Microsoft 70-744 Online Practice Questions and Exam Preparation

Microsoft 70-744 Online Questions & Answers

• Question 161:

  Your network contains two Active Directory forests named adatum.com and priv.adatum.com.

  You deploy Microsoft Identity Manager (MIM) 2016 to the priv.adatum.com domain, and you implement Privileged Access Management (PAM).

  You create a PAM role named Group1 as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  Hot Area:

  

  

  ---

  References:https://tlktechidentitythoughts.wordpress.com/2016/09/07/mim-2016-setting-up-privileged-access-management-pam-in-an-existing-domain-using-the-built-in-pam-tool/

• Question 162:

  You have a server named Server1 that runs Windows Server 2016. You need to identity whether any connection security rules are configured on Server1.

  Which cmdlet should you use?

  A. Get-NetIPSecRule
  B. Get-NetFirewallRule
  C. Get-NetFirewallProfile
  D. Get-NetFirewallSetting
  E. Get-NetFirewallPortFilter
  F. Get-NetFirewallAddressFilter
  G. Get-NetFirewallSecurityFilter
  H. Get-NetFirewallApplicationFilter
  A. Get-NetIPSecRule

  ---

  https://technet.microsoft.com/en-us/itpro/powershell/windows/netsecurity/get-netipsecrule Get-NetIPSecRule displays the existence and details of Connection Security Rules, as connection securityrules implements IPsec between computers (not usingtunnel endpoints) or sites (using tunnel endpoints)

• Question 163:

  Encryption-supported VMs are intended for use where the fabric administrators are fully trusted.

  For example, an enterprise might deploy a guarded fabric in order to ensure VM disks are encrypted at-rest for compliance purposes.

  Shielded VMs are intended for use in fabrics where the data and state of the VM must be protected from both fabric administrators and untrusted software that might be running on the Hyper-V hosts.

  Is the Virtual Machine Connection (Console), HID devices (e.g. keyboard, mouse) ON or OFF for Encryption Supported VM's?

  A. Off
  B. On
  B. On

• Question 164:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a file server that runs Windows Server 2016. The file server contains the volumes configured as shown in the following table.

  

  You need to encrypt DevFiles by using BitLocker Drive Encryption (BitLocker). Solution: You run the manage-bde.exe command and specify the -lock parameter. Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  References: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-lock

• Question 165:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this sections, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain named contoso.com. The domain contains a computer named Computer1 that runs Windows10.

  The network uses the 172.16.0.0/16 address space.

  Computer1 has an application named App1.exe that is located in D:\Apps\. App1.exe is configured to accept connections on TCP port 8080.

  You need to ensure that App1.exe can accept connections only when Computer1 is connected to the corporate network.

  Solution: You run the New-NetFirewallRule -DisplayName "Rule1" -Direction Inbound -Program "D:\Apps\App1.exe" -Action Allow -Profile Domain command.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

• Question 166:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain named contoso.com. All client computers run Windows 10.

  You plan to deploy a Remote Desktop connection solution for the client computers.

  You have four available servers in the domain that can be configured as Remote Desktop servers. The servers are configured as shown in the following table.

  

  You need to ensure that all Remote Desktop connections can be protected by using Remote Credential Guard.

  Solution: You deploy the Remote Desktop connection solution by using Server2.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  References: https://docs.microsoft.com/en-us/windows/security/identity-protection/remote-credential-guard

• Question 167:

  Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series.

  Information and details provided in a question apply only to that question.

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016.

  Multiple resource properties are defined in the domain.

  Server1 has a volume named Volume1.

  You need to view the classification properties that have been configured on Volume1.

  Which tool should you use?

  A. File Explorer
  B. Shared Folders
  C. Server Manager
  D. Disk Management
  E. Storage Explorer
  F. Computer Management
  G. System Configuration
  H. File Server Resource Manager (FSRM)
  A. File Explorer

  ---

  References: https://blog.netwrix.com/2018/05/22/microsoft-file-classification-infrastructure-fci-explained/

• Question 168:

  Your network contains an Active Directory domain named contoso.com. All client computers run Windows 10.

  You plan to deploy a Remote Desktop connection solution for the client computers.

  You have four available servers in the domain that can be configured as Remote Desktop servers. The servers are configured as shown in the following table.

  

  You need to ensure that all Remote Desktop connections can be protected by using Remote Credential Guard.

  Solution: You deploy the Remote Desktop connection solution by using Server3.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes, since all client computers run Windows 10, and Server2 is Windows Server 2016 which fulfills the following requirements of using Remote Credential Guard. https://docs.microsoft.com/en-us/windows/access-protection/remote-credential-guardRemote Credential Guard requirementsTo use Windows Defender Remote Credential Guard, the Remote Desktop client and remote host must meetthe following requirements:The Remote Desktop client device:Must be running at least Windows 10, version 1703 to be able to supply credentials.Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user's signed-incredentials. This requires the user's account be able tosign in to both the client device and the remote host.Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal WindowsPlatform application doesn't support WindowsDefender Remote Credential Guard.Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domaincontroller, then RDP attempts to fall back to NTLM.Windows Defender Remote Credential Guard does not allow NTLM fallback because this would exposecredentials to risk.The Remote Desktop remote host:Must be running at least Windows 10, version 1607 or Windows Server 2016.Must allow Restricted Admin connections.Must allow the client's domain user to access Remote Desktop connections. Must allow delegation of non-exportable credentials

• Question 169:

  Your network contains an Active Directory domain named contoso.com. The domain contains 1,000 client computers that run Windows 10.

  A security audit reveals that the network recently experienced a Pass-the-Hash attack. The attack was initiated from a client computer and accessed Active Directory objects restricted to the members of the Domain Admins group.

  You need to minimize the impact of another successful Pass-the-Hash attack on the domain.

  What should you recommend?

  A. Move the computer accounts of the domain controllers to a new organizational unit (OU). Remove the permissions to the new OU from the Domain Admins group.
  B. Configure the Domain Admins groups as a restricted group.
  C. Remove all the members from the Domain Admins group, and then remove the Domain Admins group from all other groups.
  D. Instruct all administrators to use a restricted Remote Desktop connection when they sign in to a client computer
  B. Configure the Domain Admins groups as a restricted group.

  ---

  References: https://download.microsoft.com/download/7/7/a/77abc5bd-8320-41af-863c-6ecfb10cb4b9/mitigating%20pass-the-hash%20(pth)%20attacks%20and%20other%20credential%20theft%20techniques_english.pdf

• Question 170:

  Your network contains an Active Directory forest named contoso.com. The forest functional level is Windows Server 2012. The forest contains 20 member servers that are configured as file servers. All domain controllers run Windows Server

  2016.

  You create a new forest named contosoadmin.com.

  You need to use the Enhanced Security Administrative Environment (ESAE) approach for the administration of the resources in contoso.com.

  Which two actions should you perform? Each correct answer presents part of the solution.

  A. Configure contoso.com to trust contosoadmin.com.
  B. From the properties of the trust, enable selective authentication.
  C. Configure contosoadmin.com to trust contoso.com.
  D. From the properties of the trust, enable forest-wide authentication.
  E. Configure a two-way trust between both forests.
  A. Configure contoso.com to trust contosoadmin.com.
  B. From the properties of the trust, enable selective authentication.

  ---

  References: https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#esae-administrative-forest-design-approach