MCTS 70-640 Professional Standards & Competencies 3 — Questions and Answers
Question 1: Which principle of access control is most aligned with Microsoft's recommendation for Active Directory service accounts?
- Grant service accounts Domain Admin rights for unrestricted access
- Apply the principle of least privilege, granting only the permissions the service requires (Correct answer)
- Use a single shared administrator account for all services
- Give service accounts Schema Admin rights by default
Correct answer: Apply the principle of least privilege, granting only the permissions the service requires
Least privilege limits the blast radius of a compromised service account by restricting it to only the permissions necessary for its function.
Question 2: A company must comply with PCI-DSS and needs to enforce distinct password complexity requirements for different user groups. What Windows Server 2008 feature best supports this?
- Default Domain Password Policy applied to all users
- Fine-Grained Password Policies (Password Settings Objects) applied to global security groups (Correct answer)
- Local Security Policy on individual workstations
- Group Policy Preferences targeting specific OUs
Correct answer: Fine-Grained Password Policies (Password Settings Objects) applied to global security groups
Fine-Grained Password Policies allow distinct password and lockout settings to be applied at the group or user level, independent of the domain-wide policy.
Question 3: According to best practices, where should the PDC Emulator FSMO role be placed in a multi-site environment?
- On a domain controller in the smallest branch site
- On a domain controller in the hub site with the best connectivity to all other sites (Correct answer)
- Distributed randomly across multiple domain controllers
- On a read-only domain controller in the largest site
Correct answer: On a domain controller in the hub site with the best connectivity to all other sites
The PDC Emulator handles time synchronization, password changes, and account lockouts, making it critical that it resides in a well-connected, central hub site.
Question 4: What is the professional standard for monitoring Active Directory replication health in an enterprise environment?
- Manually check replication once a month
- Use repadmin /replsummary and repadmin /showrepl regularly, combined with alerting on replication failures (Correct answer)
- Rely solely on event log spot-checks by helpdesk staff
- Disable replication monitoring to reduce log noise
Correct answer: Use repadmin /replsummary and repadmin /showrepl regularly, combined with alerting on replication failures
Regular use of repadmin tools combined with automated alerting ensures replication failures are detected and resolved before they affect directory integrity.
Question 5: When deploying a Read-Only Domain Controller (RODC) to a branch office, what is the recommended approach for the Password Replication Policy (PRP)?
- Allow all domain passwords to cache on the RODC by default
- Configure a restricted PRP allowing only branch-user and computer accounts to cache passwords (Correct answer)
- Disable the PRP entirely to prevent any caching
- Cache Domain Admin passwords on the RODC for faster authentication
Correct answer: Configure a restricted PRP allowing only branch-user and computer accounts to cache passwords
A restricted PRP limits cached credentials to only those accounts that regularly authenticate at the branch, reducing exposure if the RODC is compromised.
Question 6: A forest trust has been established between two organizations. What security measure should be applied to limit which domains within a forest can be accessed via the trust?
- Remove all SPN registrations in both forests
- Enable selective authentication on the forest trust to control resource access per user group (Correct answer)
- Set the trust to non-transitive to block all cross-domain access
- Grant all users in the trusted forest Domain Admin rights
Correct answer: Enable selective authentication on the forest trust to control resource access per user group
Selective authentication forces explicit permission grants on resources, preventing any trusted-forest user from automatically accessing resources in the trusting forest.
Question 7: What is the recommended professional standard for validating that Group Policy is applying correctly after a new GPO deployment?
- Wait for user complaints to identify misconfigured policies
- Run gpresult /r or use GPMC's Group Policy Results and Modeling features to verify effective policy (Correct answer)
- Check the SYSVOL folder size only
- Restart all domain controllers simultaneously
Correct answer: Run gpresult /r or use GPMC's Group Policy Results and Modeling features to verify effective policy
gpresult and the GPMC's built-in reporting tools provide definitive evidence of which GPOs are applied and in what order, enabling rapid troubleshooting.
MCTS 70-640 Professional Standards & Competencies 3
Which principle of access control is most aligned with Microsoft's recommendation for Active Directory service accounts?