Microsoft 70-417 Online Practice Questions and Exam Preparation

Microsoft 70-417 Online Questions & Answers

• Question 31:

  Your network contains one Active Directory domain named contoso.com.

  You pilot DirectAccess on the network.

  During the pilot deployment, you enable DirectAccess only for a group named Contoso\Test Computers.

  Once the pilot is complete, you need to enable DirectAccess for all of the client computers in the domain.

  What should you do?

  A. From Active Directory Users and Computers, modify the membership of the Windows Authorization Access Group.
  B. From Windows PowerShell, run the Set-DirectAccess cmdlet.
  C. From Windows PowerShell, run the Set-DAClient cmdlet.
  D. From the Group Policy Management, modify the security filtering of an object named Direct Access Client Settings Group Policy.
  D. From the Group Policy Management, modify the security filtering of an object named Direct Access Client Settings Group Policy.

• Question 32:

  Which of the following reasons justifies why you should audit failed events?

  A. To log resource access for reporting and billing
  B. To monitor for malicious attempts to access a resource which has been denied
  C. None of these
  D. To monitor access that would suggest users are performing actions greater than you had planned
  B. To monitor for malicious attempts to access a resource which has been denied

  ---

  http://technet.microsoft.com/en-us/library/cc778162%28v=ws.10%29.aspx

  Auditing Security Events Best practices

  If you decide to audit failure events in the policy change event category, you can see if unauthorized users or attackers are trying to change policy settings, including security policy settings. Although this can be helpful for intrusion detection,

  the increase in resources that is required and the possibility of a denial-of-service attack usually outweigh the benefits.

• Question 33:

  Your network contains an Active Directory forest named adatum.com. The forest contains an Active Directory Rights Management Services (AD RMS) cluster.

  A partner company has an Active Directory forest named litwareinc.com. The partner company does not have AD RMS deployed.

  You need to ensure that users in litwareinc.com can consume rights-protected content from adatum.com.

  Which type of trust policy should you create?

  A. At federated trust
  B. A trusted user domain
  C. A trusted publishing domain
  D. Windows Live ID
  A. At federated trust

  ---

  In AD RMS rights can be assigned to users who have a federated trust withActive Directory Federation Services (AD FS). This enables an organization to share access to rights-protected content with another organization without having to establish a separate Active Directory trust or Active Directory Rights Management Services (AD RMS) infrastructure.

  

  References: http://technet.microsoft.com/en-us/library/dd772651(v=WS.10).aspx http://technet.microsoft.com/en-us/library/cc738707(v=WS.10).aspx http://technet.microsoft.com/en-us/library/cc757344(v=ws.10).aspx

• Question 34:

  Your network contains an Active Directory domain named adatum.com. All domain controllers run Windows Server 2012 R2. The domain contains a virtual machine named DC2. On DC2, you run Get-ADDCCloningExcludedApplicationList and receive the output shown in the following table.

  

  You need to ensure that you can clone DC2.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  E. Option E
  A. Option A
  E. Option E

  ---

  Because domain controllers provide a distributed environment, you could not safely clone an Active Directory domain controller in the past.

  Before, if you cloned any server, the server would end up with the same domainor forest, which is unsupported with the same domain or forest. You would then have to run sysprep, which would remove the unique security information before

  cloning and then promote a domain controller manually. When you clone a domain controller, you perform safe cloning, which a cloned domain controller automatically runs a subset of the sysprep process and promotes the server to a

  domain controller automatically.

  The four primary steps to deploy a cloned virtualized domain controller are as follows:

  Grant the source virtualized domain controller the permission to be cloned by adding the source virtualized domain controller to the Cloneable Domain Controllers group.

  

  Run Get-ADDCCloningExcludedApplicationList cmdlet in Windows PowerShell to determine which services and applications on the domain controller are not compatible with the cloning.

  

  Run New-ADDCCloneConfigFile to create the clone configuration file, which is stored in the C:\Windows\NTDS.

  

  In Hyper-V, export and then import the virtual machine of the source domain controller.

  

  Run Get-ADDCCloningExcludedApplicationList cmdlet In this procedure, run the Get-ADDCCloningExcludedApplicationList cmdlet on the source virtualized domain controller to identify any programs or services that are not evaluated for cloning. You need to run the Get-ADDCCloningExcludedApplicationList cmdlet before the New- ADDCCloneConfigFile cmdlet because if the New-ADDCCloneConfigFile cmdlet detects an excluded application, it will not create a DCCloneConfig.xml file. To identify applications or services that run on a source domain controller which have not been evaluated for cloning Get-ADDCCloningExcludedApplicationList Get-ADDCCloningExcludedApplicationList -GenerateXml

  The clone domain controller will be located in the same site as the source domain controller unless a different site is specified in the DCCloneConfig.xml file.

  Note: The Get-ADDCCloningExcludedApplicationList cmdlet searches the local domain controller for programs and services in the installed programs database, the services control manager that are not specified in the default and user defined inclusion list. The applications in the resulting list can be added to the user defined exclusion list if they are determined to support cloning. If the applications are not cloneable, they should be removed from the source domain controller before the clone media is created. Any application that appears in cmdlet output and is not included in the user defined inclusion list will force cloning to fail. The Get-ADDCCloningExcludedApplicationList cmdlet needs to be run before the New-ADDCCloneConfigFile cmdlet is used because if the New-ADDCCloneConfigFile cmdlet detects an excluded application, it will not create a DCCloneConfig.xml file. DCCloneConfig.xml is an XML configuration file that contains all of thesettings the cloned DC will take when it boots. This includes network settings, DNS, WINS, AD site name, new DC name and more. This file can be generated in a few different ways.

  The New-ADDCCloneConfig cmdlet in PowerShell By hand with an XML editor By editing an existing config file, again with an XML editor (Notepad is not an XML editor.)

  

  You can populate the XML file. . . . . doesn't need to be empty. . . . .

  

  References: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/introduction-to-active-directory-domain-services-ad-ds-virtualization-level-100 http://blogs.dirteam.com/blogs/sanderberkouwer/archive/2012/09/10/new-features-in-activedirectory-domain-services-in-windows-server-2012-part-13-domain-controller-cloning.aspx

• Question 35:

  Which one of the following groups has permission to shut down a domain controller?

  A. Backup Operators
  B. All of these
  C. Print Operators
  D. Server Operators
  B. All of these

  ---

  Below is a screenshot of the default settings

  

• Question 36:

  Your role of Network Administrator at ABC.com includes the management of the Active Directory Domain Services (AD DS) domain named ABC.com. The network includes servers that run Windows Server 2012.

  The network includes virtual machines (VMs) running on Windows Server 2012 Hyper-V host servers.

  A VM named ABC-DevVM runs on a Hyper-V host server. ABC-DevVM has a legacy network adapter.

  You need to configure bandwidth management for ABC-DevVM to ensure the VM can use a minimum of 50Mbps and a maximum of 100 Mbps.

  How should you configure the ABC-DevVM?

  A. Run the Set-VMNetworkAdapter cmdlet with the MinimumBandwidthAbsolute and the MaximumBandwidth options.
  B. Replace the legacy network adapter with a network adapter then run the Set- VMNetworkAdapter cmdlet with the MinimumBandwidthAbsolute and the MaximumBandwidth options.
  C. Configure a new virtual switch. Connect the legacy network adapter to the virtual switch.
  D. Configure a new virtual switch. Add a second legacy network adapter and connect both legacy network adapters to the virtual switch.
  B. Replace the legacy network adapter with a network adapter then run the Set- VMNetworkAdapter cmdlet with the MinimumBandwidthAbsolute and the MaximumBandwidth options.

• Question 37:

  Your network contains an Active Directory domain named contoso.com. All servers run either Windows Server 2008 R2 or Windows Server 2012 R2. All client computers run either Windows 7 or Windows 8. The domain contains a member server named Server1 that runs Windows Server 2012 R2. Server1 has the File and Storage Services server role installed. On Server1, you create a share named Share1. You need to ensure that users can use Previous Versions to restore the files in Share1. What should you configure on Server1?

  A. A data recovery agent
  B. The Shadow Copies settings
  C. The Recycle Bin properties
  D. A Windows Server Backup schedule
  B. The Shadow Copies settings

• Question 38:

  You have a virtual machine named VM1 that runs on a host named Host1.

  You configure VM1 to replicate to another host named Host2. Host2 is located in the same physical location as Host1.

  You need to add an additional replica of VM1. The replica will be located in a different physical site.

  What should you do?

  A. From VM1 on Host2, click Extend Replication.
  B. On Host1, configure the Hyper-V settings.
  C. From VM1 on Host1, click Extend Replication.
  D. On Host2, configure the Hyper-V settings.
  A. From VM1 on Host2, click Extend Replication.

  ---

  Once that is done, go to replica site and from Hyper-V UI manager select the VM for which you want to extend the replication. Right click on VM and select "Replication->Extend Replication ...". This will open Extend Replication Wizardwhich is similar to Enable Replication Wizard. http://technet.microsoft.com/en-us/library/dn551365.aspx http://technet.microsoft.com/en-us/library/jj134240.aspx NOTE: You configure a server to receive replication with Hyper-V Manager, in this situation the replica site is assumed to be the Replica Server. Therefore, you extend replication from VM1 on Host2.

  References: http://blogs.technet.com/b/virtualization/archive/2013/12/10/hyper-v-replica-extend-replication.aspx

• Question 39:

  You have a server named Server1 that runs Windows Server 2012 R2. Server1 has following storage spaces: Data Users Backups Primordial You add an additional hard disk to Server1.

  You need to identify which storage space contains the new hard disk.

  Which storage space contains the new disk?

  A. Primordial
  B. Data
  C. Backups
  D. Users
  A. Primordial

  ---

  New Disks (Unallocated space) added to Primordial space Primordial Pool? All storage that meets acceptable criteria for Storage Spaces will be placed in the Primordial Pool. This can be considered the default pool for devices from which any other pools will be created. Notice that there are no other virtual disks or pools at this point. The Primordial Pool will only consist of physical storage devices that do not belong to any other pools.

  

  References: http://blogs.technet.com/b/canitpro/archive/2012/12/13/storage-pools-dive-right-in.aspx http://blogs.technet.com/b/askpfeplat/archive/2012/10/10/windows-server-2012-storagespaces-is- it for-youcould-be.aspx

• Question 40:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1. Server1 runs Windows Server 2012 R2.

  You need to create 3-TB virtual hard disk (VHD) on Server1.

  Which tool should you use?

  A. New-StorageSubsytemVirtualDisk
  B. New-VirtualDisk
  C. Server Manager
  D. Computer Management
  D. Computer Management

  ---

  NOT A Share and Storage will only let you create a VHD on a storage pool

  NOT B Is this powershell ? the command should be NEW-VHD (http://blogs.technet.com/b/heyscriptingguy/archive/2013/06/07/powertip-create-a- new-vhd-with-windows-powershell.aspx) NOT C Server Manager, can't find where to create

  this.

  D Computer management is the only valid yet non available answer.

  I'd be left with C, hoping they'd have the good powershell command.

  Note:

  From @L_Ranger, Computer Management is not an option anymore.

  Back to New-VirtualDisk

  Old explanation: D (Computer management)

  For Server 2012:

  http://technet.microsoft.com/en-us/library/dd851645.aspx

  https://www.isunshare.com/windows-server/create-virtual-drive-in-windows-server-2012.html