Microsoft 70-742 Online Practice Questions and Exam Preparation

Microsoft 70-742 Online Questions & Answers

• Question 241:

  Your network contains an Active Directory forest. The forest functional level is Windows Server 2016.

  The network contains Linux servers that use MIT Kerberos V5 to provide an authentication, authorization, and access service.

  You need to ensure that users can use their Active Directory credentials to access the resources on the Linux servers. The solution must minimize administrative effort.

  What should you implement?

  A. an external trust
  B. a realm trust
  C. Active Directory Federation Services (AD FS)
  D. a Web Application Proxy
  B. a realm trust

  ---

  References: http://techgenix.com/active-directory-trusts/

  https://www.rootusers.com/how-to-join-centos-linux-to-an-active-directory-domain/

• Question 242:

  You have a server named Server1 that runs Windows Server 2016. Server1 has the Web Application Proxy role service installed.

  You need to publish Microsoft Exchange Server 2013 services through the Web Application Proxy. The solution must use preauthentication whenever possible.

  How should you configure the preauthentication method for each service? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

  ---

  Box 1: Pass-through

  Box 2: Active Directory Federation Services (ADFS)

  Box 3: Pass-through

  The following table describes the Exchange services that you can publish through Web Application Proxy and the supported preauthentication for these services:

  

  References: https://technet.microsoft.com/en-us/library/dn528827(v=ws.11).aspx

• Question 243:

  Your network contains an Active Directory domain named contoso.com.

  You deploy a standalone root certification authority (CA) named CA1.

  You need to autoenroll domain computers for certificates by using a custom certificate template.

  What should you do first?

  A. Modify the Policy Module for CA1.
  B. Modify the Exit Module for CA1.
  C. Install a standalone subordinate CA.
  D. Install an enterprise subordinate CA.
  D. Install an enterprise subordinate CA.

  ---

  You can't create templates or configure auto-enrollment on a standalone CA.

• Question 244:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a server named Web1 that runs Windows Server 2016.

  You need to list all the SSL certificates on Web1 that will expire during the next 60 days.

  Solution: You run the following command.

  Get-ChildItem Cert:\LocalMachine\My |? { $_.NotAfter -It (Get-Date).AddDays( 60 ) }

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

• Question 245:

  Your network contains an Active Directory domain. The domain contains a computer named Computer1 and an organizational unit (OU) named TestOU. TestOU contains 10 computer accounts that are used for testing. A Group Policy object

  (GPO) named GPO1 is linked to TestOU.

  On Computer1, you modify the User Right Assignment by using the local policy.

  You need to apply the User Right Assignment from Computer1 to the 10 test computers.

  What should you do?

  A. On Computer1 run the secedit.exe command and specify the /export parameter. Edit GPO1, and then import a security template.
  B. On Computer1, run the gpresult.exe command and specify the /x parameter. Edit GPO1, and then import a security template.
  C. On Computer1, run the secedit.exe command and specify the /export parameter. From Group Policy Management, run the Import Settings Wizard.
  D. On Computer1, run the gpresult.exe command and specify the /x parameter. From Group Policy Management, run the Restore Group Policy Object Wizard.
  A. On Computer1 run the secedit.exe command and specify the /export parameter. Edit GPO1, and then import a security template.

• Question 246:

  Note: This question is part of a series of questions that use the same scenario. For you convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is

  exactly the same in each question in this series.

  Start of repeated scenario.

  You work for a company named Contoso, Ltd.

  The network contains an Active Directory forest named contoso.com. A forest trust exists between contoso.com and an Active Directory forest named adatum.com.

  The contoso.com forest contains the objects configured as shown in the following table.

  

  Group1 and Group2 contain only user accounts.

  Contoso hires a new remote user named User3. User3 will work from home and will use a computer named Computer3 that runs Windows 10. Computer3 is currently in a workgroup.

  An administrator named Admin1 is a member of the Domain Admins group in the contoso.com domain.

  From Active Directory Users and Computers, you create an organizational unit (OU) named OU1 in the contoso.com domain, and then you create a contact named Contact1 in OU1. An administrator of the adatum.com domain runs the Set-

  ADUser cmdlet to configure a user named User1 to have a user logon name of [email protected].

  End of repeated scenario.

  You need to ensure that Admin1 can convert Group1 to a global group.

  What should you do?

  A. Add Admin1 to the Enterprise Admin group.
  B. Remove all the member from Group1.
  C. Modify the Security settings of Group1.
  D. Convert Group1 to a universal security group.
  B. Remove all the member from Group1.

• Question 247:

  HOTSPOT

  Your network contains an Active Directory forest named contoso.com. The forest contains the root domain and two child domains named childl.contoso.com and child2.contoso.com. Child1 contains three domain controllers named DC1, DC2, and DC3. Child2 contains one domain controller named

  You have two accounts named Child1\Admin1 and Child2\Admin2 that you use to perform administrative tasks. Currently, the accounts can manage only the member servers in their respective domain.

  You plan to demote DC3 and to remove the Child2 domain.

  You need to ensure that Admin1 can demote DC3 and that Admtn2 can demote DC4. The solution must use the principle of least privilege.

  To which groups should you add Admin1 and Admin2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  

  ---

  References: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/demoting-domain-controllers-and-domains--level-200

• Question 248:

  HOTSPOT

  Your network contains a single-domain Active Directory forest named contoso.com. The forest functional level is Windows Server 2016. The Active Directory Recycle Bin feature is enabled.

  You need to design a procedure to restore the values of user object attributes if the values are changed accidentally.

  Which cmdlets should you include in the procedure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  

• Question 249:

  You create a user account that will be used as a template for new user accounts.

  Which setting will be copied when you copy the user account from Active Directory Users and Computers?

  A. the Department attribute
  B. the Description attribute
  C. Permission
  D. Remote Desktop Services Profile
  A. the Department attribute

  ---

  A user template in Active Directory can be used if you are creating users for a specific department, with exactly the same properties, and membership to the same user groups. A user template is nothing more than a disabled user account that has all these settings already in place.

  References: http://www.rebeladmin.com/2014/07/create-users-with-user-templates-in-ad/

• Question 250:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named Server1.

  You recently restored a backup of the Active Directory database from Server1 to an alternate Location. The restore operation does not interrupt the Active Directory services on Server1.

  You need to make the Active Directory data in the backup accessible by using Lightweight Directory Access Protocol (LDAP).

  Which tool should you use?

  A. Dsadd quota
  B. Dsmod
  C. Active Directory Administrative Center
  D. Dsacls
  E. Dsamain
  F. Active Directory Users and Computers
  G. Ntdsutil
  H. Group Policy Management Console
  E. Dsamain

  ---

  Dsamain.exe, allows an ntds.dit file to be mounted and exposed as an LDAP server, which means you can use such familiar tools as ADSIEdit, LDP.exe, and Active Directory Users and Computers to interact with a mounted database.

  References: http://www.itprotoday.com/windows-8/using-active-directory-snapshots-and-dsamain-tool