70-411 Test Bank, Lesson 3 Monitoring Servers

16 Multiple Choice
6 Short Answer
4 Best Answer
3 Build List
4 Repeated Answer
33 questions

Multiple Choice
1. When you set a service to start automatically with delayed start, how long is the
delay?
a. One minute
b. Two minutes
c. Five minutes
d. Delayed until all other services start
Answer: b
Difficulty: Easy
Section Ref: Using the Services Console
Explanation: The Automatic (Delayed Start) setting specifies that the service should
start automatically after the services marked as automatic have started (which is
approximately two minutes).
2. When creating service accounts, you should follow the rule of what type of rights
and permissions?
a. simple
b. domain
c. minimal
d. privileged
Answer: c
Difficulty: Easy
Section Ref: Using the Services Console
Explanation: As a general rule, you should use the account with minimal rights and
permissions for the service to operate.

3. If you install SQL Server and a third-party backup service on the same system,
what rule should you follow when creating service accounts?
a. Create difficult-to-guess usernames and passwords.
b. Use a single account for both services.
c. Use separate accounts for both services.
d. Add the service accounts to the Local Administrators group.
Answer: c
Difficulty: Medium
Section Ref: Using the Services Console
Explanation: You should use different service accounts for different services. For
example, if you install Exchange and SQL on a server, you should have a service
account for Exchange and a different service account for SQL.
4. Which of the following tasks does the Event Viewer MMC snap-in allow you to
perform?
a. Save useful event filters as custom views that can be reused.
b. Alter or edit events, such as change the date or time.
c. Create custom events from the Event Template.
d. Resolve events directly from the Event Console.
Answer: a
Difficulty: Easy
Section Ref: Using Event Viewer
Explanation: Event Viewer enables you to perform the following tasks: View events
from multiple event logs, save useful event filters as custom views that can be
reused, schedule a task to run in response to an event, and create and manage
event subscriptions.
5. The Event Viewer is essentially what kind of tool?
a. registry cleanup
b. conflict resolver
c. log viewer
d. Performance Monitor
Answer: c
Difficulty: Medium
Section Ref: Using Event Viewer
Explanation: One of the most useful troubleshooting tools is the Event Viewer, which
is essentially a log viewer.
6. What types of tasks can you add to events?
a. Start a program, send an instant message, and display a message.

b. Send a beep to the computer speakers, send an instant message, and display a
message.
c. Send an email, send an instant message, and display a message.
d. Send an email, start a program, and display a message.
Answer: d
Difficulty: Medium
Section Ref: Adding a Task to an Event
Explanation: When adding a task to an event, you add the task action on the Action
page by choosing to start a program, send an e-mail, or display a message.
7. Microsofts new Event Viewer allows you to collect events from remote computers
and store them locally. By what name is this collection of events known?
a. event logging
b. event virtualization
c. event consolidation
d. event subscription
Answer: d
Difficulty: Medium
Section Ref: Configuring Event Subscriptions
Explanation: Todays Event Viewer can be used to collect copies of events from
multiple remote computers and store them locally. To specify which events to
collect, you create an event subscription.
8. What function does a computer perform when its issued the command wecutil
qc?
a. event collecting
b. event receiving
c. event extracting
d. event collating
Answer: b
Difficulty: Medium
Section Ref: Configuring Event Subscriptions
Explanation: By executing the wecutil qc command, you configure the receiving
computer to receive events.
9. The Reliability Monitor provides a range of numbers to help you evaluate the
reliability of a computer. What is the name of this range of numbers?
a. Reliability Index
b. Stability Index
c. Event Index
d. Evaluation Index

Answer: b
Difficulty: Hard
Section Ref: Using Reliability Monitor
Explanation: The Reliability Monitor provides a stability index that ranges from 1
(the least stable) to 10 (the most stable). You can use the index to help evaluate the
reliability of your computer.
10. What do you need to do if you run the Reliability Monitor but it is blank?
a. Check the Event logs.
b. Reboot the computer.
c. Run a consistency check on the registry.
d. Enable the Reliability Monitor.
Answer: d
Difficulty: Medium
Section Ref: Using Reliability Monitor
Explanation: If the Reliability Monitor is blank, you need to enable it.
11. To examine performance correctly, you must establish a performance baseline.
When do you perform this task?
a. during lowest usage
b. during normal usage
c. during peak usage
d. during weekend usage
Answer: b
Difficulty: Medium
Section Ref: Managing Performance
Explanation: You usually cannot identify performance problems just by taking a
quick look at performance. Instead, you need a baseline, which you can get by
analyzing the performance when the system is running normally within design
specifications.
12. What can Task Manager tell you about performance?
a. that your system needs to be replaced
b. that you need a larger hard drive
c. that you need to reboot the system
d. that you might have a bottleneck
Answer: d
Difficulty: Medium
Section Ref: Using Task Manager

Explanation: Task Manager is one of the handiest programs you can use to take a
quick glance at performance to see which programs are using the most system
resources on your computer.
13. Task Manager is not a definitive performance tool because it gives you what kind
of look at computer performance?
a. in-depth analysis
b. high-level overview
c. quick glance
d. performance history
Answer: c
Difficulty: Easy
Section Ref: Using Task Manager
Explanation: Task Manager gives you a quick glance at performance and provides
information about programs and processes running on your computer.
14. What term describes an instance of a program being executed?
a. program
b. event
c. process
d. procedure
Answer: c
Difficulty: Medium
Section Ref: Using Task Manager
Explanation: A process is an instance of a program being executed.
15. Resource Monitor is a powerful tool for understanding how your system
resources are used by what two system consumers?
a. processes and handles
b. files and processes
c. handles and services
d. services and processes
Answer: d
Difficulty: Medium
Section Ref: Using Resource Monitor
Explanation: Resource Monitor is a powerful tool for understanding how your system
resources are used by processes and services.
16. You have a computer that is running Windows Server 2012 R2. In the middle of
the night, a backup job runs. However, you receive reports that some of the services

are failing during this time. How can you determine if this is a performance problem
without actually being on the computer in the middle of the night?
a. Configure a scheduled task to start Performance Monitor.
b. Schedule Performance Monitor from a DCS Properties Schedule tab.
c. Schedule Task Manager to start at the middle of the night.
d. Schedule the Event Viewer to start Performance Monitor when the first error
occurs.
Answer: b
Difficulty: Medium
Section Ref: Scheduling Performance Monitoring
Explanation: Performance monitoring can be scheduled so that you can collect
performance information when you are not actually at the computer; you can
access this feature by opening the DCS properties and clicking the Schedule tab.

Short Answer
17. List the five Resource Monitor tabs.
Answer: Overview, CPU, Memory, Disk, and Network
Difficulty: Medium
Section Ref: Using Resource Monitor
Explanation: Resource Monitor includes five tabs: Overview, CPU, Memory, Disk, and
Network.
18. Name two ways of starting the Performance Monitor.
Answer: Running the perfmon command and from Administrative Tools
Difficulty: Medium
Section Ref: Using Performance Monitor
Explanation: Resource Monitor is included in Computer Management and can be
opened as a stand-alone console from Administrative Tools. It can also be started by
executing the perfmon command.
19. Performance counters are measurements of what?
Answer: System state or activity
Difficulty: Hard
Section Ref: Configuring Data Collector Sets (DCS)
Explanation: Performance counters are measurements of system state or activity.
20. If a particular service or program creates a bottleneck for a system, what can
you configure on a system to kill a service or process?

Answer: A performance alert

Difficulty: Medium
Section Ref: Configuring Performance Alerts
Explanation: In Performance Monitor, a performance alert is a notification or task
that is executed when a performance value is reached. You also can use
Performance Monitor to start certain tasks when certain counters reach a particular
value.
21. Name at least three things to check if you experience network connectivity
problems.
Answer: Check network cables, check IP configuration, be sure the NIC is enabled,
ping the local IP address, ping the gateway address, ping another computer, use
tracert, use nslookup.
Difficulty: Medium
Section Ref: Monitoring the Network
Explanation: See the introductory section of Monitoring the network for the list and
explanations.
22. What do you view on your system with the netstat command?
Answer: Inbound and outbound TCP/IP connections
Difficulty: Medium
Section Ref: Using the netstat Command
Explanation: You use the netstat command to view the TCP/IP connections, both
inbound and outbound, on your computer.

Best Answer
23. Which tool allows you to best monitor resource usage on a virtual machine host
and its individual virtual machines?
a. Task Manager
b. Hyper-V Resource Metering
c. Performance Monitor
d. Resource Monitor
Answer: b
Difficulty: Medium
Section Ref: Monitoring Virtual Machines
Explanation: To monitor a virtual machine running Windows, you can still use Server
Manager, Computer Management, Event Viewer, Performance Monitor, and all of the

other tools. However, Hyper-V Resource Metering allows you to view the resource
usage of a host and individual VMs.
24. When troubleshooting services on your system, why might you want to start up
in Safe mode?
a. because the system boots with a lower screen resolution
b. because the system loads a minimal set of drivers
c. because the system starts only the core services
d. because the system gives you limited rights
Answer: c
Difficulty: Easy
Section Ref: Using the Services Console
Explanation: If the system does not boot because of the enabled or disabled service,
try to start the computer in Safe mode, which starts only the core services needed
to operate, loads only the necessary drivers to operate, and loads in 640x480
screen resolution with the minimum number of colors. While in Safe mode, you
should have an opportunity to fix the problem.
25. To relieve a performance bottleneck or to increase overall performance, what
one thing can you do to a system?
a. Reboot it.
b. Defragment the hard drive.
c. Add more RAM.
d. Chart the performance over time.
Answer: c
Difficulty: Medium
Section Ref: Managing Performance
Explanation: One of the most common bottlenecks is the amount of memory the
system has. By increasing the memory, you can often increase the overall
performance of a systemup to a point.
26. What single performance indicator can tell you if your CPU is over capacity and
needs to be replaced?
a. Disk Queue Length
b. Paging File % Usage
c. Physical Disk Time
d. Processor Time
Answer: d
Difficulty: Easy
Section Ref: Using Common Performance Counters

Explanation: %Processor Time measures how busy the processor is. Although the
processor might jump to 100 percent processor usage, the processor should not be
working at 80 percent capacity most of the time. If it is, you should upgrade the
processor (using a faster processor or adding processors) or move some of the
services to other systems.

Build List
27. Order the following steps to set up a new Data Collector Set.
a. Select the System Performance template.
b. Select the location to save the data.
c. Select New Data Collector Set from Performance Monitor.
d. Name the new data collector set.
e. Start the data collector set.
Answer: C D A B E
Difficulty: Medium
Section Ref: Configuring Data Collector Sets (DCS)
Explanation: Refer to the steps from Create a Data Collector Set.
28. Order the following steps to troubleshoot network connectivity.
a. Use ping to check loopback, local IP address, the remote gateway and a remote
computer.
b. Check that the network interface is enabled.
c. Use tracert to check the number of routers or hops between your system and
another.
d. Verify your DNS configuration with nslookup.
e. Check the network cabling or the wireless connection.
f. Check the local IP configuration with ipconfig.
Answer: E B F A C D
Difficulty: Medium
Section Ref: Monitoring the Network
Explanation: Refer to the steps outlined in Objective 1.3 in Monitoring the Network
section.
29. Order the following steps to attach a task to an event.
a. Choose an Action from Start a program, Send an email, or Display a message.
b. Choose Server Manager > Tools > Event Viewer.
c. Enter the location of the script or program to start.
d. Specify the folder to start the program in when the program or script is executed.
e. Select an event and choose Attach Task To This Event.

Answer: B E A C D
Difficulty: Medium
Section Ref: Adding a Task to an Event
Explanation: Refer to the steps from Create a Basic Task.

Repeated Answer
30. When reading events in the Event Viewer, you need to recognize the designated
levels or classifications. What is the definition for the Critical level?
a. An issue has occurred that can impact service or result in a more serious problem
if action is not taken.
b. A failure has occurred from which the application or component that triggered the
event cannot automatically recover.
c. A problem has occurred that might impact functionality that is external to the
application or component that triggered the event.
d. A change in an application or component has occurred (such as an operation has
successfully completed, a resource has been created, or a service started).
Answer: b
Difficulty: Hard
Section Ref: Understanding Logs and Events
Explanation: The Critical level indicates that a failure has occurred from which the
application or component that triggered the event cannot automatically recover.
31. When reading events in the Event Viewer, you need to recognize the designated
levels or classifications. What is the definition for the Information level?
a. An issue has occurred that can impact service or result in a more serious problem
if action is not taken.
b. A failure has occurred from which the application or component that triggered the
event cannot automatically recover.
c. A problem has occurred that might impact functionality that is external to the
application or component that triggered the event.
d. A change in an application or component has occurred (such as an operation has
successfully completed, a resource has been created, or a service started).
Answer: d
Difficulty: Hard
Section Ref: Understanding Logs and Events
Explanation: The Information level indicates that a change in an application or
component has occurred (such as an operation has successfully completed, a
resource has been created, or a service started).
32. When reading events in the Event Viewer, you need to recognize the designated
levels or classifications. What is the definition for the Warning level?

a. An issue has occurred that can impact service or result in a more serious problem
if action is not taken.
b. A failure has occurred from which the application or component that triggered the
event cannot automatically recover.
c. A problem has occurred that might impact functionality that is external to the
application or component that triggered the event.
d. A change in an application or component has occurred (such as an operation has
successfully completed, a resource has been created, or a service started).
Answer: a
Difficulty: Hard
Section Ref: Understanding Logs and Events
Explanation: The Warning level indicates that an issue has occurred that can impact
service or result in a more serious problem if action is not taken.
33. When reading events in the Event Viewer, you need to recognize the designated
levels or classifications. What is the definition for the Error level?
a. An issue has occurred that can impact service or result in a more serious problem
if action is not taken.
b. A failure has occurred from which the application or component that triggered the
event cannot automatically recover.
c. A problem has occurred that might impact functionality that is external to the
application or component that triggered the event.
d. A change in an application or component has occurred (such as an operation has
successfully completed, a resource has been created, or a service started).
Answer: c
Difficulty: Hard
Section Ref: Understanding Logs and Events
Explanation: The Error level indicates that a problem has occurred that might
impact functionality external to the application or component that triggered the
event.