Exam 70-742: Identity with Windows Server 2016 Practice Test
Exam 70-742: Identity with Windows Server 2016 focuses on managing identities and access in Windows Server environments. Its practice topics include Active Directory Domain Services, domain authentication, Group Policy, DNS-based domain controller discovery, and identity synchronization with Microsoft Entra ID. These skills support day-to-day administration of users, computers, and access to network resources.
Exam overview
About the Exam 70-742: Identity with Windows Server 2016 Exam
Identity administration involves more than creating accounts: administrators must maintain directory availability, diagnose trust and replication issues, and apply policies to the right users and computers. Relevant concepts include Kerberos authentication, cached domain sign-ins, certificate-based credentials, Global Catalog placement, and the account settings that constrain delegation. Troubleshooting tasks can involve checking a computer’s secure channel or assessing Active Directory replication health. Group Policy decisions include targeting computers across organizational units and using loopback processing when settings should reflect a computer’s location rather than the signed-in user’s usual policy scope. Hybrid identity work also requires understanding how password synchronization connects an on-premises directory with cloud sign-in. Practice scenarios can help distinguish which mechanism, setting, or diagnostic tool fits a particular administrative requirement.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
A user must access a domain resource from a computer when no domain controller is reachable. Which mechanism may allow the user to sign in using previously validated domain credentials?
Show answer
Correct answer: AWindows can cache domain logon information so a user who has previously signed in can authenticate interactively when a domain controller is unavailable. Trust resets, catalog referrals, and DNS delegations do not provide offline interactive logon.
A domain controller is configured as a Global Catalog server. What is one operational consideration when enabling the Global Catalog on an additional domain controller?
Show answer
Correct answer: BA Global Catalog holds a full replica of its own domain and a partial, searchable replica of objects from other domains in the forest. Enabling the role does not automatically assign FSMO roles or stop normal replication.
A workstation's secure channel to its domain is suspected of being broken. Which built-in command-line utility can test the workstation's trust relationship with the domain?
Show answer
Correct answer: ANltest includes options for checking domain trust and secure-channel status, such as /sc_verify. The other utilities serve different purposes: disk management, network configuration, and event-log management.
Which Windows Server feature is designed to synchronize passwords from an on-premises Active Directory environment to Microsoft Entra ID for cloud sign-in?
Show answer
Correct answer: BPassword Hash Synchronization, configured through Azure AD Connect (now Microsoft Entra Connect), synchronizes a derived representation of on-premises password hashes for cloud authentication. AD FS instead provides federation-based sign-in.
A company wants to allow users to sign in to domain computers using a certificate-based credential stored on a physical token. Which Windows authentication approach is most directly associated with this requirement?
Show answer
Correct answer: ASmart card authentication uses a physical card and certificate-based credentials for sign-in. Cached logon supports sign-in when a domain controller is unavailable, while NTLM and local-account authentication do not describe the requested token-based method.
Which DNS record type enables a client to locate domain controllers that provide a particular Active Directory service?
Show answer
Correct answer: DActive Directory publishes service-location records, or SRV records, in DNS. Clients query these records to locate domain controllers and other directory services.
A forest administrator wants to prevent an account from being used for delegation when it is authenticated by Kerberos. Which user-account option is most directly intended for this restriction?
Show answer
Correct answer: AMarking an account as sensitive and not delegable prevents its credentials from being delegated to other services. This is a security measure for accounts whose credentials should not be forwarded.
How to use this practice test
The free practice page draws up to 20 random questions from its 50-question bank and shows results after the session. Use each scenario to identify the relevant Windows Server identity mechanism, then review missed items by topic—for example, replication diagnosis, Group Policy targeting, or authentication choices.
Preparation tips
- Compare cached domain credentials, Kerberos authentication, and certificate-based sign-in so you can match each to its appropriate access scenario.
- Practice identifying DNS service locator records used by domain clients to find domain controllers.
- Learn the purpose of tools such as repadmin and nltest, including which one helps assess replication health and which can test a domain secure channel.
- Work through Group Policy scenarios involving security filtering, organizational units, and loopback processing for shared computers.
- Trace how password synchronization connects on-premises Active Directory identities with Microsoft Entra ID sign-in.