TS: Windows Server 2008 Active Directory, Configuring (70-640) — Questions and Answers

Question 1: What happens to the Global Catalog when you raise the forest functional level to Windows Server 2003?

The GC is no longer needed for logon in native-mode domains
Universal Group Membership Caching becomes available (Correct answer)
The GC automatically caches all schema attributes
Linked-value replication compresses GC replication

Correct answer: Universal Group Membership Caching becomes available

At Windows Server 2003 forest functional level, Universal Group Membership Caching (UGMC) can be enabled on site-level DCs to avoid GC dependency for logon.

Question 2: Your organization requires that all Active Directory schema changes be communicated to the helpdesk team before implementation. Which AD role is responsible for controlling and communicating schema modifications?

RID Master
Schema Master (Correct answer)
Infrastructure Master
PDC Emulator

Correct answer: Schema Master

The Schema Master FSMO role holder is the only DC that can write changes to the AD schema, making it the central point for communicating schema change requests.

Question 3: In the AGDLP best-practice model for group nesting, what does the letter 'L' represent?

Level
Link
Domain Local group (Correct answer)
Limit

Correct answer: Domain Local group

AGDLP stands for Accounts → Global groups → Domain Local groups → Permissions; the 'L' represents Domain Local groups where resource permissions are assigned.

Question 4: What command verifies that a domain controller has registered its DNS SRV records correctly?

nslookup -type=SRV _ldap._tcp.<domain> (Correct answer)
netstat -an
ping <domain>
tracert <dc>

Correct answer: nslookup -type=SRV _ldap._tcp.<domain>

Using nslookup with the SRV type query against _ldap._tcp.<domain> confirms that the DC's LDAP SRV records are present and resolving.

Question 5: Which DNS record maps an IPv4 address back to a hostname in reverse lookup zones?

AAAA record
A record
PTR record (Correct answer)
CNAME record

Correct answer: PTR record

PTR (pointer) records exist in reverse lookup zones and map IP addresses to fully qualified domain names for reverse DNS resolution.

Question 6: During an AD audit, the auditor asks how inter-site replication latency is monitored. Which tool provides replication lag statistics between specific domain controllers?

Netlogon debug logging
Active Directory Sites and Services GUI only
Performance Monitor with AD counters
Repadmin /showrepl and Repadmin /replsummary (Correct answer)

Correct answer: Repadmin /showrepl and Repadmin /replsummary

Repadmin /showrepl displays replication status per DC pair, while /replsummary provides an aggregate view of replication health including failure counts and latency across the domain.

Question 7: What is the value of written documentation in MCTS 70-640 professional communication?

It replaces verbal communication
It creates permanent records, ensures clarity, and provides legal protection (Correct answer)
It is only for formal occasions
It is optional

Correct answer: It creates permanent records, ensures clarity, and provides legal protection

This is fundamental to MCTS 70-640 Exam practice. It creates permanent records, ensures clarity, and provides legal protection represents the professional standard for communication in the MCTS 70-640 certification framework.

Question 8: Which PowerShell cmdlet is used to create a new group object in Active Directory?

Add-ADGroup
Create-ADGroup
Set-ADGroup
New-ADGroup (Correct answer)

Correct answer: New-ADGroup

New-ADGroup is the correct PowerShell cmdlet for creating Active Directory group objects, following the standard Verb-ADNoun naming convention.

Question 9: Which domain controller hardening measure is recommended by Microsoft security baselines for Windows Server 2008 domain controllers?

Apply the appropriate Security Compliance Manager baseline, disable unnecessary services, and restrict local logon to domain admins only (Correct answer)
Install all server roles and features on each DC for maximum capability
Enable Remote Desktop for all IT staff with no additional restrictions
Place domain controllers in the workstations OU to inherit desktop GPOs

Correct answer: Apply the appropriate Security Compliance Manager baseline, disable unnecessary services, and restrict local logon to domain admins only

Applying a security baseline, minimizing installed roles, and restricting interactive logon reduces the attack surface of domain controllers, which are crown-jewel assets.

Question 10: When configuring DNS on a new Windows Server 2008 domain controller, which zone should be created to support AD DS?

An MX-only zone
A forward lookup zone for the AD domain (Correct answer)
A reverse lookup zone only
A secondary zone pointing to the PDC

Correct answer: A forward lookup zone for the AD domain

A forward lookup zone for the Active Directory domain name is essential so clients and DCs can resolve domain names to IP addresses and locate AD services.

Question 11: What is the purpose of 'Security Filtering' on a GPO link?

To restrict which users or computers a GPO applies to within the linked container (Correct answer)
To encrypt GPO contents
To scan GPO settings for security vulnerabilities
To block external GPO imports

Correct answer: To restrict which users or computers a GPO applies to within the linked container

Security Filtering controls which security principals (users, groups, computers) within the linked OU actually receive the GPO's settings.

Question 12: Which tool in Windows Server 2008 allows administrators to manually create connection objects and override the automatic replication topology?

Group Policy Management Console
Active Directory Sites and Services (Correct answer)
ADSIEdit
Active Directory Users and Computers

Correct answer: Active Directory Sites and Services

Active Directory Sites and Services (dssite.msc) is used to manage sites, subnets, site links, and manually create or delete connection objects between DCs.

Question 13: You need to create a zone in DNS that AD DS domain controllers will use for replication, and you want the zone to be replicated only to DCs in the same domain. Which replication scope should you choose?

All domain controllers in the Active Directory domain
All DNS servers in the Active Directory forest
All DNS servers in the Active Directory domain (Correct answer)
All domain controllers registered in the zone

Correct answer: All DNS servers in the Active Directory domain

Selecting 'All DNS servers in the Active Directory domain' stores the zone in the domain-wide DNS application partition, replicating only to DCs in that domain.

Question 14: What is a DNS delegation, and when is it used?

Transferring authority for a subdomain to a different set of DNS servers (Correct answer)
Caching root hints locally
Replicating a zone to a secondary server
Forwarding all external queries to an ISP DNS server

Correct answer: Transferring authority for a subdomain to a different set of DNS servers

A delegation passes authority for a child DNS zone to different name servers, allowing decentralized management of the DNS namespace.

Question 15: The helpdesk manager wants a report showing all disabled user accounts in the domain for quarterly review. Which PowerShell command produces this list most efficiently?

Get-ADUser -Filter {Enabled -eq $false} -Properties DisplayName
Search-ADAccount -AccountDisabled
Both A and C are correct (Correct answer)
Get-ADComputer -Filter * | Where Enabled -eq $false

Correct answer: Both A and C are correct

Both Get-ADUser with a filter for disabled accounts and Search-ADAccount -AccountDisabled return lists of disabled user accounts, giving administrators flexibility in reporting.

Question 16: How should MCTS 70-640 Exam professionals handle conflicts with stakeholders?

Ignore stakeholder concerns
Address issues professionally through active listening, finding common ground, and seeking resolution (Correct answer)
Escalate immediately to management
Avoid all conflict

Correct answer: Address issues professionally through active listening, finding common ground, and seeking resolution

This is fundamental to MCTS 70-640 Exam practice. Address issues professionally through active listening, finding common ground, and seeking resolution represents the professional standard for communication in the MCTS 70-640 certification framework.

Question 17: Which GPO setting overrides 'Block Inheritance' to force a policy to apply regardless?

No Override (Enforced) (Correct answer)
WMI Filtering
Loopback Processing
Security Filtering

Correct answer: No Override (Enforced)

Setting a GPO link to 'Enforced' (formerly No Override) prevents Block Inheritance from stopping that GPO from applying.

Question 18: Research into AD DS upgrade paths shows that when raising the domain functional level to Windows Server 2008, what new feature becomes available that was not present at the 2003 level?

Read-Only Domain Controllers
Universal Group Membership Caching
Fine-Grained Password Policies
Distributed File System Replication (DFSR) for SYSVOL (Correct answer)

Correct answer: Distributed File System Replication (DFSR) for SYSVOL

At Windows Server 2008 domain functional level, SYSVOL replication can be migrated from FRS to the more reliable DFSR mechanism.

Question 19: What is the purpose of a 'child domain' in an Active Directory forest?

To store additional FSMO roles outside the root domain
To create a completely separate forest with its own schema
To create a subdomain that shares the forest schema but has its own domain partition (Correct answer)
To host a Global Catalog without replication overhead

Correct answer: To create a subdomain that shares the forest schema but has its own domain partition

A child domain is a subdomain of a parent domain within the same forest, inheriting the forest schema and configuration but maintaining its own domain partition and domain-level FSMO roles.

Question 20: Which attribute must be unique within an Active Directory forest and is required for user logon?

User Principal Name (UPN) (Correct answer)
Display Name
Description
Office Location

Correct answer: User Principal Name (UPN)

The User Principal Name (UPN) must be unique across the entire forest and serves as the primary logon identifier in the format user@domain.

Question 21: An administrator is deploying an Enterprise CA using AD Certificate Services. What is a prerequisite for installing an Enterprise CA?

The server must be joined to a workgroup
Internet Information Services must be disabled
Active Directory Domain Services must be installed and accessible (Correct answer)
A standalone CA must be installed first

Correct answer: Active Directory Domain Services must be installed and accessible

An Enterprise CA requires access to AD DS to publish certificates and CRLs to the directory.

Question 22: Fabrikam wants to block a specific GPO setting from applying to one computer in an OU without moving the computer or using a new OU. What is the correct approach?

Configure a WMI filter targeting the computer's hostname
Enable Block Policy Inheritance on the computer object
Set the GPO link to Disabled for that computer only
Apply a security filter denying Apply Group Policy to that computer's account (Correct answer)

Correct answer: Apply a security filter denying Apply Group Policy to that computer's account

Denying Apply Group Policy permission to a specific computer account via security filtering prevents the GPO from applying to that computer.

Question 23: Which ADMX file provides Group Policy administrative template settings for Internet Explorer?

system.admx
inetres.admx (Correct answer)
windowsexplorer.admx
networkconnections.admx

Correct answer: inetres.admx

inetres.admx is the ADMX template file that provides Internet Explorer Group Policy settings for administrative templates.

Question 24: An administrator wants to prevent a specific GPO from applying to one security group in an OU while still applying to others. What should be used?

Set the GPO to Enforced
Block Inheritance on the OU
Deny Apply Group Policy permission for that security group (Correct answer)
Move users to a separate OU

Correct answer: Deny Apply Group Policy permission for that security group

Denying the 'Apply Group Policy' permission for a security group prevents that GPO from affecting group members.

Question 25: Which Windows Server 2008 DNS feature enables name resolution for clients that query for short (single-label) names?

Stub zone
Secondary zone
GlobalNames zone (Correct answer)
Reverse lookup zone

Correct answer: GlobalNames zone

The GlobalNames zone allows administrators to publish single-label DNS names without relying on WINS, supporting legacy application name resolution.

Question 26: You need to configure a trust so that users in your AD DS forest can authenticate to resources in a partner company's Kerberos V5 realm running on UNIX. Which trust type should you create?

Shortcut trust
External trust
Forest trust
Realm trust (Correct answer)

Correct answer: Realm trust

A realm trust connects an AD DS domain to a non-Windows Kerberos V5 realm, enabling cross-platform authentication.

Question 27: What does the DNS TTL value control?

The maximum number of DNS queries per second
The replication interval between AD-integrated DNS zones
How long a zone transfer takes
How long a resolver caches a DNS record before requesting a fresh copy (Correct answer)

Correct answer: How long a resolver caches a DNS record before requesting a fresh copy

TTL (Time to Live) specifies in seconds how long a DNS record can be cached by resolvers before they must query the authoritative server again.

Question 28: What is WMI filtering in Group Policy used for?

Applying a GPO only to computers or users that meet specific WMI query criteria (Correct answer)
Controlling replication of GPOs between sites
Filtering DNS queries through a GPO
Restricting who can edit a GPO

Correct answer: Applying a GPO only to computers or users that meet specific WMI query criteria

WMI filters evaluate a WMI query against a target machine, and the GPO only applies if the query returns true, enabling hardware- or OS-based targeting.

Question 29: What is the purpose of a Windows Installer Transform file (.mst) when deploying software via Group Policy?

It customizes the installation settings of an .msi package without modifying the original file (Correct answer)
It signs the .msi package with a digital certificate for integrity verification
It replaces the original .msi package with a patched version
It converts the .msi package to a .zap format for non-MSI deployment

Correct answer: It customizes the installation settings of an .msi package without modifying the original file

An .mst transform file modifies the properties of an MSI installation (such as features, paths, or settings) while leaving the original package unchanged.

Question 30: What does the 'Block Inheritance' option on an OU do?

Blocks all security settings from being applied
Disables all GPOs in the domain
Prevents child OUs from inheriting GPOs from the blocked OU
Prevents GPOs from a parent container from applying to the OU (Correct answer)

Correct answer: Prevents GPOs from a parent container from applying to the OU

Block Inheritance stops GPOs linked at parent containers (domain or higher-level OUs) from flowing down to the OU where it is set.

Question 31: A stakeholder requests confirmation that all domain controllers are communicating properly after a network change. Which command-line tool provides a comprehensive DC health and connectivity report?

Ipconfig /all
Netstat -an
Ping /a
Dcdiag /test:replications /v (Correct answer)

Correct answer: Dcdiag /test:replications /v

Dcdiag with the replications test and verbose switch performs comprehensive AD replication health checks and outputs a detailed report suitable for stakeholder review.

Question 32: There is an Active Directory domain for your business. The following warning appears when a user attempts to log on to the domain from a client computer: "This user account has expired. Ask your administrator to reactivate the account." <br> You must guarantee that the user can access the domain. <br> What ought you to do?

Modify the properties of the user account to extend the Logon Hours setting.
Modify the properties of the user account to set the account to never expire. (Correct answer)
Modify the default domain policy to decrease the account lockout duration.
Modify the properties of the user account to set the password to never expire.

Correct answer: Modify the properties of the user account to set the account to never expire.

The error message 'This user account has expired' directly indicates that the user account in Active Directory has reached its configured expiration date. To resolve this, the administrator must modify the user account properties. This involves either setting a new expiration date or configuring the account to 'never expire,' allowing the user to log on again.

Question 33: A project manager asks you to document which users have access to a specific shared resource in AD. Which tool best generates this access report for stakeholder review?

Active Directory Administrative Center with dynamic access control reporting (Correct answer)
Dcdiag.exe
Nltest.exe
Netdom.exe

Correct answer: Active Directory Administrative Center with dynamic access control reporting

Active Directory Administrative Center with Dynamic Access Control provides access and permission reporting that can be shared with project managers and auditors.

Question 34: Which command-line tool forces an immediate Group Policy refresh on a Windows Server 2008 machine?

dcgpofix /force
secedit /refreshpolicy
gpupdate /force (Correct answer)
gpresult /r

Correct answer: gpupdate /force

Running 'gpupdate /force' immediately reapplies all Group Policy settings, reprocessing even those that have not changed.

Question 35: How does Active Directory Lightweight Directory Services (AD LDS) differ from AD DS?

AD LDS uses a different replication topology than AD DS but shares the same schema
AD LDS stores user credentials for domain logon, while AD DS does not
AD LDS provides a directory service without requiring a Windows domain or forest (Correct answer)
AD LDS requires a domain controller, while AD DS does not

Correct answer: AD LDS provides a directory service without requiring a Windows domain or forest

AD LDS is an LDAP directory service that runs as an application service without the domain, forest, or Kerberos infrastructure required by AD DS.

Question 36: What is the primary function of the 'Manager' attribute on an Active Directory user object?

Automatically adds the user to the manager's department group
Stores an informational reference enabling the Direct Reports list (Correct answer)
Automatically grants the manager admin rights over the user
Sets the manager as the user's Group Policy owner

Correct answer: Stores an informational reference enabling the Direct Reports list

The Manager attribute is informational, linking a user to their manager's AD account and enabling the Direct Reports view in tools like Outlook and the Address Book.

Question 37: What is the most effective communication approach for MCTS 70-640 professionals?

Using technical language exclusively
Minimizing all communications
Adapting communication style to the audience while maintaining accuracy and clarity (Correct answer)
Only written communication

Correct answer: Adapting communication style to the audience while maintaining accuracy and clarity

This is fundamental to MCTS 70-640 Exam practice. Adapting communication style to the audience while maintaining accuracy and clarity represents the professional standard for communication in the MCTS 70-640 certification framework.

Question 38: Which command-line tool is specifically designed to import and export Active Directory objects using CSV-formatted files?

NTDSUTIL
LDIFDE
DSADD
CSVDE (Correct answer)

Correct answer: CSVDE

CSVDE is used to import and export Active Directory objects using comma-separated value (CSV) files, making bulk account creation efficient.

Question 39: The Active Directory Recycle Bin feature in Windows Server 2008 R2 requires what forest functional level to enable?

Windows Server 2008
Windows Server 2003
Windows 2000 native
Windows Server 2008 R2 (Correct answer)

Correct answer: Windows Server 2008 R2

The AD Recycle Bin requires the forest functional level to be raised to Windows Server 2008 R2 or higher before it can be enabled.

Question 40: An administrator wants users to automatically receive computer certificates without any manual request process. Which Group Policy setting should be configured?

Public Key Policies – Autoenrollment Settings (Correct answer)
Account Policies – Kerberos Policy
Software Restriction Policies
Certificate Services Client – Certificate Enrollment Policy

Correct answer: Public Key Policies – Autoenrollment Settings

The Autoenrollment Settings policy under Public Key Policies automates certificate enrollment and renewal for users and computers.

Question 41: An auditor needs to verify that only authorized administrators have rights to link GPOs to the domain root. Where are these delegation settings reviewed and documented?

Secedit /export /cfg report.txt
Active Directory Users and Computers > Domain Properties > Security tab
Group Policy Management Console > Domain > Delegation tab (Correct answer)
Auditpol /get /subcategory:'Policy Change'

Correct answer: Group Policy Management Console > Domain > Delegation tab

The Delegation tab on the domain object in GPMC shows which users and groups have permission to link GPOs, providing the auditor with the authorization documentation they require.

Question 42: In which SYSVOL subfolder are GPO templates stored on a domain controller?

SYSVOL\domain\Users
SYSVOL\domain\Policies (Correct answer)
SYSVOL\domain\GPTemplates
SYSVOL\domain\Scripts

Correct answer: SYSVOL\domain\Policies

Each GPO's template files (ADM/ADMX files and settings) are stored in SYSVOL\domain\Policies\{GPO-GUID}\ on every domain controller.

Question 43: What is a conditional forwarder in DNS?

A forwarder that only works during business hours
A DNS server that forwards queries for a specific domain to designated servers (Correct answer)
A forwarder that strips DNSSEC signatures
A secondary zone that forwards updates to the primary

Correct answer: A DNS server that forwards queries for a specific domain to designated servers

A conditional forwarder directs queries for a specific DNS namespace to particular DNS servers instead of using the standard forwarder.

Question 44: A security team wants to prevent brute-force attacks on domain accounts. Which Group Policy settings should they configure?

Account lockout threshold and account lockout duration (Correct answer)
Enforce password history and maximum password age
Interactive logon message and smart card requirement
Minimum password length and password complexity

Correct answer: Account lockout threshold and account lockout duration

Account lockout threshold defines how many failed attempts lock an account, and account lockout duration defines how long the lockout lasts.

Question 45: An administrator needs to test whether Group Policy is being applied immediately after a policy change. Which command forces an immediate refresh of Group Policy on a client?

gpupdate /force (Correct answer)
gpresult /r
net group policy /refresh
secedit /refreshpolicy

Correct answer: gpupdate /force

gpupdate /force immediately reapplies all Group Policy settings regardless of whether they have changed.

Question 46: A company must comply with PCI-DSS and needs to enforce distinct password complexity requirements for different user groups. What Windows Server 2008 feature best supports this?

Local Security Policy on individual workstations
Group Policy Preferences targeting specific OUs
Default Domain Password Policy applied to all users
Fine-Grained Password Policies (Password Settings Objects) applied to global security groups (Correct answer)

Correct answer: Fine-Grained Password Policies (Password Settings Objects) applied to global security groups

Fine-Grained Password Policies allow distinct password and lockout settings to be applied at the group or user level, independent of the domain-wide policy.

Question 47: A department head wants to know which computers in their OU have not logged into the domain in over 90 days, for an asset review report. Which command identifies these stale computer accounts?

Get-ADComputer -Filter {LastLogonDate -lt (Get-Date).AddDays(-90)}
Dsquery computer -inactive 13
All of the above are valid approaches (Correct answer)
Search-ADAccount -ComputersOnly -AccountInactive -TimeSpan 90.00:00:00

Correct answer: All of the above are valid approaches

PowerShell Get-ADComputer with a LastLogonDate filter, Dsquery with the -inactive flag (weeks), and Search-ADAccount with -AccountInactive all identify stale computer accounts for asset reporting.

Question 48: According to best practices, where should the PDC Emulator FSMO role be placed in a multi-site environment?

On a domain controller in the hub site with the best connectivity to all other sites (Correct answer)
On a domain controller in the smallest branch site
On a read-only domain controller in the largest site
Distributed randomly across multiple domain controllers

Correct answer: On a domain controller in the hub site with the best connectivity to all other sites

The PDC Emulator handles time synchronization, password changes, and account lockouts, making it critical that it resides in a well-connected, central hub site.

Question 49: An administrator needs to ensure that the Password Replication Policy (PRP) on an RODC allows a specific user's credentials to be cached. Which tool should be used to add the user to the Allowed RODC Password Replication Group?

Ntdsutil
Active Directory Users and Computers (Correct answer)
Repadmin
Active Directory Sites and Services

Correct answer: Active Directory Users and Computers

Active Directory Users and Computers is used to manage the Allowed RODC Password Replication Group membership on an RODC object.

Question 50: Which DNS feature prevents clients from receiving stale cached records by enforcing a maximum record age?

Scavenging (Correct answer)
Dynamic updates
Conditional forwarding
Forwarders

Correct answer: Scavenging

DNS scavenging removes stale resource records based on configurable no-refresh and refresh intervals to keep the zone clean.

Question 51: Which DNS zone type automatically replicates zone data to all DNS servers running on domain controllers in the forest?

Standard secondary zone
Active Directory-integrated zone with ForestDNSZones scope (Correct answer)
Standard primary zone
Active Directory-integrated zone with DomainDNSZones scope

Correct answer: Active Directory-integrated zone with ForestDNSZones scope

Forest-wide AD-integrated zones replicate through the ForestDNSZones application partition to all DNS-enabled DCs across the entire forest.

Question 52: Which Group Policy section contains settings like Account Lockout Policy and Password Policy?

Computer Configuration → Administrative Templates → Network
User Configuration → Administrative Templates → System
Computer Configuration → Windows Settings → Security Settings → Account Policies (Correct answer)
User Configuration → Windows Settings → Scripts

Correct answer: Computer Configuration → Windows Settings → Security Settings → Account Policies

Account Policies including Password Policy and Account Lockout Policy are found under Computer Configuration → Windows Settings → Security Settings → Account Policies.

Question 53: For FISMA compliance, all AD objects must have their changes tracked. Which audit policy must be enabled to log changes to AD object attributes?

Audit System Events
Audit Directory Service Changes (Correct answer)
Audit Object Access
Audit Account Logon Events

Correct answer: Audit Directory Service Changes

Audit Directory Service Changes logs when attributes of AD objects are modified, created, moved, or deleted, meeting FISMA change-tracking requirements.

Question 54: What must occur before you can convert a Universal security group to a Global group?

Remove all members from other domains (Correct answer)
Raise the domain functional level
Convert it to a Distribution group first
Remove all nested Universal groups

Correct answer: Remove all members from other domains

Global groups can only contain members from their own domain, so any cross-domain members must be removed before converting a Universal group to Global.

Question 55: When you run dcpromo with the /adv switch, what additional capability does it provide?

Installs AD DS silently without prompts
Enables read-only DC installation
Allows installing from media (IFM) to reduce replication traffic (Correct answer)
Forces demotion of a domain controller

Correct answer: Allows installing from media (IFM) to reduce replication traffic

The /adv (advanced) switch enables the Install from Media (IFM) option, letting you use a backup to seed AD DS and minimize replication during promotion.

Question 56: Which file format does the LDIFDE tool use when importing or exporting Active Directory objects?

CSV (Comma-Separated Values)
XML (Extensible Markup Language)
INI (Initialization File)
LDIF (LDAP Data Interchange Format) (Correct answer)

Correct answer: LDIF (LDAP Data Interchange Format)

LDIFDE uses the LDAP Data Interchange Format (LDIF), a standard text format for representing directory entries that supports complex operations like adds, modifies, and deletes.

Question 57: Which command-line tool lets you interactively query DNS records and troubleshoot name resolution problems?

nslookup (Correct answer)
dnscmd
netsh dns
ipconfig

Correct answer: nslookup

nslookup is the primary interactive command-line utility for querying DNS servers and diagnosing DNS resolution issues.

Question 58: By establishing numerous entries with various IP addresses for the same resource, DNS servers can be set up to offer high availability. The name of this is?

Round robin (Correct answer)
IP balancing
Hyper-v
Load balancing

Correct answer: Round robin

Round robin is a DNS load balancing technique that provides high availability by distributing client requests among multiple servers. When a DNS server receives a query for a resource configured with multiple IP addresses, it cycles through these addresses in a rotating fashion. This method ensures that traffic is spread across different servers, preventing any single server from becoming a bottleneck and improving overall service availability.

Question 59: Under GLBA compliance, your organization must encrypt all data on mobile devices. Which Windows Server 2008 feature, managed through AD, enforces BitLocker encryption on domain-joined laptops?

BitLocker Drive Encryption GPO settings (Correct answer)
EFS with domain recovery agent
BitLocker Network Unlock
Windows Defender policy enforcement

Correct answer: BitLocker Drive Encryption GPO settings

Group Policy BitLocker Drive Encryption settings can require BitLocker on fixed and removable drives, enforcing encryption compliance on domain-joined machines.

Question 60: A help desk technician at Blue Yonder Airlines accidentally deleted 200 user accounts. The forest functional level is Windows Server 2008 R2 and the AD Recycle Bin is enabled. What is the fastest recovery method?

Re-create all user accounts manually from HR records
Perform an authoritative restore using NTDSUTIL
Use Get-ADObject with -IncludeDeletedObjects and Restore-ADObject (Correct answer)
Restore from the most recent System State backup

Correct answer: Use Get-ADObject with -IncludeDeletedObjects and Restore-ADObject

With the AD Recycle Bin enabled, deleted objects can be restored via PowerShell using Restore-ADObject without any backup or DC restart.

Question 61: An IT director wants a report comparing GPO settings across two organizational units to ensure consistent policy application. Which tool facilitates this comparison for stakeholder review?

Group Policy Management Console (GPMC) with GPO comparison or Resultant Set of Policy reporting (Correct answer)
Auditpol /get /category:*
Netdom query workstation
Secedit /analyze

Correct answer: Group Policy Management Console (GPMC) with GPO comparison or Resultant Set of Policy reporting

The GPMC supports comparing GPO settings and generating Resultant Set of Policy reports for different OUs, making it ideal for communicating policy consistency to IT directors.

Question 62: Your security team needs to receive email alerts whenever a privileged group membership changes in Active Directory. Which solution best automates this notification?

Enabling SNMP on all domain controllers
Configuring audit policies and using Windows Event Log subscriptions with a SMTP-capable alerting tool (Correct answer)
Scheduled Netdom queries
Manually reviewing ADUC weekly

Correct answer: Configuring audit policies and using Windows Event Log subscriptions with a SMTP-capable alerting tool

Combining audit policies for group membership changes with event log forwarding and an SMTP alerting tool provides automated, real-time notification to the security team.

Question 63: Southridge Video needs to ensure that a GPO applying desktop wallpaper cannot be overridden by GPOs linked at lower levels. What setting should be configured on that GPO link?

Block Policy Inheritance
Loopback Processing in Replace mode
Enforced (No Override) (Correct answer)
Link Order priority set to 1

Correct answer: Enforced (No Override)

Setting a GPO link to Enforced (formerly No Override) prevents child OU GPOs or Block Inheritance from overriding it.

Question 64: The network operations team needs to understand which AD sites are using which site link bridges for replication path calculations. Where is this configuration visible for documentation purposes?

Repadmin /showsitecosts
Active Directory Users and Computers > Sites container
Netdom query site
Active Directory Sites and Services > Inter-Site Transports > IP or SMTP (Correct answer)

Correct answer: Active Directory Sites and Services > Inter-Site Transports > IP or SMTP

Active Directory Sites and Services under Inter-Site Transports shows IP and SMTP site links and site link bridges, providing the topology documentation needed by the network operations team.

Question 65: You need to ensure that a specific OU and all objects within it are protected from accidental deletion. Which option in Active Directory Users and Computers should be enabled on the OU?

Set Deny Delete on the DACL for Domain Users
Enable the AdminSDHolder protection
Block Policy Inheritance
Enable the Protect object from accidental deletion checkbox on the Object tab (Correct answer)

Correct answer: Enable the Protect object from accidental deletion checkbox on the Object tab

Checking 'Protect object from accidental deletion' on the Object tab of the OU adds an ACE that prevents deletion by standard admin operations.

Question 66: Tailspin Toys has a universal group containing users from multiple domains. When a user is added to the group, global catalog replication traffic spikes. What can reduce this replication overhead?

Use domain local groups to nest users and add the domain local group to the universal group (Correct answer)
Enable Universal Group Membership Caching in each site
Reduce the replication interval on all site links
Convert the universal group to a domain local group

Correct answer: Use domain local groups to nest users and add the domain local group to the universal group

Nesting domain local groups (which don't replicate to the GC) inside the universal group means individual member changes don't trigger GC replication.

TS: Windows Server 2008 Active Directory, Configuring (70-640)

The MCTS 70-640 exam validates skills in configuring Windows Server 2008 Active Directory, covering DNS integration, AD infrastructure, directory objects, additional server roles, and environment maintenance. It is part of the Microsoft Certified Technology Specialist (MCTS) track.

Questions

180 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds