Online Access Free 070-663 Exam Questions

You need to recommend a Client Access solution for A, Datum. The solution must meet the business goals of Litware. The solution must also meet the implementation requirements of A, Datum.
What should you recommend?
Case Study Title (Case Study): Litware, Inc
Company Overview
Litware, Inc. is a manufacturing company.
Physical Locations
The company has offices in Bangkok and Tokyo. Each office has a sales department. All network support staff is located in the Bangkok office.
Existing Environment
Litware has a forest that contains a single domain named litwareinc.com. An Active Directory site exists for each office. The sites connect to each other by using a high-speed WAN link. The WAN link has an average net available bandwidth of 15 percent during business hours. The domain contains three domain controllers. The domain controllers are configured as shown in the following table.

The network has an Exchange Server 2010 Service Pack 1 (SP1) organization that contains four servers. The servers are configured as shown in the following table.

All of the servers have the following hardware configurations:
-32 GB of RAM
-Two dual quad-core Intel Xeon processors
-Two 1-gigabit per second network adapters
-One RAID 10 disk array that has 12 300-GB, 1S,000-RPM SAS disks for data
-One RAID 1 disk array that has two 73-GB, 10,000-RPM SAS disks for program files
-One RAID 1 disk array that has two 73-GB, 10,000-RPM SAS disks for the operating system
Requirements
Business Goals
Litware has the following general requirements that must be considered for all technology deployments:
-Minimize costs whenever possible.
-Minimize administrative effort whenever possible.
-Minimize traffic on the WAN link between the Bangkok and Tokyo offices.
Planned Changes
Litware acquires a management company named A, Datum Corporation. A, Datum has 2,500 employees.
A, Datum has the following email infrastructure:
-A sales department, in which 150 employees work
-A third-party email infrastructure that is used for IMAP4 and SMTP
-Three other departments that use the SMTP domains of adatum.com, asia.adatum.com, and
contoso.com. Users are assigned only one email address that uses the SMTP domain of their
department
You plan to deploy a new Exchange Server 2010 SP1 organization for A, Datum. The new email infrastructure must meet the following implementation requirements:
-All employees must have access to their mailbox if a single server fails.
-Sales department employees must use Windows Internet Explorer 8 to access their mailbox,
-Sales department employees must be prevented from accessing the calendar or journal features of Outlook Web App.
-All employees who do not work in the sales department must have access to all of the Outlook Web App features.
-All email messages sent to recipients outside of A, Datum must have a return address in the
[email protected] format.
-The administration of the A, Datum Exchange organization must be performed by a dedicated team of administrators.
-The Exchange administration team for A, Datum must be distinct from the Exchange administration team of Litware.
The new email infrastructure for A, Datum must meet the following security requirements:
-Litware administrators must be prevented from viewing or modifying the settings of the mailboxes of A, Datum users.
-All inbound and outbound Internet email to and from the A, Datum domains must be routed through the Hub Transport servers of Litware.
-All email messages that contain financial information must be encrypted automatically while in transit and the recipients of the messages must be prevented from forwarding them to users outside of the company' s financial department.
Compliance Requirements
Litware must meet the following compliance requirements:
-Each email message sent by an attorney from the Litware legal department must be approved by the manager of the legal department.
-Attorneys must be able to classify email messages as "attorney-client privileged".
-All email messages classified as "attorney-client privileged" must contain a legal disclaimer
automatically.
User Requirements
All users who have a portable computer use Microsoft Outlook 2010 when they work online and offline. When the users work offline, they must be able to read existing email messages and create new email messages. Users who have a large mailbox must minimize the amount of hard disk space used by the mailbox on their portable computer

• A.Two Client Access servers and two Outlook Web App policies
• B.Two Client Access servers and one Outlook Web App policy
• C.One Client Access server and one Outlook Web App policy
• D.One Client Access server and two Outlook Web App policies

Your company has a main office and 10 branch offices. Each office connects to the Internet by using a direct link. The main office connects to the branch offices by using a WAN link.
You plan to deploy Exchange Server 2010 servers in each office.
You need to design Active Directory to meet the following Exchange Server 2010 requirements:
-Users must be able to access their mailboxes if a single domain controller fails
-Users must be able to send e-mail messages to the Internet if a WAN link fails
What should you include in the design?

• A.Create an Active Directory site for each office. Deploy two global Catalog servers in each site.
• B.Create an Active Directory site for each office. Deploy a single domain controller in each site, and then enable site link bridging.
• C.Create an Active Directory site for all of the offices. Deploy a global catalog server and two read only global catalog servers in each site.
• D.Create an Active Directory site for all of the offices. Deploy a global catalog server and a read only domain controller in each site.

You are the Exchange administrator for the Nutex Corporation's Exchange organization. Nutex has single Active Directory domain named nutex.com. All Exchange server roles are running Exchange 2010 SP1. You have each server role on a separate subnet. The routers used to create the subnets have firewall capabilities.
Which ports should be open on the firewall? (Choose two.)

• A.You should consider opening TCP port 25, TCP port 88, TCP port 389, TCP port 443, TCP port 3268, and UDP ports 1024 to 65535 for the Unified Messaging server to communicate with other Exchange server roles and other services.
• B.You should consider opening TCP port 25, TCP port 135, TCP port 389, TCP port 443, TCP port 993, and TCP ports 5060 to 5062 for the Hub Transport server to communicate with other Exchange server roles and other services.
• C.You should consider opening TCP port 53, TCP port 389, TCP port 443, TCP port 993, and TCP port 995 for the Client Access server to communicate with other Exchange server roles and other services.
• D.You should consider opening TCP port 135, TCP port 389, TCP port 443, and TCP port 3268 for the Mailbox server to communicate with other Exchange server roles and other services.

Your network contains a single Active Directory domain named contoso.com.
You plan to deploy a new Exchange Server 2010 Service Pack 1 (SP1) organization. You identify the administrative model for the Exchange organization as shown in the following table.

You need to identity which groups must be assigned to Group1 and Group2 to support the planned
administrative model.
The solution must minimize the number of rights assigned to each group.
Which security groups and role groups should you assign to Group1 and Group2?
To answer, drag the appropriate security groups or role groups to the correct group in the answer area.
Select and Place:

Correct Answer:

Explanation:
I agree with Group 2 answer and with Organization management point of Group 1
-Domain Admins is not right here as it is more than required.
-Account Operator group in the domain is required to be able to create user accounts.
Organization management Admin can do everything :
Administrators who are members of the Organization Management role group have administrative access to the entire Exchange 2010 organization and can perform almost any task against any Exchange 2010 object, with some exceptions, such as the Discovery Management role.
So the only missing or required permission here to perform the required tasks are:
Stop / Restart system or services and system updates. As local administrator group you can do that.
================================
Previous Answer was:
Group 1:
Domain Admins Group in the domain.
Organization Management role group.
Group 2:
Recipient management role group.
Group 1 needs to be able to do the following:
-Restore mailboxes
-Stop and Restart both Servers and Services
-Create mailbox database
-Install Operating System Updates
-Manage Certificates
I don't agree with the need for this group to be a member of the Account Operators group. This is a domain account that allows local logon to domain controllers and they can create user account accounts. Group 1 as I read the question needs to logon to exchange servers and manage the local exchange server. Therefore I think they just need to be members of the Administrative Group on each Exchange Server.
Group 2 needs to be able to do the following:
-create mail - enabled users
-create distribution lists
-delete distribution lists
In order for group 2 to complete their tasks they will need to have recipient management role and the Organization Role
Account Operators is a local group that grants limited account creation privileges to a user. Members of this group can create and modify most types of accounts, including those of users, local groups, and global groups. They can also log on locally to domain controllers. However, Account Operators can't manage the Administrator user account, the user accounts of administrators, or the group accounts Administrators, Server Operators, Account Operators, Backup Operators, and Print Operators. Account Operators also can't modify user rights.
The Recipient Management management role group is one of several built-in role groups that make up the Role Based Access Control (RBAC) permissions model in Microsoft Exchange Server 2010. Role groups are assigned one or more management roles that contain the permissions required to perform a given set of tasks. The members of a role group are granted access to the management roles assigned to the role group. For more information about role groups, see Understanding Management Role Groups. Administrators who are members of the Recipient Management role group have administrative access to create or modify Microsoft Exchange Server 2010 recipients within the Exchange 2010 organization.
Help Desk - The Help Desk management role group gives members permissions that are typically required by members of a help desk, such as modifying users' details such as their address and phone number.
Organization Management - The Organization Management role group is synonymous with the Exchange Full Administrator role in Exchange 2003 and the Exchange Organization Administrators role in Exchange 2007. Essentially, membership of this management role group gives the user the ability to perform pretty much any task in Exchange 2010, with the main missing task being the ability to perform mailbox searches; that itself is achieved via the Discovery Management role group.
Domain Admins - This group is automatically added to the corresponding Administrators group in every domain in the forest. It has complete control over all domain controllers and all directory content stored in the domain and it can modify the membership of all administrative accounts in the domain.
The permissions granularity issue was improved in Exchange 2007. The Exchange Full Administrator role found in Exchange 2000 and Exchange 2003 became known as the Exchange Organization Administrators role in Exchange 2007 and still gave administrators full access to all Exchange objects in the entire organization. The Exchange View-Only Administrators role also remained, giving administrators read-only access to the entire Exchange organization.
There were effectively three new additions to the Exchange 2007 roles:
-Exchange Recipient Administrators - Allowed administrators to modify Exchange settings on users, groups, contacts and public folders
-Exchange Public Folder Administrators -Was introduced in Exchange 2007 Service Pack 1 and as its name suggests allowed administrators to manage public folders
-Exchange Server Administrators - Allowed administrators to fully manage a particular Exchange 2007 server as long as they were also a member of the local Administrators group on that server
Although the permissions model in Exchange 2007 was a vast improvement over those models found in earlier versions of Exchange, it still wasn't able to satisfy a lot of the administrative scenarios found in various organizations. Essentially, the roles in Exchange 2007 still offered too much administrative power to administrators in a decentralized Exchange organization and it was therefore difficult to limit the permissions available to certain administrators. Although it was possible to implement a split permissions model in Exchange 2007 by modifying Access Control Lists (ACLs), this was a complex procedure that could sometimes result in errors and issues that were difficult to troubleshoot.
The design of Exchange 2010 has needed to take into account the more demanding and granular permissions requirements of organizations. Exchange 2010 now supports a model where specialist users can be granted specific Exchange permissions required to perform their duties. For example, there may be the scenario where a compliance officer within a company needs to conduct a search across all employees' mailboxes for legal reasons, or perhaps a member of the Human Resources department needs to update user information in Active Directory that is seen on the properties of users' mailboxes. In these example cases, the relevant specialist user should only be given the rights to perform the required task and should not be assigned, for example, additional rights that could allow them to affect the overall configuration of the Exchange environment.
Management Role Groups -In Exchange 2010, Microsoft has made the task of assigning a series of common permissions to administrative and specialist users very easy by providing 11 default management role groups. By placing a user or group into a management role group, the management roles associated with that management role group are assigned accordingly thereby giving the user or group the relevant permissions. The term role holder is used by Microsoft to denote the administrative or specialist user that is added to the management role group. These 11 default management role groups are created during Exchange 2010 setup. Specifically, these management role groups are created when Exchange 2010 setup runs the Active Directory preparation steps that can be performed individually by running the Exchange 2010 setup.com program with the /PrepareAD switch. The management role groups can be seen in the Microsoft Exchange Security Groups Organizational Unit (OU) that is created in the root domain during the Exchange setup process. You can see this OU and the groups within it in Figure 1. Note that of the 16 groups shown in Figure 1, only 11 are management role groups; these are highlighted.

A member of LOCAL\Administrators is a far cry from a BUILTIN\Administrators, and here are the two primary reasons why:
One - BUILTIN\Administrators is not stored locally to a single DC - its membership is in the Active Directory, in the CN=Builtin,DC=domain,DC=com container. The contents of this container are replicated to all domain controllers. Therefore, adding a user to a member of this group on one DC makes them a member of the group on all DCs. (A member server has a local accounts database called a SAM that is not visible to the domain.)
Two - Since BUILTIN\Administrators gives local Administrator permissions to its members - they can do anything on any DC in the domain. Anything. Making themselves a Domain Administrator is a trivial exercise.
A final note of caution: it is now widely recognized that forests are the security boundaries in Active Directory, not domains (regardless of what the original Windows 2000 Server A/D documentation said). Domains are simply administrative boundaries. As a corollary to item two above, once a person is a domain administrator, it is fairly easy to become an enterprise administrator.

You have an Exchange Server 2003 organization. All users connect to their mailboxes by using Microsoft Office Outlook.
You start to transition the organization to new Exchange Server 2010 servers. The new servers are on a secured subnet that is separated by a firewall. You will move half of the mailboxes to the new servers.
Client Access servers and Mailbox servers are on the secured subnet. Client computers on the network can access the Client Access servers.
You need to recommend a solution that allows users to connect to Public Folders by using Outlook or Outlook Web App (OWA).

• A.Public Folder referrals and HTTP connections to the Mailbox servers
• B.Public Folder referrals and forms-based authentication
• C.Public Folder replicas and WebReady Document Viewing
• D.Public Folder replicas and MAPI connections to the Mailbox servers