MCTS 70-640 Case Studies & Practical Application 5 — Questions and Answers
Question 1: Coho Winery's Active Directory schema needs to be extended for a new application. The administrator runs the extension tool and receives 'Access Denied'. What is the minimum group membership required?
- Enterprise Admins
- Schema Admins (Correct answer)
- Domain Admins in the forest root domain
- Domain Admins in any domain
Correct answer: Schema Admins
Schema Admins is the only group with permission to modify the Active Directory schema.
Question 2: Lucerne Publishing runs a Windows Server 2008 R2 forest. An admin must transfer the Infrastructure Master FSMO role because the current holder is being decommissioned. What tool should be used?
- Active Directory Users and Computers (ADUC) (Correct answer)
- Active Directory Domains and Trusts
- NTDSUTIL command-line tool
- Active Directory Sites and Services
Correct answer: Active Directory Users and Computers (ADUC)
The Infrastructure Master can be transferred using ADUC by right-clicking the domain and selecting 'Operations Masters'.
Question 3: A Contoso branch office loses its WAN connection. Local users cannot log on because there is no local DC. Which solution would have prevented this outcome?
- Deploying an RODC in the branch office (Correct answer)
- Configuring universal group membership caching on the site
- Adding the branch users to a domain local group
- Enabling offline domain join on all branch workstations
Correct answer: Deploying an RODC in the branch office
An RODC provides local authentication services, eliminating dependency on WAN connectivity for logon.
Question 4: Fabrikam wants to block a specific GPO setting from applying to one computer in an OU without moving the computer or using a new OU. What is the correct approach?
- Apply a security filter denying Apply Group Policy to that computer's account (Correct answer)
- Set the GPO link to Disabled for that computer only
- Configure a WMI filter targeting the computer's hostname
- Enable Block Policy Inheritance on the computer object
Correct answer: Apply a security filter denying Apply Group Policy to that computer's account
Denying Apply Group Policy permission to a specific computer account via security filtering prevents the GPO from applying to that computer.
Question 5: Southridge Video needs to ensure that a GPO applying desktop wallpaper cannot be overridden by GPOs linked at lower levels. What setting should be configured on that GPO link?
- Enforced (No Override) (Correct answer)
- Block Policy Inheritance
- Loopback Processing in Replace mode
- Link Order priority set to 1
Correct answer: Enforced (No Override)
Setting a GPO link to Enforced (formerly No Override) prevents child OU GPOs or Block Inheritance from overriding it.
Question 6: A technician at City Power & Light seizes the RID Master role because the original holder crashed and cannot be recovered. Two weeks later, the original DC is restored. What must be done before bringing the old DC back online?
- The restored DC must be demoted or its AD database discarded before rejoining (Correct answer)
- Run netdom resetpwd on the restored DC to sync its machine account
- Transfer the RID Master role back to the restored DC using ADUC
- Nothing; AD will automatically resolve the duplicate FSMO holder
Correct answer: The restored DC must be demoted or its AD database discarded before rejoining
Bringing a seized FSMO holder back online causes dual FSMO conflict; the old DC must be demoted or kept permanently offline.
Question 7: Wingtip Toys is implementing AD DS for the first time. They want a design that allows delegation of administration per business unit while keeping a single Kerberos authentication boundary. What design meets these requirements?
- A single domain with multiple OUs, each delegated to the respective business unit (Correct answer)
- A separate domain for each business unit within a single forest
- A separate forest for each business unit with forest trusts
- A single domain with a separate site per business unit
Correct answer: A single domain with multiple OUs, each delegated to the respective business unit
A single domain with delegated OUs satisfies both single authentication boundary and per-unit administrative delegation.
MCTS 70-640 Case Studies & Practical Application 5
Coho Winery's Active Directory schema needs to be extended for a new application.
The administrator runs the extension tool and receives 'Access Denied'.
What is the minimum group membership required?