Microsoft Windows Server 2008, Server Administrator - 70-646 Exam Questions

QUESTION NO: 1
Baldwin Museum of Science
You need to recommend a solution for controlling access to the Internet.
The solution must meet the museum's security policy. What should you include in the recommendation?
Case Study Title (Case Study): COMPANY OVERVIEW
The Baldwin Museum of Science is an internationally renowned museum of science history.
Physical Location
The museum has a main office and a branch office named Branch1. The main office has 5,000 users. Branch1 has 1,000 users.
The main office connects to Branch1 by using a WAN link. The WAN link is highly saturated.
The museum has a sales department. All of the users in the sales department have client computers that run Windows XP Service Pack 3 (SP3).
EXISTING ENVIRONMENT Active Directory Environment
The network contains one Active Directory forest. The forest contains two domains named baldwinmuseumofscience.com and ad.baldwinmuseumofscience.com.
All user accounts and computer accounts for all employees are in the ad.baldwinmuseumofscience.com domain. The organizational unit (OU) structure for ad.baldwinmuseumofscience.com is shown:

Network Infrastructure
The network contains the following servers and Applications:
Application servers that run either Windows Server 2003 Service Pack 2 (SP2), Windows Server 2008 SP2, or Windows Server 2008 R2.
A custom Application named App1 that runs on all of the Application servers. App1 writes events to the Application log.
A line-of-business Application named App2 that requires Internet Explorer 6. All of the users in the sales department run App2.
File servers that run Windows Server 2008 R2. The main office has the following:
A two-node failover cluster that runs Windows Server 2008 R2 and has the Hyper-V role installed and a Clustered Shared Volume. The failover cluster hosts four virtual machines (VM) that run Windows Server 2008 R2. The VMs are stored on the Clustered Shared Volume. Each VM runs Microsoft SQL Server 2008.
A server named Server1 that hosts two shared folders named Share1 and Share2. Share1 hosts 50,000 research documents that are shared by multiple users. Share2 hosts documents that are created by users in the sales department.
Administration Model
All users in Branch1 are members of global groups and universal groups. The groups are located in an OU named Groups in the ad.baldwinmuseumofscience.com domain.
REQUIREMENTS Planned Changes
The Baldwin Museum of Science plans to implement a new branch office named Branch2.
Branch2 will be configured as a separate Active Directory site.
Branch2 will be configured to meet the following requirements:
Minimize the cost of deploying new servers.
Contain only client computers that run Windows 7.
Connect to the main office by using a saturated WAN link.
Contain only servers that run Windows Server 2008 R2. The servers will be configured as either file
servers or Web servers. The file shares on the file servers must be available if a single file server fails. In Branch2, if a single domain controller or a WAN link fails, users in the branch must be able to:
Change their passwords.
Log on to their client computers.
Technical Requirements
The Baldwin Museum of Science must meet the following technical requirements:
Hardware and software costs must be minimized whenever possible.
All VMs must be backed up twice a day.
All VM backups must include the VM configuration information.
Events generated by App1 must be stored in a central location.
An administrator must be notified by e-mail when App1 generates an error.
The number of permissions assigned to help desk technicians must be minimized.
The help desk technicians must be able to reset the passwords and modify the membership of all users in Branch1.
If a user overwrites another user's research document, the user must be able to recover a previous version of the document.
When users in the sales department work remotely, they must be able to access the files in Share1 in the minimum amount of time.
Security
The Baldwin Museum of Science must meet the following security requirements:
All scripts that run on production servers must be signed.
Managers in Branch1 must be allowed to access the Internet at all times.
Web site administrators must not be required to log on interactively to Web servers.
Users in Branch1 must only be allowed to access the Internet between 12:00 and 13:00.
Users and managers must be prevented from downloading executable files from the Internet.
Administration of the corporate Web sites must support all bulk changes and scheduled content
updates.

QUESTION NO: 2
Your network consists of a single Active Directory domain. All servers run Windows Server 2008 R2. All client computers run Windows 7.
Users store all of their files in their Documents folder. Many users store large files.
You plan to implement roaming user profiles for all users by using Group Policy. You need to recommend a solution that minimizes the amount of time it takes users to log on and log off of the computers that use the roaming user profiles.
What should you recommend?

QUESTION NO: 3
Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2.
You need to plan an auditing strategy that meets the following requirements:
Audits all changes to Active Directory Domain Services (AD DS).
Stores all auditing data in a central location. What should you include in your plan?

QUESTION NO: 4
Testlet: Blue Yonder Airlines
You need to implement a solution for the branch office file servers that meets the company's technical requirements.
What should you implement on the branch office file servers?
Case Study Title (Case Study): COMPANY OVERVIEW
Blue Yonder Airlines has a main office and four branch offices. Each branch office has six satellite offices. The main office is located in Sydney. The branch offices are located in London, New York, Bangkok, and Istanbul. The main office has 1,000 users. Each branch office has 500 users. Each satellite office has 50 to 100 users.
PLANNED CHANGES
Each satellite office will have a single server deployed. The servers will have the following server roles installed:
File server
Print server
Read-only Domain Controller (RODC)
Each satellite office will have a local support technician who performs the following tasks:
Manages printers.
Manages server backups.
Manages updates on the server.
Each support technician will only be permitted to manage the server located in his office.
You plan to implement a backup and recovery solution to restore deleted Active Directory objects. The solution must ensure that the attributes of the deleted objects are restored to the same state they were in before they were deleted.
You plan to deploy a custom sales application named App2 to the portable computers of all company sales consultants. The setup program of App2 requires local administrative privileges. App2 will be updated monthly.
BUSINESS GOALS
Blue Yonder Airlines has the following business goals:
Minimize server downtime.
Minimize administrative effort.
Minimize interruptions to users caused by WAN link failures.
EXISTING ENVIRONMENT
The network contains servers that run either Windows Server 2008 R2 or Windows Server 2008. All client computers were recently replaced with new computers that run Windows 7 Enterprise.
Users do not have local administrator rights on the client computers.
Existing Active Directory/Directory Services
The network contains a single Active Directory domain named blueyonderairlines.com. The functional level of the domain is Windows Server 2008. All domain controllers run Windows Server 2008.
Existing Network Infrastructure
All offices have wired and wireless networks.
The main office has a file server that stores large graphics files. The files are used by all of the users in all of the offices.
A Group Policy is used to assign an application named App1 to all of the users in the domain.
The branch offices contain public computers on which temporary employees can browse the Internet and view electronic brochures. When the employees log on to the public computers, they must all receive the same user settings.
App1 must not be installed on the public computers. The computer accounts for all of the public computers are in an organizational unit (OU) name Public.
REQUIREMENTS Security Requirements
All computers in the domain must have a domain-level security Group Policy object (GPO) applied.
You plan to implement Network Access Protection (NAP) by using switches and wireless access points (WAPs) as NAP enforcement points.
The public computers must meet the following security requirements:
Only authorized applications must be run.
Automatic updates must be enabled and applied automatically.
Users must be denied access to the local hard disk drives and the network shares from the public computers.
Technical Requirements
The file server in each branch office is configured as shown in the following table.

Each user is allocated 1 GB of storage on the Users share in their local office.
Each user must be prevented from storing files larger than 500 MB on the Data share in their local office.
Blue Yonder Airlines must meet the following requirements for managing App2:
Sales consultants must use the latest version of the application.
When a new version of App2 is installed, the previous version must be uninstalled. Sales consultants must be able to run App2 when they are disconnected from the network.

QUESTION NO: 5
You need to recommend a Windows Server 2008 R2 server configuration that meets the following requirements:
Supports the installation of Microsoft SQL Server 2008.
Provides redundancy for SQL services if a single server fails. What should you recommend?

QUESTION NO: 6
Testlet: School of Fine Art
You need to recommend changes to the file server on the main campus that meet the company's technical requirements.
What should you include in the recommendation?
Case Study Title (Case Study): COMPANY OVERVIEW
School of Fine Art is an educational institution that has a main campus and two satellite campuses.
The main campus is located in New York. The satellite campuses are located in Los Angeles and Chicago.
The main campus has approximately 4,000 users made up of students, faculty, and employees. Each satellite campus has approximately 1,000 users made up of students, faculty, and employees.
EXISTING ENVIRONMENT
The network contains a single Active Directory domain named fineartschool.net.
All servers run Windows Server 2008 R2. All client computers run either Windows XP or Windows 7.
The network contains Microsoft Application Virtualization (App-V) and Microsoft Enterprise Desktop Virtualization (MED-V).
Existing Network Infrastructure
The main campus has the following servers:
A file server that contains confidential files.
A print server that has several printers installed.
A server that has the Windows Server Update Services (WSUS) server role installed. All client computers are updated by using the WSUS server.
The main campus has a computer lab. The lab has 50 client computers that run Windows 7 Enterprise.
The computer accounts for the lab computers are located in an organizational unit (OU) named LabOU. The user accounts and computer accounts for all of the students are located in an OU named StudentsOU. Both OUs are child objects in the fineartschool.net domain.
The relevant Group Policy objects (GPOs) are configured as shown in the following table.

REQUIREMENTS Technical Requirements
The computer lab must meet the following requirements:
Ensure that the user settings in all domain-level GPOs are applied to each student.
Prevent the settings in all domain-level GPOs from being applied to the client computers in the computer
lab. The update management infrastructure must meet the following requirements:
Each campus must control the updates for its respective campus.
Update status reports must be sent weekly to the Enterprise Administrator on the main campus.
Application Requirements
All client computers will be upgraded to Windows 7 Enterprise.
An application named App1 runs on every client computer. App1 is only compatible with Windows XP. App1 must remain available after all of the operating system upgrades are complete.
App1 must meet the following requirements:
App1 must be available from the Start menu.
The management of App1 must be centralized.
Each user must have a unique instance of App1.
Security Requirements
Security for the file server on the main campus must meet the following requirements:
Unauthorized users must be prevented from printing sensitive files stored on the server.
The contents of the server's hard disks must remain secure if the physical security of the server is compromised.
Problem Statements
Users report that they receive a different desktop environment every time they log on to a client computer in the computer lab.
The print server on the main campus has reliability issues. A malfunction on a single printer often causes other printers to malfunction.

QUESTION NO: 7
Testlet: Tailspin Toys
You need to recommend a solution to meet the certificate distribution requirements.
What should you recommend?
Case Study Title (Case Study): General Background
You are the Windows Server Administrator for Tailspin Toys. Tailspin Toys has a main office and a manufacturing office.
Tailspin Toys recently acquired Wingtip Toys and is in the beginning stages of Merging the IT environments. Wingtip Toys has a main office and a sales office.
Technical Background
The companies use the network subnets indicated in the following table: The Tailspin Toys network and the Wingtip Toys are connected by a point-to-point dedicated 45 Mbps circuit that terminates in the main offices.

The current Tailspin Toys server topology is shown in the following table:

The Tailspin Toys environment has the following characteristics: All servers are joined to the tailspintoys.com domain. In the Default Domain Policy, the Retain old events Group Policy setting is enabled. An Active Directory security group named "Windows System Administrators" is used to control all files and folders on TT-PRINT01. A Tailspin Toys administrator named Marx has been delegated rights to multiple Organizational Units (OUs) and object in the tailspintoys.com domain. Tailspin Toys developers use Hyper-V Virtual Machines (VM's) for development. There are 10 development VM's named TT-DEV01 to TT-DEV20.
The current Wingtip Toys server topology is shown in the following table: All servers in the Wingtip Toys environment are joined to the wingtiptoys.com domain.

Infrastructure Services
You must ensure that the following infrastructure services requirements are met:
All domain zones must be stored as Active Directory-integrated zones.
Only DNS servers located in the Tailspin Toys main offices may communicate with the DNS servers at Wingtip Toys.
Only DNS servers located in the Wingtip Toys main offices may communicate with the DNS servers at Tailspin Toys
All tailspintoys.com resources must be resolved from the Wingtip Toys offices.
All wingtiptoys.com resources must be resolved from the Tailspin toys offices.
Certificates must be distributed automatically to all Tailspin Toys and Wingtip Toys computers.
Delegated Administration
You must ensure that the following delegated administration requirements are met: Tailspin Toys IT security administrators must be able to create, modify and delete user objects in the wingtip.com domain.
Members of the Domain Admins Group in the tailspintoys.com domain must have full access to the wingtiptoys.com Active Directory environment.
A delegation policy must grant minimum access rights and simplify the process of delegating rights.
Minimum permissions must always be delegated to ensure that the least privilege is granted for a job task.
Members of the TAILSPINTOYS\Helpdesk group must be able to update drivers and add printer ports on TT-PRINT01.
Members of the TAILSPINTOYS\Helpdesk group must not be able to cancel a print job on TT-PRINT01.
Tailspin Toys developers must be able to start, stop and apply snapshots to their development VM's.
IT Security
Server security must be automated to ensure that newly deployed servers automatically have the same security configurations as existing servers.
Auditing must be configured to ensure that the deletion of users objects and OUs is logged.
Microsoft Word and Microsoft Excel files must be automatically encrypted when uploaded to the
Confidential documents library on the Tailspin Toys Microsoft SharePoint site.
Multi factor authentication must control access to Tailspin Toys domain controllers.
All file and folder auditing must capture the reason for access.
All folder auditing must capture all delete actions for all existing folders and newly created folders.
New events must be written to the Security event log in the tailspintoys.com domain and retained
indefinitely.
Drive X:\ on the TT-FILE01 must be encrypted by using Windows BitLocker Drive Encryption and must be automatically unlock.

QUESTION NO: 8
Testlet: Woodgrove Bank
You need to recommend a solution for deploying App1. The solution must support the company's planned changes.
What should you include in the recommendation?
Case Study Title (Case Study): COMPANY OVERVIEW Overview
Woodgrove Bank is an international financial organization.
Physical Location
The company has a main office and multiple branch offices.
EXISTING ENVIRONMENT Active Directory Environment
The network contains one Active Directory forest. A separate domain exists for each office.
Network Infrastructure
All offices have domain controllers that are configured as DNS servers. All client computers are configured to connect to the DNS servers in their respective office only.
The main office has the following servers and client computers:
One Windows Server Update Services (WSUS) server.
Client computers that run either Windows XP Service Pack 3 (SP3) or Windows 7.
Ten file servers host multiple shared folders. The file servers run either Windows Server 2003 or
Windows Server 2008 R2.
One domain-based Distributed File System (DFS) namespace that has two replicas. The DFS servers
run Windows Server 2008 R2. The DFS namespace is configured to use Windows 2000 Server mode. Each branch office has a WAN link to the main office. The WAN links are highly saturated. Each office has a dedicated high-speed Internet connection.
All of the client computers in the branch offices run Windows 7.
User Problems
Users report that it is difficult to find the shared folders on the network.
REQUIREMENTS Planned Changes
Woodgrove Bank plans to implement the following changes:
Deploy a new application named App1 on each client computer. App1 has a Windows Installer package and is compatible with Windows XP, Windows Vista, and Windows 7.
Designate a user in each office to manage the address information of the user accounts in that office.
Deploy a new branch office named Branch22 that has the following servers: One file server named Server1 & Two domain controllers named DC10 and DC11 that are configured as DNS servers.
Technical Requirements
Woodgrove Bank must meet the following technical requirements:
Minimize hardware and software costs, whenever possible.
Encrypt all DNS replication traffic between the DNS servers.
Ensure that users in the branch offices can access the DFS targets if a WAN link fails.
Ensure that users can only view the list of DFS targets to which they are assigned permissions.
Minimize the amount of network traffic between the main office and the branch offices, whenever possible.
Minimize the amount of name resolution traffic from the branch offices to the DNS servers in the main office.
Ensure that the administrators in the main office manage all Windows update approvals and all
computer groups.
Manage all of the share permissions and the folder permissions for the file servers from a single
management console.
Ensure that if a file on a file server is deleted accidentally, users can revert to a previous version of the file without administrator intervention.
Ensure that administrators are notified by e-mail each time a user successfully copies a file that has an .avi extension to one of the file servers.
Security Requirements
Woodgrove Bank must meet the following security requirements:
Access rights and user rights must be minimized.
The Guest account must be disabled on all servers.
Internet Information Services (IIS) must only be installed on authorized servers.

QUESTION NO: 9
Testlet: A, Datum
You need to recommend a security strategy for WebApp2 that meets the company's application requirements.
What should you include in the recommendation?
Case Study Title (Case Study): COMPANY OVERVIEW
A, Datum Corporation is a manufacturing company that has a main office and two branch offices.
The main office is located in Denver. The branch offices are located in New York and Montreal.
The main office has 10,000 users. Each branch office has approximately 200 users.
PLANNED CHANGES
A, Datum plans to deploy a new intranet site named Site1 in the main office. Two servers that run a Server Core installation of Windows Server 2008 R2 are requisitioned for the deployment of Site1.
You plan to deploy a domain controller in each office.
You have a new server named Backup1. All servers will be backed up remotely by using Windows Server Backup on Backup1.
BUSINESS GOALS
A Datum has the following business goals:
Changes to the environment must minimize costs.
Changes to the environment must optimize the use of new hardware.
The costs to manage the network infrastructure and the servers must be minimized.
EXISTING ENVIRONMENT
All servers run Windows Server 2008 R2. All client computers run Windows 7 Enterprise.
The network contains a Web server named Web1. Web1 is located in the perimeter network and is accessible from the internal network and the Internet. Web1 runs a Server Core installation of Windows Server 2008 R2 Standard.
Existing Active Directory/Directory Services
The network contains a single Active Directory domain named adatum.com.
The main office has two domain controllers.
Existing Network Infrastructure
Each office has a file server.
The main office connects to each branch office by using a WAN link. Users in the branch offices frequently access the file server in the main office.
Current Administration Model
All domain administrators work in the main office and remotely manage the servers by using their Windows 7 computers.
A group named BranchAdmins has the rights to manage all of the client computers in the branch offices.
You have several ADMX files that contain custom application settings.
REQUIREMENTS Security Requirements
The BranchAdmins group members must be able to install updates and drivers on the domain
controllers in the branch offices.
Passwords must not be stored by using reversible encryption.
All authentication traffic on the network must be encrypted.
Application Requirements
A new application named WebApp2 must be deployed on Web1. The WebApp2 deployment must meet the following requirements:
Users must be authenticated to access WebApp2.
WebApp2 must support Web browsers from various vendors.
WebApp2 must be accessible to internal users and Internet users.
A failure of WebApp2 must not cause other Web applications to fail.
Internet users must be required to configure the minimum number of changes on their client computers
to access WebApp2. Site1 must be configured to meet the following requirements:
Site1 must support the most user connections possible.
Site1 must be backed up every day by a remote server,
If a single Web server fails, users must be able to access Site1.
If a single Web server fails, users must not receive an error message when they access Site1.
Technical Requirements
You must ensure that domain administrators can access the ADMX files from any client computer that they use to manage Group Policies.
You must ensure that the domain administrators are notified by e-mail each time a user copies video files to the file servers.

QUESTION NO: 10
Your network contains a Web-based application that runs on Windows Server 2003. You plan to migrate the Web-based application to Windows Server 2008 R2. You need to recommend a server configuration to support the Web-based application.
The server configuration must meet the following requirements:
Ensure that the application is available to all users if a single server fails.
Support the installation of .NET applications.
Minimize software costs. What should you recommend?

QUESTION NO: 11
Your network consists of an Active Directory domain. The domain controllers run Windows Server 2008 R2. Client computers run Windows 7.
You need to implement Encrypting File System (EFS) for all client computers.
You want to achieve this goal while meeting the following requirements:
You must minimize the amount of data that is transferred across the network when a user logs on to or
off from a client computer.
Users must be able to access their EFS certificates on any client computers.
If a client computer's disk fails, EFS certificates must be accessible. What should you do?

QUESTION NO: 12
Testlet: Wingtip Toys
http://technet.microsoft.com/en-us/library/dd548356(v=ws.10).aspx
You need to recommend a solution for storing user documents.
What should you include in the recommendation?
Case Study Title (Case Study): COMPANY OVERVIEW
Wingtip Toys is an international company that has a main office and several branch offices. The main office is located in Moscow. The branch offices are located throughout Europe. The main office has 500 users. Each branch office has 4 to 70 users.
PLANNED CHANGES
Wingtip Toys opens a new branch office that contains a file server. You plan to promote the file server to a Read-only Domain Controller (RODC).
Wingtip Toys plans to hire a consulting firm to manage its Web site. The consulting firm must only be permitted to manage the Web site and must be prevented from accessing to all other server resources.
Wingtip Toys plans to purchase a high-resolution printer that will be connected to a print server in the main office. Users must be charged for each page that they print on the printer.
You plan to present additional storage to a two node failover cluster in the main office. The storage will be used by the file server instance.
EXISTING ENVIRONMENT
All servers run either Windows Server 2008 or Windows Server 2008 R2. All client computers run either Windows Vista Enterprise or Windows 7 Enterprise.
Existing Network Infrastructure
The network contains an internal network and a perimeter network.
The company Web site is hosted on a standalone server in the perimeter network.
The main office connects to each branch office by using a 1-Mbps WAN link.
Existing Active Directory Environment
The network contains a single Active Directory domain named wingtiptoys.com. An Active Directory site exists for each office. Each Active Directory site contains a single subnet.
The main office has two domain controllers. Each branch office has a single domain controller.
REQUIREMENTS Technical Requirements
Wingtip Toys must meet the following technical requirements:
Minimize network utilization.
Minimize WAN link utilization.
Ensure that the file servers can access additional storage as a local drive.
Ensure that changes to the network are transparent to users whenever possible.
Ensure that new storage solutions are supported by Windows Failover Clustering.
Ensure that each user can access his Documents folder from any client computer.
Automatically organize the files on the file servers according to the contents of the files.
Ensure that storage can be provisioned without causing any downtime of the file servers.
Ensure that the data on the file servers is protected by using Windows BitLocker Drive Encryption
(BitLocker).
Problem Statements
All users store their documents and other data in the Documents folder on their respective client computers. The users report that when they log on to a computer that is not their own, their documents are unavailable.

QUESTION NO: 13
Your network consists of a single Active Directory domain.
Your network contains 10 servers and 500 client computers. All domain controllers run Windows Server 2008 R2. A Windows Server 2008 R2 server has Remote Desktop Services installed. All client computers run Windows XP Service Pack 3.
You plan to deploy a new line of business application. The application requires desktop themes to be enabled.
You need to recommend a deployment strategy that meets the following requirements:
Only authorized users must be allowed to access the application.
Authorized users must be able to access the application from any client computer.
Your strategy must minimize changes to the client computers.
Your strategy must minimize software costs. What should you recommend?