NEW QUESTION 1
Your network contains an Active Directory forest. The forest contains two domains named litwarenc.com and contoso.com. The contoso.com domain contains two domains controllers named LON-DC01 and LON-DC02.
The domain controllers are located in a site named London that is associated to a subnet of 192.168.10.0/24
You discover that LON-DC02 is not a global catalog server. You need to configure LON-DC02 as a global catalog server.
What should you do?

• A. From the properties of the LON-DC02 computer account in Active Directory Users and Computers, modify the NTDS settings.
• B. From the properties of the LON-DC02 computer account in Active Directory Users and Computers, modify the City attribute.
• C. From Active Directory Sites and Services, modify the properties of the 192.168.10.0/24 IP subnet.
• D. From the properties of the Domain Controllers organizational unit (OU) in Active Directory Users and Computers, modify the Security settings.

Answer: A

NEW QUESTION 2
Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series.
Start of repeated scenario.
Your network contains an Active Directory domain named contoso.com. The domain contains a single site named Site1. All computers are in Site1.
The Group Policy objects (GPOs) for the domain are configured as shown in the exhibit. (Click the Exhibit button.)

The relevant users and client computer in the domain are configured as shown in the following table.

End of repeated scenario.
You plan to enforce the GPO link for A6.
Which five GPOs will apply to User1 in sequence when the user signs in to Computer1 after the link is enforced? To answer, move the appropriate GPOs from the list of GPOs to the answer area and arrange them in the correct order.

Answer:

Explanation:

NEW QUESTION 3
Your network contains an Active Directory forest. The forest contains two domains named litwarenc.com and contoso.com. The contoso.com domain contains two domains controllers named LON-DC01 and LON-DC02. The domain controllers are located in a site named London that is associated to a subnet of 192.168.10.0/24
You discover that LON-DC02 is not a global catalog server. You need to configure LON-DC02 as a global catalog server. What should you do?

• A. From Active Directory Sites and Services, modify the properties of the 192.168.10.0/24 IP subnet.
• B. From Windows PowerShell, run the Set-NetNatGlobal cmdlet.
• C. From Active Directory Sites and Services, modify the NTDS Settings object of LON-DC02.
• D. From Windows PowerShell, run the Enable-ADOptionalFeature cmdlet.

Answer: C

NEW QUESTION 4
Your network contains an Active Directory domain named contos.com.
You need to create a central store for Group Policy administrative templates. What should you use?

• A. Group Policy Management Console (GPMC)
• B. Copy-Item
• C. Group Policy Management Editor
• D. Copy-GPO

Answer: B

NEW QUESTION 5
Your network contains an Active Directory forest named contoso.com. The forest contains the root domain and two child domains named childl.contoso.com and child2.contoso.com. Child1 contains three domain controllers named DC1, DC2, and DC3. Child2 contains one domain controller named
You have two accounts named Child1Admin1 and Child2Admin2 that you use to perform administrative tasks. Currently, the accounts can manage only the member servers in their respective domain.
You plan to demote DC3 and to remove the Child2 domain.
You need to ensure that Admin1 can demote DC3 and that Admtn2 can demote DC4. The solution must use the principle of least privilege.
To which groups should you add Admin1 and Admin2? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation: Admin1: ContosoDomain Admins Admin2: Child2Server Operators

NEW QUESTION 6
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory forest named contoso.com. The forest contains a member server named Server1 that runs Windows Server 2021. All domain controllers run Windows Server 2012 R2.
Contoso.com has the following configuration. PS C:> (Get-ADForest).ForestMode Windows2008R2Forest
PS C:> (Get-ADDomain).DomainMode Windows2008R2Domain
PS C:>
You plan to deploy an Active Directory Federation Services (AD FS) farm on Server1 and to configure device registration.
You need to configure Active Directory to support the planned deployment. Solution: You run adprep.exe from the Windows Server 2021 installation media. Does this meet the goal?

• A. Yes
• B. No

Answer: A

Explanation: Device Registration requires Windows Server 2012 R2 forest schema.

NEW QUESTION 7
Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series.
Information and details provided in a question apply only to that question.
Your network contains an Active Directory domain named contoso.com. The domain contains 5,000 user accounts.
You have a Group Policy object (GPO) named DomainPolicy that is linked to the domain and a GPO named DCPolicy that is linked to the Domain Controllers organizational unit (OU).
You need to configure the Documents folder of every user to be stored on a server named FileServer1. What should you do?

• A. From the Computer Configuration node of DCPolicy, modify Security Settings.
• B. From the Computer Configuration node of DomainPolicy, modify Security Settings.
• C. From the Computer Configuration node of DomainPolicy, modify Administrative Templates.
• D. From the User Configuration node of DCPolicy, modify Security Settings.
• E. From the User Configuration node of DomainPolicy, modify Folder Redirection.
• F. From user Configuration node of DomainPolicy, modify Administrative Templates.
• G. From Preferences in the User Configuration node of DomainPolicy, modify Windows Settings.
• H. From Preferences in the Computer Configuration node of DomainPolicy, modify Windows Settings.

Answer: E

NEW QUESTION 8
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory domain named contoso.com. A user named User1 is in an organizational unit (OU) named OU1.
You are troubleshooting a folder access issue for User1.
You need a list of groups to which User1 is either a direct member or ab indirect member. Solution: You run Get-ADGroup –Identity User1 –Property MemberOf.
Does this meet the goal?

• A. Yes
• B. No

Answer: B

Explanation: The Get-ADGroup cmdlet does not include the MemberOf property. The command above is, therefore, not valid.
References:
https://docs.microsoft.com/en-us/powershell/module/addsadministration/get-adgroup?view=win10-ps

NEW QUESTION 9
Your network contains an enterprise root certification authority (CA) named CA1.
Multiple computers on the network successfully enroll for certificates that will expire in one year. The certificates are based on a template named Secure_Computer. The template uses schema version 2.
You need to ensure that new certificates based on Secure_Computer are valid for three years. What should you do?

• A. Modify the Validity period for the certificate template.
• B. Instruct users to request certificates by running the certreq.exe command.
• C. Instruct users to request certificates by using the Certificates console.
• D. Modify the Validity period for the root CA certificate.

Answer: A

NEW QUESTION 10
Your network contains an Active Directory domain named adatum.com. The domain contains the servers configured as shown in the following table:

You have a server named Server6 in the perimeter network. Each server has the local users show in the following table.

The domain contains the users shown in the following table.

You install a Web Application Proxy on Server6.
You need to configure the Web Application proxy on Server6. The solution must use the principle of least privilege.
Which account should you specify in the Web Application Proxy Configuration Wizard? To answer, select the appropriate options in the answer are.
NOTE: Each correct selection is worth one point.

Answer:

Explanation: The user account used to configure the web application proxy must have local Administrator permission on the WAP server(s), and have access to an account that have local Administrator permissions on the AD FS servers.
References:
http://www.mistercloudtech.com/2015/11/25/how-to-install-and-configure-web-application-proxy-for-adfs/

NEW QUESTION 11
Your network contains an Active Directory domain named contoso.com. The network contains several IP subnets. One of the subnets uses a network ID if 192.168.10.0/24.
You link a Group Policy object (GPO) named GPO1 to the domain.
You need to map a drive to a specific file share on the computers in the 192.168.10.0/24 network only. What should you do?

• A. From the User Configuration node of GPO1, configure the Folder Redirection setting
• B. Link a WMI filter to GPO1.
• C. From the Computer Configuration mode of GPO1, configure the Network Connections setting
• D. Link a WMI filter to GPO1.
• E. From the User Configuration node of GPO1, create a Group Policy preference that uses item-level targeting.
• F. From the Computer Configuration node of GPO1, create a Group Policy preference that uses item-level targeting.

Answer: C

NEW QUESTION 12
Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series.
Start of repeated scenario.
Your network contains an Active Directory domain named contoso.com. The domain contains a single site named Site1. All computers are in Site1.
The Group Policy objects (GPOs) for the domain are configured as shown in the exhibit. (Click the Exhibit button.)

The relevant users and client computer in the domain are configured as shown in the following table.

End of repeated scenario.
Which five GPOs will apply to User1 in sequence when the user signs in to Computer1? To answer, move the appropriate GPOs from the list to the answer area and arrange them in the correct order.

Answer:

Explanation:

NEW QUESTION 13
The network contains an Active Directory forest named contoso.com.
The forest contains three domain controllers configured as shown in the following table.

The company physically relocates Server2 from the Montreal office to the Seattle office.
You discover that both Server1 and Server2 authenticate users who sign in to the client computers in the Montreal office. Only Server3 authenticates users who sign in to the computers in the Seattle office.
You need to ensure that Server2 authenticates the users in the Seattle office during normal network operations. What should you do?

• A. From Windows PowerShell, run the Set-ADReplicationSite cmdlet.
• B. From Active Directory Users and Computers, modify the Location Property of Server2.
• C. From Network Connections on Server2, modify the Internet Protocol Version 4 (TCP/IPv4) configuration.
• D. From Windows PowerShell, run the Move-ADDirectoryServer cmdlet.

Answer: A

NEW QUESTION 14
Your network contains an Active Directory domain named contoso.com. The domain contains three servers named Server1, Server2, and Server3 that run Windows Server 2021.
Server1 has IP Address Management (IPAM) installed. Server2 and Server3 have the DHCP Server role installed and have several DHCP scopes configured. The IPAM server retrieves data from Server2 and Server3.
A domain user named User1 is a member of the groups shown in the following table.

On Server1, you create a security policy for User1. The policy grants the IPAM DHCP Scope Administrator Role with the Global access scope to the user.
Which actions can User1 perform? To answer, select the appropriate options in the answer area.

Answer:

Explanation: User1 is using Server Manager, not IPAM to perform the administration. Therefore, only the “DHCP Administrators” permission on Server2 and the “DHCP Users” permissions on Server3 are applied.
The permissions granted through membership of the “IPAM DHCP Scope Administrator Role” are not applied when the user is not using the IPAM console.

NEW QUESTION 15
Your company has multiple branch offices.
The network contains an Active Directory domain named contoso.com.
In one of the branch offices, a new technician is hired to add computers to the domain.
After successfully joining multiple computers to the domain, the technician fails to join anymore computers to the domain.
You need to ensure that the technician can join an unlimited number of computers to the domain. What should you do?

• A. Modify the Security settings of the technician's user account.
• B. Modify the Security settings of the Computers container.
• C. Configure the technician's user account as a managed service account.
• D. Run the redircmp.exe command.

Answer: B

NEW QUESTION 16
Note: This question is part of a series of questions that use the same scenario. For you convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series.
Start of repeated scenario.
You work for a company named Contoso, Ltd.
The network contains an Active Directory forest named contoso.com. A forest trust exists between contoso.com and an Active Directory forest named adatum.com.
The contoso.com forest contains the objects configured as shown in the following table.

Group1 and Group2 contain only user accounts.
Contoso hires a new remote user named User3. User3 will work from home and will use a computer named Computer3 that runs Windows 10. Computer3 is currently in a workgroup.
An administrator named Admin1 is a member of the Domain Admins group in the contoso.com domain. From Active Directory Users and Computers, you create an organizational unit (OU) named OU1 in the
contoso.com domain, and then you create a contact named Contact1 in OU1.
An administrator of the adatum.com domain runs the Set-ADUser cmdlet to configure a user named User1 to have a user logon name of User1@litwareinc.com.
End or repeated scenario.
You need to join Computer3 to the contoso.com domain by using offline domain join.
Which command should you use in the contoso.com domain and on Computer3? To answer, select the appropriate options in the answer area.

Answer:

Explanation:

NEW QUESTION 17
Your network contains an Active Directory domain named contoso.com.
You open Group Policy Management as shown in the exhibit. (Click the Exhibit button.)

You discover that some of the settings configured in the A1 Group Policy object (GPO) fail to apply to the users in the OU1 organizational unit (OU).
You need to ensure that all of the settings in A1 apply to the users in OU1. What should you do?

• A. Enable loopback policy processing in A1.
• B. Block inheritance on OU1.
• C. Modify the policy processing order for OU1.
• D. Modify the GPO Status of A1.

Answer: C

NEW QUESTION 18
Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2 that run Windows Server 2021.
Server1 has Microsoft System Center 2021 Virtual Machine Manager (VMM) installed. Server2 has IP Address Management (IPAM) installed.
You create a domain user named User1.
You need to integrate IPAM and VMM. VMM must use the account of User1 to manage IPAM. The solution must use the principle of least privilege.
What should you do on each server? To answer, select the appropriate options in the answer area.

Answer:

Explanation: References:
https://technet.microsoft.com/en-us/library/dn783349(v=ws.11).aspx