Microsoft 70-417 Online Practice Questions and Exam Preparation

Microsoft 70-417 Online Questions & Answers

• Question 371:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012. Server1 has the Remote Desktop Session Host role service installed. The computer account of Server1 resides in an organizational unit (OU) named OU1.

  You create and link a Group Policy object (GPO) named GPO1 to OU1. GPO1 is configured as shown in the exhibit. (Click the Exhibit button.)

  

  You need to prevent GPO1 from applying to your user account when you log on to Server1. GPO1 must apply to every other user who logs on to Server1. What should you configure?

  A. Item-level targeting
  B. Security Filtering
  C. Block Inheritance
  D. WMI Filtering
  B. Security Filtering

  ---

  Security filtering is a way of refining which users and computers will receive and apply the settings in a Group Policy object (GPO). Using security filtering, you can specify that only certain security principals within a container where the GPO is linked apply the GPO. Security group filtering determines whether the GPO as a whole applies to groups, users, or computers; it cannot be used selectively on different settings within a GPO.

• Question 372:

  You have a server named Server1 that runs Windows Server 2012 R2.

  You need to switch Server1 to a Server Core installation of Windows Server 2012 R2.

  What command should you run?

  To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

• Question 373:

  Your role of Network Administrator at ABC.com includes the management of the Active Directory Domain Services (AD DS) domain named ABC.com. The network includes servers that run Windows Server 2012. All client computers run Windows 7 Professional. A server named ABC-CA1 runs Certificate Services and is configured as an Enterprise Certification Authority (CA) for the ABC.com domain. Company security policy states that users should be able to log on to the network and encrypt their emails using smart cards. You want to configure auto-enrollment for certificates that can be used for authentication and email encryption.

  You plan to configure a domain-wide group policy object (GPO) to enable the auto-enrollment. What should you do first?

  A. You should duplicate the Computer certificate template and then publish the duplicated template.
  B. You should duplicate the User certificate template and then publish the duplicated template.
  C. You should duplicate the Smart Card Logon certificate template and then publish the duplicated template.
  D. You should duplicate the Smart Card User certificate template and then publish the duplicated template.
  B. You should duplicate the User certificate template and then publish the duplicated template.

• Question 374:

  You have a DNS server named DNS1 that runs Windows Server 2012 R2.

  On DNS1, you create a standard primary DNS zone named adatum.com.

  You need to change the frequency that secondary name servers will replicate the zone from DNS1.

  Which type of DNS record should you modify?

  A. Name server (NS)
  B. Start of authority (SOA)
  C. Host information (HINFO)
  D. Service location (SRV)
  B. Start of authority (SOA)

  ---

  The time to live is specified in the Start of Authority (SOA) record

  Note: TTL (time to live) - The number of seconds a domain name is cached locally before expiration and return to authoritative nameservers for updated information.

• Question 375:

  You have two Hyper-V hosts named Host1 and Host2 that run Windows Server 2012 R2. Host1 hosts a virtual machine named VM1 that is replicated to Host2. VM1 hosts an internal web application.

  You need to test the failover of VM1 to Host2. The solution must ensure that clients continue to connect to VM1 on Host1.

  Which cmdlet should you run?

  A. Start-VMFailover
  B. Compare-VM
  C. Export-VM
  D. Test-VMReplicationConnection
  E. Move-VM
  A. Start-VMFailover

  ---

  References: https://docs.microsoft.com/en-us/powershell/module/hyper-v/start-vmfailover?view=winserver2012r2-ps

• Question 376:

  Which of the following situations would you use AD LDS?

  A. A DMZ
  B. Standard private network
  C. You require the use of Group Policy
  D. You require the use of Organizational Units
  A. A DMZ

  ---

  A DMZ (Demilitarized Zone) such as a web server is usually the classic choice for using AD LDS (Active Directory Lightweight Directory Service)

• Question 377:

  Sometimes it's important to remove an RODC from your forest or domain. However, it's important that you follow a simple rule whilst removing RODC's. What is this rule?

  A. All RODC's must be detached before removing a final writable domain controller
  B. All writable domain controllers must be removed before RODC's can be detached
  C. Your forest must only consist of RODC's if you want to remove them
  D. There are no rules for removing RODC's
  A. All RODC's must be detached before removing a final writable domain controller

  ---

  After researching this and using logic, we need a writable DC for a RODC to exist, therefore we have to remove all RODC's before removing the last writable DC.

• Question 378:

  Your role of Network Administrator at ABC.com includes the management of the Active Directory Domain Services (AD DS) domain named ABC.com. The network includes servers that run Windows Server 2008 R2 Service Pack 1 (SP1) and Windows Server 2012. The Organizational Unit (OU) structure includes top-level OUs for each office location. Each toplevel OU contains OUs for each company department. Each departmental OU contains the user accounts of the users working in that department in the relevant location. Many Group Policy Objects (GPOs) are applied at the site level, domain level and OU level. You discover that two GPOs applied at the domain level do not have the desired effect. You need to change the order in which the GPOs are applied.

  How can you configure the order of precedence of the GPOs?

  A. By running the Set-GPPermission cmdlet
  B. By running the New-GPLink cmdlet.
  C. By running the Set-GPLink cmdlet.
  D. By running the Set-GPInheritance cmdlet.
  E. By running the Get-GPResultantSetOfPolicy cmdlet.
  C. By running the Set-GPLink cmdlet.

• Question 379:

  You have a server named Server1 that runs Windows Server 2012 R2.

  You plan to create a storage pool that will contain a new volume.

  You need to create a new 600-GB volume by using thin provisioning. The new volume must use the parity layout.

  What is the minimum number of 256-GB disks required for the storage pool?

  A. 2
  B. 3
  C. 4
  D. 5
  B. 3

• Question 380:

  You network contains one Active Directory domain named adatum.com.

  The domain contains a DNS server named Server1 that runs Windows Server 2012 R2.

  All domain computers use Server1 for DNS.

  You sign adatum.com by using DNSSEC. You need to configure the domain computers to validate DNS responses for adatum.com records.

  What should you configure in Group Policy?

  A. Network List Manager Policies
  B. Network Access Protection (NAP)
  C. Name Resolution Policy
  D. Public Key Policy
  C. Name Resolution Policy

  ---

  Name resolution policy needs to be configured in group policy.

  "In both example 1 and example 2, validation is not required for the secure.contoso.com zone because the Name Resolution Policy Table (NRPT) is not configured to require validation."

  References:

  https://technet.microsoft.com/en-us/library/jj200221.aspx