Microsoft 70-417 Online Practice Questions and Exam Preparation

Microsoft 70-417 Online Questions & Answers

• Question 301:

  Your network contains an Active Directory domain named contoso.com. Domain controllers run either Windows Server 2008 R2 Service Pack 1 (SP1) or Windows Server 2012 R2.

  A support technician accidentally deletes a user account named User1.

  You need to use tombstone reanimation to restore the User1 account.

  Which tool should you use?

  A. Active Directory Administrative Center
  B. Ntdsutil
  C. Ldp
  D. Esentutl
  C. Ldp

  ---

  ADAC would be the perfect solution if this environment was in 2008 R2 functional level; however, it is currently below that due to there being a Windows Server 2003 DC. This means you must use the LDP utility as previously.

  

  References: http://technet.microsoft.com/en-us/library/hh831702.aspx

• Question 302:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2.

  You pre-create a read- only domain controller (RODC) account named RODC1. You export the settings of RODC1 to a file named File1.txt.

  You need to promote RODC1 by using File1.txt.

  Which tool should you use?

  A. The Install-WindowsFeature cmdlet
  B. The Add-WindowsFeature cmdlet
  C. The Dism command
  D. The Dcpromo command
  E. The Install-ADDSDomainController cmdlet
  D. The Dcpromo command

  ---

  DCPromo is gone, HOWEVER, it is still used for unattend installations using unattended files. This allows administrators the chance to get used to using powershell commands instead of the unattended file.

  http://technet.microsoft.com/en-us/library/hh472162.aspx NB: http://technet.microsoft.com/en-us/library/jj205467.aspx Install-WindowsFeature Installs one or more Windows Server roles, role services, or features on either the local or a specified remote server that is running Windows Server 2012 R2. This cmdlet is equivalent to and replaces Add- WindowsFeature, the cmdlet that was used to install roles, role services, and features in Windows Server 2008 R2. So the 2 first answers are the same and we only have one choice here...

• Question 303:

  HOTSPOT

  Your network contains an Active Directory domain named contoso.com. The domain contains servers named Server1 and Server2 that run Windows Server 2012 R2.

  You create a windows PowerShell script named Scriptl.psl that contains the following configuration:

  

  You need to apply the configuration to Server1.

  The solution must ensure that the configuration on Server1 can be updated by modifying a MOF file on Server2.

  Which actions should you perform on each server?

  To answer, select the appropriate server on which to perform each action in the answer area.

  Hot Area:

  

  

  ---

  https://www.altaro.com/hyper-v/desired-state-configuration-hyper-v-part-3-generating-mof-files/

• Question 304:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2.

  In a remote site, a support technician installs a server named DC10 that runs Windows Server 2012 R2. DC10 is currently a member of a workgroup.

  You plan to promote DC10 to a read-only domain controller (RODC).

  You need to ensure that a user named Contoso\User1 can promote DC10 to a RODC in the contoso.com domain.

  The solution must minimize the number of permissions assigned to User1.

  What should you do?

  A. From Active Directory Administrative Center, pre-create an RODC computer account.
  B. FromDsmgmt, run the local roles command.
  C. Join DC10 to the domain. Modify the properties of the DC10 computer account.
  D. Join DC10 to the domain. Run dsmod and specify the /server switch.
  A. From Active Directory Administrative Center, pre-create an RODC computer account.

  ---

  A staged read only domain controller (RODC) installation works in two discrete phases:

  1.

  Staging an unoccupied computer account

  2.

  Attaching an RODC to that account during promotion

• Question 305:

  A user from your organization has reported to the IT helpdesk that they are receiving the following message:

  "Your account is configured to prevent you from using the computer. Please try another computer."

  What should you do to enable them to log on to their computer?

  A. Use the Dsmove command
  B. Click the Log On To button on the Account tab of her user account
  C. None of these
  D. Click the Allowed To Join Domain button in the New Computer dialog box
  B. Click the Log On To button on the Account tab of her user account

  ---

  The error message is about the user account configuration. This can be set here:

  

• Question 306:

  Your company deploys a new Active Directory forest named contoso.com. The first domain controller in the forest runs Windows Server 2012 R2. The forest contains a domain controller named DC10.

  On DC10, the disk that contains the SYSVOL folder fails.

  You replace the failed disk. You stop the Distributed File System (DFS) Replication service. You restore the SYSVOL folder.

  You need to perform a non-authoritative synchronization of SYSVOL on DC10.

  Which tool should you use before you start the DFS Replication service on DC10?

  A. Active Directory Sites and Services
  B. Ultrasound
  C. Adsiedit.msc
  D. Frsutil
  C. Adsiedit.msc

  ---

  How to perform a non-authoritative synchronization of DFSR-replicated SYSVOL (like "D2" for FRS)

  1.

  In theADSIEDIT.MSCtool modify the following distinguished name (DN) value and attribute on each of the domain controllers that you want to make non-authoritative:CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSRLocalSettings,CN=,OU=Domain Controllers,DC=msDFSR-Enabled=FALSE

  2.

  Force Active Directory replication throughout the domain.

• Question 307:

  Your network contains an Active Directory forest named contoso.com. All domain controllers currently run Windows Server 2008 R2 Service Pack 1 (SP1).

  You plan to install a new domain controller named DC4 that runs Windows Server 2012 R2.

  The new domain controller will have the following configurations: Schema master Global catalog server DNS Server role Active Directory Certificate Services server role

  You need to identify which configurations cannot be fulfilled by using the Active Directory Domain Services Configuration Wizard.

  Which two configurations should you identify? (Each correct answer presents part of the solution. (Choose two.)

  A. Enable the global catalog server.
  B. Transfer the schema master.
  C. Install the Active Directory Certificate Services role.
  D. Install the DNS Server role.
  B. Transfer the schema master.
  C. Install the Active Directory Certificate Services role.

  ---

  AD Installation Wizard will automatically install DNS and allows for the option to set it as a global catalog server. ADCS and schema must be done separately.

  

• Question 308:

  Your network contains an Active Directory domain named contoso.com.

  Network Policy Server (NPS) is deployed to the domain.

  You plan to deploy Network Access Protection (NAP).

  You need to configure the requirements that are validated on the NPS client computers.

  What should you do?

  A. From the Network Policy Server console, configure a health policy.
  B. From the Network Policy Server console, configure a network policy.
  C. From a Group Policy object (GPO), configure the NAP Client Configuration security setting.
  D. From a Group Policy object (GPO), configure the Network Access Protection Administrative Templates setting.
  E. From the Network Policy Server console, configure a Windows Security Health Validator (WSHV) policy.
  E. From the Network Policy Server console, configure a Windows Security Health Validator (WSHV) policy.

  ---

  References: http://technet.microsoft.com/en-us/library/cc731260.aspx

• Question 309:

  HOTSPOT

  Your network contains an Active Directory domain named contoso.com. The domain contains two DHCP servers named Server1 and Server2. Both servers have multiple IPv4 scopes.

  Server1 and Server2 are used to assign IP addresses for the network IDs of 172.20.0.0/16 and 131.107.0.0/16.

  You install the IP Address Management (IPAM) Server feature on a server named IPAM1 and configure IPAM1 to manage Server1 and Server2.

  Some users from the 172.20.0.0 network report that they occasionally receive an IP address conflict error message.

  You need to identify whether any scopes in the 172.20.0.0 network ID conflict with one another.

  What Windows PowerShell cmdlet should you run?

  To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

  ---

  The following command will display any overlapping IP address ranges, if they exist.

  Get-IpamRange –AddressFamily IPv4 –AddressCategory Private|where-object {$_.Overlapping –eq “True”}

  References: https://technet.microsoft.com/en-us/library/dn268503.aspx

• Question 310:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1 that runs Windows Server 2012 R2. DC1 is backed up daily.

  The domain has the Active Directory Recycle Bin enabled.

  During routine maintenance, you delete 500 inactive user accounts and 100 inactive groups. One of the deleted groups is named Group1. Some of the deleted user accounts are members of some of the deleted groups.

  For documentation purposes, you must provide a list of the members of Group1 before the group was deleted.

  You need to identify the names of the users who were members of Group1 prior to its deletion. You want to achieve this goal by using the minimum amount of administrative effort.

  What should you do first?

  A. Reactivate the tombstone of Group1.
  B. Use the Recycle Bin to restore Group1.
  C. Perform an authoritative restore of Group1.
  D. Mount the most recent Active Directory backup.
  D. Mount the most recent Active Directory backup.

  ---

  You can use the Active Directory database mounting tool (Dsamain.exe) and a Lightweight Directory Access Protocol (LDAP) tool, such as Ldp.exe or Active Directory Users and Computers, to identify which backup has the last safe state of the forest. The Active Directory database mounting tool, which is included in Windows Server 2008 and later Windows Server operating systems, exposes Active Directory data that is stored in backups or snapshots as an LDAP server. Then, you can use an LDAP tool to browse the data. This approach has the advantage of not requiring you to restart any DC in Directory Services Restore Mode (DSRM) toexamine the contents of the backup of AD DS.