MCTS 70-640 Research & Evidence-Based Practice 4 — Questions and Answers
Question 1: Based on Microsoft best practice research, what is the recommended AD DS forest design when an organization requires complete administrative isolation between two business units?
- Separate forests for each business unit (Correct answer)
- Separate domains in a single forest
- Separate OUs with delegated administration
- Separate sites with separate GPOs
Correct answer: Separate forests for each business unit
Complete administrative isolation requires separate forests because forest-level boundaries are the only true security boundary in AD DS.
Question 2: Microsoft's recommended evidence-based practice for placing domain controllers in a branch office with fewer than 25 users and limited WAN bandwidth involves which role?
- Read-Only Domain Controller (RODC) (Correct answer)
- Additional writable domain controller
- Global Catalog server
- Bridgehead server
Correct answer: Read-Only Domain Controller (RODC)
RODCs host a read-only copy of AD, preventing credential theft risks at insecure branch locations while still providing local authentication.
Question 3: When researching the impact of enabling the Active Directory Recycle Bin in Windows Server 2008 R2, which prerequisite functional level must be met?
- Windows Server 2008 R2 Forest Functional Level (Correct answer)
- Windows Server 2008 Domain Functional Level
- Windows Server 2003 Forest Functional Level
- Windows Server 2008 Forest Functional Level
Correct answer: Windows Server 2008 R2 Forest Functional Level
The AD Recycle Bin requires Windows Server 2008 R2 Forest Functional Level, which means all DCs in all domains must run Windows Server 2008 R2 or later.
Question 4: Research shows that bridgehead server failures cause entire site replication to stall. What is the evidence-based best practice to prevent a single point of failure?
- Allow AD to use automatic bridgehead server selection rather than manually designating preferred bridgehead servers (Correct answer)
- Designate multiple preferred bridgehead servers per site
- Disable ISTG and configure manual connection objects
- Deploy a dedicated bridgehead server with more RAM
Correct answer: Allow AD to use automatic bridgehead server selection rather than manually designating preferred bridgehead servers
Manual preferred bridgehead designation creates a single point of failure; automatic selection lets the ISTG elect multiple candidates and failover automatically.
Question 5: Evidence from Microsoft guidance indicates that placing all five FSMO roles on a single domain controller is acceptable only under which condition?
- In a single-domain forest with only one domain controller (Correct answer)
- In any domain with fewer than 500 users
- When the domain controller is also a Global Catalog server
- When the PDC emulator role is held by the infrastructure master
Correct answer: In a single-domain forest with only one domain controller
In a single-DC environment all five FSMO roles must reside on that one DC; in multi-DC environments roles should be distributed according to best practice.
Question 6: Research on AD DS security hardening indicates which practice reduces exposure when a domain controller is decommissioned improperly?
- Run 'dcpromo /forceremoval' and then clean up metadata using ntdsutil (Correct answer)
- Simply power off the old DC and delete its computer account
- Use 'dcpromo' in attended mode only if the DC is still online
- Remove the DC's DNS records manually before running dcpromo
Correct answer: Run 'dcpromo /forceremoval' and then clean up metadata using ntdsutil
Force removal followed by metadata cleanup with ntdsutil removes all AD references to the decommissioned DC, preventing lingering objects and replication errors.
Question 7: According to Windows Server 2008 best practice research, what is the recommended approach for AD sites and site links to ensure predictable replication costs?
- Assign lower cost values to faster, more reliable WAN links so the KCC prefers them (Correct answer)
- Assign higher cost values to all links to slow replication
- Use default cost of 100 for all site links regardless of bandwidth
- Disable site link bridging and create direct site links between all sites
Correct answer: Assign lower cost values to faster, more reliable WAN links so the KCC prefers them
Lower cost site links are preferred by the KCC when generating the replication topology, so faster links should receive lower costs to optimize replication paths.
MCTS 70-640 Research & Evidence-Based Practice 4
Based on Microsoft best practice research, what is the recommended AD DS forest design when an organization requires complete administrative isolation between two business units?