Microsoft 70-417 Online Practice Questions and Exam Preparation

Microsoft 70-417 Online Questions & Answers

• Question 641:

  Your network contains an Active Directory domain named contoso.com. All user accounts reside in an organizational unit (OU) named OU1.

  You create a Group Policy object (GPO) named GPO1.

  You link GPO1 to OU1.

  You configure the Group Policy preference of GPO1 to add a shortcut named Link1 to the desktop of each user.

  You discover that when a user deletes Link1, the shortcut is removed permanently from the desktop.

  You need to ensure that if a user deletes Link1, the shortcut is added to the desktop again.

  What should you do?

  A. Modify the Link1 shortcut preference of GPO1
  B. Enable loopback processing in GPO1
  C. Enforce GPO1
  D. Modify the Security Filtering settings of GPO1
  A. Modify the Link1 shortcut preference of GPO1

• Question 642:

  Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. All domain controllers run Windows Server 2012 R2. The domain contains two domain controllers. The domain controllers are configured as shown in the following table.

  

  Active Directory Recycle Bin is enabled.

  You discover that a support technician accidentally removed 100 users from an Active Directory group named Group1 an hour ago.

  You need to restore the membership of Group1.

  What should you do?

  A. Perform an authoritative restore.
  B. Perform a non-authoritative restore.
  C. Recover the items by using Active Directory Recycle Bin.
  D. Apply a virtual machine snapshot to VM1.
  A. Perform an authoritative restore.

  ---

  Authoritative restore allows the administrator to recover a domain controller, restore it to a specific point intime, and mark objects in Active Directory as being authoritative with respect to their replication partners. For example, you might need to perform an authoritative restore if an administrator inadvertently deletes an organizational unit containing a large number of users. If you restore the server from tape, the normal replication process would not restore the inadvertently deleted organizational unit. Authoritative restore allows you to mark the organizational unit as authoritative and force the replication process to restore it to all of the other domain controllers in the domain. Incorrect: Not C: A non authoritative restore returns the domain controller to its state at the time of backup and then allows normal replication to overwrite that state with any changes that occurred after the backup was taken. After you restore the system state, the domain controller queries its replication partners. The replication partners replicate any changes to the restored domain controller, ensuring that the domain controller has an accurate and updated copy of the Active Directory database.

• Question 643:

  You have five servers that run Windows Server 2012 R2. The servers have the Failover Clustering feature installed. You deploy a new cluster named Cluster1. Cluster1 is configured as shown in the following table.

  

  Server1, Server2/ and Server3 are configured as the preferred owners of the cluster roles. Dynamic quorum management is disabled.

  You plan to perform hardware maintenance on Server3.

  You need to ensure that if the WAN link between Site1 and Site2 fails while you are performing maintenance on Server3, the cluster resource will remain available in Site1.

  What should you do?

  A. Remove the node vote for Server3.
  B. Enable DrainOnShutdown on Cluster1.
  C. Add a file share witness in Site1.
  D. Remove the node vote for Server4 and Server5.
  D. Remove the node vote for Server4 and Server5.

  ---

  Exclude secondary site nodes.

  In general, do not give votes to WSFC (Windows Server Failover Clustering) nodes that reside at a secondary disaster recovery site. You do not want nodes in the secondary site to contribute to a decision to take the cluster offline when there

  is nothing wrong with the primary site.

• Question 644:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2008 R2. One of the domain controllers is named DC1.

  The network contains a member server named Server1 that runs Windows Server 2012 R2.

  You need to promote Server1 to a domain controller by using install from media (IFM).

  What should you do first?

  A. Run the Active Directory Domain Services Installation Wizard on DC1.
  B. Upgrade DC1 to Windows Server 2012 R2.
  C. Run the Active Directory Domain Services Configuration Wizard on Server1.
  D. Create a system state backup of DC1.
  E. Create IFM media on DC1.
  B. Upgrade DC1 to Windows Server 2012 R2.

  ---

  This is the only valid option. You could install ADDS role on Server 1 and run ADDS configuration wizard and add DC to existing domain.

• Question 645:

  DRAG DROP

  Your network contains an Active Directory domain named contoso.com. The domain contains two DHCP servers named DHCP1 and DHCP2 that run Windows Server 2012.

  You install the IP Address Management (IPAM) Server feature on a member server named Server1 and you run the Run Invoke-IpamGpoProvisioningcmdlet.

  You need to manage the DHCP servers by using IPAM on Server1.

  Which three actions should you perform?

  To answer, move the three appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 646:

  You have a DNS server that runs Windows Server 2012 R2. The server hosts the zone for contoso.com and is accessible from the internet. You need to create a DNS record for the Sender Policy Framework (SPF) to list that are authorized ti send email for contoso.com

  Which type of record should you create?

  A. Name Server (NS)
  B. Mail.exchanger (MX)
  C. Resource record signature (RRSIG)
  D. Text (TXT)
  D. Text (TXT)

  ---

  References: http://mediatemple.net/community/products/dv/204404314/how-can-i-create-an-spf-record-for-my-domain http://en.wikipedia.org/wiki/Sender_Policy_Framework

• Question 647:

  Your role of Network Administrator at ABC.com includes the management of the Active Directory Domain Services (AD DS) domain named ABC.com. The network includes servers that run Windows Server 2012.

  A Windows Server 2012 server named ABC-NPS1 and is configured as a Network Policy Server (NPS) server. ABC-NPS1 also runs the DHCP server role and has a DHCP scope for local subnet. You need to ensure that Network Access

  Protection (NAP) health requirement checks are performed on only the computers that send a Statement of Health (SoH). You configure a health policy to define the computer health requirements.

  How can you ensure that only the computers that send an SoH are checked?

  A. By configuring Connection Properties conditions.
  B. By configuring NAS Port Type constraints.
  C. By configuring MS-Service Class conditions.
  D. By configuring NAP-Capable Computers conditions
  D. By configuring NAP-Capable Computers conditions

• Question 648:

  Your network contains an Active Directory domain named contoso.com. The domain contains two member servers named Server1 and Server2. All servers run Windows Server 2012 R2.

  Server1 and Server2 have the Network Load Balancing (NLB) feature installed. The servers are configured as nodes in an NLB cluster named Cluster1. Cluster1 hosts a secure web Application named WebApp1. WebApp1 saves user state information locally on each node.

  You need to ensure that when users connect to WebApp1, their session state is maintained.

  What should you configure?

  A. Affinity None
  B. Affinity Single
  C. The cluster quorum settings
  D. The failover settings
  E. A file server for general use
  F. The Handling priority
  G. The host priority
  H. Live migration
  I. The possible owner
  J. The preferred owner
  B. Affinity Single

  ---

  Even though Network Load Balancing (NLB) hasn't changed significantly since Windows Server 2008 and isn't mentioned in this chapter, be sure to review the feature and its configurable options. For example, remember that in port rules for Network Load Balancing clusters, the Affinity setting determines how you want multiple connections from the same client handled by the NLB cluster. "Affinity: Single" redirects clients back to the same cluster host. "Affinity: Network" redirects clients from the local subnet to the cluster host. "Affinity: None" doesn't redirect multiple connections from the same client back to the same cluster host. http://technet.microsoft.com/en-us/library/bb687542.aspx Using NLB Client Affinity NLB offers three types of client affinity to minimize response time to clients and provide generic support for preserving session state. Each affinity specifies a different method for distributing client requests. In Application Center, the New Cluster Wizard sets affinity to Single by default. Later, you can use the cluster Properties dialog box to modify the affinity. The following table describes the three types of affinity.

  

  No Affinity With No affinity, NLB does not associate clients with a particular member. Every client request can be load balanced to any member. This affinity provides the best performance but might disrupt clients with established sessions, because subsequent requests might be load balanced to other members where the session information does not exist. Single Affinity In Single affinity, NLB associates clients with particular members by using the client's IP address. Thus, requests coming from the same client IP address always reach the same member. This affinity provides the best support for clients that use sessions on an intranet. These clients cannot use No affinity because their sessions could be disrupted. Additionally, these clients cannot use Class C affinity because intranet clients typically have IP addresses within a narrow range. It is likely that this range is so narrow that all clients on an intranet have the same Class C address, which means that one member might process all of the requests while other members remain idle. Class C Affinity With Class C affinity, NLB associates clients with particular members by using the Class C portion of the client's IP address. Thus, clients coming from the same Class C address range always access the same member. This affinity provides the best performance for clusters serving the Internet. Bb687542.note(en- us, TechNet.10).gif Note It is not efficient for Internet clients to use Single affinity because, in Single affinity, NLB load balances each client by the client's entire IP address, which can span a broad range. By using Class C affinity, NLB associates clients with only the same Class C portion of the IP address with particular members. Therefore, you essentially reduce the range of IP addresses by which NLB load balances clients.

• Question 649:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1. On DC1, you add a new volume and you stop the Active Directory Domain Services (AD DS) service.

  You run ntdsutil.exe and you set NTDS as the active instance.

  You need to move the Active Directory database to the new volume.

  Which Ntdsutil context should you use?

  A. Files
  B. IFM
  C. Configurable Settings
  D. Partition management
  A. Files

  ---

  How to Move the Database.

  You can move the Ntds.dit data file to a new folder. If you do so, the registry is updated so that Directory Service uses the new location when you restart the server. To move the data file to another folder, follow these steps:

  1.

  Click Start, click Run, type ntdsutil in the Open box, and then press ENTER.

  2.

  At the Ntdsutil command prompt, type files, and then press ENTER.

  3.

  At the file maintenance command prompt, type move DB to new location (where new location is an existing folder that you have created for this purpose), and then press ENTER.

  4.

  To quit Ntdsutil, type quit and then press ENTER.

  5.

  Restart the computer.

  References: http://support.microsoft.com/kb/816120

• Question 650:

  HOTSPOT

  You have a server named Server1 that has the Network Policy and Access Services server role installed.

  You plan to configure Network Policy Server (NPS) on Server1 to use certificate-based authentication for VPN connections.

  You obtain a certificate for NPS.

  You need to ensure that NPS can perform certificate-based authentication.

  To which store should you import the certificate?

  To answer, select the appropriate store in the answer area.

  Hot Area:

  

  

  ---

  When organizations deploy their own public key infrastructure (PKI) and install a private trusted root CA, their CA automatically sends its certificate to all domain member computers in the organization. The domain member client and server computers store the CA certificate in the Trusted Root Certification Authorities certificate store. After this occurs, the domain member computers trust certificates that are issued by the organization trusted root CA.

  For example, if you install AD CS, the CA sends its certificate to the domain member computers in your organization and they store the CA certificate in the Trusted Root Certification Authorities certificate store on the local computer. If you also configure and autoenroll a server certificate for your NPS servers and then deploy PEAP-MS-CHAP v2 for wireless connections, all domain member wireless client computers can successfully authenticate your NPS servers using the NPS server certificate because they trust the CA that issued the NPS server certificate.

  On computers that are running the Windows operating system, certificates that are installed on the computer are kept in a storage area called the certificate store. The certificate store is accessible using the Certificates Microsoft Management Console (MMC) snap-in.

  This store contains multiple folders, where certificates of different types are stored. For example, the certificate store contains a Trusted Root Certification Authorities folder where the certificates from all trusted root CAs are kept.

  When your organization deploys a PKI and installs a private trusted root CA using AD CS, the CA automatically sends its certificate to all domain member computers in the organization. The domain member client and server computers store the CA certificate in the Trusted Root Certification Authorities folder in the Current User and the Local Computer certificate stores. After this occurs, the domain member computers trust certificates that are issued by the trusted root CA.

  Similarly, when you autoenroll computer certificates to domain member client computers, the certificate is kept in the Personal certificate store for the Local Computer. When you autoenroll certificates to users, the user certificate is kept in the Personal certificate store for the Current User. http://technet.microsoft.com/en-us/library/cc730811.aspx

  http://technet.microsoft.com/en-us/library/cc730811.aspx

  http://technet.microsoft.com/en-us/library/cc772401%28v=ws.10%29.aspx

  http://technet.microsoft.com/en-us/library/ee407543%28v=ws.10%29.aspx