How to win with 70 412 vce

70-412 Exam

Exambible offers free demo for microsoft 70 412 exam. "Configuring Advanced Windows Server 2012 Services", also known as 70 412 dumps exam, is a Microsoft Certification. This set of posts, Passing the Microsoft 70 412 dumps exam, will help you answer those questions. The exam 70 412 Questions & Answers covers all the knowledge points of the real exam. 100% real Microsoft microsoft 70 412 exams and revised by experts!

Q71. HOTSPOT

Your network contains an Active Directory domain named contoso.com.

You install the IP Address Management (IPAM) Server feature on a server named Server1

and select Manual as the provisioning method.

The IPAM database is located on a server named SQL1.

You need to configure IPAM to use Group Policy Based provisioning.

What command should you run first?

To answer, select the appropriate options in the answer area.

Answer:

Q72. Your network contains an Active Directory domain named contoso.com. The domain contains a file server named File1 that runs a Server Core Installation of Windows Server 2012 R2.

File1 has a volume named D that contains home folders. File1 creates a shadow copy of volume D twice a day.

You discover that volume D is almost full.

You add a new volume named H to File1.

You need to ensure that the shadow copies of volume D are stored on volume H.

Which command should you run?

A. The Set-Volume cmdlet with the -driveletter parameter

B. The vssadmin.exe create shadow command

C. The Set-Volume cmdlet with the -path parameter

D. The vssadmin.exe add shadowstorage command

Answer: D

Explanation:

Add ShadowStorage

Adds a shadow copy storage association for a specified volume.

Incorrect:

Not A. Sets or changes the file system label of an existing volume. -DriveLetter Specifies a

letter used to identify a drive or volume in the system.

Not B. Create Shadow

Creates a new shadow copy of a specified volume.

Not C. Sets or changes the file system label of an existing volume -Path Contains valid

path information.

Reference: Vssadmin; Set-Volume

http://technet.microsoft.com/en-us/library/cc754968(v=ws.10).aspx

http://technet.microsoft.com/en-us/library/hh848673(v=wps.620).aspx

Q73. You have a server named Server1 that runs Windows Server 2012 R2.

You have a subscription to Windows Azure.

You need to register the Microsoft Azure Backup Agent on Server1.

What should you do first?

A. Install the Microsoft System Center 2012 Data Protection Manager (DPM) agent.

B. Create a backup vault.

C. Create Site Recovery vault.

D. Configure a passphrase for the Azure Backup Agent.

Answer: B

Explanation: To back up files and data from your Windows Server to Azure, you must create a backup vault in the geographic region where you want to store the data. The main steps include:

* the creation of the vault you will use to store backups

* downloading a vault credential

* the installation of a backup agent

Reference: Configure Azure Backup to quickly and easily back up Windows Server

https://azure.microsoft.com/sv-se/documentation/articles/backup-configure-vault/

Q74. Your network contains an Active Directory domain named contoso.com. The domain contains a file server named Server1 that runs Windows Server 2012 R2.

You create a user account named User1 in the domain.

You need to ensure that User1 can use Windows Server Backup to back up Server1. The solution must minimize the number of administrative rights assigned to User1.

What should you do?

A. Add User1 to the Backup Operators group.

B. Add User1 to the Power Users group.

C. Assign User1 the Backup files and directories user right and the Restore files and directories user right.

D. Assign User1 the Backup files and directories user right.

Answer: D

Explanation:

Backup Operators have these permissions by default:

However the question explicitly says we need to minimize administrative rights. Since the requirement is for backing up the data only--no requirement to restore or shutdown--then assigning the "Back up files and directories user right" would be the correct answer.

Reference: Default local groups

http://technet.microsoft.com/en-us/library/cc787956(v=ws.10).aspx http://technet.microsoft.com/en-us/library/cc756898(v=ws.10).aspx http://technet.microsoft.com/en-us/library/cc771990.aspx

Q75. Your network contains an Active Directory domain named adatum.com. The domain contains a server named CA1 that runs Windows Server 2012 R2. CA1 has the Active Directory Certificate Services server role installed and is configured to support key archival and recovery.

You need to ensure that a user named User1 can decrypt private keys archived in the Active Directory Certificate Services (AD CS) database. The solution must prevent User1 from retrieving the private keys from the AD CS database.

What should you do?

A. Assign User1 the Issue and Manage Certificates permission to CA1.

B. Assign User1 the Read permission and the Write permission to all certificate templates.

C. Provide User1 with access to a Key Recovery Agent certificate and a private key.

D. Assign User1 the Manage CA permission to CA1.

Answer: C

Explanation:

Understanding the Key Recovery Agent Role KRAs are Information Technology (IT) administrators who can decrypt users’ archived private keys. An organization can assign KRAs by issuing KRA certificates to designated administrators and configure them on the CA. The KRA role is not one of the default roles defined by the Common Criteria specifications but a virtual role that can provide separation between Certificate Managers and the KRAs. This allows the separation between the Certificate Manager, who can retrieve the encrypted key from the CA database but not decrypt it, and the KRA, who can decrypt private keys but not retrieve them from the CA database.

Reference: Understanding User Key Recovery

Q76. Your network contains two Active Directory forests named contoso.com and adatum.com. Each forest contains one domain. Contoso.com has a two-way forest trust to adatum.com. Selective authentication is enabled on the forest trust.

Contoso contains 10 servers that have the File Server role service installed. Users successfully access shared folders on the file servers by using permissions granted to the Authenticated Users group.

You migrate the file servers to adatum.com.

Contoso users report that after the migration, they are unable to access shared folders on the file servers.

You need to ensure that the Contoso users can access the shared folders on the file servers.

What should you do?

A. Disable selective authentication on the existing forest trust.

B. Disable SID filtering on the existing forest trust.

C. Run netdom and specify the /quarantine attribute.

D. Replace the existing forest trust with an external trust.

Answer: B

Explanation:

Although it is not recommended, you can use this procedure to disable security identifier (SID) filter quarantining for an external trust with the Netdom.exe tool. You should consider disabling SID filter quarantining only in the following situations:

* Users have been migrated to the trusted domain with their SID histories preserved, and you want to grant those users access to resources in the trusting domain (the former domain of the migrated users) based on the sIDHistory attribute.

Etc.

Reference: Disabling SID filter quarantining

http://technet.microsoft.com/en-us/library/cc794713(v=ws.10).aspx

Q77. Your network contains an Active Directory domain named contoso.com. The domain contains two member servers named Server1 and Server2. All servers run Windows Server 2012 R2.

Server1 and Server2 have the Failover Clustering feature installed. The servers are configured as nodes in a failover cluster named Cluster1.

You add two additional nodes in Cluster1.

You have a folder named Folder1 on Server1 that hosts Application data. Folder1 is a folder target in a Distributed File System (DFS) namespace.

You need to provide highly available access to Folder1. The solution must support DFS Replication to Folder1.

What should you configure?

A. Affinity-None

B. Affinity-Single

C. The cluster quorum settings

D. The failover settings

E. A file server for general use

F. The Handling priority

G. The host priority

H. Live migration

I. The possible owner

J. The preferred owner

K. Quick migration

L. The Scale-Out File Server

Answer: E

Explanation:

File Server for general use

Note: You can deploy and configure a clustered file server by using either of the following methods:

* File Server for general use. This is the continuation of the clustered file server that has been supported in Windows Server since the introduction of Failover Clustering. This type of clustered file server, and therefore all the shares associated with the clustered file server, is online on one node at a time. This is sometimes referred to as active-passive or dual-active. File shares associated with this type of clustered file server are called clustered file shares. This is the recommended file server type when deploying information worker scenarios.

* Scale-Out File Server for application data This clustered file server feature was introduced in Windows Server 2012, and it lets you store server application data, such as Hyper-V virtual machine files, on file shares, and obtain a similar level of reliability, availability, manageability, and high performance that you would expect from a storage area network. All file shares are simultaneously online on all nodes. File shares associated with this type of clustered file server are called scale-out file shares. This is sometimes referred to as active-active. This is the recommended file server type when deploying either Hyper-V over Server Message Block (SMB) or Microsoft SQL Server over SMB.

Reference: Scale-Out File Server for Application Data Overview

Q78. HOTSPOT

Your network contains two DHCP servers named Server1 and Server2. Server1 fails.

You discover that DHCP clients can no longer receive IP address leases.

You need to ensure that the DHCP clients receive IP addresses immediately.

What should you configure from the View/Edit Failover Relationship settings? To answer,

select the appropriate setting in the answer area.

Answer:

Q79. You have a DNS server named Server1 that runs Windows Server 2012 R2. Server1 has the zones shown in the following output.

You need to delegate permissions to modify the records in the adatum.com zone to a group named Group1.

What should you do first?

A. Enable the distribution of the trust anchors for adatum.com.

B. Unsign adatum.com.

C. Store adatum.com in Active Directory.

D. Update the server data file for adatum.com.

Answer: A

Explanation: From the exhibit we see that the adatum.com zone is signed.

A trust anchor (or trust “point”) is a public cryptographic key for a signed zone. Trust

anchors must be configured on every non-authoritative DNS server that will attempt to

validate DNS data. You cannot distribute trust anchors until after a zone is signed.

Reference: Trust Anchors

https://technet.microsoft.com/en-us/library/dn593672.aspx

Q80. Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2. Server1 has the Active Directory Certificate Services server role installed and is configured as an enterprise certification authority (CA).

You need to ensure that all of the users in the domain are issued a certificate that can be used for the following purposes:

Email security

Client authentication

Encrypting File System (EFS)

Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

A. From a Group Policy, configure the Certificate Services Client – Auto-Enrollment settings.

B. From a Group Policy, configure the Certificate Services Client – Certificate Enrollment Policy settings.

C. Modify the properties of the User certificate template, and then publish the template.

D. Duplicate the User certificate template, and then publish the template.

E. From a Group Policy, configure the Automatic Certificate Request Settings settings.

Answer: A,D

Explanation:

The default user template supports all of the requirements EXCEPT auto enroll as shown below:

However a duplicated template from users has the ability to autoenroll:

The Automatic Certificate Request Settings GPO setting is only available to Computer, not user.

Reference: Manage Certificate Enrollment Policy by Using Group Policy. http://technet.microsoft.com/en-us/library/dd851772.aspx