Microsoft 70-744 Online Practice Questions and Exam Preparation

Microsoft 70-744 Online Questions & Answers

• Question 211:

  Your network contains an Active Directory domain named contoso.com. The domain contains a DNS server named Server1 that runs Windows Server 2016.

  A domain-based Group Policy object (GPO) is used to configure the security policy of Server1.

  You plan to use Security Compliance Manager (SCM) 4.0 to compare the security policy of Server1 to the WS2012 DNS Server Security 1.0 baseline.

  You need to import the security policy into SCM. What should you do first?

  A. From Security Configuration and Analysis, use the Export Template option.
  B. Run the Copy-GPO cmdlet and specify the -TargetName parameter.
  C. Run the Backup-GPO cmdlet and specify the -Path parameter.
  D. Run the secedit.exe command and specify the/export parameter.
  C. Run the Backup-GPO cmdlet and specify the -Path parameter.

  ---

  https://technet.microsoft.com/en-us/library/ee461052.aspx Backup-GPO cmdlet and specify the -Path parameter creates a GPO backup folder with GUID name and issuitable to import to SCM 4.0

• Question 212:

  HOTSPOT

  Your network contains an Active Directory forest named contoso.com.

  The forest has Microsoft Identity Manager (MIM) 2016 deployed.

  You implement Privileged Access Management (PAM).

  You need to request privileged access from a client computer in contoso.com by using PAM.

  How should you complete the Windows PowerShell script? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

  ---

  References: https://technet.microsoft.com/en-us/library/mt604089.aspx https://technet.microsoft.com/en-us/library/mt604084.aspx

• Question 213:

  Your network contains an Active Directory domain named contoso.com. The domain contains five servers. All servers run Windows Server 2016. A new security policy states that you must modify the infrastructure to meet the following requirements:

  1.

  Limit the rights of administrators.

  2.

  Minimize the attack surface of the forest.

  3.

  Support Multi-Factor authentication for administrators.

  You need to recommend a solution that meets the new security policy requirements.

  What should you recommend deploying?

  A. an administrative forest
  B. domain isolation
  C. an administrative domain in contoso.com
  D. the Local Administrator Password Solution (LAPS)
  A. an administrative forest

  ---

  You have to "-Minimize the attack surface of the forest", then you must create another forest for administrators. https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privilegedaccess-reference-material#ESAE_BM This section contains an approach for an administrative forest based on the Enhanced Security Administrative Environment (ESAE) reference architecture deployedby Microsoft's cybersecurity professional services teams to protect customers against cybersecurity attacks.Dedicated administrative forests allow organizations to host administrative accounts, workstations, and groups in an environment that has stronger security controls than the production environment.

• Question 214:

  This question relates to Windows Firewall and related technologies.

  These rules use IPsec to secure traffic while it crosses the network.

  You use these rules to specify that connections between two computers must be authenticated or encrypted.

  What is the name for these rules?

  A. Connection Security Rules
  B. Firewall Rules
  C. TCP Rules
  D. DHP Rules
  A. Connection Security Rules

• Question 215:

  Windows PowerShell is a task-based command-line shell and scripting language designed especially for system administration. Windows Defender comes with a number of different Defender-specific cmdlets that you can run through PowerShell to automate common tasks.

  Which Cmdlet would you run first if you wanted to perform an offline scan?

  A. Start-MpWDOScan
  B. Start-MpScan
  C. Set-MpPreference -DisableRestorePoint $true
  D. Set-MpPreference -DisablePrivacyMode $true
  A. Start-MpWDOScan

  ---

  Some malicious software can be particularly difficult to remove from your PC. Windows Defender Offline (Start-MpWDOScan) can help to find and remove this using up-to-date threat definitions.

• Question 216:

  Note: This question It part of a series of questions that present the same scenario. Each question In the series contains a unique solution that might meet the stated goats. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to It. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain named contoso.com. The domain contains a computer named Computer1 that runs Windows 10. Computer1 connects to a home network and a corporate network.

  The corporate network uses the 17216.0.0/24 address space internally.

  Computer1 runs an application named App1 that listens to port 8080.

  You need to prevent connections to App1 when Computer1 is connected to the home network.

  Solution: From Group Policy Management you create a software restriction policy.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Software Restriction Policy does not filter incoming network traffic, what you actually need is Windows Firewall Inbound Rule on the Private profile References: https://technet.microsoft.com/en-us/library/hh831534(v=ws.11).aspx

• Question 217:

  HOTSPOT

  You network contains an Active Directory domain named contoso.com.

  You have an organizational unit (OU) named Secure that contains all server.

  You install Microsoft Security Compliance Manager (SCM) 4.0 on a server named Server1.

  You need to export the SCM Print Server Security baseline and to deploy the baseline to a server named Server2.

  What should you do? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

  ---

  http://www.techrepublic.com/blog/it-security/use-ms-security-compliance-manager-to-secure-your-windows-environment/ https://technet.microsoft.com/en-us/library/hh489604.aspx

• Question 218:

  Your network contains an Active Directory domain named contoso.com.

  The domain contains four global groups named Group1. Group2, GroupB. and Group4. A user named User! is a member of Group3.

  You have an organizational unit (OU) named OUT that contains computer accounts. A Group Policy object (GPO) named GP01 is linked to 0U1.0U1 contains a computer account named Computer!.

  GP01 has the User Rights Assignment configured as shown in the following table.

  A. Modify the membership of Group
  B. Modify the membership of Group4.
  C. Modify the Deny log on locally user right.
  D. In GP01. modify the Access this computer from the network user right.
  C. Modify the Deny log on locally user right.

• Question 219:

  Your network contains an Active Directory domain named contoso.com. The domain contains 100 servers.

  You deploy the Local Administrator Password Solution (LAPS) to the network.

  You deploy a new server named FinanceServer5, and join FinanceServerS to the domain.

  You need to ensure that the passwords of the local administrators of FinanceServer5 are available to the LAPS administrators.

  What should you do?

  A. On FinanceServerS, register AdmPwd.dll.
  B. On FmanceServerS, install the LAPS Windows PowerShell module.
  C. In the domain, modify the permissions for the computer account of FmanceServer5.
  D. In the domain, modify the permissions of the Domain Controllers organizational unit (OU).
  A. On FinanceServerS, register AdmPwd.dll.

  ---

  References: https://gallery.technet.microsoft.com/Step-by-Step-Deploy-Local-7c9ef772

• Question 220:

  You have a server named Server1 that runs Windows Server 2016.

  You install Docker on Server1 and download a Docker image.

  You need to start a new container from the image. The solution must prevent the processes that run in the container from being accessible to Server1.

  Which parameter should you specify when you run the docker run command?

  A. --expose
  B. --runtime
  C. --entrypoint
  D. --isolation
  D. --isolation

  ---

  References: https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/hyperv-container

  https://docs.docker.com/engine/reference/commandline/run/