Microsoft 70-411 Online Practice Questions and Exam Preparation

Microsoft 70-411 Online Questions & Answers

• Question 201:

  Your network contains one Active Directory domain named contoso.com. The forest functional level is Windows Server 2012. All servers run Windows Server 2012 R2. All client computers run Windows 8.1.

  The domain contains 10 domain controllers and a read-only domain controller (RODC) named RODC01. All domain controllers and RODCs are hosted on a Hyper-V host that runs Windows Server 2012 R2.

  You need to identify whether the members of the protected Users group will be prevented from authenticating by using NTLM.

  Which cmdlet should you use?

  A. Get-ADGroupMember
  B. Get-ADDomainControllerPasswordReplicationPolicy
  C. Get-ADDomainControllerPasswordReplicationPolicyUsage
  D. Get-ADDomain
  E. Get-ADOptionalFeature
  F. Get-ADAccountAuthorizationGroup
  G. Get-ADAuthenticationpolicysilo
  H. Get-ADAuthenticationpolicy
  D. Get-ADDomain

• Question 202:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2. Server1 has the Remote Access server role installed.

  You log on to Server1 by using a user account named User2.

  From the Remote Access Management Console, you run the Getting Started Wizard and you receive a warning message as shown in the exhibit. (Click the Exhibit button.)

  

  You need to ensure that you can configure DirectAccess successfully. The solution must minimize the number of permissions assigned to User2. To which group should you add User2?

  A. Enterprise Admins
  B. Administrators
  C. Account Operators
  D. Server Operators
  B. Administrators

  ---

  You must have privileges to create WMI filters in the domain in which you want to create the filter. Permissions can be changed by adding a user to the Administrators group.

  Administrators (A built-in group)

  After the initial installation of the operating system, the only member of the group is the Administrator account. When a computer joins a domain, the Domain Admins group is added to the Administrators group. When a server becomes a

  domain controller, the Enterprise Admins group also is added to the Administrators group. The Administrators group has built-in capabilities that give its members full control over the system. The group is the default owner of any object that is

  created by a member of the group. This example logs in as a test user who is not a domain user or an administrator on the server. This results in the error specifying that DA can only be configured by a user with local administrator

  permissions.

  References:

  http://technet.microsoft.com/en-us/library/cc780416(v=ws.10).aspx http://technet.microsoft.com/en-us/library/cc775497(v=ws.10).aspx

• Question 203:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2.

  The domain contains 200 Group Policy objects (GPOs).

  An administrator named Admin1 must be able to add new WMI filters from the Group Policy Management Console (GPMC).

  You need to delegate the required permissions to Admin1. The solution must minimize the number of permissions assigned to Admin1.

  What should you do?

  A. From Active Directory Users and Computers, add Admin1 to the WinRMRemoteWMIUsers__group.
  B. From Group Policy Management, assign Creator Owner to Admin1 for the WMI Filters container.
  C. From Active Directory Users and Computers, add Admin1 to the Domain Admins group.
  D. From Group Policy Management, assign Full control to Admin1 for the WMI Filters container.
  D. From Group Policy Management, assign Full control to Admin1 for the WMI Filters container.

  ---

  Users with Full control permissions can create and control all WMI filters in the domain, including WMI filters created by others. Users with Creator owner permissions can create WMI filters, but can only control WMI filters that they create.

  Reference: http://technet.microsoft.com/en-us/library/cc757429(v=ws.10).aspx

• Question 204:

  Your network contains an Active Directory domain named contoso.com. The domain contains an organizational unit (OU) named IT and an OU named Sales.

  All of the help desk user accounts are located in the IT OU. All of the sales user accounts are located in the Sales OU. The Sales OU contains a global security group named G_Sales. The IT OU contains a global security group named

  G_HelpDesk.

  You need to ensure that members of G_HelpDesk can perform the following tasks:

  Reset the passwords of the sales users.

  Force the sales users to change their password at their next logon.

  What should you do?

  A. Run the Set-ADAccountPasswordcmdlet and specify the -identity parameter.
  B. Right-click the Sales OU and select Delegate Control.
  C. Right-click the IT OU and select Delegate Control.
  D. Run the Set-ADFineGrainedPasswordPolicycmdlet and specify the -identity parameter.
  B. Right-click the Sales OU and select Delegate Control.

  ---

  G_HelpDesk members need to be allowed to delegate control on the Sales OU as it contains the sales users (G_Sales) You can use the Delegation of Control Wizard to delegate the Reset Password permission to the delegated user.

  

  References: http: //support. microsoft. com/kb/296999/en-us http: //support. microsoft. com/kb/296999/en-us http: //technet. microsoft. com/en-us/library/cc732524. aspx

• Question 205:

  Your network contains a single Active Directory domain named contoso.com. The domain contains a domain controller named DC1 that hosts the primary DNS zone for contoso.com.

  All servers dynamically register their host names.

  You install two new Web servers that host identical copies of your company's intranet website. The servers are configured as shown in the following table.

  

  You need to use DNS records to load balance name resolution queries for intranet.contoso.com between the three Web servers. What is the minimum number of DNS records that you should create manually?

  A. 1
  B. 2
  C. 3
  D. 4
  B. 2

• Question 206:

  Your network contains four Network Policy Server (NPS) servers named Server1, Server2, Servers, and Server4.

  Server1 is configured as a RADIUS proxy that forwards connection requests to a remote RADIUS server group named Group1.

  You need to ensure that Server2 and Server3 receive connection requests. Server4 must only receive connection requests if both Server2 and Server3 are unavailable.

  How should you configure Group1?

  A. Change the Weight of Server4 to 10.
  B. Change the Weight of Server2 and Server3 to 10.
  C. Change the Priority of Server2 and Server3 to 10.
  D. Change the Priority of Server4 to 10.
  D. Change the Priority of Server4 to 10.

  ---

  During the NPS proxy configuration process, you can create remote RADIUS server groups and then add RADIUS servers to each group. To configure load balancing, you must have more than one RADIUS server per remote RADIUS server group. While adding group members, or after creating a RADIUS server as a group member, you can access the Add RADIUS server dialog box to configure the following items on the Load Balancing tab:

  Priority. Priority specifies the order of importance of the RADIUS server to the NPS proxy server. Priority level must be assigned a value that is an integer, such as 1, 2, or 3. The lower the number, the higher priority the NPS proxy gives to the RADIUS server. For example, if the RADIUS server is assigned the highest priority of 1, the NPS proxy sends connection requests to the RADIUS server first; if servers with priority 1 are not available, NPS then sends connection requests to RADIUS servers with priority 2, and so on. You can assign the same priority to multiple RADIUS servers, and then use the Weight setting to load balance between them. Weight. NPS uses this Weight setting to determine how many connection requests to send to each group member when the group members have the same priority level. Weight setting must be assigned a value between 1 and 100, and the value represents a percentage of 100 percent. For example, if the remote RADIUS server group contains two members that both have a priority level of 1 and a weight rating of 50, the NPS proxy forwards 50 percent of the connection requests to each RADIUS server.

  Advanced settings. These failover settingsprovide a way for NPS to determine whether the remote RADIUS server is unavailable. If NPS determines that a RADIUS server is unavailable, it can start sending connection requests to other group members. With these settings you can configure the number of seconds that the NPS proxy waits for a response from the RADIUS server before it considers the request dropped; the maximum number of dropped requests before the NPS proxy identifies the RADIUS server as unavailable; and the number of seconds that can elapse between requests before the NPS proxy identifies the RADIUS server as unavailable.

  The default priority is 1 and can be changed from 1 to 65535. So changing server 2 and 3 to priority 10 is not the way to go.

  

  Reference: http: //technet. microsoft. com/en-us/library/dd197433(WS. 10). aspx

• Question 207:

  Your company has four offices. The offices are located in Montreal, Seattle, Sydney, and New York.

  The network contains an Active Directory domain named contoso.com. The domain contains a server named Server2 that runs Windows Server 2012 R2. Server2 has the DHCP Server server role installed.

  All client computers obtain their IPv4 and IPv6 addresses from DHCP.

  You need to ensure that Network Access Protection (NAP) enforcement for DHCP applies to all of the client computers except for the client computers in the New York office.

  Which two nodes should you configure?

  To answer, select the appropriate two nodes in the answer area.

  Hot Area:

  

  

• Question 208:

  Your network contains an Active Directory domain named contoso.com. All domain controllers in the domain are configured as shown in the following table.

  

  You deploy a new domain controller named DC3 that runs Windows Server 2012 R2.

  You discover that you cannot create Password Settings objects (PSOs) by using Active Directory Administrative Center.

  You need to ensure that you can create PSOs from Active Directory Administrative Center.

  What should you do?

  A. Transfer the PDC emulator operations master role.
  B. Upgrade DC1.
  C. Raise the functional level of the domain.
  D. Transfer the infrastructure master operations master role.
  C. Raise the functional level of the domain.

• Question 209:

  You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the File Server Resource Manager role service installed.

  Each time a user receives an access-denied message after attempting to access a folder on Server1, an email notification is sent to a distribution list named DL1.

  You create a folder named Folder1 on Server1, and then you configure custom NTFS permissions for Folder 1.

  You need to ensure that when a user receives an access-denied message while attempting to access Folder1, an email notification is sent to a distribution list named DL2. The solution must not prevent DL1 from receiving notifications about

  other access-denied messages.

  What should you do?

  A. From File Explorer, modify the Classification tab of Folder1.
  B. From the File Server Resource Manager console, modify the Email Notifications settings.
  C. From the File Server Resource Manager console, set a folder management property.
  D. From File Explorer, modify the Customize tab of Folder1.
  C. From the File Server Resource Manager console, set a folder management property.

  ---

  When using the email model each of the file shares, you can determine whether access requests to each file share will be received by the administrator, a distribution list that represents the file share owners, or both.

  You can use the File Server Resource Manager console to configure the owner distribution list by editing the management properties of the classification properties.

  Reference: http://technet.microsoft.com/en-us/library/jj574182.aspx#BKMK_12

• Question 210:

  Your network contains 25 Web servers that run Windows Server 2012 R2. You need to configure auditing policies that meet the following requirements:

  Generate an event each time a new process is created.

  Generate an event each time a user attempts to access a file share.

  Which two auditing policies should you configure?

  To answer, select the appropriate two auditing policies in the answer area.

  Hot Area: