Exam 70-744 All Questions

View all questions & answers for the 70-744 exam

Exam 70-744 topic 1 question 44 discussion

Actual exam question from Microsoft's 70-744

Question #: 44
Topic #: 1

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016.
You have an organizational unit (OU) named Administration that contains the computer account of Server1.
You import the Active Directory module to Server1.
You create a Group Policy object (GPO) named GPO1. You link GPO1 to the Administration OU.
You need to log an event each time an Active Directory cmdlet is executed successfully from Server1.
What should you do?

A. From Advanced Audit Policy in GPO1, configure auditing for directory service changes.
B. Run the(Get-Module ActiveDirectory).LogPipelineExecutionDetails = $falsecommand.
C. Run the(Get-Module ActiveDirectory).LogPipelineExecutionDetails = $truecommand.
D. From Advanced Audit Policy in GPO1, configure for other privilege use events.
E. From Administrative Templates in GPO1, configure an Event Logging policy.
F. From Administrative Templates in GPO1, configure a Windows PowerShell policy.

Show Suggested Answer

Suggested Answer: C 🗳️
References:
https://www.petri.com/enable-powershell-logging

by Ario at April 5, 2020, 2:24 p.m.

Comments

Submit Cancel

VeiN

4 years, 5 months ago

C and F are correct but in question it is written: "You need to log an event EACH time an Active Directory cmdlet is executed" If you use powershell it will work only on current session. If you use GPO it will work every time. So F is the correct method. If the questioon was to apply only once then the best solution would be C.

upvoted 1 times

...

SamsOtro

4 years, 7 months ago

I believe that F is best answer.

upvoted 2 times

...

Kamikazekiller

4 years, 10 months ago

Answer is correct. C. Run the(Get-Module ActiveDirectory).LogPipelineExecutionDetails = $truecommand.

upvoted 3 times

...

DES123

4 years, 11 months ago

You need to log an event each time an Active Directory cmdlet is executed successfully from Server1. which means RSAT is installed or it is used on DC

upvoted 1 times

...

simcauley

4 years, 11 months ago

This question sucks... C does technically work but F would be better.

upvoted 2 times

...

psycho202

5 years ago

While answer C is technically correct, it only applies in the current session, not perpetually. Using GPO (F) would indeed seem like the better option.

upvoted 2 times

Matt71

4 years, 6 months ago

I have verified your answer. When machine reboots the setting goes back to $false. Apparently (F) with GPO configuration - it's even suggested in the scenario.

upvoted 1 times

...

cochy

5 years, 1 month ago

Answer C can be used only on DC and computer installed with RSAT. Reference: https://sid-500.com/2017/08/16/monitoring-windows-powershell-enable-module-logging/ I think, the correct answer is the F.

upvoted 1 times

...

Ario

5 years, 2 months ago

F is correct (Turn on module logging )

upvoted 2 times

Yebubbleman

4 years, 5 months ago

C effectively turns on module logging too.

upvoted 1 times

...