Microsoft 70-417 Study Guides 2021

NEW QUESTION 1
Your network contains one Active Directory domain named contoso.com. You pilot DirectAccess on the network.
During the pilot deployment you enable DirectAccess only for a group named ContosoTest Computers.
Once the pilot is complete, you need to enable DirectAccess for all of the client computers in the domain.
What should you do?

• A. From Windows PowerShell, run the Set-DACIient cmdlet.
• B. From Windows PowerShell, run the Set-DAServer cmdlet.
• C. From Group Policy Management, modify the security filtering of an object named Direct Access Client Settings Group Policy.
• D. From Group Policy Management, modify the security filtering of an object named Direct Access Server Settings Group Policy.

Answer: A

Explanation:  

NEW QUESTION 2
Your network contains an Active Directory domain named contoso.com. The domain
contains a server named Server1 that runs Windows Server 2012 and a server named Server2 that runs Windows Server 2008 R2 Service Pack 1 (SP1). Both servers are member servers.
On Server2, you install all of the software required to ensure that Server2 can be managed remotely from Server Manager.
You need to ensure that you can manage Server2 from Server1 by using Server Manager. Which two tasks should you perform on Server2? (Each correct answer presents part of the
solution. Choose two.)

• A. Run the Enable-PSRemotingcmdlet.
• B. Run the Configure-SMRemoting.psl script.
• C. Run the Enable-PSSessionConfigurationcmdlet.
• D. Run the Set-ExecutionPolicycmdlet.
• E. Run the systempropertiesremote.exe command.

Answer: BD

Explanation: To configure Server Manager remote management by using Windows PowerShell
On the computer that you want to manage remotely, open a Windows PowerShell session with elevated user rights.
In the Windows PowerShell session, type the following, and then press Enter. Set-ExecutionPolicy –ExecutionPolicyRemoteSigned (D)
Type the following, and then press Enter to enable all required firewall rule exceptions. Configure-SMRemoting.ps1 -force –enable (B)
 

NEW QUESTION 3
Your network contains two DNS servers named DNS1 and DNS2 that run Windows Server 2012 R2. DNS1 has a primary zone named contoso.com. DNS2 has a secondary copy of the contoso.com zone.
You need to log the zone transfer packets sent between DNS1 and DNS2. What should you configure?

• A. debug logging from DNS Manager
• B. logging from Windows Firewall with Advanced Security
• C. monitoring from DNS Manager
• D. a Data Collector Set (DCS) from Performance Monitor

Answer: C

Explanation: Monitoring DNS with the DNS Console
The DNS management console includes functionality that enables you to use the console to monitor DNS activity:
* Event Logging tab: You can access the Event Logging tab located within the Properties
dialog box of the DNS server to specify the DNS events that you want to monitor. Through the Event Logging tab, you can limit the events which are written to the DNS Events log.
* Monitoring tab: The Monitoring tab is also located within the Properties dialog box of the DNS server. This tab allows you to test querying of the DNS server.
Reference: Monitoring and Troubleshooting DNS
 

NEW QUESTION 4
Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2.
On a server named Server2, you perform a Server Core Installation of Windows Server 2012 R2. You join Server2 to the contoso.com domain. You need to ensure that you can manage Server2 by using the Computer Management console on Server1.
What should you do on Server2?

• A. Run the Disable-NetFirewallRulecmdlet.
• B. Run the Enable-NetFirewallRulecmdlet.
• C. Run sconfig.exe and configure the network settings.
• D. Run sconfig.exe and configure remote management.

Answer: B

Explanation: As we can see on the following screenshot, Remote Management is enabled by default on a new Server Core installation of 2012 (so we don't have to configure it on Server2) BUT that's not enough as it only enables WinRM-based remote management (and computer management is not WinRM- based of course). To enable the remote management from an MMC (such as server manager, or computer manager), we have to enable exception rules in the Firewall, which can be done, amongst other ways, using Powershell and the Enable- NetFirewallRulecmdlet.

http://technet.microsoft.com/en-us/library/jj554869.aspx Enable-NetFirewallRule
Detailed Description
The Enable-NetFirewallRulecmdlet enables a previously disabled firewall rule to be active within the computer or a group policy organizational unit. This cmdlet gets one or more firewall rules to be enabled with the Name parameter (default), the DisplayName parameter, rule properties, or by associated filters or objects. The Enabled parameter for the resulting queried rules is set to True.
 

NEW QUESTION 5
Your network contains an Active Directory domain named contoso.com. All user accounts reside in an organizational unit (OU) named OU1.
All of the users in the marketing department are members of a group named Marketing. All of the users in the human resources department are members of a group named HR. You create a Group Policy object (GPO) named GPO1.
You link GPO1 to OU1.
You configure the Group Policy preferences of GPO1 to add two shortcuts named Link1 and Link2 to the desktop of each user.
You need to ensure that Link1 only appears on the desktop of the users in Marketing and that Link2 only appears on the desktop of the users in HR.
What should you configure?

• A. Security Filtering
• B. WMI Filtering
• C. Group Policy Inheritance
• D. Item-level targeting

Answer: D

Explanation:  

NEW QUESTION 6
DRAG DROP
Your network contains an Active Directory domain named contoso.com. The domain contains a file server named File1. All servers in the domain run Windows Server 2012 R2.
You need to create a new volume on File1.
The new volume must have the following configurations:
✑ Have the drive letter T
✑ Have the FAT32 file system
✑ Be stored on a new virtual hard disk
In which order should you run the Diskpart commands?
To answer, move all the Diskpart commands from the list of commands to the answer area and arrange them in the correct order.

Answer:

Explanation: Box 1: create vdisk Box 2: attach vdisk Box 3: create partition Box 4: assign
Box 5: format
Note: Example:
createvdisk file="C:vdisksdisk1.vhd" maximum=16000 attachvdisk
create partition primary assign letter=g
format
References:
http://technet.microsoft.com/en-us/library/gg252576.aspx http://technet.microsoft.com/en-us/library/hh831487.aspx
 

NEW QUESTION 7
Your network contains a server named Server1 and 10 Web servers. All servers run Windows Server 2012 R2.
You create a Windows PowerShell Desired State Configuration (DSC) to push the settings from Server1 to all of the Web servers.
On Server1, you modify the file set for the Web servers.You need to ensure that all of the Web servers have the latest configurations.
Which cmdlet should you run on Server1?

• A. Restore-DcsConfiguration
• B. Set DcsLocalConfigurationManager
• C. Start-DcsConfiguration
• D. Get-DcsConfiguration

Answer: C

Explanation:  

NEW QUESTION 8
Your network contains an Active Directory domain named contoso.com. The domain contains a member server named Server 1. Server1 has the IP Address Management (IPAM) Server feature installed.
A technician performs maintenance on Server1.
After the maintenance is complete, you discover that you cannot connect to the IPAM server on Server1.
You open the Services console as shown in the exhibit. (Click the Exhibit button.)

You need to ensure that you can connect to the IPAM server. Which service should you start?

• A. Windows Process Activation Service
• B. Windows Event Collector
• C. Windows Internal Database
• D. Windows Store Service (WSService)

Answer: C

Explanation:  

NEW QUESTION 9
Dynamic memory is a great feature that allows you to manage the amount of memory that Hyper-V virtual machines consume.
How would you identify the memory a virtual machine consumes when Dynamic Memory is not enabled?

• A. View the amount of RAM listed under Startup in the Memory page of the virtual machine
• B. View the amount of RAM listed under Static in the Memory page of the virtual machine
• C. None of these
• D. View the amount of RAM listed under Maximum in the Memory page of the virtual machine

Answer: A

Explanation: When dynamic memory is not enabled, the virtual machine is given a static amount of RAM. This value is located under the Startup section of the Memory page of the virtual machine settings.
Notice in my screenshot it's enabled:

 

NEW QUESTION 10
You have a server named Server1 that runs Windows Server 2012 R2.
Server1 is backed up by using Windows Server Backup. The backup configuration is
shown in the exhibit. (Click the Exhibit button.)

You discover that only the last copy of the backup is maintained. You need to ensure that multiple backup copies are maintained. What should you do?

• A. Configure the Optimize Backup Performance settings.
• B. Modify the Volume Shadow Copy Service (VSS) settings.
• C. Modify the backup times.
• D. Modify the backup destination.

Answer: D

Explanation: A, The destination in the exhibit shows a network share is useD. If a network share is being used only the latest copy will be saved
http://windows.microsoft.com/en-us/windows7/where-should-i-save-my-backup

 

NEW QUESTION 11
Your network contains an Active Directory domain named contoso.com. The domain contains three servers named Server1, Server2, and Server3.
You create a server group named ServerGroup1.
You discover the error message shown in the following exhibit. (Click the Exhibit button.)

You need to ensure that Server2 can be managed remotely by using Server Manager. What should you do?

• A. On Server2, run the netdom.exe command.
• B. On Server2, run the net stop netlogon command, and then run the net start netlogon command.
• C. On DC1, run the Enable-PSSessionConfigurationcmdlet.
• D. On Server2, modify the membership of the Remote Management Users group.

Answer: D

Explanation: This is a security issue. To be able to access Server2 remotely through Server Manager
the user need to be a member of the Remote Management Users group. References:
Training Guide: Installing and Configuring Windows Server 2012, Chapter 3 Server Remote Management, Lesson 1: Server Manager, p. 90-92
 

NEW QUESTION 12
You have a VHD that contains an image of Windows Server 2012 R2. You plan to Apply updates to the image.
You need to ensure that only updates that can install without requiring a restart are installed.
Which DISM option should you use?

• A. /Apply-Unattend
• B. /Add-ProvisionedAppxPackage
• C. /PreventPending
• D. /Cleanup-Image

Answer: C

Explanation: http://technet.microsoft.com/en-us/library/hh825265.aspx
 

NEW QUESTION 13
Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2.
The domain contains 200 Group Policy objects (GPOs) and 100 WMI filters.
An administrator named Admin1 must be able to create new WMI filters and edit all of the existing WMI filters from the Group Policy Management Console (GPMC).
You need to delegate the required permissions to Admin1. The solution must minimize the number of permissions assigned to Admin1.
What should you do?

• A. From Active Directory Users and Computers, add Admin1 to the WinRMRemoteWMIUsers group.
• B. From Group Policy Management, assign Creator Owner to Admin1 for the WMI Filterscontainer.
• C. From Active Directory Users and Computers, add Admin1 to the Domain Admins group.
• D. From Group Policy Management, assign Full control to Admin1 for the WMI Filters container.

Answer: D

Explanation: Users with Full control permissions can create and control all WMI filters in the domain, including WMI filters created by others.
Users with Creator owner permissions can create WMI filters, but can only control WMI filters that they create.
Ref: http://technet.microsoft.com/en-us/library/cc757429(v=ws.10).aspx
 

NEW QUESTION 14
HOTSPOT
Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. All domain controllers run Windows Server 2012 R2 and are configured as DNS servers. All DNS zones are Active Directory-integrated. Active Directory Recycle Bin is enabled.
You need to modify the amount of time deleted objects are retained in the Active Directory Recycle Bin.
Which naming context should you use?
To answer, select the appropriate naming context in the answer area.

Answer:

Explanation: Starting in Windows Server 2008 R2, Active Directory now implements a true recycle bin. No longer will you need an authoritative restore to recover deleted users, groups, OU’s, or other objects. Instead, it is now possible to use PowerShell commands to bring back objects with all their attributes, backlinks, group memberships, and metadata.
The amount of time that an object can be recovered is controlled by the Deleted Object Lifetime (DOL). This time range can be set on the msDS-deletedObjectLifetime attribute. By default, it will be the same number of days as the Tombstone Lifetime (TSL). The TSL set for a new forest since Windows Server 2003 SP1 has been 180 days*, and since by default DOL = TSL, the default number of days that an object can be restored is therefore 180 days. If tombstoneLifetime is NOT SET or NULL, the tombstone lifetime is that of the Windows default: 60 days. This is all configurable by the administrator.
Set-ADObject -Identity "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=contoso,DC=com" -Partition "CN=Configuration,DC=contoso,DC=com" -Replace: @("msDS-DeletedObjectLifetime" = 365)
msDS-deletedObjectLifetime New to Windows Server 2008 R2
Is set on the “CN=Directory Service,CN=Windows NT, CN=Services, CN=Configuration, DC=COMPANY,DC=COM” container
Describes how long a deleted object will be restorable
To modify the deleted object lifetime by using Ldp.exe
To open Ldp.exe, click Start, click Run, and then type ldp.exe.
To connect and bind to the server hosting the forest root domain of your Active Directory environment, under Connections, click Connect, and then click Bind.
In the console tree, right-click the CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration container, and then click Modify.
In the Modify dialog box, in Edit Entry Attribute, type msDS-DeletedObjectLifeTime.
In the Modify dialog box, in Values, type the number of days that you want to set for the tombstone lifetime value. (The minimum is 3 days.)
In the Modify dialog box, under Operation click Replace, click Enter, and then click Run.
http: //technet. microsoft. com/en-us/library/dd392260%28v=ws. 10%29.aspx
http: //blogs. technet. com/b/askds/archive/2009/08/27/the-ad-recycle-bin-understanding- implementing-best-practices-and-troubleshooting. aspx
 

NEW QUESTION 15
You have a Hyper-V host named Server1 that runs Windows Server 2012 R2 Datacenter. Server1 is located in an isolated network that cannot access the Internet.
On Server1, you install a new virtual machine named VM1. VM1 runs Windows Server 2012 R2 Essentials and connects to a private virtual network.
After 30 days, you discover that VM1 shuts down every 60 minutes.
You need to resolve the issue that causes VM1 to shut down every 60 minutes. What should you do?

• A. OnVM1, run slmgr.exe and specify the /ipk parameter.
• B. OnServer1, run slmgr.exe and specify the /rearm-sku parameter.
• C. Create a new internal virtual network and attach VM1 to the new virtual network.
• D. On Server1, run Add-WindowsFeatureVolumeActivation.

Answer: A

Explanation:  

NEW QUESTION 16
You network contains one Active Directory domain named contoso.com.
You deploy a new virtual machine in Microsoft Azure, and then you run the Active Directory Domain Configuration Wizard as show in the exhibit. (Click the Exhibit button.)
***Exhibit is Missing***
You need to ensure that all of the users in contoso.com are replicated to the new domain controller in Azure.
What should you do?

• A. Configure Azure Active Directory Connect.
• B. Set up directory integration.
• C. Modify the Deployment Configuration option.
• D. Select the Domain Name System (DNS) server check box.

Answer: D

Explanation:  

NEW QUESTION 17
Your network contains an Active Directory domain named contoso.com. The domain contains a member server named Server1 that has the Active Directory Federation Services server role installed. All servers run Windows Server 2012.
You complete the Active Directory Federation Services Configuration Wizard on Server1. You need to ensure that client devices on the internal network can use Workplace Join. Which two actions should you perform on Server1? (Each correct answer presents part of
the solution. Choose two.)

• A. Run Enable AdfsDeviceRegistration -PrepareActiveDirectory.
• B. Edit the multi-factor authentication global authentication policy settings.
• C. Edit the primary authentication global authentication policy settings.
• D. Run Set-AdfsProxyPropertiesHttpPort 80.
• E. Run Enable-AdfsDeviceRegistration.

Answer: CE

Explanation: * To enable Device Registration Service
On your federation server, open a Windows PowerShell command window and type: Enable-AdfsDeviceRegistration
Repeat this step on each federation farm node in your AD FS farm..
Enable seamless second factor authentication
Seamless second factor authentication is an enhancement in AD FS that provides an added level of access protection to corporate resources and applications from external devices that are trying to access them. When a personal device is Workplace Joined, it becomes a ‘known’ device and administrators can use this information to drive conditional access and gate access to resources.
To enable seamless second factor authentication, persistent single sign-on (SSO) and conditional access for Workplace Joined devices
In the AD FS Management console, navigate to Authentication Policies. Select Edit Global Primary Authentication. Select the check box next to Enable Device Authentication, and then click OK.
 

NEW QUESTION 18
Your network contains an Active Directory domain named adatum.com. The domain contains a server named CA1 that runs Windows Server 2012 R2. CA1 has the Active Directory Certificate Services server role installed and is configured to support key archival and recovery.
You need to ensure that a user named User1 can decrypt private keys archived in the Active Directory Certificate Services (AD CS) database. The solution must prevent User1 from retrieving the private keys from the AD CS database.
What should you do?

• A. Assign User1 the Issue and Manage Certificates permission to CA1.
• B. Assign User1 the Read permission and the Write permission to all certificate templates.
• C. Provide User1 with access to a Key Recovery Agent certificate and a private key.
• D. Assign User1 the Manage CA permission to CA1.

Answer: C

Explanation: http://social.technet.microsoft.com/wiki/contents/articles/7573.active-directory-certificate- services-pki-keyarchival-and-management.aspx#Protecting_Key_Recovery_Agent_Keys