Microsoft 70-744 Online Practice Questions and Exam Preparation

Microsoft 70-744 Online Questions & Answers

• Question 71:

  Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is

  exactly the same in each question in this series.

  Start of repeated scenario.

  Your company has a marketing department.

  The network contains an Active Directory domain named constoso.com. The domain contains the servers configured as shown in the following table.

  

  All servers run Windows Server 2016. All client computers run Windows 10 and are domain members. All laptops are protected by using BitLocker Drive Encryption (BitLocker).

  You have an organizational unit (OU) named OU1 that contains the computer accounts of application servers. An OU named OU2 contains the computer accounts of the computers in the marketing department. A Group Policy object (GPO)

  named GP1 is linked to OU1. A GPO named GP2 is linked to OU2.

  All computers receive updates from Server1. You create an update rule named Update1.

  End of repeated scenario.

  You need to ensure that you can view Windows PowerShell code that was generated dynamically and executed on the computers in OU1.

  What should you configure in GP1?

  A. Object Access\\Audit Application Generated from the advanced audit policy
  B. Turn on PowerShell Script Block Logging from the PowerShell settings
  C. Turn on Module Logging from the PowerShell settings
  D. Object Access\\Audit Other Object Access Events from the advanced audit policy
  B. Turn on PowerShell Script Block Logging from the PowerShell settings

  ---

  https://docs.microsoft.com/en-us/powershell/wmf/5.0/audit_scriptWhile Windows PowerShell already has the LogPipelineExecutionDetails Group Policy setting to log theinvocation of cmdlets, PowerShell's scripting language hasplenty of features that you might want to log and/or audit.The new Detailed Script Tracing feature lets you enable detailed tracking and analysis of Windows PowerShellscripting use on a system.After you enable detailed script tracing, Windows PowerShell logs all script blocks to the ETW event log, Microsoft-Windows-PowerShell/Operational.If a script block creates another script block (for example, a script that calls the Invoke-Expression cmdlet on astring), that resulting script block is logged as well.Logging of these events can be enabled through the Turn on PowerShell Script Block Logging Group Policysetting (in Administrative Templates -> WindowsComponents -> Windows PowerShell).

• Question 72:

  Your network contains an Active Directory domain named contoso.com.

  You download Microsoft Security Compliance Toolkit 1.0 and all the security baselines.

  You need to deploy one of the security baselines to all the computers in an organizational unit (OU) named OU1.

  What should you do?

  A. Run 1gpo.exe and specify the /g parameter. From Policy Analyzer, click Add.
  B. From Group Policy Management, create and link a Group Policy object (GPO). Select the GPO and run the Import Settings Wizard.
  C. From Group Policy Management, click Group Policy Objects, and then click Manage Backups...
  D. From Group Policy Management, create and link a Group Policy object (GPO). Run 1gpo.exe and specify the /g parameter.
  B. From Group Policy Management, create and link a Group Policy object (GPO). Select the GPO and run the Import Settings Wizard.

  ---

  https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/distribute-certificates-to-client-computers-by-using-group-policy

• Question 73:

  HOTSPOT

  You have 100 computers that run Windows 10 and are members of a workgroup.

  You need to configure Windows Defender to meet the following requirements:

  1. Exclude a C:\Sales|Salesdb from malware scans.

  2. Configure a full scan to occur daily.

  What should you run to meet each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  

  ---

  Exclude C:\\Sales\\Salesdb from malware scans: Set-MpPreference Configure a full scan to occur daily: Set-MpPreference

  https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/set-mppreferenceSet-MpPreference-ExclusionPath C:\\Sales\\SalesdbSet-MpPreference -RemediationScheduleDay Everyday

• Question 74:

  HOTSPOT

  You are implementing Privileged Access Management (PAM) for an Active Directory forest named contoso.com.

  You install a bastion forest named adatum.com, and you establish a trust between the forests.

  You need to create a group in contoso.com that will be used by Microsoft Identity Manager to create groups in adatum.com.

  How should you configure the group? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  

  ---

  References: https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/planning-bastion-environment

  Production forest is contoso.comBastion forest is adatum.com https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/planning-bastion-environmentA security group on the local domain (contoso.com)There must be a group in the existing domain, whose name is the NetBIOS domain name followed bythree dollar signs, e.g., CONTOSO$$$.The group scope must be domain local and the group type must be Security.This is needed for groups to be created in the dedicated administrative forest (adatum.com) with the sameSecurity identifier as groups in this domain(contoso.com). Create this group with the followingNew-ADGroup -name `CONTOSO$$$' -GroupCategory Security -GroupScope DomainLocal mAccountName `CONTOSO$$$'After this, MIM could create "Shadow Group" in bastion adatum.com forest.

• Question 75:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016.

  You deploy the Advanced Threat Analytics (ATA) Gateway to Server1.

  You plan to collect events from the domain controllers by using a source-initiated configuration.

  You need to configure security to allow Server1 to collect the events.

  What should you do?

  A. Add the Contoso\Domain Controllers account to the Contoso\Event Log Readers group.
  B. Add the Network Service account to the Server1\Event Log Readers group.
  C. Add the Network Service account to the Contoso\Event Log Readers group.
  D. Add the Contoso\Domain Controllers account to the Server1\Event Log Readers group.
  C. Add the Network Service account to the Contoso\Event Log Readers group.

  ---

  Reference: https://docs.microsoft.com/en-us/advanced-threat-analytics/configure-event-collection

• Question 76:

  Your network contains an Active Directory forest named contoso.com. The forest functional level is Windows Server 2012. The forest contains a single domain. The domain contains multiple Hyper-V hosts.

  You plan to deploy guarded hosts.

  You deploy a new server named Server22 to a workgroup.

  You need to configure Server22 as a Host Guardian Service server.

  What should you do before you initialize the Host Guardian Service on Server22?

  A. Install the Active Directory Domain Services server role on Server22.
  B. Obtain a certificate.
  C. Raise the forest functional level.
  D. Join Server22 to the domain.
  D. Join Server22 to the domain.

  ---

  https://docs.microsoft.com/en-us/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabricchoose-where-to-install-hgs The only technical requirement for installing HGS in an existing forest is that it be added to the root domain; non-root domains are not supported.

• Question 77:

  Your network contains an Active Directory domain named contoso.com. The domain contains multiple servers

  that run multiple applications.

  Domain user accounts are used to authenticate access requests to the servers.

  You plan to prevent NTLM from being used to authenticate to the servers.

  You start to audit NTLM authentication events for the domain.

  You need to view all of the NTLM authentication events and to identify which applications authenticate by using NTLM.

  On which computers should you review the event logs and which logs should you review?

  A. Computers on which to review the event logs: Only client computers
  B. Computers on which to review the event logs: Only domain controllers
  C. Computers on which to review the event logs: Only member servers
  D. Event logs to review: Applications and Services Logs\\Microsoft\\Windows\\Diagnostics-Networking\\Operational
  E. Event logs to review: Applications and Services Logs\\Microsoft\\Windows\\NTLM\\Operational
  F. Event logs to review: Applications and Services Logs\\Microsoft\\Windows\\SMBClient\\Security
  G. Event logs to review: Windows Logs\\Security
  H. Event logs to review: Windows Logs\\System
  A. Computers on which to review the event logs: Only client computers
  E. Event logs to review: Applications and Services Logs\\Microsoft\\Windows\\NTLM\\Operational

  ---

  Do not confuse this with event ID 4776 recorded on domain controller's security event log!!!This question asks for implementing NTLM auditing when domain clients is connecting to memberservers! See below for further information. https:// docs.microsoft.com/en-us/windows/device-security/security-policy-settings/network-security-restrict-ntlmaudit-ntlm-authentication-in-this-domain Via lab testing, most of the NTLM audit logs are created on Windows 10 clients, except that you use Windows Server 2016 OS as clients (but this is unusual)

  

• Question 78:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016.

  You deploy Advanced Threat Analytics (ATA) to Server 1.

  you need to move the ATA database to a different folder.

  A. Config.json
  B. Config.xml
  C. Mongod.cfg
  D. Web.config
  B. Config.xml

• Question 79:

  You plan to implement a guarded fabric in TPM-trusted attestation mode. The fabric will contain a three-node Host Guardian Service (HGS) cluster and four guarded hosts.

  All the hosts will have matching hardware and will run the same workload.

  You need to add the hosts to the HGS cluster.

  What is the minimum number of times you must run each cmdlet to implement the HGS cluster? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  

  ---

  References: https://docs.microsoft.com/en-us/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabric-tpm-trusted-attestation-capturing-hardware

• Question 80:

  Your network contains an Active Directory domain named contoso.com. The domain contains several shielded virtual machines.

  You deploy a new server named Server1 that runs Windows Server 2016. You install the Hyper-V server role on Server1.

  You need to ensure that you can host shielded virtual machines on Server1.

  What should you install on Server1?

  A. Host Guardian Hyper-V Support
  B. BitLocker Network Unlock
  C. the Windows Biometric Framework (WBF)
  D. VM Shielding Tools for Fabric Management
  A. Host Guardian Hyper-V Support

  ---

  This questions mentions "The domain contains several shielded virtual machines.", which indicates a working Host Guardian Service deployment was completed. https://docs.microsoft.com/en-us/windows-server/virtualization/guarded-fabricshielded-vm/guarded-fabricguarded-host-prerequisites For a new Hyper-V server to utilize an existing Host Guardian Service, install the "Host Guardian Hyper-V Support".