You have a Windows Server 2008 R2 Enterprise Root CA . Security policy prevents port 443 and port 80 from
being opened on domain controllers and on the issuing CA .
You need to allow users to request certificates from a Web interface. You install the Active DirectoryCertificate
Services (AD CS) server role.
What should you do next?

You need to relocate the existing user and computerobjects in your company to different organizational units.
What are two possible ways to achieve this goal? (Each correct answer presents a complete solution. Choose
two.)

Your network consists of an Active Directory forestnamed contoso.com. All servers run Windows Server 2008
R2. All domain controllers are configured as DNS servers. The contoso.com DNS zone is stored in the
ForestDnsZones Active Directory application partition.
You have a member server that contains a standard primary DNS zone for dev.contoso.com.
You need to ensure that all domain controllers can resolve names for dev.contoso.com.
What should you do?

Your company has a single Active Directory domain. All domain controllers run Windows Server 2003.
You install Windows Server 2008 R2 on a server.
You need to add the new server as a domain controller in your domain.
What should you do first?

Your company has a main office and three branch offices. Each office is configured as a separate Active
Directory site that has its own domain controller.
You disable an account that has administrative rights.
You need to immediately replicate the disabled account information to all sites.
What are two possible ways to achieve this goal? (Each correct answer presents a complete solution. Choose
two.)

Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2.
You need to capture all replication errors from alldomain controllers to a central location.
What should you do?

Your company has an Active Directory forest that contains client computers that run Windows Vista and
Microsoft Windows XP.
You need to ensure that users are able to install approved application updates on their computers.
Which two actions should you perform? (Each correctanswer presents part of the solution. Choose two.)

Your company has an Active Directory domain that has an organizational unit named Sales. The Sales
organizational unit contains two global security groups named sales managers and sales executives.
You need to apply desktop restrictions to the salesexecutives group.
You must not apply these desktop restrictions to the sales managers group.
You create a GPO named DesktopLockdown and link it to the Sales organizational unit.
What should you do next?

Your company network has an Active Directory forestthat has one parent domain and one child domain. The
child domain has two domain controllers that run Windows Server 2008. All user accounts from the child
domain are migrated to the parent domain. The childdomain is scheduled to be decommissioned.
You need to remove the child domain from the ActiveDirectory forest.
What are two possible ways to achieve this goal? (Each correct answer presents a complete solution. Choose
two.)

Your network consists of a single Active Directory domain. The domain contains 10 domain controllers. The
domain controllers run Windows Server 2008 R2 and are configured as DNS servers.
You plan to create a new Active Directory-integrated zone.
You need to ensure that the new zone is only replicated to four of your domain controllers.
What should you do first?