Your company has an Active Directory forest. The company has branch offices in three locations.  Each location has an organizational unit.    
You need to ensure that the branch office administrators are able to create and apply GPOs only  to their respective organizational units.    
Which two actions should you perform（）

Your company has an Active Directory domain that has an organizational unit named Sales. The  Sales organizational unit contains two global security groups named sales managers and sales  executives.    
You need to apply desktop restrictions to the sales executives group.    
You must not apply these desktop restrictions to the sales managers group. You create a GPO  named DesktopLockdown and link it to the Sales organizational unit.    
What should you do next（）

Your company has an organizational unit named Production. The Production organizational unit  has a child organizational unit named R&D. You create a GPO named Software Deployment and  link it to the Production organizational unit.    
You create a shadow group for the R&D organizational unit. You need to deploy an application to  users in the Production organizational unit. You also need to ensure that the application is not  deployed to users in the R&D organizational unit.    
What are two possible ways to achieve this goal（）

You are installing an application on a computer that runs Windows Server 2008 R2. During  installation， the application will need to add new attributes and classes to the Active Directory  database.    
You need to ensure that you can install the application.    
What should you do（）

You want users to log on to Active Directory by using a new User Principal Name （UPN）. 
You  need to modify the UPN suffix for all user accounts.    
Which tool should you use（）

You need to relocate the existing user and computer objects in your company to different  organizational units.    
What are two possible ways to achieve this goal（）

Your company hires 10 new employees. You want the new employees to connect to the main  office through a VPN connection. You create new user accounts and grant the new employees  the Allow Read and Allow Execute permissions to shared resources in the main office.    
The new employees are unable to access shared resources in the main office. You need to  ensure that users are able to establish a VPN connection to the main office.    
What should you do（）

Your company’s security policy requires complex passwords.
You have a comma delimited file named import.csv that contains user account information. You  need to create user accounts in the domain by using the import.csv file.  
You also need to ensure that the new user accounts are set to use default passwords and are  disabled.    
What should you do（）

You have a Windows Server 2008 R2 that has the Active Directory Certificate Services server  role installed.  
You need to minimize the amount of time it takes for client computers to download a certificate  revocation list （CRL）.    
What should you do（）

Your company has an Active Directory forest. You plan to install an Enterprise certification  authority （CA） on a dedicated stand-alone server.  
When you attempt to add the Active Directory Certificate Services （AD CS） server role， you find  that the Enterprise CA option is not available.  
You need to install the AD CS server role as an Enterprise CA.    
What should you do first（）

You have an Active Directory domain that runs Windows Server 2008 R2. You need to implement  a certification authority （CA） server that meets the following requirements：    
- Allows the certification authority to automatically issue certificates  - Integrates with Active Directory Domain Services    
What should you do（）