NEW QUESTION 1
Your network contains an Active Directory domain.
You have a user account that is a member if the Domain Admins group.
You have 100 laptops that have a standard corporate image installed. The laptops are in workgroups and have random names.
A technician named Tech1 is assigned the task of joining the laptops to the domain. The computer accounts of each laptop must be in an organizational unit (OU) that is associated to the department of the user who will use the laptop. The laptop names must start with four characters indicating the department, followed by a fourdigit number.
Tech1 is a member of the Domain Users group only. Tech1 has the administrator logon credentials for all the laptops.
You need Tech1 to join the laptops to the domain. The solution must ensure that the laptops are named correctly, and the computer accounts of the laptops are in the correct OUs.
Solution: You pre-create the computer account of each laptop in Active Directory Users and Computers.
You instruct Tech1 to sign in to each laptop, to rename each laptop, and then to join each laptop to the domain by using System in Control Panel.
Does this meet the goal?

• A. Yes
• B. No

Answer: B

NEW QUESTION 2
Your network contains an Active Directory forest named contoso.com. The forest contains a member server named Server1. Server1 has several line-of-business applications. Each application runs as a service that uses the Network Service account. You need to configure the line-of-business applications to run by using a virtual account. What should you do?

• A. From the Services console, modify the Log On properties of the services.
• B. From the Microsoft Application Compatibility Toolkit (ACT), create a shim.
• C. From Windows PowerShell, run the Install-ADScrviceAccount cmdlet.
• D. From Windows PowerShell, run the New-ADServiccAccount cmdlet.

Answer: A

NEW QUESTION 3
Your network contains an Active Directory forest. The forest contains a domain named contoso.com. The domain contains three domain controllers.
A domain controller named lon-dc1 fails. You are unable to repair lon-dc1.
You need to prevent the other domain controllers from attempting to replicate to lon-dc1. Solution: From ntdsutil.exe, you perform a metadata cleanup.
Does this meet the goal?

• A. Yes
• B. NO

Answer: A

NEW QUESTION 4
You have a server named Server1 that runs Windows Server 2021. Server1 has the Web Application Proxy role service installed.
You are publishing an application named App1 that will use Integrated Windows authentication as shown in the following graphic.

Use the drop-down menus to select the answer area choice that completes each statement based on the information presented in the graphic.

Answer:

Explanation:

NEW QUESTION 5
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory forest named contoso.com. The forest contains a member server named Server1 that runs Windows Server 2021. All domain controllers run Windows Server 2012 R2.
Contoso.com has the following configuration. PS C:> (Get-ADForest).ForestMode Windows2008R2Forest
PS C:> (Get-ADDomain).DomainMode Windows2008R2Domain
PS C:>
You plan to deploy an Active Directory Federation Services (AD FS) farm on Server1 and to configure device registration.
You need to configure Active Directory to support the planned deployment. Solution: You raise the domain functional level to Windows Server 2012 R2. Does this meet the goal?

• A. Yes
• B. No

Answer: B

Explanation: Device Registration requires Windows Server 2012 R2 forest schema (not just domain schema).

NEW QUESTION 6
Your network contains an Active Directory domain named adatum.com. The domain contains the servers configured as shown in the following table:

You have a server named Server6 in the perimeter network. Each server has the local users show in the following table.

The domain contains the users shown in the following table.

You install a Web Application Proxy on Server6.
You need to configure the Web Application proxy on Server6. The solution must use the principle of least privilege.
Which account should you specify in the Web Application Proxy Configuration Wizard? To answer, select the appropriate options in the answer are.
NOTE: Each correct selection is worth one point.

Answer:

Explanation: The user account used to configure the web application proxy must have local Administrator permission on the WAP server(s), and have access to an account that have local Administrator permissions on the AD FS servers.
References:
http://www.mistercloudtech.com/2015/11/25/how-to-install-and-configure-web-application-proxy-for-adfs/

NEW QUESTION 7
Your network contains an Active Directory domain named contoso.com. The domain contains an administrative workstation named WKS1 that runs Windows 10.
You have a Group Policy object (GPO) named GPO1.
You download a custom administrative template that contains the following files:
You need to ensure that you can configure GPO1 by using the settings in the new administrative template. To where should you copy each file? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation: References:
https://support.microsoft.com/en-us/help/918239/how-to-write-custom-adm-and-admx-administrative-template-f

NEW QUESTION 8
Your network contains an Active Directory domain named contoso.com. The network contains several IP subnets. One of the subnets uses a network ID if 192.168.10.0/24.
You link a Group Policy object (GPO) named GPO1 to the domain.
You need to map a drive to a specific file share on the computers in the 192.168.10.0/24 network only. What should you do?

• A. From the User Configuration node of GPO1, configure the Folder Redirection setting
• B. Link a WMI filter to GPO1.
• C. From the Computer Configuration mode of GPO1, configure the Network Connections setting
• D. Link a WMI filter to GPO1.
• E. From the User Configuration node of GPO1, create a Group Policy preference that uses item-level targeting.
• F. From the Computer Configuration node of GPO1, create a Group Policy preference that uses item-level targeting.

Answer: C

NEW QUESTION 9
Your network contains an Active Directory domain named contoso.com. You need to create a central store for Group Policy administrator templates. What should you use?

• A. Dcgpofix.exe
• B. Copy-Item
• C. Copy-GPO
• D. Group Policy Management Console (GPMC)

Answer: B

NEW QUESTION 10
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a server named Web1 that runs Windows Server 2021.
You need to list all the SSL certificates on Web1 that will expire during the next 60 days. Solution: You run the following command.

Does this meet the goal?

• A. Yes
• B. No

Answer: B

NEW QUESTION 11
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You network contains an Active Directory forest named contoso.com. The forest contains an Active Directory Rights Management Services (AD RMS) deployment.
Your company establishes a partnership with another company named Fabrikam, Inc. The network of Fabrikam contains an Active Directory forest named fabrikam.com and an AD RMS deployment.
You need to ensure that the users in contoso.com can access rights protected documents sent by the users in fabrikam.com.
Solution: From AD RMS in fabrikam.com, you configure contoso.com as a trusted publisher domain. Does this meet the goal?

• A. Yes
• B. No

Answer: B

Explanation: Contoso needs to trust Fabrikam.

NEW QUESTION 12
Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series.
Start of repeated scenario.
Your network contains an Active Directory domain named contoso.com. The domain contains a single site named Site1. All computers are in Site1.
The Group Policy objects (GPOs) for the domain are configured as shown in the exhibit. (Click the Exhibit button.)

The relevant users and client computer in the domain are configured as shown in the following table.

End of repeated scenario.
Which five GPOs will apply to User1 in sequence when the user signs in to Computer1? To answer, move the appropriate GPOs from the list to the answer area and arrange them in the correct order.

Answer:

Explanation:

NEW QUESTION 13
Your company has a testing environment that contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2021. Server1 has IP Address Management (IPAM) installed. IPAM has the following configuration.

The IPAM Overview page from Server Manager is shown in the IPAM Overview exhibit. (Click the Exhibit button.)

The group policy configurations are shown in the GPO exhibit. (Click the Exhibit button.) For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Answer:

Explanation: No domains have been selected in the “Configure Server Discovery” option. Therefore, no automatic discovery will take place. Manual addition of a server will also fail because IPAM needs a domain configured for server verification.

NEW QUESTION 14
Your network contains an Active Directory forest named contoso.com.
A partner company has a forest named fabrikam.com. Each forest contains one domain.
You need to provide access for a group named Research in fabrikam.com to resources in contoso.com. The solution must use the principle of least privilege.
What should you do?

• A. Create an external trust from fabrikam.com to contoso.co
• B. Enable Active Directory split permissions in fabrikam.com.
• C. Create an external trust from contoso.com to fabrikam.co
• D. Enable Active Directory split permissions in contoso.com.
• E. Create a one-way forest trust from contoso.com to fabrikam.com that uses selective authentication.
• F. Create a one-way forest trust from fabrikam.com to contoso.com that uses selective authentication.

Answer: C

NEW QUESTION 15
Your company implements Active Directory Federation Services (AD FS).
You confirm that the company meets all the prerequisites for using Microsoft Azure Multi-Factor Authentication (MFA) and AD FS.
You need to ensure that you can select MFA as the primary authentication method for AD FS.
Which three actions should you perform in sequence? To answer move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Answer:

Explanation:

NEW QUESTION 16
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You network contains an Active Directory forest named contoso.com. The forest contains an Active Directory
Rights Management Services (AD RMS) deployment.
Your company establishes a partnership with another company named Fabrikam, Inc. The network of Fabrikam contains an Active Directory forest named fabrikam.com and an AD RMS deployment.
You need to ensure that the users in contoso.com can access rights protected documents sent by the users in fabrikam.com.
Solution: From AD RMS in contoso.com, you configure fabrikam.com as a trusted publisher domain. Does this meet the goal?

• A. Yes
• B. No

Answer: A