Can you secure a Windows estate end to end? These practice tests check the knowledge a Windows security administrator uses every day: security baselines and hardening of servers and endpoints, protecting Active Directory and privileged identities, locking down SMB, NTLM, LDAP and DNS, and auditing and recovering when something goes wrong.

You get 4 practice tests with 160 questions in total (40, 40, 40, 40). Every question was checked twice before release: once by the author against the official documentation, and once by an independent reviewer who answered it blind - any disagreement was settled with a source.

What makes the explanations useful

Each answer tells you why the right option is right and why each wrong option is wrong. The wrong options are real features, commands and settings that are easy to pick by mistake - that is where most of the learning is.

How the tests are built

• Practice Test 1: Security Baselines and Endpoint Hardening: security frameworks and CIS Benchmarks, the Security Compliance Toolkit, Secure Boot, BitLocker, Credential Guard, user rights, LAPS, AppLocker, WDAC, Defender and Sysinternals.
• Practice Test 2: Active Directory and Identity Security: securing domain controllers and RODCs, password and lockout policies, PSOs, Kerberos and Kerberoasting, Protected Users, authentication silos, gMSAs and tiered administration.
• Practice Test 3: Network Protocols, Auditing and Recovery: SMB signing and encryption, SMBv1, NTLM restriction, LDAP signing, DNSSEC, Windows Admin Center, advanced audit policy, event IDs, AD backup and recovery.
• Practice Test 4: Full Mock Exam: a mixed exam across all three areas - take it last, in one sitting.

Questions use single-answer and multiple-answer formats; the number of answers to pick is always stated. Suggested time: 60 minutes per test.

Versions: Windows Server 2022 and Windows Server 2025, Windows 11 (Secure Boot, TPM 2.0, BitLocker, Credential Guard, HVCI, AppLocker, App Control for Business / WDAC, Microsoft Defender Antivirus and ASR rules, Windows LAPS), Active Directory Domain Services security (Kerberos, NTLM, Protected Users, authentication policies and silos, gMSA and dMSA), SMB 3.1.1 signing and encryption, DNSSEC, Windows Admin Center, Microsoft Security Compliance Toolkit, CIS Benchmarks, Sysinternals (Sysmon, Autoruns, Process Explorer), as of October 2026.

Please note: these are original practice questions written by an instructor. This course is not affiliated with or endorsed by Microsoft; Windows, Windows Server, Active Directory, BitLocker and Microsoft Defender are Microsoft trademarks.