MCTS 70-640 Active Directory Users, Groups & Organizational Units 2

Question 1

Which Active Directory group type can be used to assign permissions to resources such as file shares and printers?

Accepted Answer

Security group

Answer

Only Security groups can be used to control access to resources; Distribution groups are used solely for email distribution and have no security token.

Question 2

In the AGDLP best-practice model for group nesting, what does the letter 'L' represent?

Accepted Answer

Domain Local group

Answer

AGDLP stands for Accounts → Global groups → Domain Local groups → Permissions; the 'L' represents Domain Local groups where resource permissions are assigned.

Question 3

A Global group from DomainA is nested inside a Domain Local group in DomainB. What is the primary benefit of this configuration?

Accepted Answer

DomainA users gain access to DomainB resources

Answer

Nesting a DomainA Global group into a DomainB Domain Local group follows AGDLP, granting DomainA users access to resources protected by the DomainB Domain Local group.

Question 4

What must occur before you can convert a Universal security group to a Global group?

Accepted Answer

Remove all members from other domains

Answer

Global groups can only contain members from their own domain, so any cross-domain members must be removed before converting a Universal group to Global.

Question 5

Which PowerShell cmdlet is used to create a new group object in Active Directory?

Accepted Answer

New-ADGroup

Answer

New-ADGroup is the correct PowerShell cmdlet for creating Active Directory group objects, following the standard Verb-ADNoun naming convention.

MCTS 70-640 Exam Practice Test

MCTS 70-640 Exam Practice Test

MCTS 70-640 Active Directory Users, Groups & Organizational Units 2