MCTS 70-640 Introduction to MCTS 70-640 4 — Questions and Answers
Question 1: A Read-Only Domain Controller (RODC) in Windows Server 2008 R2 can hold which type of passwords by default?
- All domain user passwords
- No passwords by default (Correct answer)
- Only computer account passwords
- Only service account passwords
Correct answer: No passwords by default
By default, an RODC does not cache any passwords; an administrator must configure a Password Replication Policy (PRP) to allow specific accounts to be cached.
Question 2: Which group is added to the Allowed RODC Password Replication Group by default in Windows Server 2008 R2?
- Domain Users
- Authenticated Users
- No user accounts — it is empty by default (Correct answer)
- Enterprise Read-Only Domain Controllers
Correct answer: No user accounts — it is empty by default
The Allowed RODC Password Replication Group is empty by default; administrators must explicitly add accounts whose passwords an RODC may cache.
Question 3: What is the role of the AD DS Schema Master in a Windows Server 2008 R2 forest?
- It controls all write operations in the domain
- It is the only DC that can make changes to the Active Directory schema (Correct answer)
- It manages the pool of unique security identifiers
- It handles all Kerberos authentication requests
Correct answer: It is the only DC that can make changes to the Active Directory schema
The Schema Master is a forest-wide FSMO role; only the DC holding it can make schema modifications that are then replicated forest-wide.
Question 4: Which tool allows you to verify that Active Directory replication is working correctly between domain controllers?
- dcdiag
- netdom
- nltest
- repadmin (Correct answer)
Correct answer: repadmin
Repadmin (replication administrator) is the primary tool for monitoring, diagnosing, and forcing Active Directory replication between domain controllers.
Question 5: In a Windows Server 2008 R2 environment, what does raising the domain functional level to Windows Server 2008 enable?
- Universal security groups
- Fine-grained password policies
- DFS Replication for SYSVOL (Correct answer)
- Linked-value replication
Correct answer: DFS Replication for SYSVOL
At the Windows Server 2008 domain functional level, SYSVOL can be replicated using DFS Replication (DFSR) instead of the older FRS (File Replication Service).
Question 6: Which command verifies the health and configuration of a domain controller, including FSMO role holders?
- netstat -an
- dcdiag /test:fsmocheck (Correct answer)
- ipconfig /flushdns
- repadmin /syncall
Correct answer: dcdiag /test:fsmocheck
Dcdiag /test:fsmocheck queries and verifies that all FSMO role holders are reachable and responding correctly.
Question 7: What is the purpose of a 'child domain' in an Active Directory forest?
- To create a completely separate forest with its own schema
- To create a subdomain that shares the forest schema but has its own domain partition (Correct answer)
- To store additional FSMO roles outside the root domain
- To host a Global Catalog without replication overhead
Correct answer: To create a subdomain that shares the forest schema but has its own domain partition
A child domain is a subdomain of a parent domain within the same forest, inheriting the forest schema and configuration but maintaining its own domain partition and domain-level FSMO roles.
MCTS 70-640 Introduction to MCTS 70-640 4
A Read-Only Domain Controller (RODC) in Windows Server 2008 R2 can hold which type of passwords by default?