Exam 70-744 topic 1 question 150 discussion

Actual exam question from Microsoft's 70-744

Question #: 150
Topic #: 1

DRAG DROP -
Your network contains an Active Directory domain named contoso.com. The domain functional level is Windows Server 2016. The domain contains a member server named Server1.
You test Code Integrity on Server1 in audit mode.
You need to enforce the Code Integrity levels on all the Windows Server 2016 servers in the domain.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

Show Suggested Answer

Suggested Answer:

References:
https://blogs.technet.microsoft.com/datacentersecurity/2018/03/10/default-code-integrity-policy-for-windows-server/

by KidCastaldo at Oct. 31, 2020, 5:24 p.m.

Comments

Submit Cancel

palermo

Highly Voted 4 years, 6 months ago

northgaterebel rightly noticed, correct order: a) Set-RuleOption - because we dont need create new policy (we got it but we want to enforce it) b) Convertfrom-CIPolicy c) Use GPO to deploy p7b file to all servers in domain d) Restart servers to take effect

upvoted 6 times

...

Timock

Most Recent 4 years, 5 months ago

Note You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Make your WDAC policies friendly and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. p7b is actually a thing. Poking around cant find alot of info on this but what I can put together I think that Palermo is correct.

upvoted 1 times

...

TheOGMrBee

4 years, 5 months ago

Palermo, you ARE absolutely correct. From the spelling mistakes in this and many of the other questions, it would appear that the person may be copying the questions by some form of voice transmission. it is easy to see that p7b and policy could sound the same if whispered or on a 'bad line'

upvoted 1 times

...

northgaterebel

4 years, 6 months ago

I guess the question assumes that between convert and restart we copied the converted policy to C:\Windows\System32\CodeIntegrity\SiPolicy.p7b on each server?

upvoted 1 times

...

SamsOtro

4 years, 6 months ago

Answer is correct, deploying GPO step isn't necessary.

upvoted 2 times

...

KidCastaldo

4 years, 8 months ago

Reference supports answer

upvoted 2 times

...