Microsoft Securing Windows Server 2016 Set 2

You implement Log Analytics in Microsoft Operations Management Suite (OMS) on all servers that run Windows Server 2016. You need to generate a daily report that identifies which servers restarted during the last 24 hours. Which query should you use?

Your network contains an Active Directory domain. Microsoft Advanced Threat Analytics (ATA) is deployed to the domain. A database administrator named DBA1 suspects that her user account was compromised. Which three events can you identify by using ATA? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Your network has an internal network and a perimeter network. Only the servers on the perimeter network can access the Internet. You create a Microsoft Operations Management Suite (OMS) instance in Microsoft Azure. You deploy Microsoft Monitoring Agent to all the servers on both the networks. You discover that only the servers on the perimeter network report to OMS. You need to ensure that all the servers report to OMS. What should you do?

You have a server named Server1 that runs Windows Server 2016. You configure Just Enough Administration (JEA) on Server1. You need to view a list of commands that will be available to a user named User1 when User1 establishes a JEA session to Server1. Which cmdlet should you use?

Your network contains an Active Directory domain named contoso.com. The domain contains two DNS servers that run Windows Server 2016. The servers host two zones named contoso.com and admin.contoso.com. You sign both zones. You need to ensure that all client computers in the domain validate the zone records when they query the zone. What should you deploy?

You have a Hyper-V host named Hyper1 that has a virtual machine named FS1. FS1 is a file server that contains sensitive data. You need to secure FS1 to meet the following requirements: Prevent console access to FS1. Prevent data from being extracted from the VHDX file of FS1. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

You deploy the Host Guardian Service (HGS). You have several Hyper-V that have older hardware and Trusted Platform Modules (TPMs) version 1.2. You discover that the Hyper-V hosts cannot start shielded virtual machines. You need to configure HGS to ensure that the older Hyper-V hosts can host shielded virtual machines. What should you do?

You enable and configure PowerShell Script Block Logging. You need to view which script blocks were executed by using Windows PowerShell scripts. What should you do?

Your network contains an Active Directory forest named Corp. The forest functional level is Windows Server 2016. You deploy a new forest named Priv and set the forest functional level to Windows Server 2016. You need to implement Privileged Access Management (PAM). What should you do next?

Your network contains several secured subnets that are disconnected from the Internet. One of the secured subnets contains a server named Server1 that runs Windows Server 2016. You implement Log Analytics in Microsoft Operations Management Suite (OMS) for the servers that connect to the Internet. You need to ensure that Log Analytics can collect logs from Server1. Which two actions should you perform? Each correct answer presents part of the solution.