Microsoft Securing Windows Server 2016 - 070-744 Exam Questions
QUESTION NO: 1
Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016.
You need to allow network administrators to use Just Enough Administration (JEA) to change the TCP/IP settings on Server1. The solution must use the principle of least privilege.
How should you configure the session configuration file?
Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016.
You need to allow network administrators to use Just Enough Administration (JEA) to change the TCP/IP settings on Server1. The solution must use the principle of least privilege.
How should you configure the session configuration file?
Correct Answer: D
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 2
Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016.
A user named User1 is a member of the local Administrators group.
Server1 has the AppLocker rules configured as shown in the exhibit. (Click the Exhibit button.) Exhibit:
Rule1 and Rule2 are configured as shown in the following table.
You verify that User1 is unable to run App2.exe on Server1.
Which changes will allow User1 to run D:\Folder1\Program.exe and D:\Folder2\App2.exe? To answer select the appropriate options in the answer area.
Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016.
A user named User1 is a member of the local Administrators group.
Server1 has the AppLocker rules configured as shown in the exhibit. (Click the Exhibit button.) Exhibit:
Rule1 and Rule2 are configured as shown in the following table.
You verify that User1 is unable to run App2.exe on Server1.
Which changes will allow User1 to run D:\Folder1\Program.exe and D:\Folder2\App2.exe? To answer select the appropriate options in the answer area.
Correct Answer:
Explanation
References: https://technet.microsoft.com/en-us/library/ee449492(v=ws.11).aspx
References: https://technet.microsoft.com/en-us/library/ee449492(v=ws.11).aspx
QUESTION NO: 3
HOTSPOT
You plan to implement a guarded fabric in TPM-trusted attestation mode. The fabric will contain a three-node Host Guardian Service (HGS) cluster and four guarded hosts.
All the hosts will have matching hardware and will run the same workload.
You need to add the hosts to the HGS cluster.
What is the minimum number of times you must run each cmdlet to implement the HGS cluster? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
HOTSPOT
You plan to implement a guarded fabric in TPM-trusted attestation mode. The fabric will contain a three-node Host Guardian Service (HGS) cluster and four guarded hosts.
All the hosts will have matching hardware and will run the same workload.
You need to add the hosts to the HGS cluster.
What is the minimum number of times you must run each cmdlet to implement the HGS cluster? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
References:
https://docs.microsoft.com/en-us/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabric-tpm-
References:
https://docs.microsoft.com/en-us/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabric-tpm-
QUESTION NO: 4
You are implementing Privileged Access Management (PAM) for an Active Directory forest named contoso.com.
You install a bastion forest named adatum.com, and you establish a trust between the forests.
You need to create a group in contoso.com that will be used by Microsoft Identity Manager to create groups in adatum.com.
How should you configure the group? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You are implementing Privileged Access Management (PAM) for an Active Directory forest named contoso.com.
You install a bastion forest named adatum.com, and you establish a trust between the forests.
You need to create a group in contoso.com that will be used by Microsoft Identity Manager to create groups in adatum.com.
How should you configure the group? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
References: https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/planning-bastion-environment Production forest is contoso.comBastion forest is adatum.com
https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/planning-bastion-environmentA security group on the local domain (contoso.com)There must be a group in the existing domain, whose name is the NetBIOS domain name followed bythree dollar signs, e.g., CONTOSO$$$.The group scope must be domain local and the group type must be Security.This is needed for groups to be created in the dedicated administrative forest (adatum.com) with the sameSecurity identifier as groups in this domain(contoso.com).
Create this group with the followingNew-ADGroup -name 'CONTOSO$$$' -GroupCategory Security
-GroupScope DomainLocal -SamAccountName 'CONTOSO$$$'After this, MIM could create "Shadow Group" in bastion adatum.com forest.
References: https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/planning-bastion-environment Production forest is contoso.comBastion forest is adatum.com
https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/planning-bastion-environmentA security group on the local domain (contoso.com)There must be a group in the existing domain, whose name is the NetBIOS domain name followed bythree dollar signs, e.g., CONTOSO$$$.The group scope must be domain local and the group type must be Security.This is needed for groups to be created in the dedicated administrative forest (adatum.com) with the sameSecurity identifier as groups in this domain(contoso.com).
Create this group with the followingNew-ADGroup -name 'CONTOSO$$$' -GroupCategory Security
-GroupScope DomainLocal -SamAccountName 'CONTOSO$$$'After this, MIM could create "Shadow Group" in bastion adatum.com forest.
QUESTION NO: 5
Your network contains an Active Directory domain named contoso.com.
You are deploying Microsoft Advanced Threat Analytics (ATA) to the domain. You install the ATA Gateway on a server named Server1.
To assist in detecting Pass-the-Hash attacks, you plan to configure ATA Gateway to collect events.
You need to configure the query filter for event subscriptions on Server1.
How should you configure the query filter? To answer, select the appropriate options in the answer are.
Your network contains an Active Directory domain named contoso.com.
You are deploying Microsoft Advanced Threat Analytics (ATA) to the domain. You install the ATA Gateway on a server named Server1.
To assist in detecting Pass-the-Hash attacks, you plan to configure ATA Gateway to collect events.
You need to configure the query filter for event subscriptions on Server1.
How should you configure the query filter? To answer, select the appropriate options in the answer are.
Correct Answer:
Explanation
https://docs.microsoft.com/en-us/advanced-threat-analytics/configure-event-collectionTo enhance detection capabilities, ATA needs the following Windows events: 4776, 4732, 4733, 4728, 4729,4756, 4757.These can either be read automatically by the ATA Lightweight Gateway or in case the ATA LightweightGateway is not deployed,it can be forwarded to the ATA Gateway in one of two ways, by configuring the ATA Gateway to li sten for SIEMevents or by configuring Windows Event Forwarding.
Event ID: 4776 NTLM authentication is being used against domain controllerEvent ID: 4732 A User is Added to Security-Enabled DOMAIN LOCAL Group,Event ID: 4733 A User is removed from Security-Enabled DOMAIN LOCAL GroupEvent ID: 4728 A User is Added or Removed from Security-Enabled Global Group Event ID: 4729 A User is Removed from Security-Enabled GLOBAL GroupEvent ID: 4756 A User is Added or Removed From Security-Enabled Universal GroupEvent ID: 4757 A User is Removed From Security-Enabled Universal Group
https://docs.microsoft.com/en-us/advanced-threat-analytics/configure-event-collectionTo enhance detection capabilities, ATA needs the following Windows events: 4776, 4732, 4733, 4728, 4729,4756, 4757.These can either be read automatically by the ATA Lightweight Gateway or in case the ATA LightweightGateway is not deployed,it can be forwarded to the ATA Gateway in one of two ways, by configuring the ATA Gateway to li sten for SIEMevents or by configuring Windows Event Forwarding.
Event ID: 4776 NTLM authentication is being used against domain controllerEvent ID: 4732 A User is Added to Security-Enabled DOMAIN LOCAL Group,Event ID: 4733 A User is removed from Security-Enabled DOMAIN LOCAL GroupEvent ID: 4728 A User is Added or Removed from Security-Enabled Global Group Event ID: 4729 A User is Removed from Security-Enabled GLOBAL GroupEvent ID: 4756 A User is Added or Removed From Security-Enabled Universal GroupEvent ID: 4757 A User is Removed From Security-Enabled Universal Group
QUESTION NO: 6
Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2016.
The domain contains a server named Serverl that has Microsoft Security Compliance Manager (SCM) 4.0 installed.
You export the baseline shown in the following exhibit.
You have a server named Server2 that is a member of a workgroup.
You copy the (2617e9b1-9672-492b-aefa-0505054848c2) folder to Server2.
You need to deploy the baseline settings to Server2.
What should you do?
Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2016.
The domain contains a server named Serverl that has Microsoft Security Compliance Manager (SCM) 4.0 installed.
You export the baseline shown in the following exhibit.
You have a server named Server2 that is a member of a workgroup.
You copy the (2617e9b1-9672-492b-aefa-0505054848c2) folder to Server2.
You need to deploy the baseline settings to Server2.
What should you do?
Correct Answer: B
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 7
Your network contains an Active Directory domain named contoio.com. The domain contains a server named Server1 that runs Windows Server 2016.
You have an organizational unit (OU) named Administration that contains the computer account of Server1.
You import the Active Directory module to Served1.
You create a Group Policy object (GPO) named GPO1 You link GPO1 to the Administration OU.
You need to log an event each time an Active Directory cmdlet is executed successfully from Server1.
What should you do?
Your network contains an Active Directory domain named contoio.com. The domain contains a server named Server1 that runs Windows Server 2016.
You have an organizational unit (OU) named Administration that contains the computer account of Server1.
You import the Active Directory module to Served1.
You create a Group Policy object (GPO) named GPO1 You link GPO1 to the Administration OU.
You need to log an event each time an Active Directory cmdlet is executed successfully from Server1.
What should you do?
Correct Answer: C
QUESTION NO: 8
Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series.
Start of repeated scenario
Your network contains an Active Directory domain named contoso.com. The functional level of the forest and the domain is Windows Server 2008 R2.
The domain contains the servers configured as shown in the following table.
All servers run Windows Server 2016. All client computers run Windows 10.
You have an organizational unit (OU) named Marketing that contains the computers in the marketing department. You have an OU named Finance that contains the computers in the finance department. You have an OU named AppServers that contains application servers. A Group Policy object (GPO) named GP1 is linked to the Marketing OU. A GPO named GP2 is linked to the AppServers OU.
You install Windows Defender on Nano1.
End of repeated scenario
You need to ensure that you can implement the Local Administrator Password Solution (LAPS) (or the finance department computers.
What should you do in the contoso.com forest? To answer, select the appropriate options in the answer area.
Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series.
Start of repeated scenario
Your network contains an Active Directory domain named contoso.com. The functional level of the forest and the domain is Windows Server 2008 R2.
The domain contains the servers configured as shown in the following table.
All servers run Windows Server 2016. All client computers run Windows 10.
You have an organizational unit (OU) named Marketing that contains the computers in the marketing department. You have an OU named Finance that contains the computers in the finance department. You have an OU named AppServers that contains application servers. A Group Policy object (GPO) named GP1 is linked to the Marketing OU. A GPO named GP2 is linked to the AppServers OU.
You install Windows Defender on Nano1.
End of repeated scenario
You need to ensure that you can implement the Local Administrator Password Solution (LAPS) (or the finance department computers.
What should you do in the contoso.com forest? To answer, select the appropriate options in the answer area.
Correct Answer:
Explanation
Windows PowerShell module to import: AdmPwd.PS
Windows PowerShell cmdlet to use: Update-AdmPwdADSchema
https://4sysops.com/archives/set-up-microsoft-laps-local-administrator-password-solution-in-active-directory/
Windows PowerShell module to import: AdmPwd.PS
Windows PowerShell cmdlet to use: Update-AdmPwdADSchema
https://4sysops.com/archives/set-up-microsoft-laps-local-administrator-password-solution-in-active-directory/
QUESTION NO: 9
Your network contains an Active Directory domain named adatum.com.
The domain contains a server named Server1 that runs Windows Server 2016. The domain contains two users named User1 and User2.
On Server1, you create two files named File1.doc and File2.doc in a folder named C:\Folder1.
The Audit Entry for File1.doc is configured as shown in the File1 exhibit. (Click the File1 tab.)
File2.doc has an empty auditing entry list.
The Auditing Entry for Global File SACL that applies to Server1 is configured as shown in the SACL exhibit.
(Click the SACL tab.)
The Advanced Audit Policy Configuration for Server1 is configured as shown in the Audit Policy exhibit.
(Click the Audit Policy tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Your network contains an Active Directory domain named adatum.com.
The domain contains a server named Server1 that runs Windows Server 2016. The domain contains two users named User1 and User2.
On Server1, you create two files named File1.doc and File2.doc in a folder named C:\Folder1.
The Audit Entry for File1.doc is configured as shown in the File1 exhibit. (Click the File1 tab.)
File2.doc has an empty auditing entry list.
The Auditing Entry for Global File SACL that applies to Server1 is configured as shown in the SACL exhibit.
(Click the SACL tab.)
The Advanced Audit Policy Configuration for Server1 is configured as shown in the Audit Policy exhibit.
(Click the Audit Policy tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
References:
http://sourcedaddy.com/windows-7/auditing-file-and-folder-access.html
References:
http://sourcedaddy.com/windows-7/auditing-file-and-folder-access.html
QUESTION NO: 10
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory forest named contoso.com. All servers run Windows Server 2016.
The forest contains 2,000 client computers that run Windows 10. All client computers are deployed from a customized Windows image.
You need to deploy 10 Privileged Access Workstations (PAWs). The solution must ensure that administrators can access several client applications used by all users.
Solution: You deploy 10 physical computers and configure them as virtualization hosts. You configure the operating system on each host as a PAW. You create a guest virtual machine by using the customized Windows image.
Does this meet the goal?
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory forest named contoso.com. All servers run Windows Server 2016.
The forest contains 2,000 client computers that run Windows 10. All client computers are deployed from a customized Windows image.
You need to deploy 10 Privileged Access Workstations (PAWs). The solution must ensure that administrators can access several client applications used by all users.
Solution: You deploy 10 physical computers and configure them as virtualization hosts. You configure the operating system on each host as a PAW. You create a guest virtual machine by using the customized Windows image.
Does this meet the goal?
Correct Answer: B
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
