NEW QUESTION 1
Your network contains an Active Directory domain named contoso.com. All client computers run Windows 8.1.
The network contains a shared folder named FinancialData that contains five files.
You need to ensure that the FinancialData folder and its contents are copied to all of the client computers.
Which two Group Policy preferences should you configure? (Each correct answer presents part of the solution. Choose two.)

• A. Shortcuts
• B. Network Shares
• C. Environment
• D. Folders
• E. Files

Answer: DE

Explanation: Folder preference items allow you to create, update, replace, and delete folders and their contents. (To configure individual files rather than folders, see Files Extension.) Before you create a Folder preference item, you should review the behavior of each type of action possible with this extension.
File preference items allow you to copy, modify the attributes of, replace, and delete files. (To configure folders rather than individual files, see Folders Extension.) Before you create a File preference item, you should review the behavior of each type of action possible with this extension.

NEW QUESTION 2
You have a server named Server1 that runs Windows Server 2012 R2. You create a custom Data Collector Set (DCS) named DCS1.
You need to configure Server1 to start DCS1 automatically when the network usage exceeds 70 percent.
Which type of data collector should you create?

• A. A performance counter alert
• B. A configuration data collector
• C. A performance counter data collector
• D. An event trace data collector

Answer: A

Explanation: Performance alerts notify you when a specified performance counter exceeds your configured threshold by logging an event to the event log. But rather than notifying you immediately when the counter exceeds the threshold, you can configure a time period over which the counter needs to exceed the threshold, to avoid unnecessary alerts.

NEW QUESTION 3
Your network contains an Active Directory domain named contoso.com. The domain contains more than 100 Group Policy objects (GPOs). Currently, there are no enforced GPOs.
The domain is renamed to adatum.com. Group Policies no longer function correctly.
You need to ensure that the existing GPOs are applied to users and computers. You want to achieve this goal by using the minimum amount of administrative effort.
What should you use?

• A. Dcgpofix
• B. Get-GPOReport
• C. Gpfixup
• D. Gpresult
• E. Gpedi
• F. msc
• G. Import-GPO
• H. Restore-GPO
• I. Set-GPInheritance
• J. Set-GPLink
• K. Set-GPPermission
• L. Gpupdate
• M. Add-ADGroupMember

Answer: C

Explanation: You can use the gpfixup command-line tool to fix the dependencies that Group Policy objects (GPOs) and Group Policy links in Active Directory Domain Services (AD DS) have on Domain Name System (DNS) and NetBIOS names after a domain rename operation.
Reference: http: //technet. microsoft. com/en-us/library/hh852336(v=ws. 10). aspx

NEW QUESTION 4
Your company deploys a new Active Directory forest named contoso.com. The first domain controller in the forest runs Windows Server 2012 R2. The forest contains a domain controller named DC10.
On DC10, the disk that contains the SYSVOL folder fails.
You replace the failed disk. You stop the Distributed File System (DFS) Replication service. You restore the SYSVOL folder.
You need to perform a non-authoritative synchronization of SYSVOL on DC10.
Which tool should you use before you start the DFS Replication service on DC10?

• A. Dfsgui.msc
• B. Dfsmgmt.msc
• C. Adsiedit.msc
• D. Ldp

Answer: C

Explanation: How to perform a non-authoritative synchronization of DFSR-replicated SYSVOL (like "D2" for FRS)
✑ In the ADSIEDIT. MSC tool modify the following distinguished name (DN) value and attribute on each of the domain controllers that you want to make non- authoritative:
CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR- LocalSettings,CN=<the server name>,OU=Domain Controllers,DC=<domain> msDFSR-Enabled=FALSE
✑ Force Active Directory replication throughout the domain.
✑ Run the following command from an elevated command prompt on the same servers that you set as non-authoritative:
DFSRDIAG POLLAD
✑ You will see Event ID 4114 in the DFSR event log indicating SYSVOL is no longer being replicated.
✑ On the same DN from Step 1, set: msDFSR-Enabled=TRUE
✑ Force Active Directory replication throughout the domain.
✑ Run the following command from an elevated command prompt on the same servers that you set as non-authoritative:
DFSRDIAG POLLAD
✑ You will see Event ID 4614 and 4604 in the DFSR event log indicating SYSVOL has been initialized. That domain controller has now done a “D2” of SYSVOL.
Note: Active Directory Service Interfaces Editor (ADSI Edit) is a Lightweight Directory Access Protocol (LDAP) editor that you can use to manage objects and attributes in Active Directory. ADSI Edit (adsiedit. msc) provides a view of every object and attribute in an Active Directory forest. You can use ADSI Edit to query, view, and edit attributes that are not exposed through other Active Directory Microsoft Management Console (MMC) snap- ins: Active Directory Users and Computers, Active Directory Sites and Services, Active Directory Domains and Trusts, and Active Directory Schema.

NEW QUESTION 5
DRAG DROP
Your network contains an Active Directory domain named adatum.com. The domain contains a server named Server1 that runs Windows Server 2012 R2. Server1 is configured as a Network Policy Server (NPS) server and as a DHCP server.
You need to log all DHCP clients that have windows Firewall disabled.
Which three actions should you perform in sequence? To answer, move the three appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Answer:

Explanation: References:
http: //technet.microsoft.com/es-es/library/dd314198%28v=ws.10%29.aspx
http: //technet.microsoft.com/es-es/magazine/2009.05.goat.aspx
http: //technet.microsoft.com/es-es/library/dd314173%28v=ws.10%29.aspx
http: //ripusudan.wordpress.com/2013/03/19/how-to-configure-nap-enforcement-for-dhcp/ http: //technet.microsoft.com/es-es/magazine/2009.05.goat.aspx
http: //technet.microsoft.com/en-us/library/dd125379%28v=ws.10%29.aspx http: //technet.microsoft.com/en-us/library/cc772356%28v=ws.10%29.aspx




* With NPS, you can create client health policies using SHVs that allow NAP to detect, enforce, and remediate client computer configurations.
WSHA and WSHV provide the following functionality for NAP-capable computers: The client computer has firewall software installed and enabled.
* Example measurements of health include:
The operational status of Windows Firewall. Is the firewall enabled or disabled?
In NAP terminology, verifying that a computer meets your defined health requirements is called health policy validation. NPS performs health policy validation for NAP.

NEW QUESTION 6
Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2 and has the Network Policy Server role service installed.
An administrator creates a RADIUS client template named Template1. You create a RADIUS client named Client1 by using Template 1.
You need to modify the shared secret for Client1. What should you do first?

• A. Configure the Advanced settings of Template1.
• B. Set the Shared secret setting of Template1 to Manual.
• C. Clear Enable this RADIUS client for Client1.
• D. Clear Select an existing template for Client1.

Answer: D

Explanation: Clear checkmark for Select an existing template in the new client wizard. In New RADIUS Client, in Shared secret, do one of the following:
Bullet Ensure that Manual is selected, and then in Shared secret, type the strong password that is also entered on the RADIUS client. Retype the shared secret in Confirm shared secret.

NEW QUESTION 7
Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1 that runs Windows Server 2012.
You have a Group Policy object (GPO) named GPO1 that contains several custom Administrative templates.
You need to filter the GPO to display only settings that will be removed from the registry when the GPO falls out of scope. The solution must only display settings that are either enabled or disabled and that have a comment.
How should you configure the filter?
To answer, select the appropriate options below. Select three.

• A. Set Managed to: Yes
• B. Set Managed to: No
• C. Set Managed to: Any
• D. Set Configured to: Yes
• E. Set Configured to: No
• F. Set Configured to: Any
• G. Set Commented to: Yes
• H. Set Commented to: No
• I. Set Commented to: Any

Answer: AFG

NEW QUESTION 8
Your network contains an Active Directory domain named contoso.com. All servers run
Windows Server 2012 R2.
The domain contains a server named Server1 that has the Network Policy Server server role and the Remote Access server role installed. The domain contains a server named Server2 that is configured as a RADIUS server.
Server1 provides VPN access to external users.
You need to ensure that all of the VPN connections to Server1 are logged to the RADIUS server on Server2.
What should you run?

• A. Add-RemoteAccessRadius -ServerNameServer1 -AccountingOnOffMsg Enabled - SharedSecret "Secret" -Purpose Accounting
• B. Set-RemoteAccessAccounting -AccountingOnOffMsg Enabled -AccountingOnOffMsg Enabled
• C. Add-RemoteAccessRadius -ServerName Server2 -AccountingOnOffMsg Enabled - SharedSecret "Secret" -Purpose Accounting
• D. Set-RemoteAccessAccounting -EnableAccountingType Inbox -AccountingOnOffMsg Enabled

Answer: C

Explanation: Add-RemoteAccessRadius
Adds a new external RADIUS server for VPN authentication, accounting for DirectAccess (DA) and VPN, or one-time password (OTP) authentication for DA. AccountingOnOffMsg<String>
Indicates the enabled state for sending of accounting on or off messages. The acceptable values for this parameter are:
✑ Enabled.
✑ Disabled. This is the default value.
This parameter is applicable only when the RADIUS server is being added for Remote Access accounting.

NEW QUESTION 9
Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2.
DirectAccess is deployed to the network.
Remote users connect to the DirectAccess server by using a variety of network speeds.
The remote users report that sometimes their connection is very slow.
You need to minimize Group Policy processing across all wireless wide area network (WWAN) connections.
Which Group Policy setting should you configure?

• A. Configure Group Policy slow link detection.
• B. Configure Direct Access connections as a fast network connection.
• C. Configure wireless policy processing.
• D. Change Group Policy processing to run asynchronously when a slow network connection is detected.

Answer: A

NEW QUESTION 10
Your company has a main office and a branch office.
The main office contains a server that hosts a Distributed File System (DFS) replicated folder.
You plan to implement a new DFS server in the branch office.
You need to recommend a solution that minimizes the amount of network bandwidth used to perform the initial synchronization of the folder to the branch office.
You recommend using the Export-DfsrClone and Import-DfsrClonecmdlets. Which additional command or cmdlet should you include in the recommendation?

• A. Robocopy.exe
• B. Synchost.exe
• C. Export-BcCachePackage
• D. Sync-DfsReplicationGroup

Answer: A

Explanation: By preseeding files before you set up DFS Replication, add a new replication partner, or replace a server, you can speed up initial synchronization and enable cloning of the DFS Replication database in Windows Server 2012 R2. The Robocopy method is one of several preceding methods

NEW QUESTION 11
HOTSPOT
Your network contains an Active Directory domain named contoso.com.
You create an organizational unit (OU) named OU1 and a Group Policy object (GPO) named GPO1. You link GPO1 to OU1.
You move several file servers that store sensitive company documents to OU1. Each file server contains more than 40 shared folders.
You need to audit all of the failed attempts to access the files on the file servers in OU1. The solution must minimize administrative effort.
Which two audit policies should you configure in GPO1? To answer, select the appropriate two objects in the answer area.

Answer:

Explanation:

NEW QUESTION 12
HOTSPOT
Your network contains one Active Directory domain named contoso.com. The domain contains 10 file servers that run Windows Server 2012 R2.
You plan to enable BitLocker Drive Encryption (BitLocker) for the operating system drives of the file servers.
You need to configure BitLocker policies for the file servers to meet the following requirements:
✑ Ensure that all of the servers use a startup PIN for operating system drives encrypted with BitLocker.
✑ Ensure that the BitLocker recovery key and recovery password are stored in Active
Directory.
Which two Group Policy settings should you configure? To answer, select the appropriate settings in the answer area.

Answer:

Explanation: Choose how BitLocker-protected operating system drives can be recovered: With this policy setting, you can control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. In Save BitLocker recovery information to Active Directory Domain Services, choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS) for operating system drives. If you select Store recovery password and key packages, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that is physically corrupted. If you select Store recovery password only, only the recovery password is stored in AD DS.
Require additional authentication at startup: With this policy setting, you can configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker. On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use:
-only the TPM for authentication
-insertion of a USB flash drive containing the startup key
-the entry of a 4-digit to 20-digit personal identification number (PIN)
-a combination of the PIN and the USB flash drive
There are four options for TPM-enabled computers or devices:
Configure TPM startup o Allow TPM
o Require TPM
o Do not allow TPM Configure TPM startup PIN
o Allow startup PIN with TPM
o Require startup PIN with TPM
o Do not allow startup PIN with TPM Configure TPM startup key
o Allow startup key with TPM
o Require startup key with TPM
o Do not allow startup key with TPM Configure TPM startup key and PIN o Allow TPM startup key with PIN
o Require startup key and PIN with TPM o Do not allow TPM startup key with PIN
https://technet.microsoft.com/en-us/library/jj679890.aspx

NEW QUESTION 13
DRAG DROP
You are a network administrator of an Active Directory domain named contoso.com.
You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Web Server (IIS) server role installed.
Server1 will host a web site at URL https: //secure.contoso.com. The application pool identity account of the web site will be set to a domain user account named AppPool1.
You need to identify the setspn.exe command that you must run to configure the appropriate Service Principal Name (SPN) for the web site.
What should you run?
To answer, drag the appropriate objects to the correct location. Each object may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Answer:

Explanation: Note:
* -s <SPN>
Adds the specified SPN for the computer, after verifying that no duplicates exist. Usage: setspn –s SPN accountname
For example, to register SPN "http/daserver" for computer "daserver1": setspn -S http/daserver daserver1
http: //technet. microsoft. com/en-us/library/cc731241(v=ws. 10). aspx
Attn: with Windows 2008 option is -a but with Windows 2012 it started to show -s Definition of an SPN
An SPN is the name by which a client uniquely identifies an instance of a service. If you install multiple instances of a service on computers throughout a forest, each service instance must have its own SPN. A particular service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running. Therefore, a service instance might register an SPN for each name or alias of its host.
Adding SPNs
To add an SPN, use the setspn -s service/namehostname command at a command prompt, where service/name is the SPN that you want to add and hostname is the actual host name of the computer object that you want to update. For example, if there is an Active Directory domain controller with the host name server1.contoso.com that requires an SPN for the Lightweight Directory Access Protocol (LDAP), type setspn -s ldap/server1.contoso.com server1, and then press ENTER to add the SPN.
The HTTP service class
The HTTP service class differs from the HTTP protocol. Both the HTTP protocol and the HTTPS protocol use the HTTP service class. The service class is the string that identifies the general class of service.
For example, the command may resemble the following command: setspn –S HTTP/iis6server1. mydomain.com mydomainappPool1
References:
http: //support. microsoft. com/kb/929650/en-us
http: //technet. microsoft. com/en-us/library/cc731241%28v=ws. 10%29. aspx

NEW QUESTION 14
Your network contains two Active Directory forests named contoso.com and adatum.com. All domain controllers run Windows Server 2012 R2.
The adatum.com domain contains a Group Policy object (GPO) named GPO1. An administrator from adatum.com backs up GPO1 to a USB flash drive.
You have a domain controller named dc1.contoso.com. You insert the USB flash drive in dc1.contoso.com.
You need to identify the domain-specific reference in GPO1. What should you do?

• A. From the Migration Table Editor, click Populate from Backup.
• B. From Group Policy Management, run the Group Policy Modeling Wizard.
• C. From Group Policy Management, run the Group Policy Results Wizard.
• D. From the Migration Table Editor, click Populate from GPO.

Answer: A

NEW QUESTION 15
DRAG DROP
Your network contains an Active Directory forest named contoso.com. The forest contains a Network Policy Server (NPS) server named NPS1 and a VPN server named VPN1. VPN1 forwards all authentication requests to NPS1.
A partner company has an Active Directory forest named adatum.com. The adatum.com forest contains an NPS server named NPS2.
You plan to grant users from adatum.com VPN access to your network. You need to authenticate the users from adatum.com on VPN1.
What should you create on each NPS server?
To answer, drag the appropriate objects to the correct NPS servers. Each object may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Answer:

Explanation:

NEW QUESTION 16
Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2012 R2. Server1 has the Network Policy Server role service installed.
You plan to configure Server1 as a Network Access Protection (NAP) health policy server for VPN enforcement by using the Configure NAP wizard.
You need to ensure that you can configure the VPN enforcement method on Server1 successfully.
What should you install on Server1 before you run the Configure NAP wizard?

• A. A system health validator (SHV)
• B. The Host Credential Authorization Protocol (HCAP)
• C. A computer certificate
• D. The Remote Access server role

Answer: C

Explanation: Configure NAP enforcement for VPN
This checklist provides the steps required to deploy computers with Routing and Remote Access Service installed and configured as VPN servers with Network Policy Server (NPS) and Network Access Protection (NAP).

NEW QUESTION 17
DRAG DROP
Your network contains an Active Directory domain named contoso.com. The domain contains two member servers named Server1 and Server2. All servers run Windows Server 2012 R2.
You generalize Server2.
You install the Windows Deployment Services (WDS) server role on Server1. You need to capture an image of Server2 on Server1.
Which three actions should you perform?
To answer, move the three appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Answer:

Explanation: Box 1: Start Server2 by using PXE. Box 2: Add a capture image to Server1. Box 3: Add an install image to Server1. Note:
* Capture images are Windows Preinstallation Environment (Windows PE) images that allow you to easily capture the install images that you prepare using Sysprep.exe. Instead of using complex command-line tools, once you have run Sysprep.exe on your reference computer, you can boot to the Windows Deployment Services client computer using PXE and select the capture image. When the capture image boots, it starts the Capture Image Wizard, which will guide you through the capture process and optionally upload the new install image to a Windows Deployment Services server.
Steps
/ create a capture image.
/ Create an install image.
/ Add the install image to the Windows Deployment Services server.

NEW QUESTION 18
You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the File Server Resource Manager role service installed.
Server1 has a folder named Folder1 that is used by the human resources department. You need to ensure that an email notification is sent immediately to the human resources
manager when a user copies an audio file or a video file to Folder1.
What should you configure on Server1?

• A. a storage report task
• B. a file screen exception
• C. a file screen
• D. a file group

Answer: C

Explanation: Create file screens to control the types of files that users can save, and generate notifications when users attempt to save unauthorized files.
With File Server Resource Manager (FSRM) you can create file screens that prevent users
from saving unauthorized files on volumes or folders. File Screen Enforcement:
You can create file screens to prevent users from saving unauthorized files on volumes or folders. There are two types of file screen enforcement: active and passive enforcement. Active file screen enforcement does not allow the user to save an unauthorized file. Passive file screen enforcement allows the user to save the file, but notifies the user that the file is not an authorized file. You can configure notifications, such as events logged to the event log or e-mails sent to users and administrators, as part of active and passive file screen enforcement.

NEW QUESTION 19
Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2.
The domain contains an Edge Server named Server1. Server1 is configured as a DirectAccess server. Server1 has the following settings:

You run the Remote Access Setup wizard as shown in the following exhibit. (Click the Exhibit button.)

You need to ensure that client computers on the Internet can establish DirectAccess connections to Server1.
Which additional name suffix entry should you add from the Remote Access Setup wizard?

• A. A Name Suffix value of dal.contoso.com and a blank DNS Server Address value
• B. A Name Suffix value of Server1.contoso.com and a DNS Server Address value of 65.55.37.62
• C. A Name Suffix value of dal.contoso.com and a DNS Server Address value of 65.55.37.62
• D. A Name Suffix value of Server1.contoso.com and a blank DNS Server Address value

Answer: A

Explanation: Split-brain DNS is the use of the same DNS domain for both Internet and intranet resources. For example, the Contoso Corporation is using split brain DNS; contoso.com is the domain name for intranet resources and Internet resources. Internet users use http:
//www.contoso.com to access Contoso’s public Web site and Contoso employees on the Contoso intranet use http: //www.contoso.com to access Contoso’s intranet Web site. A Contoso employee with their laptop that is not a DirectAccess client on the intranet that accesses http: //www.contoso.com sees the intranet Contoso Web site. When they take their laptop to the local coffee shop and access that same URL, they will see the public Contoso Web site.
When a DirectAccess client is on the Internet, the Name Resolution Policy Table (NRPT) sends DNS name queries for intranet resources to intranet DNS servers. A typical NRPT for DirectAccess will have a rule for the namespace of the organization, such as contoso.com for the Contoso Corporation, with the Internet Protocol version 6 (IPv6) addresses of intranet DNS servers. With just this rule in the NRPT, when a user on a DirectAccess client on the Internet attempts to access the uniform resource locator (URL) for their Web site (such as http: //www.contoso.com), they will see the intranet version. Because of this rule, they will never see the public version of this URL when they are on the Internet.
For split-brain DNS deployments, you must list the FQDNs that are duplicated on the Internet and intranet and decide which resources the DirectAccess client should reach, the intranet version or the public (Internet) version. For each name that corresponds to a resource for which you want DirectAccess clients to reach the public version, you must add the corresponding FQDN as an exemption rule to the NRPT for your DirectAccess clients. Name suffixes that do not have corresponding DNS servers are treated as exemptions.
References:
http: //technet. microsoft. com/en-us/library/ee382323(v=ws. 10). aspx

NEW QUESTION 20
HOTSPOT
Your network contains one Active Directory forest named contoso.com.
All client computers for the sales department are in an organizational unit (OU) named Sales. All of the sales department computers run Windows 8.1.
You plan to use Group Policy preferences to map several drives on the sales department computers.
You need to perform the following actions:
• Create a drive mapping on all of the sales department computers for drive X. If drive X already exists, the current drive mapping should NOT be modified.
• Create a drive mapping on all of the sales department computers for drive Y. If drive Y already exists, the UNC path must be modified, but all other settings must be maintained.
Which action should you use for each drive mapping? To answer, select the appropriate options in the answer area.

Answer:

Explanation: Create – If a drive mapping doesn’t exist for this user for the share “shareuserDocuments”, then create one. If there already is one, don’t do anything! It’s a kind, gentle sort of policy, it won’t overwrite anything you already have, so it has a Green icon associated in the UI. Update – If that drive mapping exists, it will be updated with the settings specified here. If there are other settings associated with the drive mapping that aren’t specified here, they will be maintained. If no drive mapping exists for this share, create it. https://blogs.technet.microsoft.com/grouppolicy/2009/10/26/group-policy-preferences-colorful-and-mysteriously-powerful-just-like-windows-7/