NEW QUESTION 1
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory domain named contoso.com. A user named User1 is in an organizational unit (OU) named OU1.
You need to enable User1 to sign in as user1@adatum.com.
You need a list of groups to which User1 is either a direct member or an indirect member.
Solution: From Windows PowerShell, you run Set -Aduser User1 -UserPricncipalName User1@Adatum.com. Does this meet the goal?

• A. Yes
• B. No

Answer: B

NEW QUESTION 2
Your network contains an Active Directory forest. The forest contains two domains named contoso.com and fabrikam.com. The functional level of the forest and the domains is Windows Server 2008 R2.
You have a global group named Group1 in the contoso.com domain. Group1 contains the user accounts in contoso.com. You need to ensure that you can add the user accounts in the fabrikam.com domain to Group1. What should you do?

• A. Run the Set-LocalGroup cmdlet.
• B. Assign the Domain Controllers group in fabrikam.com permissions to Group1
• C. Modify the scope of Group1 to Domain local.
• D. Change Group1 to a distribution group.

Answer: C

NEW QUESTION 3
Your network contains an Active Directory forest named contoso.com. All domain controllers run Windows Server 2012 R2. You deploy a new server named Server1 that runs Windows Server 2021.
A server administrator named ServerAdmin01 is a member of the Domain users group. You add ServerAdmin01 to the Administrators group on Server1.
ServerAdmin01 signs in to Server1 and successfully configures a new Active Directory flights Management Services (AD RMS) cluster.
You need to ensure that clients can discover the AD RMS cluster by querying Active Directory. What should you do?

• A. Register a Service Connection Point (SCP).
• B. Modify the Security settings of the computer account of Server1.
• C. Update the Active Directory schema.
• D. Upgrade one domain controller to Windows Server 2021.

Answer: A

NEW QUESTION 4
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a server named Web1 that runs Windows Server 2021.
You need to list all the SSL certificates on Web1 that will expire during the next 60 days. Solution: You run the following command.
Get-ChildItem Cert:LocalMachineTrust |? { $_.NotAfter –It (Get-Date).AddDays( 60 ) }

Does this meet the goal?

• A. Yes
• B. No

Answer: A

NEW QUESTION 5
Your network contains an Active Directory domain.
You have a user account that is a member if the Domain Admins group.
You have 100 laptops that have a standard corporate image installed. The laptops are in workgroups and have random names.
A technician named Tech1 is assigned the task of joining the laptops to the domain. The computer accounts of each laptop must be in an organizational unit (OU) that is associated to the department of the user who will use the laptop. The laptop names must start with four characters indicating the department, followed by a fourdigit number.
Tech1 is a member of the Domain Users group only. Tech1 has the administrator logon credentials for all the laptops.
You need Tech1 to join the laptops to the domain. The solution must ensure that the laptops are named correctly, and the computer accounts of the laptops are in the correct OUs.
Solution: You pre-create the computer account of each laptop in Active Directory Users and Computers.
You instruct Tech1 to sign in to each laptop, to rename each laptop, and then to join each laptop to the domain by using System in Control Panel.
Does this meet the goal?

• A. Yes
• B. No

Answer: B

NEW QUESTION 6
Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2 that run Windows Server 2021.
Server1 has IP Address Management (IPAM) installed. Server2 has Microsoft System Center 2021 Virtual Machine Manager (VMM) installed.
You need to integrate IPAM and VMM.
Which types of objects should you create on each server? To answer, drag the appropriate object types to the correct servers. Each object type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Answer:

Explanation: Server 1 (IPAM): Access Policy
VMM must be granted permission to view and modify IP address space in IPAM, and to perform remote management of the IPAM server. VMM uses a “Run As” account to provide these permissions to the IPAM network service plugin. The “Run As” account must be configured with appropriate permission on the IPAM server.
To assign permissions to the VMM user account
In the IPAM server console, in the upper navigation pane, click ACCESS CONTROL, right-click Access Policies in the lower navigation pane, and then click Add AccessPolicy.
Etc.
Server 2 (VMM) #1: Network Service Server 2 (VMM) #2: Run As Account
Perform the following procedure using the System Center VMM console. To configure VMM (see step 1-3, step 6-7)

Etc.
References: https://technet.microsoft.com/en-us/library/dn783349(v=ws.11).aspx

NEW QUESTION 7
Your network contains an Active Directory domain. All client computers run Windows 10.
A client computer named Computer1 was in storage for five months and was unused during that time. You attempt to sign in to the domain from Computer1 and receive an error message.
You need to ensure that you can sign in to the domain from Computer1. What should you do?

• A. Unjoin Computer1 from the domain, and then join the computer to the domain.
• B. From Active Directory Administrative Center, reset the computer account of Computer1.
• C. From Active Directory Administrative Center, disable Computer1, and then enable the computer account of Computer1.
• D. From Active Directory Users and Computers, run the Delegation of Control Wizard.

Answer: B

NEW QUESTION 8
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2021. The computer account for Server1 is in organizational unit (OU) named OU1.
You create a Group Policy object (GPO) named GPO1 and link GPO1 to OU1.
You need to add a domain user named User1 to the local Administrators group on Server1.
Solution: From the Computer Configuration node of GPO1, you configure the Local Users and Groups preference.
Does this meet the goal?

• A. Yes
• B. No

Answer: A

NEW QUESTION 9
Your network contains an Active Directory domain named contoso.com.
A user named User1 and a computer named Conputer1 are in an organizational unit OU1. A user named User2 and a computer named Computer 2 are in an OU named OU2.
A Group Policy object (GPO) named GPO1 is linked to the domain. GPO1 contains a user preference that is configured as shown in the Shortcut1 Properties exhibit. (Click the Exhibit button.)

Item-level targeting for the user preference is configured as shown in the Targeting exhibit. (Click the Exhibit button.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Answer:

Explanation: References:
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc73075

NEW QUESTION 10
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You deploy a new Active Directory forest.
You need to ensure that you can create a group Managed Service Account (gMSA) for multiple member servers.
Solution: You configure Kerberos constrained delegation on the computer account of each member server. Does this meet the goal?

• A. Yes
• B. No

Answer: B

NEW QUESTION 11
Your network contains an Active Directory domain. The domain contains a domain controller named DC1 that runs Windows Server 2021.
You start DC1 in Directory Services Restore Mode (DSRM). You need to compact the Active Directory database on DC1. Which three action should you perform in sequence?

Answer:

Explanation: https://technet.microsoft.com/en-us/library/cc794920(v=ws.10).aspx

NEW QUESTION 12
Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2021.
Server1 has IP Address Management (IPAM) installed. IPAM is configured to use the Group Policy based provisioning method. The prefix for the IPAM Group Policy objects (GPOs) is IP.
From Group Policy Management, you manually rename the IPAM GPOs to have a prefix of IPAM. You need to modify the GPO prefix used by IPAM.
What should you do?

• A. Click Configure server discovery in Server Manager.
• B. Run the Set-IpamConfiguration cmdlet.
• C. Run the Invoke-IpamGpoProvisioning cmdlet.
• D. Click Provision the IPAM server in Server Manager.

Answer: B

Explanation: The Set-IpamConfiguration cmdlet modifies the configuration for the computer that runs the IPAM server. The -GpoPrefix<String> parameter specifies the unique Group Policy object (GPO) prefix name that IPAM
uses to create the group policy objects. Use this parameter only when the value of the ProvisioningMethod parameter is set to Automatic.
References: https://technet.microsoft.com/en-us/library/jj590816.aspx

NEW QUESTION 13
Your network contains an Active Directory forest. The forest contains a domain named contoso.com. The domain contains three domain controllers.
A domain controller named lon-dc1 fails. You are unable to repair lon-dc1.
You need to prevent the other domain controllers from attempting to replicate to lon-dc1.
Solution: From Active Directory Sites and Trusts, you transfer the operations master roles from lon-dc1. Does this meet the goal?

• A. Yes
• B. NO

Answer: B

NEW QUESTION 14
Your network contains an Active Directory domain named contoso.com.
You need to create a central store for Group Policy administrative templates. What should you use?

• A. Server Manager
• B. File Explorer
• C. Dcgpofix.exe
• D. Group Policy Management Console (GPMC)

Answer: B

NEW QUESTION 15
Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series.
Information and details provided in a question apply only to that question.
Your network contains an Active Directory domain named contoso.com. The domain contains 5,000 user accounts.
You have a Group Policy object (GPO) named DomainPolicy that is linked to the domain and a GPO named DCPolicy that is linked to the Domain Controllers organizational unit (OU).
You need to use the application control policy settings to prevent several applications from running on the network.
What should you do?

• A. From the Computer Configuration node of DCPolicy, modify Security Settings.
• B. From the Computer Configuration node of DomainPolicy, modify Security Settings.
• C. From the Computer Configuration node of DomainPolicy, modify Administrative Templates.
• D. From the User Configuration node of DCPolicy, modify Security Settings.
• E. From the User Configuration node of DomainPolicy, modify Folder Redirection.
• F. From user Configuration node of DomainPolicy, modify Administrative Templates.
• G. From Preferences in the User Configuration node of DomainPolicy, modify Windows Settings.
• H. From Preferences in the Computer Configuration node of DomainPolicy, modify Windows Settings.

Answer: B

NEW QUESTION 16
Your network contains an Active Directory domain named contoso.com. You discover that users can use passwords that contain only numbers.
You need to ensure that all the user passwords in the domain contain at least three of the following types of characters:
• Numbers
• Uppercase letters
• Lowercase letters
• Special characters What should you do?

• A. the Default Domain Policy
• B. the local policy on each client computer
• C. the Default Domain Controllers Policy
• D. the local policy on each domain controller

Answer: A

NEW QUESTION 17
Your network contains an Active Directory domain named adatum.com. The domain contains a security group named G_Research and an organizational unit (OU) named OU_Research.
All the users in the research department are members of G_Research and their user accounts are in OU_Research.
You need to ensure that all the research department users change their password every 28 days and enforce a complex password that is characters long.
What should you do?

• A. From Group Policy Management, create and link a Group Policy object (GPO) to the domai
• B. Modify the password policy in the GPO Filter the GPO to apply to G_Research only.
• C. From Active Directory Administrative Center, create a new Password Settings object (PSO).
• D. From Active Directory Users and Computers, modify the properties of the Password Settings Container.
• E. From Group Policy Management, create and link a Group Policy object (GPO) to OU_Researc
• F. Modify the password policy in the GPO.

Answer: C

NEW QUESTION 18
Your network contains an Active Directory forest.
Some users report experiencing difficulties signing in to domain controllers. You suspect that the service location (SRV) records might be causing the issue.
What are two possible commands that you can run to verify the SRV records? Each correct answer presents a complete solution.
NOTE. Each correct selection is worth one point.

• A. dcdiag.exe /test:connectivity
• B. dnscmd /info
• C. dnscmd /DirectoryPartitionInfo
• D. dcdiag.exe /test:dns /DnsRecordRegistration
• E. dcdiag.exe /test:dns
• F. dnscmd /IPValidate

Answer: BD

Explanation: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/troubleshoot/verify-dns-functionality-to