70-742 Identity with Windows Server 2016 exam questions online

1. HOTSPOT

Your network contains an Active Directory domain named contoso.com. The domain contains four servers named Server1, Server2, Server3, and Server4 that run Windows Server 2016.

Server1 has IP Address Management (IPAM) installed. Server2, Server3, and Server 4 have the DHCP Server role installed. IPAM manages Server2, Server3, and Server4.

A domain user named User1 is a member of the groups shown in the following table.

Which actions can User1 perform? To answer, select the appropriate options in the answer area.

2. HOTSPOT

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016.

You install IP Address Management (IPAM) on Server1. You select the automatic provisioning method, and then you specify a prefix of IPAM1.

You need to configure the environment for automatic IPAM provisioning.

Which cmdlet should you run? To answer, select the appropriate options in the answer area.

3. HOTSPOT

Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2 that run Windows Server 2016.

Server1 has IP Address Management (IPAM) installed. Server2 has the DHCP Server role installed. The IPAM server retrieves data from Server2.

The domain has two users named User1 and User2 and a group named Group1. User1 is the only member of Group1.

Server1 has one IPAM access policy. You edit the access policy as shown in the Policy exhibit. (Click the Exhibit button.)

The DHCP scopes are configured as shown in the Scopes exhibit. (Click the Exhibit button.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

4. HOTSPOT

Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2 that run Windows Server 2016.

Server1 has Microsoft System Center 2016 Virtual Machine Manager (VMM) installed. Server2 has IP Address Management (IPAM) installed.

You create a domain user named User1.

You need to integrate IPAM and VMM. VMM must use the account of User1 to manage IPAM. The solution must use the principle of least privilege.

What should you do on each server? To answer, select the appropriate options in the answer area.

5. HOTSPOT

Your network contains an Active Directory domain named contoso.com. The domain contains a member server named Server1 that runs Windows Server 2016.

Server1 has IP Address Management (IPAM) installed. IPAM uses a Windows Internal Database.

You install Microsoft SQL Server on Server1.

You plan to move the IPAM database to SQL Server.

You need to create a SQL Server login for the IPAM service account.

For which user should you create the login? To answer, select the appropriate options in the answer area.

6. HOTSPOT

Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2 that run Windows Server 2016.

Server1 has IP Address Management (IPAM) installed. Server2 has the DHCP Server role installed. The IPAM server retrieves data from Server2.

You create a domain user account named User1.

You need to ensure that User1 can use IPAM to manage DHCP.

Which command should you run on Server1? To answer, select the appropriate options in the answer area.

7. HOTSPOT

Your company has a testing environment that contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016. Server1 has IP Address Management (IPAM) installed. IPAM has the following configuration.

The IPAM Overview page from Server Manager is shown in the IPAM Overview exhibit. (Click the Exhibit button.)

The group policy configurations are shown in the GPO exhibit. (Click the Exhibit button.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

8. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution. Determine whether the solution meets the stated goals.

Your network contains an Active Directory domain named contoso.com. The domain contains a DNS server named Server1. All client computers run Windows 10.

On Server1, you have the following zone configuration.

You need to ensure that all of the client computers in the domain perform DNSSEC validation for the fabrikam.com namespace.

Solution: From a Group Policy object (GPO) in the domain, you add a rule to the Name Resolution Policy Table (NRPT).

Does this meet the goal?

9. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You deploy a new Active Directory forest.

You need to ensure that you can create a group Managed Service Account (gMSA) for multiple member servers.

Solution: From Windows PowerShell on a domain controller, you run the Set-KdsConfiguration cmdlet.

Does this meet the goal?

10. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You deploy a new Active Directory forest.

You need to ensure that you can create a group Managed Service Account (gMSA) for multiple member servers.

Solution: You configure Kerberos constrained delegation on the computer account of each domain controller.

Does this meet the goal?

11. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You deploy a new Active Directory forest.

You need to ensure that you can create a group Managed Service Account (gMSA) for multiple member servers.

Solution: You configure Kerberos constrained delegation on the computer account of each member server.

Does this meet the goal?

12. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016. The Computer account for Server1 is in organizational unit (OU) named OU1.

You create a Group Policy object (GPO) named GPO1 and link GPO1 to OU1.

You need to add a domain user named user1 to the local Administrators group on Server1.

Solution: From the Computer Configuration node of GPO1, you configure the local Users and Groups preference.

Does this meet the goal?

13. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016. The Computer account for Server1 is in organizational unit (OU) named OU1.

You create a Group Policy object (GPO) named GPO1 and link GPO1 to OU1.

You need to add a domain user named user1 to the local Administrators group on Server1.

Solution: From the Computer Configuration node of GPO1, you configure the Restricted Groups settings.

Does this meet the goal?

14. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a server named Web1 that runs Windows Server 2016.

You need to list all the SSL certificates on Web1 that will expire during the next 60 days.

Solution: You run the following command.

Get-ChildItem Cert:LocalMachineTrust |? { $_.NotAfter CIt (Get-Date).AddDays( 60 ) }

Does this meet the goal?

15. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a server named Web1 that runs Windows Server 2016.

You need to list all the SSL certificates on Web1 that will expire during the next 60 days.

Solution: You run the following command.

Does this meet the goal?

16. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a server named Web1 that runs Windows Server 2016.

You need to list all the SSL certificates on Web1 that will expire during the next 60 days.

Solution: You run the following command.

Does this meet the goal?

17. Your network contains an Active Directory domain named contoso.com. The domain contains an enterprise certification authority (CA) named CA1.

You duplicate the Computer certificate template, and you name the template Cont_Computers.

You need to ensure that all of the certificates issued based on Cont_Computers have a key size of 4,096 bits.

What should you do?

18. Your network contains an Active Directory domain named contoso.com.

Domain users use smart cards to sign in to their client computer.

Some users report that it takes a long time to sign in to their computer and that the logon attempt times out, so they must restart the sign in process.

You discover that the issues to checking the certificate revocation list (CRL) of the smart card certificates.

You need to resolve the issue without diminishing the security of the smart card logons.

What should you do?

19. Your company has a marketing department and a security department.

The network contains an Active Directory domain named contoso.com. The domain contains an enterprise certification authority (CA).

You have two organizational units (OUs) named MKT_UsersOU and MKT_ComputersOU. MKT_UsersOU contains the user accounts for the users in the marketing department. MKT_ComputersOU contains the computer accounts for the computers in the marketing department.

A Group policy object (GPO) named GPO1 is linked to MKT_UsersOU. A GPO named GPO2 linked to MKT_ComputersOU.

You plan to deploy a web application for the marketing department users. The application will require certificates for authentication.

The security department configures the CA to support the planned deployment.

You need to ensure that the web application can authenticate the marketing department users.

What should you do?

20. Your network contains an Active Directory domain named contoso.com.

You need to create a central store for Group Policy administrator templates.

What should you use?