Microsoft 70-647 - Questions & Answers

To ensure that the other applications are distributed to all existing and new users on the network, you need to create a new group for each department and filter the InstallApp GPO to each group. Filtering allows you to target only specific computers or users. You can create and modify multiple preference items within each GPO, and you can filter each preference item to target only specific computers or users. Finally to simplify the distribution of the licensed application to the users of the sales department, you need to create and link a new GPO to the domain and filter the new GPO to the Sales group.
You should not filter the InstallApp GPO to the Marketing group and the Development groups only because all the other applications beside the licensed application need to be installed to the Sales department also.
References:
Group Policy/ Preferences (http://technet2.microsoft.com/windowsserver2008/en/library/3b4568bc-9d3c-4477-807d-2ea149ff06491033.mspx?mfr=true)

To recommend a certificate solution for the network routers that would enable the routers to automatically request certificates and that would use Simple Certificate Enrollment Protocol (SCEP), you need to implement Network Device Enrollment Service on Server2.

The Network Device Enrollment Service allows routers and other network devices to obtain certificates based on the Simple Certificate Enrollment Protocol (SCEP) from Cisco Systems Inc.

References:
Windows Server Active Directory Certificate Services Step-by-Step Guide/ AD CS Technology Review (http://technet2.microsoft.com/windowsserver2008/en/library/f7dfccc0-4f65-4d6f-a801-ae6a87fd174c1033.mspx?mfr=true)

To implement a solution that enables remote users to access network resources by using TS Gateway, you need to create a Terminal Services connection authorization policy (TS CAP) and a Terminal Services resource authorization policy (TS RAP). TS CAPs allow you to specify who can connect to a TS Gateway server. Users are granted access to a TS Gateway server if they meet the conditions specified in the TS CAP. You must also create a Terminal Services resource authorization policy (TS RAP). A TS RAP allows you to specify the internal network resources that users can connect to through TS Gateway. Until you create both a TS CAP and a TS RAP, users cannot connect to internal network resources through this TS Gateway server.
References:
Terminal Services Gateway (TS Gateway) / Why are TS CAPs important? (http://technet2.microsoft.com/windowsserver2008/en/library/9da3742f-699d-)
4476-b050- c50aa14aaf081033.mspx? mfr=true

Sometime DNS server can take an hour or more in companies that have extremely large zones and the DNS data of the company is stored in AD DS. The result is that the DNS server is effectively unavailable to service client requests for the entire time that it takes to load AD DS-based zones. The problem can be solved by upgrading the domain controllers to Windows Server 2008.
This is because a DNS server running Windows Server 2008 now loads zone data from AD DS in the background while it restarts so that it can respond to requests for data from other zones.

References:
DNS Server Role/ Background zone loading (http://technet2.microsoft.com/windowsserver2008/en/library/533a1cfc-5173-4248-914c-433bd018f66d1033.mspx?mfr=true)

To provide the UNIX-based client computers access to the file servers, you need to enable the User Name Mapping component and configure simple mapping and also enable a Network File System (NFS) component on the servers.
User Name Mapping (UNM) bridges the gap between the different user identification used in Windows and UNIX worlds. When UNM is used it in conjunction with Server for NFS, UNM authenticates the incoming NFS access requests. With Client for NFS, it determines the effective UID and GID to be sent with the NFS requests to UNIX NFS servers.

References:
Configuring User Name Mapping - Part 2 (Simple Mapping) (http://blogs.msdn.com/sfu/archive/2007/10/02/configuring-user-name-mapping-part-2-simple-mapping.aspx)

To allow branch office administrators to manage their local domain controller only, change device drivers, and run Windows updates, you need to add each branch office administrator to the local Administrators group of their respective domain controller. The users of Local administrator group have administrative rights on their local domain controllers to manage several machines to perform all necessary administrative tasks but they have restricted rights as compared to domain administrators.

References:
Adding a group to the local administrators group (http://blogcastrepository.com/blogs/kim_oppalfenss_systems_management_ideas/archive/2007/04/23/adding-a-group-to-the-local-administrators-group.aspx)

By default, all site links are bridged so that all the sites that are not connected by an explicit site link can communicate directly, through a chain of intermediary site links and sites. However, if you want to ensure that domain controllers in the spoke sites do not replicate with other spoke sites when a server fails in one of the hub sites, you need to disable the Bridge all site links option.
You need to then create site link bridges to create the site links between each spoke site and the hub sites to ensure that domain controllers in the spoke sites can replicate with domain controllers in the hub sites.

References:
Configuring site link bridges (http://technet2.microsoft.com/windowsserver/en/library/b42bb443-c5cd-4539-8dfa-917dbddb087a1033.mspx?mfr=true)

To achieve the desired results without requiring any additional cost, you need to use Microsoft Windows SharePoint Services (WSS) 3.0.

References:
Microsoft Windows SharePoint Services 3.0 and the Mobile Workplace (http://download.microsoft.com/download/b/b/6/bb6672dd-252c-4a21-89de-78cfc8e0b69e/WSS%20Mobile%20Workplace.doc)

To implement a GPO management strategy to ensure that the administrators can access the .admx files and any future updates to these files from each office and to ensure that the .admx files remain identical across the company, you need to create a central store in the domain and copy the custom .admx files to the central store.
The central store for ADMX files allows all local administrators to edit domain-based GPOs to access the same set of ADMX files. When a central store is created, the Group Policy tools will use the ADMX files only in the central store, ignoring the locally stored versions. You need to copy the custom .admx files to the central store and not add them because there need to be only one ADMX file and not multiple versions of the same file in the central store.

References:
Scenario 2: Editing Domain-Based GPOs Using ADMX Files (http://technet2.microsoft.com/WindowsVista/en/library/1494d791-72e1-484b-a67a-22f66fbf9d171033.mspx?mfr=true)

You should permit RPC traffic through the firewall to enable the domain controllers to replicate between the two sites because the Active Directory relies on remote procedure call (RPC) for replication between domain controllers. You can open the firewall wide to permit RPC's native dynamic behavior.

References:
Active Directory Replication over Firewalls (http://technet.microsoft.com/en-us/library/bb727063.aspx)