Microsoft 70-411 Online Practice Questions and Exam Preparation

Microsoft 70-411 Online Questions & Answers

• Question 1:

  Your network contains an Active Directory domain named contoso.com. The domain contains a read-only domain controller (RODC) named R0DC1.

  You create a global group named RODC_Admins.

  You need to provide the members of RODC_Admins with the ability to manage the hardware and the software on R0DC1. The solution must not provide RODC_Admins with the ability to manage Active Directory objects.

  What should you do?

  A. From Active Directory Sites and Services, run the Delegation of Control Wizard.
  B. From a command prompt, run the dsadd computer command.
  C. From Active Directory Site and Services, configure the Security settings of the R0DC1 server object.
  D. From a command prompt, run the dsmgmt local roles command.
  D. From a command prompt, run the dsmgmt local roles command.

  ---

  RODC: using the dsmgmt.exe utility to manage local administrators One of the benefits of RODC is that you can add local administrators who do not have full access to the domain administration. This gives them the ability to manage the server but not add or change active directory objects unless those roles are delegated. Adding this type of user is done using the dsmdmt.exe utility at the command prompt.

• Question 2:

  You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the File Server Resource Manager role service installed.

  Server1 has a folder named Folder1 that is used by the human resources department.

  You need to ensure that an email notification is sent immediately to the human resources manager when a user copies an audio file or a video file to Folder1.

  What should you configure on Server1?

  A. a storage report task
  B. a file screen exception
  C. a file screen
  D. a file group
  C. a file screen

  ---

  Create file screens to control the types of files that users can save, and generate notifications when users attempt to save unauthorized files. With File Server Resource Manager (FSRM) you can create file screens that prevent users from

  saving unauthorized files on volumes or folders.

  File Screen Enforcement:

  You can create file screens to prevent users from saving unauthorized files on volumes or folders. There are two types of file screen enforcement: active and passive enforcement. Active file screen enforcement does not allow the user to

  save an unauthorized file. Passive file screen enforcement allows the user to save the file, but notifies the user that the file is not an authorized file. You can configure notifications, such as events logged to the event log or e-mails sent to

  users and administrators, as part of active and passive file screen enforcement.

• Question 3:

  Your network contains an Active Directory domain named contoso.com. The domain contain two domain controllers named DC1 and DC2.

  You discover that client computer authenticate to both domain controllers.

  You need to ensure that client computer only authenticate to DC2 if DC1 fails. The solution must be persistent.

  What should you do?

  A. From DNS Manager, modify the weigh value of the service location (SRV) records.
  B. From Registry Editor, create the LdapSrvweigh value.
  C. From DNS Manager, modify the priority value of the service location (SRV) records.
  D. From Registry Editor, create the Ldapsrvpriority value.
  B. From Registry Editor, create the LdapSrvweigh value.

  ---

  Explanation: QUESTON NO: 287

  Your network contains an Active Directory domain.

  A Group policy object (GPO) named GPO1 is linked to the domain. GPO1 has the setting shown in the following table.

  

  You have backup of a GPO named GPO2. GPO2 has the settings shown In the following table.

  

  You import backup into GPO1.

  You need to identify the configuration in GPO1.

  What should you identify?

  A.

  *

  Enforce password of history ids not set to Not Defined.

  *

  Minimium password length is set to 5 characters.

  *

  Store passwords using reversible encryption is set to Enabled.

  B.

  *

  Enforce password history is set Not Defined.

  *

  Minimum Password length is set to 10 characters.

  *

  Store passwords using reversible encryption is set to Enabled.

  C.

  *

  Minimum password length is set to 10 characters.

  *

  Enforce password history is set to 5 password remembered.

  *

  Store password using reversible encryption is set to Enabled.

  D.

  *

  Minimum password length is set to 5 characters.

  *

  Enforce password history is set to 5 password remembered.

  *

  Stop passwords using reversible encryption is set to Enabled. Answer: A

• Question 4:

  You have a group Managed Service Account named Service01. Three servers named Server01, Server02, and Server03 currently use the Service01 service account.

  You plan to decommission Server01.

  You need to remove the cached password of the Service01 service account from Server01. The solution must ensure that Server02 and Server 03 continue to use Service01.

  Which cmdlet should you run?

  A. Set-ADServiceAccount
  B. Remove-ADServiceAccount
  C. Uninstall-ADServiceAccount
  D. Reset-ADServiceAccountPassword
  B. Remove-ADServiceAccount

  ---

  Explanation: The Remove-ADServiceAccount cmdlet removes an Active Directory service account. This cmdlet does not make changes to any computers that use the service account. After this operation, the service account is no longer

  hosted on the target computer but still exists in the directory.

  Incorrect:

  Not C: The Uninstall-ADServiceAccount cmdlet removes an Active Directory service account on the computer on which the cmdlet is run. The specified service account must be installed on the computer.

  Reference: Remove-ADServiceAccount https://technet.microsoft.com/en-us/library/ee617190.aspx

• Question 5:

  Your network contains an Active Directory domain named contoso.com. The domain contains three servers. The servers are configured as shown in the following table.

  

  You need to ensure that end-to-end encryption is used between clients and Server2 when the clients connect to the network by using DirectAccess.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. From the Remote Access Management Console, reload the configuration.
  B. Add Server2 to a security group in Active Directory.
  C. Restart the IPSec Policy Agent service on Server2.
  D. From the Remote Access Management Console, modify the Infrastructure Servers settings.
  E. From the Remote Access Management Console, modify the Application Servers settings.
  B. Add Server2 to a security group in Active Directory.
  E. From the Remote Access Management Console, modify the Application Servers settings.

  ---

  Unsure about these answers: A public key infrastructure must be deployed. Windows Firewall must be enabled on all profiles. ISATAP in the corporate network is not supported. If you are using ISATAP, you should remove it and use native IPv6. Computers that are running the following operating systems are supported as DirectAccess clients: Windows Server?2012 R2 Windows 8.1 Enterprise Windows Server?2012 Windows 8 Enterprise Windows Server?2008 R2 Windows 7 Ultimate Windows 7 Enterprise Force tunnel configuration is not supported with KerbProxy authentication. Changing policies by using a feature other than the DirectAccess management console or Windows PowerShell cmdlets is not supported. Separating NAT64/DNS64 and IPHTTPS server roles on another server is not supported.

• Question 6:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1. You run ntdsutil as shown in the exhibit. (Click the Exhibit button.)

  

  You need to ensure that you can access the contents of the mounted snapshot. What should you do?

  A. From the snapshot context of ntdsutil, run activate instance "NTDS".
  B. From a command prompt, run dsamain.exe -dbpath c:\$snap_201204131056_volumec$\windows\ntds\ntds. dit -Idapport 389.
  C. From the snapshot context of ntdsutil, run mount {79f94f82-5926-4f44-8af0- 2f56d827a57d}.
  D. From a command prompt, run dsamain.exe -dbpath c:\$snap_201204131056_volumec$\windows\ntds\ntds. dit -Idapport 33389.
  D. From a command prompt, run dsamain.exe -dbpath c:\$snap_201204131056_volumec$\windows\ntds\ntds. dit -Idapport 33389.

  ---

  By default, only members of the Domain Admins group and the Enterprise Admins group are allowed to view the snapshots because they contain sensitive AD DS data. If you want to access snapshot data from an old domain or forest that has been deleted, you can allow nonadministrators to access the data when you run Dsamain.exe. If you plan to view the snapshot data on a domain controller, specify ports that are different from the ports that the domain controller will use. A client starts an LDAP session by connecting to an LDAP server, called a Directory System Agent (DSA), by default on TCP port and UDP [7] port 389. The client then sends an operation request to the server, and the server sends responses in return. With some exceptions, the client does not need to wait for a response before sending the next request, and the server may send the responses in any order. All information is transmitted using Basic Encoding Rules (BER).

  

  References:

  http: //technet. microsoft. com/en-us/library/cc753609(v=ws. 10). aspx

• Question 7:

  Your network contains an Active Directory domain named contoso.com. The domain contains a file server named Server1 that runs Windows Server 2012 R2. Server1 has a share named Share1.

  When users without permission to Share1 attempt to access the share, they receive the Access Denied message as shown in the exhibit. (Click the Exhibit button.)

  

  You deploy a new file server named Server2 that runs Windows Server 2012 R2.

  You need to configure Server2 to display the same custom Access Denied message as Server1. What should you install on Server2?

  A. The Remote Assistance feature
  B. The Storage Services server role
  C. The File Server Resource Manager role service
  D. The Enhanced Storage feature
  C. The File Server Resource Manager role service

  ---

  Access-Denied Assistance is a new role service of the File Server role in Windows Server 2012.

  

  We need to install the prerequisites for Access-Denied Assistance.

  Because Access-Denied Assistance relies up on e-mail notifications, we also need to configure each relevant file server with a Simple Mail Transfer Protocol (SMTP) server address. Let's do that quickly with Windows PowerShell:

  Set-FSRMSetting -SMTPServer mailserver. nuggetlab.com -AdminEmailAddress [email protected] -FromEmailAddress [email protected]

  You can enable Access-Denied Assistance either on a per-server basis or centrally via Group Policy. To my mind, the latter approach is infinitely preferable from an administration standpoint.

  Create a new GPO and make sure to target the GPO at your file servers' Active Directory computer accounts as well as those of your AD client computers. In the Group Policy Object Editor, we are looking for the following path to configure

  Access-Denied Assistance:

  \Computer Configuration\Policies\Administrative Templates\System\Access-Denied Assistance

  

  The Customize message for Access Denied errors policy, shown in the screenshot below, enables us to create the actual message box shown to users when they access a shared file to which their user account has no access.

  

  What's cool about this policy is that we can "personalize" the e-mail notifications to give us administrators (and, optionally, file owners) the details they need to resolve the permissions issue quickly and easily.

  For instance, we can insert pre-defined macros to swap in the full path to the target file, the administrator e-mail address, and so forth. See this example:

  Whoops! It looks like you're having trouble accessing [Original File Path]. Please click Request Assistance to send [Admin Email] a help request e-mail message. Thanks!

  You should find that your users prefer these human-readable, informative error messages to the cryptic, non-descript error dialogs they are accustomed to dealing with.

  The Enable access-denied assistance on client for all file types policy should be enabled to force client computers to participate in Access-Denied Assistance. Again, you must make sure to target your GPO scope accordingly to "hit" your

  domain workstations as well as your Windows Server 2012 file servers.

  Testing the configuration

  This should come as no surprise to you, but Access-Denied Assistance works only with Windows Server 2012 and Windows 8 computers. More specifically, you must enable the Desktop Experience feature on your servers to see Access-

  Denied Assistance messages on server computers.

  When a Windows 8 client computer attempts to open a file to which the user has no access, the custom Access-Denied Assistance message should appear:

  

  If the user clicks Request Assistance in the Network Access dialog box, they see a secondary message:

  

  At the end of this process, the administrator(s) will receive an e-mail message that contains the key information they need in order to resolve the access problem: The user's Active Directory identity The full path to the problematic file A user-generated explanation of the problem

  So that's it, friends! Access-Denied Assistance presents Windows systems administrators with an easy-to-manage method for more efficiently resolving user access problems on shared file system resources. Of course, the key caveat is that your file servers must run Windows Server 2012 and your client devices must run Windows 8, but other than that, this is a great technology that should save admins extra work and end-users extra headaches.

  Reference: http: //4sysops. com/archives/access-denied-assistance-in-windows-server- 2012/

• Question 8:

  Your network contains an Active Directory domain named contoso.com. The domain contains two member servers named Server1 and Server2. All servers run Windows Server 2012 R2.

  Server1 and Server2 are nodes in a Hyper-V cluster named Cluster1. Cluster1 hosts 10 virtual machines. All of the virtual machines run Windows Server 2012 R2 and are members of the domain.

  You need to ensure that the first time a service named Service1 fails on a virtual machine, the virtual machine is moved to a different node.

  You configure Service1 to be monitored from Failover Cluster Manager.

  What should you configure on the virtual machine?

  A. From the General settings, modify the Startup type.
  B. From the General settings, modify the Service status.
  C. From the Recovery settings of Service1, set the First failure recovery action to Take No Action.
  D. From the Recovery settings of Service1, set the First failure recovery action to Restart the Service.
  C. From the Recovery settings of Service1, set the First failure recovery action to Take No Action.

  ---

  Configure the virtual machine to take no action through Hyper-V if the physical computer shuts down by modifying the Automatic Stop Action setting to None. Virtual machine state must be managed through the Failover Clustering feature.

  Virtual machine application monitoring and management In clusters running Windows Server 2012, administrators can monitor services on clustered virtual machines that are also running Windows Server 2012. This functionality extends the

  high-level monitoring of virtual machines that is implemented in Windows Server 2008 R2 failover clusters. If a monitored service in a virtual machine fails, the service can be restarted, or the clustered virtual machine can be restarted or

  moved to another node (depending on service restart settings and cluster failover settings). This feature increases the uptime of high availability services that are running on virtual machines within a failover cluster.

  Windows Server 2012 Failover Cluster introduces a new capability for Hyper-V virtual machines (VMs), which is a basic monitoring of a service within the VM which causes the VM to be rebooted should the monitored service fail three times.

  For this feature to work the following must be configured:

  Both the Hyper-V servers must be Windows Server 2012 and the guest OS running in the VM must be Windows Server 2012.

  The host and guest OSs are in the same or at least trusting domains. The Failover Cluster administrator must be a member of the local administrator's group inside the VM. Ensure the service being monitored is set to Take No Action (see

  screen shot below) within the guest VM for Subsequent failures (which is used after the first and second failures) and is set via the Recovery tab of the service properties within the Services application (services. msc).

  

  Within the guest VM, ensure the Virtual Machine Monitoring firewall exception is enabled for the Domain network by using the Windows Firewall with Advanced Security application or by using the Windows PowerShell command below: Set-

  NetFirewallRule -DisplayGroup "Virtual Machine Monitoring" -Enabled True.

  After the above is true, enabling the monitoring is a simple process:

  Launch the Failover Cluster Manager tool.

  Navigate to the cluster - Roles.

  Right click on the virtual machine role you wish to enable monitoring for and under More Actions select Configure Monitoring.

  

  The services running inside the VM will be gathered and check the box for the services that should be monitored and click OK.

  

  You are done!

  Monitoring can also be enabled using the Add-ClusterVMMonitoredItemcmdlet and - VirtualMachine, with the -Service parameters, as the example below shows: PS C:\Windows\system32> Add-ClusterVMMonitoredItem -VirtualMachine savdaltst01 - Service spooler

  References: http: //sportstoday. us/technology/windows-server-2012---continuous-availability-%28part- 4%29---failover-clustering-enhancements---virtual-machine-monitoring-. aspx http: //windowsitpro. com/windows-server-2012/enable-windows-server2012-failover- cluster-hyper-v-vm-monitoring http: //technet. microsoft. com/en-us/library/cc742396. aspx

• Question 9:

  You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Windows Deployment Services server role installed.

  Server1 contains two boot images and four install images.

  You need to ensure that when a computer starts from PXE, the available operating system images appear in a specific order.

  What should you do?

  A. Modify the properties of the boot images.
  B. Create a new image group.
  C. Modify the properties of the install images.
  D. Modify the PXE Response Policy.
  C. Modify the properties of the install images.

• Question 10:

  Your network contains one Active Directory domain named contoso.com. The domain contains 10 file servers that run Windows Server 2012 R2.

  You plan to enable BitLocker Drive Encryption (BitLocker) for the operating system drives of the file servers.

  You need to configure BitLocker policies for the file servers to meet the following requirements:

  Ensure that all of the servers use a startup PIN for operating system drives encrypted with BitLocker.

  Ensure that the BitLocker recovery key and recovery password are stored in Active Directory.

  Which two Group Policy settings should you configure? To answer, select the appropriate settings in the answer area.

  Hot Area:

  

  

  ---

  * Choice 1: Require additional authentication at startup This policy setting is used to control which unlock options are available for operating system drives. You can set this option to Require startup PIN with TPM Choice 2: Choose how BitLocker-protected operating system drives can be recovered This policy setting is used to configure recovery methods for operating system drives.

  In Save BitLocker recovery information to Active Directory Domain Services, choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS) for operating system drives. If you select Store recovery

  password and key packages, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that is physically corrupted. If you select Store recovery password only,

  only the recovery password is stored in AD DS.

  Reference: BitLocker Group Policy Settings

  https://technet.microsoft.com/en-us/library/jj679890.aspx#BKMK_unlockpol1