Microsoft 70-744 Online Practice Questions and Exam Preparation

Microsoft 70-744 Online Questions & Answers

• Question 81:

  Your network contains an Active Directory domain named contoso.com.

  The domain contains two DNS servers that run Windows Server 2016.

  The servers host two zones named contoso.com and admin.contoso.com.

  You sign both zones.

  You need to ensure that all client computers in the domain validate the zone records when they query the zone.

  What should you deploy?

  A. a Microsoft Security Compliance Manager (SCM) policy
  B. a zone transfer policy
  C. a Name Resolution Policy Table (NRPT)
  D. a connection security rule
  C. a Name Resolution Policy Table (NRPT)

  ---

  You should use Group Policy NRPT to for a DNS Client to perform DNSSEC validation of DNS zone records.

  

• Question 82:

  DRAG DROP

  You have two servers named Server1 and Server2 that run Windows Server 2016 and are in a workgroup. Server1 is used as a reference computer to configure the security baseline for the other computers in the workgroup.

  You need to apply the Group Policy computer settings of Server1 to Server2.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  References: https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/

• Question 83:

  You plan to enable Credential Guard on four servers. Credential Guard secrets will be bound to the TPM. The servers run Windows Server 2016 and are configured as shown in the following table.

  

  Which of the above server you could enable Credential Guard?

  A. Server1
  B. Server2
  C. Server3
  D. Server4
  D. Server4

  ---

  https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard-requirements Hardware and software requirementsTo provide basic protections against OS level attempts to read Credential Manager domain credentials, NTLMand Kerberos derived credentials, WindowsDefender Credential Guard uses:-Support for Virtualization-based security (required)-Secure boot (required)-TPM 2.0 either discrete or firmware (preferred ?provides binding to hardware)-UEFI lock (preferred ?prevents attacker from disabling with a simple registry key change)

• Question 84:

  Your network contains an Active Directory domain named contoso.com.

  The domain contains four global groups named Group].., Group2, Group3, and Group4.A user named User1 is a member of Group3.

  You have an organizational unit (OU) named OU1 that contains computer accounts.

  A Group Policy object (GPO) named GPO1 is linked to OU1. OU1 contains a computer account named Computer1.

  GPO1 has the User Rights Assignment configured as shown in the following table:

  

  You need to ensure that User1 can access the shares on Computer1. What should you do?

  A. Modify the membership of Group1.
  B. In GPO1, modify the Access this computer from the network user right
  C. Modify the Deny access to this computer from the network user right.
  D. Modify the Deny log on locally user right
  B. In GPO1, modify the Access this computer from the network user right

  ---

  You need to ensure that User1 can access the shares on Computer1, from network.If not from network, where would you access a shared folder from? from Mars? from Space? from toilet?Moreover, this question has explicitly state User1 is a member of Group3, and hence it is not possible for User1to logon Computer1 locally to touch those sharedfolders on NTFS file system.Only these two policies to be considered "Access this computer from network", "Deny access to this computerfrom network".1There's no option to modify the group member ship of "Group2", "Administrators", or "Backup Operators",so we have to add a 4th entry "User1" to this policy setting "Access this computer from network".

• Question 85:

  HOTSPOT

  Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series.

  Your network contains an Active Directory domain named contoso.com. The functional level of the forest and the domain is Windows Server 2008 R2.

  The domain contains the servers configured as shown in the following table.

  

  All servers run Windows Server 2016. All client computers run Windows 10.

  You have an organizational unit (OU) named Marketing that contains the computers in the marketing department. You have an OU named Finance that contains the computers in the finance department. You have an OU named AppServers that contains application servers. A Group Policy object (GPO) named GP1 is linked to the Marketing OU. A GPO named GP2 is linked to the AppServers OU.

  You install Windows Defender on Nano1.

  You need to ensure that you can implement the Local Administrator Password Solution (LAPS) for the finance department computers.

  What should you do in the contoso.com forest? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

  ---

  https://learn-powershell.net/2016/10/08/setting-up-local-administrator-password-solution-laps/

• Question 86:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this sections, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a file server that runs Windows Server 2016. The file server contains the volumes configured as shown in the following table.

  

  You need to encrypt DevFiles by using BitLocker Drive Encryption (BitLocker). Solution: You run the manage-bde.exe command and specify the -on parameter. Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-on

• Question 87:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this sections, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain named contoso.com. All servers run Windows Server 2016. All client computers run Windows 10.

  The relevant objects in the domain are configured as shown in the following table.

  

  You need to assign User1 the right to restore files and folders on Server1 and Server2.

  Solution: You create a Group Policy object (GPO), you link the GPO to the Servers OU, and then you modify the Users Rights Assignment in the GPO.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  References: https://technet.microsoft.com/en-us/library/cc771990(v=ws.11).aspx

• Question 88:

  Your network contains an Active Directory domain named contoso.com.

  All DNS servers host an Active Directory-integrated zone for the domain that is DNSSEC-signed. All the DNS servers have a trust anchor installed for a DNS zone named fabrikam.com.

  For all the computers in the domain, you configure a name resolution policy that enforces DNSSEC validation for the contoso.com and fabrikam.com DNS namespaces.

  You need to verify whether the trust anchor is valid.

  What should you do?

  A. On a domain-joined computer, run Resolve-DnsName to query a DNS server that hosts the fabrikam.com zone for a DNS record in the fabrikam.com zone.
  B. On a domain-joined computer, run Resolve-DnsName to query a domain controller for a DNS record in the fabrikam.com zone.
  C. On a domain-joined computer, run Get-DnsServerZone.
  D. On a domain controller, run Get-DnsServerDnsZoneSetting.
  A. On a domain-joined computer, run Resolve-DnsName to query a DNS server that hosts the fabrikam.com zone for a DNS record in the fabrikam.com zone.

  ---

  References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn593652(v%3Dws.11)

• Question 89:

  HOTSPOT

  Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of thescenario is exactly the same in each question in this series.

  Start of repeated scenario.

  Your network contains an Active Directory domain named contoso.com. The functional level of the forest and the domain is Windows Server 2008 R2. The domain contains the servers configured as shown in the following table.

  

  All servers run Windows Server 2016. All client computers run Windows 10.

  You have an organizational unit (OU) named Marketing that contains the computers in the marketing department. You have an OU named Finance that contains the computers in the finance department. You have an OU named AppServers that contains application servers. A Group Policy object (GPO) named GP1 is linked to the Marketing OU. A GPO named GP2 is linked to the AppServers OU.

  You install Windows Defender on Nano1.

  End of repeated scenario.

  You need to configure Nano1 as a Hyper-V host.

  Which command should you run? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  

  ---

  References: https://docs.microsoft.com/en-us/windows-server/get-started/deploy-nano-server

• Question 90:

  The network contains an Active Directory domain named constoso.com. The domain contains the servers configured as shown in the following table.

  

  All servers run Windows Server 2016. All client computers run Windows 10 and are domain members. All laptops are protected by using BitLocker Drive Encryption (BitLocker).

  You have an organizational unit (OU) named OU1 that contains the computer accounts of application servers.

  An OU named OU2 contains the computer accounts of the computers in the marketing department.

  A Group Policy object (GPO) named GP1 is linked to OU1.

  A GPO named GP2 is linked to OU2.

  All computers receive updates from Server1.

  You create an update rule named Update1.

  You enable deep script block logging for Windows PowerShell.

  In which event log will PowerShell code that is generated dynamically appear?

  A. Applications and Services Logs/Microsoft/Windows/PowerShell/Operational
  B. Windows Logs/Security
  C. Applications and Services Logs/Windows PowerShell
  D. Windows Logs/Application
  A. Applications and Services Logs/Microsoft/Windows/PowerShell/Operational

  ---

  https://docs.microsoft.com/en-us/powershell/wmf/5.0/audit_scriptWhile Windows PowerShell already has the LogPipelineExecutionDetails Group Policy setting to log theinvocation of cmdlets, PowerShell's scripting language hasplenty of features that you might want to log and/or audit.The new Detailed Script Tracing feature lets you enable detailed tracking and analysis of Windows PowerShellscripting use on a system.After you enable detailed script tracing, Windows PowerShell logs all script blocks to the ETW (event tracing for windows) event log ?Microsoft-WindowsPowerShell/Operational.If a script block creates another script block (for example, a script that calls the Invoke-Expression cmdlet on astring), that resulting script block is logged as well.Logging of these events can be enabled through the Turn on PowerShell Script Block Logging Group Policysetting (in Administrative Templates -> WindowsComponents -> Windows PowerShell).