MCTS 70-640 Group Policy Administration & Security Settings 1 — Questions and Answers
Question 1: In what order are Group Policy Objects (GPOs) applied in Active Directory?
- Site, Domain, OU (local applied last)
- Local, Site, Domain, OU (Correct answer)
- OU, Domain, Site, Local
- Domain, Site, OU, Local
Correct answer: Local, Site, Domain, OU
GPOs are applied in LSDOU order: Local, Site, Domain, then Organizational Unit, with later policies able to override earlier ones.
Question 2: What does the 'Block Inheritance' option on an OU do?
- Prevents GPOs from a parent container from applying to the OU (Correct answer)
- Blocks all security settings from being applied
- Prevents child OUs from inheriting GPOs from the blocked OU
- Disables all GPOs in the domain
Correct answer: Prevents GPOs from a parent container from applying to the OU
Block Inheritance stops GPOs linked at parent containers (domain or higher-level OUs) from flowing down to the OU where it is set.
Question 3: Which GPO setting overrides 'Block Inheritance' to force a policy to apply regardless?
- No Override (Enforced) (Correct answer)
- Loopback Processing
- WMI Filtering
- Security Filtering
Correct answer: No Override (Enforced)
Setting a GPO link to 'Enforced' (formerly No Override) prevents Block Inheritance from stopping that GPO from applying.
Question 4: Which Group Policy section contains settings like Account Lockout Policy and Password Policy?
- Computer Configuration → Windows Settings → Security Settings → Account Policies (Correct answer)
- User Configuration → Administrative Templates → System
- Computer Configuration → Administrative Templates → Network
- User Configuration → Windows Settings → Scripts
Correct answer: Computer Configuration → Windows Settings → Security Settings → Account Policies
Account Policies including Password Policy and Account Lockout Policy are found under Computer Configuration → Windows Settings → Security Settings → Account Policies.
Question 5: What is the purpose of the Resultant Set of Policy (RSoP) tool in Windows Server 2008?
- To create new GPOs
- To simulate or view the effective Group Policy settings applied to a user or computer (Correct answer)
- To replicate GPOs between domain controllers
- To delete conflicting GPOs
Correct answer: To simulate or view the effective Group Policy settings applied to a user or computer
RSoP reports the net result of all GPOs applied to a specific user or computer, helping administrators troubleshoot policy conflicts.
Question 6: Which command-line tool forces an immediate Group Policy refresh on a Windows Server 2008 machine?
- gpupdate /force (Correct answer)
- secedit /refreshpolicy
- gpresult /r
- dcgpofix /force
Correct answer: gpupdate /force
Running 'gpupdate /force' immediately reapplies all Group Policy settings, reprocessing even those that have not changed.
MCTS 70-640 Group Policy Administration & Security Settings 1
In what order are Group Policy Objects (GPOs) applied in Active Directory?