MCTS 70-640 MCTS 70 640: Active Directory, Configuring 4 — Questions and Answers
Question 1: You are configuring a new AD DS forest. Which server holds the Schema Master FSMO role by default?
- The first DC installed in the first child domain
- The first DC installed in the forest root domain (Correct answer)
- Any DC that holds the Global Catalog
- The Infrastructure Master of the forest root domain
Correct answer: The first DC installed in the forest root domain
The Schema Master role is automatically assigned to the first domain controller installed in the forest root domain.
Question 2: A user reports they cannot log on from a branch office. The branch office has an RODC. The user's credentials are NOT in the Allowed RODC Password Replication Group. What happens when the user attempts to authenticate?
- Authentication fails immediately with an error
- The RODC forwards the authentication request to a writable DC over the WAN (Correct answer)
- The RODC uses a cached generic token to allow logon
- The RODC denies the logon and logs an event without contacting HQ
Correct answer: The RODC forwards the authentication request to a writable DC over the WAN
When a user's credentials are not cached on an RODC, the RODC proxies the authentication request to a writable DC; if the WAN is down, logon fails.
Question 3: Which DNS record type must be present for AD DS to function correctly, as it allows clients to locate domain controllers?
- A records only
- MX records
- SRV records (Correct answer)
- PTR records
Correct answer: SRV records
Active Directory relies on SRV records in DNS for clients to discover domain controllers, Kerberos services, and other AD DS services.
Question 4: You want to ensure that when a user object is deleted from one domain controller, that deletion replicates to all other DCs before any other changes to the same object. Which AD DS concept governs this?
- Conflict resolution using highest USN wins
- Strict replication consistency
- Tombstone and replication propagation
- Change notification with urgent replication (Correct answer)
Correct answer: Change notification with urgent replication
Certain changes, such as account lockouts and password changes, trigger urgent replication via change notification to ensure rapid propagation.
Question 5: An administrator needs to extend the AD schema to support a custom application. Which group membership is required to perform schema extensions?
- Domain Admins
- Enterprise Admins
- Schema Admins (Correct answer)
- Server Operators
Correct answer: Schema Admins
Only members of the Schema Admins group have permission to modify the Active Directory schema.
Question 6: You run 'repadmin /showrepl' and notice lingering objects warnings between two domain controllers. Which command removes lingering objects from a DC?
- repadmin /removelingeringobjects (Correct answer)
- ntdsutil metadata cleanup
- dcdiag /fix
- netdom reset
Correct answer: repadmin /removelingeringobjects
The 'repadmin /removelingeringobjects' command identifies and removes objects that should not exist on a DC due to replication gaps.
Question 7: You need to configure a trust so that users in your AD DS forest can authenticate to resources in a partner company's Kerberos V5 realm running on UNIX. Which trust type should you create?
- Forest trust
- External trust
- Realm trust (Correct answer)
- Shortcut trust
Correct answer: Realm trust
A realm trust connects an AD DS domain to a non-Windows Kerberos V5 realm, enabling cross-platform authentication.
MCTS 70-640 MCTS 70 640: Active Directory, Configuring 4
You are configuring a new AD DS forest.
Which server holds the Schema Master FSMO role by default?