NEW QUESTION 1
Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series. Information and details provided in a question apply only to that question.
Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1 that runs Windows Server 2021.
You need to create a snapshot of the Active Directory database on DC1. Which tool should you use?

• A. Dsadd quota
• B. Dsmod
• C. Active Directory Administrative Center
• D. Dsacls
• E. Dsmain
• F. Active Directory Users and Computers
• G. Ntdsutil
• H. Group Policy Management Console

Answer: E

NEW QUESTION 2
Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series.
Start of repeated scenario.
Your network contains an Active Directory domain named contoso.com. The domain contains a single site named Site1. All computers are in Site1.
The Group Policy objects (GPOs) for the domain are configured as shown in the exhibit. (Click the Exhibit button.)

The relevant users and client computer in the domain are configured as shown in the following table.

End of repeated scenario.
You plan to enforce the GPO link for A6.
Which five GPOs will apply to User1 in sequence when the user signs in to Computer1 after the link is enforced? To answer, move the appropriate GPOs from the list of GPOs to the answer area and arrange them in the correct order.

Answer:

Explanation:

NEW QUESTION 3
Your network contains an Active Directory domain named contoso.com.
The user account for a user named User1 is in an organizational unit (OU) named OU1. You need to enable User1 to sign in as user1@adatum.com.
Solution: From Windows PowerShell, You run Set-ADuser User1 –UserPrincipalName User1@Adatum.com. Does this meet the goal?

• A. Yes
• B. No

Answer: A

NEW QUESTION 4
Your company has a marketing department.
The network contains an Active Directory domain named comoso.com.
The domain contains two top-level organizational units (OUs) named MKT_Comps and MKT_Users. MKT_Comps contains the computer accounts for the computers in the marketing department. MKT_Users contains the user accounts for the users in the marketing department.
You link a new Group Policy object (GPO) named GPO1 to MKT_Comps.
You need to deploy a VPN connection to all of the users who sign in to the marketing department computers. The users must be

• A. Computer Configuration/Policies/Administrative Templates/Network/Network Connections
• B. Computer Configuration/Preferences/Control Panel Settings/Network Options
• C. User Configuration/Preferences/Control Panel Settings/Network Options
• D. User configuration/Policies/Administrative Templates/Network/Network Connections

Answer: B

NEW QUESTION 5
Your network contains an Active Directory domain named contoso.com. The domain contains an enterprise certification authority (CA) named CA1.
You duplicate the Computer certificate template, and you name the template Cont_Computers.
You need to ensure that all of the certificates issued based on Cont_Computers have a key size of 4,096 bits. What should you do?

• A. From the properties of CA1, modify the Security settings.
• B. From the properties of CA1, modify the Request Handling settings.
• C. From the properties of the Computer template, modify the Key Attestation settings.
• D. From the properties of Cont_Computers, modify the Cryptography settings.

Answer: C

NEW QUESTION 6
Your company has a marketing department.
The network contains an Active Directory domain named contoso.com.
The main office contains three domain controllers. Each branch office contains one domain controller.
You discover that new settings in the Default Domain Policy are not applied on one of the branch offices, but all other Group Policy objects (GPOs) are applied.
You need to check the replication of the Default Domain Policy for the branch Office. What should you do from a domain controller in the main office?

• A. From Windows Power Shell, run the Get-GPO Report cmdlet.
• B. From a command prompt, run repadmin.exe.
• C. From a command prompt, run dcdlage.exe.
• D. From Group Policy Management, click Default Domain Policy under Contoso.com

Answer: A

NEW QUESTION 7
Your network contains an Active Directory domain named contoso.com. The domain contains a user named User1, a group named Group1, and an Organizational unit (OU) named OU1.
You need to enable User1 to link Group Policies to OU1.
Solution: From Active Directory Administrative Center, you add User1 to Group1. From Group Policy Management, you click the Group Policy Objects container. From the Delegation tab, you add Group1.

• A. Yes
• B. No

Answer: B

NEW QUESTION 8
Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2021.
You install IP Address Management (IPAM) on Server1.
You need to manually start discovery of servers that IPAM can manage in contoso.com.
Which three cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

Answer:

Explanation: Step 1: Invoke-IpamServerProvisioning Choose a provisioning method
The Invoke-IpamGpoProvisioning cmdlet creates and links three group policies specified in the Domain parameter for provisioningrequired access settingson the server roles managed by the computer running the IP Address Management (IPAM) server.
Step 2: Add-IpamDiscoveryDomain Configure the scope of discovery
The Add-IpamDiscoveryDomain cmdlet adds an Active Directory discovery domain for an IP AddressManagement (IPAM) server. A discovery domain is a domain that IPAM searches to find infrastructure servers. An IPAM server uses the list of discovery domains to determine what type of servers to add. By default, IPAM discovers all domain controllers, Dynamic Host Configuration Protocol (DHCP) servers, and Domain Name System (DNS) servers.
Step 3: Start-ScheduledTask Start server discovery
To begin discovering servers on the network, click Start server discovery to launch the IPAM ServerDiscovery task or use the Start-ScheduledTask command.

NEW QUESTION 9
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You network contains an Active Directory forest named contoso.com. The forest contains an Active Directory
Rights Management Services (AD RMS) deployment.
Your company establishes a partnership with another company named Fabrikam, Inc. The network of Fabrikam contains an Active Directory forest named fabrikam.com and an AD RMS deployment.
You need to ensure that the users in contoso.com can access rights protected documents sent by the users in fabrikam.com.
Solution: From AD RMS in contoso.com, you configure fabrikam.com as a trusted publisher domain. Does this meet the goal?

• A. Yes
• B. No

Answer: A

NEW QUESTION 10
Your network contains an Active Directory domain named contoso.com. The domain contains a Group Policy object (GPO) named GPO1.
You configure the Internet Settings preference in GPO1 as shown in the exhibit. (Click the Exhibit button.)

A user reports that the homepage of Internet Explorer is not set to http://www.contoso.com. You confirm that the other settings in GPO1 are applied.
You need to configure GPO1 to set the Internet Explorer homepage. What should you do?

• A. Edit the GPO1 preference and press F5.
• B. Modify Security Settings for GPO1.
• C. Modify WMI Filtering for GPO1.
• D. Modify the GPO1 preference to use item-level targeting.

Answer: A

Explanation: The red dotted line under the homepage URL means that setting is disabled. Pressing F5 enables all settings.

NEW QUESTION 11
Your network contains an Active Directory domain named contoso.com. All the accounts of the users in the sales department are in an organizational unit (OU) named SalesOU.
An application named App1 is deployed to the user accounts in SalesOU by using a Group Policy object (GPO) named Sales GPO.
You need to set the registry value of HKEY_CURRENT_USERSoftwareApp1Collaboration to 0. Solution: You add a computer preference that has a Replace action.
Does this meet the goal?

• A. Yes
• B. NO

Answer: A

NEW QUESTION 12
You network contains an Active Directory domain named contoso.com. The domain contains 1,000 desktop computers and 500 laptops. An organizational unit (OU) named OU1 contains the computer accounts for the desktop computers and the laptops.
You create a Windows PowerShell script named Script1.ps1 that removes temporary files and cookies. You create a Group Policy object (GPO) named GPO1 and link GPO1 to OU1.
You need to run the script once weekly only on the laptops. What should you do?

• A. In GPO1, create a File preference that uses item-level targeting.
• B. In GPO1, create a Scheduled Tasks preference that uses item-level targeting.
• C. In GPO1, configure the File System security polic
• D. Attach a WMI filter to GPO1.
• E. In GPO1, add Script1.ps1 as a startup scrip
• F. Attach a WMI filter to GPO1.

Answer: B

NEW QUESTION 13
Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other
questions in this series. Information and details provided in a question apply only to that question.
Your network contains an Active Directory domain named contoso.com. The domain functional level is Windows Server 2012 R2.
Your company hires a new security administrator to manage sensitive user data. You create a user account named Security1 for the security administrator.
You need to ensure that the password for Security1 has at least 12 characters and is modified every 10 days. The solution must apply to Security1 only.
Which tool should you use?

• A. Dsadd quota
• B. Dsmod
• C. Active Directory Administrative Center
• D. Dsacls
• E. Dsmain
• F. Active Directory Users and Computers
• G. Ntdsutil
• H. Group Policy Management Console

Answer: F

NEW QUESTION 14
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You deploy a new Active Directory forest.
You need to ensure that you can create a group Managed Service Account (gMSA) for multiple member
servers.
Solution: From Windows PowerShell on a domain controller, you run the Add-KdsRootKey cmdlet.
Does this meet the goal?

• A. Yes
• B. No

Answer: A

NEW QUESTION 15
Your network contains an Active Directory domain named contoso.com, All users are in an organizational unit (OU) named Corp_Users.
You plan to modify the description of all the users who have a string of 514 in their mobile phone number. You need to view a list of the users that will be modified.
What should you run?

• A. Get-APUser-Filter "mobilePhone-Like '*514*'"
• B. Get-ADOrganizationalUnit-LDAPFilter "(mobilePhone='*514*')"
• C. Get-ADOrganizationalUnit-Filter "mobilePhone-Like '*514* "'
• D. Get-ADUser-LDAPFilter "(mobilePhone='*514*)"

Answer: A

NEW QUESTION 16
You have an offline root certification authority (CA) named CA1. CA1 is hosted on a virtual machine. You only turn on CA1 when the CA must be patched or you must generate a key for subordinate CAs. You start CA1, and you discover that the filesystem is corrupted.
You resolve the filesystem corruption and discover that you must reload the CA root from a backup.
When you attempt to run the Restore-CARoleService cmdlet, you receive the following error message: “The process cannot access the file because it is being used by another process.”

• A. Stop the Active Directory Domain Services (AD DS) service.
• B. Run the Restore-CARoleService cmdlet and specify the path to a valid CA key.
• C. Stop the Active Directory Certificate Services (AD CS) service.
• D. Run the Restore-CARoleService cmdlet and specify the Force parameter.

Answer: C

NEW QUESTION 17
Your network contains an Active Directory domain named contoso.com. The domain contains an Active Directory Federation Services (AD FS) server named Server1.
On a standalone server named Server2. You install and configure the Web Application Proxy.
You have an internal web application named WebApp1. AD FS has a replying party trust for WebApp1. You need to provide external users with access to WebApp1. Authentication to WebApp1, must use AD FS
preauthentication.
Which tool should you use to publish webapp1?

• A. Remote Access Management on Server2
• B. AD FS Management on Server2
• C. Routing and Remote Access on Server1
• D. Remote Access Management on Server1
• E. AD FS Management on Server1

Answer: E

NEW QUESTION 18
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory forest named contoso.com. The forest contains a member server named Server1 that runs Windows Server 2021. All domain controllers run Windows Server 2012 R2.
Contoso.com has the following configuration. PS C:> (Get-ADForest).ForestMode Windows2008R2Forest
PS C:> (Get-ADDomain).DomainMode
Windows2008R2Domain PS C:>
You plan to deploy an Active Directory Federation Services (AD FS) farm on Server1 and to configure device registration.
You need to configure Active Directory to support the planned deployment. Solution: You upgrade a domain controller to Windows Server 2021.
Does this meet the goal?

• A. Yes
• B. No

Answer: B

Explanation: Device Registration requires Windows Server 2012 R2 forest schema.