Microsoft 70-417 Online Practice Questions and Exam Preparation

Microsoft 70-417 Online Questions & Answers

• Question 461:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2.

  Administrators use client computers that run Windows 8 to perform all management tasks.

  A central store is configured on a domain controller named DC1.

  You have a custom administrative template file named AppLadmx. App1.admx contains application settings for an application named App1.

  From a client computer named Computer1, you create a new Group Policy object (GPO) named GPO1.

  You discover that the application settings for App1 fail to appear in GPO1.

  You need to ensure that the App1 settings appear in all of the new GPOs that you create.

  What should you do?

  A. From the Default Domain Controllers Policy, add App1.admx to the Administrative Templates.
  B. Copy App1.admx to \\Contoso.com\SYSVOL\Contoso.com\Policies\PolicyDefinitions\.
  C. From the Default Domain Policy, add App1.admx to the Administrative Templates.
  D. Copy App1.admx to \\Contoso.com\SYSVOL\Contoso.com\StarterGPOs.
  B. Copy App1.admx to \\Contoso.com\SYSVOL\Contoso.com\Policies\PolicyDefinitions\.

  ---

  To take advantage of the benefits of .admx files, you must create a Central Store in the SYSVOL folder on a domain controller. The Central Store is a file location that is checked by the Group Policy tools. The Group Policy tools use any .admx files that are in the Central Store. The files that are in the Central Store are later replicated to all domain controllers in the domain.

• Question 462:

  HOTSPOT

  Your network contains an Active Directory domain named contoso.com. The domain contains two member servers named Server1 and Server2. All servers run Windows Server 2012 R2.

  Server1 and Server2 have the Hyper-V server role installed. The servers are configured as shown in the following table.

  

  You add a third server named Server3 to the network. Server3 has Intel processors.

  You need to move VM3 and VM6 to Server3. The solution must minimize downtime on the virtual machines.

  Which method should you use to move each virtual machine?

  To answer, select the appropriate method for each virtual machine in the answer area.

  Hot Area:

  

  

• Question 463:

  Your IT company is constantly changing, with new users coming and going throughout the year. One of your common tasks requires the deletion of user accounts for employees who have left the company. Which command can be used to delete user accounts?

  A. LDIFDE
  B. Dsmod
  C. Dspromo
  D. Netsh
  A. LDIFDE

  ---

  So far, dsmodmodifies but cannot delete ldifde can

• Question 464:

  Is the following statement about Hyper-V true or false? Hyper-V does not support wireless networks.

  A. True
  B. False
  B. False

  ---

  Hyper-V 2012 supports wireless (one of my VM is currently connected to internet using the wifi card of my laptop...) True that in 2008R2 it was not supported (unless many customizations, i know it as i did it)

• Question 465:

  Your network contains an Active Directory domain named contoso.com. The domain contains three servers. The servers are configured as shown in the following table.

  

  You need to ensure that end-to-end encryption is used between clients and Server2 when the clients connect to the network by using DirectAccess. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. From the Remote Access Management Console, reload the configuration.
  B. Add Server2 to a security group in Active Directory.
  C. Restart the IPSec Policy Agent service on Server2.
  D. From the Remote Access Management Console, modify the Infrastructure Servers settings.
  E. From the Remote Access Management Console, modify the Application Servers settings.
  B. Add Server2 to a security group in Active Directory.
  E. From the Remote Access Management Console, modify the Application Servers settings.

  ---

  References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj134239(v=ws.11)#27-configuration-summary-and-alternate-gpos

• Question 466:

  Your network contains an Active Directory domain named contoso.com. The network contains a file server named Server1 that runs Windows Server 2012 R2. You create a folder named Folder1. You share Folder1 as Share1. The NTFS permissions on Folder1 are shown in the Folder1 exhibit. (Click the Exhibit button.)

  

  The Everyone group has the Full control Share permission to Folder1.

  You configure a central access policy as shown in the Central Access Policy exhibit. (Click the Exhibit button.)

  

  Members of the IT group report that they cannot modify the files in Folder1. You need to ensure that the IT group members can modify the files in Folder1. The solution must use central access policies to control the permissions. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. On the Security tab of Folder1, remove the permission entry for the IT group.
  B. On the Classification tab of Folder1, set the classification to "Information Technology".
  C. On the Security tab of Folder1, assign the Modify permission to the Authenticated Users group.
  D. On Share1, assign the Change Share permission to the IT group.
  E. On the Security tab of Folder1, add a conditional expression to the existing permission entry for the IT group.
  B. On the Classification tab of Folder1, set the classification to "Information Technology".
  C. On the Security tab of Folder1, assign the Modify permission to the Authenticated Users group.

  ---

  A: On the Security tab of Folder1, remove the permission entry for the IT group. => tested => it failed of course, users don't even have read permissions anymore

  D: On Share1, assign the Change share permission to the IT group =>Everyone already has the full control share permission => won't solve the problem which is about the NTFS Read permission

  E: On the Security tab of Folder1, add a conditional expression to the existing permission entry for the IT group => how could a condition, added to a read permission, possibly transform a read to a modify permission? If they had said "modify the permission and add a conditional expression" => ok (even if that's stupid, it works) a condition is Applied to the existing permissions to filter existing access to only matching users or groups so if we Apply a condition to a read permission, the result will only be that less users (only them matching the conditions) will get those read permissions, which actually don't solve the problem neither so only one left:

  C: On the Security tab of Folder1, assign the Modify permission to the Authenticated Users group => for sure it works and it's actually the only one which works, but what about security? well i first did not consider this method => "modify" permission for every single authenticated users? But now it looks very clear:

  THE MORE RESTRICTIVE PERMISSION IS ALWAYS THE ONE APPLIED!! So "Modify" for Authenticated Users group and this will be filtered by the DAC who only allows IT group. and it matches the current settings that no other user

  (except admin, creator owner, etc...) can even read the folder. and this link confirms my theory:

  http://autodiscover.wordpress.com/2012/09/12/configuring-dynamic-access-controls-andfileclassificationpart4-winservr-2012-dac-microsoft-mvpbuzz/

  Configuring Dynamic Access Controls and File Classification

  Note:

  In order to allow DAC permissions to go into play, allow everyone NTFS full control permissions and then DAC will overwrite it, if the user doesn't have NTFS permissions he will be denied access even if DAC grants him access.

  And if this can help, a little summary of configuring DAC:

  

• Question 467:

  Your role of Network Administrator at ABC.com includes the management of the Active Directory Domain Services (AD DS) domain named ABC.com. The network includes servers that run Windows Server 2008 R2 Service Pack 1 (SP1) and

  Windows Server 2012. You are planning to deploy a custom CRM application named CorpApp1. All company users will use CorpApp1.

  You have installed two Windows Server 2012 servers named ABC-CL1 and ABC-CL2. The two servers will run the Failover Clustering feature and be configured as nodes in a single failover cluster.

  You plan to configure a shared folder on the failover cluster to host the application data for CorpApp1.

  To increase file server performance, you want both nodes in the failover cluster to respond to connection requests to the shared folder.

  How should you configure the failover cluster?

  A. You should configure "File Server for general use".
  B. You should configure "Scale-Out File Server".
  C. You should configure both cluster nodes as the preferred owner.
  D. You should configure both cluster nodes as the possible owner.
  E. You should set the Affinity setting to None.
  B. You should configure "Scale-Out File Server".

• Question 468:

  You have a server named Server1.

  You install the IP Address Management (IPAM) Server feature on Server1.

  You need to provide a user named User1 with the ability to set the access scope of all the DHCP servers that are managed by IPAM. The solution must use the principle of least privilege.

  Which user role should you assign to User1?

  A. IP Address Record Administrator Role
  B. IPAM Administrator Role
  C. IPAM ASM Administrator Role
  D. IPAM DHCP Administrator Role
  D. IPAM DHCP Administrator Role

  ---

  The IPAM DHCP administrator completely manages DHCP servers.

  References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn268500(v=ws.11)

• Question 469:

  Your network contains an Active Directory domain named Contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2.

  You create a group Managed Service Account named gservice1.

  You need to configure a service named service1 to run as the gservice1 account.

  How should you configure Service1?

  A. From the Services console, configure the Log On settings
  B. From a command prompt, run sc.exe and specify the privs parameter
  C. From the Services console, configure the Recovery settings
  D. From a command prompt, run sc.exe and specify the sdset parameter
  A. From the Services console, configure the Log On settings

• Question 470:

  Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series.

  Information and details provided in a question applies only to that question.

  Your network contains one Active Directory domain named contoso.com. The domain contains 10 domain controllers and a read-only domain controller (RODC) named RODC01.

  You plan to replace a domain controller named DC1. DC1 has the schema operations master role.

  You need to transfer the schema master role to another domain controller named DC10 before you remove Active Directory from DC1.

  What should you use?

  A. the ntdsutil command
  B. theSet-ADDomainWindows PowerShell cmdlet
  C. the Install-ADDSDomain Windows PowerShell cmdlet
  D. the dsadd command
  E. the dsamain command
  F. the dsmgmt command
  G. the net user command
  H. theSet-ADForestWindows PowerShell cmdlet
  A. the ntdsutil command

  ---

  You can transfertheschema operations masterrole by using Ntdsutil.exe.

  The ntdsutil roles commandseizes and transfers operations master roles (also known as flexible single master operations or FSMO roles).

  Note: You can use the ntdsutil commands to perform database maintenance of AD DS, manage and control single master operations, and remove metadataleft behind by domain controllers that were removed from the network without being

  properly uninstalled.