QUESTION 401
You have an enterprise root certification authority (CA) that runs Windows Server 2008 R2.
You need to ensure that you can recover the private key of a certificate issued to a Web server.
What should you do?

A.    From the CA, run the Get-PfxCertificate cmdlet.
B.    From the Web server, run the Get-PfxCertificate cmdlet.
C.    From the CA, run the certutil.exe tool and specify the -exportpfx parameter.
D.    From the Web server, run the certutil.exe tool and specify the -exportpfx parameter.

Answer: D
Explanation:
http://technet.microsoft.com/en-us/library/ee449471%28v=ws.10%29.aspx

QUESTION 402
Your company has a main office and a branch office.
The network contains a single Active Directory domain.
The main office contains a domain controller named DC1.
You need to install a domain controller in the branch office by using an offline copy of the Active Directory database.
What should you do first?

A.    From the Ntdsutil tool, create an IFM media set.
B.    From the command prompt, run djoin.exe /loadfile.
C.    From Windows Server Backup, perform a system state backup.
D.    From Windows PowerShell, run the get-ADDomainController cmdlet.

Answer: A
Explanation:
http://technet.microsoft.com/en-us/library/cc816722%28v=ws.10%29.aspx
Installing an Additional Domain Controller by Using IFM
When you install Active Directory Domain Services (AD DS) by using the install from media (IFM) method, you can reduce the replication traffic that is initiated during the installation of an additional domain controller in an Active Directory domain. Reducing the replication traffic reduces the time that is necessary to install the additional domain controller.
Windows Server 2008 and Windows Server 2008 R2 include an improved version of the Ntdsutil tool that you can use to create installation media for an additional domain controller. You can use Ntdsutil.exe to create installation media for additional domain controllers that you are creating in a domain. The IFM method uses the data in the installation media to install AD DS, which eliminates the need to replicate every object from a partner domain controller. However, objects that were modified, added, or deleted since the installation media was created must be replicated. If the installation media was created recently, the amount of replication that is required is considerably less than the amount of replication that is required for a regular AD DS installation.

QUESTION 403
Your network contains an Active Directory domain.
All domain controllers run Windows Server 2008.
The functional level of the domain is Windows Server 2003.
All client computers run Windows 7.
You install Windows Server 2008 R2 on a server named Server1.
You need to perform an offline domain join of Server1.
Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

A.    From Server1, run djoin.exe.
B.    From Server1, run netdom.exe.
C.    From a Windows 7 computer, run djoin.exe.
D.    Upgrade one domain controller to Windows Server 2008 R2.
E.    Raise the functional level of the domain to Windows Server 2008.

Answer: AC

QUESTION 404
You have an Active Directory snapshot.
You need to view the contents of the organizational units (OUs) in the snapshot.
Which tools should you run?

A.    explorer.exe, netdom.exe, and dsa.msc
B.    ntdsutil.exe, dsamain.exe, and dsa.msc
C.    wbadmin.msc, dsamain.exe, and netdom.exe
D.    wbadmin.msc, ntdsutil.exe, and explorer.exe

Answer: B

QUESTION 405
Your network contains a domain controller that runs Windows Server 2008 R2.
You run the following command on the domain controller:
dsamain.exe dbpath
c:$SNAP_201006170326_VOLUMEC$WindowsNTDSntds.dit ldapport
389 - allowNonAdminAccess
The command fails.
You need to ensure that the command completes successfully.
How should you modify the command?

A.    Include the path to Dsamain.
B.    Change the value of the -dbpath parameter.
C.    Change the value of the -ldapport parameter.
D.    Remove the allowNonAdminAccess

Answer: C

QUESTION 406
Your network contains an Active Directory domain.
The domain contains five domain controllers.
A domain controller named DC1 has the DHCP role and the file server role installed.
You need to move the Active Directory database on DC1 to an alternate location.
The solution must minimize impact on the network during the database move.
What should you do first?

A.    Restart DC1 in Safe Mode.
B.    Restart DC1 in Directory Services Restore Mode.
C.    Start DC1 from Windows PE.
D.    Stop the Active Directory Domain Services service on DC1.

Answer: D
Explanation:
http://technet.microsoft.com/en-us/library/cc794895%28v=ws.10%29.aspx
Relocating the Active Directory Database Files
Applies To: Windows Server 2008, Windows Server 2008 R2
Relocating Active Directory database files usually involves moving files to a temporary location while hardware updates are being performed and then moving the files to a permanent location. On domain controllers that are running versions of Windows 2000 Server and Windows Server 2003, moving database files requires restarting the domain controller in Directory Services Restore Mode (DSRM). Windows Server 2008 introduces restartable Active Directory Domain Services (AD DS), which you can use to perform database management tasks without restarting the domain controller in DSRM. Before you move database files, you must stop AD DS as a service.

QUESTION 407
Your company has a main office and a branch office.
The network contains an Active Directory forest.
The forest contains three domains.
The branch office contains one domain controller named DC5.
DC5 is configured as a global catalog server, a DHCP server, and a file server.
You remove the global catalog from DC5.
You need to reduce the size of the Active Directory database on DC5.
The solution must minimize the impact on all users in the branch office.
What should you do first?

A.    Start DC5 in Safe Mode.
B.    Start DC5 in Directory Services Restore Mode.
C.    On DC5, start the Protected Storage service.
D.    On DC5, stop the Active Directory Domain Services service.

Answer: D

QUESTION 408
Your network contains a domain controller that runs Windows Server 2008 R2.
You need to change the location of the Active Directory log files.
Which tool should you use?

A.    Dsamain
B.    Dsmgmt
C.    Dsmove
D.    Ntdsutil

Answer: D
Explanation:
http://support.microsoft.com/kb/257420

QUESTION 409
Your network contains a single Active Directory domain.
All servers run Windows Server 2008 R2.
You deploy a new server that runs Windows Server 2008 R2.
The server is not connected to the internal network.
You need to ensure that the new server is already joined to the domain when it first connects to the internal network.
What should you do?

A.    From a domain controller, run sysprep.exe and specify the /oobe parameter.
From the new server, run sysprep.exe and specify the /generalize parameter.
B.    From a domain controller, run sysprep.exe and specify the /generalize parameter.
From the new server, run sysprep.exe and specify the /oobe parameter.
C.    From a domain-joined computer, run djoin.exe and specify the /provision parameter.
From the new server, run djoin.exe and specify the /requestodj parameter.
D.    From a domain-joined computer, run djoin.exe and specify the /requestodj parameter.
From the new server, run djoin.exe and specify the /provision parameter.

Answer: C

QUESTION 410
Your network contains an Active Directory domain.
The domain contains four domain controllers.
You modify the Active Directory schema.
You need to verify that all the domain controllers received the schema modification.
Which command should you run?

A.    dcdiag.exe /a
B.    netdom.exe query fsmo
C.    repadmin.exe /showrepl *
D.    sc.exe query ntds

Answer: C
Explanation:
http://blogs.technet.com/b/askds/archive/2009/07/01/getting-over-replmon.aspx