Question 1.
ITCertKeys has opened a new branch office where 10 standalone servers run Windows Server 2008. To keep the servers updated with latest updates, you install WSUS on a server named ITCertKeys 3. 

Which of the following actions would you perform next to configure all of the servers to receive updates from ITCertKeys 3?

A. Use Control Panel to configure the Windows Update Settings on each server.
B. Run the wuauclt.exe /reauthorization command on each server.
C. Use the local group policy to configure the Windows Update Settings on each server.
D. Run the wuauclt.exe /detectnow command on each server.
E. None of the above

Answer: C

Explanation:
To configure all of the servers to receive updates from ITCertKeys 3, you need to configure the Windows Update Settings on each server by using the local group policy. Microsoft suggests the use of Group Policy for setting up computers and WSUS in clients. Configuring the Windows Update Settings on each server would be quite time consuming Configure the Windows Update Settings on each server by using the local group policy. wuauclt.exe /detectnow and wuauclt.exe / reauthorization force the update detection and reauthorization respectively and therefore cannot be used for configuration.

Reference: 
What does wuauclt.exe /detectnow do
http://www.wsus.info/forums/lofiversion/index.php?t6505.html

Reference: 
Adding Computers to WSUS 3.0 SP1 (Windows Server 2008)
http://www.geekzone.co.nz/chakkaradeep/4564

Question 2.
The corporate network of ITCertKeys consists of 100 servers that run Windows Server 2008. A file server ITCertKeys 4 is connected to a SAN and has 12 logical drives. As a system administrator of your company, you have been assigned the task to archive the data when the free space on file server is about to be finished. To accomplish this task, you decided to run a data archiving script automatically when the free space on any of the logical drives goes below 30 percent. To implement the solution, you created a new Data Collector Set and the data archiving script. Now which of the following actions would you perform to automate the execution of the script that you have created.

A. Add the System configuration data collector.
B. Add the Event trace data collector.
C. Add the Performance counter alert.
D. Add the Performance counter data collector.
E. None of the above

Answer: C

Explanation:
To implement the solution, you now need to add the Performance counter alert. The Performance counter alert creates an alert if a performance counter reaches a threshold that you specify

Reference: 
Creating a Snapshot of a Computer's Configuration with Data Collector Sets in Vista / How to Create Custom Data Collector Sets http://www.biztechmagazine.com/article.asp?item_id=241

Question 3.
The corporate network of ITCertKeys consists of two servers, ITCertKeys 2 and ITCertKeys 3 that run Windows Server 2008. You installed WSUS on both servers to create a hierarchy of WSUS servers. You now need to configure WSUS on ITCertKeys 2 so that it can receive updates from ITCertKeys 3. 
Which of the following configuration would you perform on ITCertKeys 2 to accomplish this task?

A. Create a new computer group for the server.
B. Configure it as a proxy server.
C. Configure it as an upstream server.
D. Configure it in replica mode
E. None of the above

Answer: D

Explanation:
To configure WSUS on ITCertKeys 2 so that it can receive updates from ITCertKeys 3, you need to first link the servers by configuring ITCertKeys 2 as downstream server and ITCertKeys 3 as upstream server. When you link WSUS servers together, there is an upstream WSUS server and a downstream WSUS server. Because an upstream WSUS server shares updates, you need to configure and ITCertKeys 3 as upstream server. There are two ways to link WSUS servers together, Autonomous mode and Replica mode. So you can configure ITCertKeys 2 in Replica mode.

Reference: 
Choose a Type of WSUS Deployment/ WSUS server hierarchies 
http://technet2.microsoft.com/windowsserver/en/library/12b665bc-07fa-4a4e-aed8-
f970efe80c4c1033.mspx?mfr

Question 4.
The corporate network of ITCertKeys consists of a Windows Server 2008 single Active Directory domain that contains two domain controllers named ITCertKeys 4 and ITCertKeys 5. All servers in the domain run Windows Server 2008. You wanted to configure Event forwarding and subscription in the domain server. To accomplish this task you created a default subscription on ITCertKeys 4 for ITCertKeys 5.

Which of the following event logs would you select, to review the system events for ITCertKeys 5?

A. Forwarded Events log on ITCertKeys 5.
B. Forwarded Events log on ITCertKeys 4.
C. System log on ITCertKeys 4.
D. Application log on ITCertKeys 5.
E. None of the above

Answer: B

Explanation:
To review the system events for ITCertKeys 5, you need to view theForwarded Events log on ITCertKeys 4, which is configured to centrally manage events. The Event Collector service can automatically forward event logs to other remote systems, running Windows Vista or Windows Server 2008 on a configurable schedule. Event logs can also be remotely viewed from other computers or multiple event logs can be centrally logged and monitored agentlessly and managed from a single computer.

Reference: 
Event Viewer http://en.wikipedia.org/wiki/Event_Viewer

Question 5.
You are an enterprise administrator for ITCertKeys .com. The company runs Windows Server 2008 on all the servers on the network. One of the servers, ITCertKeys Server1 has the Web Server (IIS) role installed on it. A public website has recently been hosted on ITCertKeys Server1. After a few days, you noticed an unusual high traffic volume on the website. 

Which of the following options would you choose to identify the source of the traffic?

A. Run the netstat -an command on ITCertKeys Server1.
B. Using IIS Server Manager, first enable the website logging and then filter the logs for the 
    source IP address.
C. Enable Web scripting on ITCertKeys Server1.
D. Using Event Viewer, filter information from the security log by creating a custom view in it.
E. None of the above

Answer: B

Explanation:
To identify the source of the traffic, you need to first enable the website logging using IIS Server Manager and then filter the logs for the source IP address so that the source of high traffic can be found out. The Internet Services Manager, available within the Administrative Tools folder on your Start menu, is the primary tool you'll use to administer your Web server. It allows you to enable logging on your web site. The IIS log files then can be used to identify performance issues in performance testing. 

The Client IP address filtering allows you to filter the IP address of the machine that accessed your web site. Although IP addresses aren't necessarily unique to any one visitor (as most visitors surf the web via a dynamic IP address provided by their ISP and not their own dedicated static IP and pipe), the IP address can still be useful in partitioning the log file into visitor sessions.

The netstat -an command cannot be used because it is used to check various TCP/IP connections. The web scripting is used to enhance your browsing experience. Event logs are special files that record significant events on your computer, such as when a user logs on to the computer or when a program encounters an error. Therefore all these options cannot be used to detect the source of high traffic.

Reference: 
How To Use IIS Log Files In Performance Testing
http://www.codeplex.com/PerfTesting/Wiki/Print.aspx?title=How%20To%3A%20Use%20IIS%20Log%20Files

Reference: 
Web Wizardry: Putting the Internet to Work on Windows 2000
http://mcpmag.com/features/print.asp?EditorialsID=94

Reference: 
Dissecting Log Files
http://www.clicktracks.com/insidetrack/articles/dissecting_log_files.php

Question 6.
You are an Enterprise administrator for ITCertKeys.com. The company consists of a single Active Directory domain where all the servers on the corporate network run Windows Server 2008. One of the web servers called ITCertKeys Server1 hosts shared documents. You have recently installed a few applications on the server. However, after these installations, users report extremely slow response times when they try to open the shared documents on Server1. To diagnose the problem, you used real time monitoring on the server and found that the processor is operating at 100 percent of capacity. 

Which of the following options would you choose to gather additional data to diagnose the cause of the problem?

A. Create a counter log to track processor usage in the Performance console.
B. Open and review the application log for Performance events in the Event Viewer.
C. Use the Resource View to see the percentage of processor capacity used by each application 
    in Windows Reliability and Performance Monitor.
D. Create an alert that will be triggered when processor usage exceeds 80 percent for more than 
    five minutes on ITCertKeys Server1 in Windows Reliability and Performance Monitor.
E. None of the above

Answer: C

Explanation:
To gather additional data to diagnose the cause of the problem, you need to use the Resource View in Windows Reliability and Performance Monitor to see the percentage of processor capacity used by each application. The Resource View window of Windows Reliability and Performance Monitor provides a real-time graphical overview of CPU, disk, network, and memory usage. By expanding each of these monitored elements, system administrators can identify which processes are using which resources. In previous versions of Windows, this real-time process-specific data was only available in limited form in Task Manager

Reference: 
Windows Reliability and Performance Monitor
http://technet.microsoft.com/en-us/library/cc755081.aspx

Question 7.
You are an Enterprise administrator for ITCertKeys.com. All the 100 servers on the corporate network run Windows Server 2008. A server called ITCertKeys Server1 is configured on the network with following configuration: 
1. Connected to a SAN
2. Consists of 15 logical drives.
3. A new Data Collector Set is recently created

Which of the following option would you choose to automatically run a data archiving script on ITCertKeys Server1 if the free space on any of the logical drives on the server is below 30 percent?

A. Add the Event trace data collector
B. Add the Performance counter alert
C. Add the Performance counter data collector
D. Add the System configuration data collector

Answer: B

Explanation:
To automatically run a data archiving script if the free space on any of the logical drives is below 30 percent and to automate the script execution by creating a new Data Collector Set, you need to add the Performance counter alert. The Performance counter alert creates an alert if a performance counter reaches a threshold that you specify. You can configure your data collector set to automatically run at a scheduled time, to stop running after a number of minutes, or to launch a task after running. You can also configure your data collector set to automatically run on a scheduled basis. This is useful for proactively monitoring computers.

Reference: 
Creating a Snapshot of a Computer's Configuration with Data Collector Sets in Vista / How to Create Custom Data Collector Sets http://www.biztechmagazine.com/article.asp?item_id=241

Question 8.
You are an enterprise administrator for ITCertKeys . The corporate network of the company consists of servers that run Windows Server 2008 in an Active Directory domain. The domain consists of two servers named ITCertKeys Server1 and ITCertKeys Server2. You need to configure event subscription on the servers so that events from ITCertKeys Server2 can be collected and transferred to ITCertKeys Server1. You configure the required subscriptions by selecting the normal option for the event delivery optimization setting and using the HTTP protocol. However, you noticed that none of the subscriptions work. 

Which of the following three options would you choose to ensure that the servers support event collectors? (Each correct answer presents part of the solution)

A. Run the wecutil qc command on ITCertKeys Server1
B. Run the wecutil qc command on ITCertKeys Server2
C. Run the winrm quickconfig command on ITCertKeys Server1
D. Run the winrm quickconfig command on ITCertKeys Server2
E. Add the ITCertKeys Server2account to the administrators group on ITCertKeys Server1
F. Add the ITCertKeys Server1account to the administrators group on ITCertKeys Server2

Answer: A, D, F

Explanation:
To collect events from ITCertKeys Server2 and transfer them to ITCertKeys Server1, you need to first run the wecutil qc command on ITCertKeys Server1. This command enables you to create and manage subscriptions to events that are forwarded from remote computers. Then you need to run the winrm quickconfig command on ITCertKeys Server2. WinRM is required by Windows Event Forwarding as WS-Man is the protocol used by WS-Eventing. Group Policy can be used to enable and configure Windows Remote Management (WinRM or WS-Man) on the Source Computers. With WinRM, Group Policy can be used to configure Source Computers (Clients) to forward events to a collector (or set of collectors).

Finally, you need to add the ITCertKeys Server1 account to the administrators group on ITCertKeys Server2 so that access rights can be granted to the collector system on f the forwarding computer.

Reference: 
Quick and Dirty Large Scale Eventing for Windows
http://blogs.technet.com/otto/archive/2008/07/08/quick-and-dirty-enterprise-eventing-for-windows.aspx

Reference: 
Collect Vista Events http://www.prismmicrosys.com/newsletters_june2007.php

Question 9.
You are an enterprise administrator for ITCertKeys . The corporate network of the company consists of servers that run Windows Server 2008 in an Active Directory domain. To find out the security lapse in the corporate network, you decided to build a list of all DNS requests that are initiated by a network server called CRM ITCertKeys 1. To perform this, you installed the Microsoft Network Monitor 3.0 application on CRM ITCertKeys 1 and configured the server to perform a security audit. You captured all local traffic on CRM ITCertKeys 1 for 24hours and saved the capture file as data.cap. You however realized that the size of data.cap file is more than 1GB, so you decided to create a file named CRM1DNSdata.cap from the existing capture file that contains only DNS -related data. 

Which of the following options would you choose to accomplish this task?

A. Apply the display filter !DNS and save the displayed frames as CRM1DNSdata.cap file
B. Apply the capture filter DNS and save the displayed frames as a CRM1DNSdata.cap file
C. Add a new alias named DNS to the aliases table and save the file as CRM1DNSdata.cap
D. Run the nmcap.exe /inputcapture data.cap /capture DNS /file CRM1DNSdata.cap command.
E. None of the above

Answer: D

Explanation:
NMCap also allows you to accept a capture file as input. This can be useful for cleansing your traces before you use them. Or you could also parse traffic by different ports or by IP addresses. The below given command allows you to create a file named CRM1DNSdata.cap to store only the DNS-related data after filtering it from data.cap file, which is a capture file. The command nmcap.exe /inputcapture data.cap /capture DNS /file CRM1DNSdata.cap file

Reference: 
Network Monitor / Cool NMCap trick, using another capture file as the input source
http://blogs.technet.com/netmon/Default.aspx?p=2

Question 10.
You are an enterprise administrator for ITCertKeys . The corporate network of the company consists of 100 servers that run Windows Server 2008 in an Active Directory domain. You have recently installed Windows Server 2008 on a new server and named it ITCertKeys Server1. You installed Web Server (IIS) role on it. The ITCertKeys Server1 has no Reliability Monitor data currently, and the system stability share has never been updated. 

Which of the following options would you choose to configure the ITCertKeys Server1 to collect the reliability monitor data?

A. On the ITCertKeys Server1, run the perfmon.exe /sys command.
B. On the ITCertKeys Server1Configure the Task scheduler service to start automatically.
C. On the ITCertKeys Server1, configure the Remote Registry service to start automatically.
D. On the ITCertKeys Server1, configure the Secondary Login service to start automatically.

Answer: B

Explanation:
To configure the ITCertKeys Server1 to collect the reliability monitor data, you need to configure the Task scheduler service to start automatically. Reliability Monitor uses data provided by the RACAgent scheduled task, a pre-defined task that runs by default on a new installation of Windows Vista. The seamless integration between the Task Scheduler user interface and the Event Viewer allows an event-triggered task to be created with just five clicks.

In addition to events, the Task Scheduler in Windows Vista / Server 2008 supports a number of other new types of triggers, including triggers that launch tasks at machine idle, startup, or logon. Because you need Task Scheduler to collect reliability monitor data, you need to you need to configure the Task scheduler service to start automatically.

Reference: 
Network Monitor 3.1 OneClick ... now what? / Task Scheduler Changes in Windows Vista and Windows Server 2008 - Part One http://blogs.technet.com/askperf/

Reference: 
What allows the Reliability Monitor to display data?
http://www.petri.co.il/reliability_monitor_windows_vista.htm

	Web www.certsbraindumps.com