the wbadmin start systemstaterecovery command. Critical-volumes backup: A critical-volumes backup includes all data on all volumes that contain operating system and registry files, boot files, SYSVOL files, or Active Directory files. Use this type of backup if you want to restore more than the system state. To restore a critical-volumes backup, use the wbadmin start recovery command. Full server backup: Use this type of backup only if you cannot start the server or you do not have a system state or critical-volumes backup. A full server backup is generally larger than a critical-volumes backup. Restoring a full server backup not only rolls back data in AD DS to the time of backup, but it also rolls back all data in all other volumes. Rolling back this additional data is not necessary to achieve nonauthoritative restore of AD DS.

NEW QUESTION 4
A corporate network includes a single Active Directory Domain Services (AD DS) domain.
The HR department has a dedicated organizational unit (OU) named HR. The HR OU has two sub-OUs: HR Users and HR Computers. User accounts for the HR department reside in the HR Users OU. Computer accounts for the HR department reside in the HR Computers OU. All HR department employees belong to a security group named HR Employees. All HR department computers belong to a security group named HR PCs.
Company policy requires that passwords are a minimum of 6 characters.
You need to ensure that, the next time HR department employees change their passwords, the passwords are required to have at least 8 characters. The password length requirement should not change for employees of any other department.
What should you do?

• A. Modify the password policy in the GPO that is applied to the domai
• B. Create a new GPO, with the necessary password policy, and link it to the HR Users O
• C. Create a new GPO, with the necessary password policy, and link it to the HR Computers O
• D. Modify the password policy in the GPO that is applied to the domain controllers O

Answer: C

Explanation: http://technet.microsoft.com/en-us/library/cc770394.aspx
What do fine-grained password policies do?
You can use fine-grained password policies to specify multiple password policies within a single domain. You can use fine-grained password policies to apply different restrictions for password and account lockout policies to different sets of users in a domain.
For example, you can apply stricter settings to privileged accounts and less strict settings to the accounts of other users. In other cases, you might want to apply a special password policy for accounts whose passwords are synchronized with other data sources.
Are there any special considerations?
Fine-grained password policies apply only to user objects (or inetOrgPerson objects if they are used instead of user objects) and global security groups.By default, only
members of the Domain Admins group can set fine-grained password policies. However, you can also delegate the ability to set these policies to other users. The domain functional level must be Windows Server 2008.
Fine-grained password policy cannot be applied to an organizational unit (OU) directly. To apply fine-grained password policy to users of an OU, you can use a shadow group

NEW QUESTION 5
Your network contains an Active Directory domain named contoso.com.
You need to identify whether the Active Directory Recycle Bin is enabled.
What should you do?

• A. From Ldp, search for the Reanimate-Tombstones objec
• B. From Ldp, search for the LostAndFound containe
• C. From Windows PowerShell, run the Get-ADObject cmdle
• D. From Windows PowerShell, run the Get-ADOptionalFeature cmdle

Answer: D

Explanation:
http://www.frickelsoft.net/blog/?p=224
How can I check whether the AD Recycle-Bin is enabled in my R2 forest?
[He shows how to use the PowerShell cmdlet Get- ADOptionalFeature to determine if the AD Recycle Bin is enabled.]

NEW QUESTION 6
A corporate network contains a Windows Server 2008 R2 Active Directory forest. You need to add a user principal name (UPN) suffix to the forest. Which tool should you use?

• A. Active Directory Users and Computers console
• B. Active Directory Sites and Services console
• C. Ntdsutil
• D. Active Directory module for Windows PowerShell
• E. Active Directory Domains and Trusts Console

Answer: E

Explanation: Create Alternate UPN Suffix for a Domain To create an alternate UPN suffice in a domain, administrators must follow the steps given as below:
. Log on to Windows Server 2008 R2 domain controller with domain admin or enterprise admin account credentials.
. From the desktop screen, click.Start.
. From the Start menu, go to.Administrative Tools > Active Directory Domains and Trusts.
. On.Active Directory Domains and Trusts.snap-in, from the console tree in the left pane, right-clickActive Directory Domains and Trusts [computername.domainname].(‘srv2k8r2-dc01.mydomain.com’ in this demonstration).
. From the displayed context menu, click.Properties.
Click Properties Description:

http://www.tutorialspoint.com/shorttutorials/wp-content/uploads/2013/01/Add-Alternate-UPN-Suffix.jpg
. On the properties box that appears, in the.Alternative UPN suffixes.field, specify the desired alternate UPN suffix for the domain and click.Add.
. Once added, click.OK.to save the settings.
. Close.Active Directory Domains and Trusts.snap-in when done.

NEW QUESTION 7
Your network contains a domain controller that runs Windows Server 2008 R2.
You need to change the location of the Active Directory log files.
Which tool should you use?

• A. Dsamain
• B. Dsmgmt
• C. Dsmove
• D. Ntdsutil

Answer: AD

Explanation: http://support.microsoft.com/kb/257420 How To Move the Ntds.dit File or Log Files Moving a Database or Log File
1. Restart the domain controller.
2. Press F8 at the Startup menu, and then click Directory Services Restore Mode.
3. Select the appropriate installation if more than one exists, and then log on as an
administrator at the logon prompt.
4. Start a command prompt, and then type ntdsutil.exe.NOTE: To get a list of commands
that you can use at the Ntdsutil prompt, type ?
5. At a Ntdsutil prompt, type files.
6. At the File Maintenance prompt, use one or both of the following procedures:
* To move a database, type move db to %s, where %s is the drive and folder where you
want the database moved.
* To move log files, type move logs to %s, where %s is the drive and folder where you want
the log files moved.
7. To view the log files or database, type info. To verify the integrity of the database at its
new location, type integrity.
8. Type quit, and then type quit to return to a command prompt.
9. Restart the computer in Normal mode.
NOTE: When you move the database and log files, you must back up the domain
controller.

NEW QUESTION 8
Domains provide which of the following functions?

• A. Creating logical boundaries
• B. Easing the administration of users, groups, computers, and other objects
• C. Providing a central database of network objects
• D. All of the above

Answer: D

Explanation:
http://technet.microsoft.com/en-us/library/cc756901%28v=ws.10%29.aspx Active Directory Logical Structure Background Information Before you design your Active Directory logical structure, it is important to understand the Active Directory logical model. Active Directory is a distributed database that stores and manages information about network resources, as well as application-specific data from directory enabled applications. Active Directory allows administrators to organize elements of a network (such as users, computers, devices, and so on) into a hierarchical containment structure. The top-level container is the forest. Within forests are domains, and within domains are organizational units. This is called the logical model because it is independent of the physical aspects of the deployment, such as the number of domain controllers required within each domain and network topology. Figure 2.2 Relationship Between Active Directory Forests, Domains, and OUs.

C:Documents and Settingsusernwz1Desktop1.PNG

NEW QUESTION 9
A corporate network includes a single Active Directory Domain Services (AD D5) domain and two AD DS sites. The AD DS sites are named Toronto and Montreal. Each site has multiple domain controllers.
You need to determine which domain controller holds the Inter-Site Topology Generator role for the Toronto site.
What should you do?

• A. Use the Ntdsutil tool with the roles paramete
• B. Use the Ntdsutil tool with the local roles paramete
• C. Use the LDP tool to view the NTDS Site Settings for the Toronto sit
• D. Use the LDP tool to view the properties of each domain controller in the Toronto site

Answer: D

NEW QUESTION 10
Your network contains an Active Directory forest. The forest contains two domains named contoso.com and woodgrovebank.com. You have a custom attribute named Attributel in Active Directory. Attributel is associated to User objects. You need to ensure that Attributel is included in the global catalog. What should you do?

• A. From the Active Directory Schema snap-in, modify the properties of the Attributel attributeSchema objec
• B. In Active Directory Sites and Services, configure the Global Catalog settings for all domain controllers in the fores
• C. In Active Directory Users and Computers, configure the permissions on the Attributel attribute for User object
• D. From the Active Directory Schema snap-in, modify the properties of the User classSchema objec

Answer: A

NEW QUESTION 11
Your network contains an Active Directory domain named contoso.com. All domain controllers run a Server Core installation of Windows Server 2008 R2.
You need to identify which domain controller holds the PDC emulator role.
Which tool should you run?

• A. Get-AdForest
• B. Netdom.exe
• C. Get-AdOptionalFeature
• D. Query.exe

Answer: B

NEW QUESTION 12
Your company has a main office and 40 branch offices. Each branch office is configured as a separate Active Directory site that has a dedicated read-only domain controller (RODC).
An RODC server is stolen from one of the branch offices.
You need to identify the user accounts that were cached on the stolen RODC server.
Which utility should you use?

• A. Dsmod.exe
• B. Ntdsutil.exe
• C. Active Directory Sites and Services
• D. Active Directory Users and Computers

Answer: D

Explanation:
http://technet.microsoft.com/en-us/library/cc835486%28v=ws.10%29.aspx Securing Accounts After an RODC Is Stolen If you become aware of a stolen or otherwise compromised read-only domain controller (RODC), you should act quickly to delete the RODC account from the domain and to reset the passwords of the accounts whose current passwords are stored on the RODC. An efficient tool for removing the RODC computer account and resetting all the passwords for the accounts that were authenticated to it is the Active Directory Users and Computers snap-in.

NEW QUESTION 13
Your network contains an Active Directory forest named adatum.com.
You need to create an Active Directory Rights Management Services (AD RMS) licensing-only cluster.
What should you install before you create the AD RMS root cluster?

• A. The Failover Cluster feature
• B. The Active Directory Certificate Services (AD CS) role
• C. Microsoft Exchange Server 2010
• D. Microsoft SharePoint Server 2010
• E. Microsoft SQL Server 2008

Answer: E

Explanation:
http://technet.microsoft.com/en-us/library/cc771789.aspx
Before you install AD RMS
Before you install Active Directory Rights Management Services (AD RMS) on Windows
Server. 2008 R2 for the first time, there are several requirements that must be met:
(...)
In addition to pre-installation requirements for AD RMS, we strongly recommend the
following:
Install the database server that is used to host the AD RMS databases on a separate
computer.
(...)

NEW QUESTION 14
You need to identify all failed logon attempts on the domain controllers.
What should you do?

• A. View the Netlogon.log fil
• B. View the Security tab on the domain controller computer objec
• C. Run Event Viewe
• D. Run the Security and Configuration Wizar

Answer: C

Explanation:
http://support.microsoft.com/kb/174074 Security Event Descriptions This article contains descriptions of various security-related and auditing- related events, and tips for interpreting them. These events will all appear in the Security event log and will be logged with a source of "Security." Event ID: 529 Type: Failure Audit Description: Logon Failure: Reason: Unknown user name or bad password User Name: %1 Domain: %2 Logon Type: %3 Logon Process: %4 Authentication Package: %5 Workstation Name: %6 Event ID: 530 Type: Failure Audit Description: Logon Failure: Reason: Account logon time restriction violation User Name: %1 Domain: %2 Logon Type: %3 Logon Process: %4 Authentication Package: %5 Workstation Name: %6 Event ID: 531 Type: Failure Audit Description: Logon Failure: Reason: Account currently disabled User Name: %1 Domain: %2 Logon Type: %3 Logon Process: %4 Authentication Package: %5 Workstation Name: %6 Event ID: 532 Type: Failure Audit Description: Logon Failure: Reason: The specified user account has expired User Name: %1 Domain: %2 Logon Type: %3 Logon Process: %4 Authentication Package: %5 Workstation Name: %6 Event ID: 533 Type: Failure Audit Description: Logon Failure: Reason: User not allowed to logon at this computer User Name: %1 Domain: %2 Logon Type: %3 Logon Process: %4 Authentication Package: %5 Workstation Name: %6 Event ID: 534 Type: Failure Audit Description: Logon Failure: Reason: The user has not been granted the requested logon type at this machine User Name: %1 Domain: %2 Logon Type: %3 Logon Process: %4 Authentication Package: %5 Workstation Name: %6 Event ID: 535 Type: Failure Audit Description: Logon Failure: Reason: The specified account's password has expired User Name: %1 Domain: %2 Logon Type: %3 Logon Process: %4 Authentication Package: %5 Workstation Name: %6 Event ID: 536 Type: Failure Audit Description: Logon Failure: Reason: The NetLogon component is not active User Name: %1 Domain: %2 Logon Type: %3 Logon Process: %4 Authentication Package: %5 Workstation Name: %6 Event ID: 537 Type: Failure Audit Description: Logon Failure: Reason: An unexpected error occurred during logon User Name: %1 Domain: %2 Logon Type: %3 Logon Process: %4 Authentication Package: %5 Workstation Name: %6

NEW QUESTION 15
Your network contains an Active Directory domain.
You need to activate the Active Directory Recycle Bin in the domain.
Which tool should you use?

• A. Dsamain
• B. Add-PSSnapin
• C. Enable-ADOptionalFeature
• D. Add-WindowsFeature

Answer: C

Explanation: You can enable Active Directory Recycle Bin by using the following methods:
* Enable-ADOptionalFeature Active Directory module cmdlet (This is the recommended method.)
* Ldp.exe Note: Before you can make the recycle bin available, you must first update Active Directory schema with the required attributes. When you do this, the schema is updated, and then every object in the forest is updated with the recycle bin attributes as well. This process is irreversible once it is started.

NEW QUESTION 16
Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. The domain contains 50 domain controllers that run Windows Server 2008
R2.
The domain contains a group named Computer_Location.
You plan to create 1,000 computer accounts in the domain in several organizational units (OUs).
You need to ensure that the members of the Computer_Location group can modify the description of each computer account as soon as the account is created.
The solution must use permissions that are applied explicitly to the new computer accounts.
What should you do?

• A. Run the dsadd.exe command
• B. Run the nltest.exe comman
• C. Run the Set-AdDomain cmdle
• D. Run the dsmove.exe comman
• E. Run the dcpromo.exe comman
• F. Run the Move-AdDirectoryServer cmdle
• G. Use the Active Directory Schema snap-i
• H. Use the Active Directory Users and Computers consol

Answer: G

NEW QUESTION 17
Your network contains an enterprise certification authority (CA) that runs Windows Server
2008 R2 Enterprise.
You enable key archival on the CA. The CA is configured to use custom certificate
templates for Encrypted File System (EFS) certificates.
You need to archive the private key for all new EFS certificates. Which snap-in should you use?

• A. Active Directory Users and Computers
• B. Authorization Manager
• C. Group Policy Management
• D. Enterprise PKI
• E. Security Templates
• F. TPM Management
• G. Certificates
• H. Certification Authority
• I. Certificate Templates

Answer: I

Explanation:
http://technet.microsoft.com/en-us/library/cc753826.aspx
Configure a Certificate Template for Key Archival
The key archival process takes place when a certificate is issued. Therefore, a certificate template must be modified to archive keys before any certificates are issued based on this template.
Key archival is strongly recommended for use with the Basic Encrypting File System (EFS) certificate template in order to protect users from data loss, but it can also be useful when applied to other types of certificates.
To configure a certificate template for key archival and recovery
1. Open the Certificate Templates snap-in.
2. In the details pane, right-click the certificate template that you want to change, and then click Duplicate Template.
3. In the Duplicate Template dialog box, click Windows Server 2003 Enterprise unless all of your certification authorities (CAs) and client computers are running Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista.
4. In Template, type a new template display name, and then modify any other optional properties as needed.
5. On the Security tab, click Add, type the name of the users or groups you want to issue the certificates to, and then click OK.
6. Under Group or user names, select the user or group names that you just added. Under Permissions, select the Read and Enroll check boxes, and if you want to automatically issue the certificate, also select the Autoenroll check box.
7. On the Request Handling tab, select the Archive subject's encryption private key check box.
Original explanation: http://technet.microsoft.com/en-us/library/cc730721 Original explanation: http://technet.microsoft.com/en-us/library/cc730721

NEW QUESTION 18
You have a client computer named Computer1 that runs Windows 7.
On Computer1, you configure a source-initiated subscription.
You configure the subscription to retrieve all events from the Windows logs of a domain controller named DC1.
The subscription is configured to use the HTTP protocol.
You discover that events from the Security log of DC1 are not collected on Computer1. Events from the
Application log of DC1 and the System log of DC1 are collected on Computer1.
You need to ensure that events from the Security log of DC1 are collected on Computer1.
What should you do?

• A. Add the computer account of Computer1 to the Event Log Readers group on the domain controlle
• B. Add the Network Service security principal to the Event Log Readers group on the domai
• C. Configure the subscription to use custom Event Delivery Optimization setting
• D. Configure the subscription to use the HTTPS protoco

Answer: B

Explanation:
Explanation 1: http://blogs.technet.com/b/askds/archive/2011/08/29/the-security-log-haystack-event-forwarding-and-you.aspx Preparing Windows Server 2008 and Windows Server 2008 R2 You have to prepare your Windows Server 2008/2008 R2 machines for collection of security events. To do this, simply add the Network Service account to the Built-in Event Log Readers group. Explanation 2: http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/8434ffb3-1621-4bc5-8311-66d88b215886/ How to collect security logs using event forwarding? For Windows Vista, Windows Server 2008 and later version of clients, please follow the steps below to configure it.
1. Click start->run, type CompMgmt.msc to open Computer Management Console.
2. Under Local Users and Groups, click Groups->Event Log Readers to open Event Log
Readers Properties.
3. Click Add, then click Location button, select your computer and click OK.
4. Click Object Types button, check the checkbox of Build-in security principals and click
OK.
5. Add “Network Service”build-in account to Event Log Readers group.
6. Reboot the client computer.
After these steps have been taken, you will see the security event logs in the Forwarded
Events on your event collector.