Free MCTS 70-640 MCQ Question and Answers — Questions and Answers
Question 1: In which of the subsequent circumstances might AD LDS be used?
- Standard private network
- You require the use of Group Policy
- You require the use of Organizational Units
- A DMZ (Correct answer)
Correct answer: A DMZ
Active Directory Lightweight Directory Services (AD LDS) is ideally suited for deployment in a Demilitarized Zone (DMZ) or perimeter network. Because AD LDS does not require domain membership or the full Active Directory infrastructure, it can provide secure directory services for web applications or external-facing services in an isolated environment. This prevents the exposure of the internal corporate Active Directory to external threats while still supporting application authentication and directory lookups.
Question 2: You must unlock the account that a user has locked (again!) for them to resume normal operations. Which of the following scenarios could result in a user account being unlocked?
- Windows PowerShell
- Command Line
- VBScript (Correct answer)
- None of the above
Correct answer: VBScript
VBScript was a widely used and powerful scripting language for automating administrative tasks in Windows environments, including Active Directory. While PowerShell and command-line tools can also unlock accounts, VBScript provided a flexible way to programmatically interact with Active Directory objects and modify properties like the `LockoutTime` attribute to unlock a user account. It was a common method for such operations in earlier Windows Server versions.
Question 3: Your IT manager is worried that someone is attempting to log on to the computers at your organization using legitimate domain user names and a variety of passwords. Which auditing procedure should you keep an eye on for these actions?
- Account Logon (Correct answer)
- Policy Change
- Privilege Use
- Directory Service Access
Correct answer: Account Logon
To detect attempts to log on using legitimate domain user names with various passwords, the 'Account Logon' auditing category must be enabled and monitored. This auditing policy specifically tracks events related to the validation of user credentials on a domain controller, including both successful and failed logon attempts. By analyzing these events, administrators can identify suspicious patterns indicative of brute-force attacks or unauthorized access attempts.
Question 4: The server manager is a fantastic tool for controlling the majority of your server settings and setup from a single location. Which of the following features of the server manager is used to manage the public key infrastructure?
- Domain Name Service
- Active Directory Certificate Services (Correct answer)
- Dynamic Host Configuration Server
- WINS Server
Correct answer: Active Directory Certificate Services
In Server Manager, the 'Active Directory Certificate Services' role is the designated feature for managing the Public Key Infrastructure (PKI). This role allows administrators to deploy, configure, and manage Certificate Authorities (CAs) within their organization. These CAs are essential for issuing and managing digital certificates, which are critical for secure communication, user and device authentication, and data encryption.
Question 5: Forest Trusts. There are four trust types in Windows Server 2008 that must be explicitly created. What kind of trust is NOT one of the following?
- Shortcut Trusts
- Forest Trusts
- Real Trusts (Correct answer)
- External Trusts
Correct answer: Real Trusts
Windows Server 2008 supports several specific types of trusts for Active Directory, including Forest Trusts, Shortcut Trusts, External Trusts, and Realm Trusts. 'Real Trusts' is not a recognized or standard trust type within the Active Directory framework. The listed trust types define how authentication and resource access relationships are established between different domains or forests.
Question 6: These trusts are occasionally required when users require access to resources that are housed in a Windows NT 4.0 domain or a domain that is part of an unaffiliated Active Directory Domain Services (AD DS) forest.
- Forest Trusts
- External Trust (Correct answer)
- Shortcut Trusts
- Realm Trusts
Correct answer: External Trust
External trusts are specifically designed to establish trust relationships with domains that are not part of the current Active Directory forest, such as Windows NT 4.0 domains or domains in an unaffiliated Active Directory Domain Services (AD DS) forest. These trusts can be one-way or two-way and are typically non-transitive, allowing users in one domain to access resources in the other, bridging disparate directory environments.
Question 7: With new users joining and leaving your IT organization every year, things are always changing. The deactivation of user accounts for workers who have left the organization is one of your frequent chores. What command is available for deleting user accounts?
- LDIFDE (Correct answer)
- Netsh
- Dspromo
- Dsmod
Correct answer: LDIFDE
LDIFDE (LDAP Data Interchange Format DE) is a command-line utility used to import and export directory objects to and from Active Directory using the LDAP Data Interchange Format (LDIF). While `dsmod` can delete individual objects, `LDIFDE` is particularly powerful for bulk operations, including deleting multiple user accounts by importing an LDIF file containing deletion instructions. It's a versatile tool for managing large sets of directory data.
Free MCTS 70-640 MCQ Question and Answers
In which of the subsequent circumstances might AD LDS be used?