Top Tips Of 70-412 Q&A

70-412 Exam

Cause all that matters here is passing the Microsoft 70-412 exam. Cause all that you need is a high score of 70-412 Configuring Advanced Windows Server 2012 Services exam. The only one thing you need to do is downloading Pass4sure 70-412 exam study guides now. We will not let you down with our money-back guarantee.

2021 Apr 70-412 question

Q121. Your network contains an Active Directory domain named contoso.com. The domain contains two member servers named Server1 and Server2. All servers run Windows Server 2012 R2.

Server1 and Server2 have the Failover Clustering feature installed. The servers are configured as nodes in a failover cluster named Guster1. Cluster1 contains a file server role named FS1 and a generic service role named SVC1. Server1 is the preferred node for FS1. Server 2 is the preferred node for SVC1.

You plan to run a disk maintenance tool on the physical disk used by FS1.

You need to ensure that running the disk maintenance tool does not cause a failover to occur.

What should you do before you run the tool?

A. Run Suspend-ClusterResource.

B. Run Suspend-GusterNode.

C. Run cluster.exe and specify the pause parameter.

D. Run cluster.exe and specify the offline parameter.

Answer: D

Q122. Your network contains one Active Directory forest named contoso.com. The forest contains two child domains and six domain controllers. The domain controllers are configured as shown in the following table.

You create a trust between contoso.com and a domain in another forest at a partner company.

You need to prevent the sales.contoso.com and the manufacturing.contoso.com names from being used in authentication requests across the forest trust.

What should you use?

A. Set-ADSite

B. Set-ADReplicationSite

C. Set-ADDomain

D. Set-ADReplicationSiteLink

E. Set-ADGroup

F. Set-ADForest

G. Netdom

Answer: G

Explanation: The Netdom trust command establishes, verifies, or resets a trust

relationship between domains.

Parameters include /RemoveTLNEX:

Removes the specified top level name exclusion (DNS Name Suffix) from the forest trust

info from the specified trust. Valid only for a forest transitive non-Windows realm trust and can only be performed on the root domain for a forest. Reference: Netdom trust https://technet.microsoft.com/sv-se/library/Cc835085(v=WS.10).aspx

Q123. Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012.

Server1 is the enterprise root certification authority (CA) for contoso.com.

You need to enable CA role separation on Server1.

Which tool should you use?

A. The Certutil command

B. The Authorization Manager console

C. The Certsrv command

D. The Certificates snap-in

Answer: A

Explanation:

To enable role separation

. Open Command Prompt.

. Type: certutil -setreg ca\RoleSeparationEnabled 1 Etc.

Reference: Enable role separation

Q124. Your network contains an Active Directory domain named contoso.com. The domain contains a member server named Server1 that has the Active Directory Federation Services server role installed. All servers run Windows Server 2012.

You complete the Active Directory Federation Services Configuration Wizard on Server1. You need to ensure that client devices on the internal network can use Workplace Join. Which two actions should you perform on Server1? (Each correct answer presents part of the solution. Choose two.)

A. Run Enable-AdfsDeviceRegistration -PrepareActiveDirectory.

B. Edit the multi-factor authentication global authentication policy settings.

C. Run Enable-AdfsDeviceRegistration.

D. Run Set-AdfsProxyProperties HttpPort 80.

E. Edit the primary authentication global authentication policy settings.

Answer: C,E

Explanation:

C. To enable Device Registration Service

On your federation server, open a Windows PowerShell command window and type:

Enable-AdfsDeviceRegistration

Repeat this step on each federation farm node in your AD FS farm.

E. Enable seamless second factor authentication

Seamless second factor authentication is an enhancement in AD FS that provides an

added level of access protection to corporate resources and applications from external

devices that are trying to access them. When a personal device is Workplace Joined, it

becomes a ‘known’ device and administrators can use this information to drive conditional

access and gate access to resources.

To enable seamless second factor authentication, persistent single sign-on (SSO) and

conditional access for Workplace Joined devices.

In the AD FS Management console, navigate to Authentication Policies. Select Edit Global

Primary Authentication. Select the check box next to Enable Device Authentication, and

then click OK.

Reference: Configure a federation server with Device Registration Service.

Q125. Your network contains two Active Directory forests named contoso.com and corp.contoso.com.

User1 is a member of the DnsAdmins domain local group in contoso.com.

User1 attempts to create a conditional forwarder to corp.contoso.com but receive an error message shown in the exhibit. (Click the Exhibit button.)

You need to configure bi-directional name resolution between the two forests.

What should you do first?

A. Add User1 to the DnsUpdateProxy group.

B. Configure the zone to be Active Directory-integrated.

C. Enable the Advanced view from DNS Manager.

D. Run the New Delegation Wizard.

Answer: B

Explanation:

The zone must be Active Directory-integrated.

Down to date 70-412 practice test:

Q126. You have a server named Server1 that runs Windows Server 2012 R2.

Server1 has a single volume that is encrypted by using BitLocker Drive Encryption

(BitLocker).

BitLocker is configured to save encryption keys to a Trusted Platform Module (TPM).

Server1 is configured to perform a daily system image backup.

The motherboard on Server1 is upgraded.

After the upgrade, Windows Server 2012 R2 on Server1 fails to start.

You need to start the operating system on Server1 as soon as possible.

What should you do?

A. Start Server1 from the installation media. Run startrec.exe.

B. Move the disk to a server that has a model of the old motherboard. Start the server from the installation media. Run bcdboot.exe.

C. Move the disk to a server that has a model of the old motherboard. Start the server. Run tpm.msc.

D. Start Server1 from the installation media. Perform a system image recovery.

Answer: C

Explanation:

By moving the hard drive to server with that has a model of the old motherboard the system

would be able to start. As BitLocker was configured to save encryption keys to a Trusted

Platform Module (TPM), we can use tpm.msc to access the TPM settings.

Note: After you replaced the motherboard, you need to repopulate the TPM with new

information regarding the encryption of the hard disk.

We use these commands to repopulate the information in the TPM (without PIN):

manage-bde –delete -protectors C: -type TPM

manage-bde –protectors –add C: -tpm

Incorrect:

Not D. After the system image recovery you would still have the new motherboard installed.

The problem would return.

Reference: BitLocker - New motherboard replacement

Q127. Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2. Server1 has an enterprise root certification authority (CA) for contoso.com.

You deploy another member server named Server2 that runs Windows Server 2012 R2 and has the Web Server (IIS) server role installed.

You need to designate a website on Server1 as the certificate revocation list (CRL) distribution point for the CA. The solution must ensure that CRLs are published automatically to Server2.

Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

A. Create an http:// CRL distribution point (CDP) entry.

B. Configure a CA exit module.

C. Create a file:// CRL distribution point (CDP) entry.

D. Configure a CA policy module.

E. Configure an enrollment agent.

Answer: A,D

Explanation:

A. To specify CRL distribution points in issued certificates Open the Certification Authority snap-in. In the console tree, click the name of the CA. On the Action menu, click Properties , and then click the Extensions tab. Confirm that Select extension is set to CRL Distribution Point (CDP) .

. Do one or more of the following. (The list of CRL distribution points is in the Specify locations from which users can obtain a certificate revocation list (CRL) box.)

/ To indicate that you want to use a URL as a CRL distribution point Click the CRL distribution point, select the Include in the CDP extension of issued certificates check box, and then click OK .

. Click Yes to stop and restart Active Directory Certificate Services (AD CS).

D. You can specify CRL Distribution Points (CDPs) in CAPolicy.inf. Note that any CDP in CAPolicy.inf will take precedence for certificate verifiers over the CDP's specified in the CA policy module.

Note:

CRLDistributionPoint

You can specify CRL Distribution Points (CDPs) for a root CA certificate in the CAPolicy.inf.

This section does not configure the CDP for the CA itself. After the CA has been installed

you can configure the CDP URLs that the CA will include in each certificate that it issues.

The URLs specified in this section of the CAPolicy.inf file are included in the root CA

certificate itself.

Example:

[CRLDistributionPoint]

URL=http://pki.wingtiptoys.com/cdp/WingtipToysRootCA.crl

Q128. Your network contains two Web servers named Server1 and Server2. Both servers run Windows Server 2012 R2.

Server1 and Server2 are nodes in a Network Load Balancing (NLB) cluster. The NLB cluster contains an application named App1 that is accessed by using the URL http://app1.contoso.com.

You plan to perform maintenance on Server1.

You need to ensure that all new connections to App1 are directed to Server2. The solution must not disconnect the existing connections to Server1.

What should you run?

A. The Set-NlbCluster cmdlet

B. The Set-NlbClusterNode cmdlet

C. The Stop-NlbCluster cmdlet

D. The Stop-NlbClusterNode cmdlet

Answer: D

Explanation:

The Stop-NlbClusterNode cmdlet stops a node in an NLB cluster. When you use the stop

the nodes in the cluster, client connections that are already in progress are interrupted. To

avoid interrupting active connections, consider using the -drain parameter, which allows the

node to continue servicing active connections but disables all new traffic to that node.

-Drain <SwitchParameter>

Drains existing traffic before stopping the cluster node. If this parameter is omitted, existing

traffic will be dropped.

Reference: Stop-NlbClusterNode

Q129. Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2. Server1 is an enterprise root certification authority (CA) for contoso.com.

Your user account is assigned the certificate manager role and the auditor role on the contoso.com CA. Your account is a member of the local Administrators group on Server1.

You enable CA role separation on Server1.

You need to ensure that you can manage the certificates on the CA.

What should you do?

A. Remove your user account from the local Administrators group.

B. Assign the CA administrator role to your user account.

C. Assign your user account the Bypass traverse checking user right.

D. Remove your user account from the Manage auditing and security log user right.

Answer: D

Explanation:

The separation of CA roles can be enforced using role separation. Once enforced, role separation only allows a user to be assigned a single role. If a user is assigned to more than one role and attempts to perform an operation on the CA, the operation is denied. For this reason, before role separation is enabled, a user should be assigned only one CA role.

Reference: Role Separation

Q130. Your network contains an Active Directory forest. The forest contains one domain named adatum.com. The domain contains three domain controllers. The domain controllers are configured as shown in the following table.

DC2 has all of the domain-wide operations master roles. DC3 has all of the forest-wide operation master roles.

You need to ensure that you can use Password Settings objects (PSOs) in the domain.

What should you do first?

A. Uninstall Active Directory from DC1.

B. Change the domain functional level.

C. Transfer the domain-wide operations master roles.

D. Transfer the forest-wide operations master roles.

Answer: A

Explanation:

In Windows Server 2008 and later, you can use fine-grained password policies to specify multiple password policies and apply different password restrictions and account lockout policies to different sets of users within a single domain.

Note: In Microsoft Windows 2000 and Windows Server 2003 Active Directory domains, you could apply only one password and account lockout policy, which is specified in the domain's Default Domain Policy, to all users in the domain. As a result, if you wanted different password and account lockout settings for different sets of users, you had to either create a password filter or deploy multiple domains. Both options were costly for different reasons.

Reference: AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide