Q71. - (Topic 2)
You have a computer that runs Windows 7.
You create an application shim for a third-party application by using the Microsoft Application Compatibility Toolkit (ACT).
You need to ensure that the application shim is applied the next time you run the application.
What should you do first?
A. Run Sdbinst.exe.
B. Run Msiexec.exe.
C. Right-click the application executable file and modify the compatibility settings.
D. Right-click the application executable file and modify the advanced security settings.
Answer: A
Explanation:
Deploying a custom shim database to users requires the following two actions: Placing the custom shim database (*.sdb file) in a location to which the user's computer has access (either- locally or on the network)- Calling the sdbinst.exe command-line utility to install the custom shim database locally
Demystifying Shims - or - Using the Application Compatibility Toolkit to make your old stuff work with your new stuff
What is a Shim? A shim is one of the very few four-letter words in use by Microsoft that isn't an acronym of some sort. It's a metaphor based on the English language word shim, which is an engineering term used to describe a piece of wood or metal that is inserted between two objects to make them fit together better. In computer programming, a shim is a small library which transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. Shims can also be used for running programs on different software platforms than they were developed for.
How Shims work The Shim Infrastructure implements a form of Application Programming Interface (API) hooking. The Windows API is implemented using a collection of DLLs. Each application built for Windows imports these DLLs, and maintains a table of the address of each of these functions in memory. Because the address of the Windows functionality is sitting in a table, it is straightforward for the shim engine to replace this address with the address of the shim DLL instead. The application is generally unaware that the request is going to a shim DLL instead of to Windows itself, and Windows is unaware that the request is coming from a source other than the application (because the shim DLL is just another DLL inside the application's process). In this particular case, the two objects are the application program and Windows, and the shim is additional code that causes the two to behave better together, as shown below:
Figure 1 Before the shim is applied, the application interacts directly with Windows.
Figure 2 After the shim is applied, the application interacts with Windows indirectly; the shim code is injected and can modify the request to Windows, the response from Windows, or both.
Specifically, it leverages the nature of linking to redirect API calls from Windows to alternative code—the Shim. Calls to external binary files take place through the Import
Address Table (IAT). Consequently, a call into Windows looks like:
Figure 1
Application calling into Windows through the IAT Specifically, you can modify the address of the Windows function resolved in the import table, and then replace it with a pointer to a function in the alternate shim code, as shown in
Figure 2
This redirection happens for statically linked .dll files when the application is loaded. You can also shim dynamically linked .dll files by hooking the GetProcAddress API. Why Should we be using Shims This is the cost-saving route—help the application by modifying calls to the operating system before they get there. You can fix applications without access to the source code, or without changing them at all. You incur a minimal amount of additional management overhead (for the shim database), and you can fix a reasonable number of applications this way. The downside is support as most vendors don't support shimmed applications. You can't fix every application using shims. Most people typically consider shims for applications where the vendor is out of business, the software isn't strategic enough to necessitate support, or they just want to buy some time. For example, a very commonly used shim is a version-lie shim. To implement this shim, we intercept several APIs that are used to determine which version of Windows the application is running on. Normally, this information is passed on to Windows itself, and it answers truthfully. With the shim applied, however, these APIs are intercepted. Instead of passing on the request to Windows, a different version of Windows is returned (for example, Windows XP instead of Windows 7). If the application is programmed to run only on Windows XP, this is a way to trick the application into believing it's running on the correct OS. (Frequently this is all that is necessary to resolve an application compatibility problem!) There are a huge number of tricks you can play with shims. For example: The ForceAdminAccess shim tries to trick the application into believing that the current user is a member of the local Administrator group, even if he is not. (Many applications outright fail if you are not a local administrator, though you may be able to use other tricks, such as UAC File and Registry Virtualization, to resolve the issues that caused the check in the first place.) How it implements this check can be fairly straightforward. For example, this shim intercepts the API IsUserAnAdmin from shell32.dll. The complete source code of the shimmed function (which has wonderful performance characteristics compared to the actual API) is simply return TRUE. The WrpMitigation shim tricks application installers into believing they can write to files that are protected by Windows Resource Protection (WRP). If you try to write to a file that's protected, the shim first creates a new temporary file, marks it to be deleted once the handle is closed, and then returns the handle to the temporary file as if it were the actual protected file. The application installs the crusty old version of kernel32.dll or shell32.dll (or whichever other file it picked up while it was being packaged) into a temp file, but then that temp file goes away and the matching, patched, up-to-date version of the protected file remains on the file system. So, WRP can still ensure that you don't end up with an ancient copy of shell32.dll from Windows 95 on your computer, but the installer won't fail with ACCESS_DENIED when you use this shim. The CorrectFilePaths shim can redirect files from one location to another. So, if you have an application that is trying to write to c:\myprogramdir (which isn't automatically fixed using UAC File and Registry Virtualization), you can redirect the files that are modified at runtime to a per-user location. This allows you to run as a standard user without having to loosen access control lists (ACLs), because you know your security folks hate it when you loosen ACLs. NOTE: As shims run as user-mode code inside a user-mode application process, you cannot use a shim to fix kernel-mode code. For example, you cannot use shims to resolve compatibility issues with device drivers or with other kernel-mode code. (For example, some antivirus, firewall, and antispyware code runs in kernel mode.)
When can we use a Shim: You acquired the application from a vendor that is no longer in business. Several applications are from vendors that have since gone out of business; so clearly, support is no longer a concern. However, because the source code is not available, shimming is the only option for compatibility mitigation. You developed the application internally. While most customers would prefer to fix all their applications to be natively compatible, there are some scenarios in which the timing does not allow for this. The team may not be able to fix all of them prior to the planned deployment of new version of Windows, so they may choose to shim the applications that can be shimmed and modify the code on the ones where shims are insufficient to resolve the compatibility issue. You acquired the application from a vendor that will eventually be releasing a compatible version, but support is not critical. When an off-the-shelf application is neither business critical nor important, some customers use shims as a stopgap solution. Users could theoretically wait until a compatible version is available, and its absence would not block the deployment, but being able to provide users with a shimmed and functional version can bridge that gap until a compatible version is available.
Creating an Application Compatibility Shim If you are trying to run an application that was created for 2000 or XP and had problems running in Windows 7, you could always turn on compatibility mode for the executable on your machine. However if you are trying to create a shim that could be used on other machines as well, you could use the following instructions to create the shim and send it. It is a very small size and once executed, will always be associated with that executable on that machine.
ACT is the Application Compatibility Toolkit. Download it from here: http://www.microsoft.com/downloads/details.aspx?familyid=24da89e9-b581-47b0-b45e-492dd6da2971&displaylang=en
Once we launch the Compatibility Administrator Tool, from Start Menu – Microsoft Application Compatibility Toolkit:
Right-click on New Database:
Choose Application Fix here. In this below dialog, give the application details and the executable you would want to fix:
1. Type the name of the program to fix
2. Type the vendor name
3. Browse to location of executable
When you press the next button, you will get to see the list of the compatibility modes listed by default. If you have an issue with just version incompatibility then choose the version in which the application was working earlier. At this point I have already determined that Windows 2000 compatibility mode will work for this program.
In the list box, scroll down and select "Windows 2000".
In the next window (when you have combination of shims to be chosen). As shown below, you have lots of shims to choose from. Select all the shims which would fix your application.
Click on Finish. This will give you the complete summary of the application and the fixes applied.
Now you need to save this shim database file (A small database including the shim information is created), and install it. You can either install it by right-clicking on the shim and pressing the install button, or by using a command-line option, sdbinst.exe <database. sdb>.
NOTE: "sdbinst.exe" is already located by default in c:\windows\system32
Once the Application Compatibility Database is installed, we can run the program from the location specified earlier (in the first window). Now the program should be running in the Compatibility mode that you specified during the process.
Q72. - (Topic 1)
You have a computer that runs Windows 7.
You need to view the processes that currently generate network activity.
What should you do?
A. Open Resource Monitor and click the Network tab.
B. Open Windows Task Manager and click the Networking tab.
C. Open Event Viewer and examine the NetworkProfile Operational log.
D. Open Performance Monitor and add all the counters for network interface.
Answer: A
Explanation:
Resource Monitor Windows 7 offers an enhanced version of the Resource Monitor tool. Windows 7 Resource Monitor allows you to view information about hardware and software resource use in real time. You can filter the results according to the processes or services that you want to monitor. You can also use Resource Monitor to start, stop, suspend, and resume processes and services, and to troubleshoot unresponsive applications. You can start Resource Monitor from the Processes tab of Task Manager or by entering resmon in the Search box on the Start menu. To identify the network address that a process is connected to, click the Network tab and then click the title bar of TCP Connections to expand the table. Locate the process whose network connection you want to identify. You can then determine the Remote Address and Remote Port columns to see which network address and port the process is connected to.
Q73. - (Topic 6)
You are a network administrator for a global company that has Windows Server 2008 R2 servers and Windows 7 Enterprise computers.
Management wants to decrease VPN costs by implementing DirectAccess for remote network access.
They assign you to evaluate the current network infrastructure, which includes the following elements:
Active Directory
IPv6 network and applications
Server for DirectAccess service
You need to ensure that all critical infrastructure components are present.
What should you add to the infrastructure?
A. Windows Internet Name Service (WINS) server
B. Public key infrastructure
C. NAT-PT devices
D. Windows Server 2012
Answer: B
Explanation: DirectAccess With Windows Server 2008 R2 requires:
* Public key infrastructure (PKI) to issue computer certificates.
* One or more DirectAccess servers running Windows Server 2008 R2 with two network adapters: one that is connected directly to the Internet, and a second that is connected to the intranet.
* On the DirectAccess server, at least two consecutive, public IPv4 addresses assigned to the network adapter that is connected to the Internet.
* DirectAccess clients running Windows 7 or Windows 8 "Enterprise" edition clients
* At least one domain controller and Domain Name System (DNS) server running Windows Server 2008 SP2 or Windows Server 2008 R2.
Note: DirectAccess, also known as Unified Remote Access, is a VPN-like technology that provides intranet connectivity to client computers when they are connected to the Internet. Unlike many traditional VPN connections, which must be initiated and terminated by explicit user action, DirectAccess connections are designed to connect automatically as soon as the computer connects to the Internet. DirectAccess was introduced in Windows Server 2008 R2, providing this service to Windows 7 and Windows 8 "Enterprise" edition clients.
Q74. DRAG DROP - (Topic 6)
Your organization needs to perform a Windows Vista to Windows 7 migration for a department with 150 computers.
You want to use User State Migration Tool (USMT) to automate the migration.
You need to move user data and custom settings from the source computers to the destination computers by using USMT with minimal downtime or impact to the end users. The transfer must include files in several custom directories located in the root directory of the boot volume.
Which four actions should you perform in sequence? (To answer, move the appropriate four actions from the list of actions to the answer area and arrange them in the correct order. )
Answer:
Q75. - (Topic 6)
You are deploying a number of Windows 7 laptops.
You create a custom power plan on one of the laptops that you want to replicate to the other laptops by using an unattended setup.
You need to capture the power plan from the configured laptop for use in the deployment of the other laptops, save it to the removable drive F:, and name it MobileScheme.
What should you do?
A. Run the command powercfg duplicatescheme <GUID> F:\MobileScheme.pow from an elevated command prompt.
B. Run the command powercfg -EXPORT F:\MobileScheme.pow {GUID} from an elevated command prompt.
C. Run the command powercfg -S F:\MobileScheme.pow from an elevated command prompt.
D. Create a power plan from the Power Options control panel and save it to the F: drive as MobileScheme.
Answer: B
Q76. - (Topic 1)
You have a computer that runs Windows Vista. The computer contains a custom application.
You need to export the user state and the settings of the custom application.
What should you do?
A. Run Loadstate.exe and specify the /config parameter.
B. Run Scanstate.exe and specify the /genconfig parameter.
C. Modify the miguser.xml file. Run Loadstate.exe and specify the /ui parameter.
D. Modify the migapp.xml file. Run Scanstate.exe and specify the /i parameter.
Answer: D
Explanation:
MigApp.xml This file contains rules about migrating application settings. These include Accessibility settings, dial-up connections, favorites, folder options, fonts, group membership, Open Database Connectivity (ODBC) settings, Microsoft Office Outlook Express mailbox files, mouse and keyboard settings, phone and modem options, Remote Access Service (RAS) connection phone book files, regional options, remote access, screensaver settings, taskbar settings, and wallpaper settings.(Include) /i:[Path\]FileName Specifies an .xml file that contains rules that define what user, application or system state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigUser.xml and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.NOT MigUser.xmlMigUser.xml This file contains rules about user profiles and user data. The default settings for this file migrate all data in My Documents, My Video, My Music, My Pictures, desktop files, Start Menu, Quick Launch settings, favorites, Shared Documents, Shared Video, Shared Music, Shared desktop files, Shared Pictures, Shared Start menu, and Shared Favorites. This file also contains rules that ensure that all the following file types are migrated from fixed volumes: .qdf, .qsd, .qel, .qph, .doc, .dot, .rtf, .mcw, .wps, .scd, .wri, .wpd, .xl*, .csv, .iqy, . dqy, .oqy, .rqy, .wk*, .wq1, .slk, .dif, .ppt*, .pps*, .pot*, .sh3, .ch3, .pre, .ppa, .txt, .pst, .one*, .mpp, .vsd, .vl*, .or6, .accdb, .mdb, .pub, .xla, .xlb and .xls. The asterisk ( *) represents zero or more characters.
Q77. - (Topic 5)
You administer a desktop computer that has the following hardware specifications:
. Dual-core 2.5 GHz processor
. 1 GB RAM
. 25 GB unpartitioned disk space
. Onboard graphics that has WDDM 1.0
You install a customized Windows 7 Enterprise 64-btt image on the computer by using unpartitioned disk space. The computer operates unacceptably slow.
You need to improve the performance of the computer.
What should you do?
A. Install a video card that has 128 MB of video RAM.
B. Perform the initial Windows Experience Index run.
C. Upgrade the processor.
D. Install another 1 GB of RAM.
Answer: D
Explanation: http://windows.microsoft.com/en-us/windows7/products/system-requirements Should have 2GB RAM as a minimum.
Q78. - (Topic 2)
Your network consists of an Active Directory domain and 100 computers that run Windows 7.
The domain contains a logon script named logon.cmd.
You plan to deploy a new application named app1.msi by using the logon script. App1.msi is stored in \\server1\share1.
You need to modify the logon script to deploy the application.
What should you include in the logon script?
A. Sbdinst.exe -u \\server1\share1\app1.msi -q
B. Msinfo32.exe \\server1\share1\app1.msi
C. Pkgmgr.exe /ip /m:\\server1\share1\app1.msi
D. Msiexec.exe /i \\server1\share1\app1.msi /quiet
Answer: D
Explanation:
Msiexec Provides the means to install, modify, and perform operations on Windows Installer from the command line.
To install or configure a product Syntax msiexec /i {package|ProductCode} /i : Installs or configures a product.
NOT Msinfo32 Displays a comprehensive view of your hardware, system components, and software environment.
Q79. - (Topic 6)
A company has Windows 7 Enterprise computers that use BitLocker drive encryption on operating system drives.
You need to configure multi-factor authentication before client computers are booted into Windows.
On each client computer, what should you do?
A. Configure a TPM PIN.
B. Implement fingerprint authentication.
C. Implement a Dynamic Access Control policy.
D. Install a standalone certification authority server.
Answer: A
Explanation: BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2, you can use additional forms of authentication with the TPM protection. BitLocker offers the option to lock the normal boot process until the user supplies a personal identification number (PIN) or inserts a USB device (such as a flash drive) that contains a BitLocker startup key, or both the PIN and the USB device can be required. These additional security measures provide multifactor authentication and help ensure that the computer will not start or resume from hibernation until the correct authentication method is presented.
Q80. - (Topic 4)
A company has client computers that run Windows 7 Enterprise.
You need to ensure that when Windows runs applications with elevated privileges, it enforces the Public Key Infrastructure (PKI) certification path validation for a given executable file.
What should you use to accomplish this goal?
A. the User Account Control Settings Control Panel window
B. the Services management console
C. Device Manager
D. Local Users and Groups
E. the icacls command
F. the Group Policy management console
G. the folder Properties window
H. share permissions
I. the netsh command
Answer: F
Explanation:
Besides changing the notification behavior of UAC, you can also control the behavior of the UAC by using local or group policies. Local policies are managed from each local computer while group policies are managed as part of Active Directory.
Follow these steps to change UAC settings: Click Start, type secpol.msc in the Search programs and files box, and press Enter. From the Local Security Policy tree, click Local Policies and then double-click Security Options The UAC policies are at the bottom of the list. To modify a setting, simply double-click on it and make the necessary changes.