Microsoft 70-744 Online Practice Questions and Exam Preparation

Microsoft 70-744 Online Questions & Answers

• Question 201:

  Your network contains an Active Directory domain named contoso.com. The domain contains 100 servers.

  You deploy the Local Administrator Password Solution (LAPS) to the network.

  You discover that the members of a group named FinanceAdministrators can view the password of the local Administrator accounts on the servers in an organizational unit (OU) named FinanceServers.

  You need to prevent the FinanceAdministrators members from viewing the local administrators' passwords on the servers in FinanceServers.

  Which permission should you remove from FinanceAdministrators?

  A. List contents
  B. All extended rights
  C. Read all properties
  D. Read permissions
  B. All extended rights

  ---

  https://blogs.technet.microsoft.com/askpfeplat/2015/12/28/local-administrator-password-solution-lapsimplementation-hints-and-security-nerd-commentaryincludingmini-threat-model/ Access to the password is granted via the "Control Access" right on the attribute.Control Access is an "Extended Right" in Active Directory, which means if a user has been granted the "AllExtended Rights" permission they'll be able to seepasswords even if you didn't give them permission.

• Question 202:

  Your network contains an Active Directory domain named contoso.com.

  The functional level of the forest and the domain is Windows Server 2008 R2.

  

  All servers run Windows Server 2016. All client computers run Windows 10.

  You have an organizational unit (OU) named Marketing that contains the computers in the marketing department.

  You have an OU named Finance that contains the computers in the finance department.

  You have an OU named AppServers that contains application servers.

  A Group Policy object (GPO) named GP1 is linked to the Marketing OU. A GPO named GP2 is linked to the AppServers OU.

  You install Windows Defender on Nano1.

  You need to configure Nano1 as a Hyper-V Host. Which command should you run?

  A. Add-WindowsFeature Microsoft-NanoServer-Compute-Package
  B. Add-WindowsFeature Microsoft-NanoServer-Guest-Package
  C. Add-WindowsFeature Microsoft-NanoServer-Host-Package
  D. Add-WindowsFeature Microsoft-NanoServer-ShieldedVM-Package
  E. Install-Package Microsoft-NanoServer-Compute-Package
  F. Install-Package Microsoft-NanoServer-Guest-Package
  G. Install-Package Microsoft-NanoServer-Host-Package
  H. Install-Package Microsoft-NanoServer-ShieldedVM-Package
  I. Install-WindowsFeature Microsoft-NanoServer-Compute-Package
  J. Install-WindowsFeature Microsoft-NanoServer-Guest-Package
  E. Install-Package Microsoft-NanoServer-Compute-Package

  ---

  https://docs.microsoft.com/en-us/windows-server/get-started/deploy-nano-server#BKMK_onlineThe Nano Server package "Microsoft-NanoServer-Compute-Package" includes the Hyper-V role for a NanoServer host. Moreover, the Install-WindowsFeature or Add-WindowsFeature cmdlet are NOT available on a Nano Server.

• Question 203:

  Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series.

  Start of repeated scenario.

  Your company has a marketing department.

  The network contains an Active Directory domain named constoso.com. The domain contains the servers configured as shown in the following table.

  

  All servers run Windows Server 2016. All client computers run Windows 10 and are domain members. All laptops are protected by using BitLocker Drive Encryption (BitLocker).

  You have an organizational unit (OU) named OU1 that contains the computer accounts of application servers. An OU named OU2 contains the computer accounts of the computers in the marketing department. A Group Policy object (GPO)

  named GP1 is linked to OU1. A GPO named GP2 is linked to OU2.

  All computers receive updates from Server1. You create an update rule named Update1.

  End of repeated scenario.

  You need to ensure that you can encrypt the operating system drive of VM1 by using BitLocker.

  Which Group Policy should you configure?

  A. Configure use of hardware-based encryption for operating system drives
  B. Configure TPM platform validation profile for native UEFI firmware configurations
  C. Require additional authentication at startup
  D. Configure TPM platform validation profile for BIOS-based firmware configurations
  C. Require additional authentication at startup

  ---

  As there is not a choice "Enabling Virtual TPM for the virtual machine VM1", then we have to use a fall-back method for enabling BitLocker in VM1. https://www.howtogeek.com/howto/6229/how-to-use-bitlocker-on-drives-without-tpm/

  

• Question 204:

  Note: This question b part of a series of questions that use the same or simitar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series. Information and details provided in a question apply only to that question.

  Your network contains an Active Directory domain named contoso.com The domain contains a server named Server1 that runs Windows Server 2016.

  Server1 has a shared folder named Share1.

  You need to ensure that all access to Share1 uses SMB Encryption.

  Which tool should you use?

  A. File Explorer
  B. Shared Folders
  C. Server Manager
  D. Disk Management
  E. Storage Explorer
  F. Computer Management
  G. System Configuration
  H. File Server Resource Manager (FSRM)>
  C. Server Manager

  ---

  https://blogs.technet.microsoft.com/filecab/2012/05/03/smb-3-security-enhancements-in-windows-server-2012/

  

• Question 205:

  You have a Hyper-V host named Server1 that runs Windows Server 2016. Server1 hosts the virtual machines configured as shown in the following table.

  

  All the virtual machines have two volumes named C and D.

  You plan to implement BitLocker Drive Encryption (BitLocker) on the virtual machines.

  Which virtual machines can have their volumes protected by using BitLocker? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  

  ---

  https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v/deploy/upgrade-virtual-machine-version-in-hyper-v-on-windows-or-windows-server http://www.shulerent.com/2012/09/04/locking-down-a-virtual-machine-with-bitlocker/

• Question 206:

  You plan to use the Security and Audit solution in Microsoft Operations Management Suite (OMS) to monitor servers that run Windows Server 2016. The servers are prevented from accessing the Internet.

  You create an OMS workspace and add the Security and Audit solution.

  You need to ensure that you can monitor the servers.

  What should you do first?

  A. From Connected Sources, click Download OMS Gateway.
  B. From Accounts, modify the Azure Subscription and Data Plan setting.
  C. From Accounts, add an Automation Account.
  D. From Connected Sources, click Download Windows Agent (32 bit).
  B. From Accounts, modify the Azure Subscription and Data Plan setting.

• Question 207:

  HOTSPOT

  Your network contains several Windows container hosts.

  You plan to deploy three custom .NET applications.

  You need to recommend a deployment solution for the applications. Each application must:

  1. Be accessible by using a different IP address.

  2. Have access to a unique file system.

  3. Start as quickly as possible.

  What should you recommend? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

  ---

  Both Hyper-V container and Windows container could achieve, you'll need 3 containers to do so. Answer E is correct.-be accessible by using a different IP address.-have access to a unique file system.However, Hyper-V container starts 5 times or more slower than Windows container in our lab, on samecomputer.

  References:

  https://docs.microsoft.com/en-us/dotnet/standard/modernize-with-azure-and-containers/modernize-existing-apps-to-cloud-optimized/deploy-existing-net-apps-as-windows-containers

  https://blogs.msdn.microsoft.com/msgulfcommunity/2015/06/20/what-is-windows-server-containers-and-hyper-v-containers/

• Question 208:

  Your network contains an Active Directory domain named contoso.com.

  The domain contains four global groups named Group1, Group2, Group3, and Group4. A user named User1 is a member of Group3.

  You have an organizational unit (OU) named OU1 that contains computer accounts. A Group Policy object (GPO) named GPO1 is linked to OU1. OU1 contains a computer account named Computer1.

  GPO1 has the User Rights Assignment configured as shown in the following table.

  

  You need to ensure that User1 can access the shares on Computer1. What should you do?

  A. Modify the membership of Group3.
  B. Modify the membership of Group2.
  C. Modify the membership of Group1.
  D. Modify the membership of Group4.
  B. Modify the membership of Group2.

• Question 209:

  Your network contains an Active Directory domain named contoso.com. The domain contains a file server named FS1 that runs Windows Server 2016. FS1 has a share named SecureFolder.

  You need to track all users who access the contents of SecureFolder.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From the Default Domain Controller Group Policy object (GPO), enable Audit object access.
  B. From File Explorer, modify the Advanced security settings of SecureFolder.
  C. From File Explorer, modify the Advanced sharing settings of SecureFolder.
  D. Create a Group Policy object (GPO) and enable Audit object access.
  B. From File Explorer, modify the Advanced security settings of SecureFolder.
  D. Create a Group Policy object (GPO) and enable Audit object access.

  ---

  References: https://www.rootusers.com/configure-file-access-auditing-in-windows-server-2016/

• Question 210:

  You have a Hyper-V host named Server1 that hosts the virtual machines shown in the following table.

  

  You plan to encrypt the operating system drive on the virtual machines.

  On which virtual machines can you use a TPM protector for BitLocker Drive Encryption (BitLocker)?

  A. VM3 and VM4 only
  B. VM1, VM2, VM3, and VM4
  C. VM4 only
  D. VM2 and VM4 only
  A. VM3 and VM4 only

  ---

  Virtual TPM is only available in Generation 2 VMs.