New Version Dumps Of Exam 70-411 With Free Update (Part D)

Administering Windows Server 2012 R2 Exam (Version: 13.39)

Get Latest & Actual 70-411 Exam's Question and Answers from PassLeader. http://www.passleader.com/70-411.html

1

QUESTION 61 Your network contains an Active Directory domain named contoso.com. You need to audit access to removable storage devices. Which audit category should you configure? To answer, select the appropriate category in the answer area.

Answer:

Explanation: Advanced Security Auditing Options - Configure Object Access > Audit Removable storage http://technet.microsoft.com/en-us/library/jj574128.aspx QUESTION 62 Your network contains an Active Directory domain named adatum.com. You need to audit changes to the files in the SYSVOL shares on all of the domain controllers. The solution must minimize the amount of SYSVOL replication traffic caused by the audit. Which two settings should you configure? (Each correct answer presents part of the solution.

http://www.passleader.com/70-411.html





2

Choose two.)

A. Audit Policy\Audit system events

B. Advanced Audit Policy Configuration\DS Access

C. Advanced Audit Policy Configuration\Global Object Access Auditing

D. Audit Policy\Audit object access

E. Audit Policy\Audit directory service access

F. Advanced Audit Policy Configuration\Object Access

Answer: DF Explanation: http://technet.microsoft.com/en-us/library/dd772690(v=ws.10).aspx QUESTION 63 Your network contains an Active Directory domain named contoso.com. You have several Windows PowerShell scripts that execute when client computers start. When a client computer starts, you discover that it takes a long time before users are prompted to log on. You need to reduce the amount of time it takes for the client computers to start. The solution must not prevent scripts from completing successfully. Which setting should you configure? To answer, select the appropriate setting in the answer area.

Answer:






3

Explanation: Lets the system run startup scripts simultaneously rather than waiting for each to finish http://technet.microsoft.com/en-us/library/cc939423.aspx QUESTION 64 Drag and Drop Question You are a network administrator of an Active Directory domain named contoso.com. You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Web Server (IIS) server role installed. Server1 will host a web site at URL https:// secure.contoso.com. The application pool identity account of the web site will be set to a domain user account named AppPool1. You need to identify the setspn.exe command that you must run to configure the appropriate Service Principal Name (SPN) for the web site. What should you run? To answer, drag the appropriate objects to the correct location. Each object may be used once, more than once, or not at all.

Answer:






4

Explanation: Note: * -s <SPN> Adds the specified SPN for the computer, after verifying that no duplicates exist. Usage: setspn -s SPN accountname For example, to register SPN "http/daserver" for computer "daserver1": setspn -S http/daserver daserver1 http://technet.microsoft.com/en-us/library/cc731241(v=ws.10).aspx QUESTION 65 Your network contains an Active Directory domain named contoso.com. You deploy a web-based application named App1 to a server named Server1. App1 uses an application pool named AppPool1. AppPool1 uses a domain user account named User1 as its identity. You need to configure Kerberos constrained delegation for User1. Which three actions should you perform? To answer, move the three appropriate actions from the list of actions to the answer area and arrange them in the correct order

Answer:






5

Explanation: First answer should be "setspn -L" - to check for SPNs of User1. After that we should add HTTP SPN for User1 "setspn -s" so delegation tab appears and we can select "Trust this user for delegation to specified services only" http://support.microsoft.com/kb/929650/en-us http://technet.microsoft.com/pt-pt/library/cc755413%28v=ws.10%29.aspx

QUESTION 66 Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2. The domain contains 500 client computers that run Windows 8 Enterprise. You implement a Group Policy central store. You have an application named Appl. Appl requires that a custom registry setting be deployed to all of the computers. You need to deploy the custom registry setting. The solution must minimize administrator effort. What should you configure in a Group Policy object (GPO)?

A. The Administrative Templates

B. An application control policy

C. The Group Policy preferences

D. Software installation setting

Answer: C Explanation: http://technet.microsoft.com/es-es/library/hh125923%28v=WS.10%29.aspx http://technet.microsoft.com/en-us/library/gg699429.aspx http://www.unidesk.com/blog/gpos-set-custom-registry-entries-virtual-desktops-disabling-machine- password http://technet.microsoft.com/en-us/library/cc784044%28v=ws.10%29.aspx






6

QUESTION 67 Your network contains an Active Directory domain called contoso.com. The domain contains a domain controller named DC1 that runs Windows Server 2012 R2. The domain contains some test client computers that run either Windows XP, Windows Vista, Windows 7, or Windows 8. The computer accounts for the test computers are located in an organizational unit (OU) named OU1. You have a Group Policy object (GPO) named GPO1 linked to OU1. GPO1 is used to assign several applications to the test computers. You need to ensure that when the test computers in OU1 restart, you can see which application installation is running currently. Which setting should you modify in GPO1? To answer, select the appropriate setting in the answer area.

Answer:






7

Explanation: Allows you to receive verbose startup, shutdown, logon, and logoff status messages. Verbose status messages may be helpful when you are troubleshooting slow startup, shutdown, logon, or logoff behavior. http://support.microsoft.com/kb/325376 QUESTION 68 Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1 that runs Windows Server 2012 R2. You create an Active Directory snapshot of DC1 each day. You need to view the contents of an Active Directory snapshot from two days ago. What should you do first?

A. Run the dsamain.exe command.

B. Stop the Active Directory Domain Services (AD DS) service.

C. Run the ntdsutil.exe command.

D. Start the Volume Shadow Copy Service (VSS).

Answer: A QUESTION 69 Your network contains an Active Directory domain named adatum.com. All domain controllers run Windows Server 2012 R2. The domain contains a virtual machine named DC2. On DC2, you run Get-ADDCCloningExcludedApplicationList and receive the output shown in the following table.






8

You need to ensure that you can clone DC2. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

A. Create an empty file named CustomDCClonesAllowList.xml

B. Add the following information to the DCCloneConfigSchema.xsd <AllowList> <Allow>

<Name>App1</Name>

<Type>Service</Type>

</Allow>

</AllowList>

C. Create a filename DCCloneConfig.xml that contains the following information <AllowList>

<Allow>

<Name>App1</Name>


</Allow>

</AllowList>

D. Create a filename CustomDCCloneAllowList.xml that contains the following information <AllowList>

<Allow>

<Name>App1</Name>


</Allow>

</AllowList>

E. Create an empty file named DCCloneConfig.xml

Answer: DE Explanation: D: Run Get-ADDCCloningExcludedApplicationList cmdlet In this procedure, run the Get-ADDCCloningExcludedApplicationList cmdlet on the source virtualized domain controller to identify any programs or services that are not evaluated for cloning. You need to run the Get-ADDCCloningExcludedApplicationList cmdlet before the New-ADDCCloneConfigFile cmdlet because if the New-ADDCCloneConfigFile cmdlet detects an excluded application, it will not create a DCCloneConfig.xml file. To identify applications or services that run on a source domain controller which have not been evaluated for cloning 1. On the source domain controller (VirtualDC1), click Server Manager, click Tools, click Active Directory Module for Windows PowerShell and then type the following command: Get-ADDCCloningExcludedApplicationList 2. Vet the list of the returned services and installed programs with the software vendor to determine whether they can be safely cloned. If applications or services in the list cannot be safely cloned, you must remove them from the source domain controller or cloning will fail. 3. For the set of services and installed programs that were determined to be safely cloned, run the

command again with the 璆enerateXML switch to provision these services and programs in the

CustomDCCloneAllowList.xml file. Get-ADDCCloningExcludedApplicationList -GenerateXml E: The clone domain controller will be located in the same site as the source domain controller unless a different site is specified in the DCCloneConfig.xml file. Note: * The Get-ADDCCloningExcludedApplicationList cmdlet searches the local domain controller for programs and services in the installed programs database, the services control manager that are not specified in the default and user defined inclusion list. The applications in the resulting list can be added to the user defined exclusion list if they are determined to support cloning. If the






9

applications are not cloneable, they should be removed from the source domain controller before the clone media is created. Any application that appears in cmdlet output and is not included in the user defined inclusion list will force cloning to fail. * The Get-ADDCCloningExcludedApplicationList cmdlet needs to be run before the New- ADDCCloneConfigFile cmdlet is used because if the New-ADDCCloneConfigFile cmdlet detects an excluded application, it will not create a DCCloneConfig.xml file. * DCCloneConfig.xml is an XML configuration file that contains all of the settings the cloned DC will take when it boots. This includes network settings, DNS, WINS, AD site name, new DC name and more. This file can be generated in a few different ways. The New-ADDCCloneConfig cmdlet in PowerShell By hand with an XML editor By editing an existing config file, again with an XML editor (Notepad is not an XML editor.) Reference: Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100) QUESTION 70 Your network contains an Active Directory domain named contoso.com. The domain contains a member server named Server1. Server1 has the Web Server (IIS) server role installed. On Server1, you install a managed service account named Service1. You attempt to configure the World Wide Web Publishing Service as shown in the exhibit. (Click the Exhibit button.) You receive the following error message: "The account name is invalid or does not exist, or the password is invalid

for the account name specified."

You need to ensure that the World Wide Web Publishing Service can log on by using the managed service account. What should you do?

A. Specify contoso\service1$ as the account name.






10

B. Specify [email protected] as the account name.

C. Reset the password for the account.

D. Enter and confirm the password for the account.

Answer: A Explanation: A. There must be a dollar sign ($) at the end of the account name in the Services snap-in console. When you use the Services snap-in console, the SeServiceLogonRight logon right is automatically assigned to the account. If you use the Sc.exe tool or APIs to configure the account, the account has to be explicitly granted this right by using tools such as the Security Policy snap-in, Secedit.exe, or NTRights.exe. B. Logon right not automatically granted C. Not a password issue "I assume" not exhibit present D. Password not needed when using MSA http://technet.microsoft.com/en-us/library/dd548356(v=ws.10).aspx http://blogs.technet.com/b/askds/archive/2009/09/10/managed-service-accounts-understanding- implementingbest-practices-and-troubleshooting.aspx QUESTION 71 Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2. You pre-create a read-only domain controller (P.QDC) account named RODC1. You export the settings of RODC1 to a file named File1.txt. You need to promote RODC1 by using File1.txt. Which tool should you use?

A. The Dcpromo command

B. The Install-WindowsFeature cmdlet

C. The Install-ADDSDomainController cmdlet

D. The Add-WindowsFeature cmdlet

E. The Dism command

Answer: A Explanation: http://technet.microsoft.com/en-us/library/jj574152.aspx If you have experience creating read-only domain controllers, you will discover that the installation wizard has the same graphical interface as seen when using the older Active Directory Users and Computers snap-in from Windows Server 2008 and uses the same code, which includes exporting the configuration in the unattend file format used by the obsolete dcpromo." "The Summary dialog enables you to confirm your settings. This is the last opportunity to stop the installation before the wizard creates the staged account. Click Next when you are ready to create the staged RODC computer account. Click Export Settings to save an answer file in the obsolete dcpromo unattend file format." QUESTION 72 Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2008 R2. The domain contains three servers that run Windows Server 2012 R2.






11

Server1 and Server2 are configured in a Network Load Balancing (NLB) cluster. The NLB cluster hosts a website named Web1 that uses an application pool named App1. Web1 uses a database named DB1 as its data store. You create an account named User1. You configure User1, as the identity of App1. You need to ensure that contoso.com domain users accessing Web1 connect to DB1 by using their own credentials. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

A. Configure the delegation settings of Server3.

B. Create a Service Principal Name (SPN) for User1.

C. Configure the delegation settings of User1.

D. Create a matching Service Principal Name (SPN) for Server1 and Server2.

E. Configure the delegation settings of Server1 and Server2.

Answer: BE Explanation: A. Delegation needs to be setup on the IIS web servers for the application pool identity B. Correct user: When an IIS application runs under a domain user account instead of under the default network service account, you must set the SPN for the HTTP service under the domain account. C. Delegation settings need to be set on server 1 & 2 D. SPN needs to be created for the application pool identity account E. In a distributed application (Split app/db) the IIS/web servers to be trusted for delegation to impersonate/pasusers http://technet.microsoft.com/en-us/library/hh831797.aspx http://technet.microsoft.com/en-us/library/cc961723.aspx http://technet.microsoft.com/en-us/library/cc739764(v=ws.10).aspx http://technet.microsoft.com/en-us/library/ee675779.aspx QUESTION 73 Your network contains an Active Directory domain named contoso.com. Domain controllers run either Windows Server 2003, Windows Server 2008 R2, or Windows Server 2012 R2. A support technician accidentally deletes a user account named User1. You need to use tombstone reanimation to restore the User1 account. Which tool should you use?

A. Ntdsutil

B. Ldp

C. Esentutl

D. Active Directory Administrative Center

Answer: B Explanation: A. You can use the ntdsutil commands to perform database maintenance of AD DS, manage and






12

control single master operations, and remove metadata B. use Ldp.exe to restore a single, deleted Active Directory object C. Provides database utilities for the Extensible Storage Engine (ESE) for Windows Vista. D. ADAC offers no options to restore deleted objects http://technet.microsoft.com/nl-nl/library/dd379509(v=ws.10).aspx#BKMK_2 http://technet.microsoft.com/en-us/magazine/2007.09.tombstones.aspx http://technet.microsoft.com/en-us/library/hh875546.aspx http://technet.microsoft.com/en-us/library/dd560651(v=ws.10).aspx QUESTION 74 Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC4 that runs Windows Server 2012 R2. You create a DCCloneConfig.xml file. You need to clone DC4. Where should you place DCCloneConfig.xml on DC4?

A. %Systemroot%\SYSVOL

B. %Programdata%\Microsoft

C. %Systemroot%\NTDS

D. %Systemdrive%

Answer: C Explanation: As the output shows, the XML file is written to c:\windows\ntds. That's one of three valid locations where the file can be placed for cloning. All three locations are: %windir%\NTDS Wherever the DIT lives (if you've changed the path to D:\NTDS, for example) the root of any removable media QUESTION 75 Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1. You run ntdsutil {as shown in the exhibit}. You need to ensure that you can access the contents of the mounted snapshot. What should you do?

A. From a command prompt, run dsamain.exe -dbpath c:\$snap_201204131056_volumec$\windows\ntds \ntds.dit - Idapport 33389.

B. From a command prompt, run dsamain.exe -dbpath c:\$snap_201204131056_volumec$\windows\ntds \ntds.dit - Idapport 389.

C. From the snapshot context of ntdsutil, run activate instance "NTDS".

D. From the snapshot context of ntdsutil, run mount (79f94f82-5926-4f44-8af0-2f56d827a57d).

Answer: A Explanation:






13

A. Custom port needs to be defined when mounting to allow access from ADUC B. 389 is used as the standard ldap port C. Run prior to mount and after the mount run dsamain Sets NTDS or a specific AD LDS instance as the active instance. D. mounts a specific snap shot as specified by guid, using the snapshot mounted you needs to run dsamain to start an instance of AD http://technet.microsoft.com/en-us/library/cc753609(v=ws.10).aspx QUESTION 76 Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1. On DC1, you add a new volume and you stop the Active Directory Domain Services (AD DS) service. You run ntdsutil.exe and you set NTDS as the active instance. You need to move the Active Directory database to the new volume. Which Ntdsutil context should you use?

A. Configurable Settings

B. Partition management

C. IFM

D. Files

Answer: D Explanation: A. Aids in modifying the time to live (TTL) of dynamic data that is stored in Active Directory Domain Services (AD DS). At the configurable setting: prompt, type any of the parameters listed under Syntax. B. Manages directory partitions for Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS). C. Creates installation media for writable (full) domain controllers, read-only domain controllers (RODCs), and instances of Active Directory Lightweight Directory Services (AD LDS). D. ntdsutil move db to %s Moves the directory service log files to the new directory specified by %s, and updates the registry so that, upon service restart, the directory service uses the new location. http://technet.microsoft.com/en-us/library/cc753343(v=ws.10).aspx http://technet.microsoft.com/en-us/library/cc755229(v=ws.10).aspx http://technet.microsoft.com/en-us/library/cc730970(v=ws.10).aspx http://technet.microsoft.com/en-us/library/cc732530(v=ws.10).aspx http://technet.microsoft.com/en-us/library/cc753900(v=ws.10).aspx QUESTION 77 You have a server named Server1 that has the Web Server (IIS) server role installed. You obtain a Web Server certificate. You need to configure a website on Server1 to use Secure Sockets Layer (SSL). To which store should you import the certificate?






14

Answer:






15

Explanation: http://technet.microsoft.com/en-us/library/cc740068(v=ws.10).aspx QUESTION 78 Your network contains an Active Directory domain named contoso.com. You create a user account named User1. The properties of User1 are shown in the exhibit. (Click the Exhibit button.) You plan to use the User1 account as a service account. The service will forward authentication requests to other servers. You need to ensure that you can view the Delegation tab from the properties of the User1 account. What should you do first?






16

A. Modify the Security settings of User1.

B. Modify the user principal name (UPN) of User1.

C. Configure a Service Principal Name (SPN) for User1.

D. Configure the Name Mappings of User1.

Answer: C Explanation: If you cannot see the Delegation tab, do one or both of the following: Register a Service Principal Name (SPN) for the user account with the Setspn utility in the support tools on your CD. Delegation is only intended to be used by service accounts, which should have registered SPNs, as opposed to a regular user account which typically does not have SPNs. Raise the functional level of your domain to Windows Server 2003. For more information, see Related Topics. http://technet.microsoft.com/en-us/library/cc739474(v=ws.10).aspx QUESTION 79 Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2. On all of the domain controllers, Windows is installed in C:\Windows and the Active Directory database is located in D:\Windows\NTDS\. All of the domain controllers






17

have a third-party application installed. The operating system fails to recognize that the application is compatible with domain controller cloning. You verify with the application vendor that the application supports domain controller cloning. You need to prepare a domain controller for cloning. What should you do?

A. In D:\Windows\NTDS\, create an XML file named DCCloneConfig.xml and add the application information to the file.

B. In D:\Windows\NTDS\, create an XML file named CustomDCCloneAllowList.xml and add the application information to the file.

C. In the root of a USB flash drive, add the application information to an XML file named DefaultDCClone AllowList.xml.

D. In D:\Windows\NTDS, create an XML file named DefaultDCCloneAllowList.xml and add the application information to the file.

Answer: B Explanation: http://blogs.dirteam.com/blogs/sanderberkouwer/archive/2012/09/10/new-features-in-active- directory-domainservices-in-windows-server-2012-part-13-domain-controller-cloning.aspx Place the CustomDCCloneAllowList.xml file in the same folder as the Active Directory database (ntds.dit) on the source Domain Controller. QUESTION 80 Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2. On all of the domain controllers, Windows is installed in C:\Windows and the Active Directory database is located in D:\Windows\NTDS\. All of the domain controllers have a third-party application installed. The operating system fails to recognize that the application is compatible with domain controller cloning. You verify with the application vendor that the application supports domain controller cloning. You need to prepare a domain controller for cloning. What should you do?

A. In the root of a USB flash drive, add the application information to an XML file named DefaultDCClone AllowList.xml.

B. In C:\Windows\system32\sysprep\actionfiles\, add the application information to an XML file named Specialize .xml.

C. In D:\Windows\NTDS\, create an XML file named CustomDCCloneAllowList.xml and add the application information to the file.

D. In C:\Windows\system32\sysprep\actionfiles\add the application information to an XML file named Respecialize .xml.

Answer: C




Date post:	01-Apr-2016
Category:	Documents
Upload:	ubliing
View:	220 times
Download:	1 times

New Version Dumps Of Exam 70-411 With Free Update (Part D)

Documents