Microsoft 70-411: Administering Windows Server 2012 — Questions and Answers

Question 1: Which Hyper-V virtual switch type in Windows Server 2012 allows VMs to communicate only with each other and not with the host or external network?

External virtual switch
Internal virtual switch
NAT virtual switch
Private virtual switch (Correct answer)

Correct answer: Private virtual switch

A Private virtual switch isolates VMs from the host and all external networks, allowing only VM-to-VM communication on the same private switch.

Question 2: To research intermittent network drops, an admin enables packet capture on Windows Server 2012. Which built-in command-line tool captures network traffic without installing third-party software?

ipconfig /all
netsh trace start (Correct answer)
tracert
netstat -a

Correct answer: netsh trace start

Netsh trace start captures live network traffic to an ETL file that can be analyzed in Microsoft Message Analyzer or converted to pcap.

Question 3: Which feature of Windows Server 2012 DHCP helps prevent unauthorized DHCP servers from operating on the network?

DHCP authorization in Active Directory (Correct answer)
DHCP relay agent
DHCP failover
DHCP filtering

Correct answer: DHCP authorization in Active Directory

DHCP servers must be authorized in Active Directory before they can serve leases, preventing rogue DHCP servers from assigning incorrect IP configuration.

Question 4: A Windows Server 2012 administrator needs to classify servers by risk level. Which classification factor is MOST important for determining risk priority?

Physical location of the server
Data sensitivity and business criticality (Correct answer)
Server hardware age
Number of users accessing the server

Correct answer: Data sensitivity and business criticality

Data sensitivity and business criticality are the primary factors for risk classification because they determine potential impact of a breach.

Question 5: What distinguishes a peer-reviewed study in Administering Windows Server 2012 literature?

It was published quickly
Independent experts in the field evaluated the methodology and conclusions before publication (Correct answer)
It was written by multiple authors
It was published in any format

Correct answer: Independent experts in the field evaluated the methodology and conclusions before publication

This is fundamental to Administering Windows Server 2012 practice. Independent experts in the field evaluated the methodology and conclusions before publication represents the professional standard for research in the Administering Windows Server 2012 certification framework.

Question 6: Which Active Directory functional level must be enabled to use Fine-Grained Password Policies (FGPP) in Windows Server 2012?

Windows Server 2008 (Correct answer)
Windows Server 2008 R2
Windows Server 2012
Windows Server 2003

Correct answer: Windows Server 2008

Fine-Grained Password Policies require a minimum domain functional level of Windows Server 2008.

Question 7: Which Windows Server 2012 feature allows administrators to implement Quality of Service (QoS) policies on network traffic?

Network Access Protection
Policy-based QoS via Group Policy (Correct answer)
VLAN trunking
Network Load Balancing

Correct answer: Policy-based QoS via Group Policy

Policy-based QoS in Windows Server 2012 uses Group Policy to assign DSCP values and throttle bandwidth for specific applications or traffic flows.

Question 8: Which Windows Server 2012 technology enables multiple network adapters to appear as a single adapter for bandwidth aggregation and failover?

QoS Policy
Failover Clustering
NIC Teaming (Correct answer)
Network Load Balancing

Correct answer: NIC Teaming

NIC Teaming (also called LBFO) combines multiple NICs for increased throughput and redundancy, and is built into Windows Server 2012.

Question 9: In Windows Server 2012, what does the Resilient File System (ReFS) provide over NTFS?

Improved data integrity with automatic error correction and better scalability for large volumes (Correct answer)
Built-in deduplication only
Faster small-file access and better encryption
Support for FAT32 compatibility mode

Correct answer: Improved data integrity with automatic error correction and better scalability for large volumes

ReFS provides stronger data integrity through checksumming metadata and (with Storage Spaces) data, automatic corruption repair, and support for very large volumes and files.

Question 10: An administrator wants to research the historical resource consumption of the IIS role on a Windows Server 2012 system. Which Data Collector Set template provides IIS-specific counters out of the box?

IIS Performance Data Collector Set (Correct answer)
LAN Diagnostics
System Diagnostics Data Collector Set
Active Directory Diagnostics

Correct answer: IIS Performance Data Collector Set

Performance Monitor includes an IIS Performance Data Collector Set template that pre-selects IIS-specific counters for web server analysis.

Question 11: A server's reliability has been declining. Which built-in tool provides a stability index and a timeline of software installs, failures, and warnings?

Performance Monitor
Reliability Monitor (Correct answer)
Event Viewer
Action Center

Correct answer: Reliability Monitor

Reliability Monitor displays a 1–10 stability index and a chronological history of application crashes, Windows failures, and software changes.

Question 12: What is the minimum number of disks required to create a Storage Spaces volume with parity resiliency in Windows Server 2012?

2 disks
3 disks (Correct answer)
4 disks
5 disks

Correct answer: 3 disks

Parity resiliency in Storage Spaces requires a minimum of 3 physical disks to distribute parity information and tolerate a single disk failure.

Question 13: A Windows Server 2012 administrator must ensure compliance with a security audit requiring proof that only authorized users accessed sensitive file shares. Which feature provides this evidence?

Object Access Auditing configured in Group Policy (Correct answer)
Performance Monitor data collector sets
Windows Firewall connection logs
NTFS permissions report from File Server Resource Manager

Correct answer: Object Access Auditing configured in Group Policy

Object Access Auditing, enabled via Group Policy and configured on individual files/folders, records successful and failed access attempts in the Security event log.

Question 14: During QA testing, system files on Windows Server 2012 appear corrupt after a failed update. Which command scans and repairs protected system files using the cached copy?

chkdsk /r
sfc /scannow (Correct answer)
bcdedit /fixmbr
dism /restorehealth

Correct answer: sfc /scannow

sfc /scannow scans all protected system files and replaces corrupted files with a cached version from %WinDir%\System32\dllcache.

Question 15: Which Windows Server 2012 role enables you to publish internal web applications to external users via a reverse proxy?

Internet Information Services (IIS)
DirectAccess
Web Application Proxy (Correct answer)
Remote Desktop Gateway

Correct answer: Web Application Proxy

Web Application Proxy is a Remote Access role service in Windows Server 2012 R2 that acts as a reverse proxy, publishing internal applications (including AD FS pre-authentication) to external clients.

Question 16: You set up the network policy to enforce the health policy when configuring NPS for DHCP. What changes to the network policy are required?

If the client SHV passes one or more SHV checks, deny access.
If the client SHV fails one or more SHV checks, deny access.
If the client SHV fails one or more SHV checks, grant access only for EAP clients.
If the client SHV passes one or more SHV checks, enable access. (Correct answer)

Correct answer: If the client SHV passes one or more SHV checks, enable access.

Explanation: <br> In order to set up the network policy to apply the health policy, access must be enabled.

Question 17: In Windows Server 2012 Hyper-V, what is the difference between a checkpoint (snapshot) and a backup?

A checkpoint captures VM state at a point in time for quick rollback; a backup creates a full recoverable copy for disaster recovery (Correct answer)
Checkpoints use VSS; backups do not
Checkpoints and backups are identical in function
Backups are stored on the same host; checkpoints are stored off-site

Correct answer: A checkpoint captures VM state at a point in time for quick rollback; a backup creates a full recoverable copy for disaster recovery

Checkpoints enable quick rollbacks by capturing VM state (memory, disk, config) but are not a replacement for backups, which provide full recoverability and off-host storage.

Question 18: You want to configure a Windows Server 2012 server to automatically assign IP addresses, subnet masks, and DNS server addresses to client computers. Which role provides this functionality?

RRAS
DHCP Server (Correct answer)
WINS Server
DNS Server

Correct answer: DHCP Server

The DHCP Server role automatically leases IP configurations including address, mask, gateway, and DNS to network clients.

Question 19: Which Windows Server 2012 tool runs a set of best-practice rules against server roles and reports configuration deviations?

Resource Monitor
Event Viewer
Best Practices Analyzer (BPA) (Correct answer)
Server Performance Advisor

Correct answer: Best Practices Analyzer (BPA)

Best Practices Analyzer (BPA) scans installed roles against Microsoft-defined best-practice rules and highlights deviations.

Question 20: An admin needs evidence that a specific user accessed a file share. Which must be configured for file access auditing to generate events in the Security log?

Enable Share-level auditing in Computer Management
Set Folder Redirection in Group Policy
Audit Object Access policy must be enabled AND SACL set on the folder (Correct answer)
Audit Logon Events policy only

Correct answer: Audit Object Access policy must be enabled AND SACL set on the folder

File access auditing requires both the Audit Object Access audit policy and a System Access Control List (SACL) on the resource to be audited.

Question 21: A Windows Server 2012 administrator notices that audit logs are being overwritten due to insufficient log storage. This represents which type of risk to security monitoring?

Compliance risk to administrative controls
Availability risk to detective controls (Correct answer)
Integrity risk to preventive controls
Confidentiality risk to corrective controls

Correct answer: Availability risk to detective controls

Overwritten logs make detective controls (audit logging) unavailable, creating an availability risk to security monitoring.

Question 22: Which of the following organizations has the authority to deactivate a domain controller?

All of the above (Correct answer)
Backup Operators
Print Operators
Server Operators

Correct answer: All of the above

Deactivating (demoting) a domain controller is a high-level operation, and the built-in groups Server Operators, Print Operators, and Backup Operators all hold sufficient administrative rights to perform such critical server actions. Because each group qualifies, All of the above is correct rather than naming just one.

Question 23: A Windows Server 2012 Failover Cluster node fails and the cluster resources do not move to the surviving node. Cluster Validation passes on both nodes. What should you check first?

Whether both nodes are in the same Active Directory site
Whether the Cluster service is set to Automatic start on both nodes
Whether Windows Firewall is blocking cluster heartbeat traffic
The failover policy — maximum failures and period settings on the cluster role (Correct answer)

Correct answer: The failover policy — maximum failures and period settings on the cluster role

If the maximum failures threshold has been exceeded within the configured period, the cluster role will not fail over and will remain offline to prevent a failover loop.

Question 24: During a quality review, you discover that a Windows Server 2012 role installation failed midway. Which DISM command attempts to repair the Windows image used for role installation?

dism /Online /Cleanup-Image /RestoreHealth (Correct answer)
dism /Online /Enable-Feature
dism /Online /Get-Features
dism /Image:C:\ /ScanHealth

Correct answer: dism /Online /Cleanup-Image /RestoreHealth

dism /Online /Cleanup-Image /RestoreHealth contacts Windows Update (or a supplied source) to repair a corrupted component store.

Question 25: An administrator discovers that a user's account is locked out. Which PowerShell cmdlet unlocks the account without resetting the password?

Set-ADUser -Enabled $true
Unlock-ADAccount (Correct answer)
Reset-ADAccountPassword
Enable-ADAccount

Correct answer: Unlock-ADAccount

Unlock-ADAccount clears the lockout state of an Active Directory user account without changing the password.

Question 26: During a QA audit of Windows Server 2012, an administrator needs to ensure the server's SSL/TLS certificates are not expired. Which MMC snap-in is used to inspect installed certificates?

Security Configuration and Analysis
Local Security Policy
Certificates (certmgr.msc) (Correct answer)
Component Services

Correct answer: Certificates (certmgr.msc)

The Certificates snap-in (certmgr.msc) displays all certificates in each store with their expiration dates.

Question 27: A QA process requires verifying that Windows Server 2012 event logs are not silently overwriting old entries. Which event log setting retains old logs by requiring manual archiving?

Archive the log when full, do not overwrite events (Correct answer)
Enable log forwarding
Do not overwrite events (Clear logs manually)
Overwrite events as needed (oldest events first)

Correct answer: Archive the log when full, do not overwrite events

The 'Archive the log when full' setting saves the full log to a file before clearing it, preserving all entries without silent loss.

Question 28: What does the 'ipconfig /registerdns' command do on a Windows Server 2012 client?

Flushes the local DNS resolver cache
Displays all registered DNS entries
Resets the TCP/IP stack
Forces re-registration of the client's DNS records with the DNS server (Correct answer)

Correct answer: Forces re-registration of the client's DNS records with the DNS server

Running 'ipconfig /registerdns' triggers the DNS client to re-register its A (and PTR) records with the configured DNS server, useful after IP changes.

Question 29: What type of DNS record maps a hostname to an IPv6 address in Windows Server 2012 DNS?

CNAME
PTR
A
AAAA (Correct answer)

Correct answer: AAAA

AAAA records (quad-A) map fully qualified domain names to 128-bit IPv6 addresses, while A records map to 32-bit IPv4 addresses.

Question 30: What command is used to force an immediate Group Policy refresh on a Windows Server 2012 computer?

netsh gp refresh
secedit /refreshpolicy
gpresult /r
gpupdate /force (Correct answer)

Correct answer: gpupdate /force

gpupdate /force immediately reapplies all Group Policy settings, both user and computer, regardless of whether they have changed.

Question 31: Which Windows Server 2012 role service allows remote users to connect to internal network resources securely over the Internet without a VPN client?

DirectAccess (Correct answer)
SSTP VPN
L2TP/IPsec VPN
PPTP VPN

Correct answer: DirectAccess

DirectAccess provides seamless, always-on connectivity to corporate resources over the Internet using IPv6 and IPsec, without requiring users to manually initiate a VPN.

Question 32: Which Windows Server 2012 feature allows an administrator to subscribe to events from multiple remote servers and consolidate them for centralized analysis?

Windows Event Forwarding (WEF) (Correct answer)
Event Viewer Custom Views
Server Manager event alerts
Task Scheduler event triggers

Correct answer: Windows Event Forwarding (WEF)

Windows Event Forwarding uses WinRM to collect events from remote computers into a Forwarded Events log on a collector server.

Question 33: After a penetration test, your Windows Server 2012 environment shows residual risk remains even after applying all recommended patches. Residual risk is best described as:

Risk remaining after controls have been applied (Correct answer)
Risk that has been transferred to an insurer
The initial risk before any controls are in place
Risk that management has formally accepted without controls

Correct answer: Risk remaining after controls have been applied

Residual risk is the risk that remains after security controls have been implemented and is not the same as inherent risk.

Question 34: A company's branch office has unreliable WAN connectivity. Users report that logging on takes several minutes when the WAN is slow. Which technology should you implement to improve logon times at the branch?

DirectAccess
BranchCache in Hosted Cache mode
Read-Only Domain Controller (RODC) (Correct answer)
VPN with split tunneling

Correct answer: Read-Only Domain Controller (RODC)

An RODC caches credentials locally, allowing users to authenticate without traversing the WAN when connectivity is poor.

Question 35: Which Windows Server 2012 feature generates automated reports analyzing current server configuration against best practices for Active Directory?

BPA for Active Directory Domain Services role (Correct answer)
Dcdiag.exe
Active Directory Diagnostics Data Collector Set
Netlogon debug logging

Correct answer: BPA for Active Directory Domain Services role

Running BPA against the AD DS role in Server Manager checks domain controller configuration against Microsoft best-practice rules.

Question 36: In Windows Server 2012, what is 'Dynamic Access Control (DAC)' used for?

Claims-based file access control that uses user and device attributes for authorization (Correct answer)
Automatic IP address assignment based on device type
Automatic disk quota adjustment based on user department
Dynamic firewall rules based on network traffic patterns

Correct answer: Claims-based file access control that uses user and device attributes for authorization

DAC extends traditional ACL-based access control by using Active Directory claims (user attributes, device attributes) in access decisions.

Question 37: Which Windows Server 2012 feature allows you to create a virtual hard disk (VHD) that grows in size only as data is written to it?

Pass-through disk
Dynamically expanding VHD (Correct answer)
Fixed-size VHD
Differencing VHD

Correct answer: Dynamically expanding VHD

A dynamically expanding VHD starts small and grows on-disk as data is written, up to its maximum defined size, saving storage space when the disk is not fully utilized.

Question 38: A single Active Directory Domain Services (AD DS) domain is set up on your network. Windows Server 2012 or Windows Server 2012 R2 is used by all domain controllers. Windows Deployment Server (WDS) role is set up on a member server running Windows Server 2012 R2. Using WDS multicast, you are distributing Windows 8.1 to a number of machines. You must permit clients that are presently installing to continue, but you must prevent any further clients from joining the broadcast. <br> What command do you need to enter?

Disconnect-WdsMulticastClient
Wdsutil /remove (Correct answer)
Wdsutil /stop
Deny-WdsClient

Correct answer: Wdsutil /remove

Explanation: <br> A boot or install image is removed from the server using the wdsutil remove -image command. Removes an image group and other items with the wdsutil remove-imagegroup command.

Question 39: A QA team uses Windows Server 2012 WSUS to control update deployment. Which WSUS report type shows which computers have NOT yet installed an approved update?

Computer Detail Status report
Synchronization Results report
Update Status Summary report
Update Compliance by Computer Group (Correct answer)

Correct answer: Update Compliance by Computer Group

The Update Compliance by Computer Group report shows approval and installation status per group, identifying non-compliant machines.

Question 40: What tool in Windows Server 2012 provides a graphical view of network bandwidth usage and active connections in real time?

Resource Monitor > Network tab (Correct answer)
Event Viewer
Network and Sharing Center
Task Manager > Performance tab

Correct answer: Resource Monitor > Network tab

Resource Monitor's Network tab provides real-time data on per-process network activity, TCP connections, and listening ports on Windows Server 2012.

Question 41: Which Windows Server 2012 feature enables transparent encryption of entire volumes, including the OS volume?

Rights Management Services
BitLocker Drive Encryption (Correct answer)
IPsec Transport Mode
Encrypting File System (EFS)

Correct answer: BitLocker Drive Encryption

BitLocker encrypts entire disk volumes and protects data when the server is powered off or the drive is removed.

Question 42: What is the purpose of a Read-Only Domain Controller (RODC) in Windows Server 2012?

Replace writable DCs in the main datacenter
Host AD DS in branch offices with limited physical security (Correct answer)
Synchronize time across the forest
Provide faster write operations

Correct answer: Host AD DS in branch offices with limited physical security

RODCs hold a read-only copy of the AD database and are designed for branch offices where physical security cannot be guaranteed.

Question 43: Which Windows Server 2012 tool provides a graphical view of real-time CPU, disk, network, and memory usage broken down by process and service?

Performance Monitor
Task Manager
Server Manager
Resource Monitor (Correct answer)

Correct answer: Resource Monitor

Resource Monitor (resmon.exe) shows real-time resource usage per process, including disk I/O paths and network connections, in a single view.

Question 44: How should an administrator handle a situation where two departments have conflicting requirements for a Windows Server 2012 shared resource?

Facilitate a meeting between department heads to negotiate a mutually acceptable solution (Correct answer)
Delay the project indefinitely
Implement the first request received and ignore the second
Escalate only to the IT director without involving department heads

Correct answer: Facilitate a meeting between department heads to negotiate a mutually acceptable solution

Facilitating direct negotiation between stakeholders leads to sustainable solutions and preserves working relationships.

Question 45: Which Windows Server 2012 Hyper-V feature allows live migration of virtual machines without shared storage?

Quick Migration
Cluster-Aware Updating
Shared Nothing Live Migration (Correct answer)
Storage Live Migration

Correct answer: Shared Nothing Live Migration

Shared Nothing Live Migration moves a running VM and its storage simultaneously between Hyper-V hosts without requiring a SAN or shared storage.

Question 46: What is a corrective action in Administering Windows Server 2012 quality systems?

Blaming individuals for errors
A systematic response to eliminate the cause of a detected nonconformity and prevent recurrence (Correct answer)
Ignoring minor issues
Temporary workarounds only

Correct answer: A systematic response to eliminate the cause of a detected nonconformity and prevent recurrence

This is fundamental to Administering Windows Server 2012 practice. A systematic response to eliminate the cause of a detected nonconformity and prevent recurrence represents the professional standard for quality in the Administering Windows Server 2012 certification framework.

Question 47: What Windows Server 2012 feature allows two DHCP servers to share scope information and provide failover for DHCP services?

DHCP multicast scope
DHCP superscope
DHCP split scope
DHCP failover (Correct answer)

Correct answer: DHCP failover

DHCP failover, new in Windows Server 2012, allows two DHCP servers to synchronize lease information and continue serving clients if one server fails.

Question 48: A scheduled task on a Windows Server 2012 server runs successfully when triggered manually but fails when scheduled. What is the most likely cause?

The server's time zone is misconfigured
The service account running the task lacks the required permissions or 'Log on as a batch job' right (Correct answer)
The task's trigger interval is set too low
The Task Scheduler service is disabled

Correct answer: The service account running the task lacks the required permissions or 'Log on as a batch job' right

Scheduled tasks running under a service account require that account to have the 'Log on as a batch job' user right and appropriate file system permissions.

Question 49: In Windows Server 2012, what is IPAM used for?

Centrally monitoring and managing IP address space, DHCP, and DNS (Correct answer)
Configuring IPsec tunnels
Managing Internet proxy settings
Auditing IP-level firewall rules

Correct answer: Centrally monitoring and managing IP address space, DHCP, and DNS

IP Address Management (IPAM) provides a centralized framework for monitoring, auditing, and managing the IP address space along with associated DHCP and DNS infrastructure.

Question 50: What is the purpose of regular risk reviews in Administering Windows Server 2012 practice?

To satisfy auditors only
To generate reports
To identify new risks, evaluate control effectiveness, and update mitigation strategies (Correct answer)
To reduce workload

Correct answer: To identify new risks, evaluate control effectiveness, and update mitigation strategies

This is fundamental to Administering Windows Server 2012 practice. To identify new risks, evaluate control effectiveness, and update mitigation strategies represents the professional standard for risk management in the Administering Windows Server 2012 certification framework.

Question 51: What Windows Server 2012 feature provides centralized monitoring and threshold-based alerts for server events?

Event Subscriptions in Event Viewer
BPA (Best Practices Analyzer)
Reliability and Performance Monitor with Data Collector Sets (Correct answer)
Windows Error Reporting

Correct answer: Reliability and Performance Monitor with Data Collector Sets

Performance Monitor with Data Collector Sets allows administrators to collect performance counters, set thresholds, and generate alerts when values exceed defined limits.

Question 52: During a quality audit, you need to verify disk health on a Windows Server 2012 volume. Which built-in command checks and repairs file system errors without requiring a reboot when possible?

defrag /u
diskpart clean
chkdsk /f /r (Correct answer)
format /q

Correct answer: chkdsk /f /r

chkdsk /f /r locates bad sectors and recovers readable data; on live volumes it schedules the check on next boot.

Question 53: An admin needs to research memory pressure on a Hyper-V host. Which counter shows the amount of memory that has been paged to disk?

Memory\Pages/sec (Correct answer)
Memory\Pool Paged Bytes
Memory\Committed Bytes
Memory\Available MBytes

Correct answer: Memory\Pages/sec

Memory\Pages/sec measures the rate at which pages are read from or written to disk to resolve hard page faults, indicating memory pressure.

Question 54: A server's system drive is nearly full. An administrator finds a large Windows\WinSXS folder. What is the safest way to reclaim space from this folder on Windows Server 2012 R2?

Run Disk Cleanup with the 'Clean up system files' option including Windows Update Cleanup
Use DISM /online /cleanup-image /startcomponentcleanup
Both B and C are safe approaches (Correct answer)
Manually delete files from WinSXS using an admin command prompt

Correct answer: Both B and C are safe approaches

Both Disk Cleanup's Windows Update Cleanup and DISM's StartComponentCleanup safely remove superseded components from the component store.

Question 55: In Windows Server 2012 Hyper-V, what is Live Migration used for?

Cloning VMs for testing
Backing up VMs while they run
Moving a running VM from one host to another without downtime (Correct answer)
Migrating VMs between storage locations

Correct answer: Moving a running VM from one host to another without downtime

Live Migration transfers a running virtual machine from one Hyper-V host to another with no interruption in service, requiring shared storage or SMB 3.0 storage.

Microsoft 70-411: Administering Windows Server 2012

Validates skills for IT professionals administering Windows Server 2012 in an enterprise environment, covering Active Directory, network services, Group Policy, file/print services, and Network Policy Server infrastructure. Part of the MCSA: Windows Server 2012 certification pathway.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds