Microsoft 70-742 Online Practice Questions and Exam Preparation

Microsoft 70-742 Online Questions & Answers

• Question 41:

  Your network contains an Active Directory forest named contoso.com. The forest contains an enterprise root certification authority (CA) on a server that runs Windows Server 2016.

  You plan to create and issue a custom subordinate CA template.

  You need to prevent subordinate CAs from issuing subordinate certificates.

  What should you configure in the template?

  A. The Cryptography settings
  B. The Request Handling settings
  C. The Basic Constraints extension
  D. The Security settings
  C. The Basic Constraints extension

• Question 42:

  HOTSPOT

  Your network contains an Active Directory forest named contoso.com.

  You need to add a new domain named fabrikam.com to the forest.

  What command should you run? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

• Question 43:

  Your network contains an Active Directory domain named contoso.com. The domain contains three servers named Server1, Server2, and Server3 that run Windows Server 2016.

  Server1 has IP Address Management (IPAM) installed. Server2 and Server3 have the DHCP Server role installed and have several DHCP scopes configured. The IPAM server retrieves data from Server2 and Server3.

  A domain user named User1 is a member of the groups shown in the following table.

  

  On Server1, you create a security policy for User1. The policy grants the IPAM DHCP Scope Administrator Role with the \Global access scope to the user. Which actions can User1 perform? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

  ---

  User1 is using Server Manager, not IPAM to perform the administration. Therefore, only the “DHCP Administrators” permission on Server2 and the “DHCP Users” permissions on Server3 are applied. The permissions granted through membership of the “IPAM DHCP Scope Administrator Role” are not applied when the user is not using the IPAM console.

• Question 44:

  You have a server named Server1 that runs Windows Server 2016. You need to configure Server1 as a Web Application Proxy.

  Which server role or role service should you install on Server1?

  A. Remote Access
  B. Active Directory Federation Services
  C. Web Server (IIS)
  D. DirectAccess and VPN (RAS)
  E. Network Policy and Access Services
  A. Remote Access

• Question 45:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs a Server Core installation of Windows Server 2016. Server1 is configured as an Active Directory Rights

  Management Services (AD RMS) server for the domain.

  You need to install the Identity Federation Support role service on Server1.

  What should you do first?

  A. Run the Install–WindowsFeature NET–Franework
  B. Install a Server with Desktop Experience installation of Windows Server 2016.
  C. Run the Add-AdfsClient cmdlet.
  D. Run the Install–WindowsFeature Desktop–Experience cmdlet.
  C. Run the Add-AdfsClient cmdlet.

• Question 46:

  Your network contains an Active Directory domain named contoso.com.

  You create a domain security group named Group1 and add several users to it.

  You need to force all of the users in Group1 to change their password every 35 days. The solution must affect the Group1 users only.

  What should you do?

  A. From Windows PowerShell, run the Set-ADDomain cmdlet, and then run the Set-ADAccountPassword cmdlet.
  B. Modify the Password Policy settings in a Group Policy object (GPO) that is linked to the domain, and then filter the GPO to Group1 only.
  C. Create a forms authentication provider, and then set the forms authentication credentials.
  D. From Active Directory Administrative Center, create a Password Setting object (PSO).
  D. From Active Directory Administrative Center, create a Password Setting object (PSO).

• Question 47:

  Your network contains an Active Directory domain named contoso.com.

  The domain contains an enterprise root certification authority (CA) on a server that runs Windows Server 2016.

  You need to configure the CA to support Online Certificate Status Protocol (OCSP) responders.

  Which two actions should you perform? Each correct selection presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Add a new certificate template to issue.
  B. Modify the Authority Information Access (AIA) of the CA.
  C. Configure an enrollment agent.
  D. Install a standalone subordinate CA.
  E. Modify the CRL distribution point (CDP) of the CA.
  A. Add a new certificate template to issue.
  B. Modify the Authority Information Access (AIA) of the CA.

  ---

  Once the OCSP service is configured, we need to configure the OCSP Response Signing template. This process includes adding an Authority Information Access (AIA) extension and then issuing a new certificate template. References: https://www.poweradmin.com/blog/deploying-active-directory-certificate-services-and-online-responder/

• Question 48:

  Your network contains an Active Directory domain named contoso.com. All the accounts of the users in the sales department are in an organizational unit (OU) named SalesOU.

  An application named App1 is deployed to the user accounts in SalesOU by using a Group Policy object (GPO) named Sales GPO.

  You need to set the registry value of \HKEY_CURRENT_USER\Software\App1\Collaboration to 0.

  Solution: You add a computer preference that has a Create action.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

• Question 49:

  Your network contains an Active Directory domain named contoso.com.

  You have an application named App1 that is deployed to all the client computers in the domain. App1 writes a registry value named LocalStorage on all the client computers.

  You need to delete the LocalStorage registry value from all the client computers in the domain that have less than 100 GB of free disk space on their system volume.

  What should you do?

  A. Configure Software Settings in a Group Policy object (GPO) and enable a WMI filter.
  B. Configure a Group Policy setting to modify the security of the LocalStorage registry value.
  C. Create an administrative template file that contains the LocalStorage registry setting, and then add the administrative template to a Group Policy object (GPO).
  D. Configure a Group Policy preference that uses item-level targeting.
  D. Configure a Group Policy preference that uses item-level targeting.

  ---

  In Windows Server 2008 Microsoft introduced a Group Policy extension, named Group Policy Preferences (GPP). GPP that includes registry settings, allows you to add, remove or modify key values. References: https://theitbros.com/add-modify-and-delete-registry-keys-using-group-policy/

• Question 50:

  You have an offline root certification authority (CA) named CA1. CA1 is hosted on a virtual machine.

  You only turn on CA1 when the CA must be patched or you must generate a key for subordinate CAs.

  You start CA1, and you discover that the filesystem is corrupted.

  You resolve the filesystem corruption and discover that you must reload the CA root from a backup.

  When you attempt to run the Restore-CARoleService cmdlet, you receive the following error message: "The process cannot access the file because it is being used by another process."

  You need to ensure that you can restore the CA.

  What should you do first?

  A. Stop the Active Directory Certificate Services (AD CS) service.
  B. Run the Restore-CARoleService cmdlet and specify the 璅orce parameter.
  C. Stop the Active Directory Domain Services (AD DS) service.
  D. Run the Restore-CARoleService cmdlet and specify the path to a valid CA key.
  A. Stop the Active Directory Certificate Services (AD CS) service.