Microsoft 70-688 Online Practice Questions and Exam Preparation

Microsoft 70-688 Online Questions & Answers

• Question 111:

  You administer client computers that run Windows 8 Enterprise deployed by using Windows Deployment Services (WDS). Your company recently purchased 25 new tablets that run Windows 8 Pro.

  For all 25 new tablets, you want to replace the existing Windows 8 Pro installation with Windows 8 Enterprise.

  You need to deploy the Windows 8 Enterprise image to all 25 tablets simultaneously by using the existing WDS infrastructure.

  What should you do?

  A. Start the tablets from the Windows To Go workspace.
  B. Start the tablets from a USB flash drive with a customized Windows Preinstallation Environment (WinPE).
  C. Start the tablets normally. Map the Windows Image (WIM) file from a WDS network share.
  D. Start the tablets from a customized Windows Recovery Environment (WinRE).
  B. Start the tablets from a USB flash drive with a customized Windows Preinstallation Environment (WinPE).

  ---

  Walkthrough: Create a Custom Windows PE Image To create a bootable UFD (USB Flash Drive) During a running Windows Vista operation system or a Windows PE session, insert your UFD device. At a command prompt, use Diskpart to

  format the device as FAT32 spanning the entire device, setting the partition to active. For example,

  diskpart

  select disk 1

  clean

  create partition primary size=

  select partition 1

  active

  format fs=fat32

  assign

  exit

  where the value of disk 1 is equal to UFD.

  On your technician computer, copy all the content in the \ISO directory to your UFD device. You can manually create the directory structure or use the xcopy command to automatically build and copy the appropriate files from your technician

  computer to your UFD device. For example,

  xcopy c:\winpe_x86\iso\*.* /s /e /f f:\

  where c is the letter of your technician computer hard disk and f is the letter of your UFD device.

  Reference:

  http://technet.microsoft.com/en-us/library/cc709665(v=ws.10).aspx

• Question 112:

  Your network contains an Active Directory domain named contoso.com.

  A user receives the following error message when attempting to sign in to a computer: "The trust relationship between this workstation and the primary domain failed."

  You need to ensure that the user can sign in to the computer by using a domain user account.

  Which tool should you use?

  A. Netcfg
  B. Netsh
  C. Netdom
  D. Netstat
  C. Netdom

  ---

  http://technet.microsoft.com/en-us/library/cc772217.aspx http://technet.microsoft.com/en-us/library/hh875638.aspx http://technet.microsoft.com/en-us/ library/bb490947.aspx

• Question 113:

  You administer a company network that includes computers that run Windows 8 Enterprise in an Active Directory domain. The company has purchased a subscription to Windows Intune.

  Corporate security policy requires that computers in the accounting department have file and program activity logged. A user in the accounting department uses a computer that is managed by Windows Intune.

  You need to ensure that file and program activity is always monitored on this computer.

  What should you do?

  A. Create a new Windows Firewall Setting policy in the Windows Intune Admin Console.
  B. In the Windows Intune Admin Console, create a new Windows Intune Agent Settings policy that uses the recommended settings.
  C. Create a new Windows Intune Mobile Security policy in the Windows Intune Admin Console.
  D. Create and deploy a custom policy in the Windows Intune Center Settings template.
  B. In the Windows Intune Admin Console, create a new Windows Intune Agent Settings policy that uses the recommended settings.

  ---

  Configure Your Windows Intune Environment

  Reference:

  http://technet.microsoft.com/en-us/library/hh441722.aspx To set up the default Windows Intune Policies:

  Open the Windows Intune administrator console.

  In the workspace shortcuts pane, click the Policy icon.

  Under Tasks, click Add Policy.

  In the Create a New Policy dialog box, the following policy templates are displayed in the list of templates in the left pane:

  Mobile Device Security Policy

  Windows Firewall Settings

  Windows Intune Agent Settings

  Windows Intune Center Settings

• Question 114:

  Your company has several Windows RT 8.1 devices. The devices connect to Exchange Online in Microsoft Office 365 and to Windows Intune for device management. The security policies of Office 365 and Windows Intune are configured as shown in the following table.

  

  You need to identify the effective settings on the Windows RT devices.

  What should you identify? (To answer, select the appropriate effective configuration for each setting in the answer area.)

  Hot Area:

  

  

  ---

  http://technet.microsoft.com/en-us/library/dn283963.aspx

• Question 115:

  You have the disk configuration shown in the following exhibit. (Click the Exhibit button.)

  

  To answer, complete each statement according to the information presented in the exhibit. Each correct selection is worth one point.

  Hot Area:

  

  

  ---

  http://technet.microsoft.com/en-us/library/cc737048%28v=WS.10%29.aspx New disks appear as Not Initialized. Before you can use a disk, you must first initialize it http://technet.microsoft.com/en-us/library/cc771486.aspx The Virtual Hard Disk (VHD) format is a publicly available image format specification that specifies a virtual hard disk encapsulated in a single file, capable of hosting native file systems while supporting standard disk and file operations. http://technet.microsoft.com/en-us/library/dd851645.aspx

• Question 116:

  You support Windows 8 desktop computers for a company named Contoso, Ltd. The computers are members of the Active Directory domain named contoso.com.

  Contoso works with a supplier named Fabrikam, Inc. Each company has a public key infrastructure (PKI), and no public certificate authorities (CAs) are used. The Fabrikam network includes a website that is accessible from the Contoso network. The website requires SSL and mutual authentication.

  You need to configure the computers to allow contoso.com domain users to access the website without any warning prompts. You also need to use the fewest certificates possible.

  Which certificate or certificates should you use? (To answer, drag the appropriate certificate to the correct certificate store. Each certificate may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.)

  Select and Place:

  

  

  ---

  Note:

  * Fabrikam.com provided the resources. contoso.com be the trusted root authorities store

  * No untrusted certificates

  * Not allow access to local computer account (just to user account)

  * user account access through client (user) certificate issued by Fabrikam http://technet.microsoft.com/en-us/library/cc754841.aspx http://technet.microsoft.com/en-us/library/cc753828.aspx

• Question 117:

  You support computers that run Windows 8 and are members of an Active Directory domain. Recently, several domain user accounts have been configured with super- mandatory user profiles.

  A user reports that she has lost all of her personal data after a computer restart.

  You need to configure the user's computer to prevent possible user data loss in the future.

  What should you do?

  A. Configure the user's documents library to include folders from network shares.
  B. Remove the .man extension from the user profile name.
  C. Add the .dat extension to the user profile name.
  D. Configure Folder Redirection by using the domain group policy.
  D. Configure Folder Redirection by using the domain group policy.

  ---

  A mandatory user profile is a special type of pre-configured roaming user profile that administrators can use to specify settings for users. With mandatory user profiles, a user can modify his or her desktop, but the changes are not saved when the user logs off. The next time the user logs on, the mandatory user profile created by the administrator is downloaded. There are two types of mandatory profiles: normal mandatory profiles and super-mandatory profiles. User profiles become mandatory profiles when the administrator renames the NTuser.dat file (the registry hive) on the server to NTuser.man. The .man extension causes the user profile to be a read-only profile.

  User profiles become super-mandatory when the folder name of the profile path ends in .man; for example, \\server\share\mandatoryprofile.man\. Super- mandatory user profiles are similar to normal mandatory profiles, with the exception that users who have super-mandatory profiles cannot log on when the server that stores the mandatory profile is unavailable. Users with normal mandatory profiles can log on with the locally cached copy of the mandatory profile. Only system administrators can make changes to mandatory user profiles.

  Reference:

  http://msdn.microsoft.com/en-us/library/windows/desktop/bb776895(v=vs.85).aspx

  http://technet.microsoft.com/en-us/windows/hh868022.aspx

• Question 118:

  You administer Windows 8.1 Pro computers. Your company uses credit card readers that require a custom driver supplied by the manufacturer. The readers frequently are moved from computer to computer.

  Your company recently purchased five new Windows 8.1 Pro computers. You want the required drivers to be installed automatically and silently when users connect the readers to the new computers.

  You need to pre-stage the credit card reader driver on the new computers.

  What should you do?

  A. Run the dism.exe utility. Copy the driver files to the C:\Windows\System32\drivers folder in the WIM image.
  B. Add a Registry key with a path to a network shared folder that has the driver installation files.
  C. Run the pnputil.exe utility. Specify the credit card reader driver.
  D. Add a Registry key with a path to a local folder on every computer. Copy the driver installation files to the folder.
  C. Run the pnputil.exe utility. Specify the credit card reader driver.

  ---

  Pnputil.exe is a command line utility that you can use to manage the driver store. You can use Pnputil to add driver packages, remove driver packages, and list driver packages that are in the store.

  To attempt to stage a package. At the command prompt running with elevated permissions, type the command (example):

  pnputil.exe -a toastpkg.inf

  Reference: Pnputil

  https://technet.microsoft.com/en-us/library/ff800798.aspx

• Question 119:

  You have a Windows 8.1 Enterprise client computer.

  The computer uses BitLocker Drive Encryption (BitLocker) on a fixed disk that only stores data.

  You need to prevent any data from being written to the fixed disk.

  What should you do?

  A. Run the manage-bde command and specify the -lock switch.
  B. Run the manage-bde command and specify the -pause switch.
  C. Run the manage-bde command and specify the -off switch.
  D. Run the manage-bde command and specify the -on switch.
  A. Run the manage-bde command and specify the -lock switch.

  ---

  -lock Locks a BitLocker-protected drive to prevent access to it unless the unlock key is provided.

  http://technet.microsoft.com/en-us/library/ff829864.aspx

  -pause Pauses BitLocker encryption or decryption. For examples of how this command can be used, http://technet.microsoft.com/en-us/library/ff829870.aspx -off Decrypts the drive and turns off BitLocker. All key protectors are removed when decryption is complete. http://technet.microsoft.com/en-us/library/ff829857.aspx -on Encrypts the drive and turns on BitLocker http://technet.microsoft.com/en-us/library/ff829873.aspx

• Question 120:

  You administer desktop computers that run Windows 8 Enterprise and are members of an Active Directory domain.

  A new security policy states that all traffic between computers in the research department must be encrypted and authenticated by using Kerberos V5.

  You need to configure the requested traffic authentication settings by using Windows Firewall with Advanced Settings.

  Which three actions should you perform in sequence? (To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.)

  Select and Place:

  

  

  ---

  Note:

  A connection security rule forces two peer computers to authenticate before they can establish a connection and to secure information transmitted between the two computers. Windows Firewall with Advanced Security uses IPsec to enforce these rules.

  To create a connection security rule

  1. In Windows Firewall with Advanced Security, in the console tree, click Connection Security Rules.

  2. In the Actions list, click New Rule.

  The Rule Type page, shown in the Figure below, allows you to select the type of rule you want to create. Select a type, and use the wizard to configure the new rule according to the information

  in the following sections.

  

  Isolation An isolation rule isolates computers by restricting inbound connections based on credentials, such as domain membership or compliance with policies that define the required software and system configurations. Isolation rules allow you to implement a server or domain isolation strategy. When you create an isolation rule, you will see the following wizard pages:

  * Requirements. You can choose when authentication is required:

  /Request authentication for inbound and outbound connections

  /Require authentication for inbound connections and request authentication for outbound connections

  /Require authentication for inbound and outbound connections

  *Authentication Method. You can select from the following authentication methods:

  Default. This selection uses the current computer default selections specified on the IPsec Settings tab of the Windows Firewall Properties page.

  Computer and user (Kerberos V5). This method uses both computer- and user-based Kerberos V5 authentication to restrict connections to domain-joined users and computers. User authentication, and therefore this method, is compatible only with computers running Windows Vista and later.

  Computer (Kerberos V5). This method uses Kerberos V5 authentication to restrict connections to domain-joined computers. This method is compatible with computers running Windows 2000 or later.

  Advanced. This setting allows you to designate multiple authentication methods, such as computer certificate, NTLMv2, and preshared key.

  * Profile. Choose the profiles (Domain, Public, and Private) to which the rule applies.

  * Name. Name the rule and type an optional description.

  Reference: Creating Connection Security Rules

  http://technet.microsoft.com/en-us/library/cc772017.aspx