[2021-New] Microsoft 70-412 Dumps With Update Exam Questions (131-140)

70-412 Dumps

70-412 Exam Questions - Online Test

70-412 Premium VCE File

Learn More 100% Pass Guarantee - Dumps Verified - Instant Download
150 Lectures, 20 Hours

Q1. Your company has offices in Montreal, New York, and Amsterdam.

The network contains an Active Directory forest named contoso.com. An Active Directory site exists for each office. All of the sites connect to each other by using the DEFAULTIPSITELINK site link.

You need to ensure that only between 20:00 and 08:00, the domain controllers in the Montreal office replicate the Active Directory changes to the domain controllers in the Amsterdam office.

The solution must ensure that the domain controllers in the Montreal and the New York offices can replicate the Active Directory changes any time of day.

What should you do?

A. Create a new site link that contains Montreal and Amsterdam. Remove Amsterdam from DEFAULTIPSITE1INK. Modify the schedule of DEFAULTIPSITELINK.

B. Create a new site link that contains Montreal and Amsterdam. Create a new site link bridge. Modify the schedule of DEFAULTIPSITELINK.

C. Create a new site link that contains Montreal and Amsterdam. Remove Amsterdam from DEFAULTIPSITELINK. Modify the schedule of the new site link.

D. Create a new site link that contains Montreal and Amsterdam. Create a new site link bridge. Modify the schedule of the new site link.

Answer: C

Explanation:

We create a new site link between Montreal and Amsterdam and schedule it only between

20:00 and 08:00. To ensure that traffic between Montreal and Amsterdam only occurs at this time we also remove Amsterdam from the DEFAULTIPSITELINK.

Reference: How Active Directory Replication Topology Works

http://technet.microsoft.com/en-us/library/cc755994(v=ws.10).aspx

Q2. Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2 and has the DHCP Server server role installed.

An administrator installs the IP Address Management (IPAM) Server feature on a server named Server2. The administrator configures IPAM by using Group Policy based provisioning and starts server discovery.

You plan to create Group Policies for IPAM provisioning.

You need to identify which Group Policy object (GPO) name prefix must be used for IPAM Group Policies.

What should you do on Server2?

A. From Server Manager, review the IPAM overview.

B. Run the ipamgc.exe tool.

C. From Task Scheduler, review the IPAM tasks.

D. Run the Get-IpamConfiguration cmdlet.

Answer: D

Explanation:

Example:

http://i.imgur.com/YcHLXhr.jpg

Q3. You have 20 servers that run Windows Server 2012 R2.

You need to create a Windows PowerShell script that registers each server in Windows Azure Backup and sets an encryption passphrase.

Which two PowerShell cmdlets should you run in the script? (Each correct answer presents part of the solution. Choose two.)

A. New-OBPolicy

B. New-OBRetentionPolicy

C. Add-OBFileSpec

D. Start-OBRegistration

E. Set OBMachineSetting

Answer: D,E

Explanation:

D. Start-OBRegistration Registers the current computer with Windows Azure Online Backup using the credentials (username and password) created during enrollment.

E. The Set-OBMachineSetting cmdlet sets a OBMachineSetting object for the server that includes proxy server settings for accessing the internet, network bandwidth throttling settings, and the encryption passphrase that is required to decrypt the files during recovery to another server.

Incorrect:

Not C. TheAdd-OBFileSpeccmdlet adds theOBFileSpecobject, which specifies the items to

include or exclude from a backup, to the backup policy (OBPolicyobject).

TheOBFileSpecobject can include or exclude multiple files, folders, or volumes. T Reference: Start-OBRegistration; Set OBMachineSetting http://technet.microsoft.com/en-us/library/hh770398.aspx http://technet.microsoft.com/en-us/library/hh770409.aspx

Q4. Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2. Both servers have the Hyper-V server role installed.

You plan to replicate virtual machines between Server1 and Server2. The replication will be encrypted by using Secure Sockets Layer (SSL).

You need to request a certificate on Server1 to ensure that the virtual machine replication is encrypted.

Which two intended purposes should the certificate for Server1 contain? (Each correct answer presents part of the solution. Choose two.)

A. Client Authentication

B. Kernel Mode Code Signing

C. Server Authentication

D. IP Security end system

E. KDC Authentication

Answer: A,C

Explanation:

You need to use certificate-based authentication if you want transmitted data to be encrypted.

Replica Server Certificate Requirements

To enable a server to receive replication traffic, the certificate in the replica server must meet the following conditions

* Enhanced Key Usage must support both Client and Server authentication

Etc.

Reference: Hyper-V Replica - Prerequisites for certificate based deployments

http://blogs.technet.com/b/virtualization/archive/2012/03/13/hyper-v-replica-certificate-requirements.aspx

Q5. Your network contains an Active Directory domain named contoso.com. The domain

contains a certification authority (CA).

You suspect that a certificate issued to a Web server is compromised.

You need to minimize the likelihood that users will trust the compromised certificate.

Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

A. Stop the Certificate Propagation service.

B. Modify the validity period of the Web Server certificate template.

C. Run certutil and specify the -revoke parameter.

D. Run certutil and specify the -deny parameter.

E. Publish the certificate revocation list (CRL).

Answer: C,E

Explanation: First revoke the certificate, then publish the CRL.

Q6. Your network contains an Active Directory forest named contoso.com. The forest contains three domains. All domain controllers run Windows Server 2012 R2.

The forest has a two-way realm trust to a Kerberos realm named adatum.com.

You discover that users in adatum.com can only access resources in the root domain of contoso.com.

You need to ensure that the adatum.com users can access the resources in all of the domains in the forest.

What should you do in the forest?

A. Delete the realm trust and create a forest trust.

B. Delete the realm trust and create three external trusts.

C. Modify the incoming realm trust.

D. Modify the outgoing realm trust.

Answer: D

Explanation:

* A one-way, outgoing realm trust allows resources in your Windows Server domain (the domain that you are logged on to at the time that you run the New Trust Wizard) to be accessed by users in the Kerberos realm.

* You can establish a realm trust between any non-Windows Kerberos version 5 (V5) realm and an Active Directory domain. This trust relationship allows cross-platform interoperability with security services that are based on other versions of the Kerberos V5 protocol, for example, UNIX and MIT implementations. Realm trusts can switch from nontransitive to transitive and back. Realm trusts can also be either one-way or two-way.

Reference: Create a One-Way, Outgoing, Realm Trust

Q7. You have a server named Server1 that runs Windows Server 2012 R2.

From Server Manager, you install the Active Directory Certificate Services server role on Server1.

A domain administrator named Admin1 logs on to Server1.

When Admin1 runs the Certification Authority console, Admin1 receive the following error message.

You need to ensure that when Admin1 opens the Certification Authority console on Server1, the error message does not appear.

What should you do?

A. Install the Active Directory Certificate Services (AD CS) tools.

B. Run the regsvr32.exe command.

C. Modify the PATH system variable.

D. Configure the Active Directory Certificate Services server role from Server Manager.

Answer: D

Explanation:

The error message is related to missing role configuration.

* Cannot Manage Active Directory Certificate Services Resolution: configure the two Certification Authority and Certification Authority Web Enrollment Roles:

image

Reference: Cannot manage Active Directory Certificate Services in Server 2012 Error 0x800070002

Q8. Your network contains two Active Directory forests named contoso.com and adatum.com.

Contoso.com contains one domain. Adatum.com contains a child domain named child.adatum.com.

Contoso.com has a one-way forest trust to adatum.com. Selective authentication is enabled on the forest trust.

Several user accounts are migrated from child.adatum.com to adatum.com.

Users report that after the migration, they fail to access resources in contoso.com. The users successfully accessed the resources in contoso.com before the accounts were migrated.

You need to ensure that the migrated users can access the resources in contoso.com.

What should you do?

A. Replace the existing forest trust with an external trust.

B. Run netdom and specify the /quarantine attribute.

C. Disable SID filtering on the existing forest trust.

D. Disable selective authentication on the existing forest trust.

Answer: C

Explanation:

Security Considerations for Trusts Need to gain access to the resources in contoso.com

Disabling SID Filter Quarantining on External Trusts Although it reduces the security of your forest (and is therefore not recommended), you can disable SID filter quarantining for an external trust by using the Netdom.exe tool. You should consider disabling SID filter quarantining only in the following situations:

* Users have been migrated to the trusted domain with their SID histories preserved, and

you want to grant them access to resources in the trusting domain based on the SID history

attribute.

Etc.

Incorrect:

Not B. Enables administrators to manage Active Directory domains and trust relationships

from the command prompt, /quarantine Sets or clears the domain quarantine.

Not D. Selective authentication over a forest trust restricts access to only those users in a

trusted forest who have been explicitly given authentication permissions to computer

objects (resource computers) that reside in the trusting forest.

Reference: Security Considerations for Trusts

http://technet.microsoft.com/en-us/library/cc755321(v=ws.10).aspx

Q9. Your network contains an Active Directory forest. The forest contains one domain named contoso.com. The domain contains three domain controllers. The domain controllers are configured as shown in the following table.

DC1 has all of the operations master roles installed.

You transfer all of the operations master roles to DC2, and then you uninstall Active Directory from DC1.

You need to ensure that you can use Password Settings objects (PSOs) in the domain.

What should you do?

A. Change the domain functional level.

B. Upgrade DC2.

C. Run the dcgpofix.exe command.

D. Transfer the schema master role.

Answer: A

Explanation:

The domain functional level must be Windows Server 2008 to use PSO's

Requirements and special considerations for fine-grained password and account lockout policies:

* Domain functional level: The domain functional level must be set to Windows Server 2008

or higher.

Etc.

Incorrect:

Not B. DC2 is also Windows Server 2008.

Not C. Recreates the default Group Policy Objects (GPOs) for a domain

Not D. Schema isn't up to right level

Reference: AD DS: Fine-Grained Password Policies

http://technet.microsoft.com/en-us/library/cc770394(v=ws.10).aspx

Q10. Your network contains an Active Directory domain named contoso.com. The domain contains two member servers named Server1 and Server2. All servers run Windows Server 2012 R2.

Server1 and Server2 have the Failover Clustering feature installed. The servers are configured as nodes in a failover cluster named Cluster1. Cluster1 contains a Clustered Shared Volume (CSV).

A developer creates an application named App1. App1 is NOT a cluster-aware application. App1 stores data in the file system.

You need to ensure that App1 runs in Cluster1. The solution must minimize development effort.

Which cmdlet should you run?

A. Add-ClusterServerRole

B. Add-ClusterGenericServiceRole

C. Add ClusterScaleOutFileServerRole

D. Add ClusterGenericApplicationRole

Answer: D

Explanation:

Add-ClusterGenericApplicationRole

Configure high availability for an application that was not originally designed to run in a

failover cluster.

If you run an application as a Generic Application, the cluster software will start the

application, then periodically query the operating system to see whether the application

appears to be running. If so, it is presumed to be online, and will not be restarted or failed

over.

EXAMPLE 1.

Command Prompt: C:\PS>

Add-ClusterGenericApplicationRole -CommandLine NewApplication.exe

Name OwnerNode State

cluster1GenApp node2 Online Description

This command configures NewApplication.exe as a generic clustered application. A default name will be used for client access and this application requires no storage.

Reference: Add-ClusterGenericApplicationRole

http://technet.microsoft.com/en-us/library/ee460976.aspx