MCTS 70-640 Quality Control & Assurance 5 — Questions and Answers
Question 1: A compliance officer asks you to produce a report showing all changes made to user account properties in the past week. Which log should you review?
- System event log
- Application event log
- Security event log with Audit Account Management enabled (Correct answer)
- Directory Service event log
Correct answer: Security event log with Audit Account Management enabled
With Audit Account Management enabled, the Security event log records all changes to user accounts including attribute modifications.
Question 2: You run 'repadmin /showrepl' and see the error 'The target principal name is incorrect.' What is the most likely cause?
- The domain controller's DNS record is missing
- The Kerberos tickets on the source DC are stale or the computer account password is out of sync (Correct answer)
- The replication schedule is disabled in Sites and Services
- The tombstone lifetime has been exceeded
Correct answer: The Kerberos tickets on the source DC are stale or the computer account password is out of sync
This error typically indicates a Kerberos authentication failure caused by a mismatched computer account password or stale tickets between DCs.
Question 3: During a quality review, you discover that the SYSVOL folder is not replicating between domain controllers. In Windows Server 2008 domain functional level, which service handles SYSVOL replication?
- File Replication Service (FRS)
- Distributed File System Replication (DFSR) (Correct answer)
- NTFRS
- BranchCache
Correct answer: Distributed File System Replication (DFSR)
Windows Server 2008 domain functional level migrates SYSVOL replication from FRS to the more reliable DFSR.
Question 4: An administrator needs to check whether all Active Directory integrated DNS zones are consistent across all DNS servers. Which tool helps verify DNS data consistency?
- ipconfig /flushdns
- dcdiag /test:DNS /DnsAll (Correct answer)
- nslookup /type=SOA
- dnscmd /enumzones
Correct answer: dcdiag /test:DNS /DnsAll
dcdiag /test:DNS /DnsAll performs comprehensive DNS diagnostic tests including zone delegation, dynamic updates, and record consistency.
Question 5: Which Windows Server 2008 feature allows you to set different password and account lockout policies for different groups of users within the same domain?
- Multiple Default Domain Policies
- Fine-Grained Password Policies (Correct answer)
- Password Filter DLL
- Local Security Policy override
Correct answer: Fine-Grained Password Policies
Fine-Grained Password Policies (FGPP) allow different Password Settings Objects to be applied to different users or global security groups in the same domain.
Question 6: You need to verify that the PDC Emulator FSMO role is functioning correctly. Which event in the PDC's event log indicates a successful time synchronization with an external time source?
- Event ID 37 in the System log from W32Time source (Correct answer)
- Event ID 4624 in the Security log
- Event ID 1000 in the Application log from NTDS source
- Event ID 2089 in the Directory Service log
Correct answer: Event ID 37 in the System log from W32Time source
Event ID 37 from the Windows Time (W32Time) source indicates that the time service successfully synchronized with a configured time source.
Question 7: A newly promoted domain controller is not appearing as a global catalog server after 24 hours. What should you verify first?
- Check if the Kerberos KDC service is running
- Verify that the Global Catalog checkbox is enabled in Active Directory Sites and Services for that DC's NTDS Settings (Correct answer)
- Run dcpromo again to re-promote the server
- Check the PDC emulator's replication schedule
Correct answer: Verify that the Global Catalog checkbox is enabled in Active Directory Sites and Services for that DC's NTDS Settings
The Global Catalog must be explicitly enabled per DC by checking the 'Global Catalog' checkbox on the NTDS Settings object in Active Directory Sites and Services.
MCTS 70-640 Quality Control & Assurance 5
A compliance officer asks you to produce a report showing all changes made to user account properties in the past week.
Which log should you review?