MCTS 70-640 Case Studies & Practical Application 4 — Questions and Answers
Question 1: Consolidated Messenger is migrating from Windows Server 2003 to Windows Server 2008 R2. After raising the domain functional level, administrators notice that fine-grained password policies still cannot be configured. What is the likely cause?
- The forest functional level has not been raised to Windows Server 2008 R2
- The domain functional level must be Windows Server 2008 or higher (Correct answer)
- PSOs require Schema version 44 which is not yet deployed
- Fine-grained password policies require ADFS to be configured
Correct answer: The domain functional level must be Windows Server 2008 or higher
Fine-Grained Password Policies require a minimum domain functional level of Windows Server 2008.
Question 2: Wide World Importers has a single forest with three domains. They want a user in the child domain to manage GPOs linked to the parent domain root. What is the minimum group membership required?
- Domain Admins in the parent domain
- Group Policy Creator Owners in the parent domain (Correct answer)
- Enterprise Admins
- Schema Admins
Correct answer: Group Policy Creator Owners in the parent domain
Group Policy Creator Owners members can create and manage GPOs in a domain without being full Domain Admins.
Question 3: An RODC at a branch office of Proseware Inc. is caching credentials. An attacker steals the RODC. What action should the administrator take immediately?
- Reset passwords for all users whose credentials were cached on the RODC (Correct answer)
- Seize the PDC Emulator FSMO role to prevent credential reuse
- Remove the stolen RODC's computer account from Active Directory
- Force replication from all writable DCs to invalidate cached tickets
Correct answer: Reset passwords for all users whose credentials were cached on the RODC
Resetting passwords for cached accounts invalidates any stolen credentials the attacker may extract from the RODC's local database.
Question 4: Alpine Ski House needs to audit all successful and failed logon attempts for privileged accounts. Which Group Policy node contains the relevant settings?
- Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy (Correct answer)
- User Configuration > Windows Settings > Security Settings > Audit Policy
- Computer Configuration > Administrative Templates > System > Audit
- User Configuration > Administrative Templates > Windows Components > Event Log
Correct answer: Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
Logon auditing settings are under Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy.
Question 5: Tailspin Toys has a universal group containing users from multiple domains. When a user is added to the group, global catalog replication traffic spikes. What can reduce this replication overhead?
- Convert the universal group to a domain local group
- Use domain local groups to nest users and add the domain local group to the universal group (Correct answer)
- Enable Universal Group Membership Caching in each site
- Reduce the replication interval on all site links
Correct answer: Use domain local groups to nest users and add the domain local group to the universal group
Nesting domain local groups (which don't replicate to the GC) inside the universal group means individual member changes don't trigger GC replication.
Question 6: Margie's Travel needs to redirect all domain users' Documents folders to a file server share. The policy should apply only to computers running Windows 7 or later. What is the correct mechanism?
- Folder Redirection in User Configuration with a WMI filter targeting Windows 7+ (Correct answer)
- Folder Redirection in Computer Configuration targeting the workstations OU
- Login scripts in NETLOGON that robocopy the Documents folder
- Software Installation in Computer Configuration to deploy a redirection agent
Correct answer: Folder Redirection in User Configuration with a WMI filter targeting Windows 7+
Folder Redirection is configured under User Configuration, and WMI filters allow targeting by OS version.
Question 7: Datum Corporation's AD environment has grown to 50 sites. Administrators notice that KCC-generated replication topology creates too many direct connections. What should be implemented to optimize this?
- Manually configure preferred bridgehead servers for each site (Correct answer)
- Disable the KCC and manually define all connection objects
- Increase the number of GC servers to reduce KCC load
- Enable SMTP replication between all sites
Correct answer: Manually configure preferred bridgehead servers for each site
Defining preferred bridgehead servers gives administrators control over which DCs handle inter-site replication, optimizing traffic flow.
MCTS 70-640 Case Studies & Practical Application 4
Consolidated Messenger is migrating from Windows Server 2003 to Windows Server 2008 R2.
After raising the domain functional level, administrators notice that fine-grained password policies still cannot be configured.
What is the likely cause?