70-410: Installing and Configuring Windows Server 2012

Your network contains an Active Directory domain named contoso.com. All servers run Windows Server 2012 R2.

You need to add a user named User1 to a group named ServerAdmins.

What command should you run? To answer, select the appropriate options in the answer area.

Correct answer: To work with this question, an Exam Simulator is required.

Your network contains an Active Directory domain named contoso.com.

You log on to a domain controller by using an account named Admin1. Admin1 is a member of the Domain Admins group.

You view the properties of a group named Group1 as shown in the exhibit. (Click the Exhibit button.)

Group1 is located in an organizational unit (OU) named OU1.

You need to ensure that users from Group1 can modify the Security settings of OU1 only.

What should you do from Active Directory Users and Computers?

Modify the Managed By settings on OU1.
Right-click contoso.com and select Delegate Control.
Right-click OU1 and select Delegate Control.
Modify the Security settings of Group1.

Correct answer: C

Explanation:

Delegating control to only the OU will allow the users of Group1 to modify the security settings.

Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. All servers run Windows Server 2012 R2. The domain contains two domain controllers named DC1 and DC2. Both domain controllers are virtual machines on a Hyper-V host.

You plan to create a cloned domain controller named DC3 from an image of DC1.

You need to ensure that you can clone DC1.

Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

Add the computer account of DC1 to the Cloneable Domain Controllers group.
Create a DCCloneConfig.xml file on DC1.
Add the computer account of DC3 to the Cloneable Domain Controllers group.
Run the Enable-AdOptionalFeaturecmdlet.
Modify the contents of the DefaultDCCIoneAllowList.xml file on DC1.

Correct answer: AB

Explanation:

A. Membership in the Cloneable Domain Controllers Group dictates whether a DC can or cannot be cloned. This group has some permissions set on the domain head that should not be removed. Removing these permissions will cause cloning to fail. Also, as a best practice, DCs shouldn’t be added to the group until you plan to clone and DCs should be removed from the group once cloning is complete. Cloned DCs will also end up in the Cloneable Domain Controllers group. B. DCCloneConfig.xml is an XML configuration file that contains all of the settings the cloned DC will take when it boots. This includes network settings, DNS, WINS, AD site name, new DC name and more. This file can be generated in a few different ways. The New-ADDCCloneConfig cmdlet in PowerShell By hand with an XML editor By editing an existing config file, again with an XML editor.

A. Membership in the Cloneable Domain Controllers Group dictates whether a DC can or cannot be cloned. This group has some permissions set on the domain head that should not be removed. Removing these permissions will cause cloning to fail. Also, as a best practice, DCs shouldn’t be added to the group until you plan to clone and DCs should be removed from the group once cloning is complete. Cloned DCs will also end up in the Cloneable Domain Controllers group.

B. DCCloneConfig.xml is an XML configuration file that contains all of the settings the cloned DC will take when it boots. This includes network settings, DNS, WINS, AD site name, new DC name and more. This file can be generated in a few different ways.

The New-ADDCCloneConfig cmdlet in PowerShell

By hand with an XML editor

By editing an existing config file, again with an XML editor.

Your network contains an Active Directory domain named contoso.com. Domain controllers run either Windows Server 2008 R2 or Windows Server 2012 R2. All client computers run Windows 8.

All computer accounts are located in an organizational unit (OU) named OU1.

You create a Group Policy object (GPO) that contains several AppLocker rules. You link the GPO to OU1.

You need to ensure that the AppLocker rules apply to all of the client computers.

What should you configure in the GPO?

To answer, select the appropriate service in the answer area.

Correct answer: To work with this question, an Exam Simulator is required.

Explanation:

Configuring the Application Identity will specify where the Group Policy will be applied. References:http://www.grouppolicy.biz/2012/08/how-manage-published-a-k-a-metro-apps-in-windows-8-using-grouppolicy/Exam Ref: 70-410: Installing and Configuring Windows Server 2012 R2, Chapter 6: Create and manage Group Policy, Objective 6.3: Configure application restriction policies, p.341

Configuring the Application Identity will specify where the Group Policy will be applied.

References:

http://www.grouppolicy.biz/2012/08/how-manage-published-a-k-a-metro-apps-in-windows-8-using-grouppolicy/

Exam Ref: 70-410: Installing and Configuring Windows Server 2012 R2, Chapter 6: Create and manage Group Policy, Objective 6.3: Configure application restriction policies, p.341

Your network contains an Active Directory domain named contoso.com.

You create a software restriction policy to allow an application named App1 by using a certificate rule.

You need to ensure that when users attempt to execute App1, the certificate for App1 is verified against a certificate revocation list (CRL).

What should you do?

Modify the rule for App1.
Modify the Trusted Publishers Properties.
Create a new certificate rule for App1.
Modify the Enforcement Properties.

Correct answer: B

Your network contains an Active Directory forest. The forest contains a single domain named contoso.com.

AppLocker policies are enforced on all member servers.

You view the AppLocker policy applied to the member servers as shown in the exhibit. (Click the Exhibit button.)

To answer, complete each statement according to the information presented in the exhibit. Each correct selection is worth one point.

Correct answer: To work with this question, an Exam Simulator is required.

Your network contains an Active Directory domain named contoso.com. The domain contains an organizational unit (OU) named OU1.

You need to ensure that when new client computers join the domain, their computer accounts are created in OU1 by default.

What should you do?

From Windows PowerShell, run the Move-ADObject cmdlet.
From a command prompt, run the redircmp.exe command.
From ADSI Edit, configure the properties of the OU1 object.
From Ldp, configure the properties of the Computers container.

Correct answer: B

Explanation:

Redirects the default container for newly created computers to a specified, target organizational unit (OU) so that newly created computer objects are created in the specific target OU instead of in CN=Computers. The CN=Computers container is a computer-protected object. For backward compatibility reasons, you cannot (and must not) remove it. Reference: http://technet.microsoft.com/en-us/library/cc770619.aspx

Redirects the default container for newly created computers to a specified, target organizational unit (OU) so that newly created computer objects are created in the specific target OU instead of in CN=Computers.

The CN=Computers container is a computer-protected object. For backward compatibility reasons, you cannot (and must not) remove it.

Reference: http://technet.microsoft.com/en-us/library/cc770619.aspx

Your network contains an Active Directory domain named contoso.com. The domain contains 100 user accounts that reside in an organizational unit (OU) named OU1.

You need to ensure that a user named User1 can link and unlink Group Policy objects (GPOs) to OU1. The solution must minimize the number of permissions assigned to User1.

What should you do?

Run the Delegation of Control Wizard on OU1.
Add User1 to the Group Policy Creator Owners group.
Modify the permission on the \\Contoso.com\SYSVOL\Contoso.com\Policies folder.
Modify the permissions on the User1 account.

Correct answer: A

Explanation:

The Delegation of Control Wizard allows you to delegate tasks, active Directory Object types and to set permissions.

Your network contains an Active Directory domain named adatum.com.

You create an account for a temporary employee named User1.

You need to ensure that User1 can log on to the domain only between 08:00 and 18:00 from a client computer named Computer1.

From which tab should you perform the configuration?

To answer, select the appropriate tab in the answer area.

Correct answer: To work with this question, an Exam Simulator is required.

Explanation:

The User account properties contains the Logon Hours settings that you can use to change the hours that this selected object can log on to the domain. By default, domain logon is allowed 24 hours a day, 7 days a week. Note that this control does not affect the user's ability to log on locally to a computer using a local computer account instead of a domain account. To set logon hours Open Active Directory Users and Computers. In the console tree, click Users. Where? Active Directory Users and Computers/domain node/Users Or, click the folder that contains the user account. Right-click the user account, and then click Properties. On the Account tab, click Logon Hours, and then set the permitted or denied logon hours for the user. Reference: http://technet.microsoft.com/en-us/library/dd145547.aspx

The User account properties contains the Logon Hours settings that you can use to change the hours that this selected object can log on to the domain. By default, domain logon is allowed 24 hours a day, 7 days a week. Note that this control does not affect the user's ability to log on locally to a computer using a local computer account instead of a domain account.

To set logon hours

Open Active Directory Users and Computers.
In the console tree, click Users.

Where?

Active Directory Users and Computers/domain

node/Users Or, click the folder that contains the user account.

Right-click the user account, and then click Properties.
On the Account tab, click Logon Hours, and then set the permitted or denied logon hours for the user.

Reference: http://technet.microsoft.com/en-us/library/dd145547.aspx

Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. The domain contains two domain controllers named DC1 and DC2 that run Windows Server 2012 R2.

The domain contains a user named User1 and three global security groups named Group1, Group2 and, Group3.

You need to add User1 to Group1, Group2, and Group3.

Which cmdlet should you run?

Add-AdPrincipalGroupMembership
Install-AddsDomainController
Install-WindowsFeature
Install-AddsDomain
Rename-AdObject
Set-AdAccountControl
Set-AdGroup
Set-User

Correct answer: A

Explanation:

The Add-ADPrincipalGroupMembershipcmdlet adds a user, group, service account, or computer as a new member to one or more Active Directory groups. References:http://technet.microsoft.com/en-us/library/ee617203.aspxhttp://technet.microsoft.com/en-us/library/hh974723.aspx

The Add-ADPrincipalGroupMembershipcmdlet adds a user, group, service account, or computer as a new member to one or more Active Directory groups.

References:

http://technet.microsoft.com/en-us/library/ee617203.aspx

http://technet.microsoft.com/en-us/library/hh974723.aspx

Vendor:	Microsoft
Exam Code:	70-410
Exam Name:	Installing and Configuring Windows Server 2012
Date:	Sep 20, 2018
File Size:	18 MB

Download Installing and Configuring Windows Server 2012.70-410.Train4Sure.2018-09-20.315q.vcex

How to open VCEX files?

Demo Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

ProfExam at a 20% markdown