Microsoft 70-417 Online Practice Questions and Exam Preparation

Microsoft 70-417 Online Questions & Answers

• Question 81:

  They are active as an IT consultant for a fashion company.

  The company uses an Active Directory forest with a single domain.

  The manager of the company reports that it gets displayed a desktop background, whom he has not chosen himself. In an interview with the IT department, you will learn that a former colleague more than 20 Group Policy objects (GPOs)

  created and it has not yet succeeded, determine which GPO configures the desktop background of the manager.

  How do you support the IT department in solving the problem?

  A. From Group Policy Management, run the Group Policy Results Wizard.
  B. Run the Group Policy Results Wizard for the computer account of the manager.
  C. Run the Group Policy Results Wizard for the user account of the manager.
  D. Run the Group Policy Results Wizard for all computer accounts to the domain.
  C. Run the Group Policy Results Wizard for the user account of the manager.

  ---

  The configuration of the desktop background is part of the user configuration. By carrying out the Group Policy Results Wizard for the user account of the manager can be found, which GPOs (GPOs) are applied to the order in which the user account of the manager. In addition, the report of the Group Policy Results Wizard can be seen that each GPO is crucial for the effective configuration of the individual directives.

  References: https://www.petri.com/solving-group-policy-problems-with-the-group-policy-results-wizard

• Question 82:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2. Server1 has the Active Directory Rights Management Services server role installed.

  Your company works with a partner organization that does not have its own Active Directory Rights Management Services (AD RMS) implementation.

  You need to create a trust policy for the partner organization.

  The solution must meet the following requirements:

  -

  Grant users in the partner organization access to protected content

  -

  Provide users in the partner organization with the ability to create protected content Which type of trust policy should you create?

  A. A federated trust
  B. Windows Live ID
  C. A trusted publishing domain
  D. A trusted user domain
  A. A federated trust

• Question 83:

  Is the following statement true or false?

  When a printer is installed on a network, default printer permissions are assigned that allow all users to print and change the status of documents sent to it.

  A. True
  B. False
  B. False

  ---

  Initial answer = true => false the key is all users and change the status of documents. Change the status document refers to the "Manage Document" permission and it's not a default permission for "all users". By default, so far, a user can only modify status of the jobs that he initiated himself. But we tested to make sure. We installed 2 fake printers (one by the network, and one using LPT1) and here's the default permissions we have got:

  

  If we consider that Everyone can be used to designate "all users", the above screenshot is enough. but just to be sure, i'll add the "Domain Users" and "Authenticated Users" groups to the permissions to check which permission are assigned by default: exactly the same: only the permission to print documents:

  

  Now we can be sure the answer is "FALSE".

  NB: by default, only Administrators (and administrator) and "All Application Packages" have both permissions (print and manage documents) http://technet.microsoft.com/en-us/library/cc773372%28v=ws.10%29.aspx Assigning printer

  permissions When a printer is installed on a network, default printer permissions are assigned that allow all users to print, and allow select groups to manage the printer, the documents sent to it, or both.

  Because the printer is available to all users on the network, you might want to limit access for some users by assigning specific printer permissions. For example, you could give all non administrative users in a department the Print permission

  and give all managers the Print and Manage Documents permissions. In this way, all users and managers can print documents, but managers can also change the print status of any document sent to the printer.

• Question 84:

  HOTSPOT

  Your network contains an Active Directory domain named contoso.com. The domain contains a DNS server named Server1. Server1 is configured to resolve single-label names for DNS clients.

  You need to view the number of queries for single-label names that are resolved by Server1.

  What command should you run?

  To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

• Question 85:

  Note: This question is part of series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series. Information and details provided in a question apply only to that question.

  Your network contains one Active Directory forest named contoso.com. The forest contains two child domains and six domain controllers. The domain controllers are configured as shown in the following table.

  

  You have a trust from contoo.com to another forest named fabrikam.com. You plan to migrate users from contodo.com to fabrikam.com. You need to ensure that the users who migrated to fabrikam.com can continue to access shared resources in contoso.com. The solution must not require administrators to modify permissions to shared resources.

  What should you use?

  A. Set-ADSite
  B. Set-ADReplicationSite
  C. Set-ADDomain
  D. Set-ADReplicationSiteLink
  E. Set-ADGroup
  F. Set-ADForest
  G. Netdom
  G. Netdom

  ---

  The Netdom move command moves a workstation or member server to a new domain. The act of moving a computer to a new domain creates an account for the computer on the domain, if it does not already exist.

  References: https://technet.microsoft.com/en-us/library/cc788127.aspx

• Question 86:

  Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2 that run Windows Server 2012 R2. Server1 has the IP Address Management (IPAM) Server feature installed. Server2 has the DHCP Server server role installed. A user named User1 is a member of the IPAM Users group on Server1. You need to ensure that User1 can use IPAM to modify the DHCP scopes on Server2. The solution must minimize the number of permissions assigned to User1.

  To which group should you add User1?

  A. IPAM ASM Administrators on Server1
  B. IPAMUG in Active Directory
  C. DHCP Administrators on Server2
  D. IPAM MSM Administrators on Server1
  C. DHCP Administrators on Server2

  ---

  Sever2 "DHCP Users" group membership is required to modify scopes on Server2 of course DHCP Administrators can proceed these tasks too. From the MSPress book "Upgrading your skills to MCSA Windows Server 2012 R2" IPAM Provisioning IPAM installation sets up various periodic data collection tasks to collect relevant data from managed DNS, DHCP, DC and NPS servers to enable address space management, multiserver management and monitoring and event catalog scenarios. All IPAM tasks launch under the NetworkService account, which presents the local computer's credentials to remote servers. To accomplish this,administrators must enable read access and security permissions for the required resources over managed servers for the IPAM server's computer account. Further the relevant firewall ports need to be configured on these managed servers. IPAM Access Settings The following table provides a mapping of the IPAMfunctionality and managed server role type to access setting and FW rulerequired by IPAM periodic tasks

  IPAM Access Monitoring IPAM access monitoring tracks the provisioning state of the following statuseson the server roles, which are displayed in the details pane of the IPAM server inventory view

• Question 87:

  You work for a company named ABC.com. The ABC.com network consists of a single Active Directory forest named ABC.com. The forest contains a single Active Directory Domain Services (AD DS) domain named ABC.com. All servers in the ABC.com domain run Windows Server 2012. ABC.com works with a partner company named Redbridge Logistics. The Redbridge Logistics network consists of a single Active Directory forest named RedbridgeLogistics.com. The forest contains a single Active Directory Domain Services (AD DS) domain named RedbridgeLogistics.com. All servers in the RedbridgeLogistics.com domain run Windows Server 2012.

  A forest trust exists between the two forests. The two networks are connected by a WAN link. A server named ABC-DNS1 hosts an Active Directory-integrated zone for ABC.com. A server named RL-DNS1 hosts an Active Directory-integrated zone for RedbridgeLogistics.com. Users in the ABC.com domain need to be able to resolve names of servers in the RedbridgeLogistics.com domain.

  You need to configure a name resolution solution that will enable name resolution in the event of a WAN link failure.

  What should you do?

  A. You should configure a forwarder on ABC-DNS1.
  B. You should configure a forwarder on RL-DNS1.
  C. You should configure a secondary zone on ABC-DNS1.
  D. You should configure a stub zone on RL-DNS1.
  E. You should configure a stub zone on ABC-DNS1.
  F. You should configure a conditional forwarder on ABC-DNS1.
  C. You should configure a secondary zone on ABC-DNS1.

• Question 88:

  Your network contains an Active Directory domain named adatum.com. All domain controllers run Windows Server 2008 R2.

  The domain contains a file server named Server6 that runs Windows Server 2012 R2. Server6 contains a folder named Folder1. Folder1 is shared as Share1. The NTFS permissions on Folder1 are shown in the exhibit. (Click the Exhibit button.)

  

  The domain contains two global groups named Group1 and Group2.

  You need to ensure that only users who are members of both Group1 and Group2 are denied access to Folder1.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Remove the Deny permission for Group1 from Folder1.
  B. Deny Group2 permission to Folder1.
  C. Install a domain controller that runs Windows Server 2012 R2.
  D. Create a conditional expression.
  E. Deny Group2 permission to Share1.
  F. Deny Group1 permission to Share1.
  A. Remove the Deny permission for Group1 from Folder1.
  D. Create a conditional expression.

  ---

  Conditional Expressions for Permission Entries Windows Server 2008 R2 and Windows 7 enhanced Windows security descriptors by introducing a conditional access permission entry. Windows Server 2012 R2 takes advantage of conditional access permission entries by inserting user claims, device claims, and resource properties, into conditional expressions. Windows Server 2012 R2 security evaluates these expressions and allows or denies access based on results of the evaluation. Securing access to resources through claims is known as claims-based access control. Claims-based access control works with traditional access control to provide an additional layer of authorization that is flexible to the varying needs of the enterprise environment.

  References: http://social.technet.microsoft.com/wiki/contents/articles/14269.introducing-dynamicaccesscontrol-en-us.aspx

• Question 89:

  Your network contains a single Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2.

  The domain contains 400 desktop computers that run Windows 8 and 200 desktop computers that run Windows Vista Service Pack 2 (SP2).

  All of the desktop computers are located in an organizational unit (OU) named OU1.

  You create a Group Policy object (GPO) named GPO1. GPO1 contains startup script settings.

  You link GPO1 to OU1.

  You need to ensure that GPO1 is applied only to computers that run Windows 8.

  What should you do?

  A. Modify the Security settings of OU1.
  B. Create and link a WMI filter to GPO1.
  C. Run the Set-GPInheritancecmdlet and specify the -target parameter.
  D. Run the Set-GPLinkcmdlet and specify the -target parameter.
  B. Create and link a WMI filter to GPO1.

  ---

  WMI Filtering is used to get information of the system and apply the GPO on it with the condition is met.Security filtering: apply a GPO to a specific group (members of the group)

• Question 90:

  DRAG DROP

  You have a file server named Server1 that runs Windows Server 2012 R2. The folders on Server1 are configured as shown in the following table.

  

  A new corporate policy states that backups must use Windows Azure Online Backup whenever possible.

  You need to identify which technology you must use to back up Server1. The solution must use Windows Azure Online Backup whenever possible.

  What should you identify?

  To answer, drag the appropriate backup type to the correct location or locations. Each backup type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  Select and Place: