70-413 Exam Case Studies & Practical Application 3 — Questions and Answers
Question 1: Woodgrove Bank has a Windows Server 2012 R2 environment and wants to implement just-in-time (JIT) administration so that admin privileges are granted only when needed and automatically revoked after a set period. Which capability supports this?
- Fine-Grained Password Policies applied to admin accounts
- Privileged Access Workstations (PAWs) with smart card logon
- Privileged Identity Management (PIM) using Active Directory Bastion Forest (Correct answer)
- Account lockout policies with short unlock intervals
Correct answer: Privileged Identity Management (PIM) using Active Directory Bastion Forest
PIM with a Bastion Forest in Active Directory provides time-limited, just-in-time elevation of administrative privileges.
Question 2: A company is designing a new virtualization environment. They need to ensure that critical VMs automatically restart on another host if the physical host fails, without any manual intervention. What should they deploy?
- Hyper-V Replica between two standalone hosts
- Windows Server Failover Clustering with Hyper-V roles on cluster nodes (Correct answer)
- Multiple standalone Hyper-V hosts with manual live migration scripts
- A single Hyper-V host with checkpoints enabled
Correct answer: Windows Server Failover Clustering with Hyper-V roles on cluster nodes
Failover Clustering with Hyper-V automatically restarts VMs on surviving cluster nodes when a host fails.
Question 3: An organization needs to provide external partners with access to an internal web application. Partners should authenticate using their own corporate credentials without requiring accounts in the organization's AD. Which solution is most appropriate?
- Create guest accounts for each partner in the internal AD
- Deploy Web Application Proxy with AD FS claims-based authentication (Correct answer)
- Place the web application in the DMZ with anonymous access
- Use Windows Integrated Authentication with a perimeter network
Correct answer: Deploy Web Application Proxy with AD FS claims-based authentication
AD FS with Web Application Proxy enables federated identity so partners authenticate with their own credentials via claims.
Question 4: Northwind Traders' IT team discovers that their DHCP server is a single point of failure. They want to ensure IP address leases continue if the primary DHCP server goes offline. What is the recommended Windows Server solution?
- Configure a secondary DHCP server with the 80/20 rule using split scopes
- Deploy DHCP Failover between two DHCP servers (Correct answer)
- Use APIPA fallback and document the server for quick rebuild
- Install DHCP role on all domain controllers
Correct answer: Deploy DHCP Failover between two DHCP servers
DHCP Failover (introduced in Windows Server 2012) synchronizes lease information between two servers, providing hot standby or load-sharing.
Question 5: A retailer with 200 stores needs to deploy a new POS application to all store servers overnight without impacting store operations during business hours. Which System Center tool and feature should they use?
- SCVMM with VM templates deployed during business hours
- SCCM with a maintenance window configured for off-hours deployment (Correct answer)
- SCOM with alerts configured to trigger installations
- DPM with application-aware backups and restore-based deployment
Correct answer: SCCM with a maintenance window configured for off-hours deployment
SCCM maintenance windows restrict software deployments to approved time periods, ensuring installations occur only outside business hours.
Question 6: A company's security policy requires that all communications between its web servers and internal application servers be encrypted, but certificates must be issued by an internal CA. Which Windows Server component should they deploy?
- Public CA-issued wildcard certificate on all servers
- Active Directory Certificate Services (AD CS) with an Enterprise CA (Correct answer)
- Self-signed certificates generated on each server individually
- Third-party HSM with externally trusted certificates
Correct answer: Active Directory Certificate Services (AD CS) with an Enterprise CA
AD CS with an Enterprise CA issues and manages internally-trusted certificates integrated with Active Directory for automated enrollment.
Question 7: After a recent ransomware incident, a company wants to ensure that even if an administrator account is compromised, the attacker cannot delete backup data stored on Windows Server. Which feature should be implemented?
- Store backups on a network share with standard NTFS permissions
- Enable Windows Server Backup with VSS shadow copies only
- Use Windows Server Backup to WORM-capable storage with immutable backup policies (Correct answer)
- Keep backups on the same volume as production data with separate ACLs
Correct answer: Use Windows Server Backup to WORM-capable storage with immutable backup policies
WORM (Write Once Read Many) storage with immutable policies prevents backup data from being deleted or modified even by privileged accounts.
70-413 Exam Case Studies & Practical Application 3
Woodgrove Bank has a Windows Server 2012 R2 environment and wants to implement just-in-time (JIT) administration so that admin privileges are granted only when needed and automatically revoked after a set period.
Which capability supports this?