Microsoft 70-410 Online Practice Questions and Exam Preparation

Microsoft 70-410 Online Questions & Answers

• Question 31:

  Your network contains an Active Directory forest named contoso.com. The forest contains five domains. All domain controllers run Windows Server 2012 R2.

  The contoso.com domain contains two user accounts named Admin1 and Admin2.

  You need to ensure that Admin1 and Admin2 can configure hardware and services on all of the member servers in the forest. The solution must minimize the number of privileges granted to Admin1 and Admin2.

  Which built-in groups should you use?

  A. Administrators local groups
  B. Administrators domain local groups
  C. Domain Admins global groups
  D. Server Operators global groups
  A. Administrators local groups

• Question 32:

  Your company's security policy states that all of the servers deployed to a branch office must not have the graphical user interface (GUI) installed. In a branch office, a support technician installs a server with a GUI installation of Windows

  Server 2012 on a new server, and then configures the server as a DHCP server.

  You need to ensure that the new server meets the security policy. You want to achieve this goal by using the minimum amount of Administrative effort.

  What should you do?

  A. Reinstall Windows Server 2012 on the server.
  B. From Windows PowerShell, run Uninstall-WindowsFeature Desktop-Experience.
  C. From Windows PowerShell, run Uninstall-WindowsFeature PowerShell-ISE.
  D. From Server Manager, uninstall the User Interfaces and Infrastructure feature.
  D. From Server Manager, uninstall the User Interfaces and Infrastructure feature.

• Question 33:

  Your network contains an Active Directory forest named contoso.com. All domain controllers currently run Windows Server 2008 R2.

  You plan to install a new domain controller named DC4 that runs Windows Server 2012 R2.

  The new domain controller will have the following configurations:

  Schema master

  Global catalog server DNS Server server role Active Directory Certificate Services server role

  You need to identify which configurations cannot be fulfilled by using the Active Directory Domain Services Configuration Wizard. Which two configurations should you identify? (Each correct answer presents part of the solution. Choose two.)

  A. Install the DNS Server role.
  B. Enable the global catalog server.
  C. Install the Active Directory Certificate Services role.
  D. Transfer the schema master.
  C. Install the Active Directory Certificate Services role.
  D. Transfer the schema master.

  ---

  Installation Wizard will automatically install DNS and allows for the option to set it as a global catalog server. ADCS and schema must be done separately.

• Question 34:

  You work as an administrator at ABC.com. The ABC.com network consists of a single domain named ABC.com. All servers in the ABC.com domain, including domain controllers, have Windows Server 2012 R2 installed.

  ABC.com's user accounts are located in an organizational unit (OU), named ABCStaff. ABC.com's managers belong to a group, named ABCManagers.

  You have been instructed to create a new Group Policy object (GPO) that should be linked to the ABCStaffOU, but not affect ABC.com's managers.

  Which of the following actions should you take?

  A. You should consider removing the user accounts of the managers from the ABCStaff OU.
  B. You should consider configuring the new GPO's WMI filter.
  C. You should consider adding the user accounts of ABC.com's managers to the Admins group.
  D. You should consider adding the user accounts of ABC.com's managers to the local Administrators group.
  B. You should consider configuring the new GPO's WMI filter.

• Question 35:

  You have two servers named Server1 and Server2 that run Windows Server 2012 R2. Server1 and Server2 are part of a workgroup.

  On Server1, you add Server2 to Server Manager.

  When you attempt to connect to Server2 from Server Manager, you receive the following error message: "Credentials not valid."

  You need to ensure that you can manage Server2 from Server1 by using Server Manager on Server1.

  What should you do?

  A. On Server 2, run the Configure-SmRemoting cmdlet.
  B. On Server 1, run the Set-NetFirewallRule cmdlet.
  C. On Server 1, run the Set-Item cmdlet.
  D. On Server 2, install the Remote Server Administration Tools (RSAT).
  C. On Server 1, run the Set-Item cmdlet.

  ---

  Since they are both workgroup members, server 2 will have to be added to server 1 as a trusted host

• Question 36:

  Your network contains two Active Directory forests named adatum.com and contoso.com. Both forests contain multiple domains. A two-way trust exists between the forests. The contoso.com domain contains a domain local security group

  named Group1. Group1 contains contoso\user1 and adatum\user1.

  You need to ensure that Group1 can only contain users from the contoso.com domain.

  Which three actions should you perform?

  To answer, move three actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Domain local Groups that are used to grant permissions within a single domain. Members of domain local groups can include only accounts (both user and computer accounts) and groups from the domain in which they are defined.

  ———– to review. Universal groups can only include objects from its own forest Groups can have — domain local, built-in local, global, and universal. That is, the groups have different areas in different scopes which they are valid.

  A domain local group is a security or distribution group that can contain universal groups, global groups, other domain local groups from its own domain, and accounts from any domain in the forest. You can give domain local security groups

  rights and permissions on resources that reside only in the same domain where the domain local group is located. A global group is a group that can be used in its own domain, in member servers and in workstations of the domain, and in

  trusting domains. In all those locations, you can give a global group rights and permissions and the global group can become a member of local groups. However, a global group can contain user accounts that are only from its own domain. A

  universal group is a security or distribution group that contains users, groups, and computers from any domain in its forest as members. You can give universal security groups rights and permissions on resources in any domain in the forest.

  Universal groups are not supported.

  Domain local -Groups that are used to grant permissions within a single domain. Members of domain local groups can include only accounts (both user and computer accounts) and groups from the domain in which they are defined. Built-in

  local – Groups that have a special group scope that have domain local permissions and, for simplicity, are often referred to as domain local groups. The difference between built-in local groups and other groups is that built-in local groups can't

  be created or deleted. You can only modify built-in local groups. References to domain local groups apply to built-in local groups unless otherwise noted. Global - Groups that are used to grant permissions to objects in any domain in the

  domain tree or forest. Members of global groups can include only accounts and groups from the domain in which they are defined. Universal – Groups that are used to grant permissions on a wide scale throughout a domain tree or forest.

  Members of global groups include accounts and groups from any domain in the domain tree or forest.

  Global to universal. This conversion is allowed only if the group that you want to change is not a member of another global scope group.

  Domain local to universal. This conversion is allowed only if the group that you want to change does not have another domain local group as a member.

  Universal to global. This conversion is allowed only if the group that you want to change does not have another universal group as a member.

  Universal to domain local. There are no restrictions for this operation.

• Question 37:

  You work as an administrator at ABC.com. The ABC.com network consists of a single domain named ABC.com. All servers in the ABC.com domain, including domain controllers, have Windows Server 2012 R2 installed.

  You have installed the DNS Server Role on an ABC.com server, named ABC-SR13. ABC.com's workstations make use of a web proxy to access the Internet, and refer to ABC-SR13 as a primary DNS server.

  You have been instructed to make sure that Internet host names for ABC.com's workstations are not resolved by ABC-SR13.

  Which of the following actions should you take?

  A. You should consider configuring a primary zone on ENSUREPASS-SR13.
  B. You should consider configuring a secondary zone on ENSUREPASS-SR13.
  C. You should consider configuring a reverse lookup zone on ENSUREPASS-SR13.
  D. You should consider configuring a forward lookup zone on ENSUREPASS-SR13.
  A. You should consider configuring a primary zone on ENSUREPASS-SR13.

• Question 38:

  Your network contains one Active Directory forest named contoso.com. The forest contains two child domains named east.contoso.com and west.contoso.com.

  Your user account is a member of the Domain Admins group in all of the domains. The account is not a member of any other groups.

  The contoso.com domain contains a Group Policy object (GPO) named DesktopGPO. DesktopGPO is applied to the following containers.

  An organizational unit (OU) named ALLUsers in contoso.com An OU named Marketing in east.contoso.com The east.contoso.com domain The contoso.com domain A site named Corporate You delete DesktopGPO.

  You need to identify which Group Policy links must be removed manually.

  Which three GPO links should you identify? Each correct answer presents part of the solution.

  A. a site named Corporate
  B. the AllUsers OU in contoso.com
  C. the contoso.com domain
  D. the east.contoso.com domain
  E. the Marketing OU in east.contoso.com
  A. a site named Corporate
  D. the east.contoso.com domain
  E. the Marketing OU in east.contoso.com

  ---

  When you delete a GPO, Group Policy Management attempts to delete all links to that GPO in the domain of the GPO. However, to delete a link to a GPO, you must have permission to link Group Policy objects for the organizational unit or domain. If you do not have rights to delete a link, the GPO will be deleted, but the link will remain. Links from other domains and sites are not deleted. The link to a deleted GPO appears in Group Policy Management as Not Found.

• Question 39:

  Your network contains an Active Directory domain named contoso.com.

  You have a DHCP server named Server1 that runs Windows Server 2008.

  You install Windows Server 2012 R2 on a server named Server2. You install the DHCP Server server role on Server2.

  You need to migrate the DHCP services from Server1 to Server2. The solution must meet the following requirements:

  Ensure that existing leases are migrated.

  

  Prevent lease conflicts.

  

  Which three actions should you perform? (Each correct answer presents part of the solution. Choose three.)

  A. On Server1, run the Export-DhcpServer cmdlet.
  B. On Server1, run the Stop-Service cmdlet.
  C. On Server2, run the Receive-SmigServerData cmdlet.
  D. On Server2, run the Stop-Service cmdlet.
  E. On Server2, run the Import-DhcpServer cmdlet.
  F. On Server1, run the Send-SmigServerData cmdlet.
  A. On Server1, run the Export-DhcpServer cmdlet.
  B. On Server1, run the Stop-Service cmdlet.
  E. On Server2, run the Import-DhcpServer cmdlet.

• Question 40:

  Your network contains a domain controller named dc5.adatum.com that runs Windows Server 2012 R2.

  You discover that you can connect successfully to DC5 over the network, but you receive a request timed out message when you attempt to ping DC5.

  You need to configure DC5 to respond to ping request.

  Which firewall rule should you modify on DC5?To answer, select the appropriate rule in the answer area.

  Hot Area: