MCTS 70-640 Case Studies & Practical Application 3 — Questions and Answers
Question 1: A help desk technician at Blue Yonder Airlines accidentally deleted 200 user accounts. The forest functional level is Windows Server 2008 R2 and the AD Recycle Bin is enabled. What is the fastest recovery method?
- Restore from the most recent System State backup
- Use Get-ADObject with -IncludeDeletedObjects and Restore-ADObject (Correct answer)
- Perform an authoritative restore using NTDSUTIL
- Re-create all user accounts manually from HR records
Correct answer: Use Get-ADObject with -IncludeDeletedObjects and Restore-ADObject
With the AD Recycle Bin enabled, deleted objects can be restored via PowerShell using Restore-ADObject without any backup or DC restart.
Question 2: Woodgrove Bank needs to delegate the ability to reset passwords in the Tellers OU to a group called HelpDesk without granting them broader administrative rights. What is the correct approach?
- Add HelpDesk to the Account Operators built-in group
- Use the Delegation of Control Wizard on the Tellers OU (Correct answer)
- Grant HelpDesk Full Control on the domain object
- Add HelpDesk members as domain administrators
Correct answer: Use the Delegation of Control Wizard on the Tellers OU
The Delegation of Control Wizard allows granular permission assignment on specific OUs for specific tasks such as password reset.
Question 3: Contoso deploys a new DC and notices AD replication is failing between two sites. Repadmin /showrepl shows error 8453. What does this indicate?
- DNS name resolution failure for the replication partner
- Replication access denied due to insufficient permissions (Correct answer)
- The replication schedule is set to Never
- The site link between the two sites has been deleted
Correct answer: Replication access denied due to insufficient permissions
Error 8453 'Replication Access Was Denied' means the DC's computer account lacks the required replication permissions in AD.
Question 4: An administrator at Tailspin Toys wants to ensure that Group Policy settings apply immediately to all computers in an OU without waiting for background refresh. What command should be run on each client?
- gpupdate /force (Correct answer)
- secedit /refreshpolicy MACHINE_POLICY
- dcgpofix /ignoreschema
- netlogon /restart
Correct answer: gpupdate /force
gpupdate /force triggers an immediate reapplication of all Group Policy settings on the local machine.
Question 5: Fourth Coffee has multiple sites connected by slow WAN links. AD replication is generating too much traffic between Site A and Site B. What should be configured to reduce replication frequency?
- Increase the replication interval on the site link between Site A and Site B (Correct answer)
- Add an SMTP site link connector between the two sites
- Enable universal group membership caching in Site B
- Place an additional GC server in Site A
Correct answer: Increase the replication interval on the site link between Site A and Site B
Increasing the site link replication interval reduces how often changes are replicated between sites, lowering WAN traffic.
Question 6: Humongous Insurance wants to prevent users from installing software on their workstations. A GPO with Software Restriction Policies is deployed. Users report that .msi files installed by IT are also blocked. What should be configured?
- Set the default security level to Disallowed and add path rules for IT software (Correct answer)
- Add a hash rule for every approved .msi file
- Change the enforcement to 'All software files except libraries'
- Enable AppLocker instead and allow all .msi files by publisher
Correct answer: Set the default security level to Disallowed and add path rules for IT software
Setting the default to Disallowed and creating path rules for approved locations allows IT-deployed software while blocking user installations.
Question 7: A forest trust between Contoso and Fabrikam is in place. Users in Contoso report that they can access some resources in Fabrikam but not others that they are explicitly permitted to access. SID history is suspected. What should be verified?
- That SID filtering (quarantine) is disabled on the trust if SID history migration was used (Correct answer)
- That the forest functional level is Windows Server 2003 in both forests
- That universal groups are used instead of domain local groups
- That the Kerberos ticket size does not exceed 4 KB
Correct answer: That SID filtering (quarantine) is disabled on the trust if SID history migration was used
SID filtering on forest trusts strips SID history attributes from cross-forest tokens, which can block access when SID history was used during migration.
MCTS 70-640 Case Studies & Practical Application 3
A help desk technician at Blue Yonder Airlines accidentally deleted 200 user accounts.
The forest functional level is Windows Server 2008 R2 and the AD Recycle Bin is enabled.
What is the fastest recovery method?