71-652 Notes

Ok, here are the notes I've taken for this exam thus far. They're going to be pretty sloppy as I've run out of editing fuel (beer), and I have no motivation to spend any more time with this tonight.

These were originally handwritten, and I typed them up fast (sorry for the typos) and organized them as best I could. Some sections may contain similar notes because I compiled these from several different resources. That just means it's important, and repetition will help you learn. It's not a mistake or laziness on my part, seriously. I'll try to add new notes as well, so be sure to check back. Who knows? Maybe I'll even tidy things up a little...

Find more posts tagged with

SAVE $250 on Your Microsoft Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Microsoft Boot Camps

Comments

dynamik

WSv - windows server virtualization (The 'v' is lowercase in everything I've seen. I think that's kind of dumb, but whatever)

VHD - virtual HD

SCVMM - system center virtual machine manager - future release for enterprise support

System optimizations which improve VM performance/make children VM-aware are called enlightenments -or- makes OSes aware of WSv-hosted environment. These allow child OSes to operate more efficiently

server virtualization - run multiple servers on same physical server

application virtualization - prevents conflicts between applications on the same computer (inside same OS, not different VMs) by creating application specific copies of shared resources (MS Softgrid)

dynamik

Hypervisor does not contain 3rd party drivers or code, which increases stability and security

Hypervisor sits between hw and parent os, and is less than 1mb in size

hypervisor sites between HW and OS

main reason given for hypervisor not containing drivers is stability, but security is also improved as well

Microkernel hypervisor

hypervisor-compliant OSes (2003/200

in VMs redirect requests for virtual HW to devices in the parent partition via the VMBus

Xen-enabled Linux OSes use a hypervisor adapter to support communication over the VMBus

Non-HV compliant OSes can use an emulator to communicate with the HV

dynamik

server consolidation - services and applications from several machines put onto one (or many to fewer)

This can be multiple physical machines to a single physical machine or multiple physical to multiple VMs on a single physical

separating applications (prevents conflicts and downtime if one fails)

minimize power consumption

simplify administration

reduce costs

save space

increase hardware utilization

increase ROI

better availability

lower hear/easier to cool

easier to physically secure (centralized location allows greater security. Saved money can be used to implement 2/multi-factor authentication)

less required spare parts/inventory/repairs

better hardware utilization only increases power consumption by a little. Having multiple physical machines would draw much more

improved network performance (I take this to mean either between VMs via a VM bus or by having a few share a higher bw connection, such as a few machines sharing a 10gigE as opposed to separate physical machines with 1gigE)

Distributed services, such as DNS, AD, etc. are not ideal candidates for virtualization because of availability, security, and network topology. However, you could lump all distributed services for one site on a single physical machine. For example, it wouldn't make sense for a multi-site organization to have all it's DNS servers in VMs on a single physical machine. However, each site could have a single physical machine that ran VMs of DHCP, DNS, AD, etc.

Virtualization can consolidate applications that require different OSes onto a single machine

Downsides:
requires greater initial investment
organizational change / management support
highlights incompatible services (not sure what this is referring to...)

consolidation and visualization are complimentary approaches

virtualization does not improve application compatibility or migration paths

computer migration with WSv

virtualization candidates
-machines that have HW that can't be emulated
-machines that have high resource requirements
+combine machines with different resource usage profiles
+verify HW and software compatibility and OS compatibility
+low resource requirements

Systems Center Operations Manager (SCOM) 2007 includes reports to identify top virtualization candidates. this is the best way to measure and store performance data

pilot virtualizations are important to check predictions

optimizing VM placement
-collect historical performance data
-check minimum resource requirements (remember to add 32mb overhead per VM)
-estimate simultaneous VMs
-resource maximization or load balancing
--assign VMs until resources are depleted
--queuing theory (definition?) prevents some hardware, such as CPU, to be fully maximized
-load balancing puts vms on two or more hosts with similar usage levels
-convert physical to virtual
-deploy vms to host
-monitor to see if predictions are matched. Monitor static at start and continue monitoring active in use

resource maximization increases ROI (centralizes VMs on one host)

load balancing increases reliability (distributes VMs to multiple hosts)

Central management - VMs on a single/few machines are easier to manage than the same number of physical machines

dynamik

VMBus connects parent/HW to children

Parent uses virtual service providers

Children use virtual service clients

VSPs/VSCs connect hardware

Parent partition has:
drivers that operate in kernel mode (ring 0)
connects parent to HW and provides emulation for children
virtual service provider (VSP) provides HW emulation to child OSes
Typically server core
VM service provides management and administrative interaction for child OSes
VM service creates a worker process for each child partition
parent partition provides virtualization services to children, but it still runs on the hypervisor itself

VM Bus connects parent and child OSes

Child OSes
have virtualization service clients (VSCs)
These connect to VSPs via the VMBus for hardware
OS kernel runs in kernel mode (ring 0)
applications run in user mode (ring 3)
maintain separate memory space
enlightenments provide improved integration between parent and child

Server 2008 runs in root or parent partition (root is differentiated between parent later on, is there a difference or are they synonymous?)

Other VMs run in child partitions

root partition initiates hypervisor

VM is superset of child partition

dynamik

Parent requires minimum of 512mb of ram. Add 32mb of overhead for each child OS

Intel VT/AMD-V (revision F2 and later) hardware virtualization is required

Securable ( http://www.grc.com/securable.htm ) is a great tool to check if your HW is compliant

HW DEP

64-bit CPU and parent OS

Approved HW compatible with Hyper Visor

hyper-v integration components (enlightenments) are only available for Server 2003 SP2 or Server 2008

host memory cannot be shared (unlike network, cpu, etc.) and is the ultimate limiting resource for number of concurrently running VMs

physical computer for migration must have a minimum of 96mb of ram and be NTFS

standardized VM HW is ACPI, uniprocessor or multiprocessor, virtual network, virtual HD

Most windows OSes work with abstracted environment, but 3rd party OSes may require drivers

optimizing for load balancing decreases HW usage (per machine)

centralized servers are better candidates

storage limits total number of VMs on a machine

memory limits total running (simultaneous) VMs

512 required for parent OS (add 32mb for children overhead)

x64 intel or AMD (not itanium)

Execute Disable (XD) Bit (Intel) or No Execute (NX) Bit (AMD)

HW virtualization - Intel VT or AMD Virtualation (AMD-V - Revision F2 or later)

adding virtual processors is a dynamic operation and does not require a VM restart

adding NIC is a dynamic operation and does not require a restart

adding memory requires a restart

WSv admin console is used to configure resources

8gb min HD for parent installation

standard, enterprise, and datacenter include hyper-v (x64 versions only!)

dynamik

dynamically expanding - expands as needed up to specified size
fixed - uses specified size immediately
differencing - parent/child, must be merged occasionally
physical/pass-through - best performance - hd no longer accessible other guest OSes (hd must be offline in disk management to be available for this)

actions
compact - dynamically expanding and differencing disks - useful if large amounts of data have been deleted. These types of disks automatically grow, but they do not automatically shrink
convert - fixed to dynamically expanding and dynamically expanding to fixed
expand - dynamic or fixed
merge - differencing - merges differencing disk with parent disk
reconnect - helps find parent if you cannot locate it. Starts automatically if parent is not found

A physical disk is not added through the VHD wizard, but is added to the VM by adding it an IDE (or SCSI?) bus

do not have to start a VM to edit files on a VHD

dynamik

server core can only be administered by CLI and remotely

VHDs can be stored locally or via iSCSI (no mention of fibre channel)

CLI tools, powershell and remote management can be used to manage parent OS

MMC to manage child OSes

server core is recommended, but not require, configuration

physical disk must be offline to mount directly in a physical/pass-through configuration

server manager is used to install hyper-v

might be necessary to install the two updates in c:\windows\wsv (this appears to be for earlier releases and is no longer necessary)

Hyper-V Manager
-new VM
-Import
-Server Settings
-Network Manager
-Edit Disk (edit AND optimize)
-Inspect Disk (basic information)
-Stop Service
-Remove Server
-Refresh
-View
-New Windows From here

you must create virtual networks to have settings other than "Not connected" be available

server manager installs hyper-v (gui)

core command line installation string?

SC VMM can be used to configure things such as memory

hyper-v manager manages VMs

server core is more secure for parent (less attack area)

System Center Virtual Machine Manager
-physical to virtual (p2v) and virtual to virtual conversion
-placement, optimization, consolidation, rapid provisioning, monitoring
-powershell, AD DS (active directory - directory services) integration
-library of image files for VMs and deployment of VM templates

hyper-v manager can connect to local or remote servers/vms

hyper-V provides you with the tools and techniques for server consolidation

BIOS, memory, processor changes require machine to not be running (earlier note said adding virtual cpus is a dynamic action and does not require restart)

hypver-v is integrated with AD and supports group policy
hypver-v manager can perform health monitoring when available/enabled (i.e. sql server integration services. enlightenments for 2003 sp2 and 2008 enable heartbeats as well)

virtual management pack in operations manager 2007 can perform comprehensive health monitoring on hosts, VMs, library servers, and VM Management components

dynamic secure network (internal, private, external)

hyper-v scripting is supported via WMI

powershell and SC VMM scripting allows task automation and other tasks

iSCSI is optimal storage device

static resource usage appears when VMs start.

active resource usage appears while they're running

be sure to take periods of high activity into account when measuring candidates performance (i.e. payroll every two weeks might make accounting servers usage spike)

WSv admin console can limit CPU usage on a VM

VM Management tasks:
VM creation
VM operation (start, pause, resume, etc.)
VM configuration
VHD configuration
Resource Allocation
host management

SCOM manages hosts and VMs

dynamik

Snapshots contain memory state, device state, and content of writeable disks

snapshots
can be taken at any time, even during an installation
occur at virtualization layer in guest os
can take multiple and revert to any
no downtime occurs if VM is running
great for testing, can easily revert
snapshots are great for backup. create a snapshot and backup snapshot. However, you will have to have VHD backed up as snapshots only contain changes
great way to backup without interrupting applications/services

revert (right-click on VM) reverts to last snapshot (confirm?)

snapshots provide backup and recovery solutions

install backup server role in 2008, take full/incremental backups of disks that hold VHDs. VSS can take full and incremental backups of running VMs and do not interfere with operation

2008 VSS fixes inconsistency issues that occurred in 2003/virtual server 2005

backup within vm - backs up data, but does not provide snapshot of data at a particular point in time. be sure to store on a different HD than VHD

suspend and copy vm - requires vhd, vsv, and vmc to be copied all at once. inconsistencies between them can prevent image from restarting. this involves downtime.

create a differencing drive - shutdown machine and create differencing drive. parent vhd may be xcopy'd while the differencing drive is in use. Point in time from differencing drive creation. some downtime. Differencing drive and parent must be merged at some point in the future (requires another shutdown)

snapshots - vm at a specific instant. requires parent VHD. Restores to a specific point in time, does not provide data integrity. Quickly recovers from unexpected problems from update, config changes, etc.

snapshots are very handy for testing and development

dynamik

hyper-v and clustering automate recovery from failures

high availability wizard is used to configure high availability

clustering requires failover clustering and hyper-v role on each physical server. Install via server manager

1. create cluster wizard to create the failover cluster
2. use the new virtual machine wizard to create VMs (storage location must be available to all machines in the cluster)
3. use high availability wizard to make each virtual machine highly available

VHDs must be stored in shared location for clustering

dynamic IT environments provision servers based on actual utilization, not things like expected utilization (which is less flexible)

multiple VMs on several hosts, no specific mapping (explain)

VMs are assigned to hosts based on utilization and demand (i.e. heavy web traffic will result in more web servers being activated)

physical machines can be turned on and off as well as having VMs shifted between hosts based on load

*Automatic provisioning*

Dynamic IT environments
Host loading - VMs moved between hosts to balance load between hosts. This requires miminal downtime, but it also minimizes power and cooling requirements

clustering
parent and child

parent - 2 (multiple, more?) physical computers - both host OS must run windows cluster service. Child VMs run in active/active or active/passive. all VMs are moved to the healthy machine in event of failure
child - runs on one or more physical computers. each child OS runs cluster service and services/apps must be cluster-aware. services are failed over to other child vm, like hw-based clustering

parent clustering does not require apps/services/os to be cluster-aware (occurs at VM level)

parent and child clustering can be combined

iSCSI storage is ideal for both parent and child clustering. Removes 2-node limitations from parallel scsi (example). So does this mean more than 2 physical machines can be setup for parent clustering?

iSCSI allows multiple storage locations (devices).

iSCSI allows 8-way clustering (child? parent? both?)

Storage Access - iSCSI - save state and transfer control to another machine with minimal downtime

application mix - mix and match applicatiosn and services on short notice. don't have to setup another physical machine; simply start a preconfigured VM

service availability - 5 9s (99.999%) uptime or higher might require physical computers. VMs have minor service outages as hosts are switched

parent clustering - configure VM as a resource group
-also need generic script to restart VM if necessary
-storage location is added as a disk resource
-works with 3rd party OSes (child is windows only)
-requires at least two hosts (8 max?)
-protects against host failure (child protects against application failure)

health monitoring shows if your VMs are still running

enterprise and datacenter support clustering and quick migration (VM transfer)

minimizes scheduled and unscheduled downtime (quick migration, health monitoring)

Megadeth4168

I'm taking my exam 3 hours from now! Just saw your notes here! Very nice! I found it helpful to read through to see how my studying has compared. Thanks for posting this, I found a few things I didn't know.

sprkymrk

Hmmm, methinks dynamik is trying for sticky status....
I shall await peer pressure before making any decisions. :P

dynamik

Megadeth4168 wrote:

I'm taking my exam 3 hours from now! Just saw your notes here! Very nice! I found it helpful to read through to see how my studying has compared. Thanks for posting this, I found a few things I didn't know.

Cool. Good luck with that!

Let me know if there were any topics that weren't covered (without violating your NDA, obviously). There are still a decent number of items from the outline that I am unsure about.

astorrs had a couple of supplementary links:
https://connect.microsoft.com/InvitationUse.aspx?ProgramID=2307&InvitationID=MP31-GT76-X98X&SiteID=297%20
http://blogs.msdn.com/tvoellm/archive/tags/Hyper-V/default.aspx

They look good, but I haven't had a chance to really go through them yet.

sprkymrk wrote:

Hmmm, methinks dynamik is trying for sticky status....
I shall await peer pressure before making any decisions. :P

That's funny

Let's hold off on that for the time being though. This exam is only available until next Monday. I'll clean this up and add more content once the exam is out of beta. Actually taking the exam will give me a better idea of which areas to beef up.

undomiel

I'm scheduled for Friday so these notes are gold to me.

Thanks dynamik!

shednik

Nice notes dynamik, don't think I'll be looking at this exam any time soon but its a nice read.

Megadeth4168

I gotta be honest... The exam was fairly difficult for me. Mostly because my exposure to VMs is limited to a couple OSs running on Virtual Server 2005. At least the questions were not long winded. In fact the questions were straight to the point.

The best tips I can give without breaking the NDA would be the following:

Make sure you brush up on SCVMM, not just what it means but how to use it.

Read up on:

Snapshots
Clustering
Virtual networks (ie, Internal, external and private)
Know how to access Hyper-V from clients
Know how to solve issues with VMs

If all else fails, go with your gut feeling. Unfortunately, I did not get a chance to play with Hyper-V or SCVMM, and had only a week to prepare so I'm afraid I can't provide the best synopsis, but to me it felt difficult, sure there were a few "gimmes" but overall, I don't foresee a passing mark on this beta in my future. my guess is that I will be in the 500's on this one. Now we wait for at least 9 weeks!

dynamik

Even a 500-something is pretty respectable considering you didn't get any hands-on. I'm sorry to hear things didn't go better for you though.

The wait is going to suck. I get annoyed that I don't get my score immediately after I click finish.

Are you going to take this again once it's out of beta or were you just taking this for fun?

Megadeth4168

I was taking this for 2 reasons. 1 being for fun and 2 being that we are looking at virtualization in the future where I work, so I kinda gave myself an excuse to start looking into it more.

As to weather or not I plan on taking this exam (if I failed) when the public release is out.... I don't know, it really depends on what we end up going with at work. If we end up with a compatible 2008 server running Hyper-V than yes I will take this again. All my exam choices (minus BETAs) revolve around what I'm needed to do at work.

dynamik

Cool. Oh, I forgot to ask. How long did it take you? It seems like they blocked off a ridiculously large amount of time for this.

Megadeth4168

About an hour and 15 minutes

SWM

Also took the exam today, and agree with Megadeth4168's, description of its content.

I was expecting many questions on how Virtulization works and its real technical aspects, but the majority of the exam focussed on using the product and how to manage it via various means (clients, other servers, power shell etc etc).

75 questions, had heaps of time but only took me around 1.5 hrs. Not sure if I passed due to lack of study/material, but well worth the look and experience.

dynamik

Thanks for the feedback everyone.

I "printed" the help file for SC VMM to a PDF. You can grab it here. There's a lot to it, and I'm going to be lucky to get through it, let alone make notes for it.

dynamik

This guide has a great section on hyper-v: http://www.microsoft.com/whdc/system/sysperf/Perf_tun_srv.mspx

I came across a lot of new info there.

AEV

Guess I was one of the last ones to sit this. It went just as everyone said. A lot of SCVMM, and Clustering.

Now all we have to do is wait 6 weeks, more or less.....