Microsoft 70-744 Online Practice Questions and Exam Preparation

Microsoft 70-744 Online Questions & Answers

• Question 31:

  HOTSPOT

  Your network contains an Active Directory named contoso.com

  The domain contains the computers configured as shown in the following table.

  

  

  Server1 has a share named Share1 that has the following configurations.

  Server1, Computer1, and Computer2 have the connection security rules configured as shown in the exhibit. (Click the Exhibit button.) Exhibit:

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  

  ---

  When Computer1 accesses Share1, SMB encryption will be used: YES When Computer2 accesses Share1, SMB encryption will be used: YES When Server1 accesses a shared folder on Computer1, IPsec encryption will be used: NO The shared folder "Share1" is configured with "EncryptData : True", no matter which network the client resides,SMB 3 communication will be encrypted.When Server1 access Computer1 over network, the original packet L3 IP Header is as follow:-172.16.1.30 ?gt; 172.16.10.60These traffic does not match the enabled IPSec rule "Rule2" nor "Rule3", and the only matching rule "Rule1" isdisabled. So, no IPsec encryption will be achieved.

• Question 32:

  HOTSPOT

  Your network contains an Active Directory domain named contoso.com.

  You plan to deploy an application named App1.exe.

  You need to verify whether Control Flow Guard is enabled for App1.exe.

  Which command should you run? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

  ---

  https://msdn.microsoft.com/en-us/library/windows/desktop/mt637065(v=vs.85).aspx

  Control Flow Guard (CFG) is a highly-optimized platform security feature that was created to combat memorycorruption vulnerabilities.

  By placing tight restrictions on where an application can execute code from, it makes it much harder for exploitsto execute arbitrary code through vulnerabilitiessuch as buffer overflows.

  To verify if Control Flow Guard is enable for a certain application executable:-Run the dumpbin.exe tool (included in the Visual Studio 2015 installation) from the Visual Studio commandprompt with the /headers and /loadconfig options:

  dumpbin.exe /headers /loadconfig test.exe.The output for a binary under CFG should show that the header values include "Guard", and that the loadconfig values include "CF Instrumented" and "FID tablepresent".1

  

• Question 33:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this sections, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contain an Active Directory domain named contoso.com. The domain contains a computer named Computer1 that runs Windows 10. Computer1 connects to a home network and a corporate network.

  The corporate network uses the 172.16.0.0/24 address space internally.

  Computer1 runs an application named App1 that listens to port 8080.

  You need to prevent connections to App1 when Computer1 is connected to the home network.

  Solution: From Group Policy Management, you create software restriction policy.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  References: https://technet.microsoft.com/en-us/library/hh831534(v=ws.11).aspx

• Question 34:

  Your network contains an Active Directory forest named contoso.com. The forest contains three domains. All domain controllers run Windows Server 2016.

  You deploy a second Active Directory forest named admin.contoso.com.

  The forest contains a domain member server named Server1. Server1 has Microsoft Identity Manager (MIM) 2016 deployed.

  You need to implement Privileged Access Management (PAM) and to use admin.contoso.com as an administrative forest.

  Which two actions should you perform? Each correct answers presents part of the solution.

  A. From a domain controller in contoso.com. run the New-PAMTrust cmdlet.
  B. From Server1, run the New-PAMDomainConfiguration cmdlet
  C. From a domain controller in admin.contoso.com, run the New-PAMTrust cmdlet.
  D. From a domain controller in contoso.com, run the New-PAMDomainConfiguration cmdlet.
  E. From a domain controller in admin.contoso.com, run the New-PAMDomainConfiguration cmdlet
  F. From Server1, run the New-PAMTrust cmdlet
  B. From Server1, run the New-PAMDomainConfiguration cmdlet
  F. From Server1, run the New-PAMTrust cmdlet

  ---

  https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/configuring-mim-environment-for-pam https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/step-5-establish-trust-between-priv-corpforests

  

• Question 35:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain named contoso.com. All client computers run Windows 10.

  You plan to deploy a Remote Desktop connection solution for the client computers.

  You have four available servers in the domain that can be configured as Remote Desktop servers. The servers are configured as shown in the following table.

  

  You need to ensure that all Remote Desktop connections can be protected by using Remote Credential Guard.

  Solution: You deploy the Remote Desktop connection solution by using Server4.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  No, as Server4 is a Windows Server 2012R2 which does not meet the requirements of Remote Credential Guard.https://docs.microsoft.com/en-us/windows/access-protection/remote-credential-guardRemote Credential Guard requirementsTo use Windows Defender Remote Credential Guard, the Remote Desktop client and remote host must meetthe following requirements:The Remote Desktop client device:Must be running at least Windows 10, version 1703 to be able to supply credentials.Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user's signed-incredentials. This requires the user's account be able tosign in to both the client device and the remote host.Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal WindowsPlatform application doesn't support WindowsDefender Remote Credential Guard.Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domaincontroller, then RDP attempts to fall back to NTLM.Windows Defender Remote Credential Guard does not allow NTLM fallback because this would exposecredentials to risk.The Remote Desktop remote host:Must be running at least Windows 10, version 1607 or Windows Server 2016.Must allow Restricted Admin connections.Must allow the client's domain user to access Remote Desktop connections.Must allow delegation of non-exportable credentials.

• Question 36:

  Your network contains an Active Directory domain.

  Microsoft Advanced Threat Analytics (ATA) is deployed to the domain.

  A database administrator named DBA1 suspects that her user account was compromised.

  Which three events can you identify by using ATA? Each correct answer presents a complete solution.

  A. Spam messages received by DBA1.
  B. Phishing attempts that targeted DBA1
  C. The last time DBA1 experienced a failed logon attempt
  D. Domain computers into which DBA1 recently signed.
  E. Servers that DBA1 recently accessed.
  C. The last time DBA1 experienced a failed logon attempt
  D. Domain computers into which DBA1 recently signed.
  E. Servers that DBA1 recently accessed.

  ---

  https://docs.microsoft.com/en-us/advanced-threat-analytics/ata-threatsSuspicious authentication failures (Behavioral brute force)Attackers attempt to use brute force on credentials to compromise accounts.ATA raises an alert when abnormal failed authentication behavior is detected.Abnormal behaviorLateral movement is a technique often used by attackers, to move between devices and areas in the victim'snetwork to gain access to privileged credentials orsensitive information of interest to the attacker. ATA is able to detect lateral movement by analyzing thebehavior of users, devices and their relationship inside thecorporate network, and detect on any abnormal access patterns which may indicate a lateral movementperformed by an attacker. https://gallery.technet.microsoft.com/ATA-Playbook-ef0a8e38/view/ReviewsATA Suspicious Activity Playbook Page 35 Action: Attempt to authenticate to DC1

• Question 37:

  Your network contains an Active Directory domain. All the computers in the domain are configured for the Local Administrator Password Solution (LAPS). The Group Policy object (GPO) settings for LAPS are configured as shown in the exhibit. (Click the Exhibit tab.)

  

  You provide a technician with the local administrator password for a computer named Computer1. What is the maximum amount of time the password will be valid?

  A. 30 minutes
  B. 3 days
  C. 30 days
  D. 365 days
  C. 30 days

  ---

  References: https://www.reddit.com/r/sysadmin/comments/712049/laps_password_expiration_time_password_age/

• Question 38:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016. A user named User1 is a member of the local Administrators group. Server1 has the AppLocker rules configured as shown in follow:

  

  Rule1 and Rule2 are configured as shown in the following table:

  

  You verify that User1 is unable to run App2.exe on Server1.

  Which changes will allow User1 to run D:\\Folder1\\Program.exe and D:\\Folder2\\App2.exe? Choose Two.

  A. User1 can run D:\\Folder1\\Program.exe if Program.exe is moved to another folder
  B. User1 can run D:\\Folder1\\Program.exe if Program.exe is renamed
  C. User1 can run D:\\Folder1\\Program.exe if Program.exe is updated
  D. User1 can run D:\\Folder2\\App2.exe if App2.exe is moved to another folder
  E. User1 can run D:\\Folder2\\App2.exe if App2.exe is renamed
  F. User1 can run D:\\Folder2\\App2.exe if App2.exe is upgraded
  A. User1 can run D:\\Folder1\\Program.exe if Program.exe is moved to another folder
  F. User1 can run D:\\Folder2\\App2.exe if App2.exe is upgraded

  ---

  https://technet.microsoft.com/en-us/library/ee449492(v=ws.11).aspx

  

  For "D:\\Folder1\\Program.exe", it is originally explicitly denied due to Rule1, when moving the "Program,exe" outof "D:\\Folder1\\", it does not match Rule1.Assume that "Program.exe" is moved to "D:\\Folder2", it matches an Explicit Allow rule

  for group "BUILTIN\\Administrators" which User1 is a member of, therefore Ais correct.For "App2",exe, it matches a Explicit Deny rule using its File Hash (created File content), no matter where youmove it to, or how you rename it, it would still

  matchRule2.Only changing the file content of App2.exe would let it no longer match the explicit deny hash-based rule"Rule2".By upgrading its version and content, it will generate a new hash.

  so F is correct.

• Question 39:

  Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is

  exactly the same in each question in this series.

  Start of repeated scenario

  Your network contains an Active Directory domain named contoso.com. The functional level of the forest and the domain is Windows Server 2008 R2.

  The domain contains the servers configured as shown in the following table.

  

  All servers run Windows Server 2016. All client computers run Windows 10.

  You have an organizational unit (OU) named Marketing that contains the computers in the marketing department You have an OU named finance that contains the computers in the finance department You have an OU named AppServers

  that contains application servers. A Group Policy object (GPO) named GP1 is linked to the Marketing OU. A GPO named GP2 is linked to the AppServers OU.

  You install Windows Defender on Nano1.

  End of repeated scenario

  You need to exclude D:\Folder1 on Nano1 from being scanned by Windows Defender.

  Which cmdlet should you run?

  A. Set-StorageSetting
  B. Set-FsrmFileScreenException
  C. Set-MpPreference
  D. Set-DtcAdvancedSetting
  C. Set-MpPreference

  ---

  https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/set-mppreference

• Question 40:

  Your network has an internal network and a perimeter network. Only the servers on the perimeter network can access the Internet. You create a Microsoft Operations Management Suite (OMS) instance in Microsoft Azure.

  You deploy Microsoft Monitoring Agent to all the servers on both the networks.

  You discover that only the servers on the perimeter network report to OMS.

  You need to ensure that all the servers report to OMS.

  What should you do?

  A. Install a Web Application Proxy on the perimeter network and install an OMS Gateway on the internal network. Publish the OMS Gateway from the Web Application Proxy.
  B. Install a Web Application Proxy and an OMS Gateway on the perimeter network. Publish the OMS Gateway from the Web Application Proxy.
  C. Configure the network firewalls to allow the internal servers to access the IP addresses of the Azure OMS instance by using TCP port 443.
  D. On the internal servers, run the Add-AzureRmUsageConnect cmdlet and specify the -AdminUri parameter.
  A. Install a Web Application Proxy on the perimeter network and install an OMS Gateway on the internal network. Publish the OMS Gateway from the Web Application Proxy.

  ---

  References: https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-oms-gateway