MCTS 70-640 Research & Evidence-Based Practice 5 — Questions and Answers
Question 1: An organization is using evidence-based capacity planning for AD DS. Which performance counter set provides the most relevant baseline data for domain controller health?
- NTDS object counters in Performance Monitor (Correct answer)
- Processor\% Processor Time only
- Network Interface\Bytes Total/sec only
- Memory\Available MBytes only
Correct answer: NTDS object counters in Performance Monitor
The NTDS performance object exposes counters for LDAP searches, DRA replication, Kerberos authentications, and NTLM operations—critical for AD-specific capacity planning.
Question 2: After studying replication convergence issues, an administrator wants to confirm that all domain controllers hold identical values for a critical attribute. Which repadmin command compares attribute values across all DCs?
- repadmin /showattr * <DN> /atts:<attribute> (Correct answer)
- repadmin /showrepl * /csv
- repadmin /replsummary /bysrc
- repadmin /showobjmeta <DN>
Correct answer: repadmin /showattr * <DN> /atts:<attribute>
repadmin /showattr with the wildcard (*) queries every DC for the specified object's attribute values, revealing any replication inconsistencies.
Question 3: Evidence-based monitoring practice recommends alerting on which condition to detect AD database (NTDS.dit) free-space issues before they cause domain controller failures?
- Monitor the disk partition hosting NTDS.dit for less than 20% free space (Correct answer)
- Monitor Event ID 1173 only after a failure occurs
- Monitor total server RAM usage
- Monitor CPU usage on the domain controller above 80%
Correct answer: Monitor the disk partition hosting NTDS.dit for less than 20% free space
The NTDS.dit database requires free disk space to perform online defragmentation and log flushing; proactive disk monitoring prevents AD database corruption.
Question 4: Research into AD DS upgrade paths shows that when raising the domain functional level to Windows Server 2008, what new feature becomes available that was not present at the 2003 level?
- Distributed File System Replication (DFSR) for SYSVOL (Correct answer)
- Fine-Grained Password Policies
- Read-Only Domain Controllers
- Universal Group Membership Caching
Correct answer: Distributed File System Replication (DFSR) for SYSVOL
At Windows Server 2008 domain functional level, SYSVOL replication can be migrated from FRS to the more reliable DFSR mechanism.
Question 5: An evidence-based approach to AD disaster recovery testing requires verifying authoritative restore capability. Which tool and method performs an authoritative restore of a deleted OU?
- ntdsutil 'authoritative restore' 'restore subtree <OU DN>' (Correct answer)
- wbadmin restore with /authsysvol flag
- Active Directory Users and Computers 'Restore' context menu
- repadmin /restore with the OU distinguished name
Correct answer: ntdsutil 'authoritative restore' 'restore subtree <OU DN>'
ntdsutil's authoritative restore command increments USN values on restored objects so they replicate outbound and overwrite the deletion on other DCs.
Question 6: To verify that AD integrated DNS zones are healthy and that zone data is consistent across all domain controllers, which evidence-gathering command should be run?
- dcdiag /test:DNS /DnsRecordRegistration /v (Correct answer)
- ipconfig /registerdns on each DC
- dnscmd /zonerefresh on the primary DC
- netsh dns show zones on each DC
Correct answer: dcdiag /test:DNS /DnsRecordRegistration /v
dcdiag /test:DNS with /DnsRecordRegistration /v performs a comprehensive DNS test verifying zone consistency, SRV records, and registration across all DCs.
Question 7: Based on Microsoft's evidence-based guidance for AD DS forests with multiple UPN suffixes, what must be configured so that users can log on with an alternate UPN suffix?
- Add the alternate UPN suffix in Active Directory Domains and Trusts, then assign it to user accounts (Correct answer)
- Create a new child domain for each UPN suffix
- Configure DNS conditional forwarders for each suffix
- Add the suffix to the schema naming context
Correct answer: Add the alternate UPN suffix in Active Directory Domains and Trusts, then assign it to user accounts
Alternate UPN suffixes are registered in Active Directory Domains and Trusts under the forest root, then assigned per-user in the Account tab of their AD object.
MCTS 70-640 Research & Evidence-Based Practice 5
An organization is using evidence-based capacity planning for AD DS.
Which performance counter set provides the most relevant baseline data for domain controller health?