Microsoft 70-417 Online Practice Questions and Exam Preparation

Microsoft 70-417 Online Questions & Answers

• Question 671:

  You have a server named Server1.

  You install the IP Address Management (IPAM) Server feature on Server1.

  You need to provide a user named User1 with the ability to set the access scope of all the DHCP servers that are managed by IPAM. The solution must use the principle of least privilege.

  Which user role should you assign to User1?

  A. IP Address Record Administrator Role
  B. IPAM Administrator Role
  C. IPAM MSM Administrator Role
  D. IPAM DHCP Scope Administrator Role
  C. IPAM MSM Administrator Role

  ---

  The IPAM MSM administrator completely manages DHCP and DNS servers.

  References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn268500(v=ws.11)

• Question 672:

  Note: This Question is part of series of question that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in the series. Information and detailed provided in a question apply only to that question.

  You network contains one Active Directory domain named contoso.com. The forest functional level is Windows Server 2012. All servers run Windows Server 2012 R2. All client computer run Windows 8.1. The domain contains 10 domain controllers and a read-only domain controller (RODC) named RODC01. All domain controllers and RODCs are hosted on a Hyper-V host that runs Windows Server 2012 R2. You need to identify whose passwords can be stored, view stored passwords.

  Which cmdlet should you use?

  A. Get-ADGroupMember
  B. Get-ADDomainControllerPasswordReplicationPolicy
  C. Get-ADDomainControllerPasswordReplicationPolicyUsage
  D. Get-ADDomain
  E. Get-ADOptionalFeature
  F. Get-ADAccountAuthorizationGroup
  G. Get-ADAuthenticationPolicySlio
  H. Get-ADAuthenticationPolicy
  C. Get-ADDomainControllerPasswordReplicationPolicyUsage

  ---

  The Get-ADDomainControllerPasswordReplicationPolicyUsage gets the user or computer accounts that are authenticated by a read-onlydomain controller (RODC) or that have passwords that are stored on that RODC. References: https://technet.microsoft.com/es-es/library/hh852193(v=wps.620).aspx

• Question 673:

  HOTSPOT

  Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. All domain controllers run Windows Server 2012 R2 and are configured as DNS servers. All DNS zones are Active Directory-

  integrated. Active Directory Recycle Bin is enabled.

  You need to modify the amount of time deleted objects are retained in the Active Directory Recycle Bin.

  Which naming context should you use?

  To answer, select the appropriate naming context in the answer area.

  Hot Area:

  

  

  ---

  Starting in Windows Server 2008 R2, Active Directory now implements a true recycle bin. No longer will you need an authoritative restore to recover deleted users, groups, OU's, or other objects. Instead, it is now possible to use PowerShell commands to bring back objects with all their attributes, backlinks, group memberships, and metadata.

  The amount of time that an object can be recovered is controlled by the Deleted Object Lifetime (DOL). This time range can be set on the msDS-deletedObjectLifetime attribute. By default, it will be the same number of days as the Tombstone Lifetime (TSL). The TSL set for a new forest since Windows Server 2003 SP1 has been 180 days*, and since by default DOL = TSL, the default number of days that an object can be restored is therefore 180 days. If tombstoneLifetime is NOT SET or NULL, the tombstone lifetime is that of the Windows default: 60 days. This is all configurable by the administrator.

  Set-ADObject -Identity "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=contoso,DC=com" -Partition "CN=Configuration,DC=contoso,DC=com" -Replace: @("msDS-DeletedObjectLifetime" = 365)

  msDS-deletedObjectLifetime

  New to Windows Server 2008 R2

  Is set on the “CN=Directory Service,CN=Windows NT, CN=Services,CN=Configuration, DC=COMPANY,DC=COM” container

  Describes how long a deleted object will be restorable

  To modify the deleted object lifetime by using Ldp.exe

  To open Ldp.exe, click Start, click Run, and then type ldp.exe.

  To connect and bind to the server hosting the forest root domain of your Active Directory environment, under Connections, click Connect, and then click Bind.

  In the console tree, right-click the CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration container, and then click Modify.

  In the Modify dialog box, in Edit Entry Attribute, type msDS-DeletedObjectLifeTime.

  In the Modify dialog box, in Values, type the number of days that you want to set for the tombstone lifetime value. (The minimum is 3 days.)

  In the Modify dialog box, under Operation click Replace, click Enter, and then click Run.

  http://technet.microsoft.com/en-us/library/dd392260%28v=ws.10%29.aspx

  http://blogs.technet.com/b/askds/archive/2009/08/27/the-ad-recycle-bin-understanding-implementing-best-practices-and-troubleshooting.aspx

• Question 674:

  You have a server named Server1 that runs Windows Server 2012 R2.

  Server1 has three physical network adapters named NIC1, NIC2, and NIC3.

  On Server1, you create a NIC team named Team1 by using NIC1 and NIC2. You configure Team1 to accept network traffic on VLAN 10.

  You need to ensure that Server1 can accept network traffic on VLAN 10 and VLAN 11. The solution must ensure that the network traffic can be received on both VLANs if a network adapter fails.

  What should you do?

  A. Run the Set-NetLbfoTeamWindows PowerShell cmdlet.
  B. Run the Add-NetLbfoTeamMemberWindows PowerShell cmdlet.
  C. Run the Add-NetLbfoTeamNicWindows PowerShell cmdlet.
  D. From Server Manager, add NIC3 to TEAM1.
  C. Run the Add-NetLbfoTeamNicWindows PowerShell cmdlet.

  ---

  The Add-NetLbfoTeamNic cmdlet adds a new team interface to the specified NIC team. You can use this cmdlet to add the interfaces to the specified team by specifying the respective VLAN IDs.

• Question 675:

  You have a server named Server1 that runs Windows Server 2012 R2. From Server Manager, you install the Active Directory Certificate Services server role on Server1. A domain administrator named Admin1 logs on to Server1. When Admin1 runs the Certification Authority console, Admin1 receive the following error message.

  

  You need to ensure that when Admin1 opens the Certification Authority console on Server1, the error message does not appear. What should you do?

  A. Install the Active Directory Certificate Services (AD CS) tools
  B. Configure the Active Directory Certificate Services server role from Server Manager
  C. Run the regsvr32.exe command
  D. Modify the PATH system variable
  B. Configure the Active Directory Certificate Services server role from Server Manager

  ---

  The error message is related to missing role configuration.

• Question 676:

  Your network contains an Active Directory domain named contoso.com. The Active Directory Recycle bin is enabled for contoso.com.

  A support technician accidentally deletes a user account named User1.

  You need to restore the User1 account.

  Which tool should you use?

  A. Ldp
  B. Esentutl
  C. Active Directory Administrative Center
  D. Ntdsutil
  C. Active Directory Administrative Center

  ---

  http://technet.microsoft.com/nl-nl/library/dd379509(v=ws.10).aspx#BKMK_2 http://technet.microsoft.com/en-us/magazine/2007.09.tombstones.aspx http://technet.microsoft.com/en-us/library/hh875546.aspx http://technet.microsoft.com/en-us/library/dd560651(v=ws.10).aspx

• Question 677:

  Your role of Network Administrator at ABC.com includes the management of the Active Directory Domain Services (AD DS) domain named ABC.com. The network includes servers that run Windows Server 2012.

  The network includes virtual machines (VMs) running on Windows Server 2012 Hyper-V host servers.

  You plan to configure Hyper-V replication on some of the VMs. You need to install the Hyper-V Replica Broker role on some host servers to enable Hyper-V replication.

  In which of the following scenarios is the Hyper-V Replica Broker role required? (Choose all that apply)

  A. When both the primary and replica VMs are hosted on single Hyper-V host servers.
  B. When the primary VM is hosted on a single Hyper-V host server and the replica VM is hosted on a Hyper-V host server that is a member of a failover cluster.
  C. When the primary VM is hosted on a Hyper-V host server that is a member of a failover cluster and the replica VM is hosted on a single Hyper-V host server.
  D. When both the primary and replica VMs are hosted on Hyper-V host servers that are members of failover clusters.
  B. When the primary VM is hosted on a single Hyper-V host server and the replica VM is hosted on a Hyper-V host server that is a member of a failover cluster.
  D. When both the primary and replica VMs are hosted on Hyper-V host servers that are members of failover clusters.

• Question 678:

  HOTSPOT

  Your network contains an Active Directory domain named contoso.com.

  You have a Dynamic Access Control policy named Policy1.

  You create a new Central Access Rule named Rule1.

  You need to add Rule1 to Policy1.

  What command should you run?

  To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

• Question 679:

  You have a Hyper-V host named Server1 that runs Windows Server 2012 R2. Server1 has the virtual switches listed in the following table.

  

  You create a virtual machine named VM1. VM1 has two network adapters. One network adapter connects to vSwitch1. The other network adapter connects to vSwitch2. You configure NIC teaming on VM1.

  You need to ensure that if a physical NIC fails on Server1, VM1 remains connected to the network.

  What should you do on Server1?

  A. Run the Set-VmNetworkAdaptercmdlet.
  B. Add a new network adapter to VM1.
  C. Create a new virtual switch on Server 1.
  D. Modify the properties of vSwitch1 and vSwitch2.
  A. Run the Set-VmNetworkAdaptercmdlet.

• Question 680:

  Your network contains an Active Directory domain named contoso.com. The domain contains a file server named Server1. On Server1 the operating system Windows Server 2012 R2 is installed. Check the RSoP of Server1. The effective settings are shown in the picture (click on the button drawing). You must ensure that an entry is recorded in the event log when it is on Server1 created or deleted a local user account.

  How do you proceed?

  

  You need to ensure that an entry is added to the event log whenever a local user account is created or deleted on Server1.

  What should you do?

  A. Change the settings of the audit policy in Group Policy Object (GPO) ServersGPO
  B. On Server1, attach a task to the security log.
  C. Add the System log on Server1 a task.
  D. Change the settings of the Advanced Audit Policy Configuration in Group Policy Object (GPO) ServersGPO
  A. Change the settings of the audit policy in Group Policy Object (GPO) ServersGPO

  ---

  From the figure it is evident that the policy Audit account management is enabled only for failed attempts. Must be monitored in order to monitor the creation and deletion of accounts also successful attempts of account management. Audit

  account management is determined whether all Account Management events are monitored on a computer with this security setting.

  The account management events include:

  A user account or user group is created, changed or deleted.

  

  A user account is renamed, disabled or enabled.

  

  A password is set or changed.

  

  If you define this policy setting, you can specify whether success or failure can be monitored and specify that the event type is not monitored. Success audits generate an audit entry is generated when any account management event succeeds. Failure audits generate an audit entry is generated when any account management event fails. If you "No monitoring" want to set this value to, activate the dialog "Properties" for this policy setting check box "Define these policy settings" and uncheck the checkbox "success" and "failure". When you use Advanced Audit Policy Configuration settings, you need to confirm that these settings are not overwritten by basic audit policy settings. The following procedure shows how to prevent conflicts by blocking the application of any basic audit policy settings. Enabling Advanced Audit Policy ConfigurationBasic and advanced audit policy configurations should not be mixed. As such, it's best practice to enable Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings in Group Policy to make sure that basic auditing is disabled. The setting can be found under Computer Configuration\Policies\Security Settings\Local Policies\Security Options, and sets the SCENoApplyLegacyAuditPolicy registry key to prevent basic auditing being applied using Group Policy and the Local Security Policy MMC snap-in. In Windows 7 and Windows Server 2008 R2, the number of audit settings for which success and failure can be tracked has increased to 53. Previously, there were nine basic auditing settings under Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy. These 53 new settings allow you to select only the behaviors that you want to monitor and exclude audit results for behaviors that are of little or no concern to you, or behaviors that create an excessive number of log entries. In addition, because Windows 7 and Windows Server 2008 R2 security audit policy can be applied by using domain Group Policy, audit policy settings can be modified, tested, and deployed to selected users and groups with relative simplicity. Audit Policy settings -Any changes to user account and resource permissions. -Any failed attempts for user logon. -Any failed attempts for resource access. -Any modification to the system files. Advanced Audit Configuration Settings Audit compliance with important business-related and security-related rules by tracking precisely defined activities, such as: A group administrator has modified settings or data on servers that contain finance information. An employee within a defined group has accessed an important file. The correct system access control list (SACL) is applied to every file and folder or registry key on a computer or file share as a verifiable safeguard against undetected access. In Servers GPO, modify the Audit Policy settings -enabling audit account management setting will generate events about account creation, deletion and so on. Advanced Audit Configuration Settings Advanced Audit Configuration Settings >Audit Policy -> Account Management -> Audit User Account Management

  

  In Servers GPO, modify the Audit Policy settings -enabling audit account management setting will generate events about account creation, deletion and so on

  

  References: http://blogs.technet.com/b/abizerh/archive/2010/05/27/tracing-down-user-and-computer-account-deletion-in-active-directory.aspx http://technet.microsoft.com/en-us/library/dd772623%28v=ws.10%29.aspx http://technet.microsoft.com/en-us/library/dd408940%28v=ws.10%29.aspx#BKMK_step2 http://technet.microsoft.com/en-us/library/jj852202(v=ws.10).aspx http://www.petri.co.il/enable-advanced-audit-policy-configuration-windows-server.htm