Microsoft 70-411 Online Practice Questions and Exam Preparation

Microsoft 70-411 Online Questions & Answers

• Question 221:

  Your network contains a single Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2. The domain contains 400 desktop computers that run Windows 8 and 10 desktop computers that run Windows

  XP Service Pack 3 (SP3). All new desktop computers that are added to the domain run Windows 8.

  All of the desktop computers are located in an organizational unit (OU) named OU1.

  You create a Group Policy object (GPO) named GPO1. GPO1 contains startup script settings. You link GPO1 to OU1.

  You need to ensure that GPO1 is applied only to computers that run Windows XP SP3.

  What should you do?

  A. Create and link a WML filter to GPO1
  B. Run the Set-GPInheritance cmdlet and specify the -target parameter.
  C. Run the Set-GPLink cmdlet and specify the -target parameter.
  D. Modify the Security settings of OU1.
  A. Create and link a WML filter to GPO1

  ---

  WMI Filtering is used to get information of the system and apply the GPO on it with the condition is met. Security filtering: apply a GPO to a specific group (members of the group)

• Question 222:

  You have a server named Server1 that runs Windows Server 2012 R2.

  On Server1, you configure a custom Data Collector Set (DCS) named DCS1. DCS1 is configured to store performance log data in C:\Logs.

  You need to ensure that the contents of C:\Logs are deleted automatically when the folder reaches 100 MB in size.

  What should you configure?

  A. A File Server Resource Manager (FSRM) file screen on the C:\Logs folder
  B. The Data Manager settings of DCS1
  C. A schedule for DCS1
  D. A File Server Resource Manager (FSRM) quota on the C:\Logs folder
  B. The Data Manager settings of DCS1

  ---

  To configure data management for a Data Collector Set

  1.

  In Windows Performance Monitor, expand Data Collector Sets and click User Defined.

  2.

  In the console pane, right-click the name of the Data Collector Set that you want to configure and click Data Manager.

  3.

  On the Data Manager tab, you can accept the default values or make changes according to your data retention policy. See the table below for details on each option. When Minimum free disk or Maximum folders is selected, previous data

  will be deleted according to the Resource policy you choose (Delete largest or Delete oldest) when the limit is reached. When Apply policy before the data collector set starts is selected, previous data will be deleted according to your

  selections before the data collector set creates its next log file.

  When Maximum root path size is selected, previous data will be deleted according to your selections when the root log folder size limit is reached.

  4.

  Click the Actions tab. You can accept the default values or make changes. See the table below for details on each option.

  5.

  When you have finished making your changes, click OK.

• Question 223:

  Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. The forest contains two Active Directory sites named Site1 and Site2.

  You plan to deploy a read-only domain controller (RODC) named DC10 to Site2. You pre-create the DC10 domain controller account by using Active Directory Users and Computers.

  You need to identify which domain controller will be used for initial replication during the promotion of the RODC.

  Which tab should you use to identify the domain controller?

  To answer, select the appropriate tab in the answer area.

  Hot Area:

  

  

• Question 224:

  You have a windows server Update Server (WSUS) server named serve01.

  You need to prevent the WSUS service on Server01 from being updated automatically

  What should you do from the Update Services console?

  A. From the Automatic Approvals option, modify the Default Automatic Approval Rule.
  B. From the Automatic Approvals options, modify the Advance settings.
  C. From the products and Classifications options, modify the Classification settings.
  D. From the products and classification option, modify the products settings
  C. From the products and Classifications options, modify the Classification settings.

• Question 225:

  Your network contains one Active Directory domain named contoso.com. The domain contains two domain controllers named DC01 and DC02 that run Windows Server 2012 R2. On DC02, you open C:\Windows\PolicyDefinitions as shown in the DC02 PolicyDefinitions exhibit. (Click the Exhibit button.)

  

  From a client computer, you open the SYSVOL share as shown in the SYSVOL exhibit. (Click the Exhibit button.)

  

  From DC01, you open a Group Policy object (GPO) named GPO1 as shown in the GPO1 exhibit. (Click the Exhibit button.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  Hot Area:

  

  

• Question 226:

  You have a server named Server1 that has the Network Policy and Access Services server role installed.

  You plan to configure Network Policy Server (NPS) on Server1 to use certificate-based authentication for VPN connections.

  You obtain a certificate for NPS.

  You need to ensure that NPS can perform certificate-based authentication.

  To which store should you import the certificate?

  To answer, select the appropriate store in the answer area.

  Hot Area:

  

  

• Question 227:

  Your network contains an Active Directory domain named contoso.com. The domain contains more than 100 Group Policy objects (GPOs). Currently, there are no enforced GPOs.

  The domain contains a top-level organizational unit (OU) for each department. A group named Group1 contains members from each department.

  You have a GPO named GPO1 that is linked to the domain.

  You need to configure GPO1 to apply settings to Group1 only.

  What should you use?

  A. Dcgpofix
  B. Get-GPOReport
  C. Gpfixup
  D. Gpresult
  E. Gpedit. msc
  F. Import-GPO
  G. Restore-GPO
  H. Set-GPInheritance
  I. Set-GPLink
  J. Set-GPPermission
  J. Set-GPPermission

  ---

  Set-GPPermission grants a level of permissions to a security principal (user, security group, or computer) for one GPO or all the GPOs in a domain. You use the TargetName and TargetType parameters to specify a user, security group, or

  computer for which to set the permission level.

  -Replace

  Specifies that the existing permission level for the group or user is removed before the new permission level is set. If a security principal is already granted a permission level that is higher than the specified permission level and you do not

  use the Replace parameter, no change is made.

  Reference: http: //technet. microsoft. com/en-us/library/ee461038. aspx

• Question 228:

  Your network contains an Active Directory domain named adatum.com.

  You need to audit changes to the files in the SYSVOL shares on all of the domain controllers. The solution must minimize the amount of SYSVOL replication traffic caused by the audit.

  Which two settings should you configure? (Each correct answer presents part of the solution. Choose two.)

  A. Audit Policy\Audit system events
  B. Advanced Audit Policy Configuration\DS Access
  C. Advanced Audit Policy Configuration\Global Object Access Auditing
  D. Audit Policy\Audit object access
  E. Audit Policy\Audit directory service access
  F. Advanced Audit Policy Configuration\Object Access
  D. Audit Policy\Audit object access
  F. Advanced Audit Policy Configuration\Object Access

• Question 229:

  You have a server named Server5 that runs Windows Server 2012 R2. Servers has the Windows Deployment Services server role installed.

  You need to ensure that when client computers connect to Server5 by using PXE, the computers use an unattended file.

  What should you configure?

  To answer, select the appropriate tab in the answer area.

  Hot Area:

  

  

• Question 230:

  Your network contains one Active Directory domain named contoso.com. The forest functional level is Windows Server 2012. All servers run Windows Server 2012 R2. All client computers run Windows 8.1.

  The domain contains 10 domain controllers and a read-only domain controller (RODC) named RODC01. All domain controllers and RODCs are hosted on a Hyper-V host that runs Windows Server 2012 R2.

  You need to identify which domain controller must be online when cloning a domain controller.

  Which cmdlet should you use?

  A. Get-ADGroupMember
  B. Get-ADDomainControllerPasswordReplicationPolicy
  C. Get-ADDomainControllerPasswordReplicationPolicyUsage
  D. Get-ADDomain
  E. Get-ADOptionalFeature
  F. Get-ADAccountAuthorizationGroup
  D. Get-ADDomain

  ---

  Explanation: One requirement for cloning a domain controller is an existing Windows Server 2012 DC that hosts the PDC emulator role. You can run the Get-ADDomain and retrieve which server has the PDC emulator role.

  Example: Command Prompt: C:\PS>

  Get-ADDomain

  Output wouldinclude a line such as: PDCEmulator : Fabrikam-DC1.Fabrikam.com

  Incorrect:

  Not A: The Get-ADGroupMember cmdlet gets the members of an Active Directory group.

  Members can be users, groups, and computers.

  Not E: The Get-ADOptionalFeature cmdlet gets an optional feature or performs a search to retrieve multiple optional features from an Active Directory. Not F: The Get-ADAuthorizationGroup cmdlet gets the security groups from the specified

  user, computer or service accounts token.

  Reference: Step-by-Step: Domain Controller Cloning

  http://blogs.technet.com/b/canitpro/archive/2013/06/12/step-by-step-domain-controller- cloning.aspx

  Reference: Get-ADDomain

  https://technet.microsoft.com/en-us/library/ee617224.aspx