MCTS 70-640 Research & Evidence-Based Practice 2 — Questions and Answers
Question 1: When troubleshooting AD replication failures, which command-line tool provides the most comprehensive diagnostic report including replication status, connectivity, and DNS health?
- dcdiag.exe (Correct answer)
- netstat.exe
- repadmin /showrepl
- nltest /dsgetdc
Correct answer: dcdiag.exe
dcdiag.exe runs a comprehensive suite of tests covering DNS, replication, connectivity, and domain controller health.
Question 2: An administrator needs evidence of all changes made to AD objects over the past week. Which audit subcategory must be enabled to capture this data?
- Audit Directory Service Changes (Correct answer)
- Audit Account Logon Events
- Audit Object Access
- Audit Policy Change
Correct answer: Audit Directory Service Changes
The 'Audit Directory Service Changes' subcategory logs old and new values whenever an AD object attribute is modified.
Question 3: After deploying a new GPO, users report it is not applying. Which tool produces a detailed HTML report documenting exactly which policies are applying and which are being blocked?
- gpresult /H report.html (Correct answer)
- gpmc.msc Modeling Wizard
- rsop.msc
- gpedit.msc
Correct answer: gpresult /H report.html
gpresult /H generates an HTML-formatted Resultant Set of Policy report showing applied, denied, and filtered GPOs for a specific user/computer.
Question 4: Which event ID in the Security log on a Windows Server 2008 domain controller indicates a successful account logon authenticated via Kerberos?
- 4768 (Correct answer)
- 4625
- 4740
- 4648
Correct answer: 4768
Event ID 4768 is generated when a Kerberos Authentication Service (AS) ticket is requested, indicating Kerberos-based authentication.
Question 5: A researcher wants to gather baseline data on AD replication latency across sites. Which repadmin command shows the last replication attempt and result for all domain controllers?
- repadmin /showrepl
- repadmin /syncall
- repadmin /replsummary (Correct answer)
- repadmin /queue
Correct answer: repadmin /replsummary
repadmin /replsummary provides a concise summary of the largest delta and failure counts per domain controller, ideal for baseline analysis.
Question 6: When performing a post-incident analysis of an account lockout, which tool can query all domain controllers to pinpoint the source machine causing the lockouts?
- Microsoft Account Lockout and Management Tools (LockoutStatus.exe) (Correct answer)
- Active Directory Users and Computers
- Event Viewer on the PDC emulator
- Netlogon log on any DC
Correct answer: Microsoft Account Lockout and Management Tools (LockoutStatus.exe)
LockoutStatus.exe polls all domain controllers simultaneously and displays the lockout status and bad password source across all DCs.
Question 7: To verify that a Windows Server 2008 domain controller has properly registered all required SRV records in DNS, which dcdiag test should be run?
- dcdiag /test:RegisterInDNS
- dcdiag /test:DNS (Correct answer)
- dcdiag /test:Replications
- dcdiag /test:NetLogons
Correct answer: dcdiag /test:DNS
dcdiag /test:DNS validates that all required DNS records including SRV, A, and CNAME records are registered and resolvable.
MCTS 70-640 Research & Evidence-Based Practice 2
When troubleshooting AD replication failures, which command-line tool provides the most comprehensive diagnostic report including replication status, connectivity, and DNS health?