MCTS 70-640 MCTS 70 640: Active Directory, Configuring 5 — Questions and Answers
Question 1: You need to ensure that a specific OU and all objects within it are protected from accidental deletion. Which option in Active Directory Users and Computers should be enabled on the OU?
- Block Policy Inheritance
- Enable the Protect object from accidental deletion checkbox on the Object tab (Correct answer)
- Set Deny Delete on the DACL for Domain Users
- Enable the AdminSDHolder protection
Correct answer: Enable the Protect object from accidental deletion checkbox on the Object tab
Checking 'Protect object from accidental deletion' on the Object tab of the OU adds an ACE that prevents deletion by standard admin operations.
Question 2: Global Catalog servers store a partial replica of all objects in the forest. Which scenario requires a Global Catalog server to be available for user logon to succeed?
- Logging on with a pre-Windows 2000 username in a single-domain forest
- Logging on with a UPN when Universal Group Membership Caching is not configured (Correct answer)
- Logging on to a workgroup computer joined to a domain
- Logging on with a sAMAccountName in a single-domain forest
Correct answer: Logging on with a UPN when Universal Group Membership Caching is not configured
When a user logs on with a UPN in a multi-domain environment and UGMC is not enabled, a GC must be contacted to resolve universal group memberships.
Question 3: You need to create a zone in DNS that AD DS domain controllers will use for replication, and you want the zone to be replicated only to DCs in the same domain. Which replication scope should you choose?
- All DNS servers in the Active Directory forest
- All DNS servers in the Active Directory domain (Correct answer)
- All domain controllers in the Active Directory domain
- All domain controllers registered in the zone
Correct answer: All DNS servers in the Active Directory domain
Selecting 'All DNS servers in the Active Directory domain' stores the zone in the domain-wide DNS application partition, replicating only to DCs in that domain.
Question 4: After promoting a new DC, you notice that repadmin /replsummary shows replication errors from the new DC to others. Which tool should you run first to diagnose overall DC health?
- netdom verify
- dcdiag /test:replications (Correct answer)
- nslookup
- nltest /dsgetdc
Correct answer: dcdiag /test:replications
Dcdiag /test:replications runs the replication-specific diagnostic tests on a DC and reports errors that indicate the root cause.
Question 5: You are configuring Universal Group Membership Caching (UGMC) for a remote site that has no Global Catalog server. Where is UGMC configured?
- On each domain controller in the site via the registry
- In Active Directory Sites and Services on the NTDS Site Settings object (Correct answer)
- In the Default Domain Policy GPO
- In Active Directory Users and Computers under the site container
Correct answer: In Active Directory Sites and Services on the NTDS Site Settings object
UGMC is enabled on the NTDS Site Settings object for a site in Active Directory Sites and Services, applying to all DCs in that site.
Question 6: A junior administrator accidentally ran 'dcpromo /forceremoval' on an active DC without properly demoting it. What is the immediate next step to clean up the AD DS environment?
- Run dcdiag on remaining DCs
- Perform metadata cleanup using ntdsutil (Correct answer)
- Seize all FSMO roles to another DC
- Rebuild the DC from a backup
Correct answer: Perform metadata cleanup using ntdsutil
Force removal leaves the DC's metadata in AD DS; ntdsutil metadata cleanup must be run to remove the stale DC object and associated records.
Question 7: You need to configure an audit policy so that all successful and failed logon attempts are recorded in the Security event log on domain controllers. Which audit policy category should you enable?
- Audit Object Access
- Audit Account Logon Events (Correct answer)
- Audit Logon Events
- Audit Account Management
Correct answer: Audit Account Logon Events
Audit Account Logon Events records authentication events (Kerberos ticket requests) on domain controllers where the accounts are validated.
MCTS 70-640 MCTS 70 640: Active Directory, Configuring 5
You need to ensure that a specific OU and all objects within it are protected from accidental deletion.
Which option in Active Directory Users and Computers should be enabled on the OU?