Microsoft 70-744 Online Practice Questions and Exam Preparation

Microsoft 70-744 Online Questions & Answers

• Question 191:

  Your network contains an internal network and a perimeter network. The internal network contains an Active Directory forest named contoso.com.

  You deploy five servers to the perimeter network.

  All of the servers run Windows Server 2016 and are the members of a workgroup.

  You need to apply a security baseline named Perimeter.inf to the servers in the perimeter network.

  What should you use to apply Perimeter.inf?

  A. Local Computer Policy
  B. Security Configuration Wizard (SCW)
  C. Group Policy Management
  D. Server Manager
  A. Local Computer Policy

  ---

  https://docs.microsoft.com/en-us/windows-server/get-started/deprecated-features https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/ https://msdn.microsoft.com/en-us/library/ bb742512.aspx

  

• Question 192:

  Your network contains an Active Directory domain named contoso.com.

  The domain contains a computer named Computer1 that runs Windows 10.

  Computer1 connects to a home network and a corporate network.

  The corporate network uses the 172.16.0.0/24 address space internally.

  Computer1 runs an application named App1 that listens to port 8080.

  You need to ensure that App1.exe can accept connections only when Computer1 is connected to the corporate network.

  Solution: You run the command New-NetFirewallRule -DisplayName "Rule1" -Direction Inbound -Program "D:\\Apps\\App1.exe" -Action Allow -Profile Domain

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Tested correct cmdlet, worked, and the profile "Domain" for corporate network is also correct.

  

• Question 193:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this sections, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a file server that runs Windows Server 2016. The file server contains the volumes configured as shown in the following table.

  

  You need to encrypt DevFiles by using BitLocker Drive Encryption (ButLocker).

  Solution: You run the Lock-BitLocker cmdlet.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  References: https://docs.microsoft.com/en-us/powershell/module/bitlocker/lock-bitlocker?view=win10-ps

• Question 194:

  HOTSPOT

  Your network contains an Active Directory domain named adatum.com. The domain contains a server named SAerver1 that runs Windows Server 2016 and a group named Group1. A user named user1 is the only member of Group1.

  You plan to implement Just Enough Administration (JEA) on Server1.

  You create a role capacity file that contains the following content.

  

  You create a session configuration that contains the following content.

  

  You register a JEA endpoint by using the- Name Role1 parameter.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  

  ---

  https://blogs.technet.microsoft.com/privatecloud/2014/05/14/just-enough-administration-step-by-step/ https://docs.microsoft.com/en-us/powershell/jea/using-jea https://docs.microsoft.com/en-us/powershell/jea/role-capabilities

• Question 195:

  Your network contains an Active Directory domain named contoso.com. All servers in the domain run Windows Server 2016.All client computers run Windows 10.

  Your company has deployed the Local Administrator Password Solution (LAPS).

  Client computers in the finance department are located in an organizational unit (OU) named Finance. Each finance computer has a custom administrative account named FinAdmin.

  You discover that the FinAdmin accounts are not managed by LAPS.

  You need to ensure that the FinAdmin accounts are managed by LAPS. What should you do?

  A. On the finance computers, register the AdmPwd.ps Windows PowerShell module and then run the ResetAdmPwdPassword cmdlet
  B. Modify the Password Policy in a Group Policy object (GPO).
  C. Modify the LAPS settings in a Group Policy object (GPO).
  D. On the finance computers. rename the FinAdmin accounts to Administrator.
  C. Modify the LAPS settings in a Group Policy object (GPO).

  ---

  Use the GPO Setting "Name of administrator account to manage" for LAPS to manage secondary administrative accounts which is not named as "Administrator"

  

• Question 196:

  The network contains an Active Directory domain named constoso.com. The domain contains the servers configured as shown in the following table.

  

  All servers run Windows Server 2016. All client computers run Windows 10 and are domain members.

  All laptops are protected by using BitLocker Drive Encryption (BitLocker).You have an organizational unit (OU) named OU1 that contains the computer accounts of application servers.

  An OU named OU2 contains the computer accounts of the computers in the marketing department.

  A Group Policy object (GPO) named GP1 is linked to OU1.

  A GPO named GP2 is linked to OU2.

  All computers receive updates from Server1.

  You create an update rule named Update1.

  You need to implement BitLocker Network Unlock for all of the laptops.

  Which server role should you deploy to the network?

  A. Network Controller
  B. Windows Deployment Services
  C. Host Guardian Service
  D. Device Heath Attestation
  B. Windows Deployment Services

  ---

  https://docs.microsoft.com/en-us/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock Network Unlock core requirementsNetwork Unlock must meet mandatory hardware and software requirements before the feature canautomatically unlock domain joined systems. Theserequirements include: You must be running at least Windows 8 or Windows Server 2012.Any supported operating system with UEFI DHCP drivers can be Network Unlock clients.A server running the Windows Deployment Services (WDS) role on any supported server operatingsystem.BitLocker Network Unlock optional feature installed on any supported server operating system.A DHCP server, separate from the WDS server.Properly configured public/private key pairing.Network Unlock Group Policy settings configured.

• Question 197:

  Your network contains an Active Directory domain named contoso.com.

  You are deploying Microsoft Advanced Threat Analytics (ATA).

  You create a user named User1.

  You need to configure the user account of User1 as a Honeytoken account.

  Which information must you use to configure the Honeytoken account?

  A. the SAM account name of User1
  B. the Globally Unique Identifier (GUID) of User1
  C. the SID of User1
  D. the UPN of User1
  C. the SID of User1

  ---

  https://docs.microsoft.com/en-us/advanced-threat-analytics/ata-prerequisitesA user account of a user who has no network activities.This account is configured as the ATA Honeytoken user.To configure the Honeytoken user you need the SID of the user account, not the username.

  

  https://docs.microsoft.com/en-us/advanced-threat-analytics/install-ata-step7ATA also enables the configuration of a Honeytoken user, which is used as a trap for malicious actors ?anyauthentication associated with this (normally dormant) account will trigger an alert.

• Question 198:

  Your network contains an Active Directory forest that contains 20 domain controllers. All the domain controllers run as virtual machines on Hyper-V hosts.

  A corporate security policy prohibits the installation of software on the domain controllers.

  You deploy Advanced Threat Analytics (ATA) and the ATA Gateway.

  You need to collect data from the domain controllers by using ATA.

  What should you do?

  A. Run winrm /quickconfig on the domain controllers
  B. Configure port mirroring on the virtual switches
  C. Configure the User Rights Assignment security policy settings on the domain controller
  D. Configure Windows Event Forwarding on the Hyper-V hosts
  D. Configure Windows Event Forwarding on the Hyper-V hosts

  ---

  To enhance detection capabilities, ATA needs the following Windows events: 4776, 4732, 4733, 4728, 4729, 4756, 4757, 7045. These can either be read automatically by the ATA Lightweight Gateway or it can be forwarded to the ATA Gateway by configuring Windows Event Forwarding.

  References: https://docs.microsoft.com/en-us/advanced-threat-analytics/configure-event-collection

• Question 199:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory forest named contoso.com. All servers run Windows Server 2016. The forest contains 2,000 client computers that run Windows 10. All client computers are deployed from a customized Windows

  image.

  You need to deploy 10 Privileged Access Workstations (PAWs). The solution must ensure that administrators can access several client applications used by all users.

  Solution: You deploy one physical computer and configure it as a Hyper-V host that runs Windows Server 2016. You create 10 virtual machines and configure each one as a PAW.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  References: https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/privileged-access-workstations

• Question 200:

  You have a guarded fabric and a Host Guardian Service server named HGS1.

  You deploy a Hyper-V host named Hyper1, and configure Hyper1 as part of the guarded fabric. You plan to deploy the first shielded virtual machine. You need to ensure that you can run the virtual machine on Hyper1.

  What should you do?

  A. On Hyper1, run the Invoke-WebRequest cmdlet, and then run the Import-HgsGuardian cmdlet.
  B. On HGS1, run the Invoke-WebRequest cmdlet, and then run the Import-HgsGuardian cmdlet.
  C. On Hyper1, run the Export-HgsKeyProtectionState cmdlet, and then run the Import-HgsGuardian cmdlet.
  D. On HGS1, run the Export-HgsKeyProtectionState cmdlet, and then run the Import-HgsGuardian cmdlet
  A. On Hyper1, run the Invoke-WebRequest cmdlet, and then run the Import-HgsGuardian cmdlet.

  ---

  https://blogs.technet.microsoft.com/datacentersecurity/2016/06/06/step-by-step-creating-shielded-vms-withoutvmm/ The first step is to get the HGS guardian metadata from the HGS server, and use it to create the Key protector. To do this, run the following PowerShell commandon a guarded host or any machine that can reach the HGS server:Invoke-WebRequest http://FQDN> /KeyProtection/service/metadata/2014-07/metadata.xml utFile C:\ \HGSGuardian.xmlShield the VMEach shielded VM has a Key Protector which contains one owner guardian, and one or more HGS guardians.The steps below illustrate the process of getting the guardians, create the Key Protector in order to shield theVM. Run the following cmdlets on a tenant host "Hyper1":# SVM is the VM name which to be shielded$VMName = `SVM'# Turn off the VM first. You can only shield a VM when it is powered offStop-VM MName $VMName# Create an owner self-signed certificate$Owner = New-HgsGuardian ame `Owner' enerateCertificates# Import the HGS guardian$Guardian = Import-HgsGuardian -Path `C:\\HGSGuardian.xml' -Name `TestFabric' llowUntrustedRoot# Create a Key Protector, which defines which fabric is allowed to run this shielded VM$KP = New-HgsKeyProtector -Owner $Owner -Guardian $Guardian -AllowUntrustedRoot# Enable shielding on the VMSet-VMKeyProtector MName $VMName eyProtector $KP.RawData# Set the security policy of the VM to be shieldedSet-VMSecurityPolicy -VMName $VMName -Shielded $true# Enable vTPM on the VMEnable-VMTPM -VMName $VMName