Microsoft 70-417 Online Practice Questions and Exam Preparation

Microsoft 70-417 Online Questions & Answers

• Question 481:

  Your role of Network Administrator at ABC.com includes the management of the Active Directory Domain Services (AD DS) domain named ABC.com. The network includes servers that run Windows Server 2012. All servers are hosted in a data center. The data center includes a virtual infrastructure based on host servers running Windows Server 2012 Hyper-V.

  The company implements a backup data center. The backup data center connects to the existing primary data center network using a WAN link.

  You configure virtual machine (VM) replication to replicate VMs from the primary data center Hyper-V host servers to backup Hyper-V host servers in the backup data center. A VM named ABC-VM1 replicates from a Hyper-V host named

  ABC-HV01 to a Hyper-V host named ABC-HVBak1.

  A new company security policy states that the VM replication must be encrypted using SSL (Secure Sockets Layer).

  You ensure that all servers have the necessary Computer certificates then configure the Hyper-V settings on ABC-HVBak1 to require encryption.

  You need to ensure that the replication of ABC-VM1 is encrypted.

  What should you do?

  A. Do nothing. The replication will now be encrypted.
  B. Configure ABC-VM1 to use encryption.
  C. Configure ABC-HV01 to use encryption.
  D. Configure the virtual switch settings to use encryption.
  B. Configure ABC-VM1 to use encryption.

• Question 482:

  You have a dns server named server1 that runs Windows Server 2012 R2. You need to disable recursion on Server1. What are three possible ways to achieve the goal? Each correct answer presents a complete solution.

  A. Create a reverse lookup zone named 0.in-addr.arpa.
  B. Create a forward lookup zone named globalnames
  C. From dns manager, modify the advanced properties of server1
  D. From dns manager, modify the forwarders properties of server1
  E. Create a forward lookup zones named ""
  F. Run dnscmd.exe and specify the /config parameter
  C. From dns manager, modify the advanced properties of server1
  D. From dns manager, modify the forwarders properties of server1
  F. Run dnscmd.exe and specify the /config parameter

  ---

  References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff807391(v=ws.10)

• Question 483:

  Your network contains an Active Directory domain named contoso.com. The domain contains four servers. The servers are configured as shown in the following table.

  

  You plan to deploy an enterprise certification authority (CA) on a server named Servers. Server5 will be used to issue certificates to domain-joined computers and workgroup computers.

  You need to identify which server you must use as the certificate revocation list (CRL) distribution point for Server5.

  Which server should you identify?

  A. Server1
  B. Server3
  C. Server4
  D. Server2
  B. Server3

  ---

  CDP (and AD CS) always uses a Web Server

  NB: this CDP must be accessible from outside the AD, but here we don't have to wonder about that as there's only one web server.

  http://technet.microsoft.com/fr-fr/library/cc782183%28v=ws.10%29.aspx

  Selecting a CRL Distribution Point

  Because CRLs are valid only for a limited time, PKI clients need to retrieve a new CRL periodically. Windows

  Server 2003 PKI Applications look in the CRL distribution point extension for a URL that points to a network location from which the CRL object can be retrieved. Because CRLs for enterprise CAs are stored in Active Directory, they can be

  accessed by means of LDAP. In comparison, because CRLs for stand-alone CAs are stored in a directory on the server, they can be accessed by means of HTTP, FTP, and so on as long as the CA is online. Therefore, you should set the

  CRL distribution point after the CA has been installed.

  The system account writes the CRL to its distribution point, whether the CRL is published manually or is published according to an established schedule. Therefore you must ensure that the system accounts for CAs have permission to write

  to the CRL distribution point. Because the CRL path is also included in every certificate, you must define the CRL location and its access path before deploying certificates. If an Application performs revocation checking and a valid CRL is not

  available on the local computer, it rejects the certificate.

  You can modify the CRL distribution point by using the Certification Authority MMC snap-in. In this way, you can change the location where the CRL is published to meet the needs of users in your organization. You must move the CRL

  distribution point from the CA configuration folder to a Web server to change the location of the CRL, and you must move each new CRL to the new distribution point, or else the chain will break when the previous CRL expires.

  Note

  On root CAs, you must also modify the CRL distribution point in the CAPolicy.inf file so that the root CA certificate references the correct CDP and AIA paths, if specified. If you are using certificates on the Internet, you must have at least one

  HTTPs-accessible location for all certificates that are not limited to internal use.

  http://technet.microsoft.com/en-us/library/cc771079.aspx

  Configuring Certificate Revocation

  It is not always possible to contact a CA or other trusted server for information about the validity of a certificate. To effectively support certificate status checking, a client must be able to access revocation data to determine whether the

  certificate is valid or has been revoked. To support a variety of scenarios, Active Directory Certificate Services (AD CS) supports industry-standard methods of certificate revocation. These include publication of certificate revocation lists

  (CRLs) and delta CRLs, which can be made available to clients from a variety of locations, including Active Directory Domain Services (AD DS), Web servers, and network file shares.

• Question 484:

  Your network contains an Active Directory domain named contoso.com.

  The domain contains a domain controller named DC1 that runs Windows Server 2012.

  You have a Group Policy object (GPO) named GPO1 that contains several custom Administrative templates.

  You have the display for the settings of the GPO filter so that only settings are shown that are removed from the registry when the GPO is no longer in range of the computer or the user.

  Your solution must ensure that only settings are displayed that are either enabled or disabled and do not contain a comment.

  How should you configure the filter?

  To answer, select the appropriate options below. Choose three.

  

  

  A. Set Managed to: Yes
  B. Set Managed to: No
  C. Set Managed to: Any
  D. Set Configured to: Yes
  E. Set Configured to: No
  F. Set Configured to: Any
  G. Set Commented to: Yes
  H. Set Commented to: No
  I. Set Commented to: Any
  A. Set Managed to: Yes
  D. Set Configured to: Yes
  G. Set Commented to: Yes

  ---

  The question states that only configured settings should be displayed; using the "Any" selection for the "Configured" section would display settings with that "Not Configured" in addition to "Enabled" and Disabled".

  References: https://technet.microsoft.com/en-us/library/Dd759104.aspx

• Question 485:

  Your network contains an Active Directory domain named contoso.com. Network Access Protection (NAP) is deployed to the domain.

  You need to create NAP event trace log files on a client computer.

  What should you run?

  A. Register-EngineEvent
  B. Tracert
  C. Register-ObjectEvent
  D. Logman
  D. Logman

  ---

  Register-ObjectEvent: Monitor events generated from .Net Framework Object.

  Register-EngineEvent: Subscribes to events that are generated by the Windows PowerShell engine and by the New-Event cmdlet.

  http://technet.microsoft.com/en-us/library/hh849967.aspx

  tracert: Trace IP route

  logman: Manages and schedules performance counter and event trace log collections on a local and remote systems.

  http://technet.microsoft.com/en-us/library/bb490956.aspx

• Question 486:

  Your network contains an Active Directory domain named contoso.com. The domain contains a file server named Server1. The File Server Resource Manager role service is installed on Server1. All servers run Windows Server 2012 R2. A Group Policy object (GPO) named GPO1 is linked to the organizational unit (OU) that contains Server1. The following graphic shows the configured settings in GPO1.

  

  Server1 contains a folder named Folder1. Folder1 is shared as Share1.

  You attempt to configure access-denied assistance on Server1, but the Enable access-denied assistance option cannot be selected from File Server Resource Manager.

  You need to ensure that you can configure access-denied assistance on Server1 manually by using File Server Resource Manager.

  What should you do?

  A. Set the Customize message for Access Denied errors policy setting to Enabled for GPO1.
  B. Set the Enable access-denied assistance on client for all file types policy setting to Disabled for GPO1.
  C. Set the Enable access-denied assistance on client for all file types policy setting to Enabled for GPO1.
  D. Set the Customize message for Access Denied errors policy setting to Not Configured for GPO1.
  D. Set the Customize message for Access Denied errors policy setting to Not Configured for GPO1.

  ---

  Ensure that you can configure access-denied assistance

  References: http://technet.microsoft.com/en-us/library/hh831402.aspx#BKMK_1

• Question 487:

  Your network contains an Active Directory domain named contoso.com. The domain contains servers named Server1 and Server2 that run Windows Server 2012 R2. Server1 has the IP Address Management (IPAM) Server feature installed.

  You install the IPAM client on Server2.

  You open Server Manager on Server2 as shown in the exhibit. (Click the Exhibit button.)

  You need to manage IPAM from Server2.

  What should you do first?

  

  A. On Server2, open Computer Management and connect to Server1.
  B. On Server1, add the Server2 computer account to the IPAM ASM Administrators group.
  C. On Server2, add Server1 to Server Manager.
  D. On Server1, add the Server2 computer account to the IPAM MSM Administrators group.
  C. On Server2, add Server1 to Server Manager.

  ---

  In the exhibit, we can see that only one server is managed with Server Manager on Server2 (itself, as in a Server, Server Manager always contains at least the server itself):

  

  So we can be sure that Server1 is not added to Server2 ServerManager Console. so if we want to manage IPAM, we should add Server1 to Server2's Server Manager http://technet.microsoft.com/en-us/library/hh831622.aspx Step-by-Step: Configure IPAM to Manage Your IP Address Space IP Address Management (IPAM) in Windows Server?2012 is a framework for discovering, monitoring, managing and auditing IP address space on a corporate network. IPAM provides the following features: Automatic IP address infrastructure discovery Highly customizable IP address space display, reporting, and management Configuration change auditing for DHCP and IPAM services Monitoring and management of DHCP and DNS services IP address lease tracking [...] IPAM security groups The following local IPAM security groups are created when you install IPAM. IPAM Users: Members of this group can view all information in server discovery, IP address space, and server management. They can view IPAM and DHCP server operational events, but cannot view IP address tracking information. IPAM MSM Administrators: IPAM multi-server management (MSM) administrators have IPAM Users privileges and can perform IPAM common management tasks and server management tasks. IPAM ASM Administrators: IPAM address space management (ASM) administrators have IPAM Users privileges and can perform IPAM common management tasks and IP address space tasks. (that's a user group, not a computer group) IPAM IP Audit Administrators: Members of this group have IPAM Users privileges and can perform IPAM common management tasks and can view IP address tracking information. IPAM Administrators: IPAM Administrators have the privileges to view all IPAM data and perform all IPAM tasks. http://www.google.fr/url?sa=tandrct=jandq=andesrc=sandsource=webandcd=2andcad=rjaandved=0CDwQ FjABandurl=http%3A%2F%2Fdownload.microsoft.com%2Fdownload%2FF%2F6%2F9%2FF 69BE7E8-3E99-4A4A-B1898AFADABC6216% 2FUnderstand%2520and%2520Troubleshoot%2520IP%2520Address% 2520Management%2520(IPAM)%2520in%2520Windows%2520Server%25208%2520Beta . docxandei=5xXWUIzRAsaQhQeUz4GQCgandusg=AFQjCNGh5tHzxwcaU9vXDGmPUgtjfPvhn wandbvm=bv.1355534169,d.d2k (download.microsoft.com) Understand and Troubleshoot IP Address Management (IPAM) in Windows Server 8 Beta If you are accessing the IPAM server remotely using ServerManager IPAM client RSAT, then you must be a member of the WinRMRemoteWMIUsers group on the IPAM server, in addition to being a member of the appropriate IPAM security group (or local Administrators group). Installation Process ?IPAM Client Although the IPAM client feature is automatically installed on a Windows Server "8 " Beta server, along with installation of the IPAM Server feature, this component can also be installed or uninstalled on its own. Click through the Add roles and features wizard screens to select Role or Feature Based Install and the target server. On the Select Features screen, select Remote Server Administration Tools -> Feature Administration Tools -> IP Address Management (IPAM) Client. Click Add Features when prompted. In order for the IPAM client to connect to an IPAM server, you must ensure that the target IPAM server is added to the Server Manager purview using the Add Servers wizard launched from the Manage menu. If both IPAM client and IPAM server are running on the same server, then by default the IPAM UI connects to the local IPAM server instance.

  

• Question 488:

  A user has locked his account (again!) and you need to unlock it so they can continue working normally. Which of the following is a possible way to unlock a User Account? (Choose three)

  A. Command Line
  B. None of these
  C. Windows PowerShell
  D. VBScript
  A. Command Line
  C. Windows PowerShell
  D. VBScript

  ---

  All 3 of these can be used to unlock accounts.

• Question 489:

  Your network contains an Active Directory forest named contoso.com.

  The forest contains two domains named contoso.com and childl.contoso.com.

  The domains contain three domain controllers.

  The domain controllers are configured as shown in the following table.

  

  You need to ensure that the KDC support for claims, compound authentication, and Kerberos armoring setting is enforced in both domains.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Raise the domain functional level of contoso.com.
  B. Raise the domain functional level ofchildl.contoso.com
  C. Raise the forest functional level of contoso.com
  D. Upgrade DC11 to Windows Server 2012 R2
  E. Upgrade DC1 to Windows Server 2012 R2
  A. Raise the domain functional level of contoso.com.
  E. Upgrade DC1 to Windows Server 2012 R2

  ---

  The root domain in the forest must be at Windows Server 2012 level. First upgrade DC1 to this level, then raise the contoso.com domain functional level to Windows Server 2012.

• Question 490:

  HOTSPOT

  You have a file server named Server1 that runs Windows Server 2012 R2.

  Server1 contains a file share that must be accessed by only a limited number of users.

  You need to ensure that if an unauthorized user attempts to access the file share, a custom access-denied message appears, which contains a link to request access to the share. The message must not appear when the unauthorized user

  attempts to access other shares.

  Which two nodes should you configure in File Server Resource Manager? To answer, select the appropriate two nodes in the answer area.

  Hot Area: