MCTS 70-640 Quality Control & Assurance 3 — Questions and Answers
Question 1: A company requires that password changes in Active Directory meet complexity requirements. Which Group Policy setting enforces this rule?
- Minimum password length
- Password must meet complexity requirements (Correct answer)
- Enforce password history
- Account lockout threshold
Correct answer: Password must meet complexity requirements
'Password must meet complexity requirements' enforces rules such as mixed case, numbers, and special characters in passwords.
Question 2: During a security audit, you need to verify which users have not logged on in the past 90 days. Which tool can query Active Directory for inactive accounts?
- dsquery user -inactive 13 (Correct answer)
- net user /domain
- whoami /groups
- nltest /user
Correct answer: dsquery user -inactive 13
dsquery user -inactive accepts a number of weeks and returns user accounts that have not logged on in that period.
Question 3: What is the default tombstone lifetime in Windows Server 2008 Active Directory, and why is it significant for quality assurance?
- 30 days; DCs offline longer may have inconsistent data
- 60 days; DCs offline longer may have inconsistent data
- 90 days; DCs offline longer may have inconsistent data (Correct answer)
- 180 days; DCs offline longer may have inconsistent data
Correct answer: 90 days; DCs offline longer may have inconsistent data
The default tombstone lifetime in Windows Server 2008 is 180 days, but wait — for forests raised from earlier versions it is 60 days; the default for new Windows Server 2008 forests is 180 days. DCs offline longer can develop lingering objects.
Question 4: An administrator needs to test whether Group Policy is being applied immediately after a policy change. Which command forces an immediate refresh of Group Policy on a client?
- secedit /refreshpolicy
- gpupdate /force (Correct answer)
- gpresult /r
- net group policy /refresh
Correct answer: gpupdate /force
gpupdate /force immediately reapplies all Group Policy settings regardless of whether they have changed.
Question 5: You are reviewing your Active Directory backup strategy. Which Windows Server 2008 feature allows you to perform a non-authoritative restore of AD DS?
- Active Directory Recycle Bin
- Windows Server Backup with Directory Services Restore Mode (Correct answer)
- Shadow Copies of Shared Folders
- Volume Shadow Copy Service
Correct answer: Windows Server Backup with Directory Services Restore Mode
A non-authoritative restore is performed by booting into Directory Services Restore Mode (DSRM) and restoring from a Windows Server Backup system state backup.
Question 6: Which audit policy category should be enabled to track changes made to Active Directory objects such as user accounts and OUs?
- Audit object access
- Audit directory service access (Correct answer)
- Audit account management
- Audit privilege use
Correct answer: Audit directory service access
Audit directory service access records access to Active Directory objects and is needed to track changes to AD objects.
Question 7: A security team wants to prevent brute-force attacks on domain accounts. Which Group Policy settings should they configure?
- Minimum password length and password complexity
- Account lockout threshold and account lockout duration (Correct answer)
- Enforce password history and maximum password age
- Interactive logon message and smart card requirement
Correct answer: Account lockout threshold and account lockout duration
Account lockout threshold defines how many failed attempts lock an account, and account lockout duration defines how long the lockout lasts.
MCTS 70-640 Quality Control & Assurance 3
A company requires that password changes in Active Directory meet complexity requirements.
Which Group Policy setting enforces this rule?