MCTS 70-640 Active Directory Users, Groups & Organizational Units 2 — Questions and Answers
Question 1: Which Active Directory group type can be used to assign permissions to resources such as file shares and printers?
- Security group (Correct answer)
- Distribution group
- Mail-enabled group
- Administrative group
Correct answer: Security group
Only Security groups can be used to control access to resources; Distribution groups are used solely for email distribution and have no security token.
Question 2: In the AGDLP best-practice model for group nesting, what does the letter 'L' represent?
- Domain Local group (Correct answer)
- Link
- Level
- Limit
Correct answer: Domain Local group
AGDLP stands for Accounts → Global groups → Domain Local groups → Permissions; the 'L' represents Domain Local groups where resource permissions are assigned.
Question 3: A Global group from DomainA is nested inside a Domain Local group in DomainB. What is the primary benefit of this configuration?
- DomainA users gain access to DomainB resources (Correct answer)
- DomainB users gain access to DomainA resources
- A two-way trust is automatically established
- Permissions sync between both domains
Correct answer: DomainA users gain access to DomainB resources
Nesting a DomainA Global group into a DomainB Domain Local group follows AGDLP, granting DomainA users access to resources protected by the DomainB Domain Local group.
Question 4: What must occur before you can convert a Universal security group to a Global group?
- Remove all members from other domains (Correct answer)
- Convert it to a Distribution group first
- Raise the domain functional level
- Remove all nested Universal groups
Correct answer: Remove all members from other domains
Global groups can only contain members from their own domain, so any cross-domain members must be removed before converting a Universal group to Global.
Question 5: Which PowerShell cmdlet is used to create a new group object in Active Directory?
- New-ADGroup (Correct answer)
- Add-ADGroup
- Create-ADGroup
- Set-ADGroup
Correct answer: New-ADGroup
New-ADGroup is the correct PowerShell cmdlet for creating Active Directory group objects, following the standard Verb-ADNoun naming convention.
Question 6: Which wizard in Active Directory Users and Computers allows an administrator to grant specific administrative permissions over an OU to a designated user or group?
- New Object Wizard
- Delegation of Control Wizard (Correct answer)
- Role Assignment Wizard
- Administrative Template Wizard
Correct answer: Delegation of Control Wizard
The Delegation of Control Wizard allows administrators to delegate specific AD tasks over an OU without granting broader domain-level permissions.
Question 7: At what minimum domain functional level must a domain operate to support Password Settings Objects (PSOs) for fine-grained password policies?
- Windows Server 2003
- Windows Server 2008 (Correct answer)
- Windows Server 2000 Native
- Windows Server 2012
Correct answer: Windows Server 2008
Fine-Grained Password Policies using PSOs require the domain functional level to be set to Windows Server 2008 or higher.
MCTS 70-640 Active Directory Users, Groups & Organizational Units 2
Which Active Directory group type can be used to assign permissions to resources such as file shares and printers?