Microsoft 70-410 Online Practice Questions and Exam Preparation

Microsoft 70-410 Online Questions & Answers

• Question 111:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2.

  The domain contains a server named Server1 that runs Windows Server 2012 R2.

  You need to ensure that when users log on to Server1, their user account is added automatically to a local group named Group1 during the log on process.

  Which Group Policy settings should you modify?

  A. User Rights Assignment
  B. Preferences
  C. Security Options
  D. Restricted Groups
  B. Preferences

  ---

  With Preferences, local and domain accounts can be added to a local group without affecting the existing members of the group

  References:

  Training Guide: Installing and Configuring Windows Server 2012 R2: Chapter 8: File Services and Storage, p. 361.

  http://technet.microsoft.com/en-us/library/cc785631(v=ws.10).aspx

  http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/

  http://technet.microsoft.com/en-us/library/cc780182(v=ws.10).aspx

  http://technet.microsoft.com/en-us/library/hh831424.aspx

• Question 112:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1. Server1 runs Windows Server 2012 R2.

  You create a group Managed Service Account named gservice1.

  You need to configure a service named Service1 to run as the gservice1 account. How should you configure Service1?

  A. From a command prompt, run sc.exe and specify the privs parameter
  B. From Windows PowerShell, run Set-Service and specify the -PassThrough parameter
  C. From the Services console, configure the Log On settings
  D. From the Services console, configure the Recovery settings
  E. From the Services console, configure the General settings.
  C. From the Services console, configure the Log On settings

  ---

  References: https://technet.microsoft.com/en-us/library/dd548356.aspx

• Question 113:

  Your network contains an Active Directory domain named contoso.com. The domain contains a member server named Server1. Server1 runs Windows Server 2012 R2 and has the Hyper-V server role installed.

  You create an external virtual switch named Switch1. Switch1 has the following configurations: Connection type: External network

  

  Single-root I/O virtualization (SR-IOV): Enabled

  

  Ten virtual machines connect to Switch1.

  

  You need to ensure that all of the virtual machines that connect to Switch1 are isolated from the external network and can connect to each other only. The solution must minimize network downtime for the virtual machines. What should you do?

  A. Remove Switch1 and recreate Switch1 as an internal network.
  B. Change the Connection type of Switch1 to Private network.
  C. Change the Connection type of Switch1 to Internal network.
  D. Remove Switch1 and recreate Switch1 as a private network.
  D. Remove Switch1 and recreate Switch1 as a private network.

  ---

  You cannot change the type of vswitch from external to private when SR-IOV is enabled at vswitch creation ->you need to recreate the vswitch.

• Question 114:

  Your network contains an Active Directory domain named contoso.com. The network contains a member server named Server1 that runs Windows Server 2012 R2. Server1 has the DNS Server server role installed and has a primary zone for contoso.com.

  The Active Directory domain contains 500 client computers. There are an additional 20 computers in a workgroup.

  You discover that every client computer on the network can add its record to the contoso.com zone.

  You need to ensure that only the client computers in the Active Directory domain can register records in the contoso.com zone.

  What should you do first?

  A. Move the contoso.com zone to a domain controller that is configured as a DNS server.
  B. Configure the Dynamic updates settings of the contoso.com zone.
  C. Sign the contoso.com zone by using DNSSEC
  D. Configure the Security settings of the contoso.com zone.
  A. Move the contoso.com zone to a domain controller that is configured as a DNS server.

  ---

  If you install DNS server on a non-DC, then you are not able to create AD-integrated zones. DNS update security is available only for zones that are integrated into AD DS. When your directory- integrate a zone, access control list (ACL)

  editing features are available in DNS Manager so that you can add or remove users or groups from the ACL for a specified zone or resource record. Active Directory's DNS Domain Name is NOT a single label name ("DOMAIN" vs. the

  minimal requirement of "domain.com." "domain.local", etc.).

  The Primary DNS Suffix MUST match the zone name that is allowing updates. Otherwise the client doesn't know what zone name to register in. You can also have a different Connection Specific Suffix in addition to the Primary DNS Suffix to

  register into that zone as well.

  AD/DNS zone MUST be configured to allow dynamic updates, whether Secure or Secure and Non-Secure. For client machines, if a client is not joined to the domain, and the zone is set to Secure, it will not register either.

  You must ONLY use the DNS servers that host a copy of the AD zone name or have a reference to get to them. Do not use your ISP's, an external DNS address, your router as a DNS address, or any other DNS that does not have a copy of

  the AD zone. Internet resolution for your machines will be accomplished by the Root servers (Root Hints), however it's recommended to configure a forwarder for efficient Internet resolution. The domain controller is multihomed (which means

  it has more than one unteamed, active NIC, more than one IP address, and/or RRAS is installed on the DC).

  The DNS addresses configured in the client's IP properties must ONLY reference the DNS server(s) hosting the AD zone you want to update in. This means that you must NOT use an external DNS in any machine's IP property in an AD

  environment. You can't mix them either. That's because of the way the DNS Client side resolver service works. Even if you mix up internal DNS and ISP's DNS addresses, the resolver algorithm can still have trouble asking the correct DNS

  server. It will ask the first one first. If it doesn't get a response, it removes the first one from the eligible resolvers list and goes to the next in the list. It will not go back to the first one unless you restart the machine, restart the DNS Client

  service, or set a registry entry to cut the query TTL to 0. The rule is to ONLY use your internal DNS server(s) and configure a forwarder to your ISP's DNS for efficient Internet resolution.

  This is the reg entry to cut the query to 0 TTL:

  The DNS Client service does not revert to using the first server. The Windows 2000 Domain Name System (DNS) Client service (DNS cache) follows a certain algorithm when it decides the order in which to use the DNS servers.

  For DHCP clients, DHCP Option 006 for the clients are set to the same DNS server.

  8.If using DHCP, DHCP server must only be referencing the same exact DNS server(s) in its own IP properties in order for it to `force' (if you set that setting) registration into DNS. Otherwise, how would it know which DNS to send the reg data

  to?

  If the AD DNS Domain name is a single label name, such as "EXAMPLE", and not the proper format of "example.com" and/or any child of that format, such as "child1.example.com", then we have a real big problem.

  DNS will not allow registration into a single labeldomain name.

  This is for two reasons:

  It's not the proper hierarchal format. DNS is hierarchal, but a single label name has no hierarchy. It's just a single name.

  Registration attempts cause major Internet queries to the Root servers. Why? Because it thinks the single label name, such as "EXAMPLE", is a TLD (Top Level Domain), such as "com", "net", etc. It will now try to find what Root name server

  out there handles that TLD. In the end it comes back to itself and then attempts to register. Unfortunately, it does NOT ask itself first for the mere reason it thinks it's a TLD. (Quoted from Alan Woods, Microsoft, 2004):

  "Due to this excessive Root query traffic, which ISC found from a study that discovered Microsoft DNS servers are causing excessive traffic because of single label names, Microsoft, being an internet friendly neighbor and wanting to stop this

  problem for their neighbors, stopped the ability to register into DNS with Windows 2000SP4, XP SP1, (especially XP, which cause lookup problems too), and Windows 2003. After all, DNS is hierarchal, so therefore why even allow single label

  DNS domain names?" The above also *especially* applies to Windows Vista, 7, 2008, 2008 R2, and newer.

  `Register this connection's address" on the client is not enabled under the NIC's IP properties, DNS tab.

  Maybe there's a GPO set to force Secure updates and the machine isn't a joined member of the domain.

  ON 2000, 2003 and XP, the "DHCP client" Service not running. In 2008/Vista and newer, it's the DNS Client Service. This is a requirement for DNS registration and DNS resolution even if the client is not actually using DHCP.

  You can also configure DHCP to force register clients for you, as well as keep the DNS zone clean of old or duplicate entries. Seethe link I posted in my previous post.

• Question 115:

  You have a server named Server1 that runs Windows Server 2012 R2.

  On Server1, you create a local user named User1.

  You need to create a Group Policy object (GPO) that will apply only to User1.

  What should you use?

  A. the Computer Management console
  B. the Group Policy management console
  C. the Group Policy Object Editor console
  D. the New-GPO cmdlet and the Set-GPPermission cmdlet.
  B. the Group Policy management console

  ---

  References: https://www.petri.com/how-to-create-and-link-a-group-policy-object-in-active-directory

• Question 116:

  You work as an administrator at Contoso.com. The Contoso.com network consists of a single domain named Contoso.com. All servers on the Contoso.com network have Windows Server 2012 installed.

  You have received instructions to install the Remote Desktop Services server role on a server, named ENSUREPASS-SR07. You want to achieve this remotely from a server, named ENSUREPASS-SR06.

  Which of the following actions should you take?

  A. You should consider accessing the Server Manager console on ENSUREPASS-SR07.
  B. You should consider accessing the Server Manager console on ENSUREPASS-SR06.
  C. You should consider accessing the TS Manager console on ENSUREPASS-SR07
  D. You should consider accessing the TS Manager console on ENSUREPASS-SR06.
  B. You should consider accessing the Server Manager console on ENSUREPASS-SR06.

• Question 117:

  Your network contains an Active Directory domain named contoso.com. The network contains 500 client computers that run Windows 8. All of the client computers connect to the Internet by using a web proxy.

  You deploy a server named Server1 that runs Windows Server 2012 R2. Server1 has the DNS Server server role installed.

  You configure all of the client computers to use Server1 as their primary DNS server.

  You need to prevent Server1 from attempting to resolve Internet host names for the client computers.

  What should you do on Server1?

  A. Create a primary zone named "root".
  B. Create a primary zone named "GlobalNames".
  C. Create a forwarder that points to 169.254.0.1.
  D. Create a primary zone named ".".
  D. Create a primary zone named ".".

• Question 118:

  Your network contains two servers named Server1 and Server2 that run Windows Server 2012 R2. Server1 is a DHCP server that is configured to have a scope named Scope1. Server2 is configured to obtain an IP address automatically.

  In Scope1, you create a reservation named Res_Server2 for Server2.

  A technician replaces the network adapter on Server2.

  You need to ensure that Server2 can obtain the same IP address.

  What should you modify on Server1?

  A. The Name Protection settings of Scope1
  B. The MAC address of Res_Server2
  C. The Advanced settings of Res_Server2
  D. The Network Access Protection Settings of Scope1
  B. The MAC address of Res_Server2

  ---

  DHCP reservations are given based upon MAC address (at least on IPv4/DHCPv4).

  For clients that require a constant IP address, you can either manually configure a static IP address, or assign a reservation on the DHCP server. Reservations are permanent lease assignments that are used to ensure that a specified client

  on a subnet can always use the same IP address. You can use DHCP reservations for hosts that require a consistent IP address, but do not need to be statically configured. DHCP reservations provide a mechanism by which IP addresses

  may be permanently assigned to a specific client based on the MAC address of that client. The MAC address of a Windows client can be found running the ipconfig /all command. For Linux systems the corresponding command is ifconfig -a.

  Once the MAC address has been identified, the reservation may be configured using either the DHCP console or at the command prompt using the netsh tool.

  Media access control (MAC) address authorization functions in the same way as automatic number identification (ANI) authorization, but it is used for wireless clients and clients connecting to your network by using an 802.1X authenticating switch. Since the network adapter was replaced, you need to modify the MAC address on Server1 to ensure that Server2 can obtain the same IP address.

  Reference: http://technet.microsoft.com/en-us/library/dd197535%28v=WS.10%29.aspx

• Question 119:

  A company's server security team needs a solution that will prevent users from installing and using unauthorized applications on their Windows 8 desktop computers.

  Which technology should the team choose?

  A. Starter GPOs
  B. Group Policy Objects
  C. Software Restriction Policies
  D. AppLocker
  D. AppLocker

  ---

  AppLocker (Application Locker) can help prevent malicious (malware) and unsupported applications from affecting computers. These include executable files, scripts, Windows Installer files, DLLs, Packaged apps and Packaged app

  installers.

  Quick Tip: AppLocker is also supported by Windows Server 2008 R2 and Windows 7.

• Question 120:

  You have a Hyper-V host named Host1. Host1 contains two virtual machines named VM1 and VM2. VM1 is configured as a print server. VM1 runs Windows Server 2008 R2. VM2 is configured as a file server. VM2 runs Windows Server 2012

  R2.

  You need to migrate all of the printers on VM1 to VM2.

  Which actions should you perform on the virtual machines? To answer, drag the appropriate action to the correct servers in the answer area. Each action may be used once, more than once, or not at all. You may need to drag the split bar

  between panes or scroll to view content.

  Select and Place:

  

  

  ---

  On VM1 we export the printers. On VM2 we first install the Print and Document Services role, and then import the printers. You must install the Print and Document Services role on the destination server before you begin the migration process.