Microsoft 70-411 Free Practice Questions

Answer: A,B 

Explanation: 

First off, your domain functional level must be at Windows Server 2008. Second, Fine-grained password policies ONLY apply to user objects, and global security groups. Linking them to universal or domain local groups is ineffective. I know what you’re thinking, what about OU’s? Nope, Fine-grained password policy cannot be applied to an organizational unit (OU) directly. The third thing to keep in mind is, by default only members of the Domain Admins group can set fine-grained password policies. However, you can delegate this ability to other users if needed. 

Fine-grained password policies apply only to user objects (or inetOrgPerson objects if they are used instead of user objects) and global security groups. 

You can apply Password Settings objects (PSOs) to users or global security groups: 

References: 

http: //technet. microsoft. com/en-us/library/cc731589%28v=ws. 10%29. aspx 

http: //technet. microsoft. com/en-us/library/cc731589%28v=ws. 10%29. aspx 

http: //technet. microsoft. com/en-us/library/cc770848%28v=ws. 10%29. aspx 

http: //www. brandonlawson. com/active-directory/creating-fine-grained-password-policies/ 

Answer: D 

Explanation: 

Clear checkmark for Select an existing template in the new client wizard. 

In New RADIUS Client, in Shared secret, do one of the following: 

Bullet Ensure that Manual is selected, and then in Shared secret, type the strong password that is also entered on the RADIUS client. Retype the shared secret in Confirm shared secret. 

Answer: A 

Explanation: 

The Root Directory will contain data collected by the Data Collector Set. Change this setting if you want to store your Data Collector Set data in a different location than the default. Browse to and select the directory, or type the directory name. 

To view or modify the properties of a Data Collector Set after it has been created, you can: 

* Select the Open properties for this data collector set check box at the end of the Data 

Collector Set Creation Wizard. 

* Right-click the name of a Data Collector Set, either in the MMC scope tree or in the 

console window, and click Properties in the context menu. 

Directory tab: 

In addition to defining a root directory for storing Data Collector Set data, you can specify a 

single Subdirectory or create a Subdirectory name format by clicking the arrow to the right 

of the text entry field. 

Answer: B 

Explanation: 

4. Add an Active Directory Security Identifier (SID) to the CSV disk using the Cluster Name Object (CNO) The Active Directory protector is a domain security identifier (SID) based protector for protecting clustered volumes held within the Active Directory infrastructure. It can be bound to a user account, machine account or group. When an unlock request is made for a protected volume, the BitLocker service interrupts the request and uses the BitLocker protect/unprotect APIs to unlock or deny the request. For the cluster service to selfmanage BitLocker enabled disk volumes, an administrator must add the Cluster Name Object (CNO), which is the Active Directory identity associated with the Cluster Network name, as a BitLocker protector to the target disk volumes. Add-BitLockerKeyProtector <drive letter or CSV mount point> -ADAccountOrGroupProtector – ADAccountOrGroup $cno 

Answer: C 

Explanation: 

When using the email model each of the file shares, you can determine whether access requests to each file share will be received by the administrator, a distribution list that represents the file share owners, or both. 

You can use the File Server Resource Manager console to configure the owner distribution list by editing the management properties of the classification properties. 

Reference: http://technet.microsoft.com/en-us/library/jj574182.aspx#BKMK_12 

Answer: C 

Answer: A 

Explanation: 

When you use Advanced Audit Policy Configuration settings, you need to confirm that these settings are not overwritten by basic audit policy settings. The following procedure shows how to prevent conflicts by blocking the application of any basic audit policy settings. 

Enabling Advanced Audit Policy Configuration 

Basic and advanced audit policy configurations should not be mixed. As such, it’s best practice to enable Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings in Group Policy to make sure that basic auditing is disabled. The setting can be found under Computer Configuration\Policies\Security Settings\Local Policies\Security Options, and sets the SCENoApplyLegacyAuditPolicy registry key to prevent basic auditing being applied using Group Policy and the Local Security Policy MMC snap-in. 

In Windows 7 and Windows Server 2008 R2, the number of audit settings for which success and failure can be tracked has increased to 53. Previously, there were nine basic auditing settings under Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy. These 53 new settings allow you to select only the behaviors that you want to monitor and exclude audit results for behaviors that are of little or no concern to you, or behaviors that create an excessive number of log entries. In addition, because Windows 7 and Windows Server 2008 R2 security audit policy can be applied by using domain Group Policy, audit policy settings can be modified, tested, and deployed to selected users and groups with relative simplicity. 

Audit Policy settings 

Any changes to user account and resource permissions. 

Any failed attempts for user logon. 

Any failed attempts for resource access. 

Any modification to the system files. 

Advanced Audit Configuration Settings 

Audit compliance with important business-related and security-related rules by tracking precisely defined activities, such as: 

. A group administrator has modified settings or data on servers that contain finance information. 

. An employee within a defined group has accessed an important file. 

. The correct system access control list (SACL) is applied to every file and folder or registry key on a computer or file share as a verifiable safeguard against undetected access. 

In Servers GPO, modify the Audit Policy settings - enabling audit account management setting will generate events about account creation, deletion and so on. 

Advanced Audit Configuration Settings 

Advanced Audit Configuration Settings ->Audit Policy 

-> Account Management -> Audit User Account Management 

In Servers GPO, modify the Audit Policy settings - enabling audit account management setting will generate events about account creation, deletion and so on. 

Reference: 

http: //blogs. technet. com/b/abizerh/archive/2010/05/27/tracing-down-user-and-computer-account-deletion-in-active-directory. aspx 

http: //technet. microsoft. com/en-us/library/dd772623%28v=ws. 10%29. aspx 

http: //technet. microsoft. com/en-us/library/jj852202(v=ws. 10). aspx 

http: //www. petri. co. il/enable-advanced-audit-policy-configuration-windows-server. htm 

http: //technet. microsoft. com/en-us/library/dd408940%28v=ws. 10%29. aspx 

http: //technet. microsoft. com/en-us/library/dd408940%28v=ws. 10%29. 

aspx#BKMK_step2 

Answer: B,D 

Explanation: 

PEAP is similar in design to EAP-TTLS, requiring only a server-side PKI certificate to create a secure TLS tunnel to protect user authentication, and uses server-side public key certificates to authenticate the server. When you use EAP with a strong EAP type, such as TLS with smart cards or TLS with certificates, both the client and the server use certificates to verify their identities to each other. 

Answer:  

Answer: D 

Explanation: 

Scheduling allows less bandwidth the by limiting the time interval of the replication 

Does DFS Replication throttle bandwidth per schedule, per server, or per connection? 

If you configure bandwidth throttling when specifying the schedule, all connections for that replication group will use that setting for bandwidth throttling. Bandwidth throttling can be also set as a connection-level setting using DFS Management. 

To edit the schedule and bandwidth for a specific connection, use the following steps: 

In the console tree under the Replication node, select the appropriate replication group. 

Click the Connections tab, right-click the connection that you want to edit, and then click Properties. 

Click the Schedule tab, select Custom connection schedule and then click Edit Schedule. 

Use the Edit Schedule dialog box to control when replication occurs, as well as the maximum amount of bandwidth replication can consume. 

Answer: B,C,D 

Explanation: 

The WSHA on NAP client computers running Windows XP SP3 does not monitor the status of antispyware applications. 

Answer:  

Answer: C 

Answer: C 

Explanation: 

The Zone would need to be changed to a AD integrated zone When you use directory-integrated zones, you can use access control list (ACL) editing to secure a dnsZone object container in the directory tree. This feature provides detailed access to either the zone or a specified resource record in the zone. For example, an ACL for a zone resource record can be restricted so that dynamic updates are allowed only for a specified client computer or a secure group, such as a domain administrators group. This security feature is not available with standard primary zones. 

DNS update security is available only for zones that are integrated into Active Directory. After you integrate a zone, you can use the access control list (ACL) editing features that are available in the DNS snap-in to add or to remove users or groups from the ACL for a specific zone or for a resource record. 

Standard (not an Active Directory integrated zone) has no Security settings: 

You need to firstly change the "Standard Primary Zone" to AD Integrated Zone: 

Now there's Security tab: 

References: http: //technet. microsoft. com/en-us/library/cc753014. aspx 

http: //technet. microsoft. com/en-us/library/cc726034. aspx 

http: //support. microsoft. com/kb/816101 

Answer: C 

Explanation: 

Add-RemoteAccessRadius 

Adds a new external RADIUS server for VPN authentication, accounting for DirectAccess 

(DA) and VPN, or one-time password (OTP) authentication for DA. 

AccountingOnOffMsg<String> 

Indicates the enabled state for sending of accounting on or off messages. The acceptable 

values for this parameter are: 

. Enabled. 

. Disabled. 

This is the default value. This parameter is applicable only when the RADIUS server is being added for Remote Access accounting.