MCTS 70-640 Professional Standards & Competencies 4 — Questions and Answers
Question 1: An organization's IT policy requires regular disaster recovery testing for Active Directory. What must be validated during a DR test for AD DS?
- Only the domain controller hardware replacement procedure
- The ability to perform an authoritative restore, verify replication convergence, and confirm FSMO role availability post-recovery (Correct answer)
- Restoring only user account passwords
- Testing DNS only, since AD depends on it
Correct answer: The ability to perform an authoritative restore, verify replication convergence, and confirm FSMO role availability post-recovery
A complete AD DR test must verify authoritative restores, replication health post-recovery, and FSMO role seizure or transfer to confirm full directory service continuity.
Question 2: According to Microsoft's Active Directory tiered administration model, where should highly privileged accounts such as Schema Admins be used?
- As daily user accounts for convenience
- Only when performing specific privileged tasks, and never used for email or browsing (Correct answer)
- Granted to all senior IT staff as standard accounts
- Stored in the default Users container with no additional restrictions
Correct answer: Only when performing specific privileged tasks, and never used for email or browsing
Highly privileged accounts should exist solely for specific administrative tasks and never be exposed to routine workstation use, reducing attack surface.
Question 3: When planning a Certificate Authority hierarchy for an enterprise PKI integrated with AD DS, what is the recommended two-tier design?
- A single online CA for all certificate issuance
- An offline root CA with one or more online subordinate issuing CAs (Correct answer)
- Multiple peer root CAs with no hierarchy
- An issuing CA without a root CA for simplicity
Correct answer: An offline root CA with one or more online subordinate issuing CAs
Keeping the root CA offline protects the trust anchor while subordinate issuing CAs handle day-to-day certificate operations, limiting exposure of the root key.
Question 4: A company needs to raise the forest functional level to Windows Server 2008. What is the professional pre-requisite to validate before doing so?
- Ensure at least one Windows NT 4.0 domain controller remains
- Confirm all domain controllers in all domains in the forest are running Windows Server 2008 or later (Correct answer)
- Disable all forest trusts before raising the level
- Transfer all FSMO roles to a Windows Server 2003 controller first
Correct answer: Confirm all domain controllers in all domains in the forest are running Windows Server 2008 or later
Raising the forest functional level requires every domain controller in every domain of the forest to be running the target OS version or higher.
Question 5: What professional standard applies when transferring FSMO roles during planned domain controller decommissioning?
- Seize all roles immediately before shutting down the old DC
- Transfer FSMO roles gracefully while the source DC is online, then verify role ownership before decommissioning (Correct answer)
- Leave FSMO roles on the retiring DC and seize them later
- Randomly assign FSMO roles to the youngest domain controller
Correct answer: Transfer FSMO roles gracefully while the source DC is online, then verify role ownership before decommissioning
Graceful transfer while the source is online ensures role consistency; seizure should only be used when the original role holder is unavailable.
Question 6: Which approach best meets the professional standard for securing the SYSVOL share on domain controllers running Windows Server 2008?
- Grant Everyone Full Control to SYSVOL for accessibility
- Ensure SYSVOL uses DFSR replication and apply NTFS permissions limiting write access to Domain Admins and SYSTEM (Correct answer)
- Disable SYSVOL replication to reduce attack surface
- Store Group Policy templates outside SYSVOL for security
Correct answer: Ensure SYSVOL uses DFSR replication and apply NTFS permissions limiting write access to Domain Admins and SYSTEM
DFSR provides more reliable SYSVOL replication, and restricting NTFS write permissions prevents unauthorized modification of Group Policy templates and logon scripts.
Question 7: An administrator must implement an AD DS site topology. What professional guideline determines where site links should be configured?
- Create site links that mirror the physical WAN connection paths and their available bandwidth (Correct answer)
- Create a single site link connecting all sites equally regardless of bandwidth
- Place all domain controllers in the Default-First-Site-Name site for simplicity
- Use manual replication only to avoid site link configuration overhead
Correct answer: Create site links that mirror the physical WAN connection paths and their available bandwidth
Site links should reflect actual WAN paths and bandwidth so the KCC can calculate optimal replication schedules that respect network capacity.
MCTS 70-640 Professional Standards & Competencies 4
An organization's IT policy requires regular disaster recovery testing for Active Directory.
What must be validated during a DR test for AD DS?