70-413 Designing and Implementing a Server Infrastructure - Practice Questions

Question 7 (Mixed Questions)

Your network contains an Active Directory domain named contoso.com.

You plan to implement Network Access Protection (NAP) with IPSec enforcement.

You need to recommend which Windows Server 2012 R2 components must be deployed for the planned implementation.

Which two components should you include in the recommendation? Each correct answer presents part of the solution.

NOTE: Each correct section is worth one point.

Select all that apply, then click Submit answer.

○
Health Registration Authority (HRA)
○
Host Credential Authorization Protocol (HCAP)
○
IP Address Management (IPAM) Server
○
Network Policy Server (NPS)
○
Active Directory Rights Management Services (AD RMS)

Question 8 (Mixed Questions)

Your network contains an Active Directory domain named contoso.com. The functional level of the domain and the forest is Windows Server 2008 R2.

All domain controllers run Windows Server 2008 R2.

You plan to deploy a new line-of-business application named App1 that uses claims-based authentication.

You need to recommend changes to the network to ensure that Active Directory can provide claims for App1.

What two changes should you include in the recommendation? Each correct answer presents part of the solution.

Select all that apply, then click Submit answer.

○
From the properties of the computer accounts of the domain controllers, enable Kerberos constrained delegation.
○
From the Default Domain Controllers Policy, enable the Support for Dynamic Access Control and Kerberos armoring setting.
○
Deploy Active Directory Lightweight Directory Services (AD LDS).
○
Raise the domain functional level to Windows Server 2012.
○
Add domain controllers that run Windows Server 2012.

Reference / correct answer:

From the Default Domain Controllers Policy, enable the Support for Dynamic Access Control and Kerberos armoring setting.

Add domain controllers that run Windows Server 2012.

E: You must perform several steps to enable claims in Server 2012 AD. First, you must upgrade the forest schema to Server 2012. You can do so manually through Adprep, but Microsoft strongly recommends that you add the AD DS role to a new Server 2012 server or upgrade an existing DC to Server 2012.

B: Once AD can support claims, you must enable them through Group Policy:

From the Start screen on a system with AD admin rights, open Group Policy Management and select the Domain Controllers Organizational Unit (OU) in the domain in which you wish to enable claims.

Right-click the Default Domain Controllers Policy and select Edit.

In the Editor window, drill down to Computer Configuration, Policies, Administrative Templates, System, and KDC (Key Distribution Center).

Open KDC support for claims, compound authentication, and Kerberos armoring.

Select the Enabled radio button. Supported will appear under Claims, compound authentication for Dynamic Access Control and Kerberos armoring options

Reference:

Enable Claims Support in Windows Server 2012 Active Directory

http://windowsitpro.com/windows-server-2012/enable-claims-support-windows-server2012-active-directory

Question 9 (Mixed Questions)

You plan to deploy multiple servers in a test environment by using Windows Deployment Services (WDS).

You need to identify which two network services must be available in the test environment to deploy the servers.

Which two network services should you identify? Each correct answer presents part of the solution.

Select all that apply, then click Submit answer.

○
WINS
○
Network Policy Server (NPS)
○
Active Directory Domain Services (AD DS)
○
Active Directory Lightweight Directory Services (AD LDS)
○
DNS
○
DHCP

70-413 – Designing and Implementing a Server Infrastructure