Microsoft 70-417 Online Practice Questions and Exam Preparation

Microsoft 70-417 Online Questions & Answers

• Question 351:

  Your network contains an Active Directory domain named contoso.com. The domain contains a member server named Server 1. Server1 runs Windows Server 2012 R2 and has the Hyper-V server role installed. You create an external virtual switch named Switch1. Switch1 has the following configurations:

  -Connection type: External network

  -Single-root I/O virtualization (SR-IOV): Enabled Ten virtual machines connect to Switch1.

  You need to ensure that all of the virtual machines that connect to Switch1 are isolated from the external network and can connect to each other only. The solution must minimize network downtime for the virtual machines. What should you do?

  A. Remove Switch1 and recreate Switch1 as an internal network.
  B. Change the Connection type of Switch1 to Private network.
  C. Change the Connection type of Switch1 to Internal network.
  D. Remove Switch1 and recreate Switch1 as a private network.
  B. Change the Connection type of Switch1 to Private network.

  ---

  You can change the connection type of a virtual switch from the virtual switch manager without having to remove it. A private virtual network is isolated from all external network traffic on the virtualization server, as well any network traffic between the management operating system and the external network. This type of network is useful when you need to create an isolated networking environment, such as an isolated test domain.

  References: https://lennytech.wordpress.com/2013/03/29/setting-up-a-virtual-switch-for-a-hyper-v-network/

• Question 352:

  Your role of Network Administrator at ABC.com includes the management of the Active Directory Domain Services (AD DS) domain named ABC.com. All servers on the network run Windows Server 2012.

  The corporate Web site www.ABC.com is hosted on a Windows Server 2012 Web Server hosted on the corporate network. A public IP address is mapped to the private IP address of the Web Server to provide Internet access to the corporate Web site. DirectAccess is enabled on the network using the default configuration to enable external users to access resources on the corporate network when they are away from the office. Company security policy states that all connections from outside the office to www.ABC.com must come through the corporate firewall using the external IP address of the Web site.

  How can you ensure that external users cannot connect to www.ABC.com using a DirectAccess connection?

  A. By running the Set-DAClientExperienceConfiguration cmdlet.
  B. By modifying the Name Resolution Policy.
  C. By modifying the external IP address assigned to the Web server.
  D. By running the Remove-DAEntryPointTableItem cmdlet.
  B. By modifying the Name Resolution Policy.

• Question 353:

  Your network contains an Active Directory domain named contoso.com. The domain contains three servers named Server1, Server2, and Server3 that run Windows Server 2012 R2. All three servers have the Hyper-V server role installed and

  the Failover Clustering feature installed.

  Server1 and Server2 are nodes in a failover cluster named Cluster1. Several highly available virtual machines run on Cluster1. Cluster1 has that Hyper-V Replica Broker role installed. The Hyper-V Replica Broker currently runs on Server1.

  Server3 currently has no virtual machines.

  You need to configure Cluster1 to be a replica server for Server3 and Server3 to be a replica server for Cluster1.

  Which two tools should you use? {Each correct answer presents part of the solution. Choose two.)

  A. The Hyper-V Manager console connected to Server3
  B. The Failover Cluster Manager console connected to Server3
  C. The Hyper-V Manager console connected to Server1.
  D. The Failover Cluster Manager console connected to Cluster1
  E. The Hyper-V Manager console connected to Server2
  A. The Hyper-V Manager console connected to Server3
  D. The Failover Cluster Manager console connected to Cluster1

  ---

  Steps: Install the Replica Broker Hyper-v "role" configure replication on Server 3 in Hyper-V manager and mention the cluster (that's why a replica broker is needed) configure replication on Cluster 1 using the failover cluster manager. Using Hyper-V Replica in a failover cluster The configuration steps previously described Apply to VMs that are not hosted in a failover cluster. However, you might want to provide an offsite replica VM for a clustered VM. In this scenario, you would provide two levels of fault tolerance. The failover cluster is used to provide local fault tolerance, for example, if a physical node fails within a functioning data center. The offsite replica VM, on the other hand, could be used to recover only from site level failures, for example, in case of a power outage, weather emergency, or natural disaster. The steps to configure a replica VM for a clustered VM differ slightly from the normal configuration, but they aren't complicated. The first difference is that you begin by opening Failover Cluster Manager, not Hyper-V Manager. In Failover Cluster Manager, you then have to add a failover cluster role named Hyper-V Replica Broker to the cluster. (Remember, the word "role" is now used to describe a hosted service in a failover cluster.) To add the Hyper-V Replica Broker role, right-click the Roles node in Failover Cluster Manager and select Configure Role. This step opens the High Availability Wizard. In the High Availability Wizard, select Hyper-V Replica Broker as shown in Figure 12-28:

  

  When you choose this role, the High Availability Wizard will then ask you to provide a NetBIOS name and IP address to be used as the connection point to the cluster (called a client access point, or CAP). This step is shown in Figure 12-29.

  

  Next, you configure the equivalent of the server replication settings shown earlier in Figure 12-13.

  

  To do so, right-click the Hyper-V Replica Broker node in Failover Cluster Manager, and select Replication Settings from the shortcut menu, as shown in Figure 12-30. The difference between the settings here and the settings in Figure 12-13 is that in this case, the settings Apply to the entire cluster as a whole.

  

  On the remote Replica server, you configure replication as you normally would, by configuring Hyper-V Settings in Hyper-V Manager as described in the earlier section named "Configuring Hyper-V physical host servers." However, if you want the remote Replica also to be a multi-node failover cluster, then you would need to configure that remote failover cluster through Failover Cluster Manager (by adding and configuring the Hyper-V Replica Broker role). After you configure the host server settings, you can configure replication on the VM in Failover Cluster Manager just as you would in Hyper-V Manager. Right-click the clustered VM, click Replication, and then click Enable Replication, as shown in Figure 12-31.

  

  This step opens the same Enable Replication wizard that you see when you configure replication on a nonclustered VM. The remaining configuration steps are therefore identical. For the 70-417 exam, there's a good chance you'll be asked about basic concepts related to configuring replication on clustered VMs. Remember first of all that you use Failover Cluster Manager to configure replication for a clustered VM at the primary site but still use Hyper-V Manager at the Replica site. Remember that in Failover Cluster Manager at the primary site, you need to add the Hyper-V Replica Broker role to the failover cluster, and that this role is used to configure Hyper-V Replica "server" settings for the cluster. Finally, you also need to remember that when you configure Hyper-V Replica in a failover cluster, the CAP name and address are used as the server name and address.

• Question 354:

  You have a server named Server1 that runs Windows Server 2012 R2. You download and install the Microsoft Online Backup Service Agent on Server1.

  You need to ensure that you can configure an online backup from Windows Server Backup.

  What should you do first?

  A. From a command prompt, run wbadmin.exe enable backup.
  B. From Windows Server Backup, run the Register Server Wizard.
  C. From the Services console, modify the Log On settings of the Microsoft Online Backup Service Agent.
  D. From Computer Management, add the Server1 computer account to the Backup Operators group.
  B. From Windows Server Backup, run the Register Server Wizard.

  ---

  Download and install the Windows Azure Online Backup Agent After you create an account on the Windows Azure Online Backup website, you can download the Windows Azure Online Backup Agent and install it locally. An Online Backup node then appears in the navigation pane of the Windows Server Backup console, as shown in Figure 12

  

  If you prefer, you can also configure online backups from the Windows Azure Online Backup console, which becomes available after you install the agent. The Windows Azure Online Backup console provides exactly the same set of options as the Online Backup node in the Windows Server Backup console.

  Register server The next step is to register your server. Registering a server enables you to perform backups from that same server only. (Remember this point for the exam.) To register the server, from the Actions menu, select Register Server. The Register Server Wizard includes two configuration steps. First, you are given an opportunity to specify a proxy server if desired. Second, you are asked to provide a passphrase that will be used to encrypt your backup data and a location to save this passphrase in a file. You need to provide this passphrase when you perform a restore operation, so it's essential that you don't lose it. (Microsoft doesn't maintain a copy of your passphrase.) A Generate Passphrase option creates the passphrase for you automatically. After you register a server, new options for Online Backup appear in the Actions pane, including Schedule Backup, Recover Data, Change Properties, and Unregister Server.

• Question 355:

  Your network contains an Active Directory domain named contoso.com. The domain functional level is Windows Server 2008. All domain controllers run Windows Server 2008 R2.

  The domain contains a file server named Server1 that runs Windows Server 2012.

  Server1 has a BitLocker Drive Encryption (BitLocker)-encrypted drive.

  Server1 uses a Trusted Platform Module (TPM) chip.

  You enable the Turn on TPM backup to Active Directory Domain Services policy setting by using a Group Policy object (GPO). You need to ensure that you can back up the BitLocker recovery information to Active Directory.

  What should you do?

  A. Raise the forest functional level to Windows Server 2008 R2.
  B. Enable the Configure the level of TPM owner authorization information available to the operating system policy setting and set the Operating system managed TPM authentication level to None.
  C. Add a BitLocker data recovery agent.
  D. Import the TpmSchemaExtension.ldf and TpmSchemaExtensionACLChanges.ldf schema extensions to the Active Directory schema.
  D. Import the TpmSchemaExtension.ldf and TpmSchemaExtensionACLChanges.ldf schema extensions to the Active Directory schema.

  ---

  References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj635854(v=ws.11)

• Question 356:

  Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series. Information and details provided in a question apply only to that question.

  Your network contains one Active Directory domain named contoso.com. The domain contains 10 domain controllers and a read-only domain controller (RODC) named RODC01. The domain contains an administrator account named

  Admin1. You need to prevent Admin1 from creating more than 100 objects in the domain partition.

  Which tool should you use?

  A. the ntdsutil command.
  B. the Set-ADDomain cmdlet.
  C. the Install-ADDSDornain cmdlet.
  D. the dsadd command.
  E. the dsamain command.
  F. the dsmgmt command.
  G. the net user command.
  H. the Set-ADForest cmdlet.
  D. the dsadd command.

  ---

  References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754339(v=ws.11)

• Question 357:

  HOTSPOT

  Your network contains one Active Directory domain. The domain contains an enterprise certification authority (CA). You need to ensure that members of a group named Group1 can issue certificates for the User certificate template only.

  Which two tabs should you use to perform the configuration? To answer, select the appropriate tabs in the answer area.

  Hot Area:

  

  

  ---

  To configure certificate manager restrictions for a CA

  1. Open the Certification Authority snap-in, and right-click the name of the CA.

  2. Click Properties, and then click the Security tab.

  3. Verify that the user or group that you have selected has Issue and Manage Certificates permission. If they do not yet have this permission, select the Allow check box, and then click Apply.

  4. Click the Certificate Managers tab.

  5. Click Restrict certificate managers, and verify that the name of the group or user is displayed.

  6. Under Certificate Templates, click Add, select the template for the certificates that you want this user or group to manage, and then click OK. Repeat this step until you have selected all certificate templates that you want to allow this certificate manager to manage.

  7. Under Permissions, click Add, type the name of the client for whom you want the certificate manager to manage the defined certificate types, and then click OK.

  8. If you want to block the certificate manager from managing certificates for a specific user, computer, or group, under Permissions, select this user, computer, or group, and click Deny.

  9. When you are finished configuring certificate manager restrictions, click OK or Apply.

  References: https://technet.microsoft.com/en-us/library/cc753372.aspx

• Question 358:

  HOTSPOT

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2.

  Server1 has the Active Directory Federation Services (AD FS) server role installed.

  Adatum.com is a partner organization.

  You are helping the administrator of adatum.com set up a federated trust between adatum.com and contoso.com. The administrator of adatum.com asks you to provide a file containing the federation metadata of contoso.com.

  You need to identify the location of the federation metadata file. Which node in the AD FS console should you select?

  To answer, select the appropriate node in the answer area.

  Hot Area:

  

  

  ---

  http://blogs.msdn.com/b/card/archive/2010/06/25/using-federation-metadata-to-establish-a-relying-party-trustinad-fs-2-0.aspx

  

• Question 359:

  You have a server named Server1 that runs Windows Server 2012 R2. You apply a security policy to Server1 by using the Security Configuration Wizard (SCW).

  You plan to roll back the security policy. You need to identify the setting that are prevented from rolling back using the SCW.

  Which setting should you identify?

  A. the outbound authentication methods
  B. the system access control lists (SACLs)
  C. the service startup mode
  D. the network security rules
  B. the system access control lists (SACLs)

  ---

  System Keeps Auditing After Rollback In the auditing section of SCW there is an option to include the SCWAudit.inf template. If you do so, SCW configures System Access Control Lists (SACL) on a number of files. Without this template SCW will configure the system to perform object access auditing but since no files have SACLs on them by default, no file access will actually be audited. If you apply a policy with this option turned on and you subsequently roll back the policy, the SACLs will remain on the system. Consequently, if the system is configured to perform Object Access Auditing you will find auditing events in the Security Event Log. This is by design. SCW is not designed to roll back ACLs. To clear these SACLs you would need to manually restore any pre-existing SACLs. As long as these were defined in a security template doing so is a simple matter of re-applying that security template.

  References: http://blog.netwrix.com/2015/06/19/configure-audit-policy-and-security-using-security-configuration-wizard/

• Question 360:

  You work as a Network Administrator at ABC.com. The network contains a single Active Directory Domain Services (AD DS) domain named ABC.com which spans two sites. The company has a main office and a branch office. The two

  offices are connected by a slow Wide Area Network (WAN) link.

  Both offices have servers running Windows Server 2008 R2 Service Pack 1 (SP1) and Windows Server 2012.

  A Windows Server 2012 server named ABC-MainHV1 in the main office runs the Hyper-V Server role. ABC-MainHV1 hosts Virtual Machines (VMs) primarily used by users in the main office. You install a Windows Server 2012 server named

  ABC-BranchHV1 in the branch office and configure it to run the Hyper-V Server role. You configure a VM named BranchVM1 on ABCBranchHV1.

  You need to configure the virtual environment to ensure that if ABC-BranchHV1 fails, you can run BranchVM1 on ABC-MainHV1. Which two of the following steps should you perform? (Choose two).

  A. You should select the "Enable this computer as a replica server" in the Replication Configuration settings on ABC-MainHV1.
  B. You should select the "Enable this computer as a replica server" in the Replication Configuration settings on ABC- BranchHV1.
  C. Enable replication on BranchVM1.
  D. Change the storage location of the VHD file for BranchVM1.
  E. Export BranchVM1.
  A. You should select the "Enable this computer as a replica server" in the Replication Configuration settings on ABC-MainHV1.
  C. Enable replication on BranchVM1.