Microsoft 70-410 Online Practice Questions and Exam Preparation

Microsoft 70-410 Online Questions & Answers

• Question 201:

  Drag and Drop Question

  You plan to deploy a DHCP server that will support four subnets. The subnets will be configured as shown in the following table.

  

  You need to identify which network ID you should use for each subnet. What should you identify? To answer, drag the appropriate network ID to the each subnet in the answer area.

  Select and Place:

  

  

• Question 202:

  Your network contains an Active Directory domain named contoso.com.

  An organizational unit (OU) named OU1 contains user accounts and computer accounts.

  A Group Policy object (GPO) named GP1 is linked to the domain. GP1 contains Computer Configuration settings and User Configuration settings.

  You need to prevent the User Configuration settings in GP1 from being applied to users. The solution must ensure that the Computer Configuration settings in GP1 are applied to all client computers.

  What should you configure?

  A. The GPO Status
  B. The Block Inheritance feature
  C. The Group Policy loopback processing mode
  D. The Enforced setting
  A. The GPO Status

  ---

  You can disable a part of the GPO by blocking the Computer Configuration or User Configuration settings, or both, and don't allow them to be applied. You can enable and disable policies partially or entirely by following these steps:

  1. In the GPMC, select the container for the site, domain, or OU with which you want to work.

  2. Select the policy object you want to work with, and then click the Details tab in the right pane.

  3. Choose one of the following status settings from the GPO Status list and click OK when prompted to confirm that you want to change the status of this GPO:

  All Settings Disabled Disallows processing of the policy object and all its settings.

  Computer Configuration Settings Disabled Disables processing of Computer Configuration settings. This means that only User Configuration settings are processed.

  Enabled Allows processing of the policy object and all its settings.

  User Configuration Settings Disabled Disables processing of User Configuration settings. This means that only Computer Configuration settings are processed.

  

  Incorrect Answers:

  B: By default settings in Group Policy Objects (GPOs) get applied in the following order: Local system policies first, then policies on the Active Directory Domain level, then policies on the Active Directory Site level and then the policies for all the Organization Units the computer and user are members of, starting at the root of the domain. The settings that are last applied are the settings in effect. The Block Inheritance feature affects higher-level GPOs so that they don't apply to the OU with the block inheritance feature. Only those GPOs that are configured directly on the OU will apply and inheritance will continue to child OUs, starting at the parent OU where the blocking is in effect.

  C: The Group Policy loopback processing mode directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this policy

  D: By default settings in Group Policy Objects (GPOs) get applied in the following order: Local system policies first, then policies on the Active Directory Domain level, then policies on the Active Directory Site level and then the policies for all the Organization Units the computer and user are members of, starting at the root of the domain. The settings that are last applied are the settings in effect. When a GPO is enforced it means the settings in the GPO cannot be overruled by a GPO which is link enabled on an Organizational Unit below the Organizational Unit with the enforced GPO.

  References:

  https://blogs.technet.microsoft.com/grouppolicy/2012/11/29/group-policy-in-windows-server-2012-infrastructure-status/

  https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/15/group-policy-basics-part-2-understanding-which-gpos-to-apply/ https://technet.microsoft.com/en-us/library/cc978513.aspx

  https://technet.microsoft.com/en-us/library/dd673616.aspx

• Question 203:

  You perform a Server Core Installation of window Server 2012 R2 on server named Server1.

  You need to add a graphical user interface (GUI) to server1.

  Which tool should you use?

  A. the Install-WindowsFeature cmdlet
  B. the Install-Module cmdlet
  C. the setup.exe command
  D. the Add-WindowsPackage cmdlet
  E. the Install-RoleService cmdlet
  F. the ocsetup.exe command
  G. the imagex.exe command
  A. the Install-WindowsFeature cmdlet

  ---

  Install-WindowsFeature -Installs one or more Windows Server roles, role services, or features on either the local or a specified remote server that is running Windows Server 2012 R2. This cmdlet is equivalent to and replaces Add-WindowsFeature, the cmdlet that was used to install roles, role services, and features in Windows Server 2008 R2. dism /online /get-features PS C:\> Install-WindowsFeature -Name Web-Server ?IncludeAllSubFeature -ComputerName Server1 璚hatIf

  References: https://docs.microsoft.com/en-us/powershell/module/servermanager/install-windowsfeature?view=winserver2012r2-ps https://blogs.technet.microsoft.com/john_taylor/2013/01/08/converting-from-server-2012-core-install-to-full-gui/

• Question 204:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2.

  You create and enforce the default AppLocker executable rules.

  Users report that they can no longer execute a legacy application installed in the root of drive C.

  You need to ensure that the users can execute the legacy application. What should you do?

  A. Create a new rule.
  B. Delete an existing rule.
  C. Modify the action of the existing rules.
  D. Add an exception to the existing rules.
  A. Create a new rule.

  ---

  AppLocker is a feature that advances the functionality of the Software Restriction Policies feature. AppLocker contains new capabilities and extensions that reduce administrative overhead and help administrators control how users can

  access and use files, such as executable files, scripts, Windows Installer files, and DLLs. By using AppLocker, you can:

  Define rules based on file attributes that persist across application updates, such as the publisher name (derived from the digital signature), product name, file name, and file version. You can also create rules based on the file path and hash.

  Assign a rule to a security group or an individual user.

  Create exceptions to rules. For example, you can create a rule that allows all users to run all Windows binaries except the Registry Editor (Regedit.exe). Use audit-only mode to deploy the policy and understand its impact before enforcing it.

  Create rules on a staging server, test them, export them to your production environment, and then import them into a Group Policy Object.

  Simplify creating and managing AppLocker rules by using Windows PowerShell cmdlets for AppLocker.

  AppLocker default rules

  AppLocker allows you to generate default rules for each of the rule types.

  Executable default rule types:

  Allow members of the local Administrators group to run all applications. Allow members of the Everyone group to run applications that are located in the Windows folder. Allow members of the Everyone group to run applications that are

  located in the Program Filesfolder. Windows Installer default rule types:

  Allow members of the local Administrators group to run all Windows Installer files. Allow members of the Everyone group to run digitally signed Windows Installer files. Allow members of the Everyone group to run all Windows Installer files

  located in the Windows\Installer folder. Script default rule types:

  Allow members of the local Administrators group to run all scripts. Allow members of the Everyone group to run scripts located in the Program Files folder. Allow members of the Everyone group to run scripts located in the Windows folder.

  DLL default rule types: (this on can affect system performance ) Allow members of the local Administrators group to run all DLLs. Allow members of the Everyone group to run DLLs located in the Program Files folder. Allow members of the

  Everyone group to run DLLs located in the Windows folder. You can apply AppLocker rules to individual users or to a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow a

  subset of a user group to use an application, you can create a special rule for that subset. For example, the rule "Allow Everyone to run Windows except Registry Editor" allows everyone in the organization to run the Windows operating

  system, but it does not allow anyone to run Registry Editor.

  The effect of this rule would prevent users such as Help Desk personnel from running a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Help Desk user group: "Allow Help

  Desk to run Registry Editor." If you create a deny rule that does not allow any users to run Registry Editor, the deny rule will override the second rule that allows the Help Desk user group to run Registry Editor.

• Question 205:

  Your network contains an Active Directory domain named contoso.com.

  You have a starter Group Policy object (GPO) named GPO1 that contains more than 100 settings.

  You need to create a new starter GPO based on the settings in GPO1.

  You must achieve this goal by using the minimum amount of administrative effort.

  What should you do?

  A. Run the New-GPStarterGPO cmdlet and the Copy-GPO cmdlet.
  B. Create a new starter GPO and manually configure the policy settings of the starter GPO.
  C. Right-click GPO1, and then click Back Up. Create a new starter GPO. Right-click the new GPO, and then click Restore from Backup.
  D. Right-click GPO1, and then click Copy. Right-click Starter GPOs, and then click Paste.
  B. Create a new starter GPO and manually configure the policy settings of the starter GPO.

  ---

  Although GPOs and Starter GPOs can both be copied, and a Starter GPO can be used to create a new GPO (as that is their purpose), an existing GPO cannot be copied to a new Starter GPO (unfortunately).

• Question 206:

  Your network contains a production Active Directory forest named contoso.com and a test Active Directory forest named contoso.test. A trust relationship does not exist between the forests.

  In the contoso.test domain, you create a backup of a Group Policy object (GPO) named GPO1.

  You transfer the backup of GPO1 to a domain controller in the contoso.com domain.

  You need to create a GPO in contoso.com based on the settings of GPO1.You must achieve this goal by using the minimum amount of Administrative effort.

  What should you do?

  A. From Windows PowerShell, run the Get- GPO cmdlet and the Copy- GPO cmdlet.
  B. From Windows PowerShell, run the New- GPO cmdlet and the Import- GPO cmdlet.
  C. From Group Policy Management, create a new starter GPO. Right-click the new starter GPO, and then click Restore from Backup.
  D. From Group Policy Management, right-click the Croup Policy Objects container, and then click Manage Backups.
  E. From Group Policy Management, create a new GPO. Right-click the Starter GPOs container, and then click Manage Backups.
  B. From Windows PowerShell, run the New- GPO cmdlet and the Import- GPO cmdlet.

  ---

  The Import-GPO cmdlet imports the settings from a GPO backup into a specified target GPO. The target GPO can be in a different domain or forest than that from which the backup was made and it does not have to exist prior to the operation.

  Incorrect Answers:

  A: Copy-GPO requires domain trust / copy from one domain to another domain within the same forest.

  C: This would create a starter GPO, not a GPO.

  D: You can also restore GPOs. This operation takes a backed-up GPO and restores it to the same domain from rom the GPO's original which it was backed up. You cannot restore a GPO from backup into a domain different f domain. The New-GPO cmdlet creates a new GPO with a specified name. By default, the newly created GPO is not linked to a site, domain, or organizational unit (OU). The Import-GPO cmdlet imports the settings from a GPO backup into a specified target GPO. The target GPO can be in a different domain or forest than that from which the backup was made and it does not have to exist prior to the operation. The Restore-GPO cmdlet restores a GPO backup to the original domain from which it was saved. If the original domain is not available, or if the GPO no longer exists in the domain, the cmdlet fails.

  Since the GPO's original domain is different and there is no trust relationship between forests, you should execute the New-GPO command and import the already existing command into the `new' domain.

• Question 207:

  You work as an administrator at Contoso.com. The Contoso.com network consists of a single domain named Contoso.com. All servers in the Contoso.com domain have Windows Server 2012 R2 installed.

  You have logged on to a server, named ENSUREPASS-SR07, and would like to obtain the IP configurations of a server, named ENSUREPASS-SR13.

  Which of the following actions should you take?

  A. You should consider making use of the Winrs.exe command.
  B. You should consider making use of the Winsat.exe command.
  C. You should consider making use of the Winpop.exe command.
  D. You should consider making use of the Dsrm.exe command.
  A. You should consider making use of the Winrs.exe command.

• Question 208:

  Your network contains an Active Directory domain named adatum.com. The computer accounts for all member servers are located in an organizational unit (OU) named Servers. You link a Group Policy object (GPO) to the Servers OU.

  You need to ensure that the domain's Backup Operators group is a member of the local Backup Operators group on each member server. The solution must not remove any groups from the local Backup Operators groups.

  What should you do?

  A. Add a restricted group named adatum\Backup Operators. Add Backup Operators to the This group is a member of list.
  B. Add a restricted group named adatum\Backup Operators. Add Backup Operators to the Members of this group list.
  C. Add a restricted group named Backup Operators. Add adatum\Backup Operators to the This group is a member of list.
  D. Add a restricted group named Backup Operators. Add adatum\Backup Operators to the Members of this group list.
  A. Add a restricted group named adatum\Backup Operators. Add Backup Operators to the This group is a member of list.

• Question 209:

  You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Print and Document Services server role installed.

  Server1 is connected to two identical print devices.

  You need to ensure that users can submit print jobs to the print devices. The solution must ensure that if one print device fails, the print jobs will print automatically on the other print device.

  What should you do on Server1?

  A. Add two printers and configure the priority of each printer.
  B. Add one printer and configure printer pooling.
  C. Install the Network Load Balancing (NLB) feature, and then add one printer.
  D. Install the Failover Clustering feature, and then add one printer
  B. Add one printer and configure printer pooling.

  ---

  A printing pool is one logical printer connected to multiple printers through multiple ports of the print server.

  The printer that is idle receives the next document sent to the logical printer. When printing to a printer pool, the spooler will send waiting jobs to alternate ports. If the original or alternate ports are not available

  A printing pool is one logical printer connected to multiple printers through multiple ports of the print server. The printer that is idle receives the next document sent to the logical printer. This is useful in a network with a high volume of printing

  because it decreases the time users wait for their documents.

  A printing pool also simplifies administration because multiple printers can be managed from the same logical printer on a server. If one device within a pool stops printing, the current document is held at that device. The succeeding

  documents print to other devices in the pool, while the delayed document waits until the nonfunctioning printer is fixed. Efficient printer pools have the following characteristics:

  All printers in the pool are the same model.

  Printer ports can be of the same type or mixed (parallel, serial, and network). It is recommended that all printers be in one location. Because it is impossible to predict which printer will receive the document, keep all printers in a pool in a

  single location. Otherwise, users might have a hard time finding their printed document.

  You can create a printing pool to automatically distribute print jobs to the next available printer. A printing pool is one logical printer connected to multiple printers through multiple ports of the print server. The printer that is idle receives the

  next document sent to the logical printer.

• Question 210:

  You work as a senior administrator at Contoso.com. The Contoso.com network consists of a single domain named Contoso.com. All servers on the Contoso.com network have Windows Server 2012 R2 installed, and all workstations have

  Windows 8 installed.

  You are running a training exercise for junior administrators. You are currently discussing a Windows PowerShell cmdlet that activates previously de-activated firewall rules.

  Which of the following is the cmdlet being discussed?

  A. Set-NetFirewallRule
  B. Enable-NetFirewallRule
  C. Set-NetIPsecRule
  D. Enable-NetIPsecRule
  B. Enable-NetFirewallRule

  ---

  Enable-NetFirewallRule ?Enables a previously disabled firewall rule.