Microsoft 70-411 Online Practice Questions and Exam Preparation

Microsoft 70-411 Online Questions & Answers

• Question 281:

  Your network contains an Active Directory domain named contoso.com. The domain contains a file server named Server1 that runs Windows Server 2012 R2. You view the effective policy settings of Server1 as shown in the exhibit. (Click the Exhibit button.)

  

  On Server1, you have a folder named C:\Share1 that is shared as Share1. Share1 contains confidential data. A group named Group1 has full control of the content in Share1.

  You need to ensure that an entry is added to the event log whenever a member of Group1 deletes a file in Share1.

  What should you configure?

  A. the Audit File Share setting of Servers GPO
  B. the Sharing settings of C:\Share1
  C. the Audit File System setting of Servers GPO
  D. the Security settings of C:\Share1
  D. the Security settings of C:\Share1

  ---

  You can use Computer Management to track all connections to shared resources on a Windows Server 2008 R2 system.

  Whenever a user or computer connects to a shared resource, Windows Server 2008 R2 lists a connection in the Sessions node.

  File access, modification and deletion can only be tracked, if the object access auditing is enabled you can see the entries in the event log.

  To view connections to shared resources, type net session at a command prompt or follow these steps:

  In Computer Management, connect to the computer on which you created the shared resource.

  In the console tree, expand System Tools, expand Shared Folders, and then select Sessions. You can now view connections to shares for users and computers.

  To enable folder permission auditing, you can follow the below steps:

  Click start and run "secpol. msc" without quotes.

  Open the Local Policies\Audit Policy

  Enable the Audit object access for "Success" and "Failure". Go to target files and folders, right click the folder and select properties.

  Go to Security Page and click Advanced.

  

  Click Auditing and Edit.

  Click add, type everyone in the Select User, Computer, or Group. Choose Apply onto: This folder, subfolders and files.

  Tick on the box "Change permissions"

  Click OK.

  

  After you enable security auditing on the folders, you should be able to see the folder permission changes in the server's Security event log. Task Category is File System.

  References:

  http: //social. technet. microsoft.com/Forums/en-US/winservergen/thread/13779c78-0c73- 4477-8014-f2eb10f3f10f/

  http: //technet. microsoft. com/en-us/library/cc753927(v=ws. 10). aspx http: //social. technet. microsoft. com/Forums/en-US/winservergen/thread/13779c78-0c73- 4477-8014-f2eb10f3f10f/ http: //support. microsoft. com/kb/300549

  http: //www. windowsitpro. com/article/permissions/auditing-folder-permission-changes http: //www. windowsitpro. com/article/permissions/auditing-permission-changes-on-a- folder

• Question 282:

  Your company has two offices. The offices are located in Montreal and Seattle.

  The network contains an Active Directory domain named contoso.com. The domain contains servers named Server1 and Server2. Server1 is located in the Seattle office.

  Server2 is located in the Montreal office. Both servers run Windows Server 2012 R2 and have the Windows Server Update Services (WSUS) server role installed.

  You need to configure Server2 to download updates that are approved on Server1 only.

  What cmdlet should you run?

  To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

• Question 283:

  You have a Windows Server Update Services (WSUS) server named Server1.. Server1 synchronizes from Microsoft Update.

  You plan to deploy a new WSUS server named Server2. Server2 will synchronize updates from Server1.Server2 will be separated from Server1 by a firewall.

  You need to identify which port must be open on the firewall so that Server2 can synchronize the updates.

  Which port should you identify?

  .

  A. 8530
  B. 3389
  C. 443
  D. 80
  A. 8530

  ---

  Explanation: WSUS upstream and downstream servers will synchronize on the port configured by the WSUS Administrator. By default, these ports are configured as follows: On WSUS 3.2 and earlier, port 80 for HTTP and 443 for HTTPS On WSUS 6.2 and later (at least Windows Server 2012), port 8530 for HTTP and 8531 for HTTPS The firewall on the WSUS server must be configured to allow inbound traffic on these ports. https://technet.microsoft.com/en-us/library/hh852346.aspx

• Question 284:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2.

  DirectAccess is deployed to the network.

  Remote users connect to the DirectAccess server by using a variety of network speeds.

  The remote users report that sometimes their connection is very slow.

  You need to minimize Group Policy processing across all wireless wide area network (WWAN) connections.

  Which Group Policy setting should you configure?

  A. Configure Group Policy slow link detection.
  B. Configure Direct Access connections as a fast network connection.
  C. Configure wireless policy processing.
  D. Change Group Policy processing to run asynchronously when a slow network connection is detected.
  A. Configure Group Policy slow link detection.

• Question 285:

  You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Remote Access server role installed. On Server1, you create a network policy named Policy1.

  You need to configure Policy1 to ensure that users are added to a VLAN.

  Which attributes should you add to Policy1?

  A. Tunnel-Tag, Tunnel-Password, Tunnel-Medium-Type, and Tunnel-Preference
  B. Tunnel-Tag, Tunnel-Server-Auth-ID, Tunnel-Preference, and Tunnel-Pvt-Group-ID
  C. Tunnel-Type, Tunnel-Tag, Tunnel-Medium-Type, and Tunnel-Pvt-Group-ID
  D. Tunnel-Type, Tunnel-Password, Tunnel-Server-Auth-ID, and Tunnel-Pvt-Group-ID
  C. Tunnel-Type, Tunnel-Tag, Tunnel-Medium-Type, and Tunnel-Pvt-Group-ID

  ---

  VLAN attributes used in network policy When you use network hardware, such as routers, switches, and access controllers that support virtual local area networks (VLANs), you can configure Network Policy Server (NPS) network policy to instruct the access servers to place members of Active Directory?groups on VLANs. Before configuring network policy in NPS for VLANs, create groups of users in Active Directory Domain Services (AD DS) that you want to assign to specific VLANs. Then when you run the New Network Policy wizard, add the Active Directory group as a condition of the network policy. You can create a separate network policy for each group that you want to assign to a VLAN. For more information, see Create a Group for a Network Policy. When you configure network policy for use with VLANs, you must configure the RADIUS standard attributes Tunnel-Medium-Type, Tunnel-Pvt-Group-ID, and Tunnel-Type. Some hardware vendors also require the use of the RADIUS standard attribute Tunnel-Tag. To configure these attributes in a network policy, use the New Network Policy wizard to create a network policy. You can add the attributes to the network policy settings while running the wizard or after you have successfully created a policy with the wizard. Tunnel-Medium-Type. Select a value appropriate to the previous selections you made while running the New Network Policy wizard. For example, if the network policy you are configuring is a wireless policy, in Attribute Value, select 802 (Includes all 802 media plus Ethernet canonical format). Tunnel-Pvt-Group-ID. Enter the integer that represents the VLAN number to which group members will be assigned. For example, if you want to create a Sales VLAN for your sales team by assigning team members to VLAN 4, type the number 4. Tunnel-Type. Select the value Virtual LANs (VLAN). Tunnel-Tag. Some hardware devices do not require this attribute. If your hardware device requires this attribute, obtain this value from your hardware documentation.

• Question 286:

  You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Windows Server Update Services server role installed.

  Server1 stores update files locally in C:\Updates.

  You need to change the location in which the update files are stored to D:\Updates.

  What should you do?

  A. From the Update Services console, run the Windows Server Update Services Configuration Wizard.
  B. From a command prompt, run wsusutil.exe and specify the movecontent parameter.
  C. From the Update Services console, configure the Update Files and Languages option.
  D. From a command prompt, run wsusutil.exe and specify the export parameter.
  B. From a command prompt, run wsusutil.exe and specify the movecontent parameter.

  ---

  You might need to change the location where WSUS stores updates locally. This might be required if the disk becomes full and there is no longer any room for new updates. You might also have to do this if the disk where updates are stored

  fails and the replacement disk uses a new drive letter.

  You accomplish this move with the movecontent command of WSUSutil.exe, a command- line tool that is copied to the file system of the WSUS server during WSUS Setup. By default, Setup copies WSUSutil.exe to the following location:

  WSUSInstallationDrive:\Program Files\Microsoft Windows Server Update Services\Tools\

• Question 287:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 P.2. Server1 has the Network Policy and Access Services server role installed.

  You plan to deploy 802. lx authentication to secure the wireless network.

  You need to identify which Network Policy Server (NPS) authentication method supports certificate-based mutual authentication for the 802.1x deployment.

  Which authentication method should you identify?

  A. MS-CHAP
  B. PEAP-MS-CHAPv2
  C. EAP-TLS
  D. MS-CHAP v2
  C. EAP-TLS

  ---

  802.1X uses EAP, EAP-TLS, EAP-MS-CHAP v2, and PEAP authentication methods:

  EAP (Extensible Authentication Protocol) uses an arbitrary authentication method, such as certificates, smart cards, or credentials. EAP-TLS (EAP-Transport Layer Security) is an EAP type that is used in certificate- based security

  environments, and it provides the strongest authentication and key determination method.

  EAP-MS-CHAP v2 (EAP-Microsoft Challenge Handshake Authentication Protocol version 2) is a mutual authentication method that supports password-based user or computer authentication.

  PEAP (Protected EAP) is an authentication method that uses TLS to enhance the security of other EAP authentication protocols.

• Question 288:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server1 that runs Windows Server 2012 R2. Server 1 has the Windows update Server role installed.

  You need to use a group policy object (GPO) to assign members to a computer group.

  Which setting should you configure in the GPO? To answer, select the appropriate setting in the answer area.

  Hot Area:

  

  

  ---

  Specify intranet Microsoft update service location

• Question 289:

  Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2. Both servers run Windows Server 2012 R2. Both servers have the File and Storage Services server role,

  the DFS Namespace role service, and the DFS Replication role service installed.

  Server1 and Server2 are part of a Distributed File System (DFS) Replication group named Group1. Server1 and Server2 are connected by using a high-speed LAN connection.

  You need to minimize the amount of processor resources consumed by DFS Replication.

  What should you do?

  A. Modify the replication schedule.
  B. Modify the staging quota.
  C. Disable Remote Differential Compression (RDC).
  D. Reduce the bandwidth usage.
  C. Disable Remote Differential Compression (RDC).

  ---

  Because disabling RDC can help conserve disk input/output (I/O) and CPU resources, you might want to disable RDC on a connection if the sending and receiving members are in a local area network (LAN), and bandwidth use is not a

  concern. However, in a LAN environment where bandwidth is contended, RDC can be beneficial when transferring large files.

  Question tells it uses a high-speed LAN connection.

  References:

  http: //technet. microsoft. com/en-us/library/cc758825%28v=ws. 10%29. aspx http: //technet. microsoft. com/en-us/library/cc754229. aspx

• Question 290:

  Your network contains an Active Directory forest named contoso.com. The forest contains a Network Policy Server (NPS) server named NPS1 and a VPN server named VPN1. VPN1 forwards all authentication requests to NPS1.

  A partner company has an Active Directory forest named adatum.com. The adatum.com forest contains an NPS server named NPS2.

  You plan to grant users from adatum.com VPN access to your network.

  You need to authenticate the users from adatum.com on VPN1.

  What should you create on each NPS server?

  To answer, drag the appropriate objects to the correct NPS servers. Each object may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  Select and Place: