Microsoft 70-411 Online Practice Questions and Exam Preparation

Microsoft 70-411 Online Questions & Answers

• Question 21:

  Your network contains a single Active Directory domain named contoso.com. The domain contains a domain controller named DC1 that hosts the primary DNS zone for contoso.com. All servers dynamically register their host names.

  You install three new Web servers that host identical copies of your company's intranet website. The servers are configured as shown in the following table.

  

  You need to use DNS records to load balance name resolution queries for intranet.contoso.com between the three Web servers.

  What is the minimum number of DNS records that you should create manually?

  A. 1
  B. 3
  C. 4
  D. 6
  B. 3

  ---

  To create DNS Host (A) Records for all internal pool servers

  1.

  Click Stabrt, click All Programs, click Administrative Tools, and then click DNS.

  2.

  In DNS Manager, click the DNS Server that manages your records to expand it.

  3.

  Click Forward Lookup Zones to expand it.

  4.

  Right-click the DNS domain that you need to add records to, and then click New Host (A or AAAA).

  5.

  In the Name box, type the name of the host record (the domain name will be automatically appended).

  6.

  In the IP Address box, type the IP address of the individual Front End Server and then select Create associated pointer (PTR) record or Allow any authenticated user to update DNS records with the same owner name, if applicable.

  7.

  Continue creating records for all member Front End Servers that will participate in DNS Load Balancing.

  For example, if you had a pool named pool1.contoso.com and three Front End Servers, you would create the following DNS entries:

  

  Reference: http: //technet. microsoft. com/en-us/library/cc772506. aspx http: //technet. microsoft. com/en-us/library/gg398251. aspx

• Question 22:

  Your network contains an Active Directory domain named contoso.com. The domain contains a file server named Server1 that runs Windows Server 2012 R2.

  You view the effective policy settings of Server1 as shown in the exhibit. (Click the Exhibit button.)

  

  You need to ensure that an entry is added to the event log whenever a local user account is created or deleted on Server1. What should you do?

  A. In Servers GPO, modify the Advanced Audit Configuration settings.
  B. On Server1, attach a task to the security log.
  C. In Servers GPO, modify the Audit Policy settings.
  D. On Server1, attach a task to the system log.
  A. In Servers GPO, modify the Advanced Audit Configuration settings.

  ---

  When you use Advanced Audit Policy Configuration settings, you need to confirm that these settings are not overwritten by basic audit policy settings. The following procedure shows how to prevent conflicts by blocking the application of any basic audit policy settings. Enabling Advanced Audit Policy Configuration Basic and advanced audit policy configurations should not be mixed. As such, it's best practice to enable Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings in Group Policy to make

  sure that basic auditing is disabled. The setting can be found under Computer Configuration\Policies\Security Settings\Local Policies\Security Options, and sets the SCENoApplyLegacyAuditPolicy registry key to prevent basic auditing being

  applied using Group Policy and the Local Security Policy MMC snap-in.

  In Windows 7 and Windows Server 2008 R2, the number of audit settings for which success and failure can be tracked has increased to 53. Previously, there were nine basic auditing settings under Computer Configuration\Policies\Windows

  Settings\Security Settings\Local Policies\Audit Policy. These 53 new settings allow you to select only the behaviors that you want to monitor and exclude audit results for behaviors that are of little or no concern to you, or behaviors that create

  an excessive number of log entries. In addition, because Windows 7 and Windows Server 2008 R2 security audit policy can be applied by using domain Group Policy, audit policy settings can be modified, tested, and deployed to selected

  users and groups with relative simplicity.

  Audit Policy settings

  Any changes to user account and resource permissions.

  Any failed attempts for user logon.

  Any failed attempts for resource access.

  Any modification to the system files.

  Advanced Audit Configuration Settings

  Audit compliance with important business-related and security-related rules by tracking precisely defined activities, such as:

  A group administrator has modified settings or data on servers that contain finance information.

  An employee within a defined group has accessed an important file. The correct system access control list (SACL) is applied to every file and folder or registry key on a computer or file share as a verifiable safeguard against undetected

  access.

  In Servers GPO, modify the Audit Policy settings - enabling audit account management setting will generate events about account creation, deletion and so on.

  Advanced Audit Configuration Settings

  Advanced Audit Configuration Settings ->Audit Policy -> Account Management -> Audit User Account Management

  

  In Servers GPO, modify the Audit Policy settings - enabling audit account management setting will generate events about account creation, deletion and so on.

  

  Reference: http: //blogs. technet. com/b/abizerh/archive/2010/05/27/tracing-down-user-and-computer- account-deletion-in-active-directory. aspx http: //technet. microsoft. com/en-us/library/dd772623%28v=ws. 10%29. aspx http: //technet. microsoft. com/en-us/library/jj852202(v=ws. 10). aspx http: //www. petri. co. il/enable-advanced-audit-policy-configuration-windows-server. htm

  http: //technet. microsoft. com/en-us/library/dd408940%28v=ws. 10%29. aspx http: //technet. microsoft. com/en-us/library/dd408940%28v=ws. 10%29. aspx#BKMK_step2

• Question 23:

  Your network contains one Active Directory domain. The domain contains a DirectAcess deployment.

  You need to ensure that when the DirectAccess connection is active, the connection appears as "Contoso Internal Network -Authorized Users Only" on the DirectAccess clents.

  What should you configure in the DirectAccess client Group Policy object (GPO)?

  A. Friendly Name
  B. Corporate Resources
  C. User Interface
  D. Prefer Local Names Allowed
  A. Friendly Name

• Question 24:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2. Server1 has the File Server Resource Manager role service installed. You need to configure Server1 to meet the following requirements:

  Ensure that old files in a folder named Folder1 are archived automatically to a folder named Archive1.

  Ensure that all storage reports are saved to a network share.

  Which two nodes should you configure?

  To answer, select the appropriate two nodes in the answer area.

  Hot Area:

  

  

• Question 25:

  Your network contains one Active- Directory domain named contoso.com. The domain contains a file server named Server0l that runs Windows Server 2012 R2. Server0l has an operating system drive and a data drive. Server0l has a

  Trusted Platform Module (7PM).

  You need to enable Bit Locker Drive Encryption (BitLocker) for the data drive on Server0l.

  Which cmdlet should you run first?

  A. Unblock TPM
  B. Enable-BitLocker
  C. Add-BitLockerKcyProtector
  D. Install-WindowsFeature
  D. Install-WindowsFeature

• Question 26:

  Your network contains an Active Directory domain named contoso.com.

  All user accounts reside in an organizational unit (OU) named OU1.

  You create a Group Policy object (GPO) named GPO1. You link GPO1 to OU1. You configure the Group Policy preference of GPO1 to add a shortcut named Link1 to the desktop of each user.

  You discover that when a user deletes Link1, the shortcut is removed permanently from the desktop.

  You need to ensure that if a user deletes Link1, the shortcut is added to the desktop again.

  What should you do?

  A. Enforce GPO1.
  B. Modify the Link1 shortcut preference of GPO1.
  C. Enable loopback processing in GPO1.
  D. Modify the Security Filtering settings of GPO1.
  B. Modify the Link1 shortcut preference of GPO1.

  ---

  Replace Delete and recreate a shortcut for computers or users. The net result of the Replace action is to overwrite the existing shortcut. If the shortcut does not exist, then the Replace action creates a new shortcut. This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the shortcut already exists.

  

  Refernces:

  http: //technet.microsoft.com/en-us/library/cc753580.aspx http: //technet.microsoft.com/en-us/library/cc753580.aspx

• Question 27:

  Your network contains a RADIUS server named Server1.

  You install a new server named Server2 that runs Windows Server 2012 R2 and has Network Policy Server (NPS) installed.

  You need to ensure that all accounting requests for Server2 are forwarded to Server1.

  On Server2, you configure a Connection Request Policy.

  What else should you configure on Server2?

  To answer, select the appropriate node in the answer area.

  Hot Area:

  

  

• Question 28:

  Your network contains an Active Directory domain named contoso.com. The domain contains a member server named Server1. Server1 runs Windows Server 2012 R2.

  You enable the EventLog-Application event trace session.

  You need to set the maximum size of the log file used by the trace session to 10 MB.

  From which tab should you perform the configuration? To answer, select the appropriate tab in the answer area.

  Hot Area:

  

  

• Question 29:

  Your network contains an Active Directory domain named contoso.com. The domain contains 30 organization units (OUs).

  You need to ensure that a user named Admin1 can link Group policy objects (GPOs) in the domain.

  What should you do?

  A. From Group Management, click the contoso.com node and modify the Delegation settings.
  B. From Active Directory Users and Computer, add Admin1 to the Network Configuration Operators group.
  C. From Group policy Management, click the Group policy objects node and modify the Delegation settings
  D. From Active Directory Users and computers, add Admin1 to the Group policy Creator Owners group.
  A. From Group Management, click the contoso.com node and modify the Delegation settings.

• Question 30:

  Your network contains an Active Directory domain named contoso.com. The domain contains six domain controllers. The domain controllers are configured as shown in the following table.

  

  The network contains a server named Server1 that has the Hyper-v server role installed. DC6 is a virtual machine that is hosted on Server1.

  You need to ensure that you can clone DC6.

  Which FSMO role should you transfer to DC2?

  A. Rid master
  B. Domain naming master
  C. PDC emulator
  D. Infrastructure master
  C. PDC emulator

  ---

  The clone domain controller uses the security context of the source domain controller (the domain controller whose copy it represents) to contact the Windows Server 2012 R2 Primary Domain Controller (PDC) emulator operations master

  role holder (also known as flexible single master operations, or FSMO). The PDC emulator must be running Windows Server 2012 R2, but it does not have to be running on a hypervisor.

  Reference:

  http: //technet. microsoft. com/en-us/library/hh831734. aspx