Microsoft 70-742 Online Practice Questions and Exam Preparation

Microsoft 70-742 Online Questions & Answers

• Question 281:

  You have an enterprise certification authority (CA).

  You create a global security group named Group1.

  You need to provide members of Group1 with the ability to issue and manage certificates.

  The solution must prevent the Group1 members from managing certificates requested by members of the Domain Admins group.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From the CA properties, modify the Policy Module settings.
  B. From the Certificate Templates console, modify the Security settings of the Administrator certificate template.
  C. From the CA properties, modify the security settings.
  D. From the CA properties, modify the Enrollment Agents settings.
  E. From the CA properties, modify the Certificate Managers Settings.
  F. From the Certificate Templates console, modify the Security settings of the User certificate template.
  C. From the CA properties, modify the security settings.
  E. From the CA properties, modify the Certificate Managers Settings.

• Question 282:

  Your network contains an Active Directory forest named contoso.com. The domain contains an Active Directory Federation Services (AD FS) server named Server1.

  On a standalone server named Server2, you install and configure the Web Application Proxy.

  You have an internal web application named WebApp1. AD FS has a relying party trust for WebApp1.

  You need to provide external users with access to WebApp1. Authentication to WebApp1 must use AD FS preauthentication.

  Which tool should you use to publish WebApp1?

  A. Remote Access Management on Server2
  B. Remote Access Management on Server1
  C. AD FS Management on Server2
  D. AD FS Management on Server1
  E. Routing and Remote Access on Server1
  A. Remote Access Management on Server2

  ---

  To publish a claims-based application

  1.

  On the Web Application Proxy server, in the Remote Access Management console, in the Navigation pane, click Web Application Proxy, and then in the Tasks pane, click Publish.

  2.

  On the Publish New Application Wizard, on the Welcome page, click Next.

  3.

  On the Preauthentication page, click Active Directory Federation Services (AD FS), and then click Next.

  4.

  On the Supported Clients page, select Web and MSOFBA, and then click Next.

  5.

  On the Relying Party page, in the list of relying parties select the relying party for the application that you want to publish, and then click Next.

  6.

  On the Publishing Settings page, do the following, and then click Next:

  In the Name box, enter a friendly name for the application.

  This name is used only in the list of published applications in the Remote Access Management console.

  In the External URL box, enter the external URL for this application; for example, https://sp.contoso.com/app1/.

  In the External certificate list, select a certificate whose subject covers the external URL.

  In the Backend server URL box, enter the URL of the backend server. Note that this value is automatically entered when you enter the external URL and you should change it only if the backend server URL is different; for example, http://sp/

  app1/.

  7.

  On the Confirmation page, review the settings, and then click Publish. You can copy the PowerShell command to set up additional published applications.

  8.

  On the Results page, make sure that the application published successfully, and then click Close.

  References: https://docs.microsoft.com/en-us/windows-server/remote/remote-access/web-application-proxy/publishing-applications-using-ad-fs-preauthentication

• Question 283:

  You have a certification authority (CA) named CA1.

  You create a certificate template named Template1 that has the following configurations:

  *

  Minimum key size: 2048

  *

  Cryptographic provider Microsoft Strong Cryptographic Provider

  *

  Compatibility Settings - Certification Authority: Windows Server 2012 R2

  *

  Compatibility Settings - Certificate recipient: Windows 8.1 / Windows Server 2012 R2

  You plan to configure Template1 to require that computers requesting certificates based on Template1 must have a TPM-protected private key.

  You need to modify Template1 to ensure that you can configure the Key Attestation settings.

  What should you change?

  A. Compatibility Settings - Certification Authority to Windows Server 2016
  B. Compatibility Settings - Certificate recipient to Windows 10 / Windows Server 2016
  C. Cryptographic provider to Microsoft Platform Crypto Provider
  D. Minimum key size to 4096
  C. Cryptographic provider to Microsoft Platform Crypto Provider

  ---

  References: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/tpm-key- attestation

• Question 284:

  HOTSPOT

  Your network contains an Active Directory forest named contoso.com. The forest contains an Active Directory Federation Services (AD FS) farm.

  You install Windows Server 2016 on a server named Server2.

  You need to configure Server2 as a node in the federation server farm.

  Which cmdlets should you run? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

• Question 285:

  HOTSPOT

  Your network contains an Active Directory forest. The forest contains two sites named Site1 and Site2. Site1 contains 10 domain controllers. Site1 and Site2 connect to each other by using a WAN link.

  You run the Active Directory Domain Services Configuration Wizard as shown in the following graphic.

  

  Server3 is the only server in Site2.

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  Hot Area:

  

  

• Question 286:

  Your network contains an Active Directory forest named contoso.com.

  Your company plans to hire 500 temporary employees for a project that will last 90 days.

  You create a new user account for each employee. An organizational unit (OU) named Temp contains the user accounts for the employees.

  You need to prevent the new users from accessing any of the resources in the domain after 90 days.

  What should you do?

  A. Run the Get-ADOrganizationalUnit cmdlet and pipe the output to the Set-Date cmdlet.
  B. Run the Get-ADOrganizationalUnit cmdlet and pipe the output to the Set-ADAccountPassword cmdlet.
  C. Run the Get-ADUser cmdlet and pipe the output to the Set-ADAccountExpiration cmdlet.
  D. Create a Group Policy object (GPO) and link the GPO to the Temp OU. Modify the Account Lockout Policy of the GPO.
  C. Run the Get-ADUser cmdlet and pipe the output to the Set-ADAccountExpiration cmdlet.

  ---

  References: https://docs.microsoft.com/en-us/powershell/module/addsadministration/set-adaccountexpiration?view=win10-ps

• Question 287:

  DRAG DROP

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1.

  You create and link a Group Policy object (GPO) named SalesAppGPO to an organizational unit (OU) named SalesOU. All the computer accounts are in the Computers container. All the user accounts of the users in the sales department are

  in SalesOU. You have a line-of-business application named SalesApp that is installed by using a Windows Installer package.

  You need to make SalesApp available to only the sales department users.

  Which three actions should you perform in sequence? To answer move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 288:

  Your network contains an Active Directory domain named contoso.com.

  You need to create a central store for Group Policy administrative templates.

  What should you use?

  A. Group Policy Management Console (GPMC)
  B. Copy-item
  C. Group Policy Management Editor
  D. Copy-GPO
  B. Copy-item

  ---

  References: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/copy-item?view=powershell-6

• Question 289:

  You have servers that run Windows Server 2016 and devices that run Windows 10 Enterprise.

  You have a certification authority (CA) that Issued computer certificates to all the servers and devices.

  You plan to allow the Windows 10 devices to connect to the network remotely by using VPN device tunnels.

  You install the Remote Access server role on a server. From the Routing and Remote Access console, you configure the server for the VPN role.

  You need to ensure that the Windows 10 devices can establish the VPN tunnel before users sign in to the devices. What should you do on the VPN server?

  A. Modify the ports properties and add additional SSTP ports.
  B. Modify the ports properties and add additional IKEv2 ports.
  C. From Authentication Methods, select Extensible authentication protocol (EAP)
  D. From Authentication Methods, select Allow machine certificate authentication for IKEv2.
  A. Modify the ports properties and add additional SSTP ports.