70-413 Exam Case Studies & Practical Application 2 — Questions and Answers
Question 1: Contoso Ltd. is merging with Fabrikam. Both companies have separate Active Directory forests. Users at Contoso need to access Fabrikam resources without re-authentication. Which solution best meets this requirement?
- Configure a one-way forest trust from Fabrikam to Contoso
- Configure a two-way forest trust between both forests (Correct answer)
- Migrate all Contoso users to the Fabrikam forest
- Deploy ADFS federation between both forests
Correct answer: Configure a two-way forest trust between both forests
A two-way forest trust allows users in both forests to authenticate to resources in either forest without re-authentication.
Question 2: A company runs a 3-tier web application on Windows Server. During a load test, the application tier becomes the bottleneck. The infrastructure team wants to scale out without reconfiguring the database tier. What should they implement?
- Network Load Balancing (NLB) on the application servers (Correct answer)
- Windows Server Failover Clustering on the application servers
- Increase vCPUs on the single application server
- Deploy a hardware load balancer and reconfigure SQL Always On
Correct answer: Network Load Balancing (NLB) on the application servers
NLB allows horizontal scale-out of stateless application servers while the database tier remains unchanged.
Question 3: An enterprise has 500 branch offices connected via WAN links with limited bandwidth. Each branch has 50 users who frequently access a central file server. What should you deploy to reduce WAN utilization?
- DFS Replication with read-only replicas at each branch
- BranchCache in Hosted Cache mode at each branch (Correct answer)
- DFS Namespaces without replication
- Increase WAN bandwidth at each branch
Correct answer: BranchCache in Hosted Cache mode at each branch
BranchCache in Hosted Cache mode caches frequently accessed content locally at each branch, reducing WAN traffic for repeated file access.
Question 4: A healthcare organization must ensure that patient data stored on servers is encrypted at rest and that the encryption keys are managed separately from the data. Which Windows Server feature satisfies this requirement?
- BitLocker with a TPM chip storing keys on the same server
- Encrypting File System (EFS) with user certificates
- BitLocker with Network Unlock and keys stored on a separate key management server (Correct answer)
- NTFS permissions restricting access to the data folders
Correct answer: BitLocker with Network Unlock and keys stored on a separate key management server
BitLocker with keys managed on a separate server (or MBAM) provides at-rest encryption with key separation from the data.
Question 5: Tailspin Toys needs to deploy a new server infrastructure that can automatically provision virtual machines based on demand and reclaim resources when VMs are no longer needed. Which System Center component should they implement?
- System Center Configuration Manager (SCCM)
- System Center Virtual Machine Manager (SCVMM) with Private Cloud (Correct answer)
- System Center Operations Manager (SCOM)
- System Center Data Protection Manager (DPM)
Correct answer: System Center Virtual Machine Manager (SCVMM) with Private Cloud
SCVMM with Private Cloud enables self-service VM provisioning and automated resource reclamation based on demand.
Question 6: A company has a single-domain Active Directory environment. Security auditors require that service accounts never have passwords that expire and that their credentials cannot be used for interactive logon. What should you implement?
- Standard user accounts with non-expiring passwords in a protected OU
- Group Managed Service Accounts (gMSA) (Correct answer)
- Local System accounts for all services
- Managed Service Accounts (MSA) with password rotation scripts
Correct answer: Group Managed Service Accounts (gMSA)
gMSAs provide automatic password management, no interactive logon capability, and can be used across multiple servers.
Question 7: A financial firm's disaster recovery plan requires that their SQL Server databases be available at the DR site within 5 minutes of a primary site failure with zero data loss. Which technology best meets this RPO and RTO?
- SQL Server Log Shipping with 5-minute intervals
- SQL Server Database Mirroring in high-safety mode
- SQL Server Always On Availability Groups with synchronous commit and automatic failover (Correct answer)
- SQL Server Replication with push subscriptions
Correct answer: SQL Server Always On Availability Groups with synchronous commit and automatic failover
Always On Availability Groups with synchronous commit ensures zero data loss (RPO=0) and automatic failover achieves near-zero RTO.
70-413 Exam Case Studies & Practical Application 2
Contoso Ltd. is merging with Fabrikam.
Both companies have separate Active Directory forests.
Users at Contoso need to access Fabrikam resources without re-authentication.
Which solution best meets this requirement?