Exam 70-744: Securing Windows Server 2016 Practice Test
Exam 70-744: Securing Windows Server 2016 focuses on protecting Windows Server systems through access controls, malware defenses, application restrictions, and secure startup. Its subject matter includes configuring permissions and policies, limiting service privileges, controlling which programs can run, and reducing exposure by disabling unnecessary services. These skills support administrators responsible for hardening servers and protecting workloads.
Exam overview
About the Exam 70-744: Securing Windows Server 2016 Exam
Security decisions in this area involve matching controls to risks across server accounts, processes, software, and startup components. Administrators need to distinguish user rights from file and service permissions, apply consistent settings to domain-joined systems, and use password and lockout policies to reduce account attacks. Application-control policies can limit execution to approved software, while restricted process tokens and least-privilege service configurations constrain the impact of compromise. Windows Defender and secure-boot protections address malware and untrusted startup components. Practical work also includes reviewing listening services, removing unneeded exposure, and verifying that security settings preserve required administrative tasks without granting ordinary users excess authority.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
A security administrator wants to prevent ordinary users from changing the system time on a member server, while retaining that ability for administrators. Which Windows control should be adjusted?
Show answer
Correct answer: AWindows user rights determine which accounts or groups may perform specific system operations. Restricting the right to change the system time to appropriate administrative groups prevents ordinary users from changing it.
An administrator needs to protect a Windows Server against malware by scanning files and monitoring for potentially harmful activity. Which built-in product provides this type of protection?
Show answer
Correct answer: AMicrosoft Defender Antivirus provides malware scanning and related protection on supported Windows Server configurations. The other options are used for server migration, cluster administration, and web-server management.
An organization needs to manage security settings consistently across many domain-joined servers. Which mechanism is designed to centrally apply and enforce Windows configuration settings?
Show answer
Correct answer: AGroup Policy centrally configures and enforces many Windows operating-system and application settings for users and computers in an Active Directory environment. The other features do not provide centralized policy management.
A company wants to reduce the risk that users launch unapproved applications on managed Windows computers. Which technology can enforce application execution rules through policies?
Show answer
Correct answer: AAppLocker can create rules that allow or deny applications based on attributes such as publisher, path, or file hash. The other technologies provide remote access, content caching, and operating-system deployment.
A server administrator needs to reduce the chance that a compromised service can read or modify files outside its required working directory. Which practice best supports this goal?
Show answer
Correct answer: ALeast privilege limits the resources and actions available to an account, reducing the potential impact of a compromise. Administrative membership and broad shares expand access, while disabling auditing reduces visibility rather than restricting permissions.
A Windows Server 2016 host needs to ensure that only software signed by an authorized publisher can load as the operating system starts. Which feature is designed to enforce this before Windows fully loads?
Show answer
Correct answer: ASecure Boot uses firmware trust checks to verify boot software signatures and helps prevent unauthorized boot components from loading. It is distinct from runtime application-control policies.
An administrator wants to help prevent a server from loading an untrusted or modified boot component. Which Windows security feature verifies components during startup using cryptographic measurements?
Show answer
Correct answer: BSecure Boot checks boot software against trusted signatures before allowing it to run, helping block unauthorized boot components. Credential Guard protects credentials, Windows Firewall filters network traffic, and Network Unlock is a BitLocker deployment option.
How to use this practice test
The free US Practice Tests practice bank contains 50 questions for this exam. Each session presents up to 20 random questions and shows results afterward. Use the scenarios to identify the Windows control that fits each security goal, then review any missed concepts such as policy enforcement, process restrictions, malware protection, and startup integrity.
Preparation tips
- Practice distinguishing user-right assignments, file permissions, and service permissions when limiting what users or compromised services can do.
- Compare Group Policy with account-level settings, and identify how domain password length and lockout rules are applied consistently.
- Review how application-control policies restrict execution and how restricted process tokens reduce available privileges.
- Trace the purpose of secure boot and startup integrity checks, including how they help block untrusted boot components.
- Inventory listening services on a server and determine which can be disabled without interrupting required roles or workloads.