MCTS 70-640 Professional Standards & Competencies 2 — Questions and Answers
Question 1: When delegating control in Active Directory, what is the recommended best practice for applying permissions to OUs?
- Apply permissions directly to individual user accounts
- Use the Delegation of Control Wizard and assign permissions at the appropriate OU level (Correct answer)
- Grant Domain Admin rights to all IT staff who need to manage OUs
- Modify the default AdminSDHolder object to allow broader delegation
Correct answer: Use the Delegation of Control Wizard and assign permissions at the appropriate OU level
The Delegation of Control Wizard provides a structured, least-privilege approach to assigning granular AD permissions at the OU level without granting full admin rights.
Question 2: A company's security policy requires that all Group Policy changes be tested before production deployment. What is the professional standard approach?
- Apply GPOs directly to the Domain Controllers OU first
- Use a test OU with representative user and computer accounts before linking GPOs to production OUs (Correct answer)
- Enable all GPO settings simultaneously and monitor for issues
- Use Block Inheritance on the Domain level to test GPOs
Correct answer: Use a test OU with representative user and computer accounts before linking GPOs to production OUs
Testing GPOs in a representative test OU mirrors production conditions while isolating any unintended policy effects before broad deployment.
Question 3: According to AD DS best practices, how frequently should you back up Active Directory?
- Annually, during scheduled maintenance windows
- At least once per day, ensuring backups are retained beyond the tombstone lifetime (Correct answer)
- Only after major schema changes
- Weekly, using shadow copy snapshots only
Correct answer: At least once per day, ensuring backups are retained beyond the tombstone lifetime
Daily backups retained beyond the tombstone lifetime (default 60–180 days) ensure you can recover from both recent failures and lingering replication issues.
Question 4: Which audit policy category should be enabled to track changes to Active Directory objects, per Microsoft security baseline recommendations?
- Audit Account Logon Events only
- Audit Directory Service Access and Directory Service Changes (Correct answer)
- Audit Privilege Use only
- Audit System Events only
Correct answer: Audit Directory Service Access and Directory Service Changes
Enabling Audit Directory Service Access and Directory Service Changes captures who modified AD objects and what was changed, satisfying compliance and forensic requirements.
Question 5: What documentation is considered a professional standard when designing an Active Directory OU structure for a large enterprise?
- A verbal agreement among IT staff about the layout
- A written OU design document detailing delegation boundaries, GPO links, and administrative scope (Correct answer)
- An email chain summarizing high-level decisions
- A spreadsheet of user accounts only
Correct answer: A written OU design document detailing delegation boundaries, GPO links, and administrative scope
Formal OU design documentation ensures consistent administration, eases troubleshooting, and provides an authoritative reference for future changes and audits.
Question 6: A systems administrator needs to implement a change to the AD schema. What professional change management step must occur first?
- Run adprep /forestprep immediately without review
- Submit a change request for review and approval by a change advisory board before proceeding (Correct answer)
- Make the change during business hours to ensure staff can report issues
- Delegate schema modification rights to the helpdesk team
Correct answer: Submit a change request for review and approval by a change advisory board before proceeding
Schema changes are irreversible and forest-wide, making change advisory board review and approval mandatory before execution.
Question 7: When designing OU structures in Windows Server 2008 AD DS, which principle should guide the depth and hierarchy of OUs?
- Create as many levels as possible to mirror the org chart exactly
- Keep the hierarchy as shallow as practical while still meeting delegation and GPO requirements (Correct answer)
- Create one OU per user account for maximum granularity
- Place all objects in the default Computers and Users containers
Correct answer: Keep the hierarchy as shallow as practical while still meeting delegation and GPO requirements
A shallow, purposeful OU hierarchy reduces administrative complexity and Group Policy processing overhead while still supporting delegation and policy needs.
MCTS 70-640 Professional Standards & Competencies 2
When delegating control in Active Directory, what is the recommended best practice for applying permissions to OUs?