MCTS 70-640 Case Studies & Practical Application 2 — Questions and Answers
Question 1: Contoso Ltd. has a single-domain forest. Users in the Marketing OU report they cannot log on after a new GPO was linked to that OU. The GPO was intended to enforce password complexity. What is the most likely cause?
- The GPO contains a Deny Logon Locally setting inadvertently applied (Correct answer)
- Password complexity GPOs must be linked at the domain level to take effect
- The Marketing OU has Block Policy Inheritance enabled
- Fine-Grained Password Policies override OU-linked GPOs automatically
Correct answer: The GPO contains a Deny Logon Locally setting inadvertently applied
A Deny Logon Locally right in the GPO would prevent affected users from logging on interactively.
Question 2: Fabrikam needs users in Branch Office A to authenticate even when the WAN link to the main site is down. No writable DC exists in Branch Office A. What should you deploy?
- A read-only domain controller (RODC) (Correct answer)
- An additional bridgehead server
- A universal group membership caching site
- A Global Catalog server with no replication schedule
Correct answer: A read-only domain controller (RODC)
An RODC provides local authentication for branch offices while limiting security exposure if the DC is compromised.
Question 3: Adventure Works has a two-domain forest. A user in domain A needs access to a resource in domain B. The administrator confirms a two-way transitive trust exists. The user still gets 'Access Denied'. What should be checked first?
- NTFS permissions on the resource in domain B (Correct answer)
- Whether SID filtering is removing the user's SID from the token
- Whether the forest functional level supports cross-domain access
- The replication topology between domain A and domain B
Correct answer: NTFS permissions on the resource in domain B
Even with a valid trust, the ACL on the resource itself must grant the cross-domain user or their group access.
Question 4: Northwind Traders runs Windows Server 2008 R2 DCs. They want to enforce a stricter password policy for the Domain Admins group without affecting all users. What feature should they use?
- Fine-Grained Password Policies (PSOs) (Correct answer)
- A separate GPO linked to the Domain Admins OU
- A child domain dedicated to administrative accounts
- Local Security Policy on each admin workstation
Correct answer: Fine-Grained Password Policies (PSOs)
PSOs (Password Settings Objects) allow different password and lockout policies to be applied to specific users or groups within the same domain.
Question 5: A client running Windows 7 joined to a domain cannot apply a new GPO that enforces IE proxy settings. The GPO is linked at the domain level with no WMI filters. GPRESULT shows the policy is not applied. What is the most likely reason?
- The client has a local Group Policy that blocks domain policies
- The client's computer account is in an OU with 'Block Policy Inheritance' (Correct answer)
- The GPO requires a minimum Windows 8 client version
- GPRESULT does not show policies from the domain level
Correct answer: The client's computer account is in an OU with 'Block Policy Inheritance'
Block Policy Inheritance on the OU containing the computer account prevents domain-level GPOs from applying.
Question 6: Trey Research is merging with Coho Winery. Both companies have separate AD forests. Users from Trey Research must access SharePoint resources in Coho Winery's forest. What trust type should be configured?
- External trust between the two forests
- Forest trust between the two forest root domains (Correct answer)
- Realm trust between the two forests
- Shortcut trust between the two forest root domains
Correct answer: Forest trust between the two forest root domains
A forest trust allows all domains in both forests to authenticate across organizational boundaries.
Question 7: Litware Inc. needs to ensure that deleted AD objects can be recovered without restoring from backup. The forest is at Windows Server 2008 R2 functional level. What feature should be enabled?
- Active Directory Recycle Bin (Correct answer)
- Volume Shadow Copy on SYSVOL
- Authoritative restore via NTDSUTIL
- System State backup with Windows Server Backup
Correct answer: Active Directory Recycle Bin
The AD Recycle Bin, introduced in Windows Server 2008 R2, allows restoration of deleted objects with all attributes intact.
MCTS 70-640 Case Studies & Practical Application 2
Contoso Ltd. has a single-domain forest.
Users in the Marketing OU report they cannot log on after a new GPO was linked to that OU.
The GPO was intended to enforce password complexity.
What is the most likely cause?