QUESTION 241
Your network contains an Active Directory domain.
A user named User1 takes a leave of absence for one year.
You need to restrict access to the User1 user account while User1 is away.
What should you do?

A.    From the Default Domain Policy, modify the account lockout settings.
B.    From the Default Domain Controller Policy, modify the account lockout settings.
C.    From the properties of the user account, modify the Account options.
D.    From the properties of the user account, modify the Session settings.

Answer: C
Explanation:
Account lockout settings deal with logon security, like how many times a wrong password can be entered before an account gets locked out, or after how many minutes a locked out user can try again.
To really restrict access to the User1 account it has to be disabled, by modifying the account options.
http://blogs.technet.com/b/msonline/archive/2009/08/17/disabling-and-deleting-user-accounts.aspx
Disabling a user account prevents user access to e-mail and Microsoft SharePoint Online data, but retains the user's data. Disabling a user account also keeps the user license associated with that account. This is the best option to utilize when a person leaves an organization temporarily.

QUESTION 242
Your network contains an Active Directory domain.
The domain contains 1,000 user accounts.
You have a list that contains the mobile phone number of each user.
You need to add the mobile number of each user to Active Directory.
What should you do?

A.    Create a file that contains the mobile phone numbers, and then run ldifde.exe.
B.    Create a file that contains the mobile phone numbers, and then run csvde.exe.
C.    From Adsiedit, select the CN=Users container, and then modify the properties of the
container.
D.    From Active Directory Users and Computers, select all of the users, and then modify the
properties of the users.

Answer: A
Explanation:
CSVDE can only import and export data from AD DS.
http://technet.microsoft.com/en-us/library/cc732101.aspx
http://technet.microsoft.com/en-us/library/cc731033.aspx

QUESTION 243
Your network contains an Active Directory domain named contoso.com.
All domain controllers and member servers run Windows Server 2008.
All client computers run Windows 7.
From a client computer, you create an audit policy by using the Advanced Audit Policy Configuration settings in the Default Domain Policy Group Policy object (GPO).
You discover that the audit policy is not applied to the member servers.
The audit policy is applied to the client computers.
You need to ensure that the audit policy is applied to all member servers and all client computers. What should you do?

A.    Add a WMI filter to the Default Domain Policy GPO.
B.    Modify the security settings of the Default Domain Policy GPO.
C.    Configure a startup script that runs auditpol.exe on the member servers.
D.    Configure a startup script that runs auditpol.exe on the domain controllers.

Answer: C

QUESTION 244
Your company uses an application that stores data in an Active Directory Lightweight Directory Services (AD LDS) instance named Instance1.
You attempt to create a snapshot of Instance1 as shown in the exhibit. (Click the Exhibit button.)
You need to ensure that you can take a snapshot of Instance1.
What should you do?
 

A.    At the command prompt, run net start VSS.
B.    At the command prompt, run net start Instance1.
C.    Set the Startup Type for the Instance1 service to Disabled.
D.    Set the Startup Type for the Volume Shadow Copy Service (VSS) to Manual.

Answer: A
Explanation:
Hard to find references on this, but the solution can be found by eliminating the rest.
Instance1 is running, otherwise you'd get a different message at the snaphot: create step.
("AD service must be running in order to perform this operation", on my virtual server.)
Disabling Instance1 makes no sense because you need it, nor is setting the Startup Type for the Volume Shadow Copy Service (VSS) to Manual.

QUESTION 245
Your network contains an Active Directory domain.
The domain contains a group named Group1.
The minimum password length for the domain is set to six characters.
You need to ensure that the passwords for all users in Group1 are at least 10 characters long.
All other users must be able to use passwords that are six characters long.
What should you do first?

A.    Run the New-ADFineGrainedPasswordPolicy cmdlet.
B.    Run the Add-ADFineGrainedPasswordPolicySubject cmdlet.
C.    From the Default Domain Policy, modify the password policy.
D.    From the Default Domain Controller Policy, modify the password policy.

Answer: A
Explanation:
First we need to create a new Active Directory fine grained password policy, using New-ADFineGrainedPasswordPolicy.
Then we can apply the new policy to Group1, using Add-ADFineGrainedPasswordPolicySubject.
http://technet.microsoft.com/en-us/library/ee617238.aspx
New-ADFineGrainedPasswordPolicy
Creates a new Active Directory fine grained password policy.

QUESTION 246
Your network contains 10 domain controllers that run Windows Server 2008 R2.
The network contains a member server that is configured to collect all of the events that occur on the domain controllers.
You need to ensure that administrators are notified when a specific event occurs on any of the domain controllers.
You want to achieve this goal by using the minimum amount of administrative effort.
What should you do?

A.    From Event Viewer on the member server, create a subscription.
B.    From Event Viewer on each domain controller, create a subscription.
C.    From Event Viewer on the member server, run the Create Basic Task Wizard.
D.    From Event Viewer on each domain controller, run the Create Basic Task Wizard.

Answer: C
Explanation:
Since the member server is collecting all domain controller events we just need to run the Create Basic Task Wizard on the member server, which enables us to send an e-mail when a specific event is logged. Running the wizard on every domain controller would work, but is much more work and we need to use the minimum amount of administrative effort.
http://technet.microsoft.com/en-us/library/cc748900.aspx

QUESTION 247
Your network contains an Active Directory domain controller named DC1.
DC1 runs Windows Server 2008 R2.
You need to defragment the Active Directory database on DC1.
The solution must minimize downtime on DC1.
What should you do first?

A.    At the command prompt, run net stop ntds.
B.    At the command prompt, run net stop netlogon.
C.    Restart DC1 in Safe Mode.
D.    Restart DC1 in Directory Services Restore Mode (DSRM).

Answer: A
Explanation:
We don't need to restart the server to defragment the AD database.
We only need to stop AD DS in order to defragment the database, using ntdsutil.
http://technet.microsoft.com/en-us/library/cc794920.aspx

QUESTION 248
Your network contains a single Active Directory domain named contoso.com.
An administrator accidentally deletes the _msdsc.contoso.com zone.
You recreate the _msdsc.contoso.com zone.
You need to ensure that the _msdsc.contoso.com zone contains all of the required DNS records.
What should you do on each domain controller?

A.    Restart the Netlogon service.
B.    Restart the DNS Server service.
C.    Run dcdiag.exe /fix.
D.    Run ipconfig.exe /registerdns.

Answer: A
Explanation:
http://support.microsoft.com/kb/817470

QUESTION 249
Your network contains an Active Directory-integrated zone.
All DNS servers that host the zone are domain controllers.
You add multiple DNS records to the zone.
You need to ensure that the records are replicated to all DNS servers.
Which tool should you use?

A.    Dnslint
B.    Ldp
C.    Nslookup
D.    Repadmin

Answer: D
Explanation:
To make sure that the new DNS records are replicated to all DNS servers we can use the repadmin tool.
http://technet.microsoft.com/en-us/library/cc811569.aspx

QUESTION 250
Your network contains an Active Directory forest.
The forest contains two domains named contoso.com and eu.contoso.com.
All domain controllers are DNS servers.
The domain controllers in contoso.com host the zone for contoso.com.
The domain controllers in eu.contoso.com host the zone for eu.contoso.com.
The DNS zone for contoso.com is configured as shown in the exhibit. (Click the Exhibit button.)
You need to ensure that all domain controllers in the forest host a writable copy of _msdsc.contoso.com.
Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)
 

A.    Create a zone delegation record in the contoso.com zone.
B.    Create a zone delegation record in the eu.contoso.com zone.
C.    Create an Active Directory-integrated zone for _msdsc.contoso.com.
D.    Create a secondary zone named _msdsc.contoso.com in eu.contoso.com.

Answer: AC
Explanation:
Note that the question speaks of _msdSC, instead of _msdCS. Not sure if it means something, probably a typo.