Chapter 3: Lesson Review Answers Answers 793 2. Correct Answer: D a. Incorrect: When you boot a reference client computer from a WDS capture image, the Windows Deployment Services Image Capture Wizard enables you to capture a system image from that computer and export it to the WDS server. It does not directly specify the source directory in which the WIM file resides, specify whether setup or Sysprep files are required, or move the file to the distribution share. B. Incorrect: The SCCM 2007 Task Sequence Editor creates and modifies task sequences. In the New Task Sequence Wizard, you can select Install An Existing Image, Build A Reference Operating System Image, or Create A New Custom Task Sequence. However the wizard creates task sequences. It does not directly specify the source directory in which the WIM file resides, specify whether setup or Sysprep files are required, or move the file to the distribution share. c. Incorrect: You access the Create Distribution Share Wizard from the MDT 2010 Deployment Workbench console. This wizard lets you create a distribution share that will hold the WIM file, but it does not specify the source directory in which the WIM file resides, specify whether setup or Sysprep files are required, or move the file to the distribution share. D. Correct: You access the New OS Wizard from the MDT 2010 Deployment Workbench console. This wizard lets you specify the source directory in which the WIM file resides, specify whether setup or Sysprep files are required, and then move the file to the distribution share. 3. Correct Answer: C a. Incorrect: WDS deploys install images across the network. You do not need to install them on removable bootable media. B. Incorrect: When you boot a target computer from the network, WDS presents you with a boot menu on the target machine that enables you to boot from a boot image. This is delivered over the network and you do not need to install this image from bootable removable media. Note that the choice specifies a standard boot image. Discover and capture images are special types of boot image. c. Correct: If your target computers are not PXE-compliant, they cannot boot from the network. Therefore, you need to boot them from a discover image on removable, bootable media. D. Incorrect: If you want to capture the image of a reference computer, you boot it from a capture image. Capture images appear on the boot menu in the same way as standard boot images and you do not need to install them on bootable removable media. 4. Correct Answers: A, E, and F a. Correct: The WDS server role needs to be installed on a server in an AD DS domain. B. Incorrect: WDS can work with MDT 2010 to implement LTI, but it does not require MDT 2010 to deploy images. c. Incorrect: SQL Server is required with SCCM 2007 and MDT 2010 to implement ZTI. However, SQL Server is not a WDS requirement. 7 9 4 Answers D. Incorrect: SCCM 2007 is required with SQL Server and MDT 2010 to implement ZTI. However, SCCM 2007 is not a WDS requirement. e. Correct: WDS typically deploys to PXE-compliant target client computers that rely on DHCP for their IP configuration. F. Correct: The WDS server role needs to be installed on a server in a network that contains at least one DNS server. 5. Correct Answer: A a. Correct: To make the image bootable, you use BCDboot from Windows PE to initialize the BCD store and copy boot environment files to the system partition. On restart, the target computer boots into Windows 7 Ultimate. B. Incorrect: DISM enables you to manage and manipulate a WIM image. It does not make an image bootable when you have installed it on a target computer. c. Incorrect: You use BCDEdit to make media such as VHD and USB flash memory bootable. However, it does not make an image bootable when you have installed it on a target computer. D. Incorrect: You used ImageX to create the WIM image on the source computer and install it on the target computer. However, ImageX cannot make the installed image bootable. Chapter 3: Case Scenario Answers Case Scenario 1: Deploying an Image with More Than One Language Pack 1. Don requires the following: n A technician computer with the Windows AIK tools installed and enough available space on the hard disk drive to both hold the master image and mount this image. n The Windows image (.wim file) that he wants to service. n The drivers (.inf files), update packages (.cab or .msu files), and the language packs (.cab files) that he will use to service the image. 2. Don’s first task is to copy an instance of the master image to the technician computer. Microsoft does not recommend mounting an image from a network share. 3. Don uses DISM to mount the image. He then uses DISM commands to apply the update, add the new driver, and change the relevant settings. He checks that both language packs are installed on the image and the correct international settings can be configured. If it is likely that he will service the image regularly, he should create a script using the DISM command-line options. Don uses DISM to verify that the appropriate driver and other packages were added (or removed, if necessary) from the image. Finally, he commits and dismounts the image. Chapter 4: Lesson Review Answers Answers 795 Case Scenario 2: Deploying an Image to 100 Client Computers 1. You need to ensure that all critical and recommended updates, particularly security updates, have been installed. Also, if any new hardware devices are to be used with the new computers that are not Plug and Play, you need to install the device drivers on the reference computer. You need to test the installation thoroughly. Finally, you need to use the Sysprep tool to generalize the computer configuration prior to the image capture. 2. You need to create a capture image on the WDS server. 3. You restart the reference computer and press F12 to boot from the network. On the boot menu, select the capture image and follow the procedure to create the computer’s system image. You transfer the resulting WIM file to the WDS server. You boot each target computer from the network (if necessary, configuring the BIOS boot order to do so). You choose the standard boot image (not the capture image) from the boot menu and select the install image you created from the reference computer. The image is installed, and Setup continues normally. Chapter 4: Lesson Review Answers Lesson 1 1. Correct Answers: A and C a. Correct: The device must be signed with a valid digital certificate that is recognized by Windows 7 and is in the Trusted Publishers store. Otherwise, administrator privileges are required to install the device. B. Incorrect: Digital certificates are stored in the Trusted Publisher store, not device drivers. c. Correct: The device driver must be stored in the device driver store. Otherwise, administrator privileges are required to copy the driver to that store. D. Incorrect: The device does not need to connect through a USB port. It could, for example, be a PS/2 keyboard. e. Incorrect: Although Microsoft signs many drivers, a Microsoft signature is not essential. The digital certificate needs to be from a trusted CA. For example, in the domain environment, it could be a self-signed certificate. 2. Correct Answer: B a. Incorrect: You use this procedure to determine the power requirements of each device, not the bandwidth requirements. B. Correct: This procedure enables you to view the bandwidth requirements of each device in the Bandwidth-Consuming Devices list on the Advanced tab. c. Incorrect: The Details tab can give you a great deal of information (for example, the device-type GUID) but does not indicate bandwidth requirements. Also, the devices listed are not necessarily those on the USB hub. D. Incorrect: IEEE 1394 bus host controllers are not USB devices. Also, the Resources tab does not show bandwidth requirements. 7 9 6 Answers 3. Correct Answers: A and D a. Correct: This permits non-administrators to install any device in the device setup class, provided that the device driver is in the driver store. B. Incorrect: This instructs Windows 7 to search for a device driver in any folder and subfolder on the C: drive. However, administrator privileges are required to copy the driver to the driver store and install it. c. Incorrect: The Trusted Publisher store holds digital certificates that authenticate driver signatures. It does not hold device drivers. D. Correct: When a driver is staged, it is placed in the device driver store and non-administrators can install the device, provided they have permission to install devices in the appropriate device setup class. 4. Correct Answer: B a. Incorrect: This prevents automatic installation of drivers downloaded from Windows Update but does not remove the Web site from the search path. B. Correct: This prevents Windows 7 from searching for device drivers in Windows Update. c. Incorrect: The DevicePath registry entry does not list the Windows Update Web site specifically. D. Incorrect: This installs drivers from Windows Update if Windows 7 judges they are the best drivers based on inbuilt criteria. It does not prevent Windows 7 from searching for device drivers in Windows Update. 5. Correct Answer: A a. Correct: This stops the device driver and immediately disables the device. B. Incorrect: This ensures the device is disabled the next time the computer restarts. You would likely do this if you discovered the device was giving problems. However, it does not stop the device immediately to allow you to investigate. c. Incorrect: The Disable control is available for PnP devices but not for devices listed under Non-Plug And Play Drivers. You should use the Stop control instead. D. Incorrect: The Uninstall control is available for PnP devices but not for devices listed under Non-Plug And Play Drivers. In any case, you want to stop the driver, not uninstall it. Lesson 2 1. Correct Answer: A a. Correct: This Diskpart command converts the selected disk to a GPT disk. B. Incorrect: This Diskpart command converts the selected disk to an MBR disk. c. Incorrect: This Diskpart command converts a selected dynamic disk to a static disk. D. Incorrect: This Diskpart command converts a selected static disk to a dynamic disk. Chapter 4: Lesson Review Answers Answers 797 2. Correct Answer: C a. Incorrect: This is a valid strategy for Windows 7 Enterprise or Ultimate edition, but you cannot make a VHD bootable on a computer running Windows 7 Home Premium. B. Incorrect: RAID-0 (disk striping) offers no fault tolerance and you cannot store operating system files on a RAID-0 volume. c. Correct: You can use a RAID-1 volume to mirror the disk that holds your operating system and provide fault tolerance. D. Incorrect: RAID-0 (disk striping) offers fault tolerance and failover protection. However, you cannot store operating system files on a RAID-5 volume. 3. Correct Answer: B a. Incorrect: Enabling this policy permits remote users to access removable storage devices in remote sessions. It does not deny all access to all types of external storage devices. B. Correct: Enabling this policy denies all access to all types of external storage devices. It overrides any access rights granted by other policies. c. Incorrect: Enabling this policy denies read access to USB removable disks, portable media players, and cellular phones. It does not deny all access to all types of external storage devices. D. Incorrect: Enabling this policy denies write access to USB removable disks, portable media players, and cellular phones. It does not deny all access to all types of external storage devices. 4. Correct Answer: B a. Incorrect: To create the largest possible RAID-0 (striped) volume, you omit the size parameter. Specifying a size of zero does not do this. B. Correct: This command creates the largest possible RAID-0 volume. c. Incorrect: The create volume raid command creates a RAID-5 volume. Also, to specify the largest possible volume you omit the size parameter. D. Incorrect: This command creates the largest possible RAID-5 volume. 5. Correct Answer: D a. Incorrect: If you had used the mountvol /n or the diskpart automount command on Aberdeen to prevent new volumes from being added to the system, the volume would not be mounted and would not receive a drive letter. However, the question explicitly states that you did not do this. B. Incorrect: When you move a basic volume to another computer, it receives the next available drive letter on that computer. However, you are moving a dynamic volume. c. Incorrect: The G: drive letter is neither the next available letter on Aberdeen nor the drive letter to which the volume had been allocated on Canberra. There is no reason for this drive letter to be allocated. D. Correct: When moved to a new computer, dynamic volumes retain the drive letter they had on the previous computer, in this case H:. 7 9 8 Answers Chapter 4: Case Scenario Answers Case Scenario 1: Enforcing a Driver Signing Policy 1. The Dxdiag tool diagnoses any problems with the video card and will tell you whether the driver is WHQL approved. 2. The Sigverif tool scans the computer and detects any unsigned drivers. 3. The Msinfo32 tool lists the resources and tells you what driver uses what resources. In particular, you should investigate Conflicts/Sharing under Hardware Resources. 4. Driver Verifier Monitor tests the device driver under configurable stress conditions. Case Scenario 2: Managing Disks 1. You would create a RAID-1 (mirror) array to hold your operating system and would mirror Drive 0 with 200 GB of the allocated space on Drive 2. 2. You would create a RAID-5 (striping with parity) volume using the unallocated space on Drives 1 and 3 (both 200 GB) and the 200 GB unallocated space that remains on Drive 2. A RAID-5 volume offers fault tolerance and reduced data access times. Although a RAID-0 array would provide a greater usable data storage capacity and a greater improvement in performance, it is not fault-tolerant. 3. Three 200 GB portions of unallocated disk would result in a RAID-5 array with 400 GB of usable storage capacity. Chapter 5: Lesson Review Answers Lesson 1 1. Correct Answer: A a. Correct: You should install the Windows XP Mode feature and install the application under Windows XP. Windows XP Mode runs a fully virtualized copy of Windows XP on a computer that has the Windows 7 Professional, Enterprise, or Ultimate operating system installed. Applications that work on Windows XP and that have compatibility problems that cannot be resolved using the ACT function in Windows XP Mode. B. Incorrect: You should not create a custom compatibility fix because the question already indicates that you have been unsuccessful in configuring a custom compatibility mode, which is a collection of such fixes. c. Incorrect: A shim is the previous name for a custom compatibility fix. The question text already indicates that you have been unsuccessful in configuring a custom compatibility mode, which is a collection of these fixes. D. Incorrect: You should not configure the application installer to run in Windows XP Professional SP2 mode because you have already found that you are unable to get Chapter 5: Lesson Review Answers Answers 799 the application working using the tools included in the ACT. The ACT provides more compatibility mode options than those built into Windows 7. If an application functions under the built-in Windows 7 compatibility modes, it can work under the ACT modes. 2. Correct Answer: D a. Incorrect: Although the application may function in the Windows 98/Windows Me compatibility mode, you only have evidence that the application functions on the Windows 2000 operating system, so you should use this compatibility mode first and try others only if the Windows 2000 mode is unsuccessful. B. Incorrect: Although the application may function in the Windows NT 4.0 (Service Pack 5) compatibility mode, you only have evidence that the application functions on the Windows 2000 operating system, so you should use this compatibility mode first and try others only if the Windows 2000 mode is unsuccessful. c. Incorrect: You should not configure the application to run under Windows XP (Service Pack 2) compatibility mode because you have evidence that the application does not function on computers running Windows XP. D. Correct: You should configure the application to run under the Windows 2000 compatibility mode because you know that the application functions on computers with Windows 2000 installed. 3. Correct Answer: B a. Incorrect: You cannot use the compatibility troubleshooter to troubleshoot .cab files. You must extract the contents of the .cab file to find the executable file that contains the application installer. B. Correct: The Program Compatibility troubleshooter works only with executable files. c. Incorrect: You cannot use the compatibility troubleshooter to troubleshoot .msi installer files. The Program Compatibility troubleshooter only works with executable files that have the .exe extension. D. Incorrect: You cannot use the compatibility troubleshooter to troubleshoot .zip files. You need to extract the contents of the .zip file to find the executable file that contains the application installer. 4. Correct Answer: C a. Incorrect: You should not configure the application to run in Windows XP (Service Pack 3) compatibility mode because the problem is that the application does not prompt for elevation. The program will still be unable to prompt for elevation when running in this compatibility mode. B. Incorrect: You should not configure the application to run in 256-color mode. This compatibility option should be used only when the application has display problems. c. Correct: You should enable the Run This Program As An Administrator compatibility option if the application is not configured to prompt for elevation when administrative 8 0 0 Answers privileges are required. This will allow the program to run with administrative privileges once the user responds to a User Account Control prompt. D. Incorrect: You should not enable the Disable Desktop Composition compatibility option. You should enable this option when you need the Aero interface disabled when the application executes. 5. Correct Answer: B a. Incorrect: You can use the IEAK to configure Internet Explorer. You cannot use this toolkit to determine whether an existing Web site displays correctly for users of Internet Explorer 8, which is the default browser of Windows 7. B. Correct: The ACT includes the Internet Explorer Compatibility Test Tool. This tool can be used to evaluate whether a Web site is compatible with Internet Explorer 8, which is the default browser of Windows 7. c. Incorrect: The Windows AIK includes tools that assist in deploying the Windows operating system. You cannot use this toolkit to determine whether an existing Web site displays correctly for users of Internet Explorer 8, which is the default browser of Windows 7. D. Incorrect: The MDT is a solution accelerator that assists in the planning and deployment of operating systems to client computers. You cannot use this toolkit to determine whether an existing Web site displays correctly for users of Internet Explorer 8, which is the default browser of Windows 7. Lesson 2 1. Correct Answer: D a. Incorrect: AppLocker cannot be used to block the execution of applications on computers running Windows Vista or Windows 7 Professional. B. Incorrect: AppLocker cannot be used to block the execution of applications on computers running Windows Vista or Windows 7 Professional. c. Incorrect: AppLocker cannot be used to block the execution of applications on computers running Windows Vista or Windows 7 Professional. D. Correct: Because you cannot use AppLocker to block the execution of applications on Windows Vista or Windows 7 Professional, you should use Software Restriction Policies to accomplish the same objective. 2. Correct Answer: A a. Correct: Publisher rules allow you to block applications based on which software vendor wrote the application. B. Incorrect: Path rules do not allow you to block applications based on which software vendor wrote the application, as the question stipulates; they allow you to block an executable file based on its location. c. Incorrect: Hash rules do not allow you to block applications based on which software vendor wrote the application, as the question stipulates; they allow you to block a specific executable file based on a hash value generated from that file. Chapter 5: Lesson Review Answers Answers 801 3. Correct Answers: B and C a. Incorrect: You should not create AppLocker publisher rules. Publisher rules can be used only when the file that is the subject of the rule has been signed digitally by the publisher. B. Correct: You should create an AppLocker hash rule because it is not possible to create a publisher rule due to the lack of digital signature. c. Correct: You should configure AppLocker enforcement to audit executable rules. This allows you to ensure that the rules relating to applications function before you enforce them in a production environment. D. Incorrect: You should not configure AppLocker enforcement to audit Windows Installer rules because you are interested in the functionality of executable rules. 4. Correct Answer: C a. Incorrect: You should not configure Group Policy to set the Application Management service to start automatically. The Application Management service is used to process installation, removal, and enumeration requests for software deployed through Group Policy. The service that you want to configure to start automatically is the Application Identity service. B. Incorrect: As the Software Restriction Policies are functioning properly, you do not need to modify the settings of services related to the computers running Windows 7 Professional. c. Correct: For AppLocker policies to function properly, you need to have the Application Identity service functioning. The default setting on Windows 7 is to have this service disabled. Through Group Policy, you can force this service to start automatically, which allows AppLocker policies to be enforced. D. Incorrect: Because the Software Restriction Policies are functioning properly, you do not need to modify the settings of services related to the computers running Windows 7 Professional. 5. Correct Answer: A a. Correct: You need to create a new hash rule for the application. Hash rules need to be updated whenever you apply an update to an application. This is because the update changes the characteristics of the file so that it no longer matches the hash rule generated for it originally. B. Incorrect: Because the application is not signed digitally, you cannot use a publishing rule to manage it with AppLocker. c. Incorrect: Because other AppLocker policies are functioning, you can infer that the Application Identity service is active and its status does not need to be modified. D. Incorrect: The Application Management service is related to software installation, removal, and enumeration through Group Policy. This service does not affect AppLocker policies directly. 8 0 2 Answers Chapter 5: Case Scenario Answers Case Scenario 1: Configuring Application Compatibility at Fabrikam 1. Edit the properties of application Alpha. Configure the application to run using the Windows XP Service Pack 3 compatibility mode. 2. Edit the properties of the Beta application. On the compatibility tab, enable the Run This Program As An Administrator option. This enables the Run As Administrator option without having to right-click the application each time to enable this functionality. 3. You can use the ACT to configure compatibility options for Application Gamma. Case Scenario 2: Restricting Applications at Contoso 1. Configure an AppLocker executable rule that uses a file hash of the data collection application. You cannot use a publisher rule because the application is not digitally signed. 2. Configure this rule to apply to the Everyone group. Block the execution of the application, but configure an exception for the Scientists group. 3. The in-house developers would need to sign the application digitally before you can create a publisher rule for it. Chapter 6: Lesson Review Answers Lesson 1 1. Correct Answer: C a. Incorrect: The Ping command is used to test connectivity. It does not display the IP configuration of a computer’s interfaces. B. Incorrect: The Tracert command is used to test connectivity to a device on a remote network and return information about the intermediate hops. It does not display the IP configuration of a computer’s interfaces. c. Correct: The Ipconfig command displays the IP configuration of a computer’s interfaces. D. Incorrect: The Netstat tool displays protocol statistics. It does not display the IP configuration of a computer’s interfaces. 2. Correct Answers: B, C, and D a. Incorrect: This accesses the Local Area Network (LAN Settings) dialog box. You can select automatic configuration, specify an automatic configuration script, or specify a proxy server. The dialog box does not display connection properties. . install the Windows XP Mode feature and install the application under Windows XP. Windows XP Mode runs a fully virtualized copy of Windows XP on a computer that has the Windows 7 Professional,. computers running Windows Vista or Windows 7 Professional. c. Incorrect: AppLocker cannot be used to block the execution of applications on computers running Windows Vista or Windows 7 Professional. . running Windows 7 Home Premium. B. Incorrect: RAID-0 (disk striping) offers no fault tolerance and you cannot store operating system files on a RAID-0 volume. c. Correct: You can use a RAID-1 volume