Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016. A technician is testing the deployment of Credential Guard on Server1. You need to verify whether Credential Guard is enabled on Server1. What should you do?

Correct Answer: From a command prompt, run the credwiz.exe command.

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016. You have an organizational unit (OU) named Administration that contains the computer account of Serve1. You import the Active Directory module to Server1. You create a Group Policy object (GPO) named GPO1. You link GPO1 to the Administration OU. You need to log an event each time an Active Directory cmdlet is executed successfully from Server1. What should you do?

Correct Answer: Run the(Get-Module ActiveDirectory).LogPipelineExecutionDetails = $truecommand.

Your network contains an Active Directory domain named contoso.com. You download Microsoft Security Compliance Toolkit 1.0 and all the security baselines. You need to deploy one of the security baselines to all the computers in an organizational unit (OU) named OU1. What should you do?

Correct Answer: Run 1gpo.exe and specify the /g parameter. From Policy Analyzer, click Add.

Your network has an internal network and a perimeter network. Only the servers on the perimeter network can access the Internet. You create a Microsoft Operations Management Suite (OMS) instance in Microsoft Azure. You deploy Microsoft Monitoring Agent to all the servers on both the networks. You discover that only the servers on the perimeter network report to OMS. You need to ensure that all the servers report to OMS. What should you do?

Correct Answer: Configure the network firewalls to allow the internal servers to access the IP addresses of the Azure OMS instance by using TCP port 443.

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1. You configure Just Enough Administration (JEA) on Server1. When will JEA limit the tasks that can be performed on Server1?

Correct Answer: when you run Enter-PSSession and specify Server1 and the ""ComputeName parameter

Your network contains an Active Directory forest named contoso.com. The forest functional level is Windows Server 2012. The forest contains 20 member servers that are configured as file servers. All domain controllers run Windows Server 2016. You create a new forest named contosoadmin.com. You need to use the Enhanced Security Administrative Environment (ESAE) approach for the administration of the resources in contoso.com. Which two actions should you perform? Each correct answer presents part of the solution.

Correct Answer: From the properties of the trust, enable selective authentication.

Your network contains an Active Directory domain named contoso.com. The domain contains a file server named FS1 that runs Windows Server 2016. FS1 has a share named SecureFolder. You need to track all users who access the contents of SecureFolder. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Correct Answer: From File Explorer, modify the Advanced security settings of SecureFolder.

Your network contains an Active Directory forest that contains 20 domain controllers. All the domain controllers run as virtual machines on Hyper-V hosts. A corporate security policy prohibits the installation of software on the domain controllers. You deploy Advanced Threat Analytics (ATA) and the ATA Gateway. You need to collect data from the domain controllers by using ATA. What should you do?

Correct Answer: Configure the User Rights Assignment security policy settings on the domain controller

You plan to use the Security and Audit solution in Microsoft Operations Management Suite (OMS) to monitor servers that run Windows Server 2016. The servers are prevented from accessing the Internet. You create an OMS workspace and add the Security and Audit solution. You need to ensure that you can monitor the servers. What should you do first?

Correct Answer: From Accounts, modify the Azure Subscription and Data Plan setting

You configure a server named Server1 to report to a Microsoft Azure Log Analytics workspace named Workspace1. Several events are added to the System log on Server1. You run queries in Workspace1, and no events are returned from Server1. You confirm that Server1 reports to Workspace1. You need to ensure that events from Server1 are sent to Workspace1. What should you do?

Correct Answer: On Server1, configure the Microsoft Monitoring Agent settings

Your network contains an Active Directory domain named contoso.com. The domain contains 1,000 client computers that run Windows 10. A security audit reveals that the network recently experienced a Pass-the-Hash attack. The attack was initiated from a client computer and accessed Active Directory objects restricted to the members of the Domain Admins group. You need to minimize the impact of another successful Pass-the-Hash attack on the domain. What should you recommend?

Correct Answer: Move the computer accounts of all the client computers to a new organizational unit (OU). Remove the permissions to the new OU from the Domain Admins group.

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016. You deploy the Advanced Threat Analytics (ATA) Gateway to Server1. You plan to collect events from the domain controllers by using a source-initiated configuration. You need to configure security to allow Server1 to collect the events. What should you do?

Correct Answer: Add the Network Service account to the Contoso\Event Log Readers group.

Your network contains an Active Directory forest named contoso.com. The forest functional level is Windows Server 2012. All servers run Windows Server 2016. You create a new bastion forest named admin.contoso.com. The forest functional level of admin.contoso.com is Windows Server 2012 R2. You need to implement a Privileged Access Management (PAM) solution. Which two actions should you perform? Each correct answer presents part of the solution.

Correct Answer: Configure contoso.com to trust admin.contoso.com.

Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2 that run Windows Server 2016. Server1 is configured as a domain controller. You configure Server1 as a Just Enough Administration (JEA) endpoint. You configure the required JEA rights for a user named User1. You need to tell User1 how to manage Active Directory objects from Server2. What should you tell User1 to do first on Server2?

Correct Answer: From Windows PowerShell, run the Enter-PSSession cmdlet.

Your network contains an Active Directory domain named contoso.com. The domain contains 100 servers. You deploy the Local Administrator Password Solution (LAPS) to the network. You deploy a new server named FinanceServer5, and join FinanceServer5 to the domain. You need to ensure that the passwords of the local administrators of FinanceServer5 are available to the LAPS administrators. What should you do?

Correct Answer: In the domain, modify the permissions for the computer account of FinanceServer5.

Your network contains an Active Directory domain named contoso.com. The domain contains four servers. The servers are configured as shown in the following table. You need to manage FS1 and FS2 by using Just Enough Administration (JEA). What should you do before you can implement JEA?

Correct Answer: Install Microsoft.NET Framework 4.6.2 on FS2.

Your network contains an Active Directory domain named contoso.com. The domain contains five servers. All servers run Windows Server 2016. A new security policy states that you must modify the infrastructure to meet the following requirements: ✑ Limit the rights of administrators. ✑ Minimize the attack surface of the forest. ✑ Support Multi-Factor authentication for administrators. You need to recommend a solution that meets the new security policy requirements. What should you recommend deploying?

Correct Answer: an administrative forest

Your network contains two single-domain Active Directory forests named contoso.com and contosoadmin.com. Contosoadmin.com contains all of the user accounts used to manage the servers in contoso.com. You need to recommend a workstation solution that provides the highest level of protection from vulnerabilities and attacks. What should you include in the recommendation?

Correct Answer: Provide a Privileged Access Workstation (PAW) for each user in the contoso.com forest. Join each PAW to the contoso.com domain.

Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2016. The domain contains a server named Server1 that has Microsoft Security Compliance Manager (SCM) 4.0 installed. You export the baseline shown in the following exhibit. You have a server named Server2 that is a member of a workgroup. You copy the {2617e9b1-9672-492b-aefa-0505054848c2} folder to Server2. You need to deploy the baseline settings to Server2. What should you do?

Correct Answer: From Windows PowerShell, run the Restore-GPO cmdlet.

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016. A technician is testing the deployment of Credential Guard on Server1. You need to verify whether Credential Guard is enabled on Server1. What should you do?

Correct Answer: From Server Manager, click Local Server, and review the properties of Server1.

Your network contains an Active Directory domain named contoso.com. You install the Windows Server Update Services server role on a member server named Server1. Server1 runs Windows Server 2016. You need to ensure that a user named User1 can perform the following tasks: ✑ View the Windows Server Update Services (WSUS) configuration. ✑ Generate WSUS update reports. The solution must use the principle of least privilege. What should you do on Server1?

Correct Answer: Modify the permissions of the ReportWebService virtual folder from the WSUS Administration website.

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server5 that has the Windows Server Update Services server role installed. You need to configure Windows Server Update Services (WSUS) on Server5 to use SSL. You install a certificate in the local Computer store. Which two tools should you use? Each correct answer presents part of the solution.

Correct Answer: Internet Information Services (IIS) Manager

Your network contains an Active Directory domain named contoso.com. The domain contains 1,000 client computers that run Windows 8.1 and 1,000 client computers that run Windows 10. You deploy a Windows Server Update Services (WSUS) server. You create a computer group for each organizational unit (OU) that contains client computers. You configure all of the client computers to receive updates from WSUS. You discover that all of the client computers appear in the Unassigned Computers computer group in the Update Services console. You need to ensure that the client computers are added automatically to the computer group that corresponds to the location of the computer account in Active Directory. Which two actions should you perform? Each correct answer presents part of the solution.

Correct Answer: From the Update Services console, configure the Computers option.

Note: This question is part of a series of questions that use the same or similar answer choices. An answer choice may be correct for more than one question in the series. Each question is independent of the other questions in this series. Information and details provided in a question apply only to that question. Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016. Server1 has a shared folder named Share1. You need to ensure that all access to Share1 uses SMB Encryption. Which tool should you use?

Correct Answer: Disk Management

Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series. Your network contains an Active Directory domain named contoso.com. The functional level of the forest and the domain is Windows Server 2008 R2. The domain contains the servers configured as shown in the following table. All servers run Windows Server 2016. All client computers run Windows 10. You have an organizational unit (OU) named Marketing that contains the computers in the marketing department. You have an OU named Finance that contains the computers in the finance department. You have an OU named AppServers that contains application servers. A Group Policy object (GPO) named GP1 is linked to the Marketing OU. A GPO named GP2 is linked to the AppServers OU. You install Windows Defender on Nano1. You need to execute D:\Folder1 on Nano1 from being scanned by Windows Defender. Which cmdlet should you run?

Correct Answer: Set-StorageSetting

Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series. Your network contains an Active Directory domain named contoso.com. The functional level of the forest and the domain is Windows Server 2008 R2. The domain contains the servers configured as shown in the following table. All servers run Windows Server 2016. All client computers run Windows 10. You have an organizational unit (OU) named Marketing that contains the computers in the marketing department. You have an OU named Finance that contains the computers in the finance department. You have an OU named AppServers that contains application servers. A Group Policy object (GPO) named GP1 is linked to the Marketing OU. A GPO named GP2 is linked to the AppServers OU. You install Windows Defender on Nano1. You need to ensure that the marketing department computers validate DNS responses from adatum.com. Which setting should you configure in the Computer Configuration node of GP1?

Correct Answer: Connection Security Rule from Windows Settings

Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series. Your network contains an Active Directory domain named contoso.com. The functional level of the forest and the domain is Windows Server 2008 R2. The domain contains the servers configured as shown in the following table. All servers run Windows Server 2016. All client computers run Windows 10. You have an organizational unit (OU) named Marketing that contains the computers in the marketing department. You have an OU named Finance that contains the computers in the finance department. You have an OU named AppServers that contains application servers. A Group Policy object (GPO) named GP1 is linked to the Marketing OU. A GPO named GP2 is linked to the AppServers OU. You install Windows Defender on Nano1. You need to ensure that you can deploy a shielded virtual machine to Server4. Which server role should you deploy?

Correct Answer: Host Guardian Service

Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series. Your network contains an Active Directory domain named contoso.com. The functional level of the forest and the domain is Windows Server 2008 R2. The domain contains the servers configured as shown in the following table. All servers run Windows Server 2016. All client computers run Windows 10. You have an organizational unit (OU) named Marketing that contains the computers in the marketing department. You have an OU named Finance that contains the computers in the finance department. You have an OU named AppServers that contains application servers. A Group Policy object (GPO) named GP1 is linked to the Marketing OU. A GPO named GP2 is linked to the AppServers OU. You install Windows Defender on Nano1. You need to disable SMB 1.0 on Server2. What should you do?

Correct Answer: From Server Manager, remove a Windows feature.

Note: This question is part of a series of questions that use the same scenario. For your convenience, the scenario is repeated in each question. Each question presents a different goal and answer choices, but the text of the scenario is exactly the same in each question in this series. Your network contains an Active Directory domain named contoso.com. The functional level of the forest and the domain is Windows Server 2008 R2. The domain contains the servers configured as shown in the following table. All servers run Windows Server 2016. All client computers run Windows 10. You have an organizational unit (OU) named Marketing that contains the computers in the marketing department. You have an OU named Finance that contains the computers in the finance department. You have an OU named AppServers that contains application servers. A Group Policy object (GPO) named GP1 is linked to the Marketing OU. A GPO named GP2 is linked to the AppServers OU. You install Windows Defender on Nano1. You plan to implement BitLocker Drive Encryption (BitLocker) on the operating system volumes of the application servers. You need to ensure that the BitLocker recovery keys are stored in Active Directory. Which Group Policy setting should you configure?

Correct Answer: Choose how BitLocker-protected operating system drives can be recovered.

Your network contains an Active Directory domain named contoso.com. You are deploying Microsoft Advanced Threat Analytics (ATA). You create a user named User1. You need to configure the user account of User1 as a Honeytoken account. Which information must you use to configure the Honeytoken account?

Correct Answer: the UPN of User1

Your network contains an Active Directory domain named contoso.com. You create a Microsoft Operations Management Suite (OMS) workspace. You need to connect several computers directly to the workspace. Which two pieces of information do you require? Each correct answer presents part of the solution.

Correct Answer: the key of the workspace

Welcome to awslagi.com – Sharing AWS, Google Cloud, Microsoft Azure IT Exams. It's free for all!

Securing Windows Server 2016

Secure Windows Server 2016 with advanced protection practices.

4.8★★★★★(349 ratings)

19,427 studentsIntermediate

Learn to harden Windows Server 2016 environments using modern security controls, access management, and protection strategies. The exam helps you reduce risk across servers, identities, and workloads. This certification is a strong fit for professionals focused on infrastructure security. It demonstrates that you can support enterprise environments with better defense, monitoring, and control.

What you'll learn

Harden server environments- Manage security controls- Protect identities- Reduce attack surface- Support secure administration

70-744

Lectures2

Quizzes0

Duration30 week

Students19,427

$20.00

📢 Unlock Full Access to Success!

"The content displayed here is a promotional preview and contains only 50% of the actual exam database. To access the complete set of updated questions, please upgrade to the Full Version."

👉 Click the button and follow the instructions to secure your full access immediately!