NEW QUESTION 1
Your network contains an Active Directory domain named contoso.com, All users are in an organizational unit (OU) named Corp_Users.
You plan to modify the description of all the users who have a string of 514 in their mobile phone number. You need to view a list of the users that will be modified.
What should you run?

• A. Get-APUser-Filter "mobilePhone-Like '*514*'"
• B. Get-ADOrganizationalUnit-LDAPFilter "(mobilePhone='*514*')"
• C. Get-ADOrganizationalUnit-Filter "mobilePhone-Like '*514* "'
• D. Get-ADUser-LDAPFilter "(mobilePhone='*514*)"

Answer: A

NEW QUESTION 2
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a server named Web1 that runs Windows Server 2021.
You need to list all the SSL certificates on Web1 that will expire during the next 60 days. Solution: You run the following command.
Get-ChildItem Cert:LocalMachineTrust |? { $_.NotAfter –It (Get-Date).AddDays( 60 ) }

Does this meet the goal?

• A. Yes
• B. No

Answer: A

NEW QUESTION 3
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You deploy a new Active Directory forest.
You need to ensure that you can create a group Managed Service Account (gMSA) for multiple member servers.
Solution: You configure Kerberos constrained delegation on the computer account of each member server. Does this meet the goal?

• A. Yes
• B. No

Answer: B

NEW QUESTION 4
Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series.
Information and details provided in a question apply only to that question.
Your network contains an Active Directory domain named contoso.com. The domain contains 5,000 user accounts.
You have a Group Policy object (GPO) named DomainPolicy that is linked to the domain and a GPO named DCPolicy that is linked to the Domain Controllers organizational unit (OU).
You need to use the application control policy settings to prevent several applications from running on the network.
What should you do?

• A. From the Computer Configuration node of DCPolicy, modify Security Settings.
• B. From the Computer Configuration node of DomainPolicy, modify Security Settings.
• C. From the Computer Configuration node of DomainPolicy, modify Administrative Templates.
• D. From the User Configuration node of DCPolicy, modify Security Settings.
• E. From the User Configuration node of DomainPolicy, modify Folder Redirection.
• F. From user Configuration node of DomainPolicy, modify Administrative Templates.
• G. From Preferences in the User Configuration node of DomainPolicy, modify Windows Settings.
• H. From Preferences in the Computer Configuration node of DomainPolicy, modify Windows Settings.

Answer: B

NEW QUESTION 5
Your network contains an Active Directory forest named contoso.com. The forest contains an Active Directory Federation Services (AD FS) farm.
You install Windows Server 2021 on a server named Server2.
You need to configure Server2 as a node in the federation server farm.
Which cmdlets should you run? To answer, select the appropriate options in the answer area.

Answer:

Explanation:

NEW QUESTION 6
Your company has an office in Montreal.
The network contains an Active Directory domain named contoso.com.
You have an organizational unit (OU) named Montreal that contains all of the users accounts for the users in the Montreal office. An office manager in the Montreal office knows each user personally.
You need to ensure that the office manager can provide the users with a new password if the users forget their password. What should you do?

• A. From the Security settings of the Montreal OU, assign the office manager the Reset Password permission.
• B. From the Security settings of each user account in the Montreal OU, assign the office manager the Change Password permission.
• C. Create a Group Policy object (GPO) and link the GPO to the OU of the domai
• D. Filter the GPO to the Montreal user
• E. Assign the office manager the Apply Group Policy permission on the GP
• F. Configure the Password Policy settings of the GPO.
• G. Create a Group Policy object (GPO) and link the GPO to the Montreal O
• H. Assign the office manager the Apply Group Policy permission on the GP
• I. Configure the Password Policy settings of the GPO.

Answer: B

NEW QUESTION 7
Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1.
You create and link a Group Policy object (GPO) named SalesAppGPO to an organizational unit (OU) named SalesOU. All the computer accounts are in the Computers container. All the user accounts of the users in the sales department are in SalesOU.
You have a line-of-business application named SalesApp that is installed by using a Windows Installer package.
You need to make SalesApp available to only the sales department users.
Which three actions should you perform in sequence? To answer move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Answer:

Explanation:

NEW QUESTION 8
You have a server named Server1 that runs Windows Server 2021. Server1 has the Web Application Proxy role service installed.
You need to publish Microsoft Exchange Server 2013 services through the Web Application Proxy. The solution must use preauthentication whenever possible.
How should you configure the preauthentication method for each service? To answer, select the appropriate options in the answer area.

Answer:

Explanation: Box 1: Pass-through
Box 2: Active Directory Federation Services (ADFS) Box 3: Pass-through
The following table describes the Exchange services that you can publish through Web Application Proxy and the supported preauthentication for these services:

References: https://technet.microsoft.com/en-us/library/dn528827(v=ws.11).aspx

NEW QUESTION 9
Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series.
Start of repeated Scenario:
You work for a company named Contoso, Ltd.
The network contains an Active Directory forest named contoso.com. A forest trust exists between contoso.com and an Active Directory forest named adatum.com.
The contoso.com forest contains the objects configured as shown in the following table. Scenario:
Refer to following table:

Group1 and Group 2 contain only user accounts.
Contoso hires a new remote user named User3. User3 will work from home and will use a computer named Computed that runs Windows 10. Computed is currently in a workgroup.
An administrator named Admin1 is a member of the Domain Admins group in the contoso.com domain. From Active Directory Users and Computers, you create an organizational unit (OU) named OU1 in the
contoso.com domain, and then you create a contact named Contact1 in OU1,
An administrator of the adatum.com domain runs the Set-ADUser cmdlet to configure a user named User1 to have a user logon name of User1@litwareinc.com.
End of Scenario:
Admin1 attempts to delete OU1 and receives an error message. You need to ensure that Admin1 can delete OU1. What should you do first?

• A. Delete Contact1.
• B. Add Admin1 to the Enterprise Admins group.
• C. Modify the Object settings for OU1.
• D. Disable the Active Directory Recycle Bin.

Answer: C

NEW QUESTION 10
Your network contains an Active Directory forest. The forest contains two domains named litwarenc.com and contoso.com. The contoso.com domain contains two domains controllers named LON-DC01 and LON-DC02. The domain controllers are located in a site named London that is associated to a subnet of 192.168.10.0/24
You discover that LON-DC02 is not a global catalog server. You need to configure LON-DC02 as a global catalog server. What should you do?

• A. From Active Directory Sites and Services, modify the properties of the 192.168.10.0/24 IP subnet.
• B. From Windows PowerShell, run the Set-NetNatGlobal cmdlet.
• C. From Active Directory Sites and Services, modify the NTDS Settings object of LON-DC02.
• D. From Windows PowerShell, run the Enable-ADOptionalFeature cmdlet.

Answer: C

NEW QUESTION 11
Your network contains an Active Directory domain named contoso.com. The domain contains a user named User1, a group named Group1, and an Organizational unit (OU) named OU1.
You need to enable User1 to link Group Policies to OU1.
Solution: From Active Directory Users and Computers, you add User1 to the Group Policy Creator Owner group.
Does this meet the goal?

• A. Yes
• B. No

Answer: B

NEW QUESTION 12
Your network contains an Active Directory forest named contoso.com.
You have an Active Directory Federation Services (AD FS) farm. The farm contains a server named Server1 that runs Windows Server 2012 R2.
You add a server named Server2 to the farm. Server2 runs Windows Server 2021. You remove Server1 from the farm.
You need to ensure that you can use role separation to manage the farm. Which cmdlet should you run?

• A. Set-AdfsFarmInformation
• B. Update-AdfsRelyingPartyTrust
• C. Set-AdfsProperties
• D. Invoke-AdfsFarmBehaviorLevelRaise

Answer: D

Explanation: AD FS for Windows Server 2021 introduces the ability to have separation between server administrators and AD FS service administrators.
After upgrading our ADFS servers to Windows Server 2021, the last step is to raise the Farm Behavior Level using the Invoke-AdfsFarmBehaviorLevelRaise PowerShell cmdlet.
To upgrade the farm behavior level from Windows Server 2012 R2 to Windows Server 2021 use the Invoke-ADFSFarmBehaviorLevelRaise cmdlet.
References: https://technet.microsoft.com/en-us/library/mt605334(v=ws.11).aspx

NEW QUESTION 13
Your network contains an Active Directory forest named contoso.com. They connect to the forest by using ldp.exe and receive the output as shown in the following exhibit.

Use drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

NEW QUESTION 14
Your network contains an Active Directory forest named contoso.com. The forest contains 10 domains. The root domain contains a global catalog server named DC1.
You remove the global catalog server role from DC1.
You need to decrease the size of the Active Directory database on DC1.
Solution:You restart DC1 in Directory Services Repair Mode. You run compact.exe, and then restart DC1. Does this meet the goal?

• A. Yes
• B. No

Answer: B

Explanation: You need to run ntdsutil.exe with the ‘compact to’ option. References:
https://theitbros.com/active-directory-database-compact-defrag/

NEW QUESTION 15
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2021. The computer account for Server1 is in organizational unit (OU) named OU1.
You create a Group Policy object (GPO) named GPO1 and link GPO1 to OU1.
You need to add a domain user named User1 to the local Administrators group on Server1.
Solution: From the Computer Configuration node of GPO1, you configure the Account Policies settings. Does this meet the goal?

• A. Yes
• B. No

Answer: B

NEW QUESTION 16
Your network contains an Active Directory domain named contoso.com.
You have an application named App1 that is deployed to all the client computers in the domain. App1 writes a registry value named LocalStorage on all the client computers.
You need to delete the LocalStorage registry value from all the client computers in the domain that have less than 100 GB of free disk space on their system volume.
What should you do?

• A. Configure Software Settings in a Group Policy object (GPO) and enable a WMI filter.
• B. Configure a Group Policy setting to modify the security of the LocalStorage registry value.
• C. Create an administrative template file that contains the LocalStorage registry setting, and then add the administrative template to a Group Policy object (GPO).
• D. Configure a Group Policy preference that uses item-level targeting.

Answer: D

Explanation: In Windows Server 2008 Microsoft introduced a Group Policy extension, named Group Policy Preferences (GPP). GPP that includes registry settings, allows you to add, remove or modify key values.
References: https://theitbros.com/add-modify-and-delete-registry-keys-using-group-policy/