Microsoft 70-697 Online Practice Questions and Exam Preparation

Microsoft 70-697 Online Questions & Answers

• Question 131:

  You have Windows 10 Enterprise computers.

  Microsoft BitLocker Administration and Monitoring (MBAM) is deployed on your network on a server named MBAM1.

  Company policy requires that within 2 hours of being started, computers that have the MBAM client installed prompt users to enable BitLocker.

  You need to make changes to the Configure MBAM Services Group Policy settings.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Set Select Bitlocker Recovery Information to store to Recovery password and key package.
  B. Set Enter status reporting frequency (in minutes) to 120.
  C. Set MBAM Status reporting endpoint to MBAM1.
  D. Set Enter client checking status frequency (in minutes) to 120.
  E. Set Select Bitlocker Recovery Information to store to Recovery password only.
  F. Set MBAM Recovery and Hardware service endpoint to MBAM1.
  D. Set Enter client checking status frequency (in minutes) to 120.
  F. Set MBAM Recovery and Hardware service endpoint to MBAM1.

  ---

  References: http://www.projectleadership.net/blogs_details.php?id=3519

• Question 132:

  You have 100 Windows computers that are managed by using Microsoft Intune.

  You need to ensure that when a new critical update is released, the update is approved automatically and deployed to the computers within 24 hours of approval.

  What should you do from the Microsoft Intune administration portal?

  A. From the updates node, select Critical Updates, and then modify the Approval settings.
  B. From the Admin node, click Enrollment Rules, and then modify the device enrollment rules.
  C. From the Policy node, click Configuration Policies, and then create a new Windows policy.
  D. From the Policy node, click Compliance Policies, and then create a new compliance policy.
  A. From the updates node, select Critical Updates, and then modify the Approval settings.

  ---

  References: https://docs.microsoft.com/en-us/intune/deploy-use/keep-windows-pcs-up-to-date-with-software-updates-in-microsoft-intune

• Question 133:

  Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series.

  Information and details in a question apply only to that question.

  You need to change the password used for an L2TP VPN connection.

  Which Control Panel application should you use?

  A. Work Folders
  B. Phone and Modem
  C. Credential Manager
  D. Sync Center
  E. System
  F. Network and Sharing Center
  G. RemoteApp and Desktop Connections
  H. Power Options
  F. Network and Sharing Center

  ---

  References: https://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content/en-us/mvpn/l2tp/l2tp_vpn_client_win7_c.html

• Question 134:

  You are an IT consultant for small and mid-sized businesses.

  One of your clients wants to start using Virtual Smart Cards on its Windows 10 Enterprise laptops and tablets. Before implementing any changes, the client wants to ensure that the laptops and tablets support Virtual Smart Cards.

  You need to verify that the client laptops and tablets support Virtual Smart Cards.

  What should you do?

  A. Ensure that each laptop and tablet has a Trusted Platform Module (TPM) chip of version 1.2 or greater.
  B. Ensure that BitLocker Drive Encryption is enabled on a system drive of the laptops and tablets.
  C. Ensure that each laptop and tablet can read a physical smart card.
  D. Ensure that the laptops and tablets are running Windows 10 Enterprise edition.
  A. Ensure that each laptop and tablet has a Trusted Platform Module (TPM) chip of version 1.2 or greater.

  ---

  A Trusted Platform Module (TPM) chip of version 1.2 or greater is required to support Virtual Smart Cards.

  Virtual smart card technology from Microsoft offers comparable security benefits to physical smart cards by using two-factor authentication. Virtual smart cards emulate the functionality of physical smart cards, but they use the Trusted

  Platform Module (TPM) chip that is available on computers in many organizations, rather than requiring the use of a separate physical smart card and reader. Virtual smart cards are created in the TPM, where the keys that are used for

  authentication are stored in cryptographically secured hardware.

  References:

  https://technet.microsoft.com/en-GB/library/dn593708.aspx

• Question 135:

  You have a computer named Computer1 that runs Windows 10 Enterprise.

  You need to identify the locations that you can select as a File History drive.

  What are two possible locations? Each correct answer presents a complete solution?

  A. the operating system volume
  B. an unformatted partition
  C. a non-system volume
  D. a network share
  C. a non-system volume
  D. a network share

  ---

  You can use a non-system volume as a File History drive. This can be a volume on a hard drive in a computer, a Virtual Hard Drive (VHD) or an external USB drive.

  You can also use a network share as a File History drive.

  In the File History Control Panel item, you can click the "Select Drive" option. This will display a list of all detected drives that are suitable for use as the File History drive. Under the list of drives, there is a link "Add Network Location". You can

  click the link and browse to or enter the path to the network share.

  Incorrect Answers:

  A: You cannot use the operating system volume (usually the C: drive) as the File History drive.

  B: The volume used for the File History drive must be a formatted volume.

  References: http://computerbeginnersguides.com/blog/2015/08/23/enable-file-history-backups-in-windows-10/

• Question 136:

  A company is setting up a new branch office. You deploy 10 new Windows 10 Enterprise 64-bit client computers in the branch office.

  The computers cannot connect to the Internet. You run the ipconfig command on one computer. The following output depicts a portion of the results.

  

  You need to ensure that the computers can connect to the Internet. What should you do?

  A. Deploy a Windows Internet Name Service (WINS) server. Configure all computers to use WINS
  B. Deploy a Domain Name System (DNS) server. Configure all computers to use DNS
  C. Deploy an Internet Information Services (IIS) server. Configure all computers to use IIS
  D. Deploy a Dynamic Host Configuration Protocol (DHCP) server. Configure all computers to use DHCP
  D. Deploy a Dynamic Host Configuration Protocol (DHCP) server. Configure all computers to use DHCP

  ---

  References: https://docs.microsoft.com/en-us/windows-server/networking/technologies/dhcp/dhcp-deploy-wps

• Question 137:

  Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series.

  Information and details provided in a question apply only to that question.

  You have an application named App1 installed on a computer named Computer1. Computer1 runs Windows 10. App1 saves data to %UserProfile%\App1\Data.

  You need to ensure that you can recover the App1 data if Computer1 fails.

  What should you configure?

  A. share permissions
  B. application control policies
  C. Encrypting File System (EFS) settings
  D. NTFS permissions
  E. HomeGroup settings
  F. Microsoft OneDrive
  G. software restriction policies
  H. account policies
  F. Microsoft OneDrive

• Question 138:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a corporate network. All servers run Windows Server 2016. All servers and client devices are joined to an Active Directory Domain Services (AD DS) domain named adatum.com. The use of VPN servers on the network is strictly

  prohibited.

  Users must be able to access the corporate network in addition to Work Folders when they work at home on Windows 10 devices. You install, configure, and publish the certificate revocation list (CRL) for an internal Active Directory Certificate Services (AD CS) server.

  You need to configure the environment to allow your users to register devices.

  Solution: You create a DNS CNAME record of enterpriseregistration.adatum.com. You deploy Active Directory Federation Services (AD FS) and point the DNS record to your AD FS server. You deploy a Web Application Proxy server for the

  clients to connect to establish Internet connectivity to the device registration connection.

  Does the solution meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  References: https://blog.nextxpert.com/2013/11/27/publishing-work-folders-with-web-application-proxy-2/

• Question 139:

  A company has an Active Directory Domain Services (AD DS) domain with one physical domain controller. All client computers run Windows 10 Enterprise.

  A client computer hosts a Windows 10 Enterprise virtual machine (VM) test environment. The VMs are connected to a private virtual switch that is configured as shown in the Virtual Switch Manager exhibit.

  

  You have the following requirements:

  Configure the test environment to allow VMs to communicate with the host machine.

  Minimize impact on the host machine.

  You need to meet the requirements.

  What should you do first?

  A. Change the VLAN ID of the private virtual switch to Enable Virtual LAN identification.
  B. Create a new virtual switch with a Private Network connection type.
  C. Create a new virtual switch with an External Network connection type.
  D. Create a new virtual switch with an Internal Network connection type.
  D. Create a new virtual switch with an Internal Network connection type.

  ---

  Virtual switches/ Hyper-V VLAN - you can create 3 different types of virtual switches depending the needs of your virtual machines and one single machine can use multiple virtual NICs that is member of different Virtual Switches. External This virtual switch binds to the physical network adapter and create a new adapter you can see in Control Panel\Network and Internet\Network Connections so if a virtual machine needs contact outside the host machine this one is a must.

  Internal - This virtual switch can be used to connect all virtual machines and the host machine but cannot go outside that.

  Private - This virtual switch can only be used by the virtual host

  

  Configuring Virtual Networks Private will not allow communication with the host machine. External will allow communication with the host machine but also allow access to other machines on the host machine's network which is not a requirement.

  References: http://john.bryntze.net/jbkb-v2/certification-exam-70-687-configuring-windows-8-part-2-configure-hardware-and-applications-16/

• Question 140:

  You are a system administrator for a department that has Windows 10 Enterprise computers in a domain configuration.

  You deploy an application to all computers in the domain.

  You need to use group policy to restrict certain groups from running the application.

  What should you do?

  A. Set up DirectAccess.
  B. Configure AppLocker.
  C. Disable BitLocker.
  D. Run the User State Management Tool.
  B. Configure AppLocker.

  ---

  AppLocker is a feature in Windows Server 2012, Windows Server 2008 R2, Windows 8, and Windows 7 that advances the functionality of the Software Restriction Policies feature. AppLocker contains new capabilities and extensions that reduce administrative overhead and help administrators control how users can access and use files, such as executable files, scripts, Windows Installer files, and DLLs. AppLocker rules can be applied to security groups. We can use a group policy to apply AppLocker rules to the security groups to prevent them from running the application.

  References: https://technet.microsoft.com/en-us/library/ee619725(v=ws.10).aspx#BKMK_WhatRruleConditions