Preparing 70-640 exam with vaild 70-640 exam dumps, trying PassLeader’s 70-640 vce dumps or 70-640 pdf dumps, our 70-640 exam dumps coverd all the real exam questions, all new 70-640 exam questions are available in PassLeader’s 70-640 braindumps. Our 651q 70-640 premium vce file is the best study guide for preparing 70-640 exam, browsing PassLeader’s website and download 651q 70-640 exam questions.
keywords: 70-640 exam,651q 70-640 exam dumps,651q 70-640 exam questions,70-640 pdf dumps,70-640 practice test,70-640 vce dumps,70-640 study guide,70-640 braindumps,TS: Windows Server 2008 Active Directory, Configuring Exam
QUESTION 521
Your network contains an Active Directory domain. The domain contains four domain controllers. You create a new application directory partition. You need to ensure that the new application directory partition replicates to only three of the domain controllers. Which tool should you use?
A. Active Directory Administrative Center
B. Dsamain
C. Dsmod
D. Ntdsutil
QUESTION 522
Your network contains an Active Directory domain named contoso.com. All domain controllers run a Server Core installation of Windows Server 2008 R2. You need to identify which domain controller holds the PDC emulator role. Which tool should you run?
A. Get-AdOptionalFeature
B. netdom.exe
C. Search-AdAccount
D. dsrm.exe
Answer: B
Explanation:
The FSMO role holders can be easily found by use of the Netdom command. On any domain controller, click Start, click Run, type CMD in the Open box, and then click OK. In the Command Prompt window, type netdom query /domain:<domain> fsmo (where <domain> is the name of YOUR domain).
Note: The five FSMO roles [in Windows 2003] are:
Schema master – Forest-wide and one per forest.
Domain naming master – Forest-wide and one per forest.
RID master – Domain-specific and one for each domain.
PDC – PDC Emulator is domain-specific and one for each domain.
Infrastructure master – Domain-specific and one for each domain.
QUESTION 523
Your network contains an Active Directory forest. The forest contains two domains. The forest contains four domain controllers. The domain controllers are configured as shown in the following table.
All user accounts are located in the child.contoso.com domain. Users in the child.contoso.com domain are members of several security groups in the contoso.com domain. Your company decides to change the naming standard of user accounts. You rename all of the user accounts to comply with the new standard. You discover that the old user names are listed in the members’ list of the security groups in the contoso.com domain. You need to ensure that the members’ list of the security groups in the contoso.com domain displays the new user names. What should you do?
A. Transfer the PDC emulator role from DC2 to DC3.
B. Configure DC5 as a global catalog server.
C. Configure DC1 as a global catalog server.
D. Transfer the infrastructure master role from DC3 to DC2.
Answer: D
QUESTION 524
You are decommissioning a child domain. The child domain contains five operations master roles. You need to transfer the forest operations master roles to a newly installed domain controller in a different child domain. Which two domain operations master roles should you transfer? (Each correct answer presents part of the solution. Choose two.)
A. RID master
B. PDC emulator
C. Schema master
D. Domain naming master
E. Infrastructure master
Answer: CD
Explanation:
Forestwide Operations Master Roles The schema master and domain naming master are forestwide roles, meaning that there is only one schema master and one domain naming master in the entire forest.
Note:
Operations Master Roles The five operations master roles are assigned automatically when the first domain controller in a given domain is created. Two forest-level roles are assigned to the first domain controller created in a forest and three domain-level roles are assigned to the first domain controller created in a domain. . The five FSMO roles [in Windows 2003] are: Schema master – Forest-wide and one per forest. Domain naming master – Forest-wide and one per forest. RID master – Domain-specific and one for each domain. PDC – PDC Emulator is domain-specific and one for each domain. Infrastructure master – Domain-specific and one for each domain.
QUESTION 525
Your network contains an Active Directory domain. The domain contains a certification authority (CA). The network contains several Layer 3 switches. You need to ensure that the switches can request certificates from the CA. Which role service should you deploy?
A. Network Device Enrollment Service
B. Windows Token-based Agent
C. Network Policy Server
D. Client Certificate Mapping Authentication
Answer: A
QUESTION 526
Your network contains an Active Directory forest named contoso.com. The forest contains an enterprise certification authority (CA). The enterprise CA is inaccessible from the internet. You have a server named Server1 that runs Windows Server 2008 R2. Server1 is accessible from the Internet. Server1 can communicate with the enterprise CA. You need to ensure that laptops that are joined to the domain can renew their certificates automatically from the Internet. Which two role services should you install on Server1? (To answer, select the two appropriate role services in the answer area.)
Answer:
QUESTION 527
Your network contains an Active Directory domain named contoso.com. The domain contains two member servers named Server1 and Server2. You configure Server1 as a standalone root certification authority (CA). You identify the following requirements for the public key infrastructure (PKI):
– The root CA must be offline once the PKI is deployed.
– Users must be able to enroll for certificates automatically.
You need to configure Server2 to meet the PKI requirements. What should you configure on Server2?
A. A standalone subordinate CA
B. A standalone root CA
C. An enterprise subordinate CA
D. An enterprise root CA
Answer: C
QUESTION 528
Your network contains an Active Directory domain named contoso.com. The aging and scavenging settings of the contoso.com zone are configured as shown in the exhibit. (Click the Exhibit button.)
To answer, complete each statement according to the information presented in the exhibit.
Answer:
QUESTION 529
Your network contains an Active Directory domain named contoso.com. The domain contains three domain controllers named DC1, DC2 and DC3. You need to create a zone named adatum.com that replicates between DC1 and DC2 only. The zone data for adatum.com must be writable on both DC1 and DC2. Which three actions should you perform in sequence? (To answer, move the appropriate three actions from the list of actions to the answer area and arrange them in the correct order.)
Answer:
QUESTION 530
Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2008 R2. The domain contains a domain controller named DC1. DC1 hosts an Active Directory-integrated zone for contoso.com. You enable record scavenging for contoso.com by using the default settings. You configure scavenging to run every seven days. After 30 days, you discover that some DNS records of computers that were removed from the network are still present in the contoso.com zone. You need to ensure that the scavenging process can remove the stale records.What command should you run? (To answer, select the appropriate options in the answer area.)
Answer:
http://www.passleader.com/70-640.html
QUESTION 531
Your network consists of an Active Directory forest that contains one domain named contoso.com. All domain controllers run Windows Server 2008 R2 and are configured as DNS servers. You have two Active Directory-integrated zones: contoso.com and nwtraders.com. You need to ensure a user is able to modify records in the nwtraders.com zone. The solution must prevent the user from modifying the SOA record in the contoso.com zone. What should you do?
A. From the DNS Manager console, modify the permissions of the nwtraders.com zone.
B. From the DNS Manager console, modify the permissions of the contoso.com zone.
C. From the Active Directory Users and Computers console, run the Delegation of Control Wizard.
D. From the Active Directory Users and Computers console, modify the permissions of the Domain Controllers organizational unit (OU).
Answer: A
QUESTION 532
Your network contains 50 domain controllers that runs Windows Server 2008 R2. You need to create a script that resets the Directory Services Restore Mode (DSRM) password on all of the domain controllers. The solution must NOT maintain passwords in the script. Which two tools should you use? (Each correct answer presents part of the solution. Choose two.)
A. Active Directory Users and Computers
B. Ntdsutil
C. Dsamain
D. Local Users and Groups
Answer: BD
QUESTION 533
Your network contains an Active Directory domain. The domain contains four domain controllers. You modify the Active Directory schema. You need to verify that all the domain controllers received the schema modification. Which command should you run?
A. netdom.exe query fsmo
B. repadmin.exe /showrepl *
C. dcdiag.exe /e /test:Topology
D. dcdiag.exe /a
Answer: B
QUESTION 534
Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1. You install Active Directory Lightweight Directory Services (AD LDS) on a member server named Server2. On Server2, you create a directory partition named fabrikam.com. You need to configure the MS-AdamSyncConfig.xml file to synchronize data from contoso.com to fabrikam.com. What should you do? (To answer, select the appropriate options in the answer area.)
Answer:
QUESTION 535
Your network contains an Active Directory domain named contoso.com. The domain has a branch site that contains a read-only domain controller (RODC) named R0DC1. A user named User1 is a member of the Allowed RODC Password Replication Group. User1 frequently logs on to a computer in the branchsite. You remove User1 from the Allowed RODC Password Replication Group. You need to ensure that the password of User1 is no longer cached on RODC1. What should you do?
A. Add User1 to the Denied RODC Password Replication Group, and then force Active Directory replication.
B. Run repadmin /rodcpwdrepl rodc2.contoso.com dc.contoso.com cn = User1,cn-users,dc = contoso,dccom.
C. Run repadmin /prp delete rodcl.contoso.com allow cn = User1, cn = users, dc = contoso,dc = com.
D. Reset the password of User1, and then force Active Directory replication.
Answer: D
QUESTION 536
Your network contains an Active Directory forest. The forest contains a single domain named contoso.com. The domain contains domain controllers that run either Windows Server 2003 or Windows Server 2008 R2. The functional level of the domain and the forest is Windows Server 2003. You need to add a read-only domain controller (RODC) to the forest. What should you do first?
A. Upgrade the domain controllers that run Windows Server 2003.
B. Raise the domain functional level.
C. Run the adprep command.
D. Raise the forest functional level.
Answer: C
QUESTION 537
Your company has two offices. The offices are located in Miami and London. The network contains an Active Directory forest named contoso.com. The forest contains two child domains named miami.contoso.com and london.contoso.com. Each domain contains 50 domain controllers that run Windows Server 2008 R2. Each office is configured as an Active Directory site. The office in London recently hired several thousand new employees. You need to move 10 domain controllers from miami.contoso.com to london.contoso.com. What should you do?
A. Run the dsadd.exe command.
B. Run the nltest.exe command.
C. Run the Set-AdDomain cmdlet.
D. Run the dsmove.exe command.
E. Run the dcpromo.exe command.
F. Run the Move-AdDirectoryServer cmdlet.
G. Use the Active Directory Schema snap-in.
H. Use the Active Directory Users and Computers console.
Answer: E
QUESTION 538
Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. The domain contains 50 domain controllers that run Windows Server 2008 R2. The domain contains a group named Computer_Location. You plan to create 1,000 computer accounts in the domain in several organizational units (OUs). You need to ensure that the members of the Computer_Location group can modify the description of each computer account as soon as the account is created. The solution must use permissions that are applied explicitly to the new computer accounts. What should you do?
A. Run the dsadd.exe command.
B. Run the nltest.exe command.
C. Run the Set-AdDomain cmdlet.
D. Run the dsmove.exe command.
E. Run the dcpromo.exe command.
F. Run the Move-AdDirectoryServer cmdlet.
G. Use the Active Directory Schema snap-in.
H. Use the Active Directory Users and Computers console.
Answer: G
QUESTION 539
Your company has two offices. The offices are located in Miami and London. The network contains an Active Directory forest named contoso.com. The forest contains two child domains named miami.contoso.com and london.contoso.com. The domain contains 50 domain controllers that run Windows Server 2008 R2. Each office is configured as an Active Directory site. The forest contains a custom attribute named SecurityAccessCode. You recently configured a domain controller named DC22 as a global catalog server. You need to verify that SecurityAccessCode is configured to replicate to DC22. What should you do?
A. Run the dsadd.exe command.
B. Run the nltest.exe command.
C. Run the Set-AdDomain cmdlet.
D. Run the dsmove.exe command.
E. Run the dcpromo.exe command.
F. Run the Move-AdDirectoryServer cmdlet.
G. Use the Active Directory Schema snap-in.
H. Use the Active Directory Users and Computers console.
Answer: G
QUESTION 540
Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1. DC1 hosts an Active Directory-integrated zone for contoso.com. The research department maintains its own DNS servers and hosts a zone named research.contoso.com on a UNIXbased server named Server1. The perimeter network contains a DNS server named Server2. Server2 is a standalone server that runs Windows Server 2008 R2. You need to configure the DNS settings of Server2 to meet the following requirements:
– Server2 must maintain a copy of all the records in research.contoso.com.
– DC1 must query Server2 to resolve the names of Internet hosts.
Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)
A. Create a secondary zone.
B. Create a conditional forwarder.
C. Create a stub zone.
D. Create a primary zone.
E. Create a Forwarder.
Answer: AE
Explanation:
A: When a zone that this DNS server hosts is a secondary zone, this DNS server is a secondary source for information about this zone. The zone at this server must be obtained from another remote DNS server computer that also hosts the zone. This DNS server must have network access to the remote DNS server that supplies this server with updated information about the zone. Because a secondary zone is merely a copy of a primary zone that is hosted on another server, it cannot be stored in AD DS.
E: A forwarder is a Domain Name System (DNS) server on a network that is used to forward DNS queries for external DNS names to DNS servers outside that network.
Incorrect: Not B: You can configure your server to forward queries according to specific domain names using conditional forwarders.
