Microsoft 70-412 Online Practice Questions and Exam Preparation

Microsoft 70-412 Online Questions & Answers

• Question 251:

  Your network contains an Active Directory domain named contoso.com. The domain contains a file server named Server1. The File Server Resource Manager role service is installed on Server1. All servers run Windows Server 2012 R2. A Group Policy object (GPO) named GPO1 is linked to the organizational unit (OU) that contains Server1. The following graphic shows the configured settings in GPO1.

  

  Server1 contains a folder named Folder1. Folder1 is shared as Share1.

  You attempt to configure access-denied assistance on Server1, but the Enable access-denied assistance option cannot be selected from File Server Resource Manager.

  You need to ensure that you can configure access-denied assistance on Server1 manually by using File Server Resource Manager.

  Which two actions should you perform?

  A. Set the Enable access-denied assistance on client for all file types policy setting to Disabled for GPO1.
  B. Set the Customize message for Access Denied errors policy setting to Not Configured for GPO1.
  C. Set the Enable access-denied assistance on client for all file types policy setting to Enabled for GPO1.
  D. Set the Customize message for Access Denied errors policy setting to Enabled for GPO1.
  B. Set the Customize message for Access Denied errors policy setting to Not Configured for GPO1.
  C. Set the Enable access-denied assistance on client for all file types policy setting to Enabled for GPO1.

  ---

  B:

  You can configure Administrative Template policy settings to one of three states: Not Configured, Enabled, and Disabled. Not Configured is the default state for all policy settings. Policy settings set to Not Configured do not affect users or

  computers. Enabling an Administrative Template policy setting activates the policy setting. When Enabled, the action described in the title of the policy setting applies to the user or computer. When Disabled, the opposite action described in

  the title of the policy setting applies to the user or computer. Usually Not Configured and Disabled policy settings produce the same results. The difference is that Not Configured policy settings do not apply to the user, but Disabled policy

  settings apply to a user.

  C.

  To configure access-denied assistance for all file types by using Group Policy

  Open Group Policy Management. In Server Manager, click Tools, and then click Group Policy Management.

  Right-click the appropriate Group Policy, and then click Edit.

  Click Computer Configuration, click Policies, click Administrative Templates, click System, and then click Access-Denied Assistance.

  Right-click Enable access-denied assistance on client for all file types, and then click Edit.

  Click Enabled, and then click OK.

  References: https://technet.microsoft.com/en-us/library/dn789184(v=ws.11).aspx

  https://technet.microsoft.com/en-us/library/hh831402.aspx

• Question 252:

  HOTSPOT

  Your network contains two application servers that run Windows Server 2012 R2. The application servers have the Network Load Balancing (NLB) feature installed.

  You create an NLB cluster that contains the two servers.

  You plan to deploy an application named App1 to the nodes in the cluster. App1 uses TCP port 8080 and TCP port 8081.

  Clients will connect to App1 by using HTTP and HTTPS via a single reverse proxy. App1 does not use session state information.

  You need to configure a port rule for Appl. The solution must ensure that connections to App1 are distributed evenly between the nodes.

  Which port rule should you use?

  To answer, select the appropriate rule in the answer area.

  Hot Area:

  

  

  ---

  Only the TCP Protocol is needed Only a Single host is required.

  Reference: Create a new Network Load Balancing Port Rule

• Question 253:

  HOTSPOT

  You have a file server named Server1 that runs Windows Server 2012 R2.

  Server1 contains a file share that must be accessed by only a limited number of users.

  You need to ensure that if an unauthorized user attempts to access the file share, a custom access-denied message appears, which contains a link to request access to the share. The message must not appear when the unauthorized user attempts to access other shares.

  Which two nodes should you configure in File Server Resource Manager? To answer, select the appropriate two nodes in the answer area.

  Hot Area:

  

  

  ---

  * Configure access-denied assistance

  To configure access-denied assistance by using File Server Resource Manager

  1. Open File Server Resource Manager. In Server Manager, click Tools, and then click File Server Resource Manager.

  2. Right-click File Server Resource Manager (Local), and then click Configure Options.

  etc.

  * To specify a separate access-denied message for a shared folder by using File Server Resource Manager

  1. Open File Server Resource Manager. In Server Manager, click Tools, and then click File Server Resource Manager.

  2. Expand File Server Resource Manager (Local), and then click Classification Management.

  3. Right-click Classification Properties, and then click Set Folder Management Properties.

  Etc

  Reference: Deploy Access-Denied Assistance (Demonstration Steps)

• Question 254:

  Your network contains an Active Directory domain named contoso.com.

  The domain contains a domain controller named DC1 that runs Windows Server 2012 R2.

  You create an Active Directory snapshot of DC1 each day.

  You need to view the contents of an Active Directory snapshot from two days ago.

  What should you do first?

  A. Stop the Active Directory Domain Services (AD DS) service.
  B. Run the ntdsutil.exe command.
  C. Run the dsamain.exe command.
  D. Start the Volume Shadow Copy Service (VSS).
  B. Run the ntdsutil.exe command.

• Question 255:

  Your network contains an Active Directory domain named contoso.com.

  All domain controllers run Windows Server 2012. One of the domain controllers is named DC1.

  The DNS zone for the contoso.com zone is Active Directory-integrated and has the default settings.

  A server named Server1 is a DNS server that runs a UNIX-based operating system.

  You plan to use Server1 as a secondary DNS server for the contoso.com zone.

  You need to ensure that Server1 can host a secondary copy of the contoso.com zone.

  Whatshould you do?

  A. From Windows PowerShell, run the Set-DnsServerForwarder cmdlet and specify the contoso.com zone as a target.
  B. From Windows PowerShell, run the Set-DnsServerSetting cmdlet and specify DC1 as a target.
  C. From Windows PowerShell, run theSet-DnsServerPrimaryZone cmdlet and specify the contoso.com zone as a target.
  D. From DNS Manager, modify the Advanced settings of DC1.
  C. From Windows PowerShell, run theSet-DnsServerPrimaryZone cmdlet and specify the contoso.com zone as a target.

  ---

  C. The Set-DnsServerSecondaryZone cmdletchanges settings for an existing secondary zone on aDomain Name System (DNS) server. http://technet.microsoft.com/en-us/library/jj649920(v=wps.620).aspx

• Question 256:

  HOTSPOT

  Your network contains one Active Directory forest named contoso.com. The forest contains the domain controllers configured as shown in the following table.

  

  You perform the following actions:

  

  Create a file named File1.txt in the SYSVOL folder on DC1.

  

  Create a user named User1 on DC4.

  You need to identify on which domain controller or controllers a copy of each object is stored. What should you identify? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

• Question 257:

  Your network contains an Active Directory forest named contoso.com. The forest contains three domains. All domain controllers run Windows Server 2012 R2.

  The forest has a two-way realm trust to a Kerberos realm named adatum.com.

  You discover that users in adatum.com can only access resources in the root domain of contoso.com.

  You need to ensure that the adatum.com users can access the resources in all of the domains in the forest.

  What should you do in the forest?

  A. Delete the realm trust and create a forest trust.
  B. Delete the realm trust and create three external trusts.
  C. Modify the incoming realm trust.
  D. Modify the outgoing realm trust.
  D. Modify the outgoing realm trust.

  ---

  *

  A one-way, outgoing realm trust allows resources in your Windows Server domain (the domain that you are logged on to at the time that you run the New Trust Wizard) to be accessed by users in the Kerberos realm.

  *

  You can establish a realm trust between any non-Windows Kerberos version 5 (V5) realm and an Active Directory domain. This trust relationship allows cross-platform interoperability with security services that are based on other versions of the Kerberos V5 protocol, for example, UNIX and MIT implementations. Realm trusts can switch from nontransitive to transitive and back. Realm trusts can also be either one-way or two-way.

  Reference: Create a One-Way, Outgoing, Realm Trust

• Question 258:

  Your network contains two Web servers named Server1 and Server2. Both servers run Windows Server 2012 R2.

  Server1 and Server2 are nodes in a Network Load Balancing (NLB) cluster. The NLB cluster contains an application named App1 that is accessed by using the URL http://app1.contoso.com. You plan to perform maintenance on Server1.

  You need to ensure that all new connections to App1 are directed to Server2. The solution must not disconnect the existing connections to Server1. What should you run?

  A. The Set-NlbCluster cmdlet
  B. The Set-NlbClusterNode cmdlet
  C. The Stop-NlbCluster cmdlet
  D. The Stop-NlbClusterNode cmdlet
  E. The Suspend-NlbClusterNode cmdlet
  F. The nlb.exe suspend command
  D. The Stop-NlbClusterNode cmdlet

  ---

  The Stop-NlbClusterNode cmdlet stops a node in an NLB cluster. When you use the stop the nodes in the cluster, client connections that are already in progress are interrupted. To avoid interrupting active connections, consider using the drain parameter, which allows the node to continue servicing active connections but disables all new traffic to that node.

  -Drain

  Drains existing traffic before stopping the cluster node. If this parameter is omitted, existing traffic will be dropped.

  References: Stop-NlbClusterNode

• Question 259:

  Your network contains an Active Directory domain named contoso.com.

  All servers run Windows Server 2012 R2. The domain contains a file server named Server1.

  The domain contains a domain controller named DC1.

  Server1 contains three shared folders.

  The folders are configured as shown in the following table.

  

  Folder2 has a conditional expression of User.Department= = MMarketing".

  You discover that a user named User1 cannot access \\Server1\folder2.

  User1 can access \\Server1\folderl and \\Server1\folder3.

  You verify the group membership of User1 as shown in the Member Of exhibit. (Click the Exhibit button.)

  

  You verify the organization information of User1 as shown in the Organization exhibit. (Click the Exhibit button.)

  

  You verify the general properties of User1 as shown in the General exhibit. (Click the Exhibit button.)

  

  You need to ensure that User1 can access the contents of \\Server1\folder2. What should you do?

  A. From a Group Policy object (GPO), set the Support for Dynamic Access Control and Kerberos armoring setting to Always provide claims.
  B. Change the department attribute of User1.
  C. Grant the Full Control NTFS permissions on Folder2 to User1.
  D. Remove Userl1from the Accounting global group.
  B. Change the department attribute of User1.

  ---

  Conditional Expression and users Department must match http://technet.microsoft.com/en-us/library/jj134043.aspx

• Question 260:

  You have a server named Server1.

  A Microsoft Azure Backup of Server1 is created automatically every day.

  You rename Server1 to Server2.

  You discover that backups are no longer created in Azure.

  You need to back up the server to Azure.

  What should you do?

  A. From the Azure Management Portal, modify the configuration of backup vault.
  B. On Server2, run the Add-WBBackupTarget cmdlet.
  C. On Server2, run the Start-OBRegistration cmdlet.
  D. From the Azure Management Portal, upload the Server2 certificate as a management certificate.
  C. On Server2, run the Start-OBRegistration cmdlet.

  ---

  The Start-OBRegistration cmdlet registers the server with using the vault credentials downloaded during enrollment.

  What happens if I rename a Windows server that is backing up data to Azure?

  Any currently configured backups will be stopped. You will need to reregister the server with the backup vault and it will be considered a new server by Recovery Services, so the first backup operation that occurs after registration will be a full

  backup of all of the data included in the backup instead of just the changes since the last backup occurred. However, if you need to perform a recovery operation you can recover the data that has been backed up using Recover from another

  server recovery option. For more information, see Rename a server.

  References:

  https://azure.microsoft.com/sv-se/documentation/articles/backup-azure-backup-faq/

  https://technet.microsoft.com/en-us/library/hh770398(v=wps.630).aspx