QUESTION 411
You remotely monitor several domain controllers.
You run winrm.exe quickconfig on each domain controller.
You need to create a WMI script query to retrieve information from the bios of each domain controller.
Which format should you use to write the query?

A.    XrML
B.    XML
C.    WQL
D.    HTML

Answer: C
Explanation:
http://msdn.microsoft.com/en-us/library/windows/desktop/aa394606%28v=vs.85%29.aspx
WQL (SQL for WMI)
The WMI Query Language (WQL) is a subset of the American National Standards Institute Structured Query Language (ANSI SQL)–with minor semantic changes.

QUESTION 412
Your network contains an Active Directory domain named contoso.com.
The domain contains five domain controllers.
You add a logoff script to an existing Group Policy object (GPO).
You need to verify that each domain controller successfully replicates the updated group policy. Which two objects should you verify on each domain controller? (Each correct answer presents part of the solution. Choose two.)

A.    \\servername\SYSVOL\contoso.com\Policies\{GUID}\gpt.ini
B.    \\servername\SYSVOL\contoso.com\Policies\{GUID}\machine\registry.pol
C.    the uSNChanged value for the CN={GUID},CN=Policies,CN=System,DC=contoso,DC=com
container
D.    the versionNumber value for the CN={GUID},CN=Policies,CN=System,DC=contoso,DC=com
container

Answer: AD
Explanation:
http://technet.microsoft.com/en-us/library/cc784268%28v=ws.10%29.aspx

QUESTION 413
Your network contains an Active Directory domain that contains five domain controllers.
You have a management computer that runs Windows 7.
From the Windows 7 computer, you need to view all account logon failures that occur in the domain.
The information must be consolidated on one list.
Which command should you run on each domain controller?

A.    Wecutil.exe qc
B.    Wevtutil.exe gli
C.    Winrm.exe quickconfig
D.    Winrshost.exe

Answer: C
Explanation:
http://blogs.technet.com/b/jonjor/archive/2009/01/09/winrm-windows-remote-managementtroubleshooting.aspx

QUESTION 414
You create a new Active Directory domain.
The functional level of the domain is Windows Server 2008 R2.
The domain contains five domain controllers.
You need to monitor the replication of the group policy template files.
Which tool should you use?

A.    Dfsrdiag
B.    Fsutil
C.    Ntdsutil
D.    Ntfrsutl

Answer: A
Explanation:
With domain functional level 2008 you have available dfs-r sysvol replication.
So with DFL2008 you can use the DFSRDIAG tool.
It is not available with domain functional level 2003.
With domain functional level 2003 you can only use Ntfrsutl.

QUESTION 415
You have a domain controller named DC1 that runs Windows Server 2008 R2.
DC1 is configured as a DNS Server for contoso.com.
You install the DNS Server role on a member server named Server1 and then you create a standard secondary zone for contoso.com.
You configure DC1 as the master server for the zone.
You need to ensure that Server1 receives zone updates from DC1.
What should you do?

A.    On DC1, modify the permissions of contoso.com zone.
B.    On Server1, add a conditional forwarder.
C.    On DC1, modify the zone transfer settings for the contoso.com zone.
D.    Add the Server1 computer account to the DNSUpdateProxy group.

Answer: C

QUESTION 416
Your company has an Active Directory domain. All servers run Windows Server 2008 R2.
Your company runs an Enterprise Root certification authority (CA).
You need to ensure that only administrators can sign code.
Which two tasks should you perform? (Each correct answer presents part of the solution. Choose two.)

A.    Edit the local computer policy of the Enterprise Root CA to allow only administrators to
manage Trusted Publishers.
B.    Modify the security settings on the template to allow only administrators to request code
signing certificates.
C.    Edit the local computer policy of the Enterprise Root CA to allow users to trust peer
certificates and allow only administrators to apply the policy.
D.    Publish the code signing template.

Answer: BD
Explanation:
http://techblog.mirabito.net.au/?p=297

QUESTION 417
Your company has an Active Directory forest.
You plan to install an Enterprise certification authority (CA) on a dedicated stand-alone server. When you attempt to add the Active Directory Certificate Services (AD CS) role, you find that the Enterprise CA option is not available.
You need to install the AD CS role as an Enterprise CA.
What should you do first?

A.    Add the DNS Server role.
B.    Add the Active Directory Lightweight Directory Service (AD LDS) role.
C.    Add the Web server (IIS) role and the AD CS role.
D.    Join the server to the domain.

Answer: D
Explanation:
http://technet.microsoft.com/en-us/library/cc772393%28v=ws.10%29.aspx

QUESTION 418
Your company has an Active Directory domain.
A user attempts to log on to the domain from a client computer and receives the following message:
“This user account has expired. Ask your administrator to reactivate the account.”
 
You need to ensure that the user is able to log on to the domain.
What should you do?

A.    Modify the properties of the user account to set the account to never expire.
B.    Modify the properties of the user account to extend the Logon Hours setting.
C.    Modify the default domain policy to decrease the account lockout duration.
D.    Modify the properties of the user account to set the password to never expire.

Answer: A
Explanation:
 
http://technet.microsoft.com/en-us/library/dd145547.aspx
User Properties – Account Tab
Account expires
Sets the account expiration policy for this user.
You can select between the following options:
Use Never to specify that the selected account will never expire.
This option is the default for new users.
Select End of and then select a date if you want to have the user’s account expire on a specified date.

QUESTION 419
You have an existing Active Directory site named Site1.
You create a new Active Directory site and name it Site2.
You need to configure Active Directory replication between Site1 and Site2.
You install a new domain controller.
You create the site link between Site1 and Site2.
What should you do next?

A.    Use the Active Directory Sites and Services console to assign a new IP subnet to Site2.
Move the new domain controller object to Site2.
B.    Use the Active Directory Sites and Services console to configure a new site link bridge
object.
C.    Use the Active Directory Sites and Services console to decrease the site link cost between
Site1 and Site2.
D.    Use the Active Directory Sites and Services console to configure the new domain controller
as a preferred bridgehead server for Site1.

Answer: A
Explanation:
http://www.enterprisenetworkingplanet.com/netsysm/article.php/624411/Intersite-eplication.htm
Inter-site Replication

QUESTION 420
Your company has an Active Directory forest.
Each branch office has an organizational unit and a child organizational unit named Sales.
The Sales organizational unit contains all users and computers of the sales department.
You need to install an Office 2007 application only on the computers in the Sales organizational unit.
You create a GPO named SalesApp GPO.
What should you do next?

A.    Configure the GPO to assign the application to the computer account.
Link the SalesAPP GPO to the Sales organizational unit in each location.
B.    Configure the GPO to assign the application to the computer account.
Link the SalesAPP GPO to the domain.
C.    Configure the GPO to publish the application to the user account.
Link the SalesAPP GPO to the Sales organizational unit in each location.
D.    Configure the GPO to assign the application to the user account.
Link the SalesAPP GPO to the Sales organizational unit in each location.

Answer: A