Microsoft 70-411 Online Practice Questions and Exam Preparation

Microsoft 70-411 Online Questions & Answers

• Question 191:

  Your network contains an Active Directory domain named contoso.com. The domain contains a read-only domain controller (RODC) named RODC1.

  You create a global group named RODC_Admins.

  You need to provide the members of RODC_Admins with the ability to manage the hardware and the software on R0DC1. The solution must not provide RODC_Admins with the ability to manage Active Directory objects.

  What should you do?

  A. From Active Directory Site and Services, configure the Security settings of the RODC1 server object.
  B. From Windows PowerShell, run the Set-ADAccountControlcmdlet.
  C. From a command prompt, run the dsmgmt local roles command.
  D. From Active Directory Users and Computers, configure the Member Of settings of the RODC1 account.
  C. From a command prompt, run the dsmgmt local roles command.

  ---

  RODC: using the dsmgmt.exe utility to manage local administrators One of the benefits of RODC is that you can add local administrators who do not have full access to the domain administration. This gives them the ability to manage the server but not add or change active directory objects unless those roles are delegated. Adding this type of user is done using the dsmdmt.exe utility at the command prompt.

• Question 192:

  Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2. Server1 has the Network Policy Server server role installed. Server2 has the DHCP Server server role installed. Both servers run Windows Server 2012 R2.

  You are configuring Network Access Protection (NAP) to use DHCP enforcement.

  You configure a DHCP scope as shown in the exhibit. (Click the Exhibit button.)

  

  You need to ensure that non-compliant NAP clients receive different DHCP options than compliant NAP clients.

  What should you configure on each server?

  To answer, select the appropriate options for each server in the answer area.

  Hot Area:

  

  

• Question 193:

  You have a server named Server1 that runs Windows Server 2012 R2. Server1 has two network adapters and is located in a perimeter network.

  You need to configure Server1 as a network address translation (NAT) server.

  Which node should you use to add the NAT routing protocol?

  To answer, select the appropriate node in the answer area.

  Hot Area:

  

  

  ---

  References: https://technet.microsoft.com/en-us/library/dd469812(v=ws.11).aspx

• Question 194:

  Your network contains an Active Directory domain named adatum.com. All domain controllers run Windows Server 2012 R2. The domain contains a virtual machine named DC2.

  On DC2, you run Get-ADDCCIoningExcludedApplicationList and receive the output shown in the following table.

  

  You need to ensure that you can clone DC2.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  E. Option E
  A. Option A
  E. Option E

  ---

  Because domain controllers provide a distributed environment, you could not safely clone an Active Directory domain controller in the past.

  Before, if you cloned any server, the server would end up with the same domain or forest, which is unsupported with the same domain or forest. You would then have to run sysprep, which would remove the unique security information before

  cloning and then promote a domain controller manually. When you clone a domain controller, you perform safe cloning, which a cloned domain controller automatically runs a subset of the sysprep process and promotes the server to a

  domain controller automatically.

  The four primary steps to deploy a cloned virtualized domain controller are as follows:

  Grant the source virtualized domain controller the permission to be cloned by adding the source virtualized domain controller to the Cloneable Domain Controllers group. Run Get-ADDCCloningExcludedApplicationListcmdlet in Windows

  PowerShell to determine which services and applications on the domain controller are not compatible with the cloning.

  Run New-ADDCCloneConfigFile to create the clone configuration file, which is stored in the C:\Windows\NTDS.

  In Hyper-V, export and then import the virtual machine of the source domain controller.

  Run Get-ADDCCloningExcludedApplicationListcmdlet In this procedure, run the Get- ADDCCloningExcludedApplicationListcmdlet on the source virtualized domain controller to identify any programs or services that are not evaluated for

  cloning. You need to run the Get-ADDCCloningExcludedApplicationListcmdlet before the New- ADDCCloneConfigFilecmdlet because if the New-ADDCCloneConfigFilecmdlet detects an excluded application, it will not create a

  DCCloneConfig.xml file. To identify applications or services that run on a source domain controller which have not been evaluated for cloning.

  Get-ADDCCloningExcludedApplicationList

  Get-ADDCCloningExcludedApplicationList -GenerateXml

  The clone domain controller will be located in the same site as the source domain controller unless a different site is specified in the DCCloneConfig.xml file.

  Note:

  The Get-ADDCCloningExcludedApplicationListcmdlet searches the local domain controller for programs and services in the installed programs database, the services control manager that are not specified in the default and user defined

  inclusion list. The applications in the resulting list can be added to the user defined exclusion list if they are determined to support cloning. If the applications are not cloneable, they should be removed from the source domain controller before

  the clone media is created. Any application that appears in cmdlet output and is not included in the user defined inclusion list will force cloning to fail. The Get-ADDCCloningExcludedApplicationListcmdlet needs to be run before the New-

  ADDCCloneConfigFilecmdlet is used because if the New- ADDCCloneConfigFilecmdlet detects an excluded application, it will not create a DCCloneConfig.xml file. DCCloneConfig.xml is an XML configuration file that contains all of the

  settings the cloned DC will take when it boots. This includes network settings, DNS, WINS, AD site name, new DC name and more. This file can be generated in a few different ways.

  The New-ADDCCloneConfigcmdlet in PowerShell

  By hand with an XML editor

  By editing an existing config file, again with an XML editor (Notepad is not an XML editor.)

  

  You can populate the XML file. . . . . doesn't need to be empty. . . . .

  

  References:

  http: //technet. microsoft. com/en-us/library/hh831734. aspx http: //blogs. dirteam. com/blogs/sanderberkouwer/archive/2012/09/10/new-features-in- active-directory-domain-services-in-windows-server-2012-part-13-domain-controller- cloning.

  aspx

• Question 195:

  Your network contains two servers named Server1 and Server2 that run windows Server 2012 R2. Server1 and 5erver2 have the Windows Server Update Services server role installed.

  Server1 synchronizes from Microsoft Update. Server2 is a Windows Server Update Services (WSUS) replica of Server1.

  You need to configure replica downstream servers to send Server1 summary information about the computer update status.

  What should you do?

  A. From Server1, configure Reporting Rollup.
  B. From Server2, configure Reporting Rollup.
  C. From Server2, configure Email Notifications.
  D. From Server1, configure Email Notifications.
  A. From Server1, configure Reporting Rollup.

  ---

  WSUS Reporting Rollup Sample Tool

  This tool uses the WSUS application programming interface (API) to demonstrate centralized monitoring and reporting for WSUS. It creates a single report of update and computer status from the WSUS servers into your WSUS environment.

  The sample package also contains sample source files to customize or extend the tool functionality of the tool to meet specific needs. The WSUS Reporting Rollup Sample Tool and files are provided AS IS. No product support is available for

  this tool or sample files. For more information read the readme file.

  Reference: http: //technet. microsoft. com/en-us/windowsserver/bb466192. aspx

• Question 196:

  You have a server named Server1 that is a number of a domain named contoso.com. You view the properties of a service on Server1 as shown in the graphic.

  

  Use the drop-down menus to select the answer choice that completes each statement. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  

  ---

  References:

  https://msdn.microsoft.com/en-us/library/ms677272(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/ms675915(v=vs.85).aspx

  Virtual accounts are "managed local accounts" that provide the following features to simplify service administration:

  - No password management is required.

  - The ability to access the network with a computer identity in a domain environment.

  Virtual accounts require very little management. They cannot be created or deleted, nor do they require any password management.

  You must be a member of the Administrators group on the local computer to perform the following procedures. To configure a service to use a virtual account:

  - Click Start, point to Administrative Tools, and then click Services.

  - In the details pane, right-click the service that you want to configure, and then click Properties.

  - Click the Log On tab, click This account, and then type NT SERVICE\ServiceName. When you are finished, click OK.

  - Restart the service for the change to take effect.

  https://technet.microsoft.com/en-us/library/dd548356%20(v=WS.10).aspx

• Question 197:

  Your network contains an Active Directory domain named contoso.com.

  Network Policy Server (NPS) is deployed to the domain.

  You plan to deploy Network Access Protection (NAP).

  You need to configure the requirements that are validated on the NPS client computers.

  What should you do?

  A. From the Network Policy Server console, configure a network policy.
  B. From the Network Policy Server console, configure a health policy.
  C. From the Network Policy Server console, configure a Windows Security Health Validator (WSHV) policy.
  D. From a Group Policy object (GPO), configure the NAP Client Configuration security setting.
  E. From a Group Policy object (GPO), configure the Network Access Protection Administrative Templates setting.
  C. From the Network Policy Server console, configure a Windows Security Health Validator (WSHV) policy.

• Question 198:

  Your network contains an Active Directory forest named contoso.com. The functional level of the forest is Windows Server 2008 R2.

  All of the user accounts in the marketing department are members of a group named Contoso\MarketingUsers. All of the computer accounts in the marketing department are members of a group named Contoso\MarketingComputers.

  A domain user named User1 is a member of the Contoso\MarketingUsers group. A computer named Computer1 is a member of the Contoso\MarketingComputers group.

  You have five Password Settings objects (PSOs). The PSOs are defined as shown in the following table.

  

  When User1 logs on to Computer1 and attempts to change her password, she receives an error message indicating that her password is too short.

  You need to tell User1 what her minimum password length is.

  What should you tell User1?

  A. 10
  B. 11
  C. 12
  D. 14
  A. 10

  ---

  One PSO has a precedence value of 2 and the other PSO has a precedence value of 4. In this case, the PSO that has the precedence value of 2 has a higher rank and, hence, is applied to the object.

• Question 199:

  Your network contains an Active Directory domain named adatum.com. The domain contains five servers. The servers are configured as shown in the following table.

  

  All desktop computers in adatum.com run Windows 8 and are configured to use BitLocker Drive Encryption (BitLocker) on all local disk drives. You need to deploy the Network Unlock feature. The solution must minimize the number of features and server roles installed on the network. To which server should you deploy the feature?

  A. Server3
  B. Server1
  C. DC2
  D. Server2
  E. DC1
  B. Server1

  ---

  The BitLocker-NetworkUnlock feature must be installed on a Windows Deployment Server (which does not have to be configured--the WDSServer service just needs to be running).

• Question 200:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2.

  Server1 has the following role services installed:

  DirectAccess and VPN (RRAS)

  Network Policy Server

  Remote users have client computers that run either Windows XP, Windows 7, or Windows 8.

  You need to ensure that only the client computers that run Windows 7 or Windows 8 can establish VPN connections to Server1.

  What should you configure on Server1?

  A. A condition of a Network Policy Server (NPS) network policy
  B. A constraint of a Network Policy Server (NPS) network policy
  C. a condition of a Network Policy Server (NPS) connection request policy
  D. A vendor-specific RADIUS attribute of a Network Policy Server (NPS) connection request policy
  A. A condition of a Network Policy Server (NPS) network policy

  ---

  If you want to configure the Operating System condition, click Operating System, and then click Add. In Operating System Properties, click Add, and then specify the operating system settings that are required to match the policy. The Operating System condition specifies the operating system (operating system version or service pack number), role (client or server), and architecture (x86, x64, or ia64) required for the computer configuration to match the policy.