NEW QUESTION NO: 10
Case Study
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other question on this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next sections of the exam. After you begin a new section, you cannot return to this section.
To start the case study
To display the first question on this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview
General Overview
Fabrikam, Inc. is a financial services organization.
Fabrikam recently purchased another financial services organization named Contoso, Ltd.
Fabrikam has 2,000 users. Contoso has 500 users.
Windows 10 and Office 2016 are deployed to all computers.
Physical Locations
Fabrikam has an office in the United States. Contoso has an office in the United Kingdom.
The offices connect to each other by using a WAN link. Each office also connects directly to the Internet.
Existing Environment
Active Directory
The network of Fabrikam contains an Active Directory forest.
The Active Directory Environment of Contoso was migrated to the Active Directory forest of Fabrikam. The forest contains three domains named fabrikam.com, contractor.fabrikam.com, and contoso.com.
All domain controllers run Windows Server 2008 R2.
All contractors outsourced by Fabrikam use the user principal name (UPN) suffix of contractor.fabrikam.com. If Fabrikam hires the contractor as a permanent employee, the UPN suffix changes to fabrikam.com.
Network
The network has the following configurations:
External IP address for the Unites States office: 192.168.1.100

External IP address for the United Kingdom office: 192.168.2.100

Internal IP address range for the Unites States office: 10.0.1.0/24

Internal IP address range for the United Kingdom office: 10.0.2.0/24

Active Directory Federation Services (AD FS)
AD FS and Web Application Proxies are deployed to support an app for the sales department. The app is accessed from the Microsoft Azure portal.
Office 365 Tenant
You have an Office 365 subscription that has the following configurations:
Organization name: Fabrikam Financial Services

Vanity domain: Fabrikamfinancialservices.onmicrosoft.com

Microsoft SharePoint domain: Fabrikamfinancialservices.sharepoint.com

Additional domains added to the subscription: Contoso.com and fabrikam.com

Requirements
Planned Changes
Fabrikam plans to implement the following changes:
Deploy Azure AD Connect.

Move mailboxes from Microsoft Exchange 2016 to Exchange Online.

Deploy Azure multi-factor authentication for devices that connect from untrusted networks only.

Deploy the Azure Authenticator app and the Company Portal app to all mobile devices.

Customize the AD FS sign-in webpage to include the Fabrikam logo, a helpdesk phone number, and a

sign-in description.
Once all of the Fabrikam users are replicated to Azure Active Directory (Azure AD), assign an E3

license to all of the users in the United States office.
Technical Requirements
Contoso identifies the following technical requirements:
When a device connects from an untrusted network to https://outlook.office.com, ensure that users

must type a verification code generated from a mobile app.
Ensure that all users can access Office 365 services from a web browser by using either a UPN or their

primary SMTP email address.
After Azure AD Connects is deployed, change the UPN suffix of all the users in the Contoso sales

department to fabrikam.com.
Ensure that administrators are notified when the health information of Exchange Online changes.

Use Office 365 reports to review previous tasks performed in Office 365.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this sections, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You need to ensure that a user named User1 can create mailboxes in Exchange Online and sites in SharePoint Online.
Solution: You add User1 to the Exchange administrator admin role.
Does this meet the goal?
A. Yes
B. No
Answer: B
Explanation/Reference:
Explanation:
The Exchange administrator admin role does not have the necessary privileges to create mailboxes in Exchange Online and sites in SharePoint Online.
References: https://support.office.com/en-us/article/About-Office-365-admin-roles-da585eea-f576-4f55- a1e0-87090b6aaa9d

NEW QUESTION NO: 11
You subscribe to Office 365.
You plan to implement single sign-on.
You need to deploy Active Directory Federation Services (AD FS) to a server for the planned implementation.
Which deployment methods should you use? (Each correct answer presents a complete solution.
(Choose all that apply.)
A. On a server that runs Windows Server 2008 R2, download and install AD FS 2.0.
B. On a server that runs Windows Server 2008, download and install AD FS 2.0.
C. On a server that runs Windows Server 2008, install the AD FS server role.
D. On a server that runs Windows Server 2008 R2, install the AD FS server role.
Answer: A,B
Explanation/Reference:
Explanation:
Single sign-on requires AD FS version 2.0. The AD FS server role is version 1.1.

NEW QUESTION NO: 12
You are the Office 365 administrator for a company. You plan to implement rights management.
You need to activate Microsoft Azure Rights Management.
What should you use?
A. the Windows PowerShellEnable-AadrmSuperUserFeature cmdlet
B. the Office365 Admin Center portal
C. the Windows PowerShellSet-OrganizationConfig cmdlet
D. the Microsoft Exchange Online Admin Center
Answer: B
Explanation/Reference:
Explanation:
Once you have signed up for an Office 365 plan that includes Rights Management, sign in to Office 365 with a work or school account that has the global administrator role for your Office 365 deployment. You should then navigate to the rights management page via Settings > Services & add-ins > Microsoft Azure Information Protection > Manage Microsoft Azure Information Protection settings. On the rights management page, click activate.
References: https://docs.microsoft.com/en-us/information-protection/deploy-use/activate-office365

NEW QUESTION NO: 13
DRAG DROP
You plan to use Office 365 FastTrack to deploy an Office 365 tenant.
Which action should you perform for each phase? To answer, drag the appropriate actions to the correct phases. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Answer: 

Explanation/Reference:
Explanation:
References: https://fasttrack.microsoft.com/about

NEW QUESTION NO: 14
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are the administrator for a company. You plan to use Office 365 for email and file sharing. You plan to implement a hybrid deployment with your current on-premises Active Directory Domain Services (AD DS) environment and Microsoft Azure Active Directory (Azure AD) Connect.
You must deploy Microsoft Exchange Online and OneDrive for Business for all employees. You have the following security requirements:
All employees must use complex passwords.

Passwords must be changed every six months.

Employees must use multi-factor authentication (MFA) when possible.

You need to implement MFA verification options to use with the employee's password.
Solution: Have the employee receive a phone call.
Does the solution meet the goal?
A. Yes
B. No
Answer: A
Explanation/Reference:
Explanation:
MFA for Office 365 requires users to acknowledge a phone call, text message, or app notification on their smart phones after correctly entering their passwords.
References: https://support.office.com/en-us/article/Set-up-multi-factor-authentication-for-Office-365-users-
8f0454b2-f51a-4d9c-bcde-2c48e41621c6

NEW QUESTION NO: 15
DRAG DROP
Contoso, Ltd. has an Office 365 tenant. The company has two servers named Server1 and Server2 that run Windows 2012 R2 Server. The servers are not joined to the contoso.com domain. Server2 is deployed to the perimeter network. You install Secure Sockets Layer (SSL) certificates on both servers.
You must use Integrated Windows authentication
You need to install and configure all AD FS components in the environment.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

Answer: 

Explanation/Reference:
Explanation:
Note:
Prepare the Base Servers
Box 1, Box 2: AD FS Server
Base build the AD FS server with Windows Server 2012

Setup a connection to the internal network

Add the server to the local domain

Update the server with all Windows Updates

Box 3, Box 4: AD FS Proxy Server
Once the necessary WAP role services are installed, we are then able to launch the Web Application Proxy Wizard to configure WAP.
Note:
Base Build the AD FS Proxy server with Windows Server 2012

Setup a connection to the DMZ network (verify connectivity to the AD FS server on port 443)

DO NOT add the server to the local domain

Update the server with all Windows Updates


NEW QUESTION NO: 16
An organization is migrating from an on-premises Exchange organization to Office 365 tenant.
Users report that they cannot see the free/busy information for other users.
You need to determine why free/busy information does not display.
Which two Windows PowerShell cmdlets should you run? Each correct answer presents a complete solution.
A. Get-OrganizationRelationship
B. Get-SharingPolicy
C. Get-CsMeetingConfiguration
D. Get-CsClientPolicy
E. Get-IntraOrganizationConnector
Answer: A,B
Explanation/Reference:
Explanation:
A: Problem: Free/busy information can't be retrieved from one environment Users can't access free/busy information through Exchange federation in one direction only.
To display the trust information that is currently set up for the default Office 365 domain, run the following command:
Get-OrganizationRelationship | FL
B: If the free/busy problem persists, make sure that the sharing policies in the on-premises Exchange Server environment and in Exchange Online match. To determine this, run the following command in the Exchange ManagementShell, and then note the value in the Domains field in the results:
Get-SharingPolicy | FL
References: https://support.microsoft.com/en-us/kb/2555008

NEW QUESTION NO: 17
You are the Office 365 administrator for your company.
Users report that they cannot sign in to Skype for Business from their mobile devices, but they are able to send and receive Skype for Business messages by using their laptop computers.
You need to troubleshoot the issue.
What should you do?
A. From the Office 365 message center, confirm Skype for Business settings.
B. Use the Microsoft Connectivity Analyzer tool to confirm settings.
C. Confirm Skype for Business user licenses for the affected users.
D. From the Skype for Business admin center, verify the external access settings.
Answer: B
Explanation/Reference:
Explanation:
The Microsoft Connectivity Analyzer (MCA) tool is a companion to the Microsoft Remote Connectivity Analyzer web site. The MCA tool provides administrators and end users with the ability to run connectivity diagnostics for five common connectivity symptoms directly from their local computer.
One of the five symptoms that can be tested using MCA is:
"I can't log on to Skype for Business on my mobile device or the Skype for Business Windows Store App" - This test checks for the Domain Name Server (DNS) records for your on-premise domain to ensure they are configured correctly for supporting Mobile Skype for Business clients. Also it connects to the Autodiscover web service and makes sure that the authentication, certificate, web service for Mobility is correctly set up.

NEW QUESTION NO: 18
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this sections, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Office 365 subscription.
All of the users in your tenant are assigned an E5 license.
You need to view the list of planned updates for Microsoft Skype for Business Online.
Solution: You open the Skype for Business admin center and you review the contents of the dashboard.
Does this meet the goal?
A. Yes
B. No
Answer: B
Explanation/Reference:
Explanation:
Office 365 admin center allows you to view the health of the Skype for Business Online service, change and release notifications, and usage reports.
References:
https://support.office.com/en-us/article/About-the-Skype-for-Business-admin-role-aeb35bda-93fc-49b1- ac2c-c74fbeb737b5

NEW QUESTION NO: 19
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution. Determine whether the solution meets the stated goals.
You have an on-premises Active Directory forest.
You deploy Active Directory Federation Services (AD FS) and purchase an Office 365 subscription.
You need to create a trust between the AD FS servers and the Office 365 subscription.
Solution: You run the New-MsolFederatedDomain cmdlet.
Does this meet the goal?
A. Yes
B. No
Answer: A
Explanation/Reference:
Explanation:
Each domain that you want to federate must either be added as a single sign-on domain or converted to be a single sign-on domain from a standard domain. Adding or converting a domain sets up a trust between AD FS and Microsoft Azure Active Directory (Microsoft Azure AD).
Note: The New-MSOLFederatedDomain cmdlet adds a new single sign-on domain (also known as identity- federated domain) to and configures the relying party trust settings between the on-premises AD FS server. Due to domain verification requirements, you may need to run this cmdlet several times in order to complete the process of adding the new single sign-on domain.
References:
https://msdn.microsoft.com/en-us/library/azure/dn194105(v=azure.98).aspx
https://msdn.microsoft.com/en-us/library/azure/jj205461.aspx

NEW QUESTION NO: 20
HOTSPOT
A company plans to deploy an Office 365 tenant.
You have the following requirements:
Administrators must be able to access the Office 365 admin center.

Microsoft Exchange Online must be used as a Simple Mail Transfer Protocol (SMTP) relay for a line-of-

business application that sends email messages to remote domains.
All users must be able to use the audio and video capabilities in Microsoft Skype for Business.

You need to configure the ports for the firewall.
Which port should you use for each application? Select the correct answer from each list in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer: 

Explanation/Reference:
Explanation:
Transport Control Protocol(TCP), User Datagram Protocol (UDP) ports, and Protocol Numbers are important to TCP/IP networking, intranets, and the Internet. Ports and protocol numbers provide access to a host computer. However, they also create a security hazard by allowing uninvited access. Therefore, knowing which port to allow or disable increases a network's security. If the wrong ports or protocol numbers are disabled on a firewall, router, or proxy server as a security measure, essential services might become unavailable.
TCP port 587 is an outgoing SMTP Mail port (TLS/Start TLS Port). Used by various outgoing mail servers as an alternative to port 25.
TCP port 443 is used for Audio, video and application sharing sessions as well as data sharing sessions.
RTP/UDP port 50020-50039 must be used for outbound video sessions.
RTP/UDP port 50000-50019 must be used for outbound audio sessions.
References:
https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb- abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US
https://www.speedguide.net/port.php?port=587