Microsoft 70-411 Online Practice Questions and Exam Preparation

Microsoft 70-411 Online Questions & Answers

• Question 141:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2. One of the domain controllers is named DC1.

  The DNS zone for the contoso.com zone is Active Directory-integrated and has the default settings.

  A server named Server1 is a DNS server that runs a UNIX-based operating system.

  You plan to use Server1 as a secondary DNS server for the contoso.com zone.

  You need to ensure that Server1 can host a secondary copy of the contoso.com zone.

  What should you do?

  A. From DNS Manager, modify the Advanced settings of DC1.
  B. From DNS Manager, modify the Zone Transfers settings of the contoso.com zone.
  C. From Windows PowerShell, run the Set-DnsServerForwardercmdlet and specify the contoso.com zone as a target.
  D. From DNS Manager, modify the Security settings of DC1.
  C. From Windows PowerShell, run the Set-DnsServerForwardercmdlet and specify the contoso.com zone as a target.

  ---

  There are two ways that a secondary DNS server can be added. In both scenarios you will need to add the new server to the Forwarders list of the primary Domain Controller.

  1.

  The Set-DnsServerForwarder cmdlet changes forwarder settings on a Domain Name System (DNS) server.

  2.

  From the primary server, open DNS Manager, right click on the server name and select Properties. Click on the Forwarders tab and click the Edit button in the middle of the dialogue box.

• Question 142:

  Your network contains one Active Directory domain named contoso.com. The domain contains a server named Server01 that runs Windows Server 2012 R2. Server01 does not have a Trusted Platform Module (TPM).

  You need to ensure that you can enable BitLocket Drive Encryption (BitLocker) on the operating system drive.

  Which Group policy setting should you configure?

  A. Allow network unlock at startup.
  B. Enforce drive encryption type on operating system drives.
  C. Allow enhanced PINs for startup.
  D. Require additional authentication at startup.
  A. Allow network unlock at startup.

• Question 143:

  Your network contains an Active Directory domain named contoso.com. The domain contains a member server that runs Windows Server 2012 R2 and has the Windows Deployment Services (WDS) server role installed.

  You create a new multicast session in WDS and connect 50 client computers to the session.

  When you open the Windows Deployment Services console, you discover that all of the computers are listed as pending devices.

  You need to ensure that any of the computers on the network can join a multicast transmission without requiring administrator approval.

  What should you configure?

  To answer, select the appropriate tab in the answer area.

  Hot Area:

  

  

• Question 144:

  Your network contains two Active Directory domains named contoso.com and adatum.com.

  The network contains a server named Server1 that runs Windows Server 2012 R2. Server1 has the DNS Server server role installed. Server1 has a copy of the contoso.com DNS zone.

  You need to configure Server1 to resolve names in the adatum.com domain. The solution must meet the following requirements: Prevent the need to change the configuration of the current name servers that host zones for adatum.com. Minimize administrative effort. Which type of zone should you create?

  A. Secondary
  B. Stub
  C. Reverse lookup
  D. Primary
  B. Stub

  ---

  When a zone that this DNS server hosts is a stub zone, this DNS server is a source only for information about the authoritative name servers for this zone. The zone at this server must be obtained from another DNS server that hosts the zone. This DNS server must have network access to the remote DNS server to copy the authoritative name server information about the zone.

  A stub zone is a copy of a zone that contains only necessary resource records (Start of Authority (SOA), Name Server (NS), and Address/Host (A) record) in the master zone and acts as a pointer to the authoritative name server. The stub zone allows the server to forward queries to the name server that is authoritative for the master zone without going up to the root name servers and working its way down to the server. While a stub zone can improve performance, it does not provide redundancy or load sharing.

  

  You can use stub zones to:

  Keep delegated zone information current. By updating a stub zone for one of its child zones regularly, the DNS server that hosts both the parent zone and the stub zone will maintain a current list of authoritative DNS servers for the child zone.

  Improve name resolution. Stub zones enable a DNS server to perform recursion using the stub zone's list of name servers, without having to query the Internet or an internal root server for the DNS namespace. Simplify DNS administration.

  By using stub zones throughout your DNS infrastructure, you can distribute a list of the authoritative DNS servers for a zone without using secondary zones. However, stub zones do not serve the same purpose as secondary zones, and they

  are not an alternative for enhancing redundancy and load sharing.

  There are two lists of DNS servers involved in the loading and maintenance of a stub zone:

  The list of master servers from which the DNS server loads and updates a stub zone. A master server may be a primary or secondary DNS server for the zone. In both cases, it will have a complete list of the DNS servers for the zone. The list

  of the authoritative DNS servers for a zone. This list is contained in the stub zone using name server (NS) resource records.

  When a DNS server loads a stub zone, such as widgets. tailspintoys.com, it queries the master servers, which can be in different locations, for the necessary resource records of the authoritative servers for the zone widgets. tailspintoys.com.

  The list of master servers may contain a single server or multiple servers, and it can be changed anytime.

  References:

  http: //technet.microsoft.com/en-us/library/cc771898.aspx http: //technet.microsoft.com/en-us/library/cc754190.aspx http: //technet.microsoft.com/en-us/library/cc730980.aspx

• Question 145:

  Your network contains two Active Directory forests named contoso.com and adatum.com. All domain controllers run Windows Server 2012 R2.

  The adatum.com domain contains a Group Policy object (GPO) named GPO1. An administrator from adatum.com backs up GPO1 to a USB flash drive.

  You have a domain controller named dc1.contoso.com. You insert the USB flash drive in dc1.contoso.com.

  You need to identify the domain-specific reference in GPO1.

  What should you do?

  A. From the Migration Table Editor, click Populate from Backup.
  B. From Group Policy Management, run the Group Policy Modeling Wizard.
  C. From Group Policy Management, run the Group Policy Results Wizard.
  D. From the Migration Table Editor, click Populate from GPO.
  A. From the Migration Table Editor, click Populate from Backup.

• Question 146:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1 that runs Windows Server 2012 R2.

  All client computers run Windows 8 Enterprise.

  DC1 contains a Group Policy object (GPO) named GPO1.

  You need to deploy a VPN connection to all users.

  What should you configure from User Configuration in GPO1?

  A. Policies/Administrative Templates/Network/Windows Connect Now
  B. Policies/Administrative Templates/Network/Network Connections
  C. Policies/Administrative Templates/Windows Components/Windows Mobility Center
  D. Preferences/Control Panel Settings/Network Options
  D. Preferences/Control Panel Settings/Network Options

  ---

  1.

  Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2.

  In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3.

  Right-click the Network Options node, point to New, and select VPN Connection.

  The Network Options extension allows you to centrally create, modify, and delete dial-up networking and virtual private network (VPN) connections. Before you create a network option preference item, you should review the behavior of each type of action possible with the extension. Reference: http: //technet.microsoft.com/en-us/library/cc772449.aspx

• Question 147:

  Your network contains one Active Directory domain named contoso.com.

  You pilot DirectAccess on the network.

  During the pilot deployment, you enable DirectAccess only for a group named Contoso\Test Computers.

  Once the pilot is complete, you need to enable DirectAccess for all of the client computers in the domain.

  What should you do?

  A. From Active Directory Users and Computers, modify the membership of the Windows Authorization Access Group
  B. From Windows PowerShell, run the Set-DirectAccess cmdlet
  C. From Windows PowerShell, run the Set-DAServer cmdlet
  D. From Windows PowerShell, run the Add-DAClient cmdlet
  C. From Windows PowerShell, run the Set-DAServer cmdlet

  ---

  References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj134239(v=ws.11)

• Question 148:

  Your network contains an Active Directory forest named contoso.com. The functional level of the forest is Windows Server 2008 R2.

  All of the user accounts in the marketing department are members of a group named Contoso\MarketingUsers. All of the computer accounts in the marketing department are members of a group named Contoso\MarketingComputers.

  A domain user named User1 is a member of the Contoso\MarketingUsers group. A computer named Computer1 is a member of the Contoso\MarketingComputers group.

  You have four Password Settings objects (PSOs). The PSOs are defined as shown in the following table.

  

  When User1 logs on to Computer1 and attempts to change her password, she receives an error message indicating that her password is too short.

  You need to tell User1 what her minimum password length is. What should you tell User1?

  A. 10
  B. 11
  C. 12
  D. 14
  D. 14

• Question 149:

  Your network contains an Active Directory domain named contoso.com. All client computers are configured as DHCP clients.

  You link a Group Policy object (GPO) named GPO1 to an organizational unit (OU) that contains all of the client computer accounts.

  You need to ensure that Network Access Protection (NAP) compliance is evaluated on all of the client computers.

  Which two settings should you configure in GPO1?

  To answer, select the appropriate two settings in the answer area.

  Hot Area:

  

  

• Question 150:

  Your network contains an Active Directory domain named contoso.com. All servers run Windows Server 2012 R2. The domain contains two servers. The servers are configured as shown in the following table.

  

  All client computers run Windows 8 Enterprise.

  You plan to deploy Network Access Protection (NAP) by using IPSec enforcement.

  A Group Policy object (GPO) named GPO1 is configured to deploy a trusted server group to all of the client computers.

  You need to ensure that the client computers can discover HRA servers automatically.

  Which three actions should you perform? (Each correct answer presents part of the solution. Choose three.)

  A. On all of the client computers, configure the EnableDiscovery registry key.
  B. In a GPO, modify the Request Policy setting for the NAP Client Configuration.
  C. On Server2, configure the EnableDiscovery registry key.
  D. On DC1, create an alias (CNAME) record.
  E. On DC1, create a service location (SRV) record.
  A. On all of the client computers, configure the EnableDiscovery registry key.
  B. In a GPO, modify the Request Policy setting for the NAP Client Configuration.
  E. On DC1, create a service location (SRV) record.

  ---

  Requirements for HRA automatic discovery

  The following requirements must be met in order to configure trusted server groups on NAP client computers using HRA automatic discovery:

  Client computers must be running Windows Vista?with Service Pack 1 (SP1) or Windows XP with Service Pack 3 (SP3).

  The HRA server must be configured with a Secure Sockets Layer (SSL) certificate. The EnableDiscovery registry key must be configured on NAP client computers.

  DNS SRV records must be configured.

  The trusted server group configuration in either local policy or Group Policy must be cleared.

  http: //technet. microsoft. com/en-us/library/dd296901. aspx