Exam 70-462 Administering Microsoft SQL Server 2012/2014 Databases

Published: June 11, 2012
Languages: English, Chinese (Simplified), French, German, Japanese, Portuguese (Brazil)
Audiences: IT professionals
Technology: Microsoft SQL Server 2012/2014
Credit toward certification: MCP, MCSA, MCSE

Skills measured
This exam measures your ability to accomplish the technical tasks listed below. The percentages indicate the relative weight of each major topic area on the exam. The higher the percentage, the more questions you are likely to see on that content area on the exam. View video tutorials about the variety of question types on Microsoft exams.

Please note that the questions may test on, but will not be limited to, the topics described in the bulleted text.

Do you have feedback about the relevance of the skills measured on this exam? Please send Microsoft your comments. All feedback will be reviewed and incorporated as appropriate while still maintaining the validity and reliability of the certification process. Note that Microsoft will not respond directly to your feedback. We appreciate your input in ensuring the quality of the Microsoft Certification program.

If you have concerns about specific questions on this exam, please submit an exam challenge.

If you have other questions or feedback about Microsoft Certification exams or about the certification program, registration, or promotions, please contact your Regional Service Center.

As of February 18, 2016, this exam includes content covering both SQL Server 2012 and 2014. Please note that this exam does not include questions on features or capabilities that are present only in the SQL Server 2012 product. For more information, please download and review this document.

Install and configure (20–25%)
Plan installation
Evaluate installation requirements; design the installation of SQL Server and its components (drives, service accounts, etc.); plan scale-up vs. scale-out basics; plan for capacity, including if/when to shrink, grow, autogrow, and monitor growth; manage the technologies that influence SQL architecture (for example, service broker, full text, scale out, etc.); design the storage for new databases (drives, filegroups, partitioning); design database infrastructure; configure a SQL Server standby database for reporting purposes; Windows-level security and service level security; Core mode installation; benchmark a server before using it in a production environment (SQLIO, Tests on SQL Instance); choose the right hardware
Install SQL Server and related services
Test connectivity; enable and disable features; install SQL Server database engine and SSIS (not SSRS and SSAS); configure an OS disk
Implement a migration strategy
Restore vs detach/attach; migrate security; migrate from a previous version; migrate to new hardware; migrate systems and data from other sources
Configure additional SQL Server components
Set up and configure all SQL Server components (Engine, AS, RS and SharePoint integration) in a complex and highly secure environment; configure full-text indexing; SSIS security; filestream; filetable
Manage SQL Server Agent
Create, maintain, and monitor jobs; administer jobs and alerts; automate (setup, maintenance, monitoring) across multiple databases and multiple instances; send to "Manage SQL Server Agent jobs"

Preparation resources
Understanding surface area configuration
Hardware and software requirements for installing SQL Server 2012
Quick-start installation of SQL Server 2012

Maintain instances and databases (15–20%)
Manage and configure databases
Design multiple file groups; database configuration and standardization: autoclose, autoshrink, recovery models; manage file space, including adding new filegroups and moving objects from one filegroup to another; implement and configure contained databases; data compression; configure TDE; partitioning; manage log file growth; DBCC
Configure SQL Server instances
Configure and standardize a database: autoclose, autoshrink, recovery models; install default and named instances; configure SQL to use only certain CPUs (affinity masks, etc.); configure server level settings; configure many databases/instance, many instances/server, virtualization; configure clustered instances including MSDTC; memory allocation; database mail; configure SQL Server engine: memory, filffactor, sp_configure, default options
Implement a SQL Server clustered instance
Install a cluster; manage multiple instances on a cluster; set up subnet clustering; recover from a failed cluster node
Manage SQL Server instances
Install an instance; manage interaction of instances; SQL patch management; install additional instances; manage resource utilization by using Resource Governor; cycle error logs

Preparation resources
ALTER DATABASE file and filegroup options (Transact-SQL)
Contained databases
Data compression

Optimize and troubleshoot (15–20%)
Identify and resolve concurrency problems
Examine deadlocking issues using the SQL server logs using trace flags; design reporting database infrastructure (replicated databases); monitor via DMV or other MS product; diagnose blocking, live locking and deadlocking; diagnose waits; performance detection with built in DMVs; know what affects performance; locate and if necessary kill processes that are blocking or claiming all resources
Collect and analyze troubleshooting data
Monitor using Profiler; collect performance data by using System Monitor; collect trace data by using SQL Server Profiler; identify transactional replication problems; identify and troubleshoot data access problems; gather performance metrics; identify potential problems before they cause service interruptions; identify performance problems;, use XEvents and DMVs; create alerts on critical server condition; monitor data and server access by creating audit and other controls; identify IO vs. memory vs. CPU bottlenecks; use the Data Collector tool
Audit SQL Server instances
Implement a security strategy for auditing and controlling the instance; configure an audit; configure server audits; track who modified an object; monitor elevated privileges as well as unsolicited attempts to connect; policy-based management

Preparation resources
blocked process threshold server configuration option
Configure login auditing (SQL Server Management Studio)
Data collection

Manage data (20–25%)
Configure and maintain a back-up strategy
Manage different backup models, including point-in-time recovery; protect customer data even if backup media is lost; perform backup/restore based on proper strategies including backup redundancy; recover from a corrupted drive; manage a multi-TB database; implement and test a database implementation and a backup strategy (multiple files for user database and tempdb, spreading database files, backup/restore); back up a SQL Server environment; back up system databases
Restore databases
Restore a database secured with TDE; recover data from a damaged DB (several errors in DBCC checkdb); restore to a point in time; file group restore; page level restore
Implement and maintain indexes
Inspect physical characteristics of indexes and perform index maintenance; identify fragmented indexes; identify unused indexes; implement indexes; defrag/rebuild indexes; set up a maintenance strategy for indexes and statistics; optimize indexes (full, filter index); statistics (full, filter) force or fix queue; when to rebuild vs. reorg and index; full text indexes; column store indexes
Import and export data
Transfer data; bulk copy; bulk insert

Preparation resources
Backup and restore of SQL Server databases
File restores (full recovery mode)
DBCC INDEXDEFRAG (Transact-SQL)

Implement security (15–20%)
Manage logins and server roles
Configure server security; secure the SQL Server using Windows Account / SQL Server accounts, server roles; create log in accounts; manage access to the server, SQL Server instance, and databases; create and maintain user-defined server roles; manage certificate logins
Manage database security
Configure database security; database level, permissions; protect objects from being modified; auditing; encryption
Manage users and database roles
Create access to server / database with least privilege; manage security roles for users and administrators; create database user accounts; contained login
Troubleshoot security
Manage certificates and keys; endpoints

Preparation resources
Server-level roles
Permissions (database engine)
Database-level roles

Implement high availability (5–10%)
Implement AlwaysOn
Implement AlwaysOn availability groups; implement AlwaysOn failover clustering
Implement replication
Troubleshoot replication problems; identify appropriate replication strategy

Preparation resources
AlwaysOn Availability Groups (SQL Server)
Microsoft SQL Server AlwaysOn solutions guide for high availability and disaster recovery
AlwaysOn architecture guide: Building a high availability and disaster recovery solution by using AlwaysOn Availability Groups

---

QUESTION 1
You administer a Microsoft SQL Server 2012 database that has multiple tables in the Sales schema.
Some users must be prevented from deleting records in any of the tables in the Sales schema.
You need to manage users who are prevented from deleting records in the Sales schema. You need to achieve this goal by using the minimum amount of administrative effort.
What should you do?

A. Create a custom database role that includes the users. Deny Delete permissions on the Sales schema for the custom database role.
B. Include the Sales schema as an owned schema for the db_denydatawriter role. Add the users to the db_denydatawriter role.
C. Deny Delete permissions on each table in the Sales schema for each user.
D. Create a custom database role that includes the users. Deny Delete permissions on each table in the Sales schema for the custom database role.

Answer: A

---

QUESTION 2
You administer a Microsoft SQL Server 2012 failover cluster that contains two nodes named Node A and Node B. A single instance of SQL Server is installed on the cluster.
An additional node named Node C has been added to the existing cluster.
You need to ensure that the SQL Server instance can use all nodes of the cluster.
What should you do?

A. Run the New SQL Server stand-alone installation Wizard on Node C.
B. Run the Add Node to SQL Server Failover Cluster Wizard on Node C.
C. Use Node B to install SQL Server on Node C.
D. Use Node A to install SQL Server on Node C.

Answer: B

Explanation:
http://technet.microsoft.com/en-us/library/ms191545.aspx
To add a node to an existing SQL Server failover cluster, you must run SQL Server Setup on the node that is to be added to the SQL Server failover cluster instance. Do not run Setup on the active node.
The Installation Wizard will launch the SQL Server Installation Center. To add a node to an existing failover cluster instance, click Installation in the left-hand pane. Then, select Add node to a SQL Server failover cluster.

---

QUESTION 3
You administer a Microsoft SQL Server 2012 database named ContosoDB. The database contains a table named Suppliers and a column named IsActive in the Purchases schemA.
You create a new user named ContosoUser in ContosoDB. ContosoUser has no permissions to the Suppliers table.
You need to ensure that ContosoUser can delete rows that are not active from Suppliers. You also need to grant ContosoUser only the minimum required permissions.
Which Transact-SQL statement should you use?

A. GRANT DELETE ON Purchases. Suppliers TC ContosoUser

B. CREATE PROCEDURE Purchases.PurgelnactiveSuppliers WITH EXECUTE AS USER = 'dbo'
AS
DELETE FROM Purchases.Suppliers WHERE IsActive = 0
GO
GRANT EXECUTE ON Purchases.PurgelnactiveSuppliers TO ContosoUser

C. GRANT SELECT ON Purchases.Suppliers TO ContosoUser

D. CREATE PROCEDURE Purchases. PurgeInactiveSuppliers AS
DELETE FROM Purchases.Suppliers WHERE IsActive = 0
GO
GRANT EXECUTE ON Purchases. PurgeInactiveSuppliers TO ContosoUser

Answer: B

Explanation: Explanation/Reference:
http://msdn.microsoft.com/en-us/library/ms188354.aspx
http://msdn.microsoft.com/en-us/library/ms187926.aspx

---

QUESTION 4
You administer a Microsoft SQL Server 2012 instance. After a routine shutdown, the drive that contains tempdb fails.
You need to be able to start the SQL Server.
What should you do?

A. Modify tempdb location in startup parameters.
B. Start SQL Server in minimal configuration mode.
C. Start SQL Server in single-user mode.
D. Configure SQL Server to bypass Windows application logging.

Answer: B

Explanation: Explanation/Reference:
http://msdn.microsoft.com/en-us/library/ms186400.aspx
http://msdn.microsoft.com/en-us/library/ms345408.aspx

---

QUESTION 5
You use a contained database named ContosoDb within a domain.
You need to create a user who can log on to the ContosoDb database. You also need to ensure that you can port the database to different database servers within the domain without additional user account configurations.
Which type of user should you create?

A. User mapped to a certificate
B. SQL user without login
C. Domain user
D. SQL user with login

Answer: C

Click here to view complete Q&A of 70-462 exam
Certkingdom Review

Best Microsoft MCTS Certification, Microsoft 70-462 Training at certkingdom.com

350-018 CCIE Security version 4.0 and version 4.1

CCIE Security
Exam Number 350-018 CCIE Security
Associated Certifications CCIE Security
Duration 120 minutes (90 - 110 questions)
Available Languages English
Register Pearson VUE
Exam Policies Read current policies and requirements
Exam Tutorial Review type of exam questions

This exam tests the skills and competencies of security professionals in terms of describing, implementing, deploying, configuring, maintaining, and troubleshooting Cisco network security solutions and products, as well as current industry best practices and internetworking fundamentals.

Topics include networking fundamentals and security-related concepts and best practices, as well as Cisco network security products and solutions in areas such as VPNs, intrusion prevention, firewalls, identity services, policy management, and device hardening. Content includes both IPv4 and IPv6 concepts and solutions.

CCIE Security Written Exam (350-018) version 4.0

Exam Description
The Cisco CCIE® Security Written Exam (350-018) version 4.0 is a 2-hour test with 90–110 questions. This exam tests the skills and competencies of security professionals in terms of describing, implementing, deploying, configuring, maintaining, and troubleshooting Cisco network security solutions and products, as well as current industry best practices and internetworking fundamentals.

Topics include networking fundamentals and security-related concepts and best practices, as well as Cisco network security products and solutions in areas such as VPNs, intrusion prevention, firewalls, identity services, policy management, and device hardening. Content includes both IPv4 and IPv6 concepts and solutions.

The exam is closed book, and no outside reference materials are allowed.

The following topics are general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

CCIE Security Written Exam Topics v4.0 (Recommended for candidates who are scheduled to take the exam BEFORE July 25, 2016)


1.0 Infrastructure, Connectivity, Communications, and Network Security 20%

1.1 Network addressing basics

1.2 OSI layers

1.3 TCP/UDP/IP protocols

1.4 LAN switching (for example, VTP, VLANs, spanning tree, and trunking)

1.5 Routing protocols (for example, RIP, EIGRP, OSPF, and BGP)

1.5.a Basic functions and characteristics
1.5.b Security features

1.6 Tunneling protocols

1.6.a GRE
1.6.b NHRP
1.6.c IPv6 tunnel types

1.7 IP multicast

1.7.a PIM
1.7.b MSDP
1.7.c IGMP and CGMP
1.7.d Multicast Listener Discovery

1.8 Wireless

1.8.a SSID
1.8.b Authentication and authorization
1.8.c Rogue APs
1.8.d Session establishment

1.9 Authentication and authorization technologies

1.9.a Single sign-on
1.9.b OTPs
1.9.c LDAP and AD
1.9.d RBAC

1.10 VPNs

1.10.a L2 vs L3
1.10.b MPLS, VRFs, and tag switching

1.11 Mobile IP networks

2.0 Security Protocols 15%

2.1 RSA

2.2 RC4

2.3 MD5

2.4 SHA

2.5 DES

2.6 3DES

2.7 AES

2.8 IPsec

2.9 ISAKMP

2.10 IKE and IKEv2

2.11 GDOI

2.12 AH

2.13 ESP

2.14 CEP

2.15 TLS and DTLS

2.16 SSL

2.17 SSH

2.18 RADIUS

2.19 TACACS+

2.20 LDAP

2.21 EAP methods (for example, EAP-MD5, EAP-TLS, EAP-TTLS, EAP-FAST, PEAP, and LEAP)

2.22 PKI, PKIX, and PKCS

2.23 IEEE 802.1X

2.24 WEP, WPA, and WPA2

2.25 WCCP

2.26 SXP

2.27 MACsec

2.28 DNSSEC
3.0 Application and Infrastructure Security 10%

3.1 HTTP

3.2 HTTPS

3.3 SMTP

3.4 DHCP

3.5 DNS

3.6 FTP and SFTP

3.7 TFTP

3.8 NTP

3.9 SNMP

3.10 syslog

3.11 Netlogon, NetBIOS, and SMB

3.12 RPCs

3.13 RDP and VNC

3.14 PCoIP

3.15 OWASP

3.16 Manage unnecessary services

4.0 Threats, Vulnerability Analysis, and Mitigation 10%

4.1 Recognize and mitigate common attacks

4.1.a ICMP attacks and PING floods
4.1.b MITM
4.1.c Replay
4.1.d Spoofing
4.1.e Backdoor
4.1.f Botnets
4.1.g Wireless attacks
4.1.h DoS and DDoS attacks
4.1.i Virus and worm outbreaks
4.1.j Header attacks
4.1.k Tunneling attacks

4.2 Software and OS exploits

4.3 Security and attack tools

4.4 Generic network intrusion prevention concepts

4.5 Packet filtering

4.6 Content filtering and packet inspection

4.7 Endpoint and posture assessment

4.8 QoS marking attacks

5.0 Cisco Security Products, Features, and Management 20%

5.1 Cisco Adaptive Security Appliance (ASA)

5.1.a Firewall functionality
5.1.b Routing and multicast capabilities
5.1.c Firewall modes
5.1.d NAT (before and after version 8.4)
5.1.e Object definition and ACLs
5.1.f MPF functionality (IPS, QoS, and application awareness)
5.1.g Context-aware firewall
5.1.h Identity-based services
5.1.i Failover options

5.2 Cisco IOS firewalls and NAT

5.2.a CBAC
5.2.b Zone-based firewall
5.2.c Port-to-application mapping
5.2.d Identity-based firewalling

5.3 Cisco Intrusion Prevention Systems (IPS)

5.4 Cisco IOS IPS

5.5 Cisco AAA protocols and application

5.5.a RADIUS
5.5.b TACACS+
5.5.c Device administration
5.5.d Network access
5.5.e IEEE 802.1X
5.5.f VSAs

5.6 Cisco Identity Services Engine (ISE)

5.7 Cisco Secure ACS Solution Engine

5.8 Cisco Network Admission Control (NAC) Appliance Server

5.9 Endpoint and client

5.9.a Cisco AnyConnect VPN Client
5.9.b Cisco VPN Client
5.9.c Cisco Secure Desktop
5.9.d Cisco NAC Agent

5.10 Secure access gateways (Cisco IOS router or ASA)

5.10.a IPsec
5.10.b SSL VPN
5.10.c PKI

5.11 Virtual security gateway

5.12 Cisco Catalyst 6500 Series ASA Services Modules

5.13 ScanSafe functionality and components

5.14 Cisco Web Security Appliance and Cisco Email Security Appliance

5.15 Security management

5.15.a Cisco Security Manager
5.15.b Cisco Adaptive Security Device Manager (ASDM)
5.15.c Cisco IPS Device Manager (IDM)
5.15.d Cisco IPS Manager Express (IME)
5.15.e Cisco Configuration Professional
5.15.f Cisco Prime

6.0 Cisco Security Technologies and Solutions 17%

6.1 Router hardening features (for example, CoPP, MPP, uRPF, and PBR)

6.2 Switch security features (for example, anti-spoofing, port, STP, MACSEC, NDAC, and NEAT)

6.3 NetFlow

6.4 Wireless security

6.5 Network segregation

6.5.a VRF-aware technologies
6.5.b VXLAN

6.6 VPN solutions

6.6.a FlexVPN
6.6.b DMVPN
6.6.c GET VPN
6.6.d Cisco EasyVPN

6.7 Content and packet filtering

6.8 QoS application for security

6.9 Load balancing and failover

7.0 Security Policies and Procedures, Best Practices, and Standards 8%

7.1 Security policy elements

7.2 Information security standards (for example, ISO/IEC 27001 and ISO/IEC 27002)

7.3 Standards bodies (for example, ISO, IEC, ITU, ISOC, IETF, IAB, IANA, and ICANN)

7.4 Industry best practices (for example, SOX and PCI DSS)

7.5 Common RFC and BCP (for example, RFC2827/BCP38, RFC3704/BCP84, and RFC5735)

7.6 Security audit and validation

7.7 Risk assessment

7.8 Change management process

7.9 Incident response framework

7.10 Computer security forensics

7.11 Desktop security risk assessment and desktop security risk management

CCIE Security Written Exam (350-018) Version 4.1

Exam Description
The Cisco CCIE® Security Written Exam [350-018] version 4.1 is a 2-hour test with 90–110 questions. This exam tests the skills and competencies of security professionals in terms of describing, implementing, deploying, configuring, maintaining, and troubleshooting Cisco network security solutions and products, as well as current industry best practices and internetworking fundamentals.

Topics include networking fundamentals and security-related concepts and best practices, as well as Cisco network security products and solutions in areas such as VPNs, intrusion prevention, firewalls, identity services, policy management, and device hardening. Content includes both IPv4 and IPv6 concepts and solutions.

The exam is closed book, and no outside reference materials are allowed.

The following topics are general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

CCIE Security Written Exam Topics v4.1 (Recommended for candidates who are scheduled to take the exam ON July 25, 2016 and beyond)


1.0 Infrastructure, Connectivity, Communications, and Network Security 14%

1.1 Network addressing basics

1.2 OSI layers

1.3 TCP/UDP/IP protocols

1.4 LAN switching [for example, VTP, VLANs, spanning tree, and trunking]

1.5 Routing protocols [for example, RIP, EIGRP, OSPF, and BGP]

1.5.a Basic functions and characteristics
1.5.b Security features

1.6 Tunneling protocols

1.6.a GRE
1.6.b NHRP
1.6.c IPv6 tunnel types

1.7 IP multicast

1.7.a PIM
1.7.b MSDP
1.7.c IGMP and CGMP
1.7.d Multicast Listener Discovery

1.8 Wireless

1.8.a SSID
1.8.b Authentication and authorization
1.8.c Rogue APs
1.8.d Session establishment

1.9 Authentication and authorization technologies

1.9.a Single sign-on
1.9.b OTPs
1.9.c LDAP and AD
1.9.d RBAC

1.10 VPNs

1.10.a L2 vs L3
1.10.b MPLS, VRFs, and tag switching

1.11 Mobile IP networks

2.0 Security Protocols 14%

2.1 RSA

2.2 RC4

2.3 MD5

2.4 SHA

2.5 DES

2.6 3DES

2.7 AES

2.8 IPsec

2.9 ISAKMP

2.10 IKE and IKEv2

2.11 GDOI

2.12 AH

2.13 ESP

2.14 CEP

2.15 TLS and DTLS

2.16 SSL

2.17 SSH

2.18 RADIUS

2.19 TACACS+

2.20 LDAP

2.21 EAP methods [for example, EAP-MD5, EAP-TLS, EAP-TTLS, EAP-FAST, PEAP, and LEAP]

2.22 PKI, PKIX, and PKCS

2.23 IEEE 802.1X

2.24 WEP, WPA, and WPA2

2.25 WCCP

2.26 SXP

2.27 MACsec

2.28 DNSSEC

3.0 Application and Infrastructure Security 10%

3.1 HTTP

3.2 HTTPS

3.3 SMTP

3.4 DHCP

3.5 DNS

3.6 FTP and SFTP

3.7 TFTP

3.8 NTP

3.9 SNMP

3.10 syslog

3.11 Netlogon, NetBIOS, and SMB

3.12 RPCs

3.13 RDP and VNC

3.14 PCoIP

3.15 OWASP

3.16 Manage unnecessary services

4.0 Threats, Vulnerability Analysis, and Mitigation 10%

4.1 Recognize and mitigate common attacks

4.1.a ICMP attacks and PING floods
4.1.b MITM
4.1.c Replay
4.1.d Spoofing
4.1.e Backdoor
4.1.f Botnets
4.1.g Wireless attacks
4.1.h DoS and DDoS attacks
4.1.i Virus and worm outbreaks
4.1.j Header attacks
4.1.k Tunneling attacks

4.2 Software and OS exploits

4.3 Security and attack tools

4.4 Generic network intrusion prevention concepts

4.5 Packet filtering

4.6 Content filtering and packet inspection

4.7 Endpoint and posture assessment

4.8 QoS marking attacks

5.0 Cisco Security Products, Features, and Management 18%

5.1 Cisco Adaptive Security Appliance [ASA]

5.1.a Firewall functionality
5.1.b Routing and multicast capabilities
5.1.c Firewall modes
5.1.d NAT [before and after version 8.4]
5.1.e Object definition and ACLs
5.1.f MPF functionality [IPS, QoS, and application awareness]
5.1.g Context-aware firewall
5.1.h Identity-based services
5.1.i Failover options

5.2 Cisco IOS firewalls and NAT

5.2.a CBAC
5.2.b Zone-based firewall
5.2.c Port-to-application mapping
5.2.d Identity-based firewalling

5.3 Cisco Intrusion Prevention Systems [IPS]

5.4 Cisco IOS IPS

5.5 Cisco AAA protocols and application

5.5.a RADIUS
5.5.b TACACS+
5.5.c Device administration
5.5.d Network access
5.5.e IEEE 802.1X
5.5.f VSAs

5.6 Cisco Identity Services Engine [ISE]

5.7 Cisco Secure ACS Solution Engine

5.8 Cisco Network Admission Control [NAC] Appliance Server

5.9 Endpoint and client

5.9.a Cisco AnyConnect VPN Client
5.9.b Cisco VPN Client
5.9.c Cisco Secure Desktop
5.9.d Cisco NAC Agent

5.10 Secure access gateways [Cisco IOS router or ASA]

5.10.a IPsec
5.10.b SSL VPN
5.10.c PKI

5.11 Virtual security gateway

5.12 Cisco Catalyst 6500 Series ASA Services Modules

5.13 ScanSafe functionality and components

5.14 Cisco Web Security Appliance and Cisco Email Security Appliance

5.15 Security management

5.15.a Cisco Security Manager
5.15.b Cisco Adaptive Security Device Manager [ASDM]
5.15.c Cisco IPS Device Manager [IDM]
5.15.d Cisco IPS Manager Express [IME]
5.15.e Cisco Configuration Professional
5.15.f Cisco Prime

6.0 Cisco Security Technologies and Solutions 16%

6.1 Router hardening features [for example, CoPP, MPP, uRPF, and PBR]

6.2 Switch security features [for example, anti-spoofing, port, STP, MACSEC, NDAC, and NEAT]

6.3 NetFlow

6.4 Wireless security

6.5 Network segregation

6.5.a VRF-aware technologies
6.5.b VXLAN

6.6 VPN solutions

6.6.a FlexVPN
6.6.b DMVPN
6.6.c GET VPN
6.6.d Cisco EasyVPN

6.7 Content and packet filtering

6.8 QoS application for security

6.9 Load balancing and failover

7.0 Security Policies and Procedures, Best Practices, and Standards 8%

7.1 Security policy elements

7.2 Information security standards [for example, ISO/IEC 27001 and ISO/IEC 27002]

7.3 Standards bodies [for example, ISO, IEC, ITU, ISOC, IETF, IAB, IANA, and ICANN]

7.4 Industry best practices [for example, SOX and PCI DSS]

7.5 Common RFC and BCP [for example, RFC2827/BCP38, RFC3704/BCP84, and RFC5735]

7.6 Security audit and validation

7.7 Risk assessment

7.8 Change management process

7.9 Incident response framework

7.10 Computer security forensics

7.11 Desktop security risk assessment and desktop security risk management

8.0 Evolving Technologies 10%

8.1 Cloud

8.1.a Compare and contrast Cloud deployment models
8.1.a [i] Infrastructure, platform, and software services [XaaS]
8.1.a [ii] Performance and reliability
8.1.a [iii] Security and privacy
8.1.a [iv] Scalability and interoperability
8.1.b Describe Cloud implementations and operations
8.1.b [i] Automation and orchestration
8.1.b [ii] Workload mobility
8.1.b [iii] Troubleshooting and management
8.1.b [iv] OpenStack components

8.2 Network programmability [SDN]

8.2.a Describe functional elements of network programmability [SDN] and how they interact
8.2.a [i] Controllers
8.2.a [ii] APIs
8.2.a [iii] Scripting
8.2.a [iv] Agents
8.2.a [v] Northbound vs. Southbound protocols
8.2.b Describe aspects of virtualization and automation in network environments
8.2.b [i] DevOps methodologies, tools and workflows
8.2.b [ii] Network/application function virtualization [NFV, AFV]
8.2.b [iii] Service function chaining
8.2.b [iv] Performance, availability, and scaling considerations

8.3 Internet of Things

8.3.a Describe architectural framework and deployment considerations for Internet of Things [IoT]
8.3.a [i] Performance, reliability and scalability
8.3.a [ii] Mobility
8.3.a [iii] Security and privacy
8.3.a [iv] Standards and compliance
8.3.a [v] Migration
8.3.a [vi] Environmental impacts on the network

---

QUESTION 1
An RSA key pair consists of a public key and a private key and is used to set up PKI. Which statement applies to RSA and PKI?

A. The public key must be included in the certificate enrollment request.
B. The RSA key-pair is a symmetric cryptography.
C. It is possible to determine the RSA key-pair private key from its corresponding public key.
D. When a router that does not have an RSA key pair requests a certificate, the certificate request is sent, but a warning is shown to generate the RSA key pair before a CA signed certificate is received.

Answer: A

Explanation:
An RSA key pair consists of a public key and a private key. When setting up your PKI, you must include the public key in the certificate enrollment request. After the certificate has been granted, the public key will be included in the certificate so that peers can use it to encrypt data that is sent to the router. The private key is kept on the router and used both to decrypt the data sent by peers and to digitally sign transactions when negotiating with peers.
Reference: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_pki/configuration/xe-3s/sec-pki-xe-3s-book/sec-pki-overview.html

---

QUESTION 2
Refer to the exhibit.


Which three descriptions of the configuration are true? (Choose three.)

A. The configuration is on the NHS.
B. The tunnel IP address represents the NBMA address.
C. This tunnel is a point-to-point GRE tunnel.
D. The tunnel is not providing peer authentication.
E. The configuration is on the NHC.
F. The tunnel encapsulates multicast traffic.
G. The tunnel provides data confidentiality.

Answer: A,F,G

---

QUESTION 3
Which two values you must configure on the Cisco ASA firewall to support FQDN ACL? (Choose two.)

A. a DNS server
B. an FQDN object
C. a policy map
D. a class map
E. a service object
F. a service policy

Answer: A,B
Reference: https://supportforums.cisco.com/document/66011/using-hostnames-dns-
access-lists-configuration-steps-caveats-and-troubleshooting

---

QUESTION 4
Which set of encryption algorithms is used by WPA and WPA2?

A. Blowfish and AES
B. CAST and RC6
C. TKIP and RC6
D. TKIP and AES

Answer: D

---

QUESTION 5
What are two enhancements in WCCP V2.0 over WCCP V1.0? (Choose two.)

A. support for HTTP redirection
B. multicast support
C. authentication support
D. IPv6 support
E. encryption support

Answer: B,C

Explanation: WCCP V2.0 supports the following enhancements to the WCCP V1.0
Protocol:
* Multi-Router Support.
WCCP V2.0 allows a farm of web-caches to be attached to more than one router.
* Multicast Support.
WCCP V2.0 supports multicasting of protocol messages between web-caches and routers.
* Improved Security.
WCCP V2.0 provides optional authentication of protocol packets received by web-caches and routers.
* Support for redirection of non-HTTP traffic.
WCCP V2.0 supports the redirection of traffic other than HTTP traffic through the concept of Service Groups.
* Packet return.
WCCP V2.0 allows a web-cache to decline to service a redirected packet and to return it to a router to be forwarded. The method by which packets are returned to a router is negotiable.
Reference: https://tools.ietf.org/id/draft-wilson-wrec-wccp-v2-01.txt

Click here to view complete Q&A of 300-018 exam
Certkingdom Review

Best Cisco 300-018 Certification, Cisco 300-018 Training at certkingdom.com

300-470 CLDAUT Designing the Cisco Cloud

Exam Number 300-470 CLDAUT
Associated Certifications CCNP Cloud
Duration 90 Minutes (55 - 65 questions)
Available Languages English
Register Pearson VUE
Exam Policies Read current policies and requirements
Exam Tutorial Review type of exam questions

Exam Description
The Automating the Cisco Enterprise Cloud (CLDAUT) exam (300-470) is a 90-minute, 55–65 question assessment that is associated with the CCNP Cloud Certification. This exam tests a candidate's knowledge and ability to provision private IaaS, provision private IaaS with catalog scaling, provision private IaaS with network automation, provision hybrid IaaS, and perform application provisioning a life-cycle management. Candidates can prepare for this assessment by taking the Automating the Cisco Enterprise Cloud (CLDAUT v1.0) course.

The following topics are general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

1.0 Provision Private IaaS Infrastructure 27%

1.1 Create cloud tenant

1.1.a Provision infrastructure devices
1.1.a.1 Provision network
1.1.a.2 Provision compute
1.1.a.3 Provision storage

1.2 Develop policies

1.2.a Network
1.2.b Storage
1.2.c Compute
1.2.d Cost model
1.2.e Service catalog

1.3 Manage virtual data centers

1.3.a Create virtual data center
1.3.b Manage application categories in a VDC

1.4 Manage workflows

1.4.a Create input/output parameters
1.4.b Add tasks to workflow designer
1.4.c Create custom workflow tasks
1.4.d Describe the open automation took kit (SDK)

1.5 Manage catalogs

1.5.a Publish standard and advanced catalogs
1.5.b Cloning a catalog
1.5.c Create user VM action policy
1.5.d Cost (monetary) tracking

1.6 Configure self-service provisioning in Cisco UCS Director

1.6.a Customize portals
1.6.b Create service request workflow
1.6.c Monitor service requests

2.0 Provision Private IaaS Catalog 17%

2.1 Publish Cisco UCS Director services in PSC 11.0

2.1.a Discover Cisco UCS Director catalogs and templates
2.1.b Publish services with RBAC for end-user ordering

2.2 Order PSC IaaS services as end users

2.2.a Login as an end user
2.2.b Order a VM based on standard or advanced
2.2.c Catalogs
2.2.d Order a service container

2.3 Publish application stack services

2.3.a Design application stack services
2.3.b Publish application stack services with RBAC for end-user ordering
2.3.c Order application stack as an end user

3.0 Provision Private IaaS with Network Automation 18%

3.1 Define policies for container

3.1.a Computing policies
3.1.b Network policy
3.1.c Storage policies
3.1.d System policies

3.2 Defining global resource pools

3.2.a Configure VLAN/VXLAN pools
3.2.b Configure IP subnet pools
3.2.c Configure static IP pools

3.3 Creating a Cisco VACS three-tier internal template

3.3.a Specifying a template type
3.3.b Selecting the deployment options
3.3.c Configuring network resource pools
3.3.d Configuring VM networks
3.3.e Adding virtual machines to a template

3.4 Creating a Cisco VACS three-tier external template

3.4.a Define ACL for three-tier external template
3.4.b Configure security zones

3.5 Publish discovered VACS services in PSC 11.0

3.5.a Discover the VACS containers
3.5.b Register the VACS application container templates

4.0 Provision Hybrid IaaS 18%

4.1 Configure intercloud fabric connectivity

4.1.a Set up provider cloud account
4.1.b Set up infrastructure image
4.1.c Set up secure extension
4.1.d Add port profile
4.1.e Create IP pools for VMs
4.1.f Create user groups and users
4.1.g Configure vDCs
4.1.h Configure network and system policies

4.2 Create VM templates to deploy new workloads in the hybrid cloud

4.2.a Configure a virtual machine template
4.2.b Configure network policies
4.2.c Configure system policies
4.2.d Configure storage policies
4.2.e Configure VMware policies (network, system, computing, and storage)
4.2.f Create a catalog for templates

4.3 Create VM templates to migrate workloads between public cloud and private clouds

4.3.a Configure a virtual machine template
4.3.b Configure network policies
4.3.c Configure system policies
4.3.d Configure storage polices
4.3.e Configure VMware policies (network, system, computing, and storage)
4.3.f Create a catalog for templates

4.4 Deploy security appliances in the hybrid cloud

4.4.a Run infrastructure wizard through ICF to bring up ICS services controller and cloud components (such as: PNSC)
4.4.b Add the compute firewall
4.4.c Define compute security profile
4.4.d Define object groups, zones, rules, and policies
4.4.e Create service path
4.4.f Bind the service path to port profile

4.5 Configure routing policies to enable secure communication between hybrid cloud VMs

4.5.a Add edge routers
4.5.b Add system policies
4.5.c Add network policies
4.5.d Add routing policies
4.5.e Assign VMs

4.6 Configure end-user workflows to manage virtual machines in hybrid cloud environment

4.6.a Bursting
4.6.b Sandbox for development
4.6.c Disaster recovery
4.6.d Production deployment on public environment

5.0 Application Provisioning and Life-Cycle Management 20%

5.1 Order a virtual server on PSC 11.0

5.1.a Order a VM based on standard or advanced catalogs
5.1.b Order a service container

5.2 Order a physical server on PSC 11.0

5.2.a Order a bare-metal physical server
5.2.b Order a virtualized physical server

5.3 Order a multitier application container on PSC 11.0

5.3.a Order a three-tier application container

5.4 Managing application containers

5.4.a Access the application container reports
5.4.b Power on the application container
5.4.c Power off the application container
5.4.d Add VMs to application container
5.4.e Delete VMs from application container
5.4.f Delete an application container

5.5 Managing life cycles

5.5.a VM
5.5.b Compute
5.5.c Storage
5.5.d Network

5.6 Snapshots

5.6.a Types
5.6.b Requirements
5.6.c Limitations

---

QUESTION 1
Cisco Intelligent Automation Cloud is a solution that enables organizations to automate delivery of
physical and virtual servers through the use of a self-service portal. Which two key Cisco products
are used for the automation framework of this solution? (Choose two.)

A. Cisco Process Orchestrator
B. Cisco Prime Service Catalog
C. Cisco Cloud Orchestrator
D. Cisco Server Orchestrator
E. Cisco Process Portal

Answer: A,B

Explanation:

---

QUESTION 2
Which three statements are true regarding Cisco VACS and its benefit for cloud deployment?
(Choose three.)

A. Cisco VACS offers easy-to-use templates for rapid provisioning.
B. Cisco VACS lacks security although it offers intuitive user interface through Cisco UCS
Director.
C. Cisco VACS is a robust container for three-tier or custom application deployment.
D. CSR benefits up to 10-G/ps throughput with the advent of Cisco VACS support.
E. CSR benefits up to 40-G/ps throughput with the advent of Cisco VACS support.
F. Cisco VACS offers acustom application deployment for the Cisco Prime Service Catalog.

Answer: A,C,D

Explanation:

---

QUESTION 3
The Cisco UCS Director includes a set of wizards that guide through configuring features. Which
three wizards are available in the Cisco UCS Director? (Choose three.)

A. FlexPod Configuration
B. VDC Creation
C. Catalog Configuration
D. Device Discovery
E. Zoning Creation
F. Storage Discovery

Answer: A,B,D

Explanation:

---

QUESTION 4
A cost model in UCS Director is used to define the unit level costs of which two virtual resources?
(Choose two.)

A. socket
B. CPU
C. RAM
D. NIC
E. vNIC
F. datastore size

Answer: B,C

Explanation:

---

QUESTION 5
Which two statements are true regarding role-based access control in Prime Service Catalog?
(Choose two.)

A. IT admin usesthe Cisco Prime Service Catalog as the primary interface to manage tenant life
cycle and services.
B. Tenant admin in the private cloud is associated with tenant billing and cost model.
C. Development of stack designer for application deployment is not within the framework of RBAC.
D. IT admin manages infrastructure in the cloud and uses the Cisco Prime Service Catalog,
Horizon, and Openstack templates as the primary interface.

Answer: A,D

Explanation:

Click here to view complete Q&A of 300-470 exam
Certkingdom Review

Best Cisco 300-470 Certification, Cisco 300-470 Training at certkingdom.com

300-465 CLDDES Designing the Cisco Cloud

Exam Number 300-465 CLDDES
Associated Certifications CCNP Cloud
Duration 90 Minutes (55 - 65 questions)
Available Languages English
Register Pearson VUE
Exam Policies Read current policies and requirements
Exam Tutorial Review type of exam questions

Exam Description
The 300-465 (CLDDES) Designing the Cisco Cloud is a 90-minute, 55-65 question assessment that is associated with the CCNP Cloud Certification. This exam tests a candidate's knowledge and ability to: translate requirements into cloud/automation process designs; design Private Cloud infrastructures; design Public Cloud infrastructures, design Cloud Security Policies; and design Virtualization and Virtual Network Services. Candidates can prepare for this assessment by taking the Designing the Cisco Cloud (CLDDES v1.0) course.

The following topics are general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

1.0 Translate Requirements into Automation Designs 22%

1.1 Gather business requirements

1.1.a Identify key business requirements for cloud/automation
1.1.b Choose appropriate cloud implementation to meet business requirements

1.2 Describe automation as a foundation of cloud design

1.3 Design appropriate automation tasks to meet requirements

1.3.a Design infrastructure container automation within UCS Director
1.3.b Design catalog
1.3.c Define infrastructure container
1.3.d Design workflow and services

1.4 Design Prime Services Catalog store front for UCS Director

1.5 Design Application and Platform as a Service using Stack Designer

1.6 Select the appropriate solution to automate private or hybrid clouds

1.6.a Cisco Enablement Platform
1.6.b UCS Director
1.6.c Cisco Intelligent Automation for Cloud (CIAC)

2.0 Design a Private Cloud Infrastructure 22%

2.1 Compare and contrast the various private cloud integrated infrastructures

2.1.a Flexpod
2.1.b VBlock
2.1.c Virtual System Specifications (VSPEX)

2.2 Given a set of requirements, determine when to use file or block storage

2.3 Select the methods of accessing storage

2.3.a Determine connectivity types
2.3.b Determine access rights

2.4 Determine the thin/thick provisioning methods for a given environment

2.5 Determine the appropriate methods of interconnecting private clouds

2.6 Determine when to use the appropriate solution to automate network services

3.0 Design a Hybrid Cloud Infrastructure 16%

3.1 Compare and contrast the various public cloud architectures

3.2 Select the methodology to connect to public clouds

3.3 Select the appropriate solution to automate hybrid cloud provisioning

4.0 Design a Cloud Security Policy 20%

4.1 Describe best practices for securing cloud infrastructure

4.2 Describe best practices for securing cloud services

4.3 Design a secure multi tenant environment

4.4 Design a security policy to protect a private cloud

4.5 Design a security policy to protect a hybrid cloud

5.0 Virtualization and Virtual Network Services for Private and Hybrid Clouds 20%

5.1 Describe the advantages, disadvantages and features of different hypervisors

5.1.a Resource scheduling
5.1.b DR
5.1.c HA

5.2 Describe the use of cloud automation tools to facilitate physical to virtual or virtual to virtual migrations

5.2.a Workflows
5.2.a.1 Cisco Enablement Platform
5.2.a.2 UCS Director
5.2.a.3 Virtual Application Container Services (VACS)
5.2.b Compare benefits and limitation of Virtual Machines

5.3 Select the appropriate virtual network and security services to meet requirements

5.4 Describe context aware infrastructure and workflow identity

5.4.a Methodologies
5.4.b Components
5.4.c Use cases

5.5 Describe workload mobility

5.5.a Describe VM migration: move VMs from any hypervisor to any public cloud and back
5.5.b Describe VM conversion
5.5.c Describe use cases

5.6 Describe the ability to automate VM life cycle

5.6.a Describe workflow creation using Intercloud Fabric Director and Prime Services Catalog

Click here to view complete Q&A of 300-465 exam
Certkingdom Review

Best Cisco 300-465 Certification, Cisco 300-465 Training at certkingdom.com

300-208 SISAS Implementing Cisco Secure Access Solutions

Exam Number 300-208 SISAS
Associated Certifications CCNP Security
Duration 90 minutes (65 - 75 questions)
Available Languages English, Japanese

Exam Description
The Implementing Cisco Secure Access Solutions (SISAS) (300-208) exam tests whether a network security engineer knows the components and architecture of secure access, by utilizing 802.1X and Cisco TrustSec. This 90-minute exam consists of 65–75 questions and assesses knowledge of Cisco Identity Services Engine (ISE) architecture, solution, and components as an overall network threat mitigation and endpoint control solutions. It also includes the fundamental concepts of bring your own device (BYOD) using posture and profiling services of ISE. Candidates can prepare for this exam by taking the Implementing Cisco Secure Access Solutions (SISAS) course.

The following topics are general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

1.0 Identity Management/Secure Access 33%
1.1 Implement device administration

1.1.a Compare and select AAA options
1.1.b TACACS+
1.1.c RADIUS
1.1.d Describe Native AD and LDAP

1.2 Describe identity management
1.2.a Describe features and functionality of authentication and authorization
1.2.b Describe identity store options (i.e., LDAP, AD, PKI, OTP, Smart Card, local)
1.2.c Implement accounting

1.3 Implement wired/wireless 802.1X
1.3.a Describe RADIUS flows
1.3.b AV pairs
1.3.c EAP types
1.3.d Describe supplicant, authenticator, and server
1.3.e Supplicant options
1.3.f 802.1X phasing (monitor mode, low impact, closed mode)
1.3.g AAA server
1.3.h Network access devices

1.4 Implement MAB
1.4.a Describe the MAB process within an 802.1X framework
1.4.b Flexible authentication configuration
1.4.c ISE authentication/authorization policies
1.4.d ISE endpoint identity configuration
1.4.e Verify MAB Operation

1.5 Implement network authorization enforcement
1.5.a dACL
1.5.b Dynamic VLAN assignment
1.5.c Describe SGA
1.5.d Named ACL
1.5.e CoA

1.6 Implement Central Web Authentication (CWA)
1.6.a Describe the function of CoA to support web authentication
1.6.b Configure authentication policy to facilitate CWA
1.6.c URL redirect policy
1.6.d Redirect ACL
1.6.e Customize web portal
1.6.f Verify central web authentication operation

1.7 Implement profiling
1.7.a Enable the profiling services
1.7.b Network probes
1.7.c IOS Device Sensor
1.7.d Feed service
1.7.e Profiling policy rules
1.7.f Utilize profile assignment in authorization policies
1.7.g Verify profiling operation

1.8 Implement guest services
1.8.a Managing sponsor accounts
1.8.b Sponsor portals
1.8.c Guest portals
1.8.d Guest Policies
1.8.e Self registration
1.8.f Guest activation
1.8.g Differentiated secure access
1.8.h Verify guest services operation

1.9 Implement posture services
1.9.a Describe the function of CoA to support posture services
1.9.b Agent options
1.9.c Client provisioning policy and redirect ACL
1.9.d Posture policy
1.9.e Quarantine/remediation
1.9.f Verify posture service operation

1.10 Implement BYOD access
1.10.a Describe elements of a BYOD policy
1.10.b Device registration
1.10.c My devices portal
1.10.d Describe supplicant provisioning

2.0 Threat Defense 10%
2.1 Describe TrustSec Architecture
2.1.a SGT Classification - dynamic/static
2.1.b SGT Transport - inline tagging and SXP
2.1.c SGT Enforcement - SGACL and SGFW
2.1.d MACsec

3.0 Troubleshooting, Monitoring and Reporting Tools 7%

3.1 Troubleshoot identity management solutions

3.1.a Identify issues using authentication event details in Cisco ISE
3.1.b Troubleshoot using Cisco ISE diagnostic tools
3.1.c Troubleshoot endpoint issues
3.1.d Use debug commands to troubleshoot RADIUS and 802.1X on IOS switches and wireless controllers
3.1.e Troubleshoot backup operations

4.0 Threat Defense Architectures 17%

4.1 Design highly secure wireless solution with ISE

4.1.a Identity Management
4.1.b 802.1X
4.1.c MAB
4.1.d Network authorization enforcement
4.1.e CWA
4.1.f Profiling
4.1.g Guest Services
4.1.h Posture Services
4.1.i BYOD Access

5.0 Identity Management Architectures 33%

5.1 Device administration
5.2 Identity Management
5.3 Profiling
5.4 Guest Services
5.5 Posturing Services
5.6 BYOD Access

QUESTION 1
With which two appliance-based products can Cisco Prime Infrastructure integrate to perform centralized management? (Choose two.)

A. Cisco Managed Services Engine
B. Cisco Email Security Appliance
C. Cisco Wireless Location Appliance
D. Cisco Content Security Appliance
E. Cisco ISE

Answer: A,E

---

QUESTION 2
Which two fields are characteristics of IEEE 802.1AE frame? (Choose two.)

A. destination MAC address
B. source MAC address
C. 802.1AE header in EtherType
D. security group tag in EtherType
E. integrity check value
F. CRC/FCS

Answer: C,E

---

QUESTION 3
Which three statements about the Cisco wireless IPS solution are true? (Choose three.)

A. It enables stations to remain in power-save mode, except at specified intervals to receive data from the access point.
B. It detects spoofed MAC addresses.
C. It identifies potential RF jamming attacks.
D. It protects against frame and device spoofing.
E. It allows the WLC to failover because of congestion.

Answer: B,C,D

---

QUESTION 4
In AAA, what function does authentication perform?

A. It identifies the actions that the user can perform on the device.
B. It identifies the user who is trying to access a device.
C. It identifies the actions that a user has previously taken.
D. It identifies what the user can access.

Answer: B

---

QUESTION 5
Which two EAP types require server side certificates? (Choose two.)

A. EAP-TLS
B. PEAP
C. EAP-MD5
D. LEAP
E. EAP-FAST
F. MSCHAPv2

Answer: A,B

Click here to view complete Q&A of 300-208 exam
Certkingdom Review

Best Cisco 300-208 Certification, Cisco 300-208 Training at certkingdom.com

Exam Ref 70-398 Planning for and Managing Devices in the Enterprise

Prepare for Microsoft Exam 70-398—and help demonstrate your real-world mastery of planning and designing cloud and hybrid identities and supporting identity infrastructure for managing devices. Designed for experienced IT pros ready to advance their status, this Exam Ref focuses on the critical-thinking and decision-making acumen needed for success at the Microsoft Specialist level.

Focus on the skills measured on the exam:
• Design for cloud/hybrid identity
• Design for device access and protection
• Design for data access and protection
• Design for remote access
• Plan for apps
• Plan updates and recovery

This Microsoft Exam Ref:
• Organizes its coverage by skill measured on the exam
• Features Thought Experiments to help you assess your readiness for the exam
• Assumes you have experience with desktop and device administration, Windows networking technologies, Active Directory, and Microsoft Intune

About This Course
This course is intended to be a quick-paced introduction to the key concepts and components that make up the management of Windows 10 devices using Enterprise Mobility Suite (EMS) which includes Microsoft Azure AD Premium, Azure Rights Management Services (or RMS), and Microsoft Intune. The majority of your time will be spent working directly with the products inside a preconfigured lab environment. And, although we have provided overview information for each of the technologies and pointers to additional resources should you want to know more, we believe you will gain a better understanding of the workings of device management through seeing and doing… hands on.

You will work your way through the online labs to become familiar with:

Implementing Hybrid Identity
Managing an Active Directory Hybrid Environment
Managing Inventory
Preparing the Microsoft Intune Service for Device Enrollment
Data access and protection using Azure RMS

Each lab includes the following:
Procedures for the individual lab tasks for each exercise
Access to a Windows 10 and Windows Server 2012 R2 Domain Controller for performing “hands-on” lab exercises
Short “how-to” videos for viewing each and every task should you get stuck and need to see how it’s done, and get moving again

The point is... you can try the labs on your own, at your own pace, but we recommend you view the individual demo videos for those times when you might need a little bit of help, for example entering a command string, or navigating across the Azure and Intune UI. What’s probably not a bad idea is to do a quick scan of the demos to familiarize yourself with the lab content prior to working hands-on… it’s your call, whatever works for you.

To give you an idea of how these labs work let’s look at one of the first labs entitled Automatic Microsoft Intune Enrollment of Azure AD Joined Windows 10 Systems… in that lab you get started using a Windows 10 virtual machine to setup and enable Azure AD and Enterprise Mobility Suite and then do some client join activities to Azure AD. So, once you’ve completed the lab, you’ll be able to:

Create an Azure AD instance
Activate an Enterprise Mobility Suite trial
Configure automatic Microsoft Intune enrollment during Azure AD join
Configure device join options in Azure AD
Configure Microsoft Intune subscription as the Mobile Device Management Authority
Join a Windows 10 client computer to Azure AD
Verify that a Windows 10 client is managed by Microsoft Intune

Prerequisites
This course is intended for IT professionals who administer and support Windows 7, 8.x, and 10 PCs, devices, users and associated network and security resources. The networks with which these professionals typically work are configured as a Windows Server domain-based environment with managed access to the Internet and cloud services. They are also skilled in working with iOS and Android devices.

Skills measured
This exam measures your ability to accomplish the technical tasks listed below. View video tutorials about the variety of question types on Microsoft exams.

Please note that the questions may test on, but will not be limited to, the topics described in the bulleted text.

Do you have feedback about the relevance of the skills measured on this exam? Please send Microsoft your comments. All feedback will be reviewed and incorporated as appropriate while still maintaining the validity and reliability of the certification process. Note that Microsoft will not respond directly to your feedback. We appreciate your input in ensuring the quality of the Microsoft Certification program.

If you have concerns about specific questions on this exam, please submit an exam challenge.

If you have other questions or feedback about Microsoft Certification exams or about the certification program, registration, or promotions, please contact your Regional Service Center.

Design for cloud/hybrid identity (15–20%)
Plan for Azure Active Directory (AD) identities
Design Azure AD identities; Active Directory integration; Azure Multi-Factor Authentication; user self-service from the Azure Access Panel; Azure AD reporting; company branding; design Azure AD Premium features, such as Cloud App discovery, group-based application access, self-service group management, advanced security reporting, and password reset with write-back
Design for Active Directory synchronization with Azure AD Connect
Design single sign-on, Active Directory Integration scenarios, and Active Directory synchronization tools; plan for Azure AD Synchronization Services; design for Connect Health

Design for device access and protection (15–20%)
Plan for device enrollment
Design device inventory, mobile device management authority, device management prerequisites, and device enrollment profiles
Plan for the Company Portal
Customize the Company Portal and company terms and conditions; design configuration policies, compliance policies, conditional access policies, Exchange ActiveSync policies, and policy conflicts
Plan protection for data on devices
Design for protection of data in email and SharePoint when accessing them from mobile devices, design for protection of data of applications by using encryption, design for full and selective wipes

Design for data access and protection (15–20%)
Plan shared resources
Design for file and disk encryption and BitLocker encryption; design for the Network Unlock feature; configure BitLocker policies; design for the Encrypting File System (EFS) recovery agent; manage EFS and BitLocker certificates, including backup and restore
Plan advanced audit policies
Design for auditing using Group Policy and AuditPol.exe, create expression-based audit policies, design for removable device audit policies
Plan for file and folder access
Design for Windows Server Dynamic Access Control, Web Application Proxy, and Azure Rights Management service (RMS)

Design for remote access (15–20%)
Plan for remote connectivity
Design remote authentication, configure Remote Desktop settings, design VPN connections and authentication, enable VPN reconnect, configure broadband tethering
Plan for mobility options
Design for offline file policies, power policies, Windows to Go, sync options, and Wi-Fi direct

Plan for apps (15–20%)
Manage RemoteApp
Design RemoteApp and Desktop Connections settings, configure Group Policy Objects (GPOs) for signed packages, subscribe to the Azure RemoteApp and Desktop Connections feeds, export and import Azure RemoteApp configurations, support iOS and Android, configure Remote Desktop Web Access for Azure RemoteApp distribution
Plan app support and compatibility
Design for desktop app compatibility using Application Compatibility Toolkit (ACT), including shims and compatibility database; design desktop application co-existence using Hyper-V, Azure RemoteApp, and App-V; install and configure User Experience Virtualization (UE-V); plan for desktop apps using Microsoft Intune

Plan updates and recovery (15–20%)
Plan for system recovery
Design for the recovery drive, system restore, refresh or recycle, driver rollback, and restore points
Plan file recovery
Design for previous versions of files and folders, design File History, recover files from OneDrive
Plan device updates
Design update settings and Windows Update policies, manage update history, roll back updates, design for Windows Store apps updates

Click here to view complete Q&A of 70-398 exam
Certkingdom Review

Best Microsoft MCTS Certification, Microsoft 70-398 Training at certkingdom.com

Exam Prep: 70-341 and 70-342 - MCSE: Messaging (Microsoft Exchange Server 2013)

Exam Prep: 70-341 and 70-342 - MCSE: Messaging (Microsoft Exchange Server 2013)

This Exam Prep session is designed for people experienced with Exchange Server 2013 and who are interested in taking the 70-341 (Core Solutions of Microsoft Exchange Server 2013) and 70-342 (Advanced Solutions of Microsoft Exchange Server 2013) exams. These exams are required for the new MCSE: Messaging certification. Attendees of this session can expect to review the topics covered in these exams in a fast-paced format, as well as receive some valuable test taking techniques. Attendees will leave with an understanding of how Microsoft certification works, the key topics covered in the exams, and an exhaustive look at resources for getting ready for the exam. The session is led by a Microsoft Certified Trainer (MCT), experienced in delivering sessions on these topics.

New book: Exam Ref 70-342 Advanced Solutions of Microsoft Exchange Server 2013
Prepare for Microsoft Exam 70-342—and demonstrate your real-world mastery of advanced Microsoft Exchange Server 2013 solution design, configuration, implementation, management, and support. Designed for experienced IT professionals ready to advance, Exam Ref focuses on critical-thinking and decision-making acumen needed for success at the MCSE level.

Focus on the expertise measured by these objectives:
· Configure, manage, and migrate Unified Messaging
· Design, configure, and manage site resiliency
· Design, configure, and manage advanced security
· Configure and manage compliance, archiving, and discovery solutions
· Implement and manage coexistence, hybrid scenarios, migration, and federation

This Microsoft Exam Ref:
· Organizes its coverage by exam objectives
· Features strategic, what-if scenarios to challenge you
· Provides exam preparation tips written by two Exchange Server MVPs
· Assumes you have at least three years of experience managing Exchange Servers and have responsibilities for an enterprise Exchange messaging environment

Skills measured
This exam measures your ability to accomplish the technical tasks listed below. The percentages indicate the relative weight of each major topic area on the exam. The higher the percentage, the more questions you are likely to see on that content area on the exam. View video tutorials about the variety of question types on Microsoft exams.

Please note that the questions may test on, but will not be limited to, the topics described in the bulleted text.
Do you have feedback about the relevance of the skills measured on this exam? Please send Microsoft your comments. All feedback will be reviewed and incorporated as appropriate while still maintaining the validity and reliability of the certification process. Note that Microsoft will not respond directly to your feedback. We appreciate your input in ensuring the quality of the Microsoft Certification program.

If you have concerns about specific questions on this exam, please submit an exam challenge.
If you have other questions or feedback about Microsoft Certification exams or about the certification program, registration, or promotions, please contact your Regional Service Center.

Starting July 2014, the questions on this exam include content covering Microsoft Exchange Server 2013 Service Pack 1.

Configure, manage, and migrate Unified Messaging (20%)
Configure Unified Messaging (UM)
Configure an IP gateway; configure a UM call router; create and configure an auto attendant; configure a call answering rule; design UM for high availability; create a dial plan
Manage Unified Messaging
Assign a dial plan to a user; move users between dial plans; enable and disable UM features for a user; set up protected voice mail; configure UM mailbox policy; manage UM language packs
Troubleshoot Unified Messaging
Troubleshoot and configure Mutual Transport Layer Security (MTLS); monitor calls and call statistics; troubleshoot and configure Quality of Service (QoS); troubleshoot SIP communication
Migrate Unified Messaging
Prepare to migrate; plan a migration strategy; plan a coexistence strategy; move UM mailboxes between sites; redirect the SIP gateway to Exchange; decommission the legacy system

Preparation resources
Deploy Exchange 2013 UM
Exchange Server 2013 and Unified Messaging - Part 1 - deploying and configuring
UM reports procedures

Design, configure, and manage site resiliency (22%)
Manage a site-resilient Database Availability Group (DAG)
Plan and implement Datacenter Activation Coordination (DAC); given customer node requirements, recommend quorum options; plan cross-site DAG configuration; configure DAG networks
Design, deploy, and manage a site-resilient CAS solution
Plan site-resilient namespaces; configure site-resilient namespace URLs; perform steps for site *over; plan certificate requirements for site failovers; predict client behavior during a *over
Design, deploy, and manage site resilience for transport
Configure MX records for failover scenarios; manage resubmission and reroute queues; plan and configure Send/Receive connectors for site resiliency; perform steps for transport *over
Troubleshoot site-resiliency issues
Resolve quorum issues; troubleshoot proxy redirection issues; troubleshoot client connectivity; troubleshoot mail flow; troubleshoot data center activation; troubleshoot DAG replication

Preparation resources
Microsoft Exchange Server 2013: Managing high availability and site resilience
Planning for high availability and site resilience
Database availability groups

Design, configure, and manage advanced security (21%)
Select an appropriate security strategy
Evaluate role-based access control (RBAC); evaluate BitLocker; evaluate smart cards; evaluate Information Rights Management (IRM); evaluate S/MIME; evaluate Domain Secure/TLS
Deploy and manage IRM with Active Directory Rights Management Services (AD RMS)
Create an AD RMS template; create transport protection rules; create Outlook protection rules; configure transport decryption; configure IRM for discovery; configure pre-licensing for client access
Configure and interpret mailbox and administrative auditing
Configure mailbox audit logging; configure administrative audit logging; configure mailbox access logging; interpret all audit logs
Troubleshoot security-related issues
Determine certificate validity; ensure proper Certificate Revocation List (CRL) access and placement; ensure private key availability; troubleshoot failed IRM protection; troubleshoot RBAC

Preparation resources
Information Rights Management
Mailbox audit logging

Configure and manage compliance, archiving, and discovery solutions (20%)
Configure and manage an archiving solution
Set up online archiving (Office 365); create archive policies; set up on-premises archiving; plan storage for an archiving solution
Design and configure Data Loss Prevention (DLP) solutions
Set up pre-built rules; set up custom rules; design a DLP solution to meet business requirements; set up custom policies
Configure and administer Message Records Management (MRM)
Design retention policies; configure retention policies; create and configure custom tags; assign policies to users; configure the Managed Folder Assistant; remove and delete tags
Perform eDiscovery
Plan and delegate RBAC roles for eDiscovery; enable a legal/litigation hold; perform a query-based InPlace hold; design and configure journaling; perform multi-mailbox searches in Exchange Administration Center (EAC); evaluate how to integrate InPlace federated searches with Microsoft SharePoint
Implement a compliance solution
Design and configure transport rules for ethical walls; configure MailTips; create, configure, and deploy message classifications; design and configure transport rules to meet specified compliance requirements

Preparation resources
Exchange Server 2013: Archive with elegance
Microsoft Exchange Server 2013 data loss prevention
Messaging records management

Implement and manage coexistence, hybrid scenarios, migration, and federation (18%)
Establish coexistence with Exchange Online
Deploy and manage hybrid configuration; evaluate limitations of the Hybrid Configuration Wizard; configure requirements for single sign-on (SSO); design and configure Active Directory Federation Services (ADFS)
Deploy and manage Exchange federation
Manage federation trusts with Microsoft federation gateways; manage hybrid deployment OAuth-based authentication; manage sharing policies; design certificate and firewall requirements; manage organization relationships
Implement on-premises coexistence with legacy systems
Plan namespaces for coexistence; configure proxy redirect; plan firewall configuration for coexistence; plan for mail flow requirements
Set up a cross-forest coexistence solution
Set up cross-forest availability; design certificate and firewall requirements; set up cross-forest mail flow; design and configure AutoDiscover; set up shared namespaces
Migrate legacy systems
Determine transition paths to Exchange; migrate public folders; migrate mailboxes; upgrade policies; plan to account for discontinued features; transition and decommission server roles
Troubleshoot issues associated with hybrid scenarios, coexistence, migration, and federation
Troubleshoot transport; troubleshoot Exchange federation trust and organization relationships; troubleshoot client access; troubleshoot SSO/AD FS; troubleshoot DirSync; troubleshoot cross-forest availability

Preparation resources
Exchange Server 2013 hybrid deployments
Configure the Availability service for cross-forest topologies
Public Folder procedures

Click here to view complete Q&A of 70-341 exam
Certkingdom Review

Best Microsoft MCTS Certification, Microsoft 70-342 Training at certkingdom.com