QUESTION 1 . Your network contains an Active Directory domain.

You have a server named Server1 that runs Windows Server 2008 R2. Server1 is an enterprise root certification authority (CA). You have a client computer named Computer1 that runs Windows 7. You enable automatic certificate enrollment for all client computers that run Windows 7. You need to verify that the Windows 7 client computers can automatically enroll for certificates. Which command should you run on Computer1? A. certreq.exe -retrieve B. certreq.exe -submit C. certutil.exe -getkey D. certutil.exe pulse Answer: D QUESTION 2 . Your network contains two Active Directory forests named contoso.com and adatum.com. The functional level of both forests is Windows Server 2008 R2. Each forest contains one domain. Active Directory Certificate Services (AD CS) is configured in the contoso.com forest to allow users from both forests to automatically enroll user certificates. You need to ensure that all users in the adatum.com forest have a user certificate from the contoso.com certification authority (CA). What should you configure in the adatum.com domain? A. From the Default Domain Controllers Policy, modify the Enterprise Trust settings. B. From the Default Domain Controllers Policy, modify the Trusted Publishers settings. C. From the Default Domain Policy, modify the Certificate Enrollment policy. D. From the Default Domain Policy, modify the Trusted Root Certification Authority settings. Answer: C QUESTION 3 Your company, Contoso, Ltd., has a main office and a branch office. The offices are connected by a WAN link. Contoso has an Active Directory forest that contains a single domain named ad.contoso.com. The ad.contoso.com domain contains one domain controller named DC1 that is located in the main office. DC1 is configured as a DNS server for the ad.contoso.com DNS zone. This zone is configured as a standard primary zone. You install a new domain controller named DC2 in the branch office. You install DNS on DC2. You need to ensure that the DNS service can update records and resolve DNS queries in the event that a WAN link fails. What should you do? A. Create a new stub zone named ad.contoso.com on DC2. B. Configure the DNS server on DC2 to forward requests to DC1. C. Create a new secondary zone named ad.contoso.com on DC2. D. Convert the ad.contoso.com zone on DC1 to an Active Directory-integrated zone. Answer: D

QUESTION 4 . Your company has two domain controllers that are configured as internal DNS servers. All zones on the DNS servers are Active Directory-integrated zones. The zones allow all dynamic updates. You discover that the contoso.com zone has multiple entries for the host names of computers that do not exist. You need to configure the contoso.com zone to automatically remove expired records. What should you do? A. Enable only secure updates on the contoso.com zone. B. Enable scavenging and configure the refresh interval on the contoso.com zone. C. From the Start of Authority tab, decrease the default refresh interval on the contoso.com zone. D. From the Start of Authority tab, increase the default expiration interval on the contoso.com zone. Answer: B QUESTION 4 Your network contains an Active Directory forest. All domain controllers run Windows Server 2008 R2 and are configured as DNS servers. You have an Active Directory-integrated zone for contoso.com. You have a UNIX-based DNS server. You need to configure your Windows Server 2008 R2 environment to allow zone transfers of the contoso.com zone to the UNIX-based DNS server. What should you do in the DNS Manager console? A. Disable recursion. B. Create a stub zone. C. Create a secondary zone. D. Enable BIND secondaries. Answer: D QUESTION 5 . Your network consists of an Active Directory forest that contains one domain named contoso.com. All domain controllers run Windows Server 2008 R2 and are configured as DNS servers. You have two Active Directory-integrated zones: contoso.com and nwtraders.com. You need to ensure a user is able to modify records in the contoso.com zone. You must prevent the user from modifying the SOA record in the nwtraders.com zone. What should you do? A. From the DNS Manager console, modify the permissions of the contoso.com zone. B. From the DNS Manager console, modify the permissions of the nwtraders.com zone. C. From the Active Directory Users and Computers console, run the Delegation of Control Wizard. D. From the Active Directory Users and Computers console, modify the permissions of the Domain Controllers organizational unit (OU). Answer: A

QUESTION 6 . Your company has an Active Directory domain named ad.contoso.com. The domain has two domain controllers named DC1 and DC2. Both domain controllers have the DNS Server server role installed. You install a new DNS server named DNS1.contoso.com on the perimeter network. You configure DC1 to forward all unresolved name requests to DNS1.contoso.com. You discover that the DNS forwarding option is unavailable on DC2. You need to configure DNS forwarding on the DC2 server to point to the DNS1.contoso.com server. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.) A. Clear the DNS cache on DC2. B. Delete the Root zone on DC2. C. Configure conditional forwarding on DC2. D. Configure the Listen On address on DC2. Answer: BC QUESTION 7 . Your network consists of a single Active Directory domain. The domain contains 10 domain controllers. The domain controllers run Windows Server 2008 R2 and are configured as DNS servers. You plan to create a new Active Directory-integrated zone. You need to ensure that the new zone is only replicated to four of your domain controllers. What should you do first? A. Create a new delegation in the ForestDnsZones application directory partition. B. Create a new delegation in the DomainDnsZones application directory partition. C. From the command prompt, run dnscmd and specify the /enlistdirectorypartition parameter. D. From the command prompt, run dnscmd and specify the /createdirectorypartition parameter. Answer: D QUESTION 8 . Your company has an Active Directory domain. The main office has a DNS server named DNS1 that is configured with Active Directory-integrated DNS. The branch office has a DNS server named DNS2 that contains a secondary copy of the zone from DNS1. The two offices are connected with an unreliable WAN link. You add a new server to the main office. Five minutes after adding the server, a user from the branch office reports that he is unable to connect to the new server. You need to ensure that the user is able to connect to the new server. What should you do? A. Clear the cache on DNS2. B. Reload the zone on DNS1. C. Refresh the zone on DNS2. D. Export the zone from DNS1 and import the zone to DNS2. Answer: C

QUESTION 9 You need to deploy a read-only domain controller (RODC) that runs Windows Server 2008 R2. What is the minimal forest functional level that you should use? A. Windows Server 2008 R2 B. Windows Server 2008 C. Windows Server 2003 D. Windows 2000 Answer: C QUESTION 10 . Your company has an Active Directory forest that contains only Windows Server 2008 domain controllers. You need to prepare the Active Directory domain to install Windows Server 2008 R2 domain controllers. Which two tasks should you perform? (Each correct answer presents part of the solution. Choose two.) A. Run the adprep /forestprep command. B. Run the adprep /domainprep command. C. Raise the forest functional level to Windows Server 2008. D. Raise the domain functional level to Windows Server 2008. Answer: AB QUESTION 11 . Your company has a single Active Directory domain. All domain controllers run Windows Server 2003. You install Windows Server 2008 R2 on a server. You need to add the new server as a domain controller in your domain. What should you do first? A. On the new server, run dcpromo /adv. B. On the new server, run dcpromo /createdcaccount. C. On a domain controller run adprep /rodcprep. D. On a domain controller, run adprep /forestprep. Answer: D

QUESTION 12 . Your company has two Active Directory forests as shown in the following table: Forest name Forest functional level Domain(s) contoso.com Windows Server 2008 contoso.com fabrikam.com Windows Server 2008 fabrikam.com The forests are connected by using a two-way forest trust. Each trust direction is configured with forest-wide authentication. The new security policy of the company prohibits users from the eng.fabrikam.com domain to access resources in the contoso.com domain. You need to configure the forest trust to meet the new security policy requirement. What should you do? A. Delete the outgoing forest trust in the contoso.com domain. B. Delete the incoming forest trust in the contoso.com domain. C. Change the properties of the existing incoming forest trust in the contoso.com domain from Forestwide authentication to Selective authentication. D. Change the properties of the existing outgoing forest trust in the contoso.com domain to exclude *.eng. fabrikam.com from the Name Suffix Routing trust properties. Answer: D QUESTION 13 . Your company has a branch office that is configured as a separate Active Directory site and has an Active Directory domain controller. The Active Directory site requires a local Global Catalog server to support a new application. You need to configure the domain controller as a Global Catalog server. Which tool should you use? A. The Dcpromo.exe utility B. The Server Manager console C. The Computer Management console D. The Active Directory Sites and Services console E. The Active Directory Domains and Trusts console Answer: D QUESTION 14 . Your company has a main office and 10 branch offices. Each branch office has an Active Directory site that contains one domain controller. Only domain controllers in the main office are configured as Global Catalog servers. You need to deactivate the Universal Group Membership Caching option on the domain controllers in the branch offices. At which level should you deactivate the Universal Group Membership Caching option? A. Site B. Server C. Domain D. Connection object Answer: A

QUESTION 15 . You are decommissioning one of the domain controllers in a child domain. You need to transfer all domain operations master roles within the child domain to a newly installed domain controller in the same child domain. Which three domain operations master roles should you transfer? (Each correct answer presents part of the solution. Choose three.) A. RID master B. PDC emulator C. Schema master D. Infrastructure master E. Domain naming master Answer: ABD QUESTION 16 . You are decommissioning domain controllers that hold all forest-wide operations master roles. You need to transfer all forest-wide operations master roles to another domain controller. Which two roles should you transfer? (Each correct answer presents part of the solution. Choose two.) A. RID master B. PDC emulator C. Schema master D. Infrastructure master E. Domain naming master Answer: CE QUESTION 17 . Your company has a server that runs Windows Server 2008 R2. The server runs an instance of Active Directory Lightweight Directory Services (AD LDS). You need to replicate the AD LDS instance on a test computer that is located on the network. What should you do? A. Run the repadmin /kcc <servername> command on the test computer. B. Create a naming context by running the Dsmgmt command on the test computer. C. Create a new directory partition by running the Dsmgmt command on the test computer. D. Create and install a replica by running the AD LDS Setup wizard on the test computer. Answer: D

QUESTION 18 . Your company has an Active Directory Rights Management Services (AD RMS) server. Users have Windows Vista computers. An Active Directory domain is configured at the Windows Server 2003 functional level. You need to configure AD RMS so that users are able to protect their documents. What should you do? A. Install the AD RMS client 2.0 on each client computer. B. Add the RMS service account to the local administrators group on the AD RMS server. C. Establish an e-mail account in Active Directory Domain Services (AD DS) for each RMS user. D. Upgrade the Active Directory domain to the functional level of Windows Server 2008. Answer: C QUESTION 19 . A user in a branch office of your company attempts to join a computer to the domain, but the attempt fails. You need to enable the user to join a single computer to the domain. You must ensure that the user is denied any additional rights beyond those required to complete the task. What should you do? A. Prestage the computer account in the Active Directory domain. B. Add the user to the Domain Administrators group for one day. C. Add the user to the Server Operators group in the Active Directory domain. D. Grant the user the right to log on locally by using a Group Policy Object (GPO). Answer: A QUESTION 20 . You need to relocate the existing user and computer objects in your company to different organizational units. What are two possible ways to achieve this goal? (Each correct answer presents a complete solution. Choose two.) A. Run the Dsmove utility. B. Run the Active Directory Migration Tool (ADMT). C. Run the Active Directory Users and Computers utility. D. Run the move-item command in the Microsoft Windows PowerShell utility. Answer: AC

QUESTION 21 . Your company has an Active Directory domain. All consultants belong to a global group named TempWorkers. The TempWorkers group is not nested in any other groups. You move the computer objects of three file servers to a new organizational unit named SecureServers. These file servers contain only confidential data in shared folders. You need to prevent members of the TempWorkers group from accessing the confidential data on the file servers. You must achieve this goal without affecting access to other domain resources. What should you do? A. Create a new GPO and link it to the SecureServers organizational unit. Assign the Deny access to this computer from the network user right to the TempWorkers global group. B. Create a new GPO and link it to the domain. Assign the Deny access to this computer from the network user right to the TempWorkers global group. C. Create a new GPO and link it to the domain. Assign the Deny log on locally user right to the TempWorkers global group. D. Create a new GPO and link it to the SecureServers organizational unit. Assign the Deny log on locally user right to the TempWorkers global group. Answer: A QUESTION 22 . Your company has an Active Directory forest. Each branch office has an organizational unit and a child organizational unit named Sales. The Sales organizational unit contains all users and computers of the sales department. You need to install a Microsoft Office 2007 application only on the computers in the Sales organizational unit. You create a GPO named SalesApp GPO. What should you do next? A. Configure the GPO to assign the application to the computer account. Link the SalesAPP GPO to the domain. B. Configure the GPO to assign the application to the user account. Link the SalesAPP GPO to the Sales organizational unit in each location. C. Configure the GPO to publish the application to the user account. Link the SalesAPP GPO to the Sales organizational unit in each location. D. Configure the GPO to assign the application to the computer account. Link the SalesAPP GPO to the Sales organizational unit in each location. Answer: D

QUESTION 23 . Your company has file servers located in an organizational unit named Payroll. The file servers contain payroll files located in a folder named Payroll. You create a GPO. You need to track which employees access the Payroll files on the file servers. What should you do? A. Enable the Audit object access option. Link the GPO to the Payroll organizational unit. On the file servers, configure Auditing for the Everyone group in the Payroll folder. B. Enable the Audit object access option. Link the GPO to the domain. On the domain controllers, configure Auditing for the Authenticated Users group in the Payroll folder. C. Enable the Audit process tracking option. Link the GPO to the Domain Controllers organizational unit. On the file servers, configure Auditing for the Authenticated Users group in the Payroll folder. D. Enable the Audit process tracking option. Link the GPO to the Payroll organizational unit. On the file servers, configure Auditing for the Everyone group in the Payroll folder. Answer: A QUESTION 24 . You network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2. You need to reset the Directory Services Restore Mode (DSRM) password on a domain controller. What tool should you use? A. dsmod B. ntdsutil C. Local Users and Groups snap-in D. Active Directory Users and Computers snap-in Answer: B QUESTION 25 . Your company has a server that runs Windows Server 2008 R2. Active Directory Certificate Services (AD CS) is configured as a standalone Certification Authority (CA) on the server. You need to audit changes to the CA configuration settings and the CA security settings. Which two tasks should you perform? (Each correct answer presents part of the solution. Choose two.) A. Configure auditing in the Certification Authority snap-in. B. Enable auditing of successful and failed attempts to change permissions on files in the %SYSTEM32% \CertSrv directory. C. Enable auditing of successful and failed attempts to write to files in the %SYSTEM32%\CertLog directory. D. Enable the Audit object access setting in the Local Security Policy for the Active Directory Certificate Services (AD CS) server. Answer: AD

QUESTION 26 . You have a Windows Server 2008 R2 Enterprise Root certification authority (CA). You need to grant members of the Account Operators group the ability to only manage Basic EFS certificates. You grant the Account Operators group the Issue and Manage Certificates permission on the CA . Which three tasks should you perform next? (Each correct answer presents part of the solution. Choose three.) A. Enable the Restrict Enrollment Agents option on the CA . B. Enable the Restrict Certificate Managers option on the CA . C. Add the Basic EFS certificate template for the Account Operators group. D. Grant the Account Operators group the Manage CA permission on the CA . E. Remove all unnecessary certificate templates that are assigned to the Account Operators group. Answer: BCE QUESTION 27

QUESTION 28 . Your network contains an Active Directory domain named contoso.com. You create a GlobalNames zone. You add an alias (CNAME) resource record named Server1 to the zone. The target host of the record is server2. contoso.com. When you ping Server1, you discover that the name fails to resolve. You successfully resolve server2.contoso.com. You need to ensure that you can resolve names by using the GlobalNames zone. What should you do? A. From the command prompt, use the netsh tool. B. From the command prompt, use the dnscmd tool. C. From DNS Manager, modify the properties of the GlobalNames zone. D. From DNS Manager, modify the advanced settings of the DNS server. Answer: B

QUESTION 29 Your network contains an Active Directory domain named contoso.com. The domain contains the servers shown in the following table: Server name DC1 DC2 DNS1 DNS2 Operating system Windows Server 2008 Windows Server 2008 R2 Windows Server 2008 Windows Server 2008 R2 Role Domain controller Domain controller DNS server DNS server

The functional level of the forest is Windows Server 2003. The functional level of the domain is Windows Server 2003. DNS1 and DNS2 host the contoso.com zone. All client computers run Windows 7 Enterprise. You need to ensure that all of the names in the contoso.com zone are secured by using DNSSEC. What should you do first? A. Change the functional level of the forest. B. Change the functional level of the domain. C. Upgrade DC1 to Windows Server 2008 R2. D. Upgrade DNS1 to Windows Server 2008 R2. Answer: D QUESTION 30 . Your network contains an Active Directory domain named contoso.com. You remove several computers from the network. You need to ensure that the host (A) records for the removed computers are automatically deleted from the contoso.com DNS zone. What should you do? A. Configure dynamic updates. B. Configure aging and scavenging. C. Create a scheduled task that runs the Dnscmd /ClearCache command. D. Create a scheduled task that runs the Dnscmd /ZoneReload contoso.com command. Answer: B

QUESTION 31 . Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2008 R2. The functional level of the domain is Windows Server 2008 R2. The functional level of the forest is Windows Server 2008. You have a member server named Server1 that runs Windows Server 2008. You need to ensure that you can add Server1 to contoso.com as a domain controller. What should you run before you promote Server1? A. dcpromo.exe /CreateDCAccount B. dcpromo.exe /ReplicaOrNewDomain:replica C. Set-ADDomainMode -Identity contoso.com -DomainMode Windows2008Domain D. Set-ADForestMode -Identity contoso.com -ForestMode Windows2008R2Forest Answer: C QUESTION 32 . Your network contains an Active Directory forest. The forest contains a single domain. You want to access resources in a domain that is located in another forest. You need to configure a trust between the domain in your forest and the domain in the other forest. What should you create? A. an incoming external trust B. an incoming realm trust C. an outgoing external trust D. an outgoing realm trust Answer: A QUESTION 33 . Your company has a main office and 50 branch offices. Each office contains multiple subnets. You need to automate the creation of Active Directory subnet objects. What should you use? A. the Dsadd tool B. the Netsh tool C. the New-ADObject cmdlet D. the New-Object cmdlet Answer: C

QUESTION 33 Your network contains an Active Directory domain. The domain contains three domain controllers. One of the domain controllers fails. Seven days later, the help desk reports that it can no longer create user accounts. You need to ensure that the help desk can create new user accounts. Which operations master role should you seize? A. domain naming master B. infrastructure master C. primary domain controller (PDC) emulator D. RID master E. schema master Answer: D QUESTION 34 . Your network contains two Active Directory forests named contoso.com and adatum.com. Active Directory Rights Management Services (AD RMS) is deployed in contoso.com. An AD RMS trusted user domain (TUD) exists between contoso.com and adatum.com. From the AD RMS logs, you discover that some clients that have IP addresses in the adatum.com forest are authenticating as users from contoso.com. You need to prevent users from impersonating contoso.com users. What should you do? A. Configure trusted e-mail domains. B. Enable lockbox exclusion in AD RMS. C. Create a forest trust between adatum.com and contoso.com. D. Add a certificate from a third-party trusted certification authority (CA). Answer: A QUESTION 35 . You install a read-only domain controller (RODC) named RODC1. You need to ensure that a user named User1 can administer RODC1. The solution must minimize the number of permissions assigned to User1. Which tool should you use? A. Active Directory Administrative Center B. Active Directory Users and Computers C. Dsadd D. Dsmgmt Answer: D

QUESTION 36 . Your network contains an Active Directory domain. The domain contains two sites named Site1 and Site2. Site1 contains four domain controllers. Site2 contains a read-only domain controller (RODC). You add a user named User1 to the Allowed RODC Password Replication Group. The WAN link between Site1 and Site2 fails. User1 restarts his computer and reports that he is unable to log on to the domain. The WAN link is restored and User1 reports that he is able to log on to the domain. You need to prevent the problem from reoccurring if the WAN link fails. What should you do? A. Create a Password Settings object (PSO) and link the PSO to User1's user account. B. Create a Password Settings object (PSO) and link the PSO to the Domain Users group. C. Add the computer account of the RODC to the Allowed RODC Password Replication Group. D. Add the computer account of User1's computer to the Allowed RODC Password Replication Group. Answer: D QUESTION 37 . Your company has a main office and a branch office. The network contains an Active Directory domain. The main office contains a writable domain controller named DC1. The branch office contains a read- only domain controller (RODC) named DC2. You discover that the password of an administrator named Admin1 is cached on DC2. You need to prevent Admin1's password from being cached on DC2. What should you do? A. Modify the NTDS Site Settings. B. Modify the properties of the domain. C. Create a Password Setting object (PSO). D. Modify the properties of DC2's computer account. Answer: D QUESTION 38 . Your company has a main office and a branch office. The branch office has an Active Directory site that contains a read-only domain controller (RODC). A user from the branch office reports that his account is locked out. From a writable domain controller in the main office, you discover that the user's account is not locked out. You need to ensure that the user can log on to the domain. What should you do? A. Modify the Password Replication Policy. B. Reset the password of the user account. C. Run the Knowledge Consistency Checker (KCC) on the RODC. D. Restore network communication between the branch office and the main office. Answer: D

QUESTION 39 . Your network contains a single Active Directory domain. The domain contains five read-only domain controllers (RODCs) and five writable domain controllers. All servers run Windows Server 2008. You plan to install a new RODC that runs Windows Server 2008 R2. You need to ensure that you can add the new RODC to the domain. You want to achieve this goal by using the minimum amount of administrative effort. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.) A. At the command prompt, run adprep.exe /rodcprep. B. At the command prompt, run adprep.exe /forestprep. C. At the command prompt, run adprep.exe /domainprep. D. From Active Directory Domains and Trusts, raise the functional level of the domain. E. From Active Directory Users and Computers, pre-stage the RODC computer account. Answer: BC QUESTION 40 . Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1. The Active Directory Federation Services (AD FS) role is installed on Server1. Contoso.com is defined as an account store. A partner company has a Web-based application that uses AD FS authentication. The partner company plans to provide users from contoso.com access to the Web application. You need to configure AD FS on contoso.com to allow contoso.com users to be authenticated by the partner company. What should you create on Server1? A. a new application B. a resource partner C. an account partner D. an organization claim Answer: C QUESTION 41 . Your network contains an Active Directory forest. The forest schema contains a custom attribute for user objects. You need to modify the custom attribute value of 500 user accounts. Which tool should you use? A. Csvde B. Dsmod C. Dsrm D. Ldifde Answer: D

QUESTION 42 . Your network contains an Active Directory forest. The forest schema contains a custom attribute for user objects. You need to give the human resources department a file that contains the last logon time and the custom attribute values for each user in the forest. Which should you use? A. the Dsquery tool B. the Export-CSV cmdlet C. the Get-ADUser cmdlet D. the Net.exe user command Answer: C QUESTION 43 . Your network contains an Active Directory forest. The functional level of the forest is Windows Server 2008 R2. Your company's corporate security policy states that the password for each user account must be changed at least every 45 days. You have a user account named Service1. Service1 is used by a network application named Application1. Every 45 days, Application1 fails. After resetting the password for Service1, Application1 runs properly. You need to resolve the issue that causes Application1 to fail. The solution must adhere to the corporate security policy. What should you do? A. Run the Set-ADAccountControl cmdlet. B. Run the Set-ADServiceAccount cmdlet. C. Create a new password policy. D. Create a new Password Settings object (PSO). Answer: B QUESTION 44 . You configure and deploy a Group Policy object (GPO) that contains AppLocker settings. You need to identify whether a specific application file is allowed to run on a computer. Which Windows PowerShell cmdlet should you use? A. Get-AppLockerFileInformation B. Get-GPOReport C. Get-GPPermissions D. Test-AppLockerPolicy Answer: D QUESTION 45 You need to create a Password Settings object (PSO). Which tool should you use? A. Active Directory Users and Computers B. ADSI Edit C. Group Policy Management Console D. Ntdsutil Answer: B

QUESTION 46 . Your network contains a single Active Directory domain. The functional level of the forest is Windows Server 2008 R2. You need to enable the Active Directory Recycle Bin. What should you use? A. the Dsmod tool B. the Enable-ADOptionalFeature cmdlet C. the Ntdsutil tool D. the Set-ADDomainMode cmdlet Answer: B QUESTION 47 . Your network contains a single Active Directory domain. A domain controller named DC2 fails. You need to remove DC2 from Active Directory. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.) A. At the command prompt, run dcdiag.exe /fix. B. At the command prompt, run netdom.exe remove dc2. C. From Active Directory Sites and Services, delete DC2. D. From Active Directory Users and Computers, delete DC2. Answer: CD QUESTION 48 . Your network contains a single Active Directory domain. The functional level of the forest is Windows Server 2008. The functional level of the domain is Windows Server 2008 R2. All DNS servers run Windows Server 2008. All domain controllers run Windows Server 2008 R2. You need to ensure that you can enable the Active Directory Recycle Bin. What should you do? A. Change the functional level of the forest. B. Change the functional level of the domain. C. Modify the Active Directory schema. D. Modify the Universal Group Membership Caching settings. Answer: A QUESTION 49 . You have an Active Directory snapshot. You need to view the contents of the organizational units (OUs) in the snapshot. Which tools should you run? A. explorer.exe, netdom.exe, and dsa.msc B. ntdsutil.exe, dsamain.exe, and dsa.msc C. wbadmin.msc, dsamain.exe, and netdom.exe D. wbadmin.msc, ntdsutil.exe, and explorer.exe Answer: B

QUESTION 50 . Your network contains a single Active Directory domain. All servers run Windows Server 2008 R2. You deploy a new server that runs Windows Server 2008 R2. The server is not connected to the internal network. You need to ensure that the new server is already joined to the domain when it first connects to the internal network. What should you do? A. From a domain controller, run sysprep.exe and specify the /oobe parameter. From the new server, run sysprep.exe and specify the /generalize parameter. B. From a domain controller, run sysprep.exe and specify the /generalize parameter. From the new server, run sysprep.exe and specify the /oobe parameter. C. From a domain-joined computer, run djoin.exe and specify the /provision parameter. From the new server, run djoin.exe and specify the /requestodj parameter. D. From a domain-joined computer, run djoin.exe and specify the /requestodj parameter. From the new server, run djoin.exe and specify the /provision parameter. Answer: C QUESTION 51 . You remotely monitor several domain controllers. You run winrm.exe quickconfig on each domain controller. You need to create a WMI script query to retrieve information from the bios of each domain controller. Which format should you use to write the query? A. XrML B. XML C. WQL D. HTML Answer: C QUESTION 52 You create a new Active Directory domain. The functional level of the domain is Windows Server 2008 R2. The domain contains five domain controllers. You need to monitor the replication of the group policy template files. Which tool should you use? A. Dfsrdiag B. Fsutil C. Ntdsutil D. Ntfrsutl Answer: A

QUESTION 53 . You have a domain controller named Server1 that runs Windows Server 2008 R2. You need to determine the size of the Active Directory database on Server1. What should you do? A. Run the Active Directory Sizer tool. B. Run the Active Directory Diagnostics data collector set. C. From Windows Explorer, view the properties of the %systemroot%\ntds\ntds.dit file. D. From Windows Explorer, view the properties of the %systemroot%\sysvol\domain folder. Answer: C QUESTION 54 . You need to receive an e-mail message whenever a domain user account is locked out. Which tool should you use? A. Active Directory Administrative Center B. Event Viewer C. Resource Monitor D. Security Configuration Wizard Answer: B QUESTION 55 . Your network contains an Active Directory domain named contoso.com. You have a management computer named Computer1 that runs Windows 7. You need to forward the logon events of all the domain controllers in contoso.com to Computer1. All new domain controllers must be dynamically added to the subscription. What should you do? A. From Computer1, configure source-initiated event subscriptions. From a Group Policy object (GPO) linked to the Domain Controllers organizational unit (OU), configure the Event Forwarding node. B. From Computer1, configure collector-initiated event subscriptions. From a Group Policy object (GPO) linked to the Domain Controllers organizational unit (OU), configure the Event Forwarding node. C. From Computer1, configure source-initiated event subscriptions. Install a server authentication certificate on Computer1. Implement autoenrollment for the Domain Controllers organizational unit (OU). D. From Computer1, configure collector-initiated event subscriptions. Install a server authentication certificate on Computer1. Implement autoenrollment for the Domain Controllers organizational unit (OU). Answer: A

QUESTION 56 . You have Active Directory Certificate Services (AD CS) deployed. You create a custom certificate template. You need to ensure that all of the users in the domain automatically enroll for a certificate based on the custom certificate template. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.) A. In a Group Policy object (GPO), configure the autoenrollment settings. B. In a Group Policy object (GPO), configure the Automatic Certificate Request Settings. C. On the certificate template, assign the Read and Autoenroll permission to the Authenticated Users group. D. On the certificate template, assign the Read, Enroll, and Autoenroll permission to the Domain Users group. Answer: AD QUESTION 57 . Your network contains an Active Directory forest. All domain controllers run Windows Server 2008 Standard. The functional level of the domain is Windows Server 2003. You have a certification authority (CA). The relevant servers in the domain are configured as shown in the following table: Server name Server1 Server2 Server3 Operating system Windows Server 2003 Windows Server 2008 Windows Server 2008 R2 Server role Enterprise root CA Enterprise subordinate CA Web Server

You need to ensure that you can install the Active Directory Certificate Services (AD CS) Certificate Enrollment Web Service on the network. What should you do? A. Upgrade Server1 to Windows Server 2008 R2. B. Upgrade Server2 to Windows Server 2008 R2. C. Raise the functional level of the domain to Windows Server 2008. D. Install the Windows Server 2008 R2 Active Directory Schema updates. Answer: D QUESTION 58 Your network contains an Active Directory domain named contoso.com. Contoso.com contains two sites named Site1 and Site2. Site1 contains a domain controller named DC1. In Site1 , you install a new domain controller named DC2. You ship DC2 to Site2. You discover that certain users in Site2 authenticate to DC1. You need to ensure that the users in Site2 always attemp to authentcate to DC2 first. What should you do? A. From Active Dirctory Sites and Services, move the DC2 server object. B. From Active Directory Users and Computers, modify the Location settings of the DC2 computer object. C. From Active Directory Sites and Services, modify the Location attribute for Site2. D. From Active Directory Users and Computers, move the DC2 computer object. Answer: A

QUESTION 59 Your network contains an Active Directory domain named contoso.com. The Adminisrator deletes an OU named OU1 accidentally. You need to restore OU1. Which cmdlet should you use? A. Set-ADObject cmdlet B. Set-ADOrganizationalUnit cmdlet C. Set-ADUser cmdlet D. Set-ADGroup cmdlet Answer: A QUESTION 60 Your company has a single Active Directory forest with a single domain. Consultants in different departments of the company require access to different network resources. The consultants belong to a global group named TempWorkers. Three file servers are placed in a new organizational unit named SecureServers. The file servers contain confidential data in shared folders. You need to prevent the consultants from accessing the confidential data. What should you do? A. Create a new Group Policy Object (GPO) and link it to the SecureServers organizational unit. Assign the Deny access to this computer from the network user right to the TempWorkers global group. B. Create a new Group Policy Object (GPO) and link it to the domain. Assign the Deny access to this computer from the network user right to the TempWorkers global group. C. On the three file servers, create a share on the root of each hard disk. Configure the Deny Full control permission for the TempWorkers global group on the share. D. Create a new Group Policy Object (GPO) and link it to the domain. Assign the Deny log on locally user right to the TempWorkers global group. E. Create a new Group Policy Object (GPO) and link it to the SecureServers organizational unit. Assign the Deny log on locally user right to the TempWorkers global group. Answer: A QUESTION 61 Your network contains an Active Directory forest named adatum.com. All client computers used by the marketing department are in an organizational unit (OU) named Marketing Computers. All user accounts for the marketing department are in an OU named Marketing Users. You purchase a new application. You need to ensure that every user in the domain who logs on to a marketing department computer can use the application. The application must only be available from the marketing department computers. What should you do? A. Create and link a Group Policy object (GPO) to the Marketing Users OU. Copy the installation package to a shared folder on the network. Assign the application. B. Create and link a Group Policy object (GPO) to the Marketing Computers OU. Copy the installation package to a shared folder on the network. Assign the application. C. Create and link a Group Policy object (GPO) to the Marketing Computers OU. Copy the installation package to a local drive on each marketing department computer. Publish the application. D. Create and link a Group Policy object (GPO) to the Marketing Users OU. Copy the installation package to a folder on each marketing department computer. Publish the application. Answer: B

QUESTION 62 Your network contains an enterprise certification authority (CA) that runs Windows Server 2008 R2 Enterprise. You enable key archival on the CA. The CA is configured to use custom certificate templates for Encrypted File System (EFS) certificates. You need to archive the private key for all new EFS certificates. Which snap-in should you use? A. Active Directory Users and Computers B. Authorization Manager C. Group Policy Management D. Enterprise PKI E. Security Templates F. TPM Management G. Certificates H. Certification Authority I. Certificate Templates Answer: H QUESTION 63

QUESTION 64

QUESTION 65

QUESTION 66

QUESTION 67 Your network contains an Active Directory domain named contoso.com. Contoso.com contains a domain controller named DC1 and a read-only domain controller (RODC) named RODC1. You need to view the most recent user accounts authenticated by RODC1. What should you do first? A. From Active Directory Sites and Services, right-click the Connection object for DC1, and then click Replicate Now. B. From Active Directory Sites and Services, right-click the Connection object for DC2, and then click Replicate Now. C. From Active Directory Users and Computers, right-click contoso.com, click Change DomainController, and then connect to DC1. D. From Active Directory Users and Computers, right-click contoso.com, click Change Domain Controller, and then connect to RODC1. Answer: C QUESTION 68 Your network contains an Active Directory domain named contoso.com. Contoso.com contains two sites named Site1 and Site2. Site1 contains a domain controller named DC1. In Site1, you install a new domain controller named DC2. You ship DC2 to Site2. You discover that certain users in Site2 authenticate to DC1. You need to ensure that the users in Site2 always attempt to authenticate to DC2 first. What should you do? A. From Active Directory Users and Computers, modify the Location settings of the DC2 computer object. B. From Active Directory Sites and Services, modify the Location attribute for Site2. C. From Active Directory Sites and Services, move the DC2 server object. D. From Active Directory Users and Computers, move the DC2 computer object. Answer: C

QUESTION 69 Your network contains an enterprise certification authority (CA) that runs Windows Server 2008 R2 Enterprise. You need to ensure that all of the members of a group named Group1 can view the event log entries for Certificate Services. Which snap-in should you use? A. Certificate Templates B. Certification Authority C. Authorization Manager D. Active Directory Users and Computers E. TPM Management F. Security Templates G. Group Policy Management H. Enterprise PKI I. Certificates Answer: D QUESTION 70 Your network contains an enterprise certification authority (CA) that runs Windows Server 2008 R2 Enterprise. You need to ensure that users can enroll for certificates that use the IPSEC (Offline request) certificate template Which snap-in should you use? A. Enterprise PKI B. TPM Management C. Certificates D. Active Directory Users and Computers E. Authorization Manager F. Certification Authority G. Group Policy Management H. Security Templates I. Certificate Templates Answer: I QUESTION 71 Your network contains an enterprise certification authority (CA) that runs Windows Server 2008 R2 Enterprise. You need to approve a pending certificate request. Which snap-in should you use? A. Active Directory Users and Computers B. Authorization Manager C. Certification Authority D. Group Policy Management E. Certificate Templates F. TPM Management G. Certificates H. Enterprise PKI I. Security Templates Answer: C

QUESTION 72 Your network contains an Active Directory domain. The domain contains several domain controllers. You need to modify the Password Replication Policy on a read-only domain controller (RODC). Which tool should you use? A. Group Policy Management B. Active Directory Domains and Trusts C. Active Directory Users and Computers D. Computer Management E. Security Configuration Wizard Answer: C QUESTION 73 Your network contains an Active Directory domain. All domain controllers run Windows Server 2008 R2. You need to compact the Active Directory database. What should you do? A. Run the Get-ADForest cmdlet. B. Configure subscriptions from Event Viewer. C. Run the eventcreate.exe command. D. Configure the Active Directory Diagnostics Data Collector Set (OCS). E. Create a Data Collector Set (DCS). F. Run the repadmin.exe command. G. Run the ntdsutil.exe command. H. Run the dsquery.exe command. I. Run the dsamain.exe command. J. Create custom views from Event Viewer. Answer: G QUESTION 74 Your network contains an Active Directory domain. All domain controllers run Windows Server 2008 R2. You need to collect all of the Directory Services events from all of the domain controllers and store the events in a single central computer. What should you do? A. Run the ntdsutil.exe command. B. Run the repodmin.exe command. C. Run the Get-ADForest cmdlet. D. Run the dsamain.exe command. E. Create custom views from Event Viewer. F. Run the dsquery.exe command. G. Configure the Active Directory Diagnostics Data Collector Set (DCS), H. Configure subscriptions from Event Viewer. I. Run the eventcreate.exe command. J. Create a Data Collector Set (DCS). Answer: H

QUESTION 75 Your network contains an Active Directory domain. All domain controllers run Windows Server 2008 R2. You need to receive a notification when more than 100 Active Directory objects are deleted per second. What should you do? A. Create custom views from Event Viewer. B. Run the Get-ADForest cmdlet. C. Run the ntdsutil.exe command. D. Configure the Active Directory Diagnostics Data Collector Set (DCS). E. Create a Data Collector Set (DCS). F. Run the dsamain.exe command. G. Run the dsquery.exe command. H. Run the repadmin.exe command. I. Configure subscriptions from Event Viewer. J. Run the eventcreate.exe command. Answer: E QUESTION 76 Your network contains an Active Directory domain. All domain controllers run Windows Server 2008 R2. You need to create a snapshot of Active Directory. What should you do? A. Run the dsquery.exe command. B. Run the dsamain.exe command. C. Create custom views from Event Viewer. D. Configure subscriptions from Event Viewer. E. Create a Data Collector Set (DCS). F. Configure the Active Directory Diagnostics Data Collector Set (DCS). G. Run the repadmin.exe command. H. Run the ntdsutil.exe command. I. Run the Get-ADForest cmdlet. J. Run the eventcreate.exe command. Answer: H QUESTION 77 Your network contains an Active Directory-integrated zone. All DNS servers that host the zone are domain controllers. You add multiple DNS records to the zone. You need to ensure that the records are replicated to all DNS servers. Which tool should you use? A. Dnslint B. Ldp C. Nslookup D. Repadmin Answer: A