70-744 - Microsoft70-744 Exam Dumps Updated DEC 2020 | RealExamCollection
                     Microsoft
70-744
Securing Windows
https://www.realexamcollection.com/microsoft/70-744-dumps.html
Practice Test Microsoft - 70-744
Question #:1
A shielding data file (also called a provisioning data file or PDK file) is an encrypted file that a tenant or VM
owner creates to protect important VM configuration information.
A fabric administrator uses the shielding data file when creating a shielded VM, but is unable to view or use
the information contained in the file.
Which information can be stored in the shielding data file?
A.  Administrator credentials
B.  All of these
C.  A Key Protector
D.  Unattend.xml
Answer: B
Question #:2
Note: This question It part of a series of questions that present the same scenario. Each question In the series
contains a unique solution that might meet the stated goats. Some question sets might have more than one
correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to It. As a result, these questions
will not appear in the review screen.
Your network contains an Active Directory domain named contoso.com. The domain contains a computer
named Computer1 that runs Windows 10. Computer1 connects to a home network and a corporate network.
The corporate network uses the 17216.0.0/24 address space internally.
Computer1 runs an application named App1 that listens to port 8080.
You need to prevent connections to App1 when Computer1 is connected to the home network.
Solution: From Group Policy Management you create a software restriction policy.
Does this meet the goal?
A.  Yes
B.  No
Answer: B
Explanation
Software Restriction Policy does not filter incoming network traffic, what you actually need is Windows
1 of 7
Practice Test Microsoft - 70-744
Firewall Inbound Rule on the Private profile
References:
https://technet.microsoft.com/en-us/library/hh831534(v=ws.11).aspx
Question #:3
Your network contains an Active Directory domain named contoso.com. The domain contains four servers.
The servers are configured as shown in the following table.
You need to manage FS1 and FS2 by using Just Enough Administration (JEA).
What should you do before you can implement JEA?
A.  Install Microsoft .NET Framework 4.6.2 on FS1
B.  Upgrade DC1 to Windows Server 2016
C.  Install Windows Management Framework 5.0 on FS2.
D.  Deploy Microsoft Identity Manager (MIM) 2016 to the domain.
Answer: C
Explanation
https://msdn.microsoft.com/en-us/library/dn896648.aspxThe current release of JEA is available on the
following platforms:-Windows Server 2016 Technical Preview 5 and higher-Windows Server 2012 R2,
Windows Server 2012, and Windows Server 2008 R2* with WindowsManagement Framework 5.0 installed
FS1 is ready to be managed by JEA, but FS2 need some extra work to do, either upgrade it to Windows Server
2016 or install Windows Management Framework5.0 installed,
Question #:4
Your network contains an Active Directory domain named contoso.com.
The domain contains 10 servers that run Windows Server 2016 and 800 client computers that run Windows
10.
You need to configure the domain to meet the following requirements:
2 of 7
Practice Test Microsoft - 70-744
-Users must be locked out from their computer if they enter an incorrect password twice.
-Users must only be able to unlock a locked account by using a one-time password that is sent to their mobile
phone.
You deploy all the components of Microsoft Identity Manager (MIM) 2016.
Which three actions should you perform before you deploy the MIM add-ins and extensions? Each correct
answer presents part of the solution.
A.  From a Group Policy object (GPO), configure Public Key Policies
B.  Deploy a Multi-Factor Authentication provider and copy the required certificates to the MIM server.
C.  From the MIM Portal, configure the Password Reset AuthN Workflow.
D.  Deploy a Multi-Factor Authentication provider and copy the required certificates to the client
computers.
E.  From a Group Policy object (GPO), configure Security Settings.
Answer: B C E
Explanation
-Users must be locked out from their computer if they enter an incorrect password twice. (E)-Users must only
be able to unlock a locked account by using a one-time password that is sent to their mobilephone. (B and C),
detailed configuration process inthe following web page.
https://docs.microsoft.com/en-us/microsoft-identity-manager/working-with-self-service-pa
sswordreset#prepare-mim-to-work-with-multi-factor-authentication
Question #:5
Your network contains an Active Directory domain named adatum.com.
The network contains a server named Server!. Server! is in a workgroup.
You need to create a backup of the local Group Policy on Server1 that you can import into a Group Policy
object (GPO) in the domain.
Which tool should you use?
A.  lgpo.exe
B.  Local Group Policy Editor
C.  Group Policy Management
D.  Backup-GPO
Answer: A
3 of 7
Practice Test Microsoft - 70-744
Explanation
References:
http://woshub.com/backupimport-local-group-policy-settings/
Question #:6
You have a server named Server1 that runs Windows Server 2016.
You need to install Security Compliance Manager (SCM) 4.0 on Server1.
What should you install on Server1 first?
A.  the .NET Framework 3.5 Features feature
B.  the Active Directory Rights Management Services server role
C.  the Remote Server Administration Tools feature
D.  the Group Policy Management feature
Answer: A
Question #:7
You have a server named Server1 that runs Windows Server 2016.
You need to identity whether any connection security rules are configured on Server1.
Which cmdlet should you use?
A.  Get-NetIPSecRule
B.  Get-NetFirewallRule
C.  Get-NetFirewallProfile
D.  Get-NetFirewallSetting
E.  Get-NetFirewallPortFilter
F.  Get-NetFirewallAddressFilter
G.  Get-NetFirewallSecurityFilter
H.  Get-NetFirewallApplicationFilter
4 of 7
Practice Test Microsoft - 70-744
Answer: A
Explanation
https://technet.microsoft.com/en-us/itpro/powershell/windows/netsecurity/get-netipsecrule Get-NetIPSecRule
displays the existence and details of Connection Security Rules, as connection securityrules implements IPsec
between computers (not usingtunnel endpoints) or sites (using tunnel endpoints)
Question #:8
You have a server named Server1 that runs Windows Server 2016.
You need to identify whether any inbound rules on Server1 require that users be authenticated before they can
connect to the server.
Which cmdlet should you use?
A.  Get-NetIPSecRule
B.  Get-NetFirewallRule
C.  Get-NetFirewallProfile
D.  Get-NetFirewallSetting
E.  Get-NetFirewallPortFilter
F.  Get-NetFirewallAddressFilter
G.  Get-NetFirewallApplicationFilter
Answer: B
Explanation
The complete cmdlet to perform the required action:-
Question #:9
5 of 7
Practice Test Microsoft - 70-744
You deploy the Host Guardian Service (HGS).
You have several Hyper-V hosts that have older hardware and Trusted Platform Modules (TPMs) version 1.2.
You discover that the Hyper-V hosts cannot start shielded virtual machines.
You need to configure HGS to ensure that the older Hyper-V hosts can host shielded virtual machines. What
should you do?
A.  Run the Set-HgsServer cmdlet and specify the -TrustTpm parameter.
B.  Run the Set-HgsServer cmdlet and specify the -TrustActiveDirectory parameter.
C.  Run the Clear-HgsServer cmdlet and specify the -Clustername parameter
D.  Run the Clear-HgsServer cmdlet and specify the -Force parameter.
E.  It is not possible to enable older Hyper-V hosts to run Shielded virtual machines
Answer: E
Explanation
Requirements and LimitationsThere are several requirements for using Shielded VMs and the HGS:One bare
metal host: You can deploy the Shielded VMs and the HGS with just one host. However, Microsoftrecommends
that you cluster HGS for high availability.Windows Server 2016 Datacenter Edition: The ability to create and
run Shielded VMs and the HGS is onlysupported by Windows Server 2016 DatacenterEdition.For
Admin-trusted attestation mode: You only need to have server hardware capable of running Hyper-V in
Windows Server 2016 TP5 or higher.For TPM-trusted attestation: Your servers must have TPM 2.0 and UEFI
2.3.1 and they must boot in UEFImode. The hosts must also have secure boot enabled.Hyper-V role: Must be
installed on the guarded host.HGS Role: Must be added to a physical host.Generation 2 VMs.A fabric AD
domain.An HGS AD, which in Windows Server 2016 TP5 is a separate AD infrastructure from your fabric AD.
Question #:10
Your network contains an Active Directory domain named contoso.com.
The domain contains a server named Server1 that runs Windows Server 2016.
You need to prevent NTLM authentication on Server1.
Solution: From a Group Policy, you configure the Security Options.
Does this meet the goal?
A.  Yes
B.  No
Answer: A
https://www.realexamcollection.com/microsoft/70-744-dumps.html
6 of 7