MCTS 70-640 Professional Standards & Competencies 5 — Questions and Answers
Question 1: A technician is troubleshooting a Group Policy application failure. What is the recommended first diagnostic step according to Microsoft troubleshooting methodology?
- Immediately delete and recreate the GPO
- Run gpresult /h to generate an HTML report and identify which GPOs are applied or blocked (Correct answer)
- Restart the domain controller and wait for policies to reapply
- Disable all GPOs and re-enable them one by one
Correct answer: Run gpresult /h to generate an HTML report and identify which GPOs are applied or blocked
gpresult /h provides a complete, readable summary of GPO application, filtering, and errors, making it the authoritative first diagnostic tool.
Question 2: The Active Directory Recycle Bin feature in Windows Server 2008 R2 requires what forest functional level to enable?
- Windows 2000 native
- Windows Server 2003
- Windows Server 2008 R2 (Correct answer)
- Windows Server 2008
Correct answer: Windows Server 2008 R2
The AD Recycle Bin requires the forest functional level to be raised to Windows Server 2008 R2 or higher before it can be enabled.
Question 3: Under Kerberos authentication standards in Windows Server 2008 AD DS, what is the maximum allowed clock skew between a client and a domain controller by default?
- 10 minutes
- 30 minutes
- 5 minutes (Correct answer)
- 1 hour
Correct answer: 5 minutes
Kerberos requires clocks within 5 minutes of each other by default; exceeding this skew causes authentication failures and is mitigated by AD's time synchronization hierarchy.
Question 4: What professional standard should guide the configuration of DNS zones integrated with Active Directory to ensure security?
- Use standard primary zones stored as flat files on all domain controllers
- Use AD-integrated DNS zones with dynamic updates set to Secure Only to prevent unauthorized record registration (Correct answer)
- Allow all DNS clients to perform dynamic updates without authentication
- Store DNS zones on a standalone DNS server outside the domain
Correct answer: Use AD-integrated DNS zones with dynamic updates set to Secure Only to prevent unauthorized record registration
AD-integrated zones with Secure Only dynamic updates ensure only authenticated domain members can register or update DNS records, preventing DNS poisoning.
Question 5: Which domain controller hardening measure is recommended by Microsoft security baselines for Windows Server 2008 domain controllers?
- Install all server roles and features on each DC for maximum capability
- Apply the appropriate Security Compliance Manager baseline, disable unnecessary services, and restrict local logon to domain admins only (Correct answer)
- Enable Remote Desktop for all IT staff with no additional restrictions
- Place domain controllers in the workstations OU to inherit desktop GPOs
Correct answer: Apply the appropriate Security Compliance Manager baseline, disable unnecessary services, and restrict local logon to domain admins only
Applying a security baseline, minimizing installed roles, and restricting interactive logon reduces the attack surface of domain controllers, which are crown-jewel assets.
Question 6: A company's compliance team requires proof that no unauthorized changes were made to AD group memberships in the last 90 days. What Windows Server 2008 capability best supports this?
- Review the event log on individual workstations
- Enable Audit Directory Service Changes (DS Changes) subcategory and archive Security event logs for 90 days or more (Correct answer)
- Use Resultant Set of Policy to generate group membership reports
- Export Active Directory to a spreadsheet monthly
Correct answer: Enable Audit Directory Service Changes (DS Changes) subcategory and archive Security event logs for 90 days or more
The DS Changes audit subcategory records old and new values for modified AD attributes, providing a complete changelog for group membership alterations.
Question 7: When planning the placement of global catalog servers in a multi-site Active Directory environment, what professional guideline applies?
- Place a global catalog server only at headquarters and nowhere else
- Place at least one global catalog server in each site to reduce WAN logon traffic and support universal group membership caching (Correct answer)
- Disable global catalog on all domain controllers to reduce replication overhead
- Configure global catalog only on RODC servers
Correct answer: Place at least one global catalog server in each site to reduce WAN logon traffic and support universal group membership caching
Placing a global catalog in each site prevents logon delays caused by cross-site GC queries for universal group membership during authentication.
MCTS 70-640 Professional Standards & Competencies 5
A technician is troubleshooting a Group Policy application failure.
What is the recommended first diagnostic step according to Microsoft troubleshooting methodology?