MCSE 70-217b
1 You are the administrator of your company’s network. Your event log shows that hackers are using brute force attacks to attempt to gain access to your network. You do not want user accounts to be easily accessible. You want to strengthen security to protect against brute force attacks. What should you do? (Choose two.)
A Enable the Users must log on to change the password setting.
B Enable the Store password using reversible encryption for all users in the domain setting.
C Enable the Password must meet complexity requirements setting.
D Increase minimum password length.
E Increase minimum password age.
Answer: CD
2 You are the Windows 2000 network administrator for your company. You are implementing the company a network security model. Your network has several servers that contain sensitive or confidential information. You want to configure security auditing on these servers to monitor access to specific folders. You also want to prevent users from gaining access to these servers when the security logs become full. What should you do?
A Create a Group Policy object (GPO) that applies to the servers. Configure the GPO to enable auditing for object access. Set up the individual objects to be audited in Windows Explorer, and then customize the Event Viewer logs to limit the size of the security log to 1024 KB.
B Create a Group Policy object (GPO) that applies to the servers. Configure the GPO to enable auditing for directory service access. Set up the individual objects to be audited in Windows Explorer, and then customize the Event Viewer logs to limit the size of the security log to 1024 KB Configure the security event log so that it does not overwrite events.
C Create a Group Policy object (GPO) that applies to the servers. Configure the GPO to enable auditing for directory service access. Set up the individual objects to be audited in Windows Explorer. Configure the security event log so that it does not overwrite events. Then configure the GPO to enable the Shut down the system immediately if unable to log security audits setting.
D Create a Group Policy object (GPO) that applies to the servers. Configure the GPO to enable auditing for object access. Set up the individual objects to be audited in Windows Explorer. Configure the security event log so that it does not overwrite events. Then configure the GPO to enable the Shut down the system immediately if unable to log security audits setting.
Answer:D
3 You are the administrator of your company a network. You have been auditing security events on the network since it was installed. A user on your network named John Thorson recently becomes that he was no longer able to change his password. Because there have been no recent changes to account policies, you suspect that someone has been modifying the properties of user accounts in Active Directory. There are thousands of entries in the event logs, and you need to isolate and review the events pertaining to this problem in the least possible amount of time.
What should you do?
A In the security log, create a filter for events matching the following criteria:
Event source Security
Category Account Management
User JITHORSON
B In the directory service log, create a filter for events matching the following criteria:
Event source: NTDS Security
Category: Security
Search the remaining items for events referencing John Thorson’s account.
C In the directory service log, create a filter for events matching the following criteria:
Event source NTDS Security
Category: Global Catalog
User JITHORSON
D In the security log, create a filter for events matching the following criteria Event source: Security
Category: Account Management
Search the remaining items for events referencing John Thorson’s account.
Answer:D
4 You are the administrator of your company a network. The network consists of one Windows NT 4.0 domain. You create and implement a security policy that is applied to all Windows 2000 Professional client computers as they are staged and added to the network. You want this security policy to be in effect at all times on all client computers on the network. However you find out that administrators periodically change security settings on computers when they are troubleshooting or doing maintenance. You want to automate the security analysis and configuration of client computers on the network so that you can track changes to security policy and reapply the original security policy when it is changed. What should you do?
A Use Windows NT System Policy to globally configure the security policy settings on the client computers.
B Use Windows 2000 Group Policy to globally configure the security policy settings on the client computers.
C Use the Security and Configuration Analysis tool on the client computers to analyze and configure the
security policy.
D Schedule the Secedit command to run on the client computers to analyze and configure the security policy.
Answer:D
5 You are hired by Fabrikam Inc, to secure its Windows 2000 network. You use Security or Templates to create a custom template and save it as Securefab inf. You need to use this template on five domain controllers in the fabrikam.com domain. What should you do? (Choose two)
A Copy the Securefab.inf file to the Sysvol shared folder on one domain controller
B Create a new security database.
C Import the Securefab.inf file.
D Rename Securefab.inf to Ntconfig.pol.
E Create a Group Policy object (GPO) on the Domain Controllers organizational unit (OU).
F Configure the File Replication service to replicate the template file to all the domain controllers.
Answer:C,E
6 You are the administrator for a Windows 2000 network. Your network consists of one domain and two organizational units (OUs). The OUs are named Corporate and Accounting. A user recently reported that she was not able to log on to the domain. You investigate and find out that the user’s account has been deleted. You have been auditing all objects in Active Directory since the domain was created, but you cannot find a record of the user account deletion. You want to find a record that identifies the person who deleted the account. What should you do?
A Search the security event logs on each domain controller for account management events.
B Search the security event logs on each domain controller for object access events.
C Search the Active Directory Users and Computers console on each domain controller for the user’s previous account name.
D Search the Active Directory Users and Computers console on each domain controller for the user’s computer account.
Answer:A
7 You edit the Default Domain Controllers Group Policy on the arborshoes.com domain to require passwords to be at least eight characters long. However, users are able to create passwords that do not comply with the implemented policy. What should you do?
A Initiate replication to make sure the Group Policy containers and the Group Policy template (GPT) are replicated.
B Configure each client computer to have a local Group Policy that requires passwords to be at least eight characters long.
C Edit the Default Domain Group Policy to require passwords to be at least eight characters long.
D Edit the Default Domain Controllers Group Policy to force the password to meet complexity requirements.
Answer:C
8 You are the administrator of a Windows 2000 network for Lucerne Real Estate. The network has 1200 users. You are delegating part of the administration of the domain to three users. You delegate the authority to create and delete computer accounts to Carlos. You delegate the authority to change user account information to Juld. You delegate the ability to add client computers to the domain to Peter. You want to track the changes made to the directory by these three users. What should you do?
A Create a Group Policy object (GPO) for the domain controllers .
Assign Read and Apply Group Policy permissions to only Carlos, Juld and Peter.
Configure the GPO to audit directory services access and account management.
B Create a Group Policy object (GPO) for the domain.
Assign Read and Apply Group Policy permissions to only Carlos, Juld and Peter.
Configure the GPO to audit directory services access and audit object access.
C Create a Group Policy object (GPO) for the domain controllers.
Assign Read and Apply Group Policy permissions to only Carlos, Juld and Peter.
Configure the GPO to audit directory services access and audit object access.
D Create a Group Policy object (GPO) for the domain.
Assign Read and Apply Group Policy permissions to only Carlos, Juld and Peter.
Configure the GPO to audit object access and process tracking.
Answer:A
9 You are the network administrator for Contoso.Ltd. Marc is moving from the IT department to the sales department and will be the technical sales manager for the eastern United States. The current OU structure is shown in the exhibit. (Click the Exhibit button) You move Marc’s user account from the IT OU to the Technical Sales OU. You want Marc to be able to create user accounts in ou=sales, ou=eastern, dc=contoso, dc=com. What should you do?
A Move Marc’s user account to the Sales OU.
B Add Marc’s user account to the Account Operators group.
C Grant Marc’s user account Create User Objects permission for the Sales OU.
D Grant Marc’s user account Write permission for the Sales OU.
Answer:C
10 You are the administrator of a Windows 2000 network. The network is composed of four domains named aftorshoes.com, na.aftorshoes.com, sa.aftorshoes.com, and fabrikam.com. The root of the forest is arborshoes.com. There are two Microsoft Windows NT 4.0 BDCs in each domain. Graphic posts place finished artwork for Fabrikam,Inc., in a shared folder located on a domain controller named bna01.fabrikam.com. Read and Write permissions are granted to the Artists Domain Local group in the fabrikam.com domain. Sharon is a member of the Graphic Artists global distribution group in the no arborshoes.com domain. She is unable to gain access to the shared folder. You want to allow Sharon access to the shared folder. What should you do?
A Change the Graphic Artists group type to Security and add it to the Artists Domain Local group.
B Change the Artists Domain Local group to a universal group and add it to the Graphic Artists group.
C Change the Graphic Artists group to a Domain Local group and add it to the Artists Domain Local group.
D Change the mode of the domain controller in no arborshoes.com to native mode Add the Graphic Artists group to the Artists Domain Local group.
Answer:A
11 You are the network administrator for Trey Research Trey Research has two Windows 2000 domains named treyresearch.com and na.treyresearch.com Blake has a user account in the treyresearch.com domain and needs to use support documents in the na.treyresearch.com domain. You create a global group named NA Support in na.treyresearch.com. NA Support is a member of the Domain Local group named Support. Support has Read permission to the Support shared folder in the na.treyresearch.com domain. Your network contains only Windows 2000 domain controllers. The domains are in native mode. You want to grant Blake Read permission to the Support shared folder. What should you do?
A Create a universal group in treyresearch.com and make Blake a member. Add the universal group to the NA Support group.
B Create a new user account in no treyresearch.com Use the same user name and password that Blake uses for his user account in treyresearch.com.
C Create a global group in treyresearch.com and make Blake a member. Add the global group to the NA Support group.
D Create a universal group in no treyresearch.com and make Blake a member. Add the universal group to the Support group.
E Create a new global group named Global Support in treyresearch.com. Add Blake to the new global group Add the Global Support group to the Support group.
Answer:E
12 You are the administrator of a Windows 2000 network. Your Windows 2000 domain controller has been in operation for one year. During that year, you have deleted numerous objects. However, the Ntds.dit file is the same size it was before you deleted any objects. You want to reduce the size of the Ntds.dit file. What should you do? (Choose two)
A Delete all the log files from the NTDS folder and restart the server.
B Use the Ntdsutil utility to perform an authoritative restore..
C Run the Esentutl utility by using the /d switch.
D Restart the server in directory services restore mode.
E Use the Ntdsutil utility to compress the database to another drive.
Answer:C,D
13 You are the administrator of a Windows 2000 network. The domain is named litware.com .The distinguished name for the Sales organizational unit (OU) is ou=Sales, ou=Nodh,America, dc=litsware, dc=com. You want to assign Andrew the ability to manage all the objects in only the Sales OU. What should you do?
A Add Andrew to the Domain Administrators group.
B Grant Andrew Full Control permission to the Noon America OU and disable inheritance at the Sales OU.
C Grant Andrew Read and Write permissions to the Sales OU.
D Grant Andrew Full Control permission to the Sales OU.
E Move Andrew a user account to the Sales OU,
Answer:D
14 You are the administrator of a Windows 2000 network that has three sites: Boston, Minneapolis, and Seattle. You have two domains: adatum.com and support adatum.com. Minneapolis and Seattle each have a domain controller for adatum.com and Boston has a domain controller for support adatum.com. There is one IP site link named SEA-BOS, which connects Seattle to Boston. There is one IP site link, named BOS-MIN, which connects Boston to Minneapolis. The schedule for SEA-BOS is set to allow replication from 1:00 A.M. to 4:00 A.M. Greenwich mean time. The schedule for BOS-MIN is set to allow replication from 9:00 P.M. to 12:00 midnight Greenwich mean time. All site links are set to replicate every 60 minutes. The administrator in Minneapolis creates two new user accounts for users who travel frequently between Minneapolis and Seattle. When you connect to the domain controller in the Minneapolis site, you are able to see the new user accounts. However, when you connect to the domain controller in the Seattle site, you cannot see the new user accounts. The administrator in the Boston site cannot see the users when the administrator is connected to the domain controller in Boston until the day after the administrator in Minneapolis creates the accounts. How should you correct this problem?
A Create a new SMITH site link between the Minneapolis site and the Seattle site.
B Install a second domain controller for the support adatum.com domain in the Minneapolis site.
C Change the schedule on the BOS-MIN site link to be from 11:00 P.M. Greenwich mean time to 2:00 A.M. Greenwich mean time.
D Change the frequency of replication on the SEA-BOS site link to every 30 minutes.
Answer:C
15 You are the administrator of a Windows 2000 network. Your network has one domain named parnellaerospace.com. The parnellaerospace.com domain supports 8000 users at three locations. The network has three sites connected by Tl lines, as shown in the exhibit (Click the Exhibit button) The West site has 2500 users; the East site has 3000 users; and the Central site has 2500 users. Each site contains a global catalog server. The global catalog server in the West site is named LAX01-GC. The global catalog server in the Central site is named TUL01-GC. The global catalog server in the East site is named CYCO1-GC. You want users located in the West site to query TUL01-GC. If the West site global catalog serveris offline. What should you do?
A Create a new subnet, assign it to the West site, and move TUL01-GC to the West site.
B Configure the site link between the Central site and the West site to have a lower cost than the site link between the West site and the East site.
C Add a global catalog server to the Central site that has an IP address in the West site subnet.
D Configure TUL01-GC as a preferred bridgehead server.
E Set the query policy on LAXOl-GC to the default query policy.
Answer:B
16 You add three new SCSI hard disk drives to your company’s domain controller. The SCSI disks are conferred in a hardware RAID-5 array. You have two other physical disks in this domain controller. You want to optimize the speed of the Active Directory database. What can you do? (Choose two)
A Move the Ntds.dit file to the RAID-5 array.
B Move the log files to a separate physical disk from the operating system.
C Move the log files and the Ntds.dit file to the RAID-5 array.
D Move the Neflogon share to the RAID-5 array.
E Create a mirror volume and place the log files on the mirror.
Answer:A,B
17 You are the administrator of a Windows 2000 network for your company. Your company has three locations in North America and three locations in Europe. Your network includes six sites as shown in the exhibit (Click the Exhibit button). The England, France, and Italy sites are in the eur.blueskyairlines.com domain. The NorthwestUS, CentralUS and NortheastUS sites are in the na.blueskyairlines.com domain. The root of the forest is blueskyairlines.com. The connection between the NortheastUS site and the England site is unreliable. You want to configure replication between the NortheastUS site and the England site. What should you do?
A Create an SMITP site link between the NortheastUS site and the England site.
B Create an IP site link between the NortheastUS site and the England site.
C Create an SMITP site link bridge between the NortheastUS site and the England site.
D Create an IP site link bridge between the NortheastUS site and the England site.
Answer:A
18 You create a new Windows 2000 Active Directory network. Five months after deployment of the network, you receive a report that the Active Directory database file takes up too much disk space on the ServerA domain controller. You want to reduce the size of the Active Directory database file. What should you do? (Choose three.)
A Restart ServerA in directory services restore mode.
B Stop the Net Logon service on ServerA.
C Run Windows Backup to back up the System State data. Immediately run Windows Backup again to restore the System State data from the backup file.
D Use the Ntdsutil utility to compact the database to a folder. Move the compacted database file to the original location.
E Restart ServerA and boot normally.
F Start the Net Logon service on ServerA.
Answer: A D E
19 You install a Windows 2000 Server computer on your network. You promote the computer to be a domain controller. This computer also functions as the DNS server for the domain. All client computers are running Windows 2000 Professional. When users attempt to log on, they receive an error message stating that a domain controller cannot be located. You verify that Active Directory is installed and functional on the server. You want to ensure that the domain controller is available for user logons. What should you do next?
A Check DNS for the addition of an appropriate SRV (service) record in the zone.
B Check DNS for the addition of an appropriate A (host) record in the zone.
C Check for the presence of an NTDS folder on the domain controller.
D Check for the presence of a Sysvol folder on the domain controller.
E On the client computers, create a Hosts file that contains the SRV (service) records for the domain controller.
F On the client computers, create a Hosts file that contains the A (host) record for the domain controller.
Answer:a
20 You are installing a new Windows 2000 Server computer on your existing Windows NT network. You run DCPromo.exe to promote the Server to a domain controller in a domain named domain local. You receive the following error message “The domain name specified is already in use on the network.” There are no other Windows 2000 domains on your network What should you do?
A Place an entry in your DNS Server host table for the domain local domain name.
B Place an entry in your WINS database for the domain local domain name.
C Change the domain name to domain.com.
D Change the downlevel domain name to domain1.
Answer:D
21 You are the network administrator for the Lucerne Real Estate company. The network consists of one Windows 2000 domain named lucernerealestate.local. The network is not currently connected to the Internet. You are installing a new domain named lucernerealestate1.local. During the promotion process you receive the following error message “The domain name specified is already in use on the network.” What is the most likely cause of the problem?
A The default-generated DNS domain name is already in use.
B DNS domain names cannot be named iteratively.
C The default-generated NetBIOS domain name is already in use.
D NetBIOS domain names cannot be named iteratively.
Answer:C
22 You are the administrator of your company a network. The company has prices in Chicago and Madrid. The prices are connected by both a Tl line and an ISDN line. You have one Windows 2000 domain. You create sites and subnets to reflect the physical structure of your network. You also create a site link for each physical connection between the two prices using default values. You want to ensure that the faster of the two connections will always be used for replication purposes, even if both connections are available. What should you do?
A Set the cost of the Tl site link to 150.
B Set the cost of the ISDN site link to 150
C Set the replication schedule on the ISDN site link to be more frequent than the replication schedule on the Tl site link.
D Set the replication schedule on the ISDN site link to be less frequent than the replication schedule on the Tl site link.
Answer:B
23 Your company’s Windows 2000 network consists of a single domain. You are the enterprise administrator of the domain. Two administrators named Ann and Bill make changes to Active Directory at approximately the same time at two different domain controllers named ServerA and ServerB. Ann deletes an empty organizational unit (OU) named Branch1 from ServerA. Before this deletion is replicated to ServerB. Bill moves five existing users from the Branch2 OU to the Branch1 OU at ServerB. Ten minutes later Bill discovers that the Branch1 OU is deleted from Active Directory. You want to reinstate the configuration that Bill attempted to accomplish. What should you do?
A Perform an authoritative restore of the Branch1 OU at ServerA.
B Perform a nonauthoritative restore of the Branch1 OU at ServerA.
C Perform an authoritative restore of the five users at ServerB.
D At ServerB, move the Branch1 OU from the LostAndFound container to its original location.
E At ServerA, create a new Branch1 OU. Move the five users from the Branch2 OU to the new Branch1 OU.
F At ServerB, create a new Branch1 OU. Move the five users from the LostAndFound container to the new Branch1 OU.
Answer:F
24 You are the administrator of your company a WAN. Your company has four locations connected by dedicated 256-Kbps leased lines. You install and configure a Windows 2000 domain controller at each location. For network performance reasons you want to control the bandwidth usage and replication schedule of directory information to each domain controller in each location. What should you do? (Choose two)
A Create a site for each location.
B Create a site that spans all the locations.
C Create Server objects for each domain controller in every site.
D Create Server objects for each domain controller in its own site.
E Copy all Server objects from Default First Site Name to each site.
F Move each Server object from Default First Site Name to the appropriate site.
Answer:A,F
25 You are the administrator of your company a network. The company has two native mode domains in six sites as shown in the exhibit. (Click the Exhibit bunch) Each site has one or more domain controllers. Users report that at times of high network usage authentication and directory searches are extremely slow. You want to improve network performance. What should you do?
A Move all domain controllers into one site.
B Promote more Windows 2000 Server computers in each site to be domain controllers.
C Install a DNS Server in each site and configure it to use Active Directory integration.
D Designate a domain controller in only one site as a global catalog Server.
E Designate a domain controller in each site as a global catalog Server.
Answer:E
26 You are the enterprise administrator of a Windows 2000 domain named fabrikam.com. The domain contains three domain controllers named DCA, DCB, and DCC. DCA does not hold any operations master roles. You backed up the System State data of DCA two weeks ago. Without warning, the DCA hard disk fails. You decide to replace DCA with a new computer. You install a new Windows 2000 Server computer. What should you do next?
A Add the server to the domain. Do an authoritative restore of the backup of the original DCA System State data that you made two weeks ago.
B Add the server to the domain. Use Windows Backup to create a backup of the DCB System State data and restore this backup on the new DCA.
C Use the Active Directory Installation wizard to make the new computer a replica in the domain.
D Use the full utility to copy the Active Directory database from DCB to the new DCA.
Answer:C
27 You are the backup operator of a Windows 2000 domain. The domain has two domain controllers. You want the Active Directory database files of both domain controllers to be automatically backed up once a week. What should you do?
A Schedule a backup job that will back up the System State data once a week.
B Schedule a backup job and select the Schema.ini file in the System32 folder and all files in the NTDS folder to be backed up once a week.
C Schedule a task that will run the Ntdsutil utility once a week.
D Schedule a task that will copy the Ntds.dit file and the Sysvol folder once a .week
Answer:A
28 You are the administrator of a Windows 2000 network that has only one domain. You are contouring network security settings for the domain’s Windows 2000 Professional users. Your sales team uses portable computers and Routing and Remote Access to connect to the company network. Sales users need local administrator rights to their computers so that they can run a third-party application. You want to configure the computers to prevent the users from modifying their existing network connections. What should you do?
A On each portable computer, create only the permitted LAN and Routing and Remote Access connections. At the Server, configure the sales user accounts to permit connections to only the specified computers.
B Create a System Policy to hide Network Neighborhood and disable registry-editing tools. Apply this policy to all the sales users.
C Create a Group Policy object (GPO) for the domain Filter the GPO for the sales users. Configure the GPO to deny the sales users access to the properties of a LAN or Routing and Remote Access connection.
D Create a Group Policy object (GPO) for the domain controllers. Filter the GPO for the sales users, Configure the GPO to deny the sales users access to the Network Connection wizard.
Answer:C
29 You are deploying Windows 2000 Professional on your network. You recently installed a RIS Server to expedite the deployment process. Your network is now conferred as shown in the exhibit (Click the Exhibit button). When you attempt to use the RIS Server to deploy Windows 2000 on Julia’s and Carlos’s computers, you cannot establish the initial connection. Anita and Peter installed Windows 2000 from CD-ROM and did not have any problems with the installation. What should you do to correct the problem?
A Integrate the DNS Server’s zones into Active Directory.
B Install a DHCP Server and authorize it in Active Directory.
C Install a WINS Server and configure the DNS Server to use it for name resolution.
D Create computer accounts in Active Directory for Julia and Carlos, and specify the name of the RIS Server
on the Remote Install tab of the Computer Accounts properly sheet.
Answer:B
30 You are the administrator of your company a Windows 2000 domain. Your company wants to deploy a custom application named Drawing. To configure the Drawing application you need to set a custom policy setting in the HKCUlocation in the registry for every user in the domain. What should you do?
A Create a Group Policy object (GPO) named Draw Setting.
Assign the Draw Setting GPO to the domain.
Configure the Draw Setting GPO to run a startup script that changes the appropriate
HKCUlocation in the registry.
B Create a Group Policy object (GPO) named Draw Setting.
Assign the Draw Setting GPO to the domain.
Configure the Draw Setting GPO to run a logon script that changes the appropriate
HKCUlocation in the registry.
C Create a Group Policy object (GPO) named Draw Setting.
Assign the Draw Setting GPO to the domain.
Create a new administrative template that defines the custom policy setting.
Add the new administrative template to the Draw Setting GPO.
Configure the Draw Setting GPO to set the appropriate policy.
D Create a registry file that has the reg file name extension.
Edit the registry file to change the appropriate HKCUlocation in the registry.
Place the registry file in the All Users Startup folders of all computers in your domain.
Answer:C
31 You are the administrator of a network that consists of 500 computers. Your network is conferred as shown in the exhibit. (Click the Exhibit button) You are deploying Windows 2000 Professional on the computers in the Tech and Sales organizational units (OUs). There is one Windows 2000 Server computer that is running RIS. You create a group named RIS Installers that consists of users from the Tech OU. Only members of the RIS Installers group will use RIS to deploy Windows 2000. You want to accomplish the following goals: Members of the RIS Installers group will be able to choose client computer names during client computer installation. New computer accounts will be organized into their corresponding Ous. The company naming convention will be applied to all new computer accounts. Computers that are not in either the Tech OU or the Sales OU will not be able to download images during RIS deployment. You take the following actions: Create an OU, then specify the client account location in the RIS anecdotes sheet. Enter a custom Client computer naming format in the RIS anecdotes sheet. Place the Mktg computers in a different IP subnet from the Tech and Sales users. Which result or results do these actions produce? (Choose all that apply)
A Members of the RIS Installers group can choose client computer names during client computer installation.
B New computer accounts are organized into their corresponding Ous.
C The company naming convention is applied to all new computer accounts.
D Computers that are not in either the Tech OU or the Sales OU cannot download images during RIS deployment.
Answer:C
32 You are the network administrator of a Windows 2000 network. The network consists of 500 Windows 2000 Professional computers. You recently discovered that users of these computers have been using the same passwords since their accounts were created You need to correct this problem to maintain security in the network. You create a Group Policy object (GPO) and filter it to the users. You want to configure the GPO to require users to create different passwords periodically. Which two spores should you enable? (Choose two)
A minimum password length
B user must log on to change the password
C enforcement of password history
D minimum password age
E maximum password age
Answer:C,E
33 You are the administrator of a Windows 2000 domain. The domain has a Windows 2000 Server computer named MainApps. The MainApps Server is not a domain controller. Members of the Domain Users group have the right to log on locally at the MainApps Server. When one of these members logs on locally, you want a script named Setperms.vbs to be executed. This script defines environment variables settings in the current user profile that are needed for the MainApps Server. What should you do?
A Copy the Setperms.vbs script to the Netlogon share on the MainApps Server.
B Place the Setperms.vbs script in the Sysvol share on the MainApps Server.
C Add the Setperms.vbs script to the local Group Policy object (GPO) as a logon script.
D Add the Setperms.vbs script to the local Group Policy object (GPO) as a startup script.
Answer:C
34 You are the administrator of a Windows 2000 domain. The domain has an organizational unit (OU) named Support. Users in the Support OU frequently use their portable computers when they are not connected to the network. The portable computers are Windows 2000 Professional computers in the Support OU. The domain also has a Windows 2000 Server computer named Data3. The \Data3share contains files that are needed by the users in the Support OU. You want to accomplish the following goals: Users in the Support OU will be able to access files at \Data3if they use their portable computers while they are not connected to the network. The total disk space used on the portable computers to automatically store files from the \Data3share and other Server locations will not exceed 5 percent of the hard disk space. What should you do? (Choose all that apply)
A Configure the SupiTles share on the Data3 Server to cache documents automatically.
B Create a new Group Policy object (GPO) named Exfolder.
Assign the Exfolder GPO to the Support OU.
Configure the Exfolder GPO to exclude the AData3folder from roaming profiles.
C Create a new Group Policy object (GPO) named Maxdisk.
Assign the Maxdisk GPO to the Support OU.
Configure the Maxdisk GPO to limit the automatically cached offinne files to 5 percent of the hard disk space.
D Create a new Group Policy object (GPO) named plaxape.
Assign the plaxape GPO to the Support OU.
Configure the plaxape GPO to limit the size of each user profile to 5 percent of the hard disk space.
Answer:A,C
35 You are the administrator of a Windows 2000 domain. The domain has an organizational unit (OU) named Sales. All users in the Sales OU use an application named Planning. The Planning application is deployed by using a Group Policy object (GPO) named Plan App on the Sales OU. The Plan App GPO is configures to assign the Planning application to users by using a Microsoft Windows Installer package for the application. The Planning application will be replaced by another application in the next month. You want to accomplish the following goals: Users who have not yet installed the Planning application will be prevented from installing the application. Users who have already installed the Planning application will be able to continue to use it If key application files are missing when the Planning application stake, the missing files will be reinstalled automatically. If the vendor of the Planning application releases a software patch by using a Windows Installer package, you will be able to assign the patch to only the users who have already installed the application. You take the following actions: Create a new software category named Optional Apps. Configure the Plan App GPO to add the Planning application to the Optional Apps software category. Configure the Plan App GPO to remove the planning application,but select the option to allow users to continue to use the software. Which result or results do these actions produce? (Choose all that apply)
A Users who have not yet installed the Planning application are prevented from installing the application.
B Users who have already installed the Planning application can continue to use it.
C If key application files are missing when the Planning application starts, the missing files are reinstalled automatically.
D If the vendor of the Planning application releases a software patch by using a Windows Installer package you can assign the patch to only the users who have already installed the application.
Answer:
36 You are deploying Windows 2000 Professional on your network of 1000 users. Part of your network is shown in the exhibit (Click the Exhibit button) You have recently installed a RIS Server to assist in the deployment process. You confirm that the client computers meet the requirements for RIS deployment. However, you still cannot connect the RIS client computers to the RIS Server. Existing client computers are able to connect to all the servers for network resources. What can be causing the problem? (Choose all that apply)
A The RIS Server has no client-side tools installed.
B The RIS Server is not trusted for delegation.
C The RIS Server is not authorized in Active Directory.
D The client computers are not configured to use DHCP.
E The RIS Server is not configured to respond to client computers requesting service.
Answer:
37 You are the administrator of a Windows 2000 domain. The domain has a Windows 2000 Server computer named Toronto. Users in the domain frequently work on different Windows 2000 Professional computers. All Windows 2000 Professional computers are in the domain. You want to enable roaming profiles for all users. You want to accomplish the following goals: All users in the domain will be able to work on all Windows 2000 Professional computers and have their own desktop settings available on all computers. All users in the domain will be able to make changes to their desktop settings. All users in the domain will be able to access their documents in the My Documents folder from any Windows 2000 Professional computer. The amount of data that is copied between the Toronto Server and the Windows 2000 Professional computers each time a user logs on or on will be minimized. What should you do? (Choose two)
A Configure a roaming profile for each user in the domain. Use \Toronto%Username% as the profile path.
B Configure a roaming profile for each user in the domain. Use \Toronto%Username%.man as the profile path.
C Create a new Group Policy object (GPO) named Profilescript. Assign the Profilescript GPO to the domain Configure the Profilescript GPO to assign a logon script to all users Include the runas /profile explorer.exe command in the logon script.
D Create a new Group Policy object (GPO) named Docs.Assign the Docs GPO to the domain. Configure the Docs GPO to redirect the My Documents folder to the \Toronto%Username%.
E Create a new Group Policy object (GPO) named Profiledocs Assign the Profiledocs GPO to the domain. Configure the Profiledocs GPO to exclude the My Documents folder from each user a roaming profile.
Answer:A,D
38 You are the administrator of a Windows 2000 network. Users in an organizational unit (OU) named Procs need to have a drive mapped to a network location. These users log on from Windows 2000 Professional computers. You want to use a logon script named Userlog.cmd to implement this drive-mapping for all current and future users in the Procs OU. What should you do?
A Copy Userlog.cmd to the Netlogon share on each domain controller in the domain. Select each user in the Procs OU and set the logon script to Userlog.cmd.
B Copy Userlog.cmd to the Sysvol share on each domain controller.
Assign Read permission to the file for all users in the Procs OU.
C Create a Group Policy object (GPO) that enforces Userlog.cmd as a logon script.Assign the GPO to the Procs OU.
D Create a Group Policy object (GPO) that enforces Userlog.cmd as a startup script.
Assign the GPO to the Procs OU.
Answer:C
39 You are the enterprise administrator of a Windows 2000 domain. The domain is in native mode. You want to implement a policy to disable the ShutDown command for all users in the domain except for the members of the Domain Admins security group. You create a new Group Policy object (GPO) named Shutdown. You configure the Shutdown GPO to disable the Shutdown option. You assign the Shutdown GPO to the domain. You want to ensure that the policy does not apply to the members of the Domain Admins group. What should you do?
A On the Shutdown GPO, deny the Apply Group Policy permission to the Domain Admins group.
B On the Shutdown GPO, remove the Apply Group Policy permission from the Authenticated Users group.
Grant the Apply Group Policy permission to the Users group.
C Add the Domain Admins group to the Group Policy Creator Owners group.
D Create a new OU named No Shutdown. Move the Domain Admins group to the No Shutdown OU. Configure the No Shutdown OU to block policy inheritance.
E On the computers that the members of the Domain Admins group use to log on. configure the local GPO to enable the Shutdown option.
Answer:A
40 You are the administrator of a Windows 2000 domain. You want to deploy a new application named Finance that will be used by all users in the domain. The vendor of the Finance application supplied a Microsoft Windows Installer package for the application. You decide to deploy the Finance application in two phases During phase 1, only members of a security group named Finance Pilot will use the Finance application. During phase 2, all users in the domain will be able to install the Finance application. You want to accomplish the following goals: During phase 1, the Finance application will not be installed automatically when users log on. During phase 1, users who are members of the Finance Pilot group will be able to install the Finance application by using a Stand menu shortcut. During phase 1, users who are not members of the Finance Pilot group will not be able to install the Finance application by using a Stand menu shortcut. The Finance application will be installed automatically the first time any user in the domain logs on after phase 2 has begun. You take the following actions: Create a new Group Policy object (GPO) named Finance App and link the Finance App GPO to the domain. Configure the Finance App GPO to publish the Finance application to users. For phase 1,configure the finance App GPO permissions. Remove the Apply Group Policy permission for the Authenticated Users group. Remove the Apply Group Policy permission for the Finance Pilot group. For phase 2, configure the Finance App GPO permissions. Grant the Apply Group Policy permission for the Authenticated Users group. Remove the Apply Group Policy permission for the Finance Pilot group. Which result or results do these actions produce? (Choose all that apply)
A During phase 1, the Finance application is not installed automatically when users log on.
B During phase 1, users who are members of the Finance Pilot group can install the Finance application by using a Start menu shortcut.
C During phase 1, users who are not members of the Finance Pilot group cannot install the Finance application by using a Start menu shortcut.
D The Finance application is installed automatically the first time any user in the domain logs on after phase 2 has begun.
Answer:A,C
41 You are the network administrator for Blue Sky Airlines. You are implementing a Windows 2000 network consisting of five sites in the blueskyairlines.com domain. There are 15000 users in Chicago; 5000 users in Los Angeles; 2000 users in Miami; 10000 users in New York, and 2000 users in Seattle. You are designing the structure of the DNS servers. You want to allow secure dynamic updates to DNS in Chicago, Los Angeles, and New York. You want full DNS replication to occur in all the sites. You do not want the Miami site to have an editable copy of the DNS zone. How should you configure the DNS servers to accomplish these goals?
To answer, click the Select and Place button, and then drag the letter indicating the appropriate Server type to each site. Next drag the number indicating the appropriate zone type to each site. Two sites have been partially completed for you. (Note Zone types and Server types can be used more than once.)
Answer: Chicago(AD)+Los(AD)+New(AD)+Miami(second)+Seattle(second)
42.You are configuring a Windows 2000 DNS Server on your company’s network. The network consists of one Windows NT domain. You already have DNS installed on a Windows NT Server computer on the Windows NT domain. You want to use dynamic updates on the DNS database, but company management will not allow you to upgrade or decommission the Windows NT DNS Server. All DNS information must be synchronized between the two DNS servers. What should you do to accomplish these goals? (Choose three)
A Create a standard primary zone on the Windows 2000 DNS Server and import the existing zone file.
B Create a standard secondary zone on the Windows 2000 DNS Server.
C Delete and re-create the primary zone on the Windows NT DNS Server.
D Delete the existing zone and create a new secondary zone on the Windows NT DNS Server.
E Configure the primary zone on the Windows NT DNS Server as the master zone for the secondary zone on the Windows 2000 DNS Server.
F Configure the secondary zone on the Windows NT DNS Server to use the Windows 2000 standard primary zone as its master zone.
Answer: A C F
43 You are the administrator of your company a network. The network consists of one Windows 2000 domain that spans multiple archers. You are conferring DNS for host name resolution throughout the network. You want to accomplish the following goals: DNS zone transfer traffic will be minimized on the network. Administrative overhead for maintaining DNS zone files will be minimized. Unauthorized host computers will not have records created in the zone. All zone updates will come only from authorized DNS servers. All zone transfer information will be secured as it crosses the network. You take the following actions: Create an Active directory integrated zone. In the Zone Properties dialog box, set the Allow Dynamic Updates option to Only Secure Updates. On the Name Servers tab of the Zone Properties dialog box, enter the names and addresses of all DNS servers on the network. On the Zone Transfers tab of the Zone Properties dialog box, select the Allow zone transfers only to servers listed on the Name Servers tab option. Which result or results do these actions produce? (Choose all that apply)
A DNS zone transfer traffic is minimized on the network.
B Administrative overhead for maintaining DNS zone files is minimized.
C Unauthorized host computers do not have records created in the zone.
D All zone updates come only from authorized DNS servers.
E All zone transfer information is secured as it crosses the network.
Answer:A,B,C,D
44 You are the network administrator for Enchantment Lakes Corporation. Enchantment Lakes Corporation and Five Lakes Publishing are planning a merger. The planned Windows 2000 network configuration is shown in the exhibit (Click the Exhibit bunch ) You want to host the fivelakespublishing.com domain on the enchantmentlakes.com DNS Server. The fivelakespublishing.com domain uses an Active Directory integrated zone on its DNS Server. Five Lakes Publishing will retain its domain structure after the merger is complete. You want to set up the enchantmentlakes.com DNS Server to host the fivelakespublishing.com domain. What should you do?
A On Server1, create an Active Directory integrated zone named fivelakespublishing.com Enable WINS lookup, and specify Server7 as the IP address for the WINS Server.
B On Server5 create a secondary zone named fivelakespublishing.com Configure PINS zone transfers to allow Server1 to replicate data.
C On Server5 configure DNS zone transfers to allow Server1 to replicate data On Server1 create a secondary zone named fivelakespublishing.com.
D On Server1 create an Active Directory integrated zone named fivelakespublishing.com Configure DNS zone transfers to allow Server5 to replicate data.
Answer:C
45 You are the administrator of your company a network. The network consists of two Windows 2000 domains named contoso.com and mice contoso.com. You create separate zones for each domain on your DNS Server Later, you add a second DNS Server to the network. This Server also functions as a domain controller. You convert the contoso.com zone to an Active Directory integrated zone and set the zone to allow only secure updates to the zone database. You discover that unauthorized computers are registering themselves in the mktg.contoso.com domain. You check the zone’s properties and discover that the zone is allowing unsecured dynamic updates. You also discover that the option to select secure dynamic updates is not available. What should you do to correct this problem?
A Initiate a zone transfer between the mktg.contoso.com zone and the contoso.com zone.
B Reinstall mktg.contoso.com as a standard secondary zone.
C Reinstall contoso.com as a standard primary zone.
D Convert mktg.contoso.com to an Active Directory integrated zone.
Answer:D
46. You are the administrator of your company’s network. Your company has its main office in North America and has branch offices in Asia and Europe. The locations are connected by dedicated 256 Kbps lines. The network consists of one Windows 2000 domain. To minimize logon authentication traffic across the slow links, you create a site for each office and configure the site links between the sites. Users in the branch offices report that it takes a long time to log on to the domain. You monitor the network and discover that all authentication traffic is still being sent to the domain controllers in the North America site. What should you do to correct this problem?
A Schedule replication to occur more frequently between the sites
B Schedule replication to occur less frequently between the sites
C Create a subnet for each physical location associate the subnets with the North
America site and move server objects to the North America site
D Create a subnet for each physical location, associate each subnet with its respective site, and move each server object to its respective site
Answer:D
47. You are the administrator of your company’s network. Your company has two domains in six sites as shown in the exhibit (Click the Exhibit button ) Each site has one or more domain controllers. For fault tolerance and load balancing purposes, one domain controller in each site is configures as a global catalog server. Users report that several times a day network performance and data transfer for an application located in SiteA are extremely poor. You want to improve network performance. What should you do?
A Configure at least two domain controllers in each site as global catalog servers
B Configure the domain controllers in only one site as global catalog servers
C Create site links between all sites and use the default replication schedules
D Create site links between all sites and set less frequent replication schedules
E Create connection objects between each domain controller. Use RPC as the transport protocol
F Create connection objects between each domain controller. Use SMTP as the transport protocol
Answer:D
48. You are the enterprise administrator of a Windows 2000 domain. The domain has three domain controllers named DC1 DC2 and DC3. Because of changed hardware requirements, you want to replace the domain controller named DC1 with a newer computer named DC4. You want DC4 to be a domain controller in the domain. You no longer want DC1 to function as a domain controller. What should you do?
A Install DC4 as a stand alone server in a workgroup named WG
Restore a System State data backup of DC1 on DC4
On DC1 use the Active Directory Installation wizard to remove Active Directory from DC1
B Install DC4 as a stand alone server in a workgroup named WG
Disconnect DC1 from the network
Rename DC4 to DC1
On DC2 force replication of Active Directory to all its replication partners
C Install DC4 as a member server in the domain
On DC4 use the Active Directory Installation wizard to install Active Directory on DC4
On DC1 use the Active Directory Installation wizard to remove Active Directory from DC1
D Install DC4 as a member server in the domain
On DC1 use the Ntdsutil utility to copy the Active Directory files to DC4
Use the Active Directory Installation wizard to remove Active Directory from DC1
Answer:C
49. You are the administrator of a domain named contoso.com. The domain contains an organizational unit (OU) named Sales that has 20 users. In the Active Directory User and Computers console on a domain controller named DC1, you inadvertently delete the Sales OU. You want to reinstate the Sales OU. What should you do?
A Move the tombstoned Sales OU from the Lostandfound container to its original location
B Copy the Sales OU from another domain controller in the contoso.com domain to DC1
C Perform an authoritative restore of the Sales OU from the last backup
D In the Active Directory Sites and Services console, force replication from another domain controller in the contoso.com domain
Answer:C
50. You are the administrator of a Windows 2000 domain. The domain has two domain controllers named Server1 and Server2. The volume that contains the Active Directory database file on Server1 is running out of disk space. You decide to move the database file to an empty volume on a different disk on Server1. What should you do?
A Restart Server1 in directory services restore mode. Use the Ntdsutil utility to move the database file to the empty volume
B Use Windows Backup to create a backup of the System State data of Server1. Restart Server1 in directory services restore mode. Restore the System State data to the empty volume
C Use the Logical Disk Manager console to mount the empty volume in the folder that contains the Active Directory database file
D Stop the Net Logon service on Server1. Use Windows Explorer to move Ntds.dit to the empty volume. Start the Net Logon service again. Force replication from Server2
Answer:A
51. You are the network administrator for your company. Your company’s main office is in Seattle Branch prices are in New York Roma and Tokyo. The local administrators at each branch office need to be able to control local resources You want to prevent the local administrators from controlling resources in the other branch prices. You want only the administrators from the main office to be allowed to create and manage user accounts. You want to create an Active Directory structure to accomplish these goals. What should you do?
A Create a domain tree that has a top level domain for the main office and a child domain for each branch office. Grant the local administrators membership in the Domain Admins group in their child domains
B Create a domain tree that has a top level domain for the main office and a child domain for each branch office. Grant the local administrators membership in the Enterprise Admins group in the domain tree
C Create a single domain. Create a group named Branch Admins. Grant the local administrators membership in this group. Assign permissions to the local resources to this group
D Create a single domain. Create an organizational unit (OU) for each branch office and an additional OU named CorpUsers. Delegate authority for resource administration to the local administrators for their own Ous. Delegate authority to the CorpUsers OU only to the Domain Admins group
Answer:D
52. You are the administrator for your company. You are deploying Windows 2000 on your network of 10500 users. There are 15 departments in your company. Each department needs to use specific features of Windows 2000 and custom third party applications You want to minimize the administrative time required to set up the client computers. You also want to provide customized software installations to the users What should you do?
A Install and configure a RIS server on your network
Use RIPrep.exe to create multiple images for each department
Connect the client computers to the RIS server and deploy the custom images
B Install and configure a RIS server on your network
Create different installation script files for each department
Deploy the computers by using RIS
C Create a shared folder on one of the servers
Copy the source files from the Windows 2000 Professional CD ROM to the shared folder
Perform unattended installations from the shared folder by using script files and then install the third party applications
D Create a shared folder on one of the servers
Copy the source files from the Windows 2000 Professional CD ROM to the shared folder
Perform attended installations from the shared folder and then select only the components you need for each department
Answer:A
53. Your company is deploying Windows 2000 Professional on a network of 300 computers. The network has two Windows 2000 Server computers. You have only enough Windows 2000 Professional licenses for 250 users. You need to restrict the deployment so that Windows 2000 Professional can be installed on only the licensed computers. You also need to minimize user intervention during the deployment and centralize the installation files What should you do?
A Create a shared folder on one of the servers
Copy the source files from the Windows 2000 Professional CD ROM to the shared folder
Allow users to perform attended installations from the shared folder on only the licensed computers
B Install RIS on one of the servers
Create user accounts for all the licensed users
Configure the RIS server to accept connections from only known computers
Perform unattended installations for all connecting computers
C Create a shared folder on one of the servers
Restrict access to the share so that only 250 users can connect
Copy the source files of the Windows 2000 Professional CD ROM to the shared folder
Allow users to perform unattended installations from the shared folder
D Install RIS on one of the servers
Create computer accounts in the domain for only the licensed computers
Configure the RIS server to accept connections from only known computers
Perform unattended installations for all connecting computers
Answer:D
54. You are the administrator of a Windows 2000 domain. The domain has an organizational unit (OU) named Staff. Users in the Staff OU frequently work on different Windows 2000 Professional computers. All Windows 2000 Professional computers are in the domain. The domain also has a Windows 2000 Server computer named ServerA. You want to accomplish the following goals: Users in the Staff OU will receive their user profile settings at every Windows 2000 Professional computer in the domain Each user in the Staff OU will be able to gain access to the documents in the user’s My Documents folder from any Windows 2000 Professional computer in the domain. To reduce network traffic documents in users’ My Documents folders will not be automatically copied to or from the server when users log on to or log on of the domain. What should you do? (Choose all that apply)
A Configure a roaming profile for each user in the Staff OU
Use \ServerA%Username% as the profile path
B Create a new Group Policy object (GPO) named Profile
Assign the Profile GPO to the Staff OU
Configure the Profile GPO to redirect the Desktop folder to \ServerA%Username%
C Create a new Group Policy object (GPO) named Redirect
Assign the Redirect GPO to the Staff OU
Configure the Redirect GPO to redirect the My Documents folder to \ServerA%Username%
D On the Windows 2000 Professional computers share the My Documents folder.
Configure the My Documents share to prevent files in the shared folder from being cached
Answer:A,C
55. You are the administrator of a Windows 2000 domain. The domain has a Windows 2000 Server computer named Central. Users in the domain frequently work on different Windows 2000 Professional desktop and portable computers. They use the Windows 2000 Professional portable computers to dial in to the network when they are traveling. All Windows 2000 Professional computers are in the domain. You want to accomplish the following goals: All users in the domain will be able to work on all Windows 2000 Professional desktop and portable computers and have their own desktop settings available on all computers. All users in the domain will be able to access their documents in the My Documents folder from any computer including the portable computers when users dial in to the network. When users dial in to the network the logon and logon times will not be delayed because of the transfer of the contents of the My Documents folder. What should you do? (Choose two)
A Configure a roaming profile for each user in the domain
Use \Central%Username% as the profile path
B Configure a home folder for each user in the domain
Use \Central%Username% as the home folder path
C Create a new Group Policy object (GPO) named Offdocs
Assign the Offdocs GPO to the domain
Configure the Offdocs GPO to Prevent the use of the Offline Files folder
D Create a new Group Policy object (GPO) named Redocs
Assign the Redocs GPO to the domain
Configure the Redocs GPO to redirect the My Documents folder to the \Central%Username% location
E Create a new Group Policy object (GPO) named Async
Assign the Async GPO to the domain
Configure the Async GPO to apply Group Policy settings for users asynchronously when they log on
Answer:A,D
56. Your company’s Windows 2000 domain contains an organizational unit (OU) named Shipping. The domain is in native mode. You want to delegate the control of Group Policy settings for the Shipping OU to a global group named Help Desk. Members of the Help Desk group need to be able to create and edit new Group Policy objects (GPOs) and assign these GPOs to the Shipping OU. You do not want these members to assign GPOs to other Ous. What should you do? (Choose two)
A Add the Help Desk group to the Group Policy Creator Owners security group
B Create a new security group named Group Policy Administrators in the Shipping OU.
Add the Help Desk group to this new group
C On existing GPOs assign Read and Write permissions to the Help Desk group
D On the Shipping OU, assign the Apply Group Policy permission to the Help Desk group
E On the Shipping OU, delegate the predefined task named Manage Group Policy links to the Help Desk group
F On all the OUs in the domain except the Shipping OU deny Write permission to the Help Desk group
Answer:A,E
57. You are the administrator for your company. You are deploying Windows 2000 Professional on your network by using RIS. Your company has several departments. To expedite the deployment of Windows 2000 and other third party applications, you have created a group named Department Managers. You want to allow members of the Department Managers group access to create custom images and post them to the RIS server for deployment. In addition, you want to allow members of the group to install client computers from the RIS server. What should you do?
A Grant the Department Managers group Read and Write permissions to the Remoteinstall folder
B Grant the Department Managers group Read and Write permissions to the OSChooser folder
C Grant the Department Managers group Full Control permission to RIPrep.exe
D Grant the Department Managers group Full Control permission to the SysPrep utility
E Grant the Department Managers group Read and Write permissions to the Admin folder
Answer:A
58. You are the administrator of a Windows 2000 network. You are configuring RIS to deploy Windows 2000 Professional on new client computers. New users report that when they attempt to install their computers, they are unable to receive an IP address. What should you do?
A Authorize the DHCP server in the DHCP console
B Configure each computer to boot from a remote installation boot disk
C Create a reservation in DHCP for each computer
D Start the Boot Information Negotiation Layer (BINL) service on the RIS server
Answer:A
59. You are the administrator of a Windows 2000 domain. You want to deploy an application named Travel that will be used by all users in the domain. The vendor of the application did not provide a Microsoft Windows Installer package for the application. When the application is installed it uses the .tvl file name extension. You want to use Group Policy to deploy the application. You want to accomplish the following goals: Users will be able to install the application by using Add/Remove Programs. Users will be able to install the application by using a Start menu shorcut. Users will be able to install the application by using document invocation. The application will be automatically reinstalled if key application files are missing.You take the following actions: Create a zero administration package (.zap) text: file that specifies how to install the Travel application. Copy the zap file to a shared folder on the network. Create a new Group Policy object (GPO) named Install Travel and assign the Install Travel GPO to the domain. Configure the Install Travel GPO to publish the Travel application to users by using the .zap file. Which result or results do these actions produce? (Choose all that apply)
A Users can install the application by using Add/Remove Programs
B Users can install the application by using a Start menu shortcut
C Users can install the application by using document invocation
D The application is automatically reinstalled if key application files are missing
Answer:A,C
60. You are the administrator of a Windows 2000 domain. You want to deploy a new application named Finance that will be used by all users in the domain. The vendor of the Finance application supplied a Microsoft Windows Installer package for the application. You decide to deploy the Finance application in two phases. During phase 1 only members of a security group named Finance Pilot will use the Finance application. During phase 2 all users in the domain will be able to install the Finance application. You want to accomplish the following goals: During phase 1 the Finance application will not be installed automatically when users log on. During phase 1 users who are members of the Finance Pilot group will be able to install the Finance application by using a Start menu shortcut. During phase 1 users who are not members of the Finance Pilot group will not be able to install the Finance application by using a Start menu shortcut. The Finance application will be installed automatically the first time any user in the domain logs on after phase 2 has begun. You take the following actions: Create a new Group Policy object (GPO) named Deploy Finance and link the Deploy Finance GPO to the domain. Configure the Deploy Finance GPO to assign the Finance application to users. For phase 1 create a software category named Finance Pilot. Assign the Finance application to the Finance Pilot software category. For phase 2 remove the Finance application from the Finance Pilot software category. Which result or results do these actions produce? (Choose all that apply)
A During phase 1 the Finance application is not installed automatically when users log on
B During phase 1 users who are members of the Finance Pilot group can install the Finance application by using a Start menu shortcut
C During phase 1 users who are not members of the Finance Pilot group cannot install the Finance application by using a Start menu shortcut
D The Finance application is installed automatically the first time any user in the domain logs on after phase 2 has begun
Answer:A,B
61. You are the administrator for Cone Vineyard. You are using RIS to deploy Windows 2000 on your network. You want to direct your client computers to specific RIS servers for deployment. You cannot find the GUIDs on several of the client computers. You need the GUIDs to finish your deployment process. What should you do?
A Use network Monitor to capture the DHCPDiscover frames from the client computers. Search the data fields for the GUIDs in hexadecimal format
B Use network Monitor to capture the DNS frames from the client computers. Search the data fields for the GUIDs in hexadecimal format
C Use network Monitor to capture the DHCPRequest frames from the client computers. Search the data fields for the GUIDs in hexadecimal format
D Use network Monitor to capture the DHCPOffer frames from the client computers. Search the data fields for the GUIDs in hexadecimal format
Answer:A
62. You are the administrator of a Windows 2000 domain. The domain has an organizational unit (OU) named Help Desk. A Group Policy object (GPO) named Disable Regedit is assigned to the Help Desk OU. The only policy setting defined in the Disable Regedit GPO is the policy setting that disables the use of registry editing tools. For performance reasons your company wants to minimize the number of GPOs that are processed at logon. The company also decides that the restriction on the use of the registry editing tools must no longer apply to the users in the Help Desk OU. What should you do to accomplish these goals?
A Remove the Disable Regedit GPO from the Help Desk OU
B Assign a new GPO to the Help Desk OU that enables the use of registry editing tools
C On the computers used by users in the Help Desk OU, edit the registry to allow the use of registry editing tools
D On the computers used by users in the Help Desk OU, configure the local GPO to allow the use of registry editing tools
E On the computers used by users in the Help Desk OU, delete the Registry.pol file from the Systemrootfolder
Answer:A
63. You are the administrator of a Windows 2000 network. Recently, your network security was compromised and confidential data was lost. You are now implementing a stricter network security policy. You want to require encrypted TCP/IP communication on your network. What should you do?
A Create a Group Policy object (GPO) for the domain and configure it to assign the Secure Server IPSec Policy
B Create a Group Policy object (GPO) for the domain and configure it to assign the Server IPSec Policy and to enable Secure channel: Require strong session key
C Implement TCP/IP packet filtering, and open only the ports required for your network services
D Edit the local security policies on the servers and client computers, and enable Digitally sign client and server communications
Answer:A
64. You are the administrator of a Windows 2000 network for Lucerne Real Estate. The network has 1200 users. You are delegating part of the administration of the domain to three users. You delegate the authority to create and delete computer accounts to Caries. You delegate the authority to change user account information to Juld. You delegate the ability to add client computers to the domain to Peter. You want to track the changes made to the directory by these three users. What should you do?
A Create a Group Policy object (GPO) for the domain controllers
Assign Read and Apply Group Policy permissions to only Caries Juld and Peter
Configure the GPO to audit directory services access and account management
B Create a Group Policy object (GPO) for the domain
Assign Read and Apply Group Policy permissions to only Caries Juld and Peter
Configure the GPO to audit directory services access and audit object access
C Create a Group Policy object (GPO) for the domain controllers
Assign Read and Apply Group Policy permissions to only Caries Juld and Peter
Configure the GPO to audit directory services access and audit object access
D Create a Group Policy object (GPO) for the domain
Assign Read and Apply Group Policy permissions to only Caries Juld and Peter
Configure the GPO to audit object access and process tracking
Answer:A
65. You are the administrator of your company’s network. Your event log shows that hackers are using brute force attacks to attempt to gain access to your network. You do not want user accounts to be easily accessible. You want to strengthen security to protect against brute force attacks. What should you do? (Choose two)
A Enable the Users must log on to change the password setting
B Enable the Store password using reversible encryption for all users in the domain setting
C Enable the Password must meet complexity requirements setting
D Increase minimum password length
E Increase minimum password age
Answer:C,D
66. You are the administrator of a newly installed Windows 2000 network for a call center. You need to rename the Administrator account on all computers on your network. You do not want to manually edit each account. Because of a recent security breach, you must implement this policy immediately. What should you do? (Choose all that apply)
A Use Group Policy to rename the Administrator account at the Default Domain Group policy
B Use Group Policy to implement a user logon script
C Send a network message to all users to restart their computers
D Use Group Policy to force all users to log off within 30 minutes
Answer:A,C
67. You are the administrator of your company’s network. The network consists of one Windows 2000 domain that has organizational units (OUs) as shown in the exhibit (Click the Exhibit button ). All domain controllers in the domain are in OU1. Resources for two separate office buildings are in OU2 and OU3. Nonadminnistrative users, groups and computers are in OU4 and OU5. Administrative users, computers and resources are in OU6. You are designing a domain wide security policy. You want to accomplish the following goals: The same password and account lockout policies will be applied to all users Different security settings will be applied to administrative and nonadministrative computers. Strict audit policies will be enforced for only domain controllers and servers. The number of Group Policy object (GPO) links will be minimized. You take the following actions: Create a single GPO. Create one security template that has all required spores. Imago the security template into the GPO. Link the GPO to the domain. Which result or results do these actions produce? (Choose all that apply)
A The same password and account lockout policies are applied to all users
B Different security spores are applied to administrative and nonadminnistrative computers
C Strict audit policies are enforced for only domain controllers and servers
D The number of GPO links is minimized
Answer:A,D
68. You are the network administrator for Arbor Shoes. Part of your multisite Windows 2000 network configuration is shown in the exhibit (Click the Exhibit button) Server1 is configured with the primary zone for arborshoes.com. Server3 and Server5 are configured with secondary zones for arborshoes.com. You discover an error in several host records that is preventing client computers in Atlanta from accessing some shared resources. You make the necessary corrections on Server1. You want these changes to be propagated to Atlanta immediately What should you do?
A On the Action menu for the arborshoes.com zone, click Update Server Data Files
B At Server5, perform the Transfer from master action for the arborshoes.com zone
C At Server1, stop and start the DNS Server service
D At Server5, select Allow zone transfers on the arborshoes.com zone
Answer:B
