Microsoft 70-417 Online Practice Questions and Exam Preparation

Microsoft 70-417 Online Questions & Answers

• Question 61:

  DRAG DROP

  You have a Hyper-V host named Host1.Host1 contains two virtual machines named VM1 and VM2.VM1 is configured as a print server.VM1 runs Windows Server 2008 R2.VM2 is configured as a file server.VM2 runs Windows Server 2012 R2.

  You need to migrate all of the printers on VM1 to VM2. Which actions should you perform on the virtual machines?

  To answer, drag the appropriate action to the correct servers in the answer area. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  Select and Place:

  

  

  ---

  Note:

  On VM1 we export the printers. On VM2 we first install the Print and Document Services role, and then import the printers.

  You must install the Print and Document Services role on the destination server before you begin the migration process.

• Question 62:

  You have a VHD that contains an image of Windows Server 2012 R2. You plan to Apply updates to the image.

  You need to ensure that only updates that can install without requiring a restart are installed.

  Which DISM option should you use?

  A. /Apply-Unattend
  B. /Add-ProvisionedAppxPackage
  C. /PreventPending
  D. /Cleanup-Image
  C. /PreventPending

  ---

  Use the /PreventPending option to skip the installation of the package if the package or Windows image has pending online actions.

  References: http://technet.microsoft.com/en-us/library/hh825265.aspx

• Question 63:

  Your role of Network Administrator at ABC.com includes the management of the Active Directory Domain Services (AD DS) domain named ABC.com. The network includes servers that run Windows Server 2012.

  The network includes four Windows Server 2012 servers configured as nodes in a single failover clustering cluster named ABC-CL01.

  You configure a custom line-of-business application (LOB) as a clustered resource on ABC-CL01. You need to identify the number of consecutive missed heartbeats required to initiate a failover.

  What number should you identify?

  A. 1
  B. 2
  C. 5
  D. 10
  C. 5

  ---

  References: https://blogs.msdn.microsoft.com/clustering/2012/11/21/tuning-failover-cluster-network-thresholds/

• Question 64:

  Your network contains an Active Directory domain named contoso.com. The domain contains a read-only domain controller (RODC) named RODC1.

  You create a global group named RODC_Admins.

  You need to provide the members of RODC_Admins with the ability to manage the hardware and the software on RODC1. The solution must not provide RODC_Admins with the ability to manage Active Directory objects.

  What should you do?

  A. From Active Directory Users and Computers, configure the Managed By settings of the RODC1 account.
  B. From Windows PowerShell, run the Set-ADAccountControl cmdlet.
  C. From a command prompt, run the dsadd computer command.
  D. From Active Directory Sites and Services, run the Delegation of Control Wizard.
  A. From Active Directory Users and Computers, configure the Managed By settings of the RODC1 account.

• Question 65:

  Your role of Network Administrator at ABC.com includes the management of the Active Directory Domain Services (AD DS) domain named ABC.com. The network includes servers that run Windows Server 2008 R2 Service Pack 1 (SP1) and

  Windows Server 2012. A Windows Server 2012 Web server is named ABC-Web1. ABC-Web1 hosts a company Intranet site with the URL: http://intranet.ABC.com.

  You want to configure the Intranet site to use HTTPS. You purchase an SSL certificate for intranet.ABC.com. You run the import certificate wizard and select the option to specify which certificate store to import the certificate into.

  You need the certificate to be selectable in the bindings of the Intranet site in IIS Manager. Which certificate store should you import the SSL certificate into?

  A. Certificates (Local Computer) \ Personal
  B. Certificates (Local Computer) \ Trusted Root Certification Authorities.
  C. Certificates (Local Computer) \ Trusted Publishers
  D. Certificates (Local Computer) \ Trusted People
  E. Certificates (Local Computer) \ TrustedDevices
  F. Certificates (Local Computer) \ Web Hosting
  A. Certificates (Local Computer) \ Personal

• Question 66:

  Your network contains two DNS servers named DNS1 and DNS2 that run Windows Server 2012 R2. DNS1 has a primary zone named contoso.com. DNS2 has a secondary copy of the contoso.com zone.

  You need to log the zone transfer packets sent between DNS1 and DNS2. What should you configure?

  A. debug logging from DNS Manager
  B. logging from Windows Firewall with Advanced Security
  C. monitoring from DNS Manager
  D. a Data Collector Set (DCS) from Performance Monitor
  C. monitoring from DNS Manager

  ---

  Monitoring DNS with the DNS Console

  The DNS management console includes functionality that enables you to use the console to monitor DNS activity:

  *Event Logging tab: You can access the Event Logging tab located within the Properties dialog box of the DNS server to specify the DNS events that you want to monitor. Through the Event Logging tab, you can limit the events which are

  written to the DNS Events log.

  *Monitoring tab: The Monitoring tab is also located within the Properties dialog box of the DNS server. This tab allows you to test querying of the DNS server.

  References:

• Question 67:

  Your network contains an Active Directory domain named contoso.com. The domain contains a member server named HVServer1. HVServer1 runs Windows Server 2012 R2 and has the Hyper-V server role installed.

  HVServer1 hosts 10 generation 1 virtual machines. All of the virtual machines connect to a virtual switch named Switch1. Switch1 is configured as a private network. All of the virtual machines have the DHCP guard and the router guard

  settings enabled.

  You install the DHCP server role on a virtual machine named Server1. You authorize Server1 as a DHCP server in contoso.com. You create an IP scope.

  You discover that the virtual machines connected to Switch1 do not receive IP settings from Server1.

  You need to ensure that the virtual machines can use Server1 as a DHCP server.

  What should you do?

  A. Enable MAC address spoofing on Server1.
  B. Enable single-root I/O visualization (SR-IOV) on Server1.
  C. Disable the DHCP guard on Server1.
  D. Disable the DHCP guard on all of the virtual machines that are DHCP clients.
  C. Disable the DHCP guard on Server1.

  ---

  DHCP guard setting This setting stops the virtual machine from making DHCP offers over this network interface. To be clear ?this does not affect the ability to receive a DHCP offer (i.e. if you need to use DHCP to acquire an IP address that will work) it only blocks the ability for the virtual machine to act as a DHCP server.

• Question 68:

  You have a server named Server1 that runs a full installation of Windows Server 2012. You need to uninstall the graphical user interface (GUI) on Server1. You must achieve this goal by using the minimum amount of administrative effort. What should you do?

  A. From Server Manager, uninstall the User Interfaces and Infrastructure feature.
  B. From Windows PowerShell, run Uninstall-WindowsFeature PowerShell-ISE.
  C. From Windows PowerShell, run Uninstall-WindowsFeature Desktop-Experience.
  D. Reinstall Windows Server 2012on the server.
  A. From Server Manager, uninstall the User Interfaces and Infrastructure feature.

• Question 69:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1 and a member server named Server1. Server1 has the IP Address Management (IPAM) Server feature installed.

  On DC1, you configure Windows Firewall to allow all of the necessary inbound ports for IPAM.

  On Server1, you open Server Manager as shown in the exhibit. (Click the Exhibit button.)

  

  You need to ensure that you can use IPAM on Server1 to manage DNS on DC1. What should you do?

  A. Add Server1 to the Remote Management Users group.
  B. Modify the outbound firewall rules on Server1.
  C. Add Server1 to the Event Log Readers group.
  D. Modify the inbound firewall rules on Server1.
  C. Add Server1 to the Event Log Readers group.

  ---

  

  The exhibit shows (in the details tab) that firewall rules are OK for DNS management (DNS RPC Access Status Unblocked) But it shows too that Event log Access Status is blocked (which by the way blocks the IPAM Access Status) => We should solve this by adding the Server1 computer account to the Event Log Readers group Understand and Troubleshoot IP Address Management (IPAM) in Windows Server 8 Beta (download.microsoft.com) IPAM Access Monitoring

  

  IPAM Access Settings

  

  Manual provisioning For manual provisioning, ensure that the required access settings are appropriately configured on the target server manually. Verify Access Verify that IPAM access status is listed as unblocked indicating that manual or GPO based provisioning is successfully complete. For the IPAM access status value to be allowed, all of the access sub-states shown in the details pane should be marked as allowed. These access states are: DNS RPC access status DHCP RPC access status Event log access status DHCP audit share access status [...] Troubleshooting Access Issues If any of the access sub-states for managed server roles is showing in the Blocked state, check that the corresponding setting is enabled on the target server. For details of access setting to sub-state mapping refer to the IPAM Access Monitoring section in this guide. For GPO based provisioning, the GPResult command line tool can be used to troubleshoot group policy update issues. The provisioning task setup by IPAM DHCP and DNS GPOs creates a troubleshooting log in the location%windir%\temp named IpamDhcpLog.txt and IpamDnsLog.txt respectively. http://social.technet.microsoft.com/Forums/en-US/winserver8gen/thread/c882c077 -61bd45f6-ab47-735bd728d3bc/ IPAM -Unblock access to a DC? The process to manually (not GPO based) unblock a DNS/DC server is:

  1.

  Enable DNS RPC access by enabling the following inbound Firewall rules:

  a) DNS Service (RPC)

  b) DNS Service (RPC Endpoint Mapper)

  2.

  Enable remote management access by enabling the following inbound Firewall rules:

  a) Remote

  b) Service Management (RPC)

  b) Remote Service Management (RPC-EPMAP)

  3.

  Enable Remote Event Log Management RPC access by enabling the following inbound

  Firewall rules:

  a) Remote Event Log Management (RPC)

  b) Remote Event Log Management (RPC-EPMAP)

  4.

  Add the IPAM machine acct to the Event Log Readers domain security group. See the example below.

  This view is from Active Directory Users and Computers \contoso.com \Builtin \Event Log Readers:

  

  

  Also, there should be a Details tab at the bottom that summarizes whether or not the correct firewall ports and the Event Log Access status are unblocked

  References: http://technet.microsoft.com/en-us/library/jj878313.aspx

• Question 70:

  Your network contains an Active Directory domain named contoso.com. The domain contains domain controllers that run Windows Server 2008 Service Pack 2 (SP2), Windows Server 2008 R2 Service Pack 1 (SP1), Windows Server 2012, and Windows Server 2012 R2.

  A domain controller named DC1 runs Windows Server 2012 R2. DC1 is backed up daily.

  During routine maintenance, you delete a group named Group1.

  You need to recover Group1 and identify the names of the users who were members of Group1 prior to its deletion. You want to achieve this goal by using the minimum amount of administrative effort. What should you do first?

  A. Perform an authoritative restore of Group1.
  B. Mount the most recent Active Directory backup.
  C. Use the Recycle Bin to restore Group1.
  D. Reactivate the tombstone of Group1.
  A. Perform an authoritative restore of Group1.

  ---

  The Active Directory Recycle Bin does not have the ability to track simple changes to objects. If the object itself is not deleted, no element is moved to the Recycle Bin for possible recovery in the future. In other words, there is no rollback

  capacity for changes to object properties, or, in other words, to the values of these properties.

  There is another approach you should be aware of. Tombstone reanimation (which has nothing to do with zombies) provides the only way to recover deleted objects without taking a DC offline, and it's the only way to recover a deleted

  object's identity information, such as its objectGUID and objectSid attributes. It neatly solves the problem of recreating a deleted user or group and having to fix up all the old access control list (ACL) references, which contain the objectSid of

  the deleted object.

  Restores domain controllers to a specific point in time, and marks objects in Active Directory as being authoritative with respect to their replication partners.