83-640

TS: Windows Server 2008 Active Directory, Configuring

Version: 1.0
QUESTION NO: 1

Your company hires 10 new employees. You want the new employees to connect to the main
office through a VPN connection. You create new user accounts and grant the new employees
the Allow Read and Allow Execute permissions to shared resources in the main office. The new
employees are unable to access shared resources in the main office. You need to ensure that
users are able to establish a VPN connection to the main office. What should you do?

A. Grant the new employees the Allow Full control permission.

B. Grant the new employees the Allow Access Dial-in permission.
C. Add the new employees to the Remote Desktop Users security group.
D. Add the new employees to the Windows Authorization Access security group.

Answer: B

QUESTION NO: 2

Your company has an Active Directory forest that contains a single domain. The domain member
server has an Active Directory Federation Services (AD FS) role installed. You need to configure
AD FS to ensure that AD FS tokens contain information from the Active Directory domain. What
should you do?

A. Add and configure a new account store.

B. Add and configure a Claims-aware application.
C. Add and configure a new account partner.
D. Add and configure a new resource partner.

Answer: A

QUESTION NO: 3

Your company has a DNS server that has 10 Active Directory-integrated zones. You need to
provide copies of the zone files of the DNS server to the security department. What should you
do?

A. Run the dnscmd /Zonelnfo command.

B. Run the ipconfig /registerdns command.
C. Run the dnscmd /ZoneExport command.
D. Run the ntdsutil > Partition Management > List commands.

Answer: C

QUESTION NO: 4

You have a Windows Server 2008 Enterprise Root CA. Security policy prevents port 443 and port
80 from being opened on domain controllers and on the issuing CA. You need to allow users to
request certificates from a Web interface. You install the AD CS role. What should you do next?

A. Configure the Online Responder Role Service on a member server.

B. Configure the Online Responder Role Service on a domain controller.
C. Configure the Certification Authority Web Enrollment Role Service on a member server.
D. Configure the Certification Authority Web Enrollment Role Service on a domain controller.

Answer: C

QUESTION NO: 5

Your network consists of a single Active Directory domain. All domain controllers run Windows
Server 2008. You need to capture all replication errors from all domain controllers to a central
location. What should you do?

A. Configure event log subscriptions.

B. Start the System Performance data collector set.
C. Start the Active Directory Diagnostics data collector set.
D. Install Network Monitor and create a new a new capture.

Answer: A

QUESTION NO: 6

Your company has two Active Directory forests named contoso.com and fabrikam.com. The
company network has three DNS servers named DNS1, DNS2, and DNS3. The DNS servers are
configured as shown in the following table.

All computers that belong to the fabrikam.com domain have DNS3 configured as the preferred
DNS server. All other computers use DNS1 as the preferred DNS server. Users from the
fabrikam.com domain are unable to connect to the servers that belong to the contoso.com
domain. You need to ensure users in the fabrikam.com domain are able to resolve all
contoso.com queries. What should you do?

A. Create a copy of the _msdcs.contoso.com zone on the DNS3 server.

B. Create a copy of the fabrikam.com zone on the DNS1 server and the DNS2 server.
C. Configure conditional forwarding on DNS3 to forward contoso.com queries to DNSL
D. Configure conditional forwarding on DNS1 and DNS2 to forward fabrikam.com queries to
DNS3.

Answer: C

QUESTION NO: 7

Your network consists of a single Active Directory domain. All domain controllers run Windows
Server 2008. The Audit account management policy setting and Audit directory services access
setting are enabled for the entire domain. You need to ensure that changes made to Active
Directory objects can be logged. The logged changes must include the old and new values of any
attributes. What should you do?

A. Enable the Audit account management policy in the Default Domain Controller Policy.
B. Run auditpol.exe and then configure the Security settings of the Domain Controllers OU.
C. Run auditpol.exe and then enable the Audit directory service access setting in the Default
Domain policy.
D. From the Default Domain Controllers policy, enable the Audit directory service access setting
and enable directory service changes.

Answer: B

QUESTION NO: 8

You have a domain controller named DC1 that runs Windows Server 2008. DC1 is configured as
a DNS Server for contoso.com. You install the DNS Server role on a member server named
Server! and then you create a standard secondary zone for contoso. com. You configure DC1 as
the master server for the zone. You need to ensure that Serverl receives zone updates from DC1.
What should you do?

A. On Server1, add a conditional forwarder.

B. On DC1, modify the permissions of contoso.com zone.
C. On DC1, modify the zone transfer settings for the contoso.com zone.
D. Add the Server1 computer account to the DNSUpdateProxy group.

Answer: C

QUESTION NO: 9

Your company has an Active Directory domain. The company has purchased 100 new computers.
You want to deploy the computers as members of the domain. You need to create the computer
accounts in an organizational unit. What should you do?

A. Run the csvde f computers.csv command.

B. Run the Idifde f computers.Idf command.
C. Run the dsadd computer <computerdn> command.
D. Run the dsmod computer <computerdn> command.

Answer: C

QUESTION NO: 10

Your company, Contoso, Ltd., has a main office and a branch office. The offices are connected by
a WAN link. Contoso has an Active Directory forest that contains a single domain named
ad.contoso.com. The ad.contoso.com domain contains one domain controller named DC1 that is
located in the main office. DC1 is configured as a DNS server for the ad.contoso.com DNS zone.
This zone is configured as a standard primary zone.
You install a new domain controller named DC2 in the branch office. You install DNS on DC2. You
need to ensure that the DNS service can update records and resolve DNS queries in the event
that a WAN link fails. What should you do?

A. Create a new stub zone named ad.contoso.com on DC2.

B. Configure the DNS server on DC2 to forward requests to DC1.
C. Create a new standard secondary zone named ad.contoso.com on DC2.
D. Convert the ad.contoso.com zone on DC1 to an Active Directory-integrated zone.
Answer: D

QUESTION NO: 11

Your company has an Active Directory domain. The company has two domain controllers named
DC1 and DC2. DC1 holds the Schema Master role. DC1 fails. You log on to Active Directory by
using the administrator account. You are not able to transfer the Schema Master operations role.
You need to ensure that DC2 holds the Schema Master role. What should you do?

A. Register the Schmmgmt.dll. Start the Active Directory Schema snap-in.

B. Configure DC2 as a bridgehead server.
C. On DC2, seize the Schema Master role.
D. Log off and log on again to Active Directory by using an account that is a member of the
Schema Administrators group. Start the Active Directory Schema snap-in.

Answer: C

QUESTION NO: 12

Your network consists of an Active Directory forest that contains one domain. All domain
controllers run Windows Server 2008 and are configured as DNS servers. You have an Active
Directory-integrated zone. You have two Active Directory sites. Each site contains five domain
controllers. You add a new NS record to the zone. You need to ensure that all domain controllers
immediately receive the new NS record. What should you do?

A. From the DNS Manager console, reload the zone.

B. From the Services snap-in, restart the DNS Server service.
C. From the command prompt, run repadmin /syncall.
D. From the DNS Manager console, increase the version number of the SOA record.

Answer: C

QUESTION NO: 13

Your company has an Active Directory forest. The company has branch offices in three locations.
Each location has an organizational unit. You need to ensure that the branch office administrators
are able to create and apply GPOs only to their respective organizational units. Which two actions
should you perform? (Each correct answer presents part of the solution. Choose two.}

A. Add the user accounts of the branch office administrators to the Group Policy Creator Owners
Group.
B. Modify the Managed By tab in each organizational unit to add the branch office administrators
to their respective organizational units.
C. Run the Delegation of Control wizard and delegate the right to link GPOs for the domain to the
branch office administrators.
D. Run the Delegation of Control wizard and delegate the right to link GPOs for their branch
organizational units to the branch office administrators.

Answer: A, D

QUESTION NO: 14
Your company has a branch office that is configured as a separate Active Directory site and has
an Active Directory domain controller. The Active Directory site requires a local Global Catalog
server to support a new application. You need to configure the domain controller as a Global
Catalog server. Which tool should you use?

A. The Dcpromo.exe utility

B. The Server Manager console
C. The Computer Management console
D. The Active Directory Sites and Services console
E. The Active Directory Domains and Trusts console

Answer: D

QUESTION NO: 15

Your company has an Active Directory domain. All servers run Windows Server 2008. You deploy
a certificate authority server. You create a new global security group named Cerllssuers. You
need to ensure that members of the Certlssuers group can issue, approve, and revoke
certificates. What should you do?

A. Assign the Certificate Manager role to the Certlssuers group.

B. Place the Certlssuers group in the Cert Publishers group.
C. Run the certsrv add Certlssuers command at the command prompt of the certificate server.
D. Run the add-member-membertype Memberset Certlssuers command by using Microsoft
Windows PowerShell.

Answer: A

QUESTION NO: 16

Your company has a single Active Directory domain. All domain controllers run Windows Server
2003. You install Windows Server 2008 on a server. You need to add the new server as a domain
controller in your domain. What should you do first?

A. On the new server, run dcpromo /adv.

B. On the new server, run dcpromo /createdcaccount.
C. On a domain controller run adprep /rodcprep.
D. On a domain controller, run adprep /forestprep.

Answer: D

QUESTION NO: 17

Your company has a single Active Directory domain named intranet.adatum.com. The domain
controllers run Windows Server 2008 and the DNS server role. All computers, including non-
domain members, dynamically register their DNS records. You need to configure the
intranet.adatum.com zone to allow only domain members to dynamically register DNS records.
What should you do?

A. Set dynamic updates to Secure Only.

B. Enable zone transfers to Name Servers.
C. Remove the Authenticated Users group.
D. Deny the Everyone group the Create All Child Objects permission.
Answer: A

QUESTION NO: 18

Your company has an Active Directory domain that has an organizational unit named Sales. The
Sales organizational unit contains two global security groups named sales managers and sales
executives. You need to apply desktop restrictions to the sales executives group. You must not
apply these desktop restrictions to the sales managers group. You create a GPO named
DesktopLockdown and link it to the Sales organizational unit. What should you do next?

A. Configure the Deny Apply Group Policy permission for the sales managers on the
DesktopLockdown GPO.
B. Configure the Deny Apply Group Policy permission for the sales executives on the
DesktopLockdown GPO.
C. Configure the Deny Apply Group Policy permission for Authenticated Users on the
DesktopLockdown GPO.
D. Configure the Allow Apply Group Policy permission for Authenticated Users on the
DesktopLockdown GPO.

Answer: A

QUESTION NO: 19

Your company has an Active Directory domain named contoso.com. The company network has
two DNS servers named DNS1 and DNS2.

The DNS servers are configured as shown in the following table. Domain users, who are
configured to use DNS2 as the preferred DNS server, are unable to connect to Internet Web
sites. You need to enable Internet name resolution for all client computers. What should you do?

A. Create a copy of the .(root) zone on DNSL

B. Update the list of root hints servers on DNS2.
C. Update the Cache.dns file on DNS2. Configure conditional forwarding on DNS1.
D. Delete the .(root) zone from DNS2. Configure conditional forwarding on DNS2.

Answer: D

QUESTION NO: 20

Your company has an Active Directory forest. You plan to install an Enterprise certification
authority (CA) on a dedicated stand-alone server. When you attempt to add the Active Directory
Certificate Services (AD CS) role, you find that the Enterprise CA option is not available. You
need to install the AD CS role as an Enterprise CA. What should you do first?

A. Add the DNS Server role.

B. Join the server to the domain.
C. Add the Web server (IIS) role and the AD CS role.
D. Add the Active Directory Lightweight Directory Service (AD LDS) role.

Answer: B

QUESTION NO: 21

Your company purchases a new application to deploy on 200 computers. The application requires
that you modify the registry on each target computer before you install the application. The
registry modifications are in a file that has an .adm extension. You need to prepare the target
computers for the application. What should you do?

A. Import the .adm file into a new Group Policy Object (GPO). Edit the GPO and link it to an
organizational unit that contains the target computers.
B. Create a Microsoft Windows PowerShell script to copy the .adm file to the startup folder of
each target computer.
C. Create a Microsoft Windows PowerShell script to copy the .adm file to each computer. Run the
REDIRUsr CONTAINER-DN command on each target computer.
D. Create a Microsoft Windows PowerShell script to copy the .adm file to each computer. Run the
REDIRCmp CONTAINER-DN command on each target computer.

Answer: A

QUESTION NO: 22

Your company has an Active Directory forest. The company has three locations. Each location
has an organizational unit and a child organizational unit named Sales. The Sales organizational
unit contains all users and computers of the sales department. The company plans to deploy a
Microsoft Office 2007 application on all computers within the three Sales organizational units. You
need to ensure that the Office 2007 application is installed only on the computers in the Sales
organizational units. What should you do?

A. Create a Group Policy Object (GPO) named SalesAPP GPO. Configure the GPO to assign the
application to the computer account. Link the SalesAPP GPO to the domain.
B. Create a Group Policy Object (GPO) named SalesAPP GPO. Configure the GPO to assign the
application to the user account. Link the SalesAPP GPO to the Sales organizational unit in each
location.
C. Create a Group Policy Object (GPO) named SalesAPP GPO. Configure the GPO to publish
the application to the user account. Link the SalesAPP GPO to the Sales organizational unit in
each location.
D. Create a Group Policy Object (GPO) named SalesAPP GPO. Configure the GPO to assign the
application to the computer account. Link the SalesAPP GPO to the Sales organizational unit in
each location.

Answer: D

QUESTION NO: 23

Your company has a main office and 10 branch offices. Each branch office has an Active
Directory site that contains one domain controller. Only domain controllers in the main office are
configured as Global Catalog servers. You need to deactivate the Universal Group Membership
Caching (UGMC) option on the domain controllers in the branch offices. At which level should you
deactivate UGMC?
A. Site
B. Server
C. Domain
D. Connection object

Answer: A

QUESTION NO: 24

You need to identify all failed logon attempts on the domain controllers. What should you do?

A. Run Event Viewer.

B. View the Netlogon.log file.
C. Run the Security and Configuration Wizard.
D. View the Security tab on the domain controller computer object.

Answer: A

QUESTION NO: 25

Your company has an Active Directory forest that contains client computers that run Windows
Vista and Microsoft Windows XP. You need to ensure that users are able to install approved
application updates on their computers. Which two actions should you perform? (Each correct
answer presents part of the solution. Choose two.)

A. Set up Automatic Updates through Control Panel on the client computers.

B. Create a GPO and link it to the Domain Controllers organizational unit. Configure the GPO to
automatically search for updates on the Microsoft Update site.
C. Create a GPO and link it to the domain. Configure the GPO to direct the client computers to
the Microsoft WSUS server for approved updates.
D. Install the Microsoft WSUS application on a server in the environment. Configure the server to
search for new updates on the Internet. Approve all required updates.

Answer: C, D

QUESTION NO: 26

Your company has a single Active Directory domain named intranet.contoso.com. All domain
controllers run Windows Server 2008. The domain functional level and the forest functional level
are set to Windows 2000 native mode. You need to ensure the UPN suffix for contoso.com is
available for user accounts. What should you do first?

A. Raise the contoso.com forest functional level to Windows Server 2003 or Windows Server
2008.
B. Raise the contoso.com domain functional level to Windows Server 2003 or Windows Server
2008.
C. Add the new UPN suffix to the forest.
D. Change the Primary DNS Suffix option in the Default Domain Controllers Group Policy Object
(GPO) to contoso.com.

Answer: C
QUESTION NO: 27

Your network consists of a single Active Directory domain.? All domain controllers run Windows
Server 2008. You need to identify the Lightweight Directory Access Protocol (LDAP) clients that
are using the largest amount of available CPU resources on a domain controller. What should you
do?

A. Review performance data in Resource Monitor.

B. Review the Hardware Events log in the Event Viewer.
C. Run the LAN Diagnostics Data Collector Set. Review the LAN Diagnostics report.
D. Run the Active Directory Diagnostics Data Collector Set. Review the Active Directory
Diagnostics report.

Answer: D

QUESTION NO: 28

You need to relocate the existing user and computer objects in your company to different
organizational units. What are two possible ways to achieve this goal? (Each correct answer
presents a complete solution. Choose two.)

A. Run the Dsmod utility.

B. Run the Active Directory Migration Tool (ADMT).
C. Run the Active Directory Users and Computers utility.
D. Run the move-item command in the Microsoft Windows PowerShell utility.

Answer: A, C

QUESTION NO: 29

Your company has file servers located in an organizational unit named Payroll. The file servers
contain payroll files located in a folder named Payroll. You create a GPO. You need to track which
employees access the Payroll files on the file servers. What should you do?

A. Enable the Audit object access option. Link the GPO to the Payroll organizational unit. On the
file servers, configure Auditing for the Everyone group in the Payroll folder.
B. Enable the Audit object access option. Link the GPO to the domain. On the domain controllers,
configure Auditing for the Authenticated Users group in the Payroll folder.
C. Enable the Audit process tracking option. Link the GPO to the Domain Controllers
organizational unit. On the file servers, configure Auditing for the Authenticated Users group in the
Payroll folder.
D. Enable the Audit process tracking option. Link the GPO to the Payroll organizational unit. On
the file servers, configure Auditing for the Everyone group in the Payroll folder.

Answer: A

QUESTION NO: 30

Your network consists of a single Active Directory domain. The domain contains 10 domain
controllers. The domain controllers run Windows Server 2008 and are configured as DNS
servers. You plan to create a new Active Directory-integrated zone. You need to ensure that the
new zone is only replicated to four of your domain controllers. What should you do first?

A. Create a new delegation in the ForestDnsZones application directory partition.

B. Create a new delegation in the DomainDnsZones application directory partition.
C. From the command prompt, run dnscmd and specify the /enlistdirectorypartition parameter.
D. From the command prompt, run dnscmd and specify the /createdirectorypartition parameter.

Answer: D

QUESTION NO: 31

Your company has a main office and a branch office. The company has a single-domain Active
Directory forest. The main office has two domain controllers named DC1 and DC2 that run
Windows Server 2008. The branch office has a Windows Server 2008 read-only domain controller
(RODC) named DC3. All domain controllers hold the DNS Server role and are configured as
Active Directory-integrated zones.
The DNS zones only allow secure updates. You need to enable dynamic DNS updates on DC3.
What should you do?

A. Run the Ntdsutil.exe > DS Behavior commands on DC3.

B. Run the Dnscmd.exe /ZoneResetType command on DC3.
C. Reinstall Active Directory Domain Services on DC3 as a writable domain controller.
D. Create a custom application directory partition on DC1. Configure the partition to store Active
Directory-integrated zones.

Answer: C

QUESTION NO: 32

Your company has an Active Directory domain. You log on to the domain controller. The Active
Directory Schema snap-in is not available in the Microsoft Management Console (MMC). You
need to access the Active Directory Schema snap-in. What should you do?

A. Register Schmmgmt.dll.
B. Log off and log on again by using an account that is a member of the Schema Administrators
group.
C. Use the Ntdsutil.exe command to connect to the Schema Master operations master and open
the schema for writing.
D. Add the Active Directory Lightweight Directory Services (AD LDS) role to the domain controller
by using Server Manager.

Answer: A

QUESTION NO: 33

Your company has an Active Directory domain that runs Windows Server 2008. The Sales OU
contains an OU for Computers, an OU for Groups, and an OU for Users. You perform nightly
backups. An administrator deletes the Groups OU. You need to restore the Groups OU without
affecting users and computers in the Sales OU. What should you do?

A. Perform an authoritative restore of the Sales OU.

B. Perform an authoritative restore of the Groups OU.
C. Perform a non-authoritative restore of the Groups OU.
D. Perform a non-authoritative restore of the Sales OU.

Answer: B

QUESTION NO: 34

Your network consists of an Active Directory forest that contains one domain. All domain
controllers run Windows Server 2008 and are configured as DNS servers. You have an Active
Directory-integrated zone. You have two Active Directory sites. Each site contains five domain
controllers. You add a new NS record to the zone. You need to ensure that all domain controllers
immediately receive the new NS record. What should you do?

A. From the DNS Manager console, reload the zone.

B. From the Services snap-in, restart the DNS Server service.
C. From the command prompt, run repadmin /syncall.
D. From the DNS Manager console, increase the version number of the SOA record.

Answer: C

QUESTION NO: 35

All consultants belong to a global group named TempWorkers. You place three file servers in a
new organizational unit named SecureServers. The three file servers contain confidential data
located in shared folders. You need to record any attempts made by the consultants to access the
confidential data. Which two actions should you perform? (Each correct answer presents part of
the solution. Choose two.

A. Create and link a new GPO to the SecureServers organizational unit. Configure the Audit
privilege use Failure audit policy setting.
B. Create and link a new GPO to the SecureServers organizational unit. Configure the Audit
object access Failure audit policy setting.
C. Create and link a new GPO to the SecureServers organizational unit. Configure the Deny
access to this computer from the network user rights setting for the TempWorkers global group.
D. On each shared folder on the three file servers, add the three servers to the Auditing tab.
Configure the Failed Full control setting in the Auditing Entry dialog box.
E. On each shared folder on the three file servers, add the TempWorkers global group to the
Auditing tab. Configure the Failed Full control setting in the Auditing Entry dialog box.

Answer: B, E

QUESTION NO: 36

Your company has a main office and a branch office. You deploy a read-only domain controller
(RODC) that runs Microsoft Windows Server 2008 to the branch office. You need to ensure that
users at the branch office are able to log on to the domain by using the RODC. What should you
do?

A. Add another RODC to the branch office.

B. Configure a new bridgehead server in the main office.
C. Configure the Password Replication Policy on the RODC.
D. Decrease the replication interval for all connection objects by using the Active Directory Sites
and Services console.
Answer: C

QUESTION NO: 37

You have a domain controller named DC1 that runs Windows Server 2008. DC1 is configured as
a DNS Server for contoso.com. You install the DNS Server role on a member server named
Server! and then you create a standard secondary zone for contoso. com. You configure DC1 as
the master server for the zone. You need to ensure that Serverl receives zone updates from DC1.
What should you do?

A. On Server1, add a conditional forwarder.

B. On DC1, modify the permissions of contoso.com zone.
C. On DC1, modify the zone transfer settings for the contoso.com zone.
D. Add the Server1 computer account to the DNSUpdateProxy group.

Answer: C

QUESTION NO: 38

Your company has an Active Directory forest. Each branch office has an organizational unit and a
child organizational unit named Sales. The Sales organizational unit contains all users and
computers of the sales department. You need to install an Office 2007 application only on the
computers in the Sales organizational unit. You create a GPO named SalesApp GPO. What
should you do next?

A. Configure the GPO to assign the application to the computer account. Link the SalesAPP GPO
to the domain.
B. Configure the GPO to assign the application to the user account. Link the SalesAPP GPO to
the Sales organizational unit in each location.
C. Configure the GPO to publish the application to the user account. Link the SalesAPP GPO to
the Sales organizational unit in each location.
D. Configure the GPO to assign the application to the computer account. Link the SalesAPP GPO
to the Sales organizational unit in each location.

Answer: D

QUESTION NO: 39

You have an existing Active Directory site named Site1. You create a new Active Directory site
and name it Site2. You need to configure Active Directory replication between Site1 and Site2.
You install a new domain controller. You create the site link between Site1 and Site2. What should
you do next?

A. Use the Active Directory Sites and Services console to configure a new site link bridge object.
B. Use the Active Directory Sites and Services console to decrease the site link cost between
Site1 andSite2.
C. Use the Active Directory Sites and Services console to assign a new IP subnet to Site2. Move
the new domain controller object to Site2.
D. Use the Active Directory Sites and Services console to configure the new domain controller as
a preferred bridgehead server for Site1.
Answer: C

QUESTION NO: 40

You have two servers named Server1 and Server2. Both servers run Windows Server 2008.
Server1 is configured as an enterprise root certification authority (CA). You install the Online
Responder role service on Server2. You need to configure Server1 to support the Online
Responder. What should you do?

A. Import the enterprise root CA certificate.

B. Configure the Certificate Distribution Point (CDP) extension.
C. Configure the Authority Information Access (AIA) extension.
D. Add the Server2 computer account to the CertPublishers group.

Answer: C

QUESTION NO: 41

Your company has a main office and a branch office. The company has a single-domain Active
Directory forest. The main office has two domain controllers named DC1 and DC2 that run
Windows Server 2008. The branch office has a Windows Server 2008 read-only domain controller
(RODC) named DC3. All domain controllers hold the DNS Server role and are configured as
Active Directory-integrated zones. The DNS zones only allow secure updates. You need to
enable dynamic DNS updates on DC3. What should you do?

A. Run the Ntdsutil.exe > DS Behavior commands on DC3.

B. Run the Dnscmd.exe /ZoneResetType command on DC3.
C. Reinstall Active Directory Domain Services on DC3 as a writable domain controller.
D. Create a custom application directory partition on DC1. Configure the partition to store Active
Directory-integrated zones.

Answer: C

QUESTION NO: 42

Your company has an Active Directory forest that runs at the functional level of Windows Server
2008. You implement Active Directory Rights Management Services (AD RMS). You install
Microsoft SQL Server 2005. When you attempt to open the AD RMS administration Web site, you
receive the following error message: "SQL Server does not exist or access denied." You need to
open the AD RMS administration Web site. Which two actions should you perform? (Each correct
answer presents part of the solution. Choose two.)

A. Restart IIS.
B. Install Message Queuing.
C. Start the MSSQLSVC service.
D. Manually delete the Service Connection Point in AD DS and restart AD RMS.

Answer: A, C

QUESTION NO: 43
Your network consists of a single Active Directory domain. All domain controllers run Windows
Server 2008 and are configured as DNS servers. A domain controller named DC1 has a standard
primary zone for contoso.com. A domain controller named DC2 has a standard secondary zone
for contoso.com. You need to ensure that the replication of the contoso.com zone is encrypted.
You must not lose any zone data. What should you do?

A. On both servers, modify the interface that the DNS server listens on.
B. Convert the primary zone into an Active Directory-integrated zone. Delete the secondary zone.
C. Convert the primary zone into an Active Directory-integrated stub zone. Delete the secondary
zone.
D. Configure the zone transfer settings of the standard primary zone. Modify the Master Servers
lists on the secondary zone.

Answer: B

QUESTION NO: 44

Your network consists of a single Active Directory domain. All domain controllers run Windows
Server 2008 and are configured as DNS servers. A domain controller named DC1 has a standard
primary zone for contoso.com. A domain controller named DC2 has a standard secondary zone
for contoso.com. You need to ensure that the replication of the contoso.com zone is encrypted.
You must not lose any zone data. What should you do?

A. On both servers, modify the interface that the DNS server listens on.
B. Convert the primary zone into an Active Directory-integrated zone. Delete the secondary zone.
C. Convert the primary zone into an Active Directory-integrated stub zone. Delete the secondary
zone.
D. Configure the zone transfer settings of the standard primary zone. Modify the Master Servers
lists on the secondary zone.

Answer: B

QUESTION NO: 45

Your company, Contoso, Ltd., has offices in North America and Europe. Contoso has an Active
Directory forest that has three domains. You need to reduce the time required to authenticate
users from the labs.eu.contoso.com domain when they access resources in the
eng.na.contoso.com domain. What should you do?

A. Decrease the replication interval for all Connection objects.

B. Decrease the replication interval for the DEFAULTIPSITELINK site link.
C. Set up a one-way shortcut trust from eng.na.contoso.com to labs.eu.contoso.com.
D. Set up a one-way shortcut trust from labs.eu.contoso.com to eng.na.contoso.com.

Answer: C

QUESTION NO: 46

You network consists of an Active Directory forest named contoso.com. All servers run Windows
Server 2008. All domain controllers are configured as DNS servers. The contoso.com DNS zone
is stored in the ForestDnsZones Active Directory application partition. You have a member server
that contains a standard primary DNS zone for dev.contoso.com. You need to ensure that all
domain controllers can resolve names for dev.contoso.com. What should you do?
A. Create a NS record in the contoso.com zone.
B. Create a delegation in the contoso.com zone.
C. Create a standard secondary zone on a Global Catalog server.
D. Modify the properties of the SOA record in the contoso.com zone.

Answer: B

QUESTION NO: 47

Your company has an Active Directory domain. All servers run Windows Server 2008. Your
company uses an Enterprise Root certificate authority (CA). You need to ensure that revoked
certificate information is highly available. What should you do?

A. Implement an Online Certificate Status Protocol (OCSP) responder by using Network Load
Balancing.
B. Implement an Online Certificate Status Protocol (OCSP) responder by using an Internet
Security and Acceleration Server array.
C. Publish the trusted certificate authorities list to the domain by using a Group Policy Object
(GPO).
D. Create a new Group Policy Object (GPO) that allows users to trust peer certificates. Link the
GPO to the domain.

Answer: A

QUESTION NO: 48

Your network consists of an Active Directory forest that contains one domain named contoso.com.
All domain controllers run Windows Server 2008 and are configured as DNS servers. You have
two Active Directory-integrated zones: contoso.com and nwtraders.com. You need to ensure a
user is able to modify records in the contoso.com zone. You must prevent the user from modifying
the SOA record in the nwtraders.com zone. What should you do?

A. From the DNS Manager console, modify the permissions of the contoso.com zone.
B. From the DNS Manager console, modify the permissions of the nwtraders.com zone.
C. From the Active Directory Users and Computers console, run the Delegation of Control
Wizard.
D. From the Active Directory Users and Computers console, modify the permissions of the
Domain Controllers organizational unit (OU).

Answer: A

QUESTION NO: 49

Your network consists of a single Active Directory domain. The functional level of the forest is
Windows Server 2008. You need to create multiple password policies for users in your domain.
What should you do?

A. From the Schema snap-in, create multiple class schema objects.

B. From the ADSI Edit snap-in, create multiple Password Setting objects.
C. From the Security Configuration Wizard, create multiple security policies.
D. From the Group Policy Management snap-in, create multiple Group Policy objects.
Answer: B

QUESTION NO: 50

Your company has a DNS server that has 10 Active Directory integrated zones. You need to
provide copies of the zone files of the DNS server to the security department. What should you
do?

A. Run the dnscmd /Zonelnfo command.

B. Run the ipconfig /registerdns command.
C. Run the dnscmd /ZoneExport command.
D. Run the ntdsutil > Partition Management > List commands.

Answer: C

QUESTION NO: 51

Your company has an Active Directory forest that contains only Windows Server 2003 domain
controllers. You need to prepare the Active Directory domain to install Windows Server 2008
domain controllers. Which two tasks should you perform? (Each correct answer presents part of
the solution. Choose two.)

A. Run the adprep /forestprep command.

B. Run the adprep /domainprep command.
C. Raise the forest functional level to Windows Server 2008.
D. Raise the domain functional level to Windows Server 2008.

Answer: A, B

QUESTION NO: 52

Your company has a single Active Directory domain named intranet.adatum.com. The domain
controllers run Windows Server 2008 and the DNS server role. All computers, including non-
domain members .dynamically register their DNS records. You need to configure the
intranet.adatum.com zone to allow only domain members to dynamically register DNS records.
What should you do?

A. Set dynamic updates to Secure Only.

B. Enable zone transfers to Name Servers.
C. Remove the Authenticated Users group.
D. Deny the Everyone group the Create All Child Objects permission.

Answer: A

QUESTION NO: 53

Your company has an Active Directory domain. You plan to install the Active Directory Certificate
Service (AD CS) role on a member server that runs Windows Server 2008. You need to ensure
that members of the Account Operators group are able to issue smartcard credentials. They
should not be able to revoke certificates. Which three actions should you perform? (Each correct
answer presents part of the solution. Choose three.)
A. Install the AD CS role and configure it as an Enterprise Root CA.
B. Install the AD CS role and configure it as a Standalone CA.
C. Restrict enrollment agents for the Smartcard logon certificate to the Account Operator group.
D. Restrict certificate managers for the Smartcard logon certificate to the Account Operator group.
E. Create a Smartcard logon certificate
F. Create an Enrollment Agent certificate

Answer: A, C, E

QUESTION NO: 54

Your network consists of a single Active Directory domain. All domain controllers run Windows
Server 2003. You upgrade all domain controllers to Windows Server 2008. You need to configure
the Active Directory environment to support the application of multiple password policies. What
should you do?

A. Create multiple Active Directory sites.

B. On all domain controllers, run dcpromo /adv.
C. On one domain controller, run dcpromo /adv.
D. Raise the functional level of the domain to Windows Server 2008.

Answer: D

QUESTION NO: 55

You network consists of an Active Directory forest named contoso.com. All servers run Windows
Server 2008. All domain controllers are configured as DNS servers. The contoso.com DNS zone
is stored in the ForestDnsZones Active Directory application partition. You have a member server
that contains a standard primary DNS zone for dev.contoso.com. You need to ensure that all
domain controllers can resolve names for dev.contoso.com. What should you do?

A. Create a NS record in the contoso.com zone.

B. Create a delegation in the contoso.com zone.
C. Create a standard secondary zone on a Global Catalog server.
D. Modify the properties of the SOA record in the contoso.com zone.

Answer: B

QUESTION NO: 56

Your company has a single-domain Active Directory forest. The functional level of the domain is
Windows Server 2008.
You perform the following activities:
■ Create a global distribution group.
■ Add users to the global distribution group.
■ Create a shared folder on a Windows Server 2008 member server.
■ Place the global distribution group in a domain local group that has access to the shared
folder. You need to ensure that the users have access to the shared folder.
What should you do?

A. Raise the forest functional level to Windows Server 2008.

B. Add the global distribution group to the Domain Administrators group.
C. Change the group type of the global distribution group to a security group.
D. Change the scope of the global distribution group to a Universal distribution group.

Answer: C

QUESTION NO: 57

Your company has two Active Directory forests named contoso.com and fabrikam.com. Both
forests run only domain controllers that run Windows Server 2008. The domain functional level
ofcontoso.com is Windows Server 2008. The domain functional level of fabrikam.com is Windows
Server 2003 Native mode. You configure an external trust between contoso.com and
fabrikam.com. You need to enable the Kerberos AES encryption option. What should you do?

A. Create a new forest trust and enable forest-wide authentication.

B. Raise the forest functional level of contoso.com to Windows Server 2008.
C. Raise the forest functional level of fabrikam.com to Windows Server 2008.
D. Raise the domain functional level of fabrikam.com to Windows Server 2008.

Answer: D

QUESTION NO: 58

Your company has a server that runs an instance of Active Directory Lightweight Directory
Services (AD LDS). You need to create new organizational units in the AD LDS application
directory partition. What should you do?

A. Use the Active Directory Users and Computers snap-in to create the organizational units on
the AD LDS application directory partition.
B. Use the ADSI Edit snap-in to create the organizational units on the AD LDS application
directory partition.
C. Use the dsadd OU <OrganizationalUnitDN> command to create the organizational units.
D. Use the dsmod OU <OrganizationalUnitDN> command to create the organizational units.

Answer: B

QUESTION NO: 59

You have two servers named Server1 and Server2. Both servers run Windows Server 2008.
Server1 is configured as an Enterprise Root certification authority (CA). You install the Online
Responder role service on Server2. You need to configure Server2 to issue certificate revocation
lists (CRL) for the enterprise root CA. Which two tasks should you perform? (Each correct answer
presents part of the solution. Choose two.)

A. Import the enterprise root CA certificate.

B. Import the OCSP Response Signing certificate.
C. Add the Server1 computer account to the CertPublishers group.
D. Set the Startup Type of the Certificate Propagation service to Automatic.

Answer: A, B

QUESTION NO: 60
Your company, Contoso, Ltd., has a main office and a branch office. The offices are connected by
a WAN link. Contoso has an Active Directory forest that contains a single domain named
ad.contoso.com. The ad.contoso.com domain contains one domain controller named DC1 that is
located in the main office. DC1 is configured as a DNS server for the ad.contoso.com DNS zone.
This zone is configured as a standard primary zone.

You install a new domain controller named DC2 in the branch office. You install DNS on DC2. You
need to ensure that the DNS service can update records and resolve DNS queries in the event
that a WAN link fails. What should you do?

A. Create a new stub zone named ad.contoso.com on DC2.

B. Configure the DNS server on DC2 to forward requests to DC1.
C. Create a new standard secondary zone named ad.contoso.com on DC2.
D. Convert the ad.contoso.com zone on DC1 to an Active Directory-integrated zone.

Answer: D

QUESTION NO: 61

Your network consists of a single Active Directory domain. The domain contains 10 domain
controllers. The domain controllers run Windows Server 2008 and are configured as DNS
servers. You plan to create a new Active Directory-integrated zone. You need to ensure that the
new zone is only replicated to four of your domain controllers. What should you do first?

A. Create a new delegation in the ForestDnsZones application directory partition.

B. Create a new delegation in the DomainDnsZones application directory partition.
C. From the command prompt, run dnscmd and specify the /enlistdirectorypartition parameter.
D. From the command prompt, run dnscmd and specify the /createdirectorypartition parameter.

Answer: D

QUESTION NO: 62

Your network consists of an Active Directory forest that contains one domain named contoso.com.
All domain controllers run Windows Server 2008 and are configured as DNS servers. You have
two Active Directory-integrated zones: contoso.com and nwtraders.com. You need to ensure a
user is able to modify records in the contoso.com zone. You must prevent the user from modifying
the SOA record in the nwtraders.com zone. What should you do?

A. From the DNS Manager console, modify the permissions of the contoso.com zone.
B. From the DNS Manager console, modify the permissions of the nwtraders.com zone.
C. From the Active Directory Users and Computers console, run the Delegation of Control
Wizard.
D. From the Active Directory Users and Computers console, modify the permissions of the
Domain Controllers organizational unit (OU).

Answer: A