Microsoft 70-742 Online Practice Questions and Exam Preparation

Microsoft 70-742 Online Questions & Answers

• Question 131:

  You deploy a new certification authority (CA) to a server that runs Windows Server 2016.

  You need to configure the CA to support recovery of certificates.

  What should you do first?

  A. Assign the Request Certificates permission to the user account that will be responsible for recovering certificates.
  B. Configure the Key Recovery Agent templates as a certificate template to issue.
  C. Modify the Recovery Agents settings from the properties of the CA.
  D. Modify the extension of the OCSP Response Signing template.
  B. Configure the Key Recovery Agent templates as a certificate template to issue.

  ---

  References: http://markgossa.blogspot.co.uk/2017/03/enable-key-archival-in-server-2012-r2.html

• Question 132:

  Your company has multiple branch offices.

  The network contains an Active Directory domain named contoso.com.

  In one of the branch offices, a new technician is hired to add computers to the domain.

  After successfully joining multiple computers to the domain, the technician fails to join any more computers to the domain.

  You need to ensure that the technician can join an unlimited number of computers to the domain.

  What should you do?

  A. Configure the technician's user account as a manager service account.
  B. Run the Set-ADComputer cmdlet.
  C. Run the Delegation if Control Wizard on the Computers container.
  D. Add the technician to the Domain Computers group.
  C. Run the Delegation if Control Wizard on the Computers container.

  ---

  References: https://www.itprotoday.com/active-directory/delegating-privileges-active-directory

• Question 133:

  Your company has a marketing department and a security department.

  The network contains an Active Directory domain named contoso.com.

  The domain contains an enterprise certification authority (CA).

  You have two organizational units (OUs) named MKT_UsersOU and MKT_ComputersOU. MKT_UsersOU contains the user accounts for the users in the marketing department. MKT_ComputersOU contains the computer accounts for the

  computers in the marketing department.

  A Group policy object (GPO) named GPO1 is linked to MKT_UsersOU.

  A GPO named GPO2 linked to MKT_ComputersOU.

  You plan to deploy a web application for the marketing department users.

  The application will require certificates for authentication.

  The security department configures the CA to support the planned deployment.

  You need to ensure that the web application can authenticate the marketing department users.

  What should you do?

  A. From the User Configuration node of GPO1, create an Internet Setting preference.
  B. From the User Configuration node of GPO1, configure the Certificate Services Client - Auto-enrollment settings.
  C. From the Computer Configuration node of GPO2, configure the Certificate Services Client - Certificate Enrollment Policy settings.
  D. From the Computer Configuration node of GPO2, create the Automatic Certificate Request Settings.
  B. From the User Configuration node of GPO1, configure the Certificate Services Client - Auto-enrollment settings.

• Question 134:

  HOTSPOT

  Your network contains an Active Directory domain named contoso.com.

  You have an administrative computer named Computer1 that runs Windows Server 2016.

  From Computer1, you edit a Group Policy object (GPO) named GPO1 as shown in the exhibit.

  

  You receive a new administrative template named Template1.

  Template1 consists of Template1.adml. Template1 is in English US.

  You need to ensure that the settings of Template1 appear under the Administrative Templates node.

  To where should you copy the Template1 files? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  

• Question 135:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016. The computer account for Server1 is in organizational unit (OU) named OU1.

  You create a Group Policy object (GPO) named GPO1 and link GPO1 to OU1.

  You need to add a domain user named User1 to the local Administrators group on Server1.

  Solution: From the Computer Configuration node of GPO1, you configure the Local Users and Groups preference.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  to add uses to the Local Administrator built In group on all the computers using Group Policy, open group policy editor and create or edit existing GPO. Go to User Configuration -> Preferences -> Control Panel Settings -> Local users and groups.

  References: https://www.ntweekly.com/2015/01/10/how-to-add-users-to-local-admin-group-using-group-policy-windows-server-2012/

• Question 136:

  Your network contains an Active Directory domain named contoso.com. The domain contains a Group Policy object (GPO) named GPO1.

  You configure the Internet Settings preference in GPO1 as shown in the exhibit. (Click the Exhibit button.)

  

  A user reports that the homepage of Internet Explorer is not set to http://www.contoso.com.

  You confirm that the other settings in GPO1 are applied.

  You need to configure GPO1 to set the Internet Explorer homepage.

  What should you do?

  A. Edit the GPO1 preference and press F5.
  B. Modify Security Settings for GPO1.
  C. Modify WMI Filtering for GPO1.
  D. Modify the GPO1 preference to use item-level targeting.
  A. Edit the GPO1 preference and press F5.

  ---

  The red dotted line under the homepage URL means that setting is disabled. Pressing F5 enables all settings. References: https://community.spiceworks.com/topic/285312-add-default-website-in-group-policy

• Question 137:

  Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series.

  Information and details provided in a question apply only to that question.

  Your network contains an Active Directory domain named contoso.com.

  The domain functional level is Windows Server 2012 R2.

  Your company hires a new security administrator to manage sensitive user data.

  You create a user account named Security1 for the security administrator.

  You need to ensure that the password for Security1 has at least 12 characters and is modified every 10 days. The solution must apply to Security1 only.

  Which tool should you use?

  A. Dsadd quota
  B. Dsmod
  C. Active Directory Administrative Center
  D. Dsacls
  E. Dsamain
  F. Active Directory Users and Computers
  G. Ntdsutil
  H. Group Policy Management Console
  C. Active Directory Administrative Center

• Question 138:

  Your network contains a single-domain Active Directory forest named contoso. com. The forest functional level is Windows Server 2016. The forest has Dynamic Access Control enabled. The domain contains two domain controllers named

  DC1 and DC2. Privileged user accounts used to manage Active Directory reside in a group named Contoso\AD_Admins.

  You create an authentication policy named Policy1 and an authentication policy silo named Silo1.

  You need to ensure that the accounts in the Contoso\AD_Admins group can sign in to the domain controllers only.

  Which three configurations should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Create an access control condition in Policy1.
  B. Create a managed service account and add the account to Permitted Accounts in Silo1.
  C. Add the domain controllers to the Contoso\AD_Admins group.
  D. Add the privileged user accounts and the domain controllers to Permitted Accounts in Silo1.
  E. Assign Silo1 to the privileged user accounts and the domain controllers.
  A. Create an access control condition in Policy1.
  D. Add the privileged user accounts and the domain controllers to Permitted Accounts in Silo1.
  E. Assign Silo1 to the privileged user accounts and the domain controllers.

• Question 139:

  Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is

  exactly the same in each question in this series.

  Start of repeated scenario.

  You work for a company named Contoso, Ltd.

  The network contains an Active Directory forest named contoso.com. A forest trust exists between contoso.com and an Active Directory forest named adatum.com.

  The contoso.com forest contains the objects configured as shown in the following table.

  

  Group1 and Group2 contain only user accounts.

  Contoso hires a new remote user named User3. User3 will work from home and will use a computer named Computer3 that runs Windows 10. Computer3 is currently in a workgroup.

  An administrator named Admin1 is a member of the Domain Admins group in the contoso.com domain.

  From Active Directory Users and Computers, you create an organizational unit (OU) named OU1 in the contoso.com domain, and then you create a contact named Contact1 in OU1.

  An administrator of the adatum.com domain runs the Set-ADUser cmdlet to configure a user named User1 to have a user logon name of [email protected].

  End of repeated scenario.

  Admin1 attempts to delete OU1 and receives an error message.

  You need to ensure that Admin1 can delete OU1.

  What should you do first?

  A. Modify the Object settings for OU1
  B. Add Admin1 to the Enterprise Admins group
  C. Delete Contact1
  D. Disable the Active Directory Recycle Bin
  A. Modify the Object settings for OU1

  ---

  References: https://www.dtonias.com/access-denied-delete-move-ou-active-directory/

• Question 140:

  Your network contains an Active Directory forest named contoso.com.

  A partner company has a forest named fabrikam.com. Each forest contains one domain.

  You need to provide access for a group named Research in fabrikam.com to resources in contoso.com. The solution must use the principle of least privilege.

  What should you do?

  A. Create an external trust from fabrikam.com to contoso.com. Enable Active Directory split permissions in fabrikam.com.
  B. Create an external trust from contoso.com to fabrikam.com. Enable Active Directory split permissions in contoso.com.
  C. Create a one-way forest trust from contoso.com to fabrikam.com that uses selective authentication.
  D. Create a one-way forest trust from fabrikam.com to contoso.com that uses selective authentication.
  C. Create a one-way forest trust from contoso.com to fabrikam.com that uses selective authentication.