AZ-802 Administering Windows Server Questions and Answers

Modify the trust on: DC2. Modify the permissions for the: Computer object of SRV1.

By default, an external trust grants every authenticated user in the trusted domain (contoso.com, from adatum.com ' s perspective) the implicit right to attempt authentication against any computer in the trusting domain (adatum.com), with actual access then governed only by each resource ' s own ACLs -- there is no built-in restriction limiting which specific computers users can even attempt to authenticate against. Selective Authentication is the trust setting that changes this: once enabled on the trust from the perspective of the domain being accessed, authenticating users from the other side must be explicitly granted the " Allowed to Authenticate " permission on the specific computer object(s) they should be allowed to reach; without that permission, authentication is denied outright, regardless of any file/share-level permissions. Because the goal is to restrict contoso.com users specifically -- without restricting the reverse direction (adatum.com users accessing contoso.com resources, which must remain unrestricted) -- Selective Authentication must be enabled only on the adatum.com side of the trust, which is configured on DC2, the domain controller hosting the FSMO roles (and by extension the trust configuration) for adatum.com; enabling it on DC1 or on both would risk also restricting the other direction. Once Selective Authentication is enabled on that side, the " Allowed to Authenticate " permission must then be granted specifically on SRV1 ' s own computer object (not on DC1 ' s, and not merely on SRV1 ' s file shares, since Selective Authentication is enforced at the computer-object authentication level, before any share-level permission is even evaluated) for the relevant contoso.com users or groups.

When a Storage Spaces Direct pool contains three distinct drive tiers, in this case SSD, NVMe, and HDD as shown in the exhibit, Storage Spaces Direct automatically designates only the single fastest media type present, NVMe, as the cache devices for the pool, leaving both the SSD and HDD drives entirely to provide usable pool capacity rather than splitting cache duty across more than one tier. The default cache behavior that Storage Spaces Direct applies then differs depending on which capacity tier is being cached: cached HDD capacity drives receive full read-and-write caching, because HDDs benefit the most from having both random read and random write operations absorbed and accelerated by the much faster flash-based cache tier sitting in front of them. Cached SSD capacity drives, on the other hand, receive write-only caching, since SSD read latency is already low enough on its own that adding read caching in front of it would provide little additional performance benefit while still consuming cache capacity and adding unnecessary wear to the cache devices. Combining these two distinct behaviors together, the documented default outcome for this specific three-tier deployment is NVMe-only caching devices with a combined cache behavior of read/write for the HDD capacity tier and write-only for the SSD capacity tier.

Group12 (Global, contoso.com) can have as members: Group13 only. Group21 (Universal, east.contoso.com) can have as members: Group12, Group13, and Group14 only.

Active Directory ' s group-scope nesting rules are strict and well-defined: a Global-scope group can contain only user/computer accounts and other Global-scope groups from its own, same domain -- it can never contain a Universal-scope or Domain-local-scope group, regardless of domain. Group12 is Global (contoso.com), so among the listed candidates, only Group13 (also Global, also contoso.com) is eligible; Group11 is disqualified because it is Domain-local scope, and Group14 is disqualified because it is Universal scope -- Global groups cannot absorb Universal-scope members under any circumstance, even within the same domain. A Universal-scope group, by contrast, can contain accounts, other Universal groups from any domain in the forest, and Global groups from any domain in the forest (but never a Domain-local group). Group21 is Universal (east.contoso.com), so Group12 and Group13 (both Global, in contoso.com, a different domain -- which is fine, since Universal-group membership is forest-wide) are eligible, and Group14 (Universal, contoso.com) is also eligible, since Universal groups may contain other Universal groups from anywhere in the forest. Only Group11 (Domain-local scope) is excluded from Group21 ' s membership, since a Domain-local group can never be nested inside anything except another Domain-local group in its own domain.

Onboarding an on-premises server to Microsoft Defender for Cloud starts with preparing a Log Analytics workspace that will receive security data and back the Defender for Cloud plan. Server1 must then be projected into Azure as an Arc-enabled server by installing the Azure Connected Machine agent, which is what makes an on-premises machine addressable by Azure resource-based services such as Defender for Cloud. Finally, a data collection rule is created and associated with the server so that the Microsoft Defender for Endpoint/Azure Monitor Agent based data required by the enabled Defender for Cloud plan is actually collected from Server1. Skipping the Arc-connection step would leave Server1 without an Azure resource identity, so no later DCR association would be possible until the Connected Machine agent is installed first. Once Server1 appears as an Azure Arc machine, Defender for Cloud ' s Foundational CSPM or Defender for Servers plan can be enabled on it just as it would be on a native Azure VM, giving the on-premises server the same recommendations, alerts, and regulatory compliance coverage.

The BitLocker recovery key for volume C: the Server1 computer object. The BitLocker recovery key for volume E: the Server2 computer object.

When BitLocker recovery information is backed up to Active Directory Domain Services, it is written as a child object underneath the computer object of whichever machine was actually running when the key protector was created; it is never written under a user object, an organizational unit object, or the domain root itself. Because Admin1 turned on BitLocker for volume C directly on Server1, that recovery password is stored as a child object of Server1 ' s own computer object, and Admin1 subsequently moving Server1 into OU1 only changes Server1 ' s location within the directory tree, not which computer object actually holds its recovery data. Because Admin2 turned on BitLocker for removable volume E while it was physically attached to Server2, its recovery password was written under Server2 ' s computer object at that time. Simply moving the removable drive over to Server1 afterward and unlocking it there does not trigger a new backup to Active Directory, since a new recovery-information object is only created when a key protector is actually added to a volume, not merely when an already-encrypted volume is unlocked elsewhere. The recovery key for volume E therefore remains associated with Server2 ' s computer object even after the drive itself has been physically relocated to Server1.

Confidential disk encryption is a platform feature available only on confidential VM sizes such as the DCasv5/DCadsv5/DCesv6 (and equivalent ECasv5/ECesv6) series, so VM1 must be deployed on a DC-series confidential SKU rather than the NC (GPU) or HB (HPC) families. Confidential disk encryption itself binds the encryption key to the VM ' s own vTPM and, by design, protects the operating system disk; the temp disk can optionally be added through a separate confidential temp disk encryption extension, but data disks are not covered by this mechanism and instead rely on guest-level encryption such as BitLocker if extra protection is required. Consequently the disk scope for confidential disk encryption is the operating system disk only, not the OS disk together with data disks. The encryption keys can be customer-managed and held in a managed HSM or Key Vault with purge protection enabled, ensuring the platform itself cannot access the disk contents outside the attested confidential VM boundary, which is the core security guarantee this feature provides over standard Azure Disk Encryption.

The Boot diagnostics blade on an Azure virtual machine ' s resource page in the Azure portal captures and exposes both the text-based serial console output generated during the guest operating system ' s startup sequence and a periodic boot screenshot showing what would appear on a physical monitor at that point in the boot process, making it the primary built-in tool for diagnosing why a virtual machine like VM1 is failing to start properly or is hanging partway through boot. Resource health, by comparison, reports on platform-level availability status for the underlying Azure infrastructure hosting the VM, such as whether the host experienced an outage, rather than exposing any content from inside the guest operating system ' s own boot process. Performance diagnostics is a tool aimed at identifying in-guest performance bottlenecks, such as high CPU or disk latency, on a virtual machine that is already running and reachable, which does not apply to a VM that is failing to start in the first place. Diagnose and solve problems surfaces general, guided troubleshooting articles and automated checks rather than raw serial console output, and Change tracking records configuration and file changes over time rather than capturing boot-time console logs, so Boot diagnostics is the only listed option that actually provides the serial log needed to identify this startup issue.

Preparation: Shut down VM1. Memory configuration on VM1: Disable Dynamic Memory. PCIe NVMe configuration on HV1: Dismount Device1.

Discrete Device Assignment can only be attached to a virtual machine while that VM is completely powered off, not merely saved or paused, since the assignment operation reconfigures the VM ' s underlying hardware resource list at the virtualization stack level, an operation that requires the VM to be in the Off state; saving or pausing VM1 would leave its running state (and its currently assigned resources) intact rather than allowing the new device to be added, so shutting down VM1 is the necessary preparation step. Dynamic Memory must be disabled on any VM that will use DDA because DDA-assigned devices, being passed through directly to the VM with minimal hypervisor mediation, are incompatible with the memory ballooning and hot-add/remove behavior Dynamic Memory performs, and Hyper-V will not permit DDA assignment to a VM with Dynamic Memory still enabled; increasing the memory buffer or setting memory weight to High only adjusts Dynamic Memory ' s own behavior and does not resolve the incompatibility. On the host side, a device slated for DDA use must first be dismounted from the host ' s own device tree, using Dismount-VMHostAssignableDevice, which detaches it from HV1 ' s host operating system (which cannot use it while it is assigned) without physically removing it, making it available to be mounted into the VM afterward with Add-VMAssignableDevice; simply enabling the device (it is already disabled and DDA-capable, not needing re-enabling for this step) or removing it entirely goes beyond what this specific assignment preparation requires.

Application Control policies (Windows Defender Application Control / App Control for Business) log every policy-load, allow, and block decision to the CodeIntegrity/Operational event log, including the event that confirms a policy has been successfully refreshed and is being enforced on the local computer. AppLocker ' s MSI and Script log only records AppLocker rule evaluations, which is a separate feature from Application Control policies, and the DeviceManagement-Enterprise-Diagnostic-Provider log relates to MDM enrollment diagnostics, not application control enforcement. Reviewing CodeIntegrity/Operational on Server1 is therefore the correct way to confirm Policy1 has taken effect, since the event log records the policy ' s GUID and version each time it is loaded, letting an administrator match the deployed policy to the one actually running on Server1 ' s code integrity subsystem. Event ID 3099 in that log specifically indicates a policy was refreshed successfully, while block events such as 3077 or 3089 would appear there too if an executable outside the allowed rules were later denied.

Adding or in-place upgrading a domain controller to Windows Server 2025 requires the forest functional level to be at least Windows Server 2016, and a forest functional level can never exceed the domain functional level of any domain in the forest, including the forest root. Because contoso.com, the forest root, is currently at the Windows Server 2012 R2 domain functional level, the forest functional level is capped below Windows Server 2016 even though east.contoso.com already sits at the Windows Server 2016 domain functional level. Raising contoso.com ' s domain functional level to Windows Server 2016 removes that ceiling and is therefore the necessary first step before the forest functional level can be raised and the east.contoso.com domain controllers upgraded in place to Windows Server 2025 with minimal additional effort. Extending the schema or attempting to raise the forest functional level directly would fail at this point, since the forest-level ceiling imposed by contoso.com ' s own domain functional level has not yet been lifted.

Statement 1: No. Statement 2: Yes. Statement 3: No.

When a user accesses a file over the network through a share, the effective permission is always the more restrictive of the share permission and the NTFS permission, evaluated separately for each specific right. The Domain Users share permission on Share1 grants only Change and Read, not Full Control, so no member of Domain Users can exercise Full-Control-only special permissions, such as Take Ownership, through the share, no matter what NTFS grants. User1 has NTFS Full Control on File1.txt, but because the share caps everyone in Domain Users at Change, User1 cannot take ownership when connecting via \\Server1.adatum.com\Share1\, so statement 1 is false. Share1 has Access-Based Enumeration enabled, which hides items from a directory listing only when a user has no access to them at all, but still shows anything the user can at least read. User2 has NTFS Read on File1.txt, which combined with the share ' s Read/Change grant gives User2 effective read access, so File1.txt is visible to User2, making statement 2 true. User3, however, has only NTFS Write on File1.txt with no Read permission at all; without at least read-level access, Access-Based Enumeration hides the file from User3 ' s listing, so statement 3 is false.

New-AzADServicePrincipal -DisplayName ' arc-for-servers ' -Role ' Azure Connected Machine Onboarding '

At-scale onboarding to Azure Arc with a deployment script authenticates using a service principal rather than an interactive sign-in, and Microsoft ' s guidance for scripted, least-privilege onboarding is to create that service principal with New-AzADServicePrincipal, supplying a -DisplayName and assigning it the built-in Azure Connected Machine Onboarding role, optionally scoped to a specific resource group with -Scope. This role grants only the permissions required to register a machine with Arc and complete the connect operation; it does not include general compute, storage, or networking rights, which is why it satisfies least privilege far better than a broad role such as Contributor. The other two cmdlets in the option list do not fit this task: New-AzADAppCredential only adds or rotates a credential (secret or certificate) on an application object that already exists, and it performs no role assignment; New-AzUserAssignedIdentity creates a standalone managed identity resource, which is a different authentication mechanism used by Azure resources calling other Azure services, not a mechanism a locally run onboarding script can use to authenticate against an Azure AD tenant. For the role value, Virtual Machine Contributor and Virtual Machine User Login both exceed what onboarding needs, since they grant ongoing VM management or interactive sign-in rights rather than the narrow, one-time registration permission the Azure Connected Machine Onboarding role provides.

Migrating an IIS site with Web Deploy in the shortest time and with the least administrative effort is done by installing the Web Deployment Tool on the source server (Server1) and starting its remote agent service, msdepsvc, so the source can act as a remote sync endpoint. The actual synchronization is then triggered from the destination server (Server2) by running msdeploy.exe with the -verb:sync parameter, pulling Site1 ' s content and configuration directly from Server1 over the remote agent connection in a single pass, rather than exporting and importing packages manually. This is the standard remote-to-remote Web Deploy migration pattern for moving an IIS site between servers, and it avoids the intermediate package files and manual import steps that a packaged export/import approach would otherwise require, which is why it minimizes both migration time and administrative effort compared with alternatives such as the Windows Server Migration Tools feature. Running smigdeploy.exe on Server2 instead would only prepare that server for the unrelated general-purpose Windows Server Migration Tools workflow, which packages and transfers role/feature settings rather than syncing a live IIS site ' s content directly.

A Planned Failover in Hyper-V Replica requires the source (primary) virtual machine to be gracefully shut down and reachable so that any final, not-yet-replicated changes can be sent across before the role formally switches to the replica -- a precondition that cannot be met when the primary host itself has suffered a hardware failure and is unreachable. Because Server1 has failed and VM1, VM2, and VM3 cannot be contacted, gracefully shutting them down is impossible, ruling out Planned Failover as an option. Instead, the administrator must perform an Unplanned Failover from Hyper-V Manager on Server2, which brings each replica virtual machine online using whatever data was most recently replicated (and, if recovery points are configured, the most recent available recovery point) without requiring any action on, or connectivity to, the failed primary host. This is the recovery path specifically documented for unexpected primary-host outages, in direct contrast to Planned Failover, which is reserved for scheduled maintenance or controlled, orderly migrations where the primary is still running. " Start " merely powers on an existing VM without invoking replica failover logic, and " Move " performs a live or quick migration that requires the source host to be online, so neither applies here. Therefore, Unplanned Failover is the correct action for each virtual machine.

Among Server1 ' s four printers, only Printer4 is configured to use the FILE: port, meaning it is the one printer whose output is directed into a file rather than to a physical parallel port, a local port, or a network TCP/IP port; Printer1 uses an LPT1 parallel port, Printer2 uses a local port, and Printer3 uses a Standard TCP/IP port pointed at a specific IP address, so none of those three writes to a file. Because the Print to File capability is a property of the port a printer is connected to rather than something that changes during migration, Printer4 remains the only migrated printer on Server2 that can print to file after the move. Print Management ' s printer migration wizard, built on Printbrm.exe, carries over each printer ' s assigned security permissions along with the print queue and driver during the export and import process, and since Group1 already holds print permission on all four printers as configured on Server1, that same permission is preserved for all four printers once they are migrated to Server2. As a result, Group1 members retain the ability to print to Printer1, Printer2, Printer3, and Printer4 after the migration, since the migration process did not remove or narrow any of Group1 ' s existing print permissions on any of the four queues.

New-ADServiceAccount " Account1 " -DNSHostName " website.contoso.com " -PrincipalsAllowedToRetrieveManagedPassword " Group1 "

Creating a group managed service account (gMSA) is done with New-ADServiceAccount, which both creates the account object and defines the service ' s DNS host name association via -DNSHostName (used for the SPN). Controlling which computers or groups are permitted to actually use the gMSA -- that is, retrieve its automatically managed password so services running as that identity can authenticate -- is done with the -PrincipalsAllowedToRetrieveManagedPassword parameter, which accepts computer accounts or, as here, a security group. Adding a group to this parameter means any computer that is a member of that group can use the gMSA without further per-computer modification. The distractor parameter -AuthenticationPolicy assigns a Kerberos authentication policy (used for tools such as Protected Users and Authentication Policy Silos) to control ticket lifetimes and authentication restrictions; it has nothing to do with granting principals the right to retrieve a gMSA ' s password. Because the requirement is specifically that Group1 must be able to use Account1, the completed cmdlet must be New-ADServiceAccount " Account1 " -DNSHostName " website.contoso.com " -PrincipalsAllowedToRetrieveManagedPassword " Group1 " . After running this cmdlet, member computers of Group1 also need the Install-ADServiceAccount cmdlet run locally to install the gMSA before any service on those computers can actually run under the account.

Statement 1: No. Statement 2: Yes. Statement 3: Yes.

Forest trusts are transitive across every domain within each of the two forests they connect but are never transitive into a third, unrelated forest, so a forest trust between contoso.com and fabrikam.com and a separate trust involving adatum.com and research.fabrikam.com do not chain together; contoso.com has no trust relationship of any kind with adatum.com ' s forest, so contoso.com users cannot access resources in adatum.com after both trusts are configured, making statement 1 false. The Contoso-Fabrikam requirement needs every domain in either forest to reach every domain in the other, which is precisely what a single two-way forest trust provides, since forest trust transitivity automatically extends to every child domain in both forests (contoso.com, europe.contoso.com, asia.contoso.com, fabrikam.com, and research.fabrikam.com), so statement 2 is true and no additional external or domain trusts are needed. The Adatum-Fabrikam requirement is narrower, needing only adatum.com ' s users to reach a single domain, research.fabrikam.com; a one-way external trust in which research.fabrikam.com is the trusting domain and adatum.com is the trusted domain grants exactly that direction of access (the trusting domain permits authorized users of the trusted domain to access its resources), and since only one specific domain pair needs access, the external trust ' s non-transitivity is not a limitation here, so statement 3 is true.

Server1: File1.txt, File2.docx, File3.sys, and File4.bmp; Server2: File1.txt only

Data Deduplication optimizes files by replacing their contents with a reparse point that references chunks stored in the Chunk Store, but it never optimizes files smaller than the 32 KB minimum file size threshold -- those remain ordinary, unmodified files on the volume. Of the four files, only File1.txt (5 KB) falls below that threshold; File2.docx (800 KB), File3.sys (2 MB), and File4.bmp (5 GB) are all well above it, and Microsoft ' s documentation confirms Data Deduplication has no default extension- or type-based exclusions (exclusions by file type or folder are purely administrator-configured and empty by default), so in steady state all three larger files would have been optimized into chunk-store reparse points. When Disk1 is attached to Server1, which has the Data Deduplication role service installed, the Dedup filter driver is present and can resolve every reparse point back into real data, so all four files -- File1.txt, File2.docx, File3.sys, and File4.bmp -- are fully recoverable. When Disk1 is attached to Server2, which does not have Data Deduplication installed, the filter driver needed to reconstruct optimized files is absent; Microsoft ' s troubleshooting documentation confirms that attempting to open an optimized file without the Dedup role produces an access error (ERROR_CANT_ACCESS_FILE) until the role is installed and the volume re-enabled. Only File1.txt, which was never optimized in the first place, remains a plain, directly readable file on Server2; the other three are inaccessible there.

Azure Migrate: Server Migration requires that any BitLocker-encrypted operating system disk be decrypted before that machine can be discovered and migrated, since the replication process cannot properly read and transfer an encrypted OS volume, so Server1, which has BitLocker Drive Encryption enabled on its OS disk, is disqualified from migration regardless of its OS disk otherwise being within supported size limits. The maximum operating system disk size supported for a generation 2 Azure virtual machine is up to 4 TB, compared to the lower 2 TB limit that applies to generation 1 VMs, and Server2 ' s 2,000 GB OS disk and Server3 ' s 4,000 GB OS disk both fall within that generation 2 limit, so neither server is blocked by disk size, and neither has BitLocker enabled, so neither is blocked on that front either. Because Server1 is excluded solely due to its unresolved BitLocker encryption while Server2 and Server3 have no disqualifying configuration at all, Server2 and Server3 only is the correct set of servers that can be migrated to Azure generation 2 virtual machines by using Azure Migrate in this scenario.

When an application extends the on-premises AD DS schema by adding new custom attributes after Microsoft Entra Connect has already been installed and configured, the sync engine ' s local, cached copy of the AD schema (used to populate the attribute-selection lists for sync rules and attribute mappings) does not automatically become aware of the newly added attributes. Microsoft Entra Connect provides a " Refresh directory schema " task, run from the Microsoft Entra Connect wizard, specifically to re-read the current AD DS schema and update the sync engine ' s local metadata so that the newly introduced custom attributes become visible and selectable for synchronization rules and attribute-flow configuration. Only after this refresh has completed can an administrator configure a rule (via directory extension attribute sync, or a custom sync rule) that actually flows the new attributes to Microsoft Entra ID, at which point they would finally be queryable from Azure Cloud Shell (for example, via Microsoft Graph). " Configure device options " pertains to device registration/writeback settings, not attribute sync. " Customize synchronization options " is used to reconfigure existing sync features (such as enabling or changing which optional features are active) and, without a preceding schema refresh, still would not expose attributes the sync engine ' s cached schema doesn ' t yet know about. " Manage federation " configures AD FS/federation trust settings and is unrelated to attribute synchronization. Therefore, the first task to perform is to refresh the directory schema.

A standard Azure VM backup policy supports only one backup operation per day, so the most frequent schedule it can be configured to run at is once every 24 hours, and no more granular interval is exposed for that policy type regardless of how the schedule is configured. The enhanced backup policy, which was introduced to also add support for features such as protecting Trusted Launch virtual machines and taking multiple restore points within a single day, allows an hourly-style backup schedule with a configurable interval chosen from 4, 6, 8, 12, or 24 hours, giving it a minimum, and therefore most frequent, recovery point objective of 4 hours between backups. Selecting the enhanced policy and configuring it with the smallest available interval of 4 hours minimizes potential data loss far more effectively than the standard policy ' s once-daily cadence can, since a VM protected this way is never more than 4 hours behind its last successful recovery point, compared with up to a full day of exposure under the standard policy ' s single daily backup.

Server1 ' s only interface, NIC1 (172.16.0.1/24), sits on the same subnet as Server2 ' s NIC2 (172.16.0.100/24), which is also configured as Server1 ' s default gateway, so Server1 can reach itself and NIC2 directly. Server2 has no IP routing or RRAS enabled to forward packets between its two NICs, so traffic aimed at the 192.168.15.0/24 or 131.107.0.0/24 subnets is never relayed on Server1 ' s behalf, and those destinations are unreachable from Server1. Server2 can likewise reach every address on its own two directly connected subnets: NIC1 and NIC2 on 172.16.0.0/24, plus NIC3 and NIC4 on 192.168.15.0/24, since NIC4 shares that same subnet as NIC3. However, NIC3 has no gateway configured pointing at Server3 ' s NAT interface, so Server2 has no route to the 131.107.0.0/24 network and cannot reach NIC5. Because Server3 ' s role as a NAT gateway only translates outbound traffic that is actually routed to it, and neither Server1 nor Server2 has the routing or gateway configuration needed to send traffic that far, connectivity in both cases is limited strictly to each server ' s directly attached subnets rather than extending across the NAT boundary toward the internet-facing side.

The infrastructure master ' s job is to periodically compare its domain ' s phantom records (placeholder stubs created for objects, such as group members, referenced from other domains) against the full, current data held by a global catalog, and to update any phantom found to be stale, which is how cross-domain object references stay current; this comparison only produces useful updates when the infrastructure master itself is NOT a global catalog server, because a domain controller that is also a global catalog already holds a complete, up-to-date replica of every object in the forest and therefore never perceives any of its own phantoms as stale, silently skipping updates that a non-GC infrastructure master would have caught and propagated. In this forest, DC1 holds the infrastructure master role for contoso.com and is also a global catalog server, which is precisely the unsupported combination (permitted only in a single-domain forest or when every DC in the domain is a GC, neither of which applies here) that causes exactly the symptom described: cross-domain references in contoso.com failing to update for branch.contoso.com objects. Transferring the infrastructure master role for contoso.com from DC1 to DC2, which is not a global catalog server, resolves the issue with a single, minimal role transfer. Transferring the PDC emulator, schema master, or domain naming master roles would not affect phantom/cross-domain reference updates at all, and DC4 already correctly holds branch.contoso.com ' s infrastructure master role on a non-GC server.

BitLocker: C, D, E, and F. Auto-unlock: D, E, and F only.

BitLocker Drive Encryption can be enabled on every volume shown in Server4 ' s disk configuration -- the NTFS-formatted operating system volume (C:), the NTFS data volume (D:), and the two ReFS-formatted data volumes (E: and F:). BitLocker has no file-system restriction that excludes ReFS: Microsoft ' s ReFS documentation and BitLocker ' s own volume support explicitly confirm that ReFS-formatted volumes, including already-encrypted ones that are later expanded, are fully supported, so E: and F: are just as eligible for BitLocker as the NTFS volumes. BitLocker auto-unlock, however, is a feature limited to fixed data volumes: it lets a data volume unlock automatically at startup using a key protected by the already-unlocked operating system volume, and it is not applicable to the OS volume itself, since the OS volume instead relies on the TPM (or a startup key/PIN) to unlock during boot -- there is no separate outer volume for it to depend on. Because C: is the operating system volume, auto-unlock cannot be configured on it, leaving D:, E:, and F: as the volumes eligible for auto-unlock. Therefore, BitLocker can be turned on for all four volumes (C, D, E, and F), while auto-unlock is available only on the three data volumes (D, E, and F).

Signing in over Remote Desktop requires a user to hold the " Allow log on through Remote Desktop Services " right and the " Access this computer from the network " right, and to be excluded from any matching Deny counterpart, since an explicit Deny always overrides an Allow granted through any other group membership. User1 is a member of Group2 (granted the Remote Desktop Services logon right) but is also a member of Group4, which is explicitly denied " Access this computer from the network " on Server4 -- that network-access denial blocks the RDP connection outright regardless of the Everyone-based network-access Allow or the RDS logon right, so User1 is denied. User2 belongs only to Group2: Group2 grants the RDS logon right, User2 is covered by the Everyone-based network-access Allow, and User2 is not a member of either Group3 or Group4, so neither Deny applies and User2 can sign in successfully. User3 is a member of Group3, which is explicitly denied " Allow log on through Remote Desktop Services " on Server4 -- that denial blocks the RDP logon right itself, so User3 cannot sign in regardless of network-access rights (and User3 is also in Group4, which independently denies network access as well). Therefore, only User2 can successfully sign in to Server4 using Remote Desktop.

Backing up a standalone Windows Server ' s files, folders, and system state directly to an Azure Recovery Services vault -- exactly what the requirement calls for on Server4 -- is done using the Microsoft Azure Recovery Services (MARS) agent, so installing that agent on Server4 is the necessary first step. Microsoft Azure Backup Server (MABS) is used for application-aware and Hyper-V virtual machine backups rather than direct file/system-state backup of a single standalone server, and while it can also protect servers, it is not the lightweight, direct-to-vault mechanism appropriate for a single standalone server like Server4 and represents unnecessary additional infrastructure. Native Windows Server Backup does not target an Azure Recovery Services vault on its own without additional agent installation, and Storage Replica provides block-level volume replication between servers rather than the point-in-time backup and long-term retention the requirement calls for. Therefore, installing the MARS agent on Server4 is the correct first step to meet this technical requirement.

User1: 9. Admin1: 8.

Fine-grained password policies delivered through Password Settings Objects (PSOs) take precedence over the domain-wide Default Domain Policy for any user they apply to. When more than one PSO would apply to the same user only through different group memberships (as opposed to one being linked directly to the user), the PSO with the lowest numeric precedence value wins. User1 is a member of both Group2 (targeted directly by PSO1, precedence 10, minimum password length 9) and Group4 (targeted directly by PSO2, precedence 20, minimum password length 11); since PSO1 ' s precedence value of 10 is lower than PSO2 ' s 20, PSO1 governs, giving User1 an effective minimum password length of 9. Admin1 is a member only of Domain Admins, which is not targeted by either PSO, so no fine-grained password policy applies. Admin1 is also in OU1, which has GPO1 linked to it with a minimum password length of 10, but Account Policy settings such as password policy configured in an OU-linked GPO never affect the effective password policy of domain user accounts -- only a GPO linked at the domain root can supply a fallback domain-wide default, and PSOs otherwise take precedence over that default. With no applicable PSO, Admin1 ' s effective policy falls back to the Default Domain Policy, whose minimum password length in this environment is 8.

Storage Migration Service is designed to migrate a file share such as Share1 to a new server (Server2) while carrying over both the share-level and NTFS folder/file permissions, and it can also perform a cutover of the source server ' s name and IP address if a fully transparent migration is later required. This directly satisfies the requirement to migrate Share1 to Server2 including all the share and folder permissions. File Server Resource Manager (FSRM) only provides quota, file-screening, and storage-reporting capabilities and has no mechanism to migrate data, shares, or permissions between servers. Server Manager is a general-purpose administration console with no dedicated share-migration workflow -- it can be used to create shares manually but cannot transfer existing permissions programmatically. Storage Replica performs block-level volume replication intended for disaster recovery and stretch-cluster scenarios rather than a one-time, permission-preserving share migration to a specific destination server. Therefore, Storage Migration Service is the correct tool to migrate Share1 to Server2 while preserving its share and folder permissions.

The Azure Site Recovery Provider must be installed and registered on every Hyper-V host that is a node of the cluster being protected, because each node is a location the protected virtual machines could reside on after a live migration, and each node must independently be able to track and replicate the VMs it is currently hosting. Cluster2 has four nodes according to the Hyper-V failover clusters table (Cluster1 has six nodes and eighteen virtual machines, Cluster2 has four nodes and twelve virtual machines, and Cluster3 has two nodes and six virtual machines), so a minimum of four Provider installations -- one per node -- is required; installing the Provider on only one, two, or three of the nodes would leave replication unable to follow a protected VM if it live-migrated to whichever node lacks the Provider, breaking continuous replication for that VM the moment it moved. Therefore, four is the minimum number of Azure Site Recovery Provider installations required to fully protect all of Cluster2 ' s virtual machines regardless of which node currently hosts them.

1. Create an Azure Recovery Services vault. 2. Create a Hyper-V site. 3. Install and register Azure Site Recovery Providers. 4. Create and associate replication policies.

Setting up Azure Site Recovery for a Hyper-V cluster that is not managed by Virtual Machine Manager follows a fixed infrastructure-preparation order. An Azure Recovery Services vault must exist first, since it is the container that every later step registers against. A Hyper-V site is then created in that vault to represent the on-premises Hyper-V environment, because a Hyper-V host or cluster must belong to a site before its hosts can be registered against Azure Site Recovery. The Azure Site Recovery Provider is then installed on the Hyper-V hosts (Cluster2 ' s nodes) and registered to that site/vault, which is what actually connects the cluster nodes to Azure Site Recovery. Only once the hosts are registered can a replication policy be created and associated with the Hyper-V site, since a policy has nothing to attach to until the site and its registered hosts already exist. Installing Azure Connected Machine agents is unrelated to Hyper-V VM replication -- that agent is used for onboarding servers to Azure Arc -- and is not part of this workflow. Therefore, the correct order is: create the vault, create the Hyper-V site, install and register the Providers, and create and associate the replication policy.

Server1 can communicate with: Server2, Server3, and Server4. Server3 can communicate with: Server1 and Server2 only.

Server4 has no isolation connection security rule configured at all, so it never attempts or performs IPsec authentication with any peer. Server1 ' s rule only requests IPsec in both directions rather than requiring it, meaning that if IPsec negotiation does not occur -- as with Server4, which has no IPsec capability configured -- the connection still falls back to succeed in the clear; Server1 can therefore reach Server2, Server3, and Server4. Server3 ' s rule requires IPsec in both directions, meaning a connection only succeeds if IPsec authentication is actually negotiated. Server3 can successfully negotiate IPsec with Server1 (whose " request " setting means it will still respond to and complete an IPsec negotiation when the peer requires it) and with Server2 (which requires inbound and requests outbound IPsec, and likewise supports negotiation), so both of those connections succeed. Server3 cannot successfully negotiate IPsec with Server4, since Server4 has no IPsec capability configured at all, and Server3 ' s " require " setting blocks any connection that cannot be authenticated via IPsec. Therefore, Server1 can communicate with Server2, Server3, and Server4, while Server3 can communicate with only Server1 and Server2.

Restoring deleted objects from the Active Directory Recycle Bin requires permission to view and restore objects inside the forest ' s Deleted Objects container, and by default that container ' s access control list denies access to everyone except the SYSTEM account and members of Domain Admins (and Enterprise Admins at the forest root) -- no delegation to any other built-in group exists out of the box. Among the four groups offered, only Domain Admins carries this permission by default, since Account Operators (which can manage most user, group, and computer objects but has no special access to the hidden Deleted Objects container), Schema Admins (which governs schema modifications, not object restoration), and Backup Operators (which can back up and restore files and the system state, but not perform an online Active Directory Recycle Bin object restore through the Active Directory Administrative Center) all lack the needed access. The case study ' s general instruction to use the principle of least privilege where possible does not change this outcome here, since none of the three lower-privileged alternatives actually has the required capability by default -- Domain Admins is not merely the most convenient choice but the only one of the four that functionally works. Therefore, User1 must be added to Domain Admins to be able to recover objects from the Active Directory Recycle Bin.

On the domain controllers: Install the Azure Monitor agent. In Azure: Create an Azure Log Analytics workspace.

Centrally managing performance alerts in Azure for on-premises domain controllers is done by connecting those servers to Azure Monitor: the Azure Monitor agent is installed on each domain controller (onboarded to Azure Arc for non-Azure servers, or directly if they are Azure VMs) to collect performance counters and event data, and that telemetry is sent to an Azure Log Analytics workspace, which is the resource that stores the collected data and against which performance-based alert rules are then defined and centrally managed. Creating a Data Collector Set in Performance Monitor and modifying the Performance Monitor Users group are both local, per-server administrative actions that never send any data to Azure and cannot support central, Azure-based alerting. An Azure SQL database, a Storage Sync Service, and an Azure Storage account are all Azure resources, but none of them is the telemetry store that Azure Monitor ' s alerting pipeline is built on -- only a Log Analytics workspace serves that role. Therefore, installing the Azure Monitor agent on the domain controllers and creating an Azure Log Analytics workspace are the two required actions.

Promoting a new domain controller that runs a newer operating system version than any existing domain controller in the forest -- here, DC4 running Windows Server 2022 into a forest whose functional level is still Windows Server 2012 R2 -- requires the Active Directory schema to first be extended to support that OS version ' s schema additions (the adprep /forestprep and /domainprep operations, which modern promotion tools such as Install-ADDSDomainController run automatically when needed). Extending the schema requires connectivity to the domain controller holding the Schema Master FSMO role, since schema changes can only be made by contacting that specific role holder; if the Schema Master is offline, the schema extension step fails and the promotion cannot proceed. According to the domain controllers table, DC1 holds both the RID master and the schema master roles. DC2 holds the PDC emulator and infrastructure master roles, and DC3 holds the domain naming master role -- neither of those role sets is relevant to a schema extension. Therefore, DC1, as the Schema Master, must be online for DC4 ' s promotion (and its associated schema extension) to succeed.

Using Hyper-V Replica within a clustered Hyper-V environment such as Cluster3 requires deploying the Hyper-V Replica Broker, which itself runs as a clustered role on the failover cluster; without the Broker, replication cannot follow a protected virtual machine if it live-migrates between Cluster3 ' s nodes, since there would be no single, cluster-aware endpoint tracking which node currently owns each VM ' s replication state. Adding a failover cluster role is exactly how the Hyper-V Replica Broker is deployed onto Cluster3, satisfying the requirement to use Hyper-V Replica to protect Cluster3 ' s virtual machines. Enabling integration services on the virtual machines addresses guest-OS-to-host integration (time synchronization, heartbeat, and similar) rather than providing any replication capability. Adding a generic Windows Server server role does not, by itself, install or configure the Hyper-V Replica Broker -- the Broker must specifically be added as a clustered role through Failover Cluster Manager. Configuring a fault domain for the cluster is not a real Windows Server failover clustering concept and does not provide Hyper-V Replica capability. Therefore, adding a failover cluster role (the Hyper-V Replica Broker) is the correct solution for Cluster3.

Task1 is an Azure Automation runbook, and Azure Automation supports a specific, limited set of runbook types: PowerShell (and PowerShell Workflow), Python, and Graphical runbooks (which are authored visually rather than in a scripting language). Of the listed options, PowerShell and Python are the two genuine scripting languages Azure Automation lets you author a runbook in directly, making them the two correct answers. Java and JavaScript are not supported runbook languages in Azure Automation; JavaScript is used elsewhere in Azure (for example, in Azure Functions or Logic Apps custom code), but not for Automation runbooks. Bicep is a domain-specific language for declaratively defining Azure infrastructure as code (compiling down to ARM templates) and has no role as an executable runbook language; you would not write a Task1 runbook in Bicep, since runbooks execute imperative logic rather than declare resource deployments. Therefore, Python and PowerShell are the two languages available for Task1.

Enabling Microsoft Entra ID sign-in on an Azure VM running Windows is implemented through a VM extension named AADLoginForWindows, published by Microsoft.Azure.ActiveDirectory. This extension installs the components needed for the VM to accept Microsoft Entra credentials for RDP sign-in and, when combined with Azure RBAC roles such as Virtual Machine Administrator Login, controls who is authorized to sign in. VM extensions in Azure are deployed and managed with the Set-AzVMExtension cmdlet, which is how this specific extension gets installed onto Server1. Set-AzVM modifies general virtual machine properties, such as size or OS profile settings, but has no mechanism for installing extensions. Add-ADComputerServiceAccount and New-ADComputer are on-premises Active Directory cmdlets used to manage computer objects and service accounts in AD DS; they have no relevance to an Azure VM ' s sign-in method and would not apply here since Server1 ' s sign-in requirement is being satisfied by Microsoft Entra ID, not by joining a domain. Set-AzVMExtension is therefore the correct cmdlet.

1. Deploy the Azure Storage Sync service. 2. Install and register the Azure File Sync agent. 3. Create a sync group. 4. Add a server endpoint.

Data1 is a file share on VM1 that must be synced to the Azure Files share1 using Azure File Sync. The documented deployment order starts in Azure: you must first deploy a Storage Sync Service resource, because the on-premises agent registration process needs an existing Storage Sync Service to register against. With that resource in place, the next step, already fixed in the sequence, is to install the Azure File Sync agent on VM1 and register the server with the Storage Sync Service, which establishes the server ' s identity and trust relationship with Azure. After registration, you create a sync group, the container that pairs one Azure file share (the cloud endpoint) with one or more on-premises folders (server endpoints); the sync group must exist before endpoints can be attached to it. Finally, you add a server endpoint pointing at the Data1 path on VM1, which starts the actual namespace and content synchronization with share1. Installing the DFS Replication role service and installing the Storage Replica feature are unrelated technologies, DFS-R replicates between on-premises servers and Storage Replica performs block-level volume replication, neither of which is part of an Azure File Sync deployment, so both are correctly excluded from the sequence.

hvc.exe, ssh User2@VM2

The requirement is to use a direct SSH session to manage all the supported virtual machines on HyperV1, without relying on a network path to the guest. Hyper-V provides hvc.exe, a helper used as an SSH ProxyCommand, that opens an SSH session to a virtual machine over the VMBus (the internal Hyper-V socket/console channel) rather than over the network, which works even when the guest has no reachable IP configuration and only default management tools installed, matching the stated environment. Direct SSH management this way requires the guest to run an SSH server; of the three VMs, only VM2 runs Red Hat Enterprise Linux, which includes OpenSSH server support out of the box, so it is the only VM realistically " supported " for this direct SSH scenario as described, and the account to use is User2, the local account that exists on VM2. VM1 and VM3 both run Windows Server, so " direct SSH, " as intended by this requirement, targets the Linux guest. Connect-PSSession and Connect-WSMan are PowerShell remoting tools, not SSH, and mstsc.exe launches a graphical Remote Desktop session rather than a console-mode SSH session, so none of those alternatives fit. The correct combination is hvc.exe used as the SSH proxy, connecting as User2@VM2.

The Marketing OU users exist in fabrikam.com, a completely separate on-premises AD DS forest belonging to a different company than A. Datum, whose own Microsoft Entra tenant only syncs the adatum.com forest today. To give those Fabrikam users access to storage1 in A. Datum ' s tenant, their identities must also be represented in that tenant. Microsoft Entra Connect cloud sync uses lightweight, cloud-managed provisioning agents that are specifically designed to support complex or multi-forest topologies, including syncing from a partner organization ' s forest, with a much smaller on-premises footprint and configuration burden than the full Microsoft Entra Connect Sync engine, and without requiring a trust relationship between the two companies ' forests. The traditional Microsoft Entra Connect Sync engine (whether in active or staging mode) is built around a single organization ' s identity infrastructure and is a heavier deployment to extend safely across an independent partner company ' s forest; staging mode specifically only prepares a secondary sync server to take over, and does not by itself address the cross-company sync problem. AD FS provides federation and SSO but does not create Microsoft Entra ID objects for Fabrikam ' s users. Microsoft Entra Connect cloud sync is therefore the correct, purpose-built option.

Private1 is deployed with its inbound endpoint in VNet1, and an Azure DNS Private Resolver inbound endpoint can resolve only private DNS zones that are virtual-network-linked to the same virtual network where the resolver itself sits; it cannot resolve a zone just because it exists in the same subscription, or because that zone happens to be linked to a different, unrelated virtual network. Per the private DNS zone table, Zone1.com is linked to VNet1, Zone2.com is linked to VNet2, and Zone3.com has no virtual network link at all. Because Private1 ' s inbound endpoint lives in VNet1, only Zone1.com, the zone actually linked to VNet1, can be resolved through it. Zone2.com cannot be resolved by Private1 because it is linked only to VNet2, a separate virtual network with no stated peering or additional resolver configuration connecting it to VNet1; and Zone3.com cannot be resolved by any resolver in any virtual network because it has no virtual network link whatsoever, meaning no virtual network can consult it through the normal Azure-provided DNS resolution path. Extending resolution to Zone2.com would require either a separate resolver deployed in VNet2, or peering combined with a forwarding ruleset and outbound endpoint, neither of which is described as being configured here. Therefore only Zone1.com can currently be resolved.

Azure Automanage currently does not support virtual machines that use the Trusted launch security type; this is an explicit, documented limitation of the service, independent of which Windows Server version or edition the VM is running. Looking at the four virtual machines ' security types, Server1 (Windows Server 2022 Datacenter: Azure Edition) and Server4 (Windows Server 2019 Datacenter) are both configured with Trusted launch, which makes both of them ineligible for Automanage onboarding regardless of their OS version. Server2 (Windows Server 2022 Datacenter: Azure Edition) and Server3 (Windows Server 2022 Datacenter) both use the Standard security type and run OS versions on Automanage ' s supported list, so both qualify and Automanage should be enabled on them to satisfy the requirement that it be used on " all supported " virtual machines, which by definition excludes the ones the service cannot onboard. It is a common misreading of this scenario to assume the Azure Edition label is the deciding factor, since Server1 and Server2 share that edition; the actual determining attribute the requirement hinges on is the VM ' s security type, not its Windows Server edition. Therefore Server2 and Server3 are the correct machines on which to enable Automanage.

The requirement is that VMs must be configured to enable per-folder quotas. VM3 already has the File and Storage Services role installed, but native NTFS quotas only apply per volume and per user; they cannot restrict the amount of data stored inside an individual folder. File Server Resource Manager (FSRM) is the Windows Server feature that adds true folder-level quota management, letting an administrator define hard or soft quota limits (and quota templates) scoped to specific folders rather than entire volumes, which is exactly the granularity the requirement calls for. Enhanced Storage is an unrelated feature that supports certain storage devices with enhanced storage access (IEEE 1667), Windows Standards-Based Storage Management provides SMI-S/WMI-based management of storage arrays and has nothing to do with folder-level quotas, and the iSNS Server service is used for discovery of iSCSI targets and initiators on a network, also unrelated to quota enforcement. None of those three alternatives provide any per-folder capacity restriction capability, so installing FSRM is the necessary first step before per-folder quotas can be configured on VM3.

1. roles 2. connections 3. connect to server dc2.adatum.com 4. quit 5. seize schema master

Because DC1 has failed and cannot gracefully transfer the schema master role, DC2 must forcibly seize it using ntdsutil.exe. From the initial ntdsutil prompt, the first command is roles, which enters the Role Management submenu where FSMO role transfers and seizures are performed. From within that submenu, the command connections opens the Connections submenu, which is required before you can bind ntdsutil to a specific target domain controller. Inside the Connections submenu, connect to server dc2.adatum.com establishes the bind to DC2, the domain controller that will actually take over the schema master role. The quit command then exits the Connections submenu and returns to the Role Management submenu while keeping the established connection to DC2 active. Finally, seize schema master, executed from the Role Management submenu while bound to DC2, forces DC2 to take ownership of the schema master role even though DC1 (the previous holder) is offline and cannot be contacted to confirm the transfer. The unused command in the list, metadata cleanup, is a separate, later step used to remove the failed DC1 ' s leftover directory metadata once its roles have been reassigned; it is not part of seizing the schema master role itself, so it is correctly left out of this five-step sequence.

Disk1: 2. Disk2: 1.

The requirement is that data on SSPace1 must remain available at all times, meaning the storage pool ' s virtual disks must be able to tolerate physical disk failures without becoming unavailable or losing data. A three-way mirror keeps three copies of every block of data spread across different physical disks, so it remains available and readable even if any two of those disks fail simultaneously; the resiliency is fixed at tolerating two failures regardless of how many total disks (8, in Disk1 ' s case) make up the pool, as long as there are enough disks to support three-way mirroring, which eight comfortably provides. Disk2 uses parity resiliency, which stores a single parity block that can reconstruct data after one physical disk failure; unless dual parity is explicitly configured (which requires being set at virtual disk creation time and is not indicated here), a standard parity virtual disk tolerates only one physical disk failure before data becomes unavailable, regardless of the pool having twelve physical disks. Administrators sometimes assume more disks in a parity pool automatically means more fault tolerance, but the number of disks a parity space can lose is determined by the resiliency configuration (single vs. dual parity), not by the total disk count. Therefore Disk1 tolerates two disk failures and Disk2 tolerates one.

Site, subnet, and site-link objects are stored in the Configuration partition, which replicates to every domain controller in the forest but is administratively owned by the forest root domain. By default, only members of Enterprise Admins and members of the Domain Admins group of the forest root domain (contoso.com in this forest) have permissions to modify objects in the Configuration container, including editing a site link ' s replication schedule. Admin1 is a member of Contoso\Enterprise Admins and therefore has forest-wide rights over the Configuration partition. Admin2 is a member of Contoso\Domain Admins; because contoso.com is the forest root domain, this group also carries default rights over the Configuration and Schema partitions. Admin3, however, is a member of Canada\Domain Admins, the Domain Admins group of the canada.contoso.com child domain, which has no inherent rights over the Configuration partition. Consequently, to change the replication schedule on all site links to 30 minutes, only Admin1 and Admin2 currently have the necessary permissions, making option C the correct answer.

Group3: Group1, Group2, Group4, and Group5 only. Group5: Group4 only.

Group nesting in AD DS is governed strictly by group scope, independent of whether a group is security- or distribution-type. A Domain Local group can contain user accounts, Global groups from any domain, and Universal groups from any domain, plus other Domain Local groups from its own domain only. Group3 is a Domain Local group in contoso.com, so it can accept Group1 (Universal, contoso.com), Group2 (Global, contoso.com), and Group4 and Group5 (both Global, canada.contoso.com), since Global groups from any domain are valid Domain Local members. It cannot accept Group6, because Group6 is Domain Local in canada.contoso.com, a different domain, and Domain Local groups may only nest other Domain Local groups from their own domain. That gives Group3: Group1, Group2, Group4, and Group5 only. A Global group, by contrast, can contain only user accounts and other Global groups from the same domain. Group5 is Global in canada.contoso.com, so among the remaining groups only Group4 qualifies, since it is also Global and in the same domain; Group1 (Universal), Group2 (Global but a different domain), and Group6 (Domain Local) are all excluded by scope rules. That gives Group5: Group4 only.

Statement 1: No. Statement 2: Yes. Statement 3: No.

Password-policy (Account Policy) settings inside a GPO behave differently depending on where the GPO is linked. For domain user accounts, only Account Policy settings defined in a GPO linked at the domain level (or in a fine-grained Password Settings Object) take effect; Account Policy settings in a GPO linked to an OU are ignored for domain accounts and instead apply only to the local SAM password policy of computer objects located in that OU. GPO1 (minimum length 14) is linked to OU1, where Admin1 ' s user object resides, but because it is linked to an OU rather than the domain, it has no effect on Admin1 ' s domain account password requirement. Admin1 ' s domain password is governed only by the Default Domain Policy (minimum length 10), so statement 1 is false. User1 is likewise a domain account subject only to the Default Domain Policy ' s minimum length of 10, so statement 2 is true. GPO2 (minimum length 8) is linked to the Member Servers OU, which contains Server1 as a computer object; this makes GPO2 the effective local password policy for local accounts created on Server1 (overriding the Default Domain Policy locally), not the domain policy ' s 10-character minimum. Therefore a new local account on Server1 needs only eight characters, not ten, making statement 3 false.

Promoting a member server to a domain controller in a specific domain requires membership in either the Enterprise Admins group (forest-wide rights) or the Domain Admins group of that target domain. Server1 is a member server in canada.contoso.com, and the requirement is to promote it to a domain controller in that same domain. Admin1 belongs to Contoso\Enterprise Admins, which has full administrative rights across every domain in the forest, including the right to install AD DS and promote a server anywhere in the forest, so Admin1 qualifies. Admin3 belongs to Canada\Domain Admins, the Domain Admins group of canada.contoso.com itself, which grants full administrative control, including domain controller promotion, within that domain, so Admin3 also qualifies. Admin2, by contrast, is a member of Contoso\Domain Admins, the Domain Admins group of the contoso.com domain; Domain Admins rights are scoped to their own domain and do not extend into a child domain such as canada.contoso.com, so Admin2 cannot promote Server1. User1 has only standard Domain Users membership and holds no administrative rights anywhere. Therefore, only Admin1 and Admin3 currently have sufficient rights, making option C correct.

The requirement states that server administrators must request approval before establishing a Remote Desktop connection to an Azure virtual machine, and that once approved, the connection must be established within a defined two-hour window. This request-approve-then-time-limited-access pattern for a specific management port on an Azure VM is precisely what just-in-time (JIT) VM access, a Microsoft Defender for Cloud capability, provides: it keeps the RDP/SSH management ports closed by default in the network security group, requires an explicit access request, and, once approved, opens the port only for a specified time window and only from the requester ' s source IP. Microsoft Entra Privileged Identity Management provides time-bound, approval-based elevation for Microsoft Entra and Azure RBAC roles, not for opening network ports to a VM, so it does not by itself control Remote Desktop network access. The Remote Desktop extension for Azure Cloud Services is a legacy classic-deployment feature unrelated to this scenario. Azure Bastion provides browser-based RDP/SSH without exposing public IPs but does not implement an approval workflow with a bounded connection window. JIT VM access is therefore the correct, purpose-built solution.

Fabrikam ' s plan is to use Azure Policy to enforce configuration management policies across both its Azure and on-premises servers. Azure Policy ' s guest configuration capability, which evaluates and can remediate in-guest settings, only works against a server that is registered as an Azure resource. For an on-premises or non-Azure server, that registration is achieved by deploying the Azure Connected Machine agent, which onboards the machine as an Azure Arc-enabled server, gives it an Azure resource ID, and makes it a valid target for Azure Policy assignments, including guest configuration policies, in exactly the same way an Azure VM would be. Hybrid joining servers to Microsoft Entra ID affects identity and device management (such as Conditional Access) but does not make a server a valid Azure Policy target. A hybrid runbook worker lets Azure Automation runbooks execute on-premises but is unrelated to Azure Policy enforcement. The Azure Monitor agent collects telemetry into Log Analytics and Azure Monitor but does not register the server as an Arc resource or enable policy assignment on its own; it is typically deployed after Arc onboarding, not instead of it. Deploying the Azure Connected Machine agent is therefore the correct first step.

DC3 is a domain controller for the existing corp.fabrikam.com AD DS forest, deployed into Vnet1 in Azure. Domain controllers rely on AD-integrated DNS for locating other domain controllers, SRV records, and replication, so DC3 needs to host that zone itself, which requires installing the DNS Server role on DC3 and letting it host an AD-integrated copy of the corp.fabrikam.com zone. Azure ' s default virtual-network-provided DNS resolver has no awareness of AD DS records and cannot host or serve an AD-integrated zone, so every resource in Vnet1 that needs to locate the domain (including Azure VMs and DC3 ' s own replication partners) must be pointed at real DNS servers instead. That is accomplished by configuring the custom DNS Servers setting on Vnet1 to reference DC3 (and, once available, DC1 and DC2), which makes all Azure VMs in the virtual network resolve names through the AD-integrated DNS infrastructure rather than the platform resolver. An Azure DNS zone (public) or an Azure private DNS zone are separate, unrelated Azure-native DNS services that cannot host an AD-integrated zone and are not used for this scenario. Installing the DNS Server role on DC3 and pointing Vnet1 at it together satisfy the requirement.

Sync groups: 3. Storage Sync Services: 1.

In Azure File Sync, a sync group defines a single sync topology and can contain exactly one cloud endpoint (one Azure file share) but can contain multiple server endpoints (on-premises server locations) that all sync to that same file share. Fabrikam needs newyorkfiles to sync only to FS1, seattlefiles to sync only to FS2, and companyfiles to sync to both FS1 and FS2. Because each Azure file share can only belong to one sync group, newyorkfiles requires its own sync group with a single server endpoint on FS1, seattlefiles requires its own sync group with a single server endpoint on FS2, and companyfiles requires a third sync group whose one cloud endpoint (companyfiles) has two server endpoints, one on FS1 and one on FS2, which Azure File Sync fully supports within a single sync group. That gives a minimum of three sync groups. A Storage Sync Service is the top-level Azure resource that contains and manages sync groups, and there is no requirement here that forces the shares into separate Storage Sync Service instances (such as differing regions or subscriptions); a single Storage Sync Service can hold all three sync groups. Therefore only one Storage Sync Service is required.

GPO4 is already linked to the VirtualDesktops OU, which contains the Azure Virtual Desktop session host computer accounts, so it is correctly targeted at the right computers. The requirement is that the idle lockout behavior configured in GPO4 must apply to whichever user is signed in to a session host, and that the user must still be able to adjust the lockout time manually from their own client, which means the relevant setting is a per-user configuration item rather than a strict, non-negotiable computer policy. By default, user-configuration settings inside a GPO apply based on the OU containing the user account, not the computer the user signs in to; Fabrikam ' s users are located in the AllUsers OU, which is governed by GPO1, not GPO4. Group Policy Loopback Processing, enabled in GPO4 and set to Merge (to allow the client-side adjustment) or Replace, forces the user-configuration portion of GPO4 to apply to any user who logs on to a computer in the VirtualDesktops OU, regardless of where that user ' s own account resides. Security filtering and the Enforced property both affect who a GPO applies to or its precedence in conflicts, but neither one makes a GPO ' s user-side settings follow the computer instead of the user, so loopback processing in GPO4 is correct.

On a Virtual WAN hub: An ExpressRoute gateway. In the offices: An ExpressRoute circuit connection.

Fabrikam ' s plan is to replace the existing WAN links between the New York and Seattle offices with Azure Virtual WAN and ExpressRoute, connecting both offices to Vnet1 through the Virtual WAN hub. Azure Virtual WAN uses its own hub-native ExpressRoute gateway object (distinct from the standalone virtual network gateway used when ExpressRoute is connected directly to a single VNet); this ExpressRoute gateway is deployed inside the Virtual WAN hub and is required before any ExpressRoute circuit can terminate into that hub. A standard virtual network gateway is used for VNet-to-VNet or VPN scenarios, not for Virtual WAN hub ExpressRoute termination, and an ExpressRoute circuit connection itself is the logical link resource, not something you deploy on the hub. At each office, connectivity into Microsoft ' s network is established through an ExpressRoute circuit connection provisioned with a connectivity provider, which then links, via Microsoft ' s backbone, into the ExpressRoute gateway in the Virtual WAN hub. A Site-to-Site VPN, an Azure application gateway (a web traffic load balancer), and an on-premises data gateway (used for Power Platform/Logic Apps connectors) are all unrelated to this ExpressRoute-based design.

DHCP1 (New York, Scope1) and DHCP2 (Seattle, Scope2) currently serve only their own local office. To make DHCP highly available across both offices, the modern, supported approach is DHCP Failover, configured per scope (option E), which replicates lease information between DHCP1 and DHCP2 in either load-balance or hot-standby mode so that either server can service either scope ' s clients if its partner becomes unavailable. However, DHCP Failover alone only helps if a client ' s DHCP broadcast can actually reach the surviving partner server across the WAN; broadcasts do not cross routed office boundaries on their own. Configuring a DHCP relay agent on the router (or another relay-capable device) in each office (option B) forwards DHCPDISCOVER broadcasts from local clients to the remote partner server whenever the local DHCP server is down, allowing failover to actually take effect for clients in either office. The legacy split-scope technique of manually carving off a percentage of the other scope ' s addresses (options A and C) is the older, pre-failover workaround and is unnecessary once DHCP Failover is used; there is also no DHCP cluster role delivered through Windows Failover Clustering (option D), since DHCP achieves high availability through Failover mode, not a clustered role.

DC3 is explicitly described as a domain controller named dc3.corp.fabrikam.com that will exist inside Vnet1, meaning it must be a genuine, writable domain controller for Fabrikam ' s existing corp.fabrikam.com AD DS forest, replicating with DC1 and DC2. The only way to run an actual domain controller for an existing on-premises forest inside Azure is to deploy a regular Azure virtual machine, place it on Vnet1, install the AD DS role on it, and promote it as an additional domain controller for corp.fabrikam.com. Microsoft Entra Domain Services is a fundamentally different, fully managed service: it creates its own separate, standalone managed domain and does not add a domain controller to, or replicate directly with, an existing on-premises forest, so it cannot be used to deploy " DC3 " as described. Microsoft Entra Application Proxy publishes on-premises web applications to external users and has nothing to do with domain controller placement. A Microsoft Entra administrative unit is a container used to scope administrative permissions over Microsoft Entra objects and is unrelated to deploying infrastructure. Therefore, an Azure virtual machine, promoted to a domain controller, is the correct implementation for DC3.

1. Create the KDS root key in AD DS. 2. Create a group managed service account (gMSA) in Active Directory. 3. Configure the IIS application pool (on WEB1 and WEB2) to run as the gMSA via a specified user account.

The requirement is that every instance of Webapp1 (running on both WEB1 and WEB2) uses the same identity, and that identity ' s password rotates automatically every 30 days, without any administrator manually resetting it. A standalone managed service account (sMSA) is tied to a single computer and cannot be shared across WEB1 and WEB2, so it does not meet the requirement. A group managed service account (gMSA) is designed exactly for this scenario: one AD-managed identity that multiple servers can use simultaneously, with the Key Distribution Service automatically rotating its password (by default every 30 days) without needing manual intervention or downtime. Before any gMSA can be created in the forest, a one-time prerequisite must exist: the KDS root key, which the Key Distribution Service uses to generate and later recompute the gMSA ' s password material. So the correct order is to first create the KDS root key, then create the gMSA object in Active Directory, and finally configure the IIS application pool on each web server to run as that gMSA using the " specified user account " identity option (entered as domain\gMSA$ with no password required, since the password is centrally managed). Creating a system- or user-assigned managed identity in Microsoft Entra ID does not apply here, since Webapp1 runs on IIS on domain-joined VMs, not as an Azure PaaS resource.

1. Add a disk resource to the cluster. 2. Create a Cluster Shared Volume (CSV). 3. Put the disk in maintenance mode. 4. Enable BitLocker on the volume. 5. Update the BitLockerProtectorInfo property of the volume.

BitLocker can only be enabled on a Cluster Shared Volume disk while that disk is taken offline to cluster I/O, so the CSV must exist and be placed into maintenance mode before encryption can be applied. The supported sequence begins by adding the disk resource to the cluster and converting it into a Cluster Shared Volume, since BitLocker-on-CSV support requires the disk to already be a CSV rather than a plain cluster disk. The disk is then put into maintenance mode, which takes it offline to the other cluster nodes so it can be safely encrypted without a node attempting to access it mid-operation. With the CSV disk offline in maintenance mode, BitLocker is enabled on the volume. Finally, the volume ' s BitLockerProtectorInfo property is updated so that Failover Clustering registers the unlock protector, allowing the volume to automatically unlock on every cluster node once maintenance mode ends and the CSV is brought back online. Performing these steps out of order either fails outright -- BitLocker cannot be enabled on a CSV disk that is still online and actively used by the cluster -- or leaves the other cluster nodes unable to bring the encrypted volume back online afterward, since they would lack the registered unlock protector. Therefore, the correct order is: add the disk resource, create the CSV, put the disk in maintenance mode, enable BitLocker, and update BitLockerProtectorInfo.

Server administrators can be prevented from configuring Windows Defender Firewall rules by defining firewall policy centrally in a Group Policy Object and linking it to the servers ' organizational unit(s); domain-based GPO firewall policy overrides any local, administrator-configured Windows Defender Firewall rules on the domain-joined servers, since Group Policy-delivered firewall settings take precedence over local policy. Adaptive network hardening in Microsoft Defender for Cloud only generates recommendations to tighten network security group (NSG) rules protecting Azure resources -- it has no visibility into or control over host-based Windows Defender Firewall configuration on on-premises servers. A network security group (NSG) in Sub1 filters traffic at the Azure virtual network boundary and has no bearing on the on-premises Chicago office servers described in the scenario. An Azure Firewall policy governs the centrally managed Azure Firewall network virtual appliance, not the host-based Windows Defender Firewall running locally on each on-premises server. Because the servers in question are on-premises and domain-joined, only a Group Policy Object can centrally enforce and lock down their local Windows Defender Firewall configuration, preventing server administrators from modifying the rules directly on each machine. Therefore, configuring a GPO is the correct way to reduce this security risk.

On Cluster1: Import the Azure Migrate appliance. In Azure: Create an Azure Migrate project.

APP3 and APP4 run as virtual machines on the on-premises Cluster1 Hyper-V failover cluster, so migrating them to Azure uses the Azure Migrate: Server Migration workflow for Hyper-V. That workflow requires an Azure Migrate project to first be created in Azure, since the project is the container that organizes the migration effort, tracks discovered and assessed machines, and holds the configuration for the subsequent discovery and replication work. On the Cluster1 side, the Azure Migrate appliance -- a purpose-built VM or OVA image supplied by Azure Migrate specifically for Hyper-V environments -- must be imported (deployed) onto the Hyper-V host or cluster, where it discovers the VMs running there and orchestrates their replication into Azure. Configuring an Azure Network Adapter, creating a Point-to-Site VPN connection to Vnet1, installing the Azure File Sync agent, and installing the Windows Server Migration Tools are all unrelated actions that do not perform Hyper-V VM discovery or replication for an Azure Migrate project. Similarly, creating a premium block blob storage account, a private endpoint, or a VPN gateway in Azure are not the resource that Azure Migrate itself requires to begin a migration project -- an Azure Migrate project is. Therefore, importing the Azure Migrate appliance onto Cluster1 and creating an Azure Migrate project in Azure are the two required preparatory actions.

Enforce the security policy: Microsoft Defender Application Control. Manage the policy settings: Group Policy Objects (GPOs).

Windows Defender Application Control (WDAC) is the platform feature that enforces which applications are authorized to install or run on a Windows Server, directly meeting the stated requirement that only authorized applications can be installed or run on the servers in the forest. Microsoft Defender Application Guard isolates untrusted browsing sessions in a container and Microsoft Defender Credential Guard protects credential material from theft -- neither controls which applications are permitted to execute. Microsoft Defender for Endpoint is an endpoint detection-and-response platform that detects and responds to threats rather than enforcing a whitelist of permitted applications. Because the servers described are on-premises, domain-joined machines rather than Intune-managed, Microsoft Entra-joined devices, the WDAC policy settings here must be managed through Group Policy Objects distributed via AD DS, not through Intune. Configuration profiles in Microsoft Intune and compliance policies in Microsoft Intune are both cloud-management mechanisms that apply only to devices enrolled in and managed by Intune, which these on-premises, domain-joined servers are not. Therefore, WDAC is the enforcing service and Group Policy Objects are the correct management mechanism for these on-premises servers.

DHCP1: Export-DhcpServer, Remove-DhcpServerInDC. DHCP2: Add-DhcpServerInDC, Import-DhcpServer.

Migrating a DHCP server ' s configuration together with its existing leases and reservations by PowerShell follows an export/unauthorize-then-authorize/import pattern across the two servers. On the source server, DHCP1, Export-DhcpServer captures the existing scopes, options, leases, and reservations into a migration file, which is what allows the existing leases and reservations to actually carry over to the replacement server. Remove-DhcpServerInDC is then run on DHCP1 to unauthorize it in Active Directory, which is what prevents DHCP1 from continuing to service client requests once DHCP2 is brought online, satisfying that specific migration requirement. On the target server, DHCP2, Add-DhcpServerInDC authorizes the new server in AD DS so it is permitted to lease addresses on the network, and Import-DhcpServer then applies the configuration file exported from DHCP1, causing DHCP2 to hand out the same address ranges as DHCP1 along with the existing leases and reservations that were captured during export. Add-DhcpServerv4Scope and Remove-DhcpServerv4Scope only create or delete an individual scope ' s address range and do not export, import, or preserve any existing lease or reservation data, so neither is part of this migration sequence. Therefore, DHCP1 requires Export-DhcpServer and Remove-DhcpServerInDC, while DHCP2 requires Add-DhcpServerInDC and Import-DhcpServer.

A Windows Server failover cluster requires a distinct IP address for each individual cluster node ' s network adapter, plus one additional IP address for the cluster ' s own network name resource -- the cluster access point that clients and management tools use to address the cluster as a single logical entity rather than any one specific node. Cluster3 will contain two physical nodes, Node1 and Node2, so at minimum one IP address is required for Node1 ' s network adapter and one for Node2 ' s network adapter. Beyond those two node-level addresses, the cluster core resource itself (the cluster name object and its associated IP address resource) requires one more address so that the cluster can be addressed and managed as a whole and so that any highly available roles hosted on the cluster (such as the file share role planned for Cluster3) can obtain the network identity they need to fail over between nodes. Adding these together -- one for Node1, one for Node2, and one for the cluster ' s own network name -- yields a minimum of three IP addresses required for Cluster3 ' s node and cluster roles. Fewer than three would leave either a node or the cluster itself without a usable network identity, and while additional IP addresses may be consumed by highly available roles later added to the cluster, three is the baseline minimum for the node and cluster roles themselves.

Storage Migration Service is purpose-built to inventory the data, security descriptors, and both share-level and NTFS-level permissions on a source file server such as Fileserver1, transfer that data to a destination server such as Fileserver2, and then perform a cutover that reassigns the source server ' s network identity -- its computer name and IP address -- to the destination server. That cutover step is precisely what allows the existing \\Fileserver1\Data UNC path, already relied upon by the Chicago office application, to continue working unchanged after the migration, since client requests to that path transparently resolve to Fileserver2 once it has taken on Fileserver1 ' s identity. The Microsoft File Server Migration Toolkit and Windows Server Migration Tools are older, largely superseded utilities that can move some file server settings but do not provide this automated inventory-transfer-and-cutover workflow, and neither preserves the source server ' s identity on the destination the way Storage Migration Service does, meaning the UNC path would need to be manually updated or redirected. File Server Resource Manager (FSRM) is a quota, file-screening, and storage-reporting feature entirely unrelated to migrating data between servers. Therefore, Storage Migration Service is the correct tool to perform this migration while preserving the existing UNC path.

Microsoft Defender for Identity is the Microsoft Sentinel data connector purpose-built to monitor on-premises Active Directory domain controllers and surface exactly the insecure-protocol activity described in the requirement, including authentication attempts and sign-ins that rely on legacy or unsigned protocols such as NTLMv1, SMBv1, and unsigned LDAP binds. It does this by analyzing domain controller network traffic and Windows Events directly on the DCs, which is exactly where this insecure-protocol usage originates. The Threat Intelligence - TAXII connector ingests external threat-intelligence indicator feeds (IP addresses, file hashes, domains) from TAXII-compliant sources and has nothing to do with monitoring authentication protocol usage on domain controllers. The Azure Active Directory (Microsoft Entra ID) connector reports on cloud sign-in and audit log events for the Entra tenant, not on legacy protocol usage against on-premises AD DS domain controllers. Microsoft Defender for Cloud focuses on cloud resource security posture management and workload protection rather than detecting legacy authentication protocol usage against on-premises domain controllers. Therefore, connecting Microsoft Defender for Identity to Microsoft Sentinel is the correct connector to identify connections to the domain controllers that use insecure protocols.

To enable WebApp1 to handle requests for the website: Add a custom domain name. To point client connections to WebApp1: Modify a DNS record.

For an Azure App Service web app to accept and correctly serve requests addressed to https://www.fabrikam.com rather than only its default *.azurewebsites.net hostname, the custom domain www.fabrikam.com must be added and bound to WebApp1 -- this is the specific configuration step that makes the app recognize and handle that custom hostname at all. Creating a deployment slot supports staged rollout and swap scenarios and does nothing to bind a custom domain, and creating a private endpoint provides private, VNet-restricted connectivity rather than public custom-domain handling, so neither accomplishes the stated goal. Once WEB1 and WEB2 are decommissioned per the migration plan, client traffic that currently resolves to those on-premises-facing web servers must instead be directed to WebApp1; since DNS is what resolves the www.fabrikam.com name to a specific endpoint, the DNS record for that hostname must be modified (typically to a CNAME record pointing at WebApp1 ' s default hostname, together with the domain-verification TXT record Azure requires before it will accept the custom domain binding). Azure Front Door and Azure Traffic Manager are global routing and load-balancing services meant for multi-region or multi-endpoint failover scenarios and are unnecessary complexity for redirecting a single custom domain to a single web app, and adding HTTP redirect rules on WEB1/WEB2 is not a viable option once those servers have been decommissioned. Therefore, adding a custom domain name to WebApp1 and then modifying the DNS record are the two required actions.