70-412: Configuring Advanced Windows Server 2012 Services

Your company recently deployed a new Active Directory forest named contoso.com. The first domain controller in the forest runs Windows Server 2012 R2.

You need to identify the time-to-live (TTL) value for domain referrals to the NETLOGON and SYSVOL shared folders.

Which tool should you use?

Ultrasound
Replmon
Dfsdiag
Frsutil

Correct answer: C

Explanation:

DFSDIAG can check your configuration in five different ways:Checking referral responses (DFSDIAG /TestReferral) Checking domain controller configuration Checking site associations Checking namespace server configuration Checking individual namespace configuration and integrity References: https://blogs.technet.microsoft.com/josebda/2009/07/15/five-ways-to-check-your-dfs-namespaces-dfs-n-configuration-with-the-dfsdiag-exe-tool/

DFSDIAG can check your configuration in five different ways:

Checking referral responses (DFSDIAG /TestReferral)
Checking domain controller configuration
Checking site associations
Checking namespace server configuration
Checking individual namespace configuration and integrity

References: https://blogs.technet.microsoft.com/josebda/2009/07/15/five-ways-to-check-your-dfs-namespaces-dfs-n-configuration-with-the-dfsdiag-exe-tool/

Your network contains two Active Directory forests named contoso.com and adatum.com. Contoso.com contains one domain. Adatum.com contains a child domain named child.adatum.com.

Contoso.com has a one-way forest trust to adatum.com. Selective authentication is enabled on the forest trust.

Several user accounts are migrated from child.adatum.com to adatum.com. Users report that after the migration, they fail to access resources in contoso.com. The users successfully accessed the resources in contoso.com before the accounts were migrated.

You need to ensure that the migrated users can access the resources in contoso.com.

What should you do?

Replace the existing forest trust with an external trust.
Run netdom and specify the /quarantine attribute.
Disable SID filtering on the existing forest trust.
Disable selective authentication on the existing forest trust.

Correct answer: C

Explanation:

Security Considerations for Trusts Need to gain access to the resources in contoso.com Disabling SID Filter Quarantining on External Trusts Although it reduces the security of your forest (and is therefore not recommended), you can disable SID filter quarantining for an external trust by using the Netdom.exe tool. You should consider disabling SID filter quarantining only in the following situations:* Users have been migrated to the trusted domain with their SID histories preserved, and you want to grant them access to resources in the trusting domain based on the SID history attribute. Etc. Incorrect Answers:B. Enables administrators to manage Active Directory domains and trust relationships from the command prompt, /quarantine Sets or clears the domain quarantine. D. Selective authentication over a forest trust restricts access to only those users in a trusted forest who have been explicitly given authentication permissions to computer objects (resource computers) that reside in the trusting forest. References: Security Considerations for Trustshttps://technet.microsoft.com/en-us/library/cc755321(v=ws.10).aspx

Security Considerations for Trusts

Need to gain access to the resources in contoso.com

Disabling SID Filter Quarantining on External Trusts

Although it reduces the security of your forest (and is therefore not recommended), you can disable SID filter quarantining for an external trust by using the Netdom.exe tool. You should consider disabling SID filter quarantining only in the following situations:

* Users have been migrated to the trusted domain with their SID histories preserved, and you want to grant them access to resources in the trusting domain based on the SID history attribute.

Etc.

Incorrect Answers:

B. Enables administrators to manage Active Directory domains and trust relationships from the command prompt, /quarantine Sets or clears the domain quarantine.

D. Selective authentication over a forest trust restricts access to only those users in a trusted forest who have been explicitly given authentication permissions to computer objects (resource computers) that reside in the trusting forest.

References: Security Considerations for Trusts

https://technet.microsoft.com/en-us/library/cc755321(v=ws.10).aspx

Your network contains an Active Directory forest named adatum.com. The forest contains a single domain. The domain contains four servers. The servers are configured as shown in the following table.

You need to update the schema to support a domain controller that will run Windows Server 2012 R2.

On which server should you run adprep.exe?

Server1
DC3
DC2
DC1

Correct answer: B

Explanation:

We must use the Windows Server 2008 R2 Server. Upgrade Domain Controllers to Windows Server 2012 R2 and Windows Server 2012 You can use adprep.exe on domain controllers that run 64-bit versions of Windows Server 2008 or Windows Server 2008 R2 to upgrade to Windows Server 2012. You cannot upgrade domain controllers that run Windows Server 2003 or 32-bit versions of Windows Server 2008. To replace them, install domain controllers that run a later version of Windows Server in the domain, and then remove the domain controllers that Windows Server 2003. Reference: http://technet.microsoft.com/en-us/library/hh994618.aspx#BKMK_UpgradePaths

We must use the Windows Server 2008 R2 Server.

Upgrade Domain Controllers to Windows Server 2012 R2 and Windows Server 2012

You can use adprep.exe on domain controllers that run 64-bit versions of Windows Server 2008 or Windows Server 2008 R2 to upgrade to Windows Server 2012. You cannot upgrade domain controllers that run Windows Server 2003 or 32-bit versions of Windows Server 2008. To replace them, install domain controllers that run a later version of Windows Server in the domain, and then remove the domain controllers that Windows Server 2003.

Reference:

http://technet.microsoft.com/en-us/library/hh994618.aspx#BKMK_UpgradePaths

Your network contains an Active Directory forest named contoso.com. The forest contains two domains named contoso.com and child1.contoso.com. The domains contain three domain controllers.

The domain controllers are configured as shown in the following table.

You need to ensure that the KDC support for claims, compound authentication, and Kerberos armoring setting is enforced in the child1.contoso.com domain.

Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

Upgrade DC1 to Windows Server 2012 R2.
Upgrade DC11 to Windows Server 2012 R2.
Raise the domain functional level of child1.contoso.com.
Raise the domain functional level of contoso.com.
Raise the forest functional level of contoso.com.

Correct answer: AD

Explanation:

The root domain in the forest must be at Windows Server 2012level. First upgrade DC1 to this level (A), then raise the contoso.com domain functional level to Windows Server 2012 (D). (A) To support resources that use claims-based access control, the principal’s domains will need to be running one of the following:All Windows Server 2012 domain controllers Sufficient Windows Server 2012domain controllers to handle all the Windows 8 device authentication requests Sufficient Windows Server 2012 domain controllers to handle all the Windows Server 2012 resource protocol transition requests to support non-Windows 8 devices. References:https://technet.microsoft.com/en-us/library/hh831747.aspx.

The root domain in the forest must be at Windows Server 2012level. First upgrade DC1 to this level (A), then raise the contoso.com domain functional level to Windows Server 2012 (D).

(A) To support resources that use claims-based access control, the principal’s domains will need to be running one of the following:

All Windows Server 2012 domain controllers
Sufficient Windows Server 2012domain controllers to handle all the Windows 8 device authentication requests
Sufficient Windows Server 2012 domain controllers to handle all the Windows Server 2012 resource protocol transition requests to support non-Windows 8 devices.

References:

https://technet.microsoft.com/en-us/library/hh831747.aspx.

Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2012 R2. The domain contains two domain controllers.

The domain controllers are configured as shown in the following table.

You configure a user named User1 as a delegated administrator of DC10.

You need to ensure that User1 can log on to DC10 if the network link between the Main site and the Branch site fails.

What should you do?

Add User1 to the Domain Admins group.
On DC10, modify the User Rights Assignment in Local Policies.
Run repadmin and specify the /prp parameter.
On DC10, run ntdsutil and configure the settings in the Roles context.
Run repadmin and specify /replsingleobject parameter.
On DC1, modify the User Rights Assignment in Default Controllers Group Policy object (GPO).

Correct answer: C

Explanation:

repadmin /prp will allow the password caching of the local administrator to the RODC. This command lists and modifies the Password Replication Policy (PRP) for read-only domain controllers (RODCs). References: RODC Administrationhttps://technet.microsoft.com/en-us/library/cc755310%28v=ws.10%29.aspx

repadmin /prp will allow the password caching of the local administrator to the RODC.

This command lists and modifies the Password Replication Policy (PRP) for read-only domain controllers (RODCs).

References: RODC Administration

https://technet.microsoft.com/en-us/library/cc755310%28v=ws.10%29.aspx

Your network contains two servers named HV1 and HV2. Both servers run Windows Server 2012 R2 and have the Hyper-V server role installed.

HV1 hosts 25 virtual machines. The virtual machine configuration files and the virtual hard disks are stored in D:\VM.

You shut down all of the virtual machines on HV1.

You copy D:\VM to D:\VM on HV2.

You need to start all of the virtual machines on HV2. You want to achieve this goal by using the minimum amount of administrative effort.

What should you do?

Run the Import-VMInitialReplication cmdlet.
From HV1, export all virtual machines to D:\VM. Copy D:\VM to D:\VM on HV2 and overwrite the existing files. On HV2, run the Import Virtual Machine wizard.
From HV1, export all virtual machines to D:\VM. Copy D:\VM to D:\VM on HV2 and overwrite the existing files. On HV2, run the New Virtual Machine wizard.
Run the Import-VM cmdlet.

Correct answer: D

Explanation:

Import-VM Imports a virtual machine from a file. Example Imports the virtual machine from its configuration file. The virtual machine is registered in-place, so its files are not copied. Windows PowerShell PS C:\> Import-VM Path 'D:\Test\VirtualMachines\5AE40946-3A98-428E-8C83- 081A3C6BD18C.XML'References:https://docs.microsoft.com/en-us/powershell/module/hyper-v/import-vm

Import-VM

Imports a virtual machine from a file.

Example

Imports the virtual machine from its configuration file. The virtual machine is registered in-place, so its files are not copied.

Windows PowerShell

PS C:\> Import-VM Path 'D:\Test\VirtualMachines\5AE40946-3A98-428E-8C83- 081A3C6BD18C.XML'

References:

https://docs.microsoft.com/en-us/powershell/module/hyper-v/import-vm

Your network contains a perimeter network and an internal network. The internal network contains an Active Directory Federation Services (AD FS) 2.1 infrastructure. The infrastructure uses Active Directory as the attribute store.

You plan to deploy a federation server proxy to a server named Server2 in the perimeter network.

You need to identify which value must be included in the certificate that is deployed to Server2.

What should you identify?

The FQDN of the AD FS server
The name of the Federation Service
The name of the Active Directory domain
The public IP address of Server2

Correct answer: A

Explanation:

To add a host (A) record to corporate DNS for a federation server On a DNS server for the corporate network, open the DNS snap-in. 1. In the console tree, right-click the applicable forward lookup zone, and then click New Host (A). 2. In Name, type only the computer name of the federation server or federation server cluster (for example, type fs for the fully qualified domain name (FQDN) fs.adatum.com). 3. In IP address, type the IP address for the federation server or federation server cluster (for example, 192.168.1.4). 4. Click Add Host. References:https://technet.microsoft.com/en-us/library/cc776786(v=ws.10).aspx

To add a host (A) record to corporate DNS for a federation server On a DNS server for the corporate network, open the DNS snap-in.

1. In the console tree, right-click the applicable forward lookup zone, and then click New Host (A).

2. In Name, type only the computer name of the federation server or federation server cluster (for example, type fs for the fully qualified domain name (FQDN) fs.adatum.com).

3. In IP address, type the IP address for the federation server or federation server cluster (for example, 192.168.1.4).

4. Click Add Host.

References:

https://technet.microsoft.com/en-us/library/cc776786(v=ws.10).aspx

Your network contains an Active directory forest named contoso.com. The forest contains two child domains named east.contoso.com and west.contoso.com.

You install an Active Directory Rights Management Services (AD RMS) cluster in each child domain.

You discover that all of the users in the contoso.com forest are directed to the AD RMS cluster in east.contoso.com.

You need to ensure that the users in west.contoso.com are directed to the AD RMS cluster in west.contoso.com and that the users in east.contoso.com are directed to the AD RMS cluster in east.contoso.com.

What should you do?

Modify the Service Connection Point (SCP).
Configure the Group Policy object (GPO) settings of the users in the west.contoso.com domain.
Configure the Group Policy object (GPO) settings of the users in the east.contoso.com domain.
Modify the properties of the AD RMS cluster in west.contoso.com.

Correct answer: B

Explanation:

The west.contoso.com are the ones in trouble that need to be redirected to the west.contoso.com not the east.contoso.com. Note: It is recommended that you use GPO to deploy AD RMS client settings and that you only deploy settings as needed.References:https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj735304(v=ws.11)

The west.contoso.com are the ones in trouble that need to be redirected to the west.contoso.com not the east.contoso.com.

Note: It is recommended that you use GPO to deploy AD RMS client settings and that you only deploy settings as needed.

References:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj735304(v=ws.11)

You have a server named Server1 that runs Windows Server 2012 R2.

From Server Manager, you install the Active Directory Certificate Services server role on Server1.

A domain administrator named Admin1 logs on to Server1.

When Admin1 runs the Certification Authority console, Admin1 receive the following error message.

You need to ensure that when Admin1 opens the Certification Authority console on Server1, the error message does not appear.

What should you do?

Install the Active Directory Certificate Services (AD CS) tools.
Run the regsvr32.exe command.
Modify the PATH system variable.
Configure the Active Directory Certificate Services server role from Server Manager.
Run the Install-AdcsCertificationAuthority cmdlet.
Add Admin1 to the Cert Publishers group.
Add Admin1to the Enterprise Admins group.
Run the Install-WindowsFeature cmdlet

Correct answer: D

Explanation:

The error message is related to missing role configuration. Cannot Manage Active Directory Certificate Services Resolution: configure the two Certification Authority and Certification Authority Web Enrollment Roles. Active Directory Certificate Services (AD CS) is an Active Directory tool that lets administrators customize services in order to issue and manage public key certificates. AD CS included:CA Web enrollment - connects users to a CA with a Web browser Certification authorities (CAs) - manages certificate validation and issues certificates Etc. Incorrect Answers:A, E. The CA is installed, it just need to be configured correctly. Note: Install-AdcsCertificationAuthorityThe Install-AdcsCertificationAuthority cmdlet performs installation and configuration of the AD CS CA role service. References: Cannot manage Active Directory Certificate Services in Server 2012 Error 0x800070002; Active Directory Certificate Services (AD CS) Definitionhttp://searchwindowsserver.techtarget.com/definition/Active-Directory-Certificate-Services-AD-CS

The error message is related to missing role configuration.

Cannot Manage Active Directory Certificate Services

Resolution: configure the two Certification Authority and Certification Authority Web Enrollment Roles.

Active Directory Certificate Services (AD CS) is an Active Directory tool that lets administrators customize services in order to issue and manage public key certificates.

AD CS included:

CA Web enrollment - connects users to a CA with a Web browser

Certification authorities (CAs) - manages certificate validation and issues certificates

Etc.

Incorrect Answers:

A, E. The CA is installed, it just need to be configured correctly.

Note: Install-AdcsCertificationAuthority

The Install-AdcsCertificationAuthority cmdlet performs installation and configuration of the AD CS CA role service.

References: Cannot manage Active Directory Certificate Services in Server 2012 Error 0x800070002; Active Directory Certificate Services (AD CS) Definition

http://searchwindowsserver.techtarget.com/definition/Active-Directory-Certificate-Services-AD-CS

Your network contains an Active Directory domain named contoso.com.

A previous administrator implemented a Proof of Concept installation of Active Directory Rights Management Services (AD RMS).

After the proof of concept was complete, the Active Directory Rights Management Services server role was removed.

You attempt to deploy AD RMS.

During the configuration of AD RMS, you receive an error message indicating that an existing AD RMS Service Connection Point (SCP) was found.

You need to remove the existing AD RMS SCP.

Which tool should you use?

Active Directory Users and Computers
Authorization Manager
Active Directory Domains and Trusts
Active Directory Sites and Services
Active Directory Rights Management Services

Correct answer: E

Explanation:

ADRMS will registered the Service Connection Point (SCP) in Active Directory and you will need to unregister first before you remove the ADRMS server role. If your ADRMS server is still alive, you can easily manually remove the SCP by below: References:https://www.jqit.com.au/blog/how-to-manually-remove-or-reinstall-adrms/

ADRMS will registered the Service Connection Point (SCP) in Active Directory and you will need to unregister first before you remove the ADRMS server role.

If your ADRMS server is still alive, you can easily manually remove the SCP by below: