Download Configuring Advanced Windows Server 2012 Services.70-412.SelftestTraining.2019-07-19.271q.vcex

Security Considerations for Trusts Need to gain access to the resources in contoso.com Disabling SID Filter Quarantining on External Trusts Although it reduces the security of your forest (and is therefore not recommended), you can disable SID filter quarantining for an external trust by using the Netdom.exe tool. You should consider disabling SID filter quarantining only in the following situations:* Users have been migrated to the trusted domain with their SID histories preserved, and you want to grant them access to resources in the trusting domain based on the SID history attribute. Etc. Incorrect Answers:B. Enables administrators to manage Active Directory domains and trust relationships from the command prompt, /quarantine Sets or clears the domain quarantine. D. Selective authentication over a forest trust restricts access to only those users in a trusted forest who have been explicitly given authentication permissions to computer objects (resource computers) that reside in the trusting forest. References: Security Considerations for Trustshttps://technet.microsoft.com/en-us/library/cc755321(v=ws.10).aspx

repadmin /prp will allow the password caching of the local administrator to the RODC. This command lists and modifies the Password Replication Policy (PRP) for read-only domain controllers (RODCs). References: RODC Administrationhttps://technet.microsoft.com/en-us/library/cc755310%28v=ws.10%29.aspx

We create a new site link between Montreal and Amsterdam and schedule it only between 20:00 and08:00. To ensure that traffic between Montreal and Amsterdam only occurs at this time we also remove Amsterdam from the DEFAULTIPSITELINK.References:https://technet.microsoft.com/en-us/library/cc755994(v=ws.10).aspx

The Stop-NlbClusterNode cmdlet stops a node in an NLB cluster. When you use the stop the nodes in the cluster, client connections that are already in progress are interrupted. To avoid interrupting active connections, consider using the -drain parameter, which allows the node to continue servicing active connections but disables all new traffic to that node. -Drain <SwitchParameter> Drains existing traffic before stopping the cluster node. If this parameter is omitted, existing traffic will be dropped. References:https://docs.microsoft.com/en-us/powershell/module/networkloadbalancingclusters/stop-nlbclusternode

Add-ClusterGenericApplicationRole Configure high availability for an application that was not originally designed to run in a failover cluster. If you run an application as a Generic Application, the cluster software will start the application, then periodically query the operating system to see whether the application appears to be running. If so, it is presumed to be online, and will not be restarted or failed over. EXAMPLE 1. Command Prompt: C:\PS>Add-ClusterGenericApplicationRole -CommandLine NewApplication.exe  Name                       OwnerNode                           State  ----                       ---------                           -----  cluster1GenApp             node2                              Online Description ----------- This command configures NewApplication.exe as a generic clustered application. A default name will be used for client access and this application requires no storage. Reference: Add-ClusterGenericApplicationRolehttp://technet.microsoft.com/en-us/library/ee460976.aspx

Enterprise CAs must be domain members. From the exhibit we see that it is only a Workgroup member. Note:A new CA can be the root CA of a new PKI or subordinate to another in an existing PKI. Enterprise subordinate certification authority. An enterprise subordinate CA must get a CA certificate from an enterprise root CA but can then issue certificates to all users and computers in the enterprise. These types of CAs are often used for load balancing of an enterprise root CA.   References:https://forsenergy.com/en-us/certsvr/html/e9bd1194-e088-4671-840f-0847cf5ee2a0.htm

The west.contoso.com are the ones in trouble that need to be redirected to the west.contoso.com not the east.contoso.com. Note: It is recommended that you use GPO to deploy AD RMS client settings and that you only deploy settings as needed.References:https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj735304(v=ws.11)

The error message is related to missing role configuration. Cannot Manage Active Directory Certificate Services Resolution: configure the two Certification Authority and Certification Authority Web Enrollment Roles.  Active Directory Certificate Services (AD CS) is an Active Directory tool that lets administrators customize services in order to issue and manage public key certificates. AD CS included:CA Web enrollment - connects users to a CA with a Web browser Certification authorities (CAs) - manages certificate validation and issues certificates Etc. Incorrect Answers:A, E. The CA is installed, it just need to be configured correctly. Note: Install-AdcsCertificationAuthorityThe Install-AdcsCertificationAuthority cmdlet performs installation and configuration of the AD CS CA role service. References: Cannot manage Active Directory Certificate Services in Server 2012 Error 0x800070002; Active Directory Certificate Services (AD CS) Definitionhttp://searchwindowsserver.techtarget.com/definition/Active-Directory-Certificate-Services-AD-CS

C. To enable Device Registration Service On your federation server, open a Windows PowerShell command window and type:Enable-AdfsDeviceRegistration Repeat this step on each federation farm node in your AD FS farm. E. Enable seamless second factor authentication Seamless second factor authentication is an enhancement in AD FS that provides an added level of access protection to corporate resources and applications from external devices that are trying to access them. When a personal device is Workplace Joined, it becomes a `known' device and administrators can use this information to drive conditional access and gate access to resources. To enable seamless second factor authentication, persistent single sign-on (SSO) and conditional access for Workplace Joined devices. In the AD FS Management console, navigate to Authentication Policies. Select Edit Global Primary Authentication. Select the check box next to Enable Device Authentication, and then click OK. References:https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/configure-a-federation-server-with-device-registration-service

The default user template supports all of the requirements EXCEPT auto enroll as shown below:  However a duplicated template from users has the ability to autoenroll:  The Automatic Certificate Request Settings GPO setting is only available to Computer, not user.   References:https://technet.microsoft.com/en-us/library/dd851772.aspx