Microsoft 70-744 Online Practice Questions and Exam Preparation

Microsoft 70-744 Online Questions & Answers

• Question 91:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this sections, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You deploy Windows Server 2016 to a server named Server1.

  You need to ensure that you can run Windows Containers on Server1.

  Solution: On Server1, you enable the Containers feature, and then you install the PowerShell for Docker module. You restart the server.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  https://docs.microsoft.com/en-us/virtualization/windowscontainers/deploy-containers/deploy-containers-on-server

• Question 92:

  _____ enables easier management for BitLocker enabled desktops and servers in a domain environment by providing automatic unlock of operating system volumes at system reboot when connected to a wired corporate network. This feature requires the client hardware to have a DHCP driver implemented in its UEFI firmware.

  A. Network Unlock
  B. EFS recovery agent
  C. JEA
  D. Credential Guard
  A. Network Unlock

  ---

  https://docs.microsoft.com/en-us/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock

• Question 93:

  Your network contains an Active Directory domain named contoso.com.

  You implement Local Administrator Password Solution (LAPS) on a member sever named Server1.

  You need to retrieve the password of the local Administrator of Server1.

  What should you do?

  A. From Active Directory Administrative Center, view the content of the Password Settings Container.
  B. Run the Get-ADComputerServiceAccount cmdlet
  C. Run the Get-ADComputer cmdlet.
  D. From Active Directory Administrative Center, view the attributes of the computer object of Server1.
  A. From Active Directory Administrative Center, view the content of the Password Settings Container.

• Question 94:

  You configure Just Enough Administration (JEA).

  You need to ensure that a non-administrator user can perform the following actions:

  -Restart Internet Information Services (IIS)

  -Restart a custom service named Service1.

  How should you complete the role configuration file? To answer, select the appropriate options in the answer area.

  Select and Place:

  

  

  ---

  VisibleExternalCommands = `C:\\Windows\\system32\\iisreset.exe'

  VisibleCmdlets = @{ Name `Restart-service' ; Parameters @{ Name = `Name'; ValidateSet = `Service1'}}

  https://docs.microsoft.com/en-us/powershell/jea/role-capabilities

  

• Question 95:

  Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is

  exactly the same in each question in this series.

  Start of repeated scenario.

  Your company has a marketing department.

  The network contains an Active Directory domain named constoso.com. The domain contains the servers configured as shown in the following table.

  

  All servers run Windows Server 2016. All client computers run Windows 10 and are domain members. All laptops are protected by using BitLocker Drive Encryption (BitLocker).

  You have an organizational unit (OU) named OU1 that contains the computer accounts of application servers.

  An OU named OU2 contains the computer accounts of the computers in the marketing department.

  A Group Policy object (GPO) named GP1 is linked to OU1.

  A GPO named GP2 is linked to OU2.

  All computers receive updates from Server1.

  You create an update rule named Update1.

  You need to prepare the environment to support applying Update1 to the laptops only.

  What should you do? Choose Two.

  A. Tool to use: Active Directory Administrative Center
  B. Tool to use: Active Directory Users and Computers
  C. Tool to use: Microsoft Intune
  D. Tool to use: Update Services
  E. Type of object to create: A computer group
  F. Type of object to create: A distribution group
  G. Type of object to create: A mobile device group
  H. Type of object to create: A security group
  I. Type of object to create: An OU
  D. Tool to use: Update Services
  E. Type of object to create: A computer group

  ---

  https://technet.microsoft.com/en-us/library/cc708458(v=ws.10).aspx

• Question 96:

  You have a server named Server1.

  You need to configure PowerShell logging to capture dynamic code generation. The solution must minimize the number of events that are logged.

  What should you configure?

  A. protected event logging
  B. script block logging
  C. module logging
  D. system-wide transcription
  C. module logging

  ---

  References: https://www.rootusers.com/enable-and-configure-module-script-block-and-transcription-logging-in-windows-powershell/

• Question 97:

  Your data center contains 10 Hyper-V hosts that host 100 virtual machines.

  You plan to secure access to the virtual machines by using the Datacenter Firewall service.

  You have four servers available for the Datacenter Firewall service. The servers are configured as shown in the following table.

  

  You need to install the required server roles for the planned deployment

  Which server role should you deploy? Choose Two.

  A. Server role to deploy: Multipoint Services
  B. Server role to deploy: Network Controller
  C. Server role to deploy: Network Policy and Access Services
  D. Servers on which to deploy the server role: Server20 and Server21
  E. Servers on which to deploy the server role: Server22 and Server23
  B. Server role to deploy: Network Controller
  E. Servers on which to deploy the server role: Server22 and Server23

  ---

  Datacenter Firewall is a new service included with Windows Server 2016. It is a network layer, 5-tuple (protocol,source and destination port numbers, source anddestination IP addresses), stateful, multitenant firewall. When deployed and offered as a service by the serviceprovider, tenant administrators can install and configure firewall policies to help protect their virtual networks from unwanted traffic originating from Internetand intranet networks. https://docs.microsoft.com/ en-us/windows-server/networking/sdn/technologies/network-controller/networkcontroller Network Controller FeaturesThe following Network Controller features allow you to configure and manage virtual and physical networkdevices and services.i) Firewall Management (Datacenter Firewall)ii) Software Load Balancer Managementiii) Virtual Network Managementiv) RAS Gateway Management

  

  https://docs.microsoft.com/en-us/windows-server/networking/sdn/plan/installation-and-preparationrequirements-for-deploying-network-controller Installation requirementsFollowing are the installation requirements for Network Controller.For Windows Server 2016 deployments, you can deploy Network Controller on one or more computers, one ormore VMs, or a combination of computers and VMs.All VMs and computers planned as Network Controller nodes must be running Windows Server 2016Datacenter edition.

• Question 98:

  Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2. The domain has Dynamic Access Control enabled.

  Server1 contains a folder named C:\Folder1. Folder1 is shared as Share1.

  You need to audit all access to the contents of Folder1 from Server2. The solution must minimize the number of event log entries.

  Which two audit policies should you enable on Server1? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Global Object Access- File System
  B. Object Access ?Audit Detailed File Share
  C. Object Access ?Audit Other Object Access Events
  D. Object Access ?Audit File System
  E. Object Access ?Audit File Share
  B. Object Access ?Audit Detailed File Share
  E. Object Access ?Audit File Share

  ---

  References: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-detailed-file-share https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-share

• Question 99:

  Your network contains an Active Directory domain.

  The domain contains two organizational units (OUs) named ProdOU and TestOU.

  All production servers are in ProdOU. All test servers are in TestOU. A server named Server1 is in TestOU.

  You have a Windows Server Update Services (WSUS) server named WSUS1 that runs Windows Server 2016.

  All servers receive updates from WSUS1.

  WSUS is configured to approve updates for computers in the Test computer group automatically.

  Manual approval is required for updates to the computers in the Production computer group.

  You move Server1 to ProdOU, and you discover that updates continue to be approved and installed automatically on Server1.

  You need to ensure that all the servers in ProdOU only receive updates that are approved manually.

  What should you do?

  A. Turn off auto-restart for updates during active hours by using Group Policy objects (GPOs).
  B. Configure client-side targeting by using Group Policy objects (GPOs).
  C. Create computer groups by using the Update Services console.
  D. Run wuauclt.exe /detectnow on each server after the server is moved to a different OU.
  B. Configure client-side targeting by using Group Policy objects (GPOs).

  ---

  Updates in WSUS are approved against "Computer Group" , not AD OUs.For this example, to prevent Server1 to install automatically approved updates,you have to remove Server1 from "Test" computer group and add Server1 into "Production" computer group inWSUS console, manually or use the WSUS GPO Client-Side Targeting feature. https://technet.microsoft.com/en-us/library/cc720450%28v=ws.10%29.aspx?f=255and MSPPError=-2147217396With client-side targeting, you enable client-computers to add themselves to the computer groups you create inthe WSUS console.You can enable client-side targeting through Group Policy (in an Active Directory network environment) or byediting registry entries (in a non-Active Directorynetwork environment) for the client computers.When the WSUS client computers connect to the WSUS server, they will add themselves into thecorrect computer group.Client-side targeting is an excellent option if you have many client computers and want to automate the processof assigning them to computer groups.First, configure WSUS to allow Client Site Targeting.

  

  Secondly, configure GPO to affect "ProdOU" , so that Server1 add itself to "Production" computer group. https://prajwaldesai.com/how-to-configure-client-side-targeting-in-wsus

  

• Question 100:

  Windows Firewall rules can be configured using PowerShell.

  The "Set-NetFirewallProfile" cmdlet configures settings that apply to the per-profile configurations of the Windows Firewall with Advanced Security.

  What is the default setting for the AllowInboundRules parameter when managing a GPO?

  A. FALSE
  B. NotConfigured
  B. NotConfigured

  ---

  The default setting when managing a computer is True. When managing a GPO, the default setting is NotConfigured. The NotConfigured value is only valid when configuring a Group Policy Object (GPO). This parameter removes the setting from the GPO, which results in the policy not changing the value on the computer when the policy is applied.