MCTS 70-640 MCQ 5 — Questions and Answers
Question 1: Which tool allows an administrator to perform an authoritative restore of accidentally deleted AD objects?
- repadmin /syncall
- ntdsutil with authoritative restore (Correct answer)
- dcpromo /forceremoval
- wbadmin start recovery
Correct answer: ntdsutil with authoritative restore
Ntdsutil is used in Directory Services Restore Mode to mark objects as authoritative so they replicate back to other DCs.
Question 2: AD Federation Services (AD FS) is used primarily to enable which scenario?
- Replication between AD forests
- Single sign-on across organizational boundaries using claims (Correct answer)
- Certificate enrollment for internal users
- Password policy enforcement for external users
Correct answer: Single sign-on across organizational boundaries using claims
AD FS provides web-based SSO and identity federation using standards like SAML to share identity claims across organizations.
Question 3: What is the default tombstone lifetime in Windows Server 2008 Active Directory?
- 30 days
- 60 days
- 180 days (Correct answer)
- 365 days
Correct answer: 180 days
Windows Server 2008 raises the default tombstone lifetime to 180 days, up from 60 days in older versions.
Question 4: Which group scope should be used to assign permissions to a resource, following Microsoft's AGDLP best practice?
- Global group
- Universal group
- Domain Local group (Correct answer)
- Local group on the member server
Correct answer: Domain Local group
AGDLP: Accounts → Global groups → Domain Local groups → Permissions; Domain Local groups are assigned to resources.
Question 5: A forest trust between two separate AD forests requires which minimum functional level?
- Windows 2000 native
- Windows Server 2003 (Correct answer)
- Windows Server 2008
- Windows Server 2008 R2
Correct answer: Windows Server 2003
Forest trusts require both forests to be at Windows Server 2003 forest functional level or higher.
Question 6: Which AD LDS (Lightweight Directory Services) feature differentiates it from full AD DS?
- AD LDS requires a domain controller
- AD LDS does not support Kerberos authentication
- AD LDS can run multiple instances on the same server without a domain (Correct answer)
- AD LDS stores data in a flat file instead of a database
Correct answer: AD LDS can run multiple instances on the same server without a domain
AD LDS runs as an independent service and supports multiple instances on one server, without requiring AD DS domain membership.
Question 7: Which command verifies Active Directory replication status between domain controllers?
- netdom query fsmo
- dcdiag /test:replications
- repadmin /replsummary (Correct answer)
- nltest /dsgetsite
Correct answer: repadmin /replsummary
Repadmin /replsummary provides a high-level summary of replication successes and failures across all DCs.
MCTS 70-640 MCQ 5
Which tool allows an administrator to perform an authoritative restore of accidentally deleted AD objects?