DRAG DROP

You network contains an Active Directory forest. The forest contains an Active Directory Federation Services (AD FS) deployment.

The AD FS deployment contains the following:

– An AD FS server named server1.contoso.com that runs Windows Server 2016

– A Web Application Proxy used to publish AD FS

– A LIPN that uses the contoso.com suffix

– A namespace named adfs.contoso.com

You create a Microsoft Office 365 tenant named contoso.onmicrosoft.com. You use Microsoft Azure Active Directory Connect (AD Connect) to synchronize all of the users and the UPNs from the contoso.com forest to Office 365.

You need to configure federation between Office 365 and the on-premises deployment of Active Directory.

Which three commands should you run in sequence from Server1? To answer, move the appropriate commands from the list of commands to the answer area and arrange them in the correct order.

Reveal Solution Hide Solution

Correct Answer:

HOTSPOT

You have a server named Server1 that runs Windows Server 2016. Server1 has the Web Application Proxy role service installed.

You are publishing an application named App1 that will use Integrated Windows authentication as shown in the following graphic.

Use the drop-down menus to select the answer area choice that completes each statement based on the information presented in the graphic.

Reveal Solution Hide Solution

Correct Answer:

HOTSPOT

Your network contains an Active Directory forest. The forest contains one domain named contoso.com. The domain contains two domain controllers named DC1 and DC2. DC1 holds all of the operations master roles.

During normal network operations, you run the following commands on DC2: Move-ADDirectoryServerOperationMasterRole -Identity “DC2” -OperationMasterRole PDCEmulator Move- ADDirectoryServerOperationMasterRole CIdentity “DC2” -OperationMasterRole RIDMaster DC1 fails.

You remove DC1 from the network, and then you run the following command: Move-ADDirectoryServerOperationMasterRole CIdentity “DC2” -OperationMasterRole SchemaMaster

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Reveal Solution Hide Solution

Correct Answer:

Your network contains an Active Directory forest named contoso.com

Your company plans to hire 500 temporary employees for a project that will last 90 days.

You create a new user account for each employee. An organizational unit (OU) named Temp contains the user accounts for the employees.

You need to prevent the new users from accessing any of the resources in the domain after 90 days.

What should you do?

Reveal Solution Hide Solution

Your network contains an Active Directory forest. The forest contains two domains named litwarenc.com and contoso.com. The contoso.com domain contains two domains controllers named LON-DC01 and LON-DC02. The domain controllers are located in a site named London that is associated to a subnet of 192.168.10.0/24

You discover that LON-DC02 is not a global catalog server.

You need to configure LON-DC02 as a global catalog server.

What should you do?

Reveal Solution Hide Solution

Your network contains an Active Directory domain named contoso.com. The domain functional level is Windows Server 2012 R2.

You need to secure several high-privilege user accounts to meet the following requirements:

What should you do?

Reveal Solution Hide Solution

HOTSPOT

Your network contains an Active Directory domain named contoso.com.

Some user accounts in the domain have the P.O. Box attribute set.

You plan to remove the value of the P.O. Box attribute for all of the users by using Ldifde.

You have a user named User1 who is located in the Users container.

How should you configure the LDIF file to remove the value of the P.O. Box attribute for User1? To answer, select the appropriate options in the answer area.

Reveal Solution Hide Solution

Correct Answer:

DRAG DROP

Your company has multiple offices.

The network contains an Active Directory domain named contoso.com. An Active Directory site exists for each office. All of the sites connect to each other by using DEFAULTIPSITELINK. The company plans to open a new office. The new office will have a domain controller and 100 client computers.

You install Windows Server 2016 on a member server in the new office. The new server will become a domain controller. You need to deploy the domain controller to the new office. The solution must ensure that the client computers in the new office will authenticate by using the local domain controller.

Which three actions should you perform next in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal Solution Hide Solution

Correct Answer:

Your network contains an Active Directory forest named contoso.com.

A partner company has a forest named fabrikam.com. Each forest contains one domain.

You need to provide access for a group named Research in fabrikam.com to resources in contoso.com. The solution must use the principle of least privilege.

What should you do?

Reveal Solution Hide Solution

HOTSPOT

Your network contains an Active Directory forest named contoso.com.

Your company has a custom application named ERP1. ERP1 uses an Active Directory Lightweight Directory Services (AD LDS) server named Server1 to authenticate users.

You have a member server named Server2 that runs Windows Server 2016. You install the Active Directory Federation Services (AD FS) server role on Server2 and create an AD FS farm.

You need to configure AD FS to authenticate users from the AD LDS server.

Which cmdlets should you run? To answer, select the appropriate options in the answer area.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

To configure your AD FSfarm to authenticate users from an LDAP directory, you can complete the following steps:

Step 1: New-AdfsLdapServerConnection

First, configure a connection to your LDAP directory using the New-AdfsLdapServerConnection cmdlet:

$DirectoryCred = Get-Credential

$vendorDirectory = New-AdfsLdapServerConnection CHostName dirserver CPort 50000CSslMode None CAuthenticationMethod Basic CCredential $DirectoryCred

Step 2 (optional):

Next, you can perform the optional step of mapping LDAP attributes to the existing AD FS claims using the New-AdfsLdapAttributeToClaimMapping cmdlet.

Step 3: Add-AdfsLocalClaimsProviderTrust

Finally, you must register the LDAP store with AD FS as a local claims provider trust using the Add-AdfsLocalClaimsProviderTrust cmdlet:

Add-AdfsLocalClaimsProviderTrust CName “Vendors” CIdentifier “urn:vendors” CType L

References: https://technet.microsoft.com/en-us/library/dn823754(v=ws.11).aspx