70-413 Exam Case Studies & Practical Application 4 — Questions and Answers
Question 1: Adventure Works is designing an IP address management strategy for 50 sites. They need centralized visibility into all DHCP and DNS data across all sites. Which Windows Server feature provides this?
- Deploy a single DHCP server for all 50 sites
- Implement IP Address Management (IPAM) in Windows Server (Correct answer)
- Use a third-party IPAM tool exclusively
- Configure DNS scavenging on each DNS server manually
Correct answer: Implement IP Address Management (IPAM) in Windows Server
Windows Server IPAM provides centralized monitoring, auditing, and management of DHCP and DNS across multiple servers and sites.
Question 2: A university needs to allow students to bring their own devices and connect to the campus network, but student devices must be placed in a restricted VLAN with internet-only access. Which technology should they implement?
- Network Access Protection (NAP) with DHCP enforcement
- 802.1X authentication with RADIUS policies redirecting non-compliant devices to the restricted VLAN (Correct answer)
- Static VLAN assignments based on MAC address tables
- VPN split tunneling for all student devices
Correct answer: 802.1X authentication with RADIUS policies redirecting non-compliant devices to the restricted VLAN
802.1X with RADIUS (NPS) allows dynamic VLAN assignment based on authentication results, placing unknown devices in a restricted VLAN.
Question 3: A company runs Windows Server 2012 R2 Hyper-V and wants to allow VMs to use more memory than is physically installed by enabling memory overcommitment. Which Hyper-V feature enables this?
- Hyper-V Replica
- Dynamic Memory with Smart Paging (Correct answer)
- Hyper-V Network Virtualization
- Storage QoS policies
Correct answer: Dynamic Memory with Smart Paging
Dynamic Memory with Smart Paging allows VMs to burst beyond physical RAM using disk-based paging as a last resort.
Question 4: Datum Corporation must ensure that remote employees can access internal applications securely without installing a VPN client. The solution must use SSL and provide access through a web browser. Which role should they deploy?
- DirectAccess with Windows 8.1+ clients
- Remote Desktop Gateway
- Web Application Proxy publishing internal applications via AD FS (Correct answer)
- SSTP VPN with a single endpoint
Correct answer: Web Application Proxy publishing internal applications via AD FS
Web Application Proxy with AD FS publishes internal web applications over HTTPS, accessible via a browser without a VPN client.
Question 5: A law firm stores sensitive documents on a file server. They need to ensure that documents labeled 'Confidential' cannot be emailed outside the organization, even if a user downloads the file to their laptop. Which technology enforces this?
- NTFS permissions preventing file copy to local drives
- Active Directory Rights Management Services (AD RMS) with file classification (Correct answer)
- BitLocker on all employee laptops
- AppLocker policies blocking email client attachments
Correct answer: Active Directory Rights Management Services (AD RMS) with file classification
AD RMS embeds persistent usage policies within documents that travel with the file, restricting actions like forwarding via email regardless of location.
Question 6: A company's Help Desk team needs to be able to reset passwords and unlock accounts in a specific OU, but should have no other administrative rights. What is the most precise way to grant this?
- Add Help Desk users to the Domain Admins group
- Delegate control on the specific OU for password reset and account unlock permissions only (Correct answer)
- Give Help Desk accounts access to the Active Directory Users and Computers MMC
- Create a custom GPO granting account management rights domain-wide
Correct answer: Delegate control on the specific OU for password reset and account unlock permissions only
Delegation of Control at the OU level grants only the specified permissions (reset password, unlock account) without broader administrative rights.
Question 7: A manufacturing company requires that servers on the production floor cannot communicate with the corporate network but must still receive Windows Updates. Which architecture achieves this with minimal internet exposure?
- Connect production servers directly to Windows Update over the internet
- Deploy WSUS in the corporate network and configure a one-way firewall rule allowing production servers to pull from WSUS
- Enable automatic updates via WSUS with production servers in an isolated network segment with only outbound access to the WSUS server (Correct answer)
- Use SCCM Software Update Point with full bidirectional network access
Correct answer: Enable automatic updates via WSUS with production servers in an isolated network segment with only outbound access to the WSUS server
WSUS in an isolated network allows production servers to pull updates from an internal server using only outbound connections, with no direct internet access.
70-413 Exam Case Studies & Practical Application 4
Adventure Works is designing an IP address management strategy for 50 sites.
They need centralized visibility into all DHCP and DNS data across all sites.
Which Windows Server feature provides this?