Practice Free AZ-802 Administering Windows Server Exam Questions Answers With Explanation

? For User1, \\server2\share maps to drive H.: No

? For User2, \\server1\share maps to drive H.: Yes

? For User3, \\server3\share maps to drive H.: No

The Administering Windows Server Hybrid Core Infrastructure materials explain that Group Policy is processed in the order Local ? Site ? Domain ? OU, with the last applied policy normally taking precedence. Two modifiers change this behavior: Enforced (No override) on a GPO link and Block inheritance on a container/OU. The guide states that an Enforced link “prevents child containers from overriding settings in that GPO,” while Block inheritance “prevents higher-level GPOs from applying except those marked Enforced.”

Applying these rules:

User1 (Contoso\Users) is not in OU1, so GPO2 (drive H to \\server2\share ) does not apply. Only domain-level GPOs apply to the Users container; thus, the statement for \\server2\share is No.

User2 (OU1) receives GPO1 (Domain, Enforced) and GPO2 (OU1). Because GPO1 is Enforced, its mapping (H ? \\server1\share ) cannot be overridden by GPO2, so the statement is Yes.

User3 (OU1\OU2) is in OU2, which has Block inheritance. This blocks higher GPOs except those Enforced, so GPO1 still applies and GPO2 is blocked. Although GPO3 (OU2) also applies, the Enforced domain GPO (GPO1) takes precedence over conflicting lower-level settings, so H: remains \\server1\share , making the statement about \\server3\share No.

In a Windows Defender Firewall connection security rule, ' request ' authentication is opportunistic: the computer attempts IPsec authentication but falls back to unauthenticated communication if the peer cannot negotiate it, so a host whose outbound setting is ' request ' (Server1) can always reach any peer, authenticated or not, including Server4, which has no connection security rule at all. ' Require ' authentication, by contrast, only succeeds when the peer is capable of responding to the IKE negotiation at all, regardless of whether that peer ' s own policy is set to request or require; it fails outright against a peer with no IPsec policy configured. Server1 ' s rule requests authentication both ways, so it can reach Server2, Server3, and Server4 without restriction. Server2 requires authentication for outbound connections, so its outbound traffic succeeds against Server1 and Server3 (both of which support IPsec negotiation) but is blocked toward Server4, which has no rule to negotiate with, making ' Server1 and Server3 only ' the correct outcome for Server2.

A DHCP reservation permanently binds a specific IP address to a specific client so that the client receives the same address on every lease renewal, and Windows Server DHCP identifies the client for this binding by its network adapter ' s MAC (hardware) address, which is the unique Layer 2 identifier included in every DHCPDISCOVER/DHCPREQUEST message. This makes the MAC address the correct and only supported identifier type for a standard client reservation in Windows Server DHCP. A UUID (client identifier option) is used in certain scenarios such as PXE/network boot or specific DHCPv6 configurations (as a DUID), but it is not the mechanism used for ordinary IPv4 reservations on Windows Server DHCP. An FQDN or a NetBIOS name identifies a computer for name resolution purposes (DNS or WINS/NetBIOS) but is not part of the DHCP protocol ' s client identification handshake and cannot be used to key a reservation, since DHCP operates below and independently of the name-resolution layer, at the point where the client does not necessarily have a resolvable name yet. A MAC-address-based reservation is therefore the correct approach.

If FS1 runs on Node3, and Node3 fails, FS1 will fail over to Node4 automatically: Yes. If DFS1 runs on Node2, and Node2 fails, DFS1 will fail over to Node3 automatically: No. If Site2 fails, DFS1 will remain available: Yes.

FS1, the File Server for general use role, can run on any cluster node that has the File Server role installed, and the exhibit shows that Node4 has the File Server role installed even though its cluster vote has been administratively set to zero for quorum-weighting purposes; a vote of zero only affects that node ' s contribution to quorum calculations and does not disqualify it as a valid failover target for a role it is capable of hosting. Because Node4 has the required role installed, FS1 fails over to Node4 automatically if it was running on Node3 and Node3 fails. DFS1, the DFS Namespace Server role, in this cluster ' s fault-domain topology is hosted within the Site1 fault domain, which the Get-ClusterFaultDomain output shows contains Node1 and Node2, while Node3 and Node4 belong to the separate Site2 fault domain. Because DFS1 does not automatically extend its ownership across a fault-domain boundary, if it is running on Node2 in Site1 and Node2 fails, it fails over to Node1, the other node within the same Site1 fault domain that also has the DFS Namespace Server role, rather than jumping across to Node3 in Site2. Since Site1 remains fully intact and, together with the cloud witness, continues to hold cluster quorum on its own, DFS1 stays available on Site1 ' s remaining nodes even if the entire Site2 fault domain, consisting of Node3 and Node4, goes offline completely.

1. Create a failover cluster. 2. Enable Storage Spaces Direct. 3. Create a volume.

Deploying a Storage Spaces Direct hyper-converged cluster follows a fixed sequence. First, the Failover Clustering feature is used to create and validate a cluster across Server1, Server2, and Server3, since Storage Spaces Direct is a capability enabled on top of an existing failover cluster rather than a standalone feature. Only after the cluster exists can Storage Spaces Direct be enabled on it, which pools the local or shared disks across all three nodes into a single software-defined storage pool spanning the cluster. Finally, a volume is created from that pool; this volume backs the Cluster Shared Volume used to actually store the Hyper-V virtual machines ' files. Creating a DFS namespace, adding a Scale-Out File Server role, or creating a file share are all unrelated to hosting VM storage directly on Storage Spaces Direct volumes and are not part of this sequence. Therefore, the correct order is: create the failover cluster, enable Storage Spaces Direct, and create the volume.

Windows does not automatically populate the Group Policy Central Store; an administrator creates the empty PolicyDefinitions folder in SYSVOL and must manually copy the full set of ADMX/ADML administrative template files into it. Once a Central Store exists, the Group Policy Management Editor exclusively displays the ADMX files that physically exist inside that Central Store -- it never falls back to using a workstation ' s local C:\Windows\PolicyDefinitions folder as long as the Central Store is present. The fact that only two settings appear means someone created the Central Store and copied in just a couple of custom ADMX/ADML files (evidently ActiveX-related ones) but never copied in the full default Windows ADMX/ADML set, so this is fundamentally a content problem with the store, not a problem with GPO1 itself. Deleting the PolicyDefinitions folder entirely would cause the Group Policy Management Editor to fall back to whatever ADMX files exist locally on each individual administrator ' s own workstation -- which may vary in completeness from machine to machine and defeats the entire purpose of having a centralized, consistent store -- rather than actually restoring the complete, intended set of settings in a centralized way. Therefore, deleting the Central Store ' s PolicyDefinitions folder does not meet the goal.

Windows Server lets you change a server ' s edition in place using DISM with the /Set-Edition (or /Online /Set-Edition) option and a valid edition key, which upgrades Standard to Datacenter without requiring a full reinstall and needs only a single restart to complete, minimizing downtime for the Hyper-V host and preserving its running virtual machines and configuration. Setup.exe would perform a full in-place OS upgrade rather than an edition change, which is unnecessary and far more disruptive when the OS version itself is not changing, slmgr.vbs manages license activation rather than edition conversion, and convert.exe is unrelated (it converts file systems). DISM is Microsoft ' s documented tool for this specific Standard-to-Datacenter edition upgrade scenario, and running DISM /Online /Set-Edition:ServerDatacenter /ProductKey: < key > /AcceptEula is the documented command sequence for completing it with a single reboot. After the reboot, the server retains its existing roles, features, and settings, including the Hyper-V role and any virtual machines already configured, since an edition change preserves the installation rather than replacing it.

The Windows Time service hierarchy in an AD DS domain is anchored to the PDC emulator by default: the PDC emulator of the domain is designated the domain ' s authoritative time source, every other domain controller in the domain synchronizes its clock from the PDC emulator (directly or transitively), and domain-joined clients ultimately trace their time back to it through the domain hierarchy. To make DC3 the domain ' s authoritative time server, the PDC emulator role itself must be moved to DC3, since authoritative time-server status follows the PDC emulator role holder rather than being an independently assignable setting. The other FSMO roles are unrelated to time authority: the domain naming master and schema master are forest-wide roles governing directory partition creation and schema changes, and the RID master issues relative ID pools for new security principals — none of these affect which DC anchors the domain ' s time hierarchy. The PDC emulator, RID master, and infrastructure master are domain-wide roles that are viewed and transferred through Active Directory Users and Computers, by right-clicking the domain node and selecting Operations Masters; the forest-wide roles are instead managed through Active Directory Domains and Trusts (domain naming master) and the Active Directory Schema snap-in (schema master), and Active Directory Sites and Services manages site topology, not FSMO roles at all. Transferring the PDC emulator role to DC3 using Active Directory Users and Computers is therefore correct.

When BitLocker recovery information is configured to be backed up to AD DS, each protected volume ' s recovery data is stored as one or more msFVE-RecoveryInformation objects, which AD DS creates as child objects underneath the corresponding computer object, here Server1 ' s own computer object; each such child object carries the ms-FVE-RecoveryPassword attribute holding the 48-digit numerical recovery password along with an ms-FVE-RecoveryGuid used to match it to the correct BitLocker key protector. ADSI Edit is a low-level LDAP editor capable of navigating directly to any object in the directory, including drilling down into a computer object ' s child objects, so using ADSI Edit to view Server1 ' s computer object and its msFVE-RecoveryInformation children is one of the two methods Microsoft documents for retrieving an AD DS-stored BitLocker recovery password when the more convenient BitLocker Recovery Password Viewer for Active Directory Users and Computers snap-in is not installed or not preferred; the recovery password read from that child object ' s attribute is entered at the BitLocker recovery screen to unlock Server1. Because this approach correctly reaches the actual location where the recovery password is stored in AD DS and retrieves the exact value needed, it does meet the stated goal of identifying Server1 ' s BitLocker recovery key.

In Azure File Sync, a sync group defines the synchronization topology between exactly one cloud endpoint (an Azure file share) and one or more server endpoints (on-premises or IaaS VM paths). Microsoft ' s documented Azure File Sync limits state explicitly that a sync group can contain, at most, a single cloud endpoint -- there is no supported configuration in which a sync group is associated with two or more Azure file shares simultaneously. This 1:1 relationship between a sync group and its cloud endpoint is a hard architectural limit, not a configurable quota, and it holds true regardless of how many storage accounts exist in the subscription or which Azure region the Storage Sync Service (SyncA) was created in. The number of available storage accounts shown in the exhibit ' s table, and the fact that they might reside in the same or different regions, does not change this per-sync-group limit; each additional cloud endpoint would require creating an entirely separate sync group rather than adding it to GroupA. By contrast, a sync group can contain multiple server endpoints, registering as many on-premises servers/shares as needed to sync against that single cloud endpoint. Therefore, the maximum number of cloud endpoints that can be used with GroupA is 1.

Azure Disk Encryption artifacts (such as the BitLocker/DM-Crypt encryption keys) can be protected in Key Vault by a software-protected key or by a hardware-protected key. Choosing ' key ' (rather than ' certificate ' or ' secret ' ) creates a cryptographic key object that can be used as a key-encryption key to wrap the disk encryption secret before it is written to the vault. Specifying --kty RSA-HSM (as opposed to plain RSA) ensures the key material is generated and protected inside a FIPS 140-validated hardware security module rather than in software, which is the highest level of protection Key Vault offers for this purpose. This matches the completed command shown in the exhibit, and Vault1 must be a Premium-tier vault for the RSA-HSM key type to be available, since HSM-backed keys are not supported on the Standard vault tier. Once artifact1 exists as an RSA-HSM key, its key identifier is supplied to Set-AzVMDiskEncryptionExtension as the key-encryption key parameter so that every BitLocker protector secret written to Vault1 is wrapped by it before storage.

Volume for the AD DS database: F. Caching configuration for the volume that hosts the database: NONE.

Microsoft ' s guidance for running AD DS domain controllers on Azure virtual machines is explicit that the NTDS database and logs should be placed on a dedicated data disk rather than the OS disk (C:) or the VM ' s temporary disk (D:). The OS disk mixes the database with the operating system and is not sized or managed for this purpose, and the temporary disk is local, ephemeral storage on the physical host that provides no durability at all — its contents can be lost during routine platform maintenance, a host failure, or a resize/reallocation, which is completely incompatible with maximizing resiliency for a domain controller ' s database. A separate managed data disk, mounted as F:, is backed by durable, replicated Azure Storage and is the disk that should host the AD DS database, giving the required resiliency. Separately, Azure lets you configure host caching (None, Read, or Read/write) on a managed data disk; for a disk hosting a transactional, write-sensitive database like the AD DS Extensible Storage Engine database, Microsoft explicitly documents that host caching must be set to None. Read or Read/write caching risks acknowledging writes to the VM before they are guaranteed to be durably committed to the underlying storage, which for a database like NTDS.dit can result in inconsistency or accidental data loss if a cache flush is interrupted. Setting caching to None ensures every write is fully committed, directly satisfying the requirement to prevent accidental data loss.

Windows Admin Center ' s gateway installation, by default, hosts its browser-based management portal over HTTPS on TCP port 443. Administrators at the main office reach the gateway server in the branch office by pointing a web browser at https:// < gatewayserver > , and that HTTPS session is what the branch office firewall must permit inbound from the WAN. Once that portal connection is established, the gateway itself relays management traffic to the target servers using WinRM (over HTTP/HTTPS) on the local network, but that relay happens between the gateway and the managed servers inside the branch office, not across the WAN link the firewall is filtering. Port 3389 is used for Remote Desktop Protocol (RDP) sessions, which is a different management channel entirely and not what a default Windows Admin Center gateway installation listens on. Port 5985 is the default WinRM HTTP port used for PowerShell remoting and is what the gateway uses internally to reach managed nodes, not the port browsers use to reach the gateway itself. Port 6516 is unrelated to Windows Admin Center. Because the requirement is specifically to let administrators ' browser sessions reach the gateway from across the WAN, the firewall must allow inbound TCP 443, matching the gateway ' s default HTTPS listener.

The Balancer tab shows Enable Automatic Balancing of Virtual Machines checked with the Always load balance option left unselected, which corresponds to the cluster ' s AutoBalancerMode being set to 1, meaning node fairness rebalancing is triggered only when a node actually joins the cluster, rather than mode 2, which would also rebalance on a recurring timer. In this mode, adding a new Hyper-V node to Cluster1 constitutes a node-join event, so the cluster ' s node fairness feature does automatically live-migrate one or more virtual machines onto the newly joined node to level out CPU load across all nodes, making statement 1 true. Because rebalancing is not time-triggered under this configuration, simply waiting an hour after running commands, with no node joining or leaving the cluster in between, does not by itself cause any automatic migration from Node1 to Node2, so statement 2 is false. VM6 in the scenario runs on the separate standalone host Host1, not as a clustered virtual machine on a node of Cluster1, and deploying it specifically to Node1 would make it a clustered VM sharing Node1 ' s existing load, but that placement action is not a node-join event either, so it does not trigger the automatic node-fairness rebalance, making statement 3 false as well.

Exploit protection, found under App & browser control in the Windows Security app, applies system-wide and per-application mitigations against memory-corruption and code-execution exploit techniques, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), Control Flow Guard, and restrictions on child-process creation or Win32k system call use. These mitigations harden individual applications against being exploited by malicious code that tries to hijack their execution flow; they do not govern, allow-list, or restrict which applications are permitted to modify files inside specific protected folders, and Exploit protection has no concept of a " protected folder " at all. Configuring Exploit protection therefore has no effect whatsoever on which applications can write to the protected folders described in the requirement, regardless of how its individual mitigation settings are tuned for Server1. Only Controlled folder access, configured from Virus & threat protection > Manage ransomware protection rather than from App & browser control, provides that specific folder-level application allow-listing capability. Therefore, configuring the Exploit protection settings does not meet the goal.

Microsoft Defender for Identity sensors capture and analyze authentication and directory traffic locally on each domain controller they are installed on, so detecting all security risks that touch either domain -- including risks involving the read-only domain controllers DC3 and DC6, which also process authentication traffic for their respective domains -- requires a sensor on every domain controller in the forest, DC1 through DC6, rather than only the PDC emulators or infrastructure masters; installing sensors on a subset would leave authentication traffic on the uncovered domain controllers unmonitored, creating a detection gap. Therefore the minimum number of domain controllers that still achieves full coverage of both domains is, in fact, all six -- there is no smaller subset that captures every domain controller ' s local traffic. During each sensor ' s initial installation, it must be registered to the Defender for Identity workspace using the one-time access key that is generated and copied from the Microsoft Defender portal; after this initial registration, subsequent sensor-to-cloud communication is secured using certificates rather than requiring the access key, a gMSA, or a cloud-only Azure AD/Microsoft Entra user account again.

The Print Management migration wizard, built on printbrm.exe, documents that local bus printers, meaning printers connected through ports such as LPT or a locally attached USB-style port, are shown and processed during the backup step of the migration but are not successfully migrated to a working configuration on the destination server, because the physical port itself does not exist or map meaningfully on Server2. Printer1, connected through LPT1, and Printer2, connected through the similarly local, non-network Port1, both fall into this unsupported local-bus category and cannot be relied on to retain a working configuration after the move to Server2. Printer3, connected through a standard TCP/IP port pointing at a specific network address, is a fully network-addressable print queue whose port definition is meaningful on any print server, including Server2, so it migrates cleanly with its driver, queue settings, and configuration intact. Printer4, which uses the built-in FILE: port to print to a file rather than to physical hardware, is a virtual, hardware-independent port that is present identically on every Windows print server, so it too migrates without issue. Because printer drivers, queue settings, and port/configuration details only transfer meaningfully for ports that exist and behave identically on the target server, only Printer3 and Printer4 retain their current configuration after migrating to Server2.

Core isolation, which is the feature group that includes Memory Integrity, also known as Hypervisor-protected Code Integrity or HVCI, is surfaced and enabled from the Device security tile of the Windows Security app, since it is a hardware- and virtualization-based security capability grouped alongside other device-level protections such as the Security processor and Secure Boot status. Mandatory ASLR, which forces address space layout randomization for images that were not compiled with ASLR support, is one of the individually configurable system-level Exploit Protection settings, and Exploit Protection as a whole is configured from the App & browser control tile, alongside Windows Defender SmartScreen and Controlled folder access, rather than from Device security or Virus & threat protection. Because these two settings live under two different top-level tiles in the Windows Security app despite both being low-level exploit-mitigation and platform-security features, an administrator enabling both Core isolation and Mandatory ASLR needs to visit Device security for the first setting and App & browser control for the second.

Upgrading, or more precisely transferring, the PDC emulator FSMO role to a different domain controller has no bearing whatsoever on which replication engine SYSVOL uses within the domain. The blocking condition preventing a Windows Server 2022 domain controller from being added is strictly that Windows Server 2016 and later builds no longer ship the File Replication Service binaries at all, so as long as SYSVOL keeps replicating over FRS, no domain controller running a newer operating system can be introduced into the domain, entirely regardless of which existing domain controller happens to hold the PDC emulator role at the time. Moving the PDC emulator role does not touch SYSVOL replication technology in any way, does not migrate anything from FRS to DFS Replication, and does not remove the FRS binaries requirement that the domain promotion process checks for. Only actually migrating SYSVOL replication from FRS to DFS Replication addresses the real constraint described in the scenario, so upgrading the PDC emulator alone does not meet the goal.

Windows Admin Center includes a built-in Azure Monitor integration tool, reached under Tools > Azure Monitor for a connected cluster, that registers the connection with Azure, provisions the underlying Log Analytics workspace, deploys the monitoring agent to every cluster node, and exposes a predefined set of alert rules covering exactly this scenario ' s requirements: CPU utilization over 85% for 10 minutes, disk capacity over roughly 80 to 85% for 10 minutes, memory utilization thresholds, heartbeat loss, cluster critical events, and health service faults. Because the administrator already manages every server and cluster through Windows Admin Center on a daily basis, launching this wizard from the existing console and onboarding Cluster1 directly through it is the lowest-effort path available, since it avoids standing up a separate manual Azure Arc onboarding project or installing agents by hand. Configuring Azure Monitor and onboarding Cluster1 through Azure Arc from the Azure portal accomplishes something similar but requires more manual configuration outside the tool the administrator already uses, and manually installing the Microsoft Monitoring Agent on each of the three nodes individually is explicitly the higher-effort approach that the Windows Admin Center wizard is designed to eliminate.

Client computers falling back to APIPA (169.254.x.x) addresses means their DHCPDISCOVER broadcasts are never reaching DHCP1 at all, which is expected here because DHCP1 ' s own network interface sits on the 10.10.10.0/24 subnet while the scope it is meant to service, 10.10.20.0/24, is a different subnet; DHCP discovery broadcasts do not cross router/subnet boundaries by default, and there is no indication that a DHCP relay agent (or an RFC 1542-compliant router configured to forward BOOTP/DHCP broadcasts) exists to carry those broadcasts from the 10.10.20.0/24 subnet across to DHCP1. Configuring a DHCP relay agent, typically on a router interface or a member server physically present on the 10.10.20.0/24 subnet and pointed at DHCP1 ' s IP address, converts the client broadcasts into unicast packets addressed directly to DHCP1, letting the existing, already-active, already-available scope actually receive and answer the requests, which is the only change needed since the scope, authorization, and service status are all already confirmed correct. Running Add-DhcpServerInDC would attempt to (re-)register a server as authorized in AD DS, which is already true and unrelated to this symptom. Creating an exclusion range would shrink the address pool, not fix broadcast delivery, and adding a DHCP server security group has no effect on whether client broadcasts can reach the server across a subnet boundary.

Group3: Group1, Group2, Group4, and Group5 only. Group5: Group4 only.

Group nesting in AD DS is governed strictly by group scope, independent of whether a group is security- or distribution-type. A Domain Local group can contain user accounts, Global groups from any domain, and Universal groups from any domain, plus other Domain Local groups from its own domain only. Group3 is a Domain Local group in contoso.com, so it can accept Group1 (Universal, contoso.com), Group2 (Global, contoso.com), and Group4 and Group5 (both Global, canada.contoso.com), since Global groups from any domain are valid Domain Local members. It cannot accept Group6, because Group6 is Domain Local in canada.contoso.com, a different domain, and Domain Local groups may only nest other Domain Local groups from their own domain. That gives Group3: Group1, Group2, Group4, and Group5 only. A Global group, by contrast, can contain only user accounts and other Global groups from the same domain. Group5 is Global in canada.contoso.com, so among the remaining groups only Group4 qualifies, since it is also Global and in the same domain; Group1 (Universal), Group2 (Global but a different domain), and Group6 (Domain Local) are all excluded by scope rules. That gives Group5: Group4 only.

Server1: Set-Item. Server4: Enable-PSRemoting.

The requirement is to manage Server4 from Server1 by using PowerShell remoting. Server4 is a workgroup computer, not a member of either AD DS domain, so the WinRM authentication that PowerShell remoting relies on cannot use Kerberos between Server1 and Server4; it must fall back to NTLM, which WinRM only permits toward hosts explicitly listed in the client ' s TrustedHosts list. On Server1, the correct action is therefore Set-Item, used as Set-Item WSMan:\localhost\Client\TrustedHosts -Value " Server4 " (with -Concatenate as needed), which adds Server4 to Server1 ' s trusted hosts so an NTLM-based remoting session is permitted. On Server4, the target must first be configured to accept remote commands at all, which is done with Enable-PSRemoting; this cmdlet starts and configures the WinRM service, creates a listener, and enables the Windows Remote Management firewall rule for the current network profile, matching Server4 ' s private firewall profile. Enable-ServerManagerStandardUserRemoting only grants a non-administrator limited Server Manager access and does not establish remoting, and Start-Service alone does not create or configure a WinRM listener or firewall exception. Configuring Set-Item on Server1 and Enable-PSRemoting on Server4 together satisfies the requirement.

Promoting a member server to a domain controller in a specific domain requires membership in either the Enterprise Admins group (forest-wide rights) or the Domain Admins group of that target domain. Server1 is a member server in canada.contoso.com, and the requirement is to promote it to a domain controller in that same domain. Admin1 belongs to Contoso\Enterprise Admins, which has full administrative rights across every domain in the forest, including the right to install AD DS and promote a server anywhere in the forest, so Admin1 qualifies. Admin3 belongs to Canada\Domain Admins, the Domain Admins group of canada.contoso.com itself, which grants full administrative control, including domain controller promotion, within that domain, so Admin3 also qualifies. Admin2, by contrast, is a member of Contoso\Domain Admins, the Domain Admins group of the contoso.com domain; Domain Admins rights are scoped to their own domain and do not extend into a child domain such as canada.contoso.com, so Admin2 cannot promote Server1. User1 has only standard Domain Users membership and holds no administrative rights anywhere. Therefore, only Admin1 and Admin3 currently have sufficient rights, making option C correct.

The stated problem is that when an administrator connects to VM2 ' s console through Virtual Machine Connection and disconnects without signing out, a second administrator who opens the console can silently inherit that still-signed-in session without ever supplying credentials. By default, VMConnect attaches directly to the raw console of the guest, which behaves like walking up to a physical, unlocked machine. Enhanced Session Mode changes this behavior by routing the VMConnect session over the Remote Desktop Protocol into the guest, which means every connection is treated as a new interactive Remote Desktop logon and therefore always prompts for credentials, eliminating the ability to passively inherit someone else ' s open session. Enabling Enhanced Session Mode requires both host-side and guest-side support (the guest operating system must support RDP and have the setting enabled) but is the direct, purpose-built fix for this exact console-sharing problem. The Guest Services integration component only enables basic file-copy functionality between host and guest and has no effect on console/session behavior. Credential Guard protects locally stored credentials from theft using virtualization-based security, and shielded VMs protect a VM ' s disk, state, and console from a compromised or malicious fabric administrator; neither addresses console session takeover between two legitimate administrators. Enhanced Session Mode is therefore the correct solution.

Site, subnet, and site-link objects are stored in the Configuration partition, which replicates to every domain controller in the forest but is administratively owned by the forest root domain. By default, only members of Enterprise Admins and members of the Domain Admins group of the forest root domain (contoso.com in this forest) have permissions to modify objects in the Configuration container, including editing a site link ' s replication schedule. Admin1 is a member of Contoso\Enterprise Admins and therefore has forest-wide rights over the Configuration partition. Admin2 is a member of Contoso\Domain Admins; because contoso.com is the forest root domain, this group also carries default rights over the Configuration and Schema partitions. Admin3, however, is a member of Canada\Domain Admins, the Domain Admins group of the canada.contoso.com child domain, which has no inherent rights over the Configuration partition. Consequently, to change the replication schedule on all site links to 30 minutes, only Admin1 and Admin2 currently have the necessary permissions, making option C the correct answer.

The requirement is narrow: User1 must be able to manage the membership of all the groups located in Contoso\OU3, and nothing more. The Delegation of Control Wizard, run against OU3 specifically, lets an administrator grant User1 exactly the built-in task " Modify the membership of a group, " which grants write access to the member attribute on group objects contained in that OU only. This satisfies the requirement while granting no rights outside OU3, which is the definition of least privilege. Creating the same delegation at the domain root (contoso.com) would technically work but grants far broader scope than needed, since it would apply to every container in the domain, not just OU3, violating least privilege. Adding User1 to Account Operators grants domain-wide rights to create, delete, and modify most user, group, and computer accounts throughout the domain (with some protections for built-in admin accounts), which is excessive for a task limited to group membership in one OU. Server Operators is unrelated to Active Directory object management altogether; it governs local administrative rights on domain controllers themselves. Therefore, delegating control on OU3 is the correct, minimally scoped solution.

Installing and authorizing a DHCP server in an Active Directory-integrated environment requires two distinct sets of rights: local Administrators group membership on Server3 to install the DHCP Server role itself, and Enterprise Admins group membership to authorize that server in AD DS, because DHCP server authorization is stored as a forest-wide object under CN=NetServices,CN=Services,CN=Configuration and only Enterprise Admins can create or modify objects there by default. Admin1 is a member of Contoso\Enterprise Admins, which grants exactly this forest-wide right and also carries local administrative rights on every domain-joined computer in the forest, including Server3, so Admin1 can both install the role and authorize the server, fully satisfying the requirement on his own. Admin2, a member of only Contoso\Domain Admins, has full administrative rights over contoso.com and its member computers, but Domain Admins does not carry the right to authorize a DHCP server in the forest-wide NetServices container, so Admin2 cannot complete authorization even though he can install the role. Admin3, a member of Canada\Domain Admins, has administrative rights limited to the canada.contoso.com domain and likewise lacks the Enterprise Admins-only authorization right needed here, since Server3 and the DHCP authorization object both fall outside that domain ' s scope of control. Because only Admin1 holds both the local administrative rights needed to install the DHCP Server role on Server3 and the Enterprise Admins membership needed to authorize it in AD DS, Admin1 only is correct.

Data Deduplication is a Windows Server file-and-storage feature that can only be enabled on NTFS-formatted data volumes; it cannot be enabled on the operating system (boot/system) volume, and it does not support ReFS or FAT/exFAT volumes at all. VM3 ' s volumes are C (NTFS, the operating system volume), D (NTFS, a data volume), E (ReFS), and F (exFAT). Volume C is excluded because Deduplication is never supported on the volume that hosts the operating system, even though its file system is NTFS. Volume E is excluded because Data Deduplication has no ReFS support in general-purpose deployments; ReFS uses its own separate storage-efficiency mechanisms such as block cloning, not the Deduplication feature. Volume F is excluded because exFAT is a lightweight file system with no support for Windows Server roles or features such as Deduplication, which depends on NTFS-specific metadata structures. That leaves volume D as the only NTFS data volume that is neither the boot volume nor formatted with an unsupported file system, so it is the only volume on which Data Deduplication can currently be enabled, making option C correct.

Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true

The requirement is to run virtual machines on VM1 itself, which means enabling nested virtualization so that VM1 (a guest VM hosted on Server2) can install Hyper-V and host its own virtual machines. Nested virtualization on Hyper-V requires the parent VM ' s virtual processor to expose the host ' s hardware virtualization extensions (Intel VT-x or AMD-V) through to the guest. This is done with the Set-VMProcessor cmdlet using the -ExposeVirtualizationExtensions parameter set to $true, run against VM1 from the Hyper-V host (Server2): Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true. VM1 must be turned off before this setting can be applied, and after it is applied, VM1 needs the Hyper-V role installed inside the guest before it can run its own VMs. Set-VM, Set-VMBios, Set-VMHost, and Set-VMFirmware do not control virtualization extension exposure: Set-VM manages general VM configuration such as memory and name, Set-VMHost configures host-wide settings, and Set-VMFirmware/Set-VMBios control boot and firmware settings for generation 2 and generation 1 VMs respectively. Only Set-VMProcessor with -ExposeVirtualizationExtensions satisfies the stated requirement, making it the correct first step.

Statement 1: No. Statement 2: Yes. Statement 3: No.

Password-policy (Account Policy) settings inside a GPO behave differently depending on where the GPO is linked. For domain user accounts, only Account Policy settings defined in a GPO linked at the domain level (or in a fine-grained Password Settings Object) take effect; Account Policy settings in a GPO linked to an OU are ignored for domain accounts and instead apply only to the local SAM password policy of computer objects located in that OU. GPO1 (minimum length 14) is linked to OU1, where Admin1 ' s user object resides, but because it is linked to an OU rather than the domain, it has no effect on Admin1 ' s domain account password requirement. Admin1 ' s domain password is governed only by the Default Domain Policy (minimum length 10), so statement 1 is false. User1 is likewise a domain account subject only to the Default Domain Policy ' s minimum length of 10, so statement 2 is true. GPO2 (minimum length 8) is linked to the Member Servers OU, which contains Server1 as a computer object; this makes GPO2 the effective local password policy for local accounts created on Server1 (overriding the Default Domain Policy locally), not the domain policy ' s 10-character minimum. Therefore a new local account on Server1 needs only eight characters, not ten, making statement 3 false.

User1: 9. Admin1: 8.

Fine-grained password policies delivered through Password Settings Objects (PSOs) take precedence over the domain-wide Default Domain Policy for any user they apply to. When more than one PSO would apply to the same user only through different group memberships (as opposed to one being linked directly to the user), the PSO with the lowest numeric precedence value wins. User1 is a member of both Group2 (targeted directly by PSO1, precedence 10, minimum password length 9) and Group4 (targeted directly by PSO2, precedence 20, minimum password length 11); since PSO1 ' s precedence value of 10 is lower than PSO2 ' s 20, PSO1 governs, giving User1 an effective minimum password length of 9. Admin1 is a member only of Domain Admins, which is not targeted by either PSO, so no fine-grained password policy applies. Admin1 is also in OU1, which has GPO1 linked to it with a minimum password length of 10, but Account Policy settings such as password policy configured in an OU-linked GPO never affect the effective password policy of domain user accounts -- only a GPO linked at the domain root can supply a fallback domain-wide default, and PSOs otherwise take precedence over that default. With no applicable PSO, Admin1 ' s effective policy falls back to the Default Domain Policy, whose minimum password length in this environment is 8.

Signing in over Remote Desktop requires a user to hold the " Allow log on through Remote Desktop Services " right and the " Access this computer from the network " right, and to be excluded from any matching Deny counterpart, since an explicit Deny always overrides an Allow granted through any other group membership. User1 is a member of Group2 (granted the Remote Desktop Services logon right) but is also a member of Group4, which is explicitly denied " Access this computer from the network " on Server4 -- that network-access denial blocks the RDP connection outright regardless of the Everyone-based network-access Allow or the RDS logon right, so User1 is denied. User2 belongs only to Group2: Group2 grants the RDS logon right, User2 is covered by the Everyone-based network-access Allow, and User2 is not a member of either Group3 or Group4, so neither Deny applies and User2 can sign in successfully. User3 is a member of Group3, which is explicitly denied " Allow log on through Remote Desktop Services " on Server4 -- that denial blocks the RDP logon right itself, so User3 cannot sign in regardless of network-access rights (and User3 is also in Group4, which independently denies network access as well). Therefore, only User2 can successfully sign in to Server4 using Remote Desktop.

Using Hyper-V Replica within a clustered Hyper-V environment such as Cluster3 requires deploying the Hyper-V Replica Broker, which itself runs as a clustered role on the failover cluster; without the Broker, replication cannot follow a protected virtual machine if it live-migrates between Cluster3 ' s nodes, since there would be no single, cluster-aware endpoint tracking which node currently owns each VM ' s replication state. Adding a failover cluster role is exactly how the Hyper-V Replica Broker is deployed onto Cluster3, satisfying the requirement to use Hyper-V Replica to protect Cluster3 ' s virtual machines. Enabling integration services on the virtual machines addresses guest-OS-to-host integration (time synchronization, heartbeat, and similar) rather than providing any replication capability. Adding a generic Windows Server server role does not, by itself, install or configure the Hyper-V Replica Broker -- the Broker must specifically be added as a clustered role through Failover Cluster Manager. Configuring a fault domain for the cluster is not a real Windows Server failover clustering concept and does not provide Hyper-V Replica capability. Therefore, adding a failover cluster role (the Hyper-V Replica Broker) is the correct solution for Cluster3.

Backing up a standalone Windows Server ' s files, folders, and system state directly to an Azure Recovery Services vault -- exactly what the requirement calls for on Server4 -- is done using the Microsoft Azure Recovery Services (MARS) agent, so installing that agent on Server4 is the necessary first step. Microsoft Azure Backup Server (MABS) is used for application-aware and Hyper-V virtual machine backups rather than direct file/system-state backup of a single standalone server, and while it can also protect servers, it is not the lightweight, direct-to-vault mechanism appropriate for a single standalone server like Server4 and represents unnecessary additional infrastructure. Native Windows Server Backup does not target an Azure Recovery Services vault on its own without additional agent installation, and Storage Replica provides block-level volume replication between servers rather than the point-in-time backup and long-term retention the requirement calls for. Therefore, installing the MARS agent on Server4 is the correct first step to meet this technical requirement.

Promoting a new domain controller that runs a newer operating system version than any existing domain controller in the forest -- here, DC4 running Windows Server 2022 into a forest whose functional level is still Windows Server 2012 R2 -- requires the Active Directory schema to first be extended to support that OS version ' s schema additions (the adprep /forestprep and /domainprep operations, which modern promotion tools such as Install-ADDSDomainController run automatically when needed). Extending the schema requires connectivity to the domain controller holding the Schema Master FSMO role, since schema changes can only be made by contacting that specific role holder; if the Schema Master is offline, the schema extension step fails and the promotion cannot proceed. According to the domain controllers table, DC1 holds both the RID master and the schema master roles. DC2 holds the PDC emulator and infrastructure master roles, and DC3 holds the domain naming master role -- neither of those role sets is relevant to a schema extension. Therefore, DC1, as the Schema Master, must be online for DC4 ' s promotion (and its associated schema extension) to succeed.

1. Create an Azure Recovery Services vault. 2. Create a Hyper-V site. 3. Install and register Azure Site Recovery Providers. 4. Create and associate replication policies.

Setting up Azure Site Recovery for a Hyper-V cluster that is not managed by Virtual Machine Manager follows a fixed infrastructure-preparation order. An Azure Recovery Services vault must exist first, since it is the container that every later step registers against. A Hyper-V site is then created in that vault to represent the on-premises Hyper-V environment, because a Hyper-V host or cluster must belong to a site before its hosts can be registered against Azure Site Recovery. The Azure Site Recovery Provider is then installed on the Hyper-V hosts (Cluster2 ' s nodes) and registered to that site/vault, which is what actually connects the cluster nodes to Azure Site Recovery. Only once the hosts are registered can a replication policy be created and associated with the Hyper-V site, since a policy has nothing to attach to until the site and its registered hosts already exist. Installing Azure Connected Machine agents is unrelated to Hyper-V VM replication -- that agent is used for onboarding servers to Azure Arc -- and is not part of this workflow. Therefore, the correct order is: create the vault, create the Hyper-V site, install and register the Providers, and create and associate the replication policy.

The Azure Site Recovery Provider must be installed and registered on every Hyper-V host that is a node of the cluster being protected, because each node is a location the protected virtual machines could reside on after a live migration, and each node must independently be able to track and replicate the VMs it is currently hosting. Cluster2 has four nodes according to the Hyper-V failover clusters table (Cluster1 has six nodes and eighteen virtual machines, Cluster2 has four nodes and twelve virtual machines, and Cluster3 has two nodes and six virtual machines), so a minimum of four Provider installations -- one per node -- is required; installing the Provider on only one, two, or three of the nodes would leave replication unable to follow a protected VM if it live-migrated to whichever node lacks the Provider, breaking continuous replication for that VM the moment it moved. Therefore, four is the minimum number of Azure Site Recovery Provider installations required to fully protect all of Cluster2 ' s virtual machines regardless of which node currently hosts them.

On the domain controllers: Install the Azure Monitor agent. In Azure: Create an Azure Log Analytics workspace.

Centrally managing performance alerts in Azure for on-premises domain controllers is done by connecting those servers to Azure Monitor: the Azure Monitor agent is installed on each domain controller (onboarded to Azure Arc for non-Azure servers, or directly if they are Azure VMs) to collect performance counters and event data, and that telemetry is sent to an Azure Log Analytics workspace, which is the resource that stores the collected data and against which performance-based alert rules are then defined and centrally managed. Creating a Data Collector Set in Performance Monitor and modifying the Performance Monitor Users group are both local, per-server administrative actions that never send any data to Azure and cannot support central, Azure-based alerting. An Azure SQL database, a Storage Sync Service, and an Azure Storage account are all Azure resources, but none of them is the telemetry store that Azure Monitor ' s alerting pipeline is built on -- only a Log Analytics workspace serves that role. Therefore, installing the Azure Monitor agent on the domain controllers and creating an Azure Log Analytics workspace are the two required actions.

Storage Migration Service is designed to migrate a file share such as Share1 to a new server (Server2) while carrying over both the share-level and NTFS folder/file permissions, and it can also perform a cutover of the source server ' s name and IP address if a fully transparent migration is later required. This directly satisfies the requirement to migrate Share1 to Server2 including all the share and folder permissions. File Server Resource Manager (FSRM) only provides quota, file-screening, and storage-reporting capabilities and has no mechanism to migrate data, shares, or permissions between servers. Server Manager is a general-purpose administration console with no dedicated share-migration workflow -- it can be used to create shares manually but cannot transfer existing permissions programmatically. Storage Replica performs block-level volume replication intended for disaster recovery and stretch-cluster scenarios rather than a one-time, permission-preserving share migration to a specific destination server. Therefore, Storage Migration Service is the correct tool to migrate Share1 to Server2 while preserving its share and folder permissions.

Restoring deleted objects from the Active Directory Recycle Bin requires permission to view and restore objects inside the forest ' s Deleted Objects container, and by default that container ' s access control list denies access to everyone except the SYSTEM account and members of Domain Admins (and Enterprise Admins at the forest root) -- no delegation to any other built-in group exists out of the box. Among the four groups offered, only Domain Admins carries this permission by default, since Account Operators (which can manage most user, group, and computer objects but has no special access to the hidden Deleted Objects container), Schema Admins (which governs schema modifications, not object restoration), and Backup Operators (which can back up and restore files and the system state, but not perform an online Active Directory Recycle Bin object restore through the Active Directory Administrative Center) all lack the needed access. The case study ' s general instruction to use the principle of least privilege where possible does not change this outcome here, since none of the three lower-privileged alternatives actually has the required capability by default -- Domain Admins is not merely the most convenient choice but the only one of the four that functionally works. Therefore, User1 must be added to Domain Admins to be able to recover objects from the Active Directory Recycle Bin.

Server1 can communicate with: Server2, Server3, and Server4. Server3 can communicate with: Server1 and Server2 only.

Server4 has no isolation connection security rule configured at all, so it never attempts or performs IPsec authentication with any peer. Server1 ' s rule only requests IPsec in both directions rather than requiring it, meaning that if IPsec negotiation does not occur -- as with Server4, which has no IPsec capability configured -- the connection still falls back to succeed in the clear; Server1 can therefore reach Server2, Server3, and Server4. Server3 ' s rule requires IPsec in both directions, meaning a connection only succeeds if IPsec authentication is actually negotiated. Server3 can successfully negotiate IPsec with Server1 (whose " request " setting means it will still respond to and complete an IPsec negotiation when the peer requires it) and with Server2 (which requires inbound and requests outbound IPsec, and likewise supports negotiation), so both of those connections succeed. Server3 cannot successfully negotiate IPsec with Server4, since Server4 has no IPsec capability configured at all, and Server3 ' s " require " setting blocks any connection that cannot be authenticated via IPsec. Therefore, Server1 can communicate with Server2, Server3, and Server4, while Server3 can communicate with only Server1 and Server2.

BitLocker: C, D, E, and F. Auto-unlock: D, E, and F only.

BitLocker Drive Encryption can be enabled on every volume shown in Server4 ' s disk configuration -- the NTFS-formatted operating system volume (C:), the NTFS data volume (D:), and the two ReFS-formatted data volumes (E: and F:). BitLocker has no file-system restriction that excludes ReFS: Microsoft ' s ReFS documentation and BitLocker ' s own volume support explicitly confirm that ReFS-formatted volumes, including already-encrypted ones that are later expanded, are fully supported, so E: and F: are just as eligible for BitLocker as the NTFS volumes. BitLocker auto-unlock, however, is a feature limited to fixed data volumes: it lets a data volume unlock automatically at startup using a key protected by the already-unlocked operating system volume, and it is not applicable to the OS volume itself, since the OS volume instead relies on the TPM (or a startup key/PIN) to unlock during boot -- there is no separate outer volume for it to depend on. Because C: is the operating system volume, auto-unlock cannot be configured on it, leaving D:, E:, and F: as the volumes eligible for auto-unlock. Therefore, BitLocker can be turned on for all four volumes (C, D, E, and F), while auto-unlock is available only on the three data volumes (D, E, and F).

Disk1: 2. Disk2: 1.

The requirement is that data on SSPace1 must remain available at all times, meaning the storage pool ' s virtual disks must be able to tolerate physical disk failures without becoming unavailable or losing data. A three-way mirror keeps three copies of every block of data spread across different physical disks, so it remains available and readable even if any two of those disks fail simultaneously; the resiliency is fixed at tolerating two failures regardless of how many total disks (8, in Disk1 ' s case) make up the pool, as long as there are enough disks to support three-way mirroring, which eight comfortably provides. Disk2 uses parity resiliency, which stores a single parity block that can reconstruct data after one physical disk failure; unless dual parity is explicitly configured (which requires being set at virtual disk creation time and is not indicated here), a standard parity virtual disk tolerates only one physical disk failure before data becomes unavailable, regardless of the pool having twelve physical disks. Administrators sometimes assume more disks in a parity pool automatically means more fault tolerance, but the number of disks a parity space can lose is determined by the resiliency configuration (single vs. dual parity), not by the total disk count. Therefore Disk1 tolerates two disk failures and Disk2 tolerates one.

Private1 is deployed with its inbound endpoint in VNet1, and an Azure DNS Private Resolver inbound endpoint can resolve only private DNS zones that are virtual-network-linked to the same virtual network where the resolver itself sits; it cannot resolve a zone just because it exists in the same subscription, or because that zone happens to be linked to a different, unrelated virtual network. Per the private DNS zone table, Zone1.com is linked to VNet1, Zone2.com is linked to VNet2, and Zone3.com has no virtual network link at all. Because Private1 ' s inbound endpoint lives in VNet1, only Zone1.com, the zone actually linked to VNet1, can be resolved through it. Zone2.com cannot be resolved by Private1 because it is linked only to VNet2, a separate virtual network with no stated peering or additional resolver configuration connecting it to VNet1; and Zone3.com cannot be resolved by any resolver in any virtual network because it has no virtual network link whatsoever, meaning no virtual network can consult it through the normal Azure-provided DNS resolution path. Extending resolution to Zone2.com would require either a separate resolver deployed in VNet2, or peering combined with a forwarding ruleset and outbound endpoint, neither of which is described as being configured here. Therefore only Zone1.com can currently be resolved.

1. roles 2. connections 3. connect to server dc2.adatum.com 4. quit 5. seize schema master

Because DC1 has failed and cannot gracefully transfer the schema master role, DC2 must forcibly seize it using ntdsutil.exe. From the initial ntdsutil prompt, the first command is roles, which enters the Role Management submenu where FSMO role transfers and seizures are performed. From within that submenu, the command connections opens the Connections submenu, which is required before you can bind ntdsutil to a specific target domain controller. Inside the Connections submenu, connect to server dc2.adatum.com establishes the bind to DC2, the domain controller that will actually take over the schema master role. The quit command then exits the Connections submenu and returns to the Role Management submenu while keeping the established connection to DC2 active. Finally, seize schema master, executed from the Role Management submenu while bound to DC2, forces DC2 to take ownership of the schema master role even though DC1 (the previous holder) is offline and cannot be contacted to confirm the transfer. The unused command in the list, metadata cleanup, is a separate, later step used to remove the failed DC1 ' s leftover directory metadata once its roles have been reassigned; it is not part of seizing the schema master role itself, so it is correctly left out of this five-step sequence.

Task1 is an Azure Automation runbook, and Azure Automation supports a specific, limited set of runbook types: PowerShell (and PowerShell Workflow), Python, and Graphical runbooks (which are authored visually rather than in a scripting language). Of the listed options, PowerShell and Python are the two genuine scripting languages Azure Automation lets you author a runbook in directly, making them the two correct answers. Java and JavaScript are not supported runbook languages in Azure Automation; JavaScript is used elsewhere in Azure (for example, in Azure Functions or Logic Apps custom code), but not for Automation runbooks. Bicep is a domain-specific language for declaratively defining Azure infrastructure as code (compiling down to ARM templates) and has no role as an executable runbook language; you would not write a Task1 runbook in Bicep, since runbooks execute imperative logic rather than declare resource deployments. Therefore, Python and PowerShell are the two languages available for Task1.

The requirement states that server administrators must request approval before establishing a Remote Desktop connection to an Azure virtual machine, and that once approved, the connection must be established within a defined two-hour window. This request-approve-then-time-limited-access pattern for a specific management port on an Azure VM is precisely what just-in-time (JIT) VM access, a Microsoft Defender for Cloud capability, provides: it keeps the RDP/SSH management ports closed by default in the network security group, requires an explicit access request, and, once approved, opens the port only for a specified time window and only from the requester ' s source IP. Microsoft Entra Privileged Identity Management provides time-bound, approval-based elevation for Microsoft Entra and Azure RBAC roles, not for opening network ports to a VM, so it does not by itself control Remote Desktop network access. The Remote Desktop extension for Azure Cloud Services is a legacy classic-deployment feature unrelated to this scenario. Azure Bastion provides browser-based RDP/SSH without exposing public IPs but does not implement an approval workflow with a bounded connection window. JIT VM access is therefore the correct, purpose-built solution.

Fabrikam ' s plan is to use Azure Policy to enforce configuration management policies across both its Azure and on-premises servers. Azure Policy ' s guest configuration capability, which evaluates and can remediate in-guest settings, only works against a server that is registered as an Azure resource. For an on-premises or non-Azure server, that registration is achieved by deploying the Azure Connected Machine agent, which onboards the machine as an Azure Arc-enabled server, gives it an Azure resource ID, and makes it a valid target for Azure Policy assignments, including guest configuration policies, in exactly the same way an Azure VM would be. Hybrid joining servers to Microsoft Entra ID affects identity and device management (such as Conditional Access) but does not make a server a valid Azure Policy target. A hybrid runbook worker lets Azure Automation runbooks execute on-premises but is unrelated to Azure Policy enforcement. The Azure Monitor agent collects telemetry into Log Analytics and Azure Monitor but does not register the server as an Arc resource or enable policy assignment on its own; it is typically deployed after Arc onboarding, not instead of it. Deploying the Azure Connected Machine agent is therefore the correct first step.

DHCP1 (New York, Scope1) and DHCP2 (Seattle, Scope2) currently serve only their own local office. To make DHCP highly available across both offices, the modern, supported approach is DHCP Failover, configured per scope (option E), which replicates lease information between DHCP1 and DHCP2 in either load-balance or hot-standby mode so that either server can service either scope ' s clients if its partner becomes unavailable. However, DHCP Failover alone only helps if a client ' s DHCP broadcast can actually reach the surviving partner server across the WAN; broadcasts do not cross routed office boundaries on their own. Configuring a DHCP relay agent on the router (or another relay-capable device) in each office (option B) forwards DHCPDISCOVER broadcasts from local clients to the remote partner server whenever the local DHCP server is down, allowing failover to actually take effect for clients in either office. The legacy split-scope technique of manually carving off a percentage of the other scope ' s addresses (options A and C) is the older, pre-failover workaround and is unnecessary once DHCP Failover is used; there is also no DHCP cluster role delivered through Windows Failover Clustering (option D), since DHCP achieves high availability through Failover mode, not a clustered role.

On a Virtual WAN hub: An ExpressRoute gateway. In the offices: An ExpressRoute circuit connection.

Fabrikam ' s plan is to replace the existing WAN links between the New York and Seattle offices with Azure Virtual WAN and ExpressRoute, connecting both offices to Vnet1 through the Virtual WAN hub. Azure Virtual WAN uses its own hub-native ExpressRoute gateway object (distinct from the standalone virtual network gateway used when ExpressRoute is connected directly to a single VNet); this ExpressRoute gateway is deployed inside the Virtual WAN hub and is required before any ExpressRoute circuit can terminate into that hub. A standard virtual network gateway is used for VNet-to-VNet or VPN scenarios, not for Virtual WAN hub ExpressRoute termination, and an ExpressRoute circuit connection itself is the logical link resource, not something you deploy on the hub. At each office, connectivity into Microsoft ' s network is established through an ExpressRoute circuit connection provisioned with a connectivity provider, which then links, via Microsoft ' s backbone, into the ExpressRoute gateway in the Virtual WAN hub. A Site-to-Site VPN, an Azure application gateway (a web traffic load balancer), and an on-premises data gateway (used for Power Platform/Logic Apps connectors) are all unrelated to this ExpressRoute-based design.

DC3 is a domain controller for the existing corp.fabrikam.com AD DS forest, deployed into Vnet1 in Azure. Domain controllers rely on AD-integrated DNS for locating other domain controllers, SRV records, and replication, so DC3 needs to host that zone itself, which requires installing the DNS Server role on DC3 and letting it host an AD-integrated copy of the corp.fabrikam.com zone. Azure ' s default virtual-network-provided DNS resolver has no awareness of AD DS records and cannot host or serve an AD-integrated zone, so every resource in Vnet1 that needs to locate the domain (including Azure VMs and DC3 ' s own replication partners) must be pointed at real DNS servers instead. That is accomplished by configuring the custom DNS Servers setting on Vnet1 to reference DC3 (and, once available, DC1 and DC2), which makes all Azure VMs in the virtual network resolve names through the AD-integrated DNS infrastructure rather than the platform resolver. An Azure DNS zone (public) or an Azure private DNS zone are separate, unrelated Azure-native DNS services that cannot host an AD-integrated zone and are not used for this scenario. Installing the DNS Server role on DC3 and pointing Vnet1 at it together satisfy the requirement.

GPO4 is already linked to the VirtualDesktops OU, which contains the Azure Virtual Desktop session host computer accounts, so it is correctly targeted at the right computers. The requirement is that the idle lockout behavior configured in GPO4 must apply to whichever user is signed in to a session host, and that the user must still be able to adjust the lockout time manually from their own client, which means the relevant setting is a per-user configuration item rather than a strict, non-negotiable computer policy. By default, user-configuration settings inside a GPO apply based on the OU containing the user account, not the computer the user signs in to; Fabrikam ' s users are located in the AllUsers OU, which is governed by GPO1, not GPO4. Group Policy Loopback Processing, enabled in GPO4 and set to Merge (to allow the client-side adjustment) or Replace, forces the user-configuration portion of GPO4 to apply to any user who logs on to a computer in the VirtualDesktops OU, regardless of where that user ' s own account resides. Security filtering and the Enforced property both affect who a GPO applies to or its precedence in conflicts, but neither one makes a GPO ' s user-side settings follow the computer instead of the user, so loopback processing in GPO4 is correct.

1. Create the KDS root key in AD DS. 2. Create a group managed service account (gMSA) in Active Directory. 3. Configure the IIS application pool (on WEB1 and WEB2) to run as the gMSA via a specified user account.

The requirement is that every instance of Webapp1 (running on both WEB1 and WEB2) uses the same identity, and that identity ' s password rotates automatically every 30 days, without any administrator manually resetting it. A standalone managed service account (sMSA) is tied to a single computer and cannot be shared across WEB1 and WEB2, so it does not meet the requirement. A group managed service account (gMSA) is designed exactly for this scenario: one AD-managed identity that multiple servers can use simultaneously, with the Key Distribution Service automatically rotating its password (by default every 30 days) without needing manual intervention or downtime. Before any gMSA can be created in the forest, a one-time prerequisite must exist: the KDS root key, which the Key Distribution Service uses to generate and later recompute the gMSA ' s password material. So the correct order is to first create the KDS root key, then create the gMSA object in Active Directory, and finally configure the IIS application pool on each web server to run as that gMSA using the " specified user account " identity option (entered as domain\gMSA$ with no password required, since the password is centrally managed). Creating a system- or user-assigned managed identity in Microsoft Entra ID does not apply here, since Webapp1 runs on IIS on domain-joined VMs, not as an Azure PaaS resource.

Sync groups: 3. Storage Sync Services: 1.

In Azure File Sync, a sync group defines a single sync topology and can contain exactly one cloud endpoint (one Azure file share) but can contain multiple server endpoints (on-premises server locations) that all sync to that same file share. Fabrikam needs newyorkfiles to sync only to FS1, seattlefiles to sync only to FS2, and companyfiles to sync to both FS1 and FS2. Because each Azure file share can only belong to one sync group, newyorkfiles requires its own sync group with a single server endpoint on FS1, seattlefiles requires its own sync group with a single server endpoint on FS2, and companyfiles requires a third sync group whose one cloud endpoint (companyfiles) has two server endpoints, one on FS1 and one on FS2, which Azure File Sync fully supports within a single sync group. That gives a minimum of three sync groups. A Storage Sync Service is the top-level Azure resource that contains and manages sync groups, and there is no requirement here that forces the shares into separate Storage Sync Service instances (such as differing regions or subscriptions); a single Storage Sync Service can hold all three sync groups. Therefore only one Storage Sync Service is required.

DC3 is explicitly described as a domain controller named dc3.corp.fabrikam.com that will exist inside Vnet1, meaning it must be a genuine, writable domain controller for Fabrikam ' s existing corp.fabrikam.com AD DS forest, replicating with DC1 and DC2. The only way to run an actual domain controller for an existing on-premises forest inside Azure is to deploy a regular Azure virtual machine, place it on Vnet1, install the AD DS role on it, and promote it as an additional domain controller for corp.fabrikam.com. Microsoft Entra Domain Services is a fundamentally different, fully managed service: it creates its own separate, standalone managed domain and does not add a domain controller to, or replicate directly with, an existing on-premises forest, so it cannot be used to deploy " DC3 " as described. Microsoft Entra Application Proxy publishes on-premises web applications to external users and has nothing to do with domain controller placement. A Microsoft Entra administrative unit is a container used to scope administrative permissions over Microsoft Entra objects and is unrelated to deploying infrastructure. Therefore, an Azure virtual machine, promoted to a domain controller, is the correct implementation for DC3.

Microsoft Defender for Identity is the Microsoft Sentinel data connector purpose-built to monitor on-premises Active Directory domain controllers and surface exactly the insecure-protocol activity described in the requirement, including authentication attempts and sign-ins that rely on legacy or unsigned protocols such as NTLMv1, SMBv1, and unsigned LDAP binds. It does this by analyzing domain controller network traffic and Windows Events directly on the DCs, which is exactly where this insecure-protocol usage originates. The Threat Intelligence - TAXII connector ingests external threat-intelligence indicator feeds (IP addresses, file hashes, domains) from TAXII-compliant sources and has nothing to do with monitoring authentication protocol usage on domain controllers. The Azure Active Directory (Microsoft Entra ID) connector reports on cloud sign-in and audit log events for the Entra tenant, not on legacy protocol usage against on-premises AD DS domain controllers. Microsoft Defender for Cloud focuses on cloud resource security posture management and workload protection rather than detecting legacy authentication protocol usage against on-premises domain controllers. Therefore, connecting Microsoft Defender for Identity to Microsoft Sentinel is the correct connector to identify connections to the domain controllers that use insecure protocols.

1. Add a disk resource to the cluster. 2. Create a Cluster Shared Volume (CSV). 3. Put the disk in maintenance mode. 4. Enable BitLocker on the volume. 5. Update the BitLockerProtectorInfo property of the volume.

BitLocker can only be enabled on a Cluster Shared Volume disk while that disk is taken offline to cluster I/O, so the CSV must exist and be placed into maintenance mode before encryption can be applied. The supported sequence begins by adding the disk resource to the cluster and converting it into a Cluster Shared Volume, since BitLocker-on-CSV support requires the disk to already be a CSV rather than a plain cluster disk. The disk is then put into maintenance mode, which takes it offline to the other cluster nodes so it can be safely encrypted without a node attempting to access it mid-operation. With the CSV disk offline in maintenance mode, BitLocker is enabled on the volume. Finally, the volume ' s BitLockerProtectorInfo property is updated so that Failover Clustering registers the unlock protector, allowing the volume to automatically unlock on every cluster node once maintenance mode ends and the CSV is brought back online. Performing these steps out of order either fails outright -- BitLocker cannot be enabled on a CSV disk that is still online and actively used by the cluster -- or leaves the other cluster nodes unable to bring the encrypted volume back online afterward, since they would lack the registered unlock protector. Therefore, the correct order is: add the disk resource, create the CSV, put the disk in maintenance mode, enable BitLocker, and update BitLockerProtectorInfo.

On Cluster1: Import the Azure Migrate appliance. In Azure: Create an Azure Migrate project.

APP3 and APP4 run as virtual machines on the on-premises Cluster1 Hyper-V failover cluster, so migrating them to Azure uses the Azure Migrate: Server Migration workflow for Hyper-V. That workflow requires an Azure Migrate project to first be created in Azure, since the project is the container that organizes the migration effort, tracks discovered and assessed machines, and holds the configuration for the subsequent discovery and replication work. On the Cluster1 side, the Azure Migrate appliance -- a purpose-built VM or OVA image supplied by Azure Migrate specifically for Hyper-V environments -- must be imported (deployed) onto the Hyper-V host or cluster, where it discovers the VMs running there and orchestrates their replication into Azure. Configuring an Azure Network Adapter, creating a Point-to-Site VPN connection to Vnet1, installing the Azure File Sync agent, and installing the Windows Server Migration Tools are all unrelated actions that do not perform Hyper-V VM discovery or replication for an Azure Migrate project. Similarly, creating a premium block blob storage account, a private endpoint, or a VPN gateway in Azure are not the resource that Azure Migrate itself requires to begin a migration project -- an Azure Migrate project is. Therefore, importing the Azure Migrate appliance onto Cluster1 and creating an Azure Migrate project in Azure are the two required preparatory actions.

Storage Migration Service is purpose-built to inventory the data, security descriptors, and both share-level and NTFS-level permissions on a source file server such as Fileserver1, transfer that data to a destination server such as Fileserver2, and then perform a cutover that reassigns the source server ' s network identity -- its computer name and IP address -- to the destination server. That cutover step is precisely what allows the existing \\Fileserver1\Data UNC path, already relied upon by the Chicago office application, to continue working unchanged after the migration, since client requests to that path transparently resolve to Fileserver2 once it has taken on Fileserver1 ' s identity. The Microsoft File Server Migration Toolkit and Windows Server Migration Tools are older, largely superseded utilities that can move some file server settings but do not provide this automated inventory-transfer-and-cutover workflow, and neither preserves the source server ' s identity on the destination the way Storage Migration Service does, meaning the UNC path would need to be manually updated or redirected. File Server Resource Manager (FSRM) is a quota, file-screening, and storage-reporting feature entirely unrelated to migrating data between servers. Therefore, Storage Migration Service is the correct tool to perform this migration while preserving the existing UNC path.

Enforce the security policy: Microsoft Defender Application Control. Manage the policy settings: Group Policy Objects (GPOs).

Windows Defender Application Control (WDAC) is the platform feature that enforces which applications are authorized to install or run on a Windows Server, directly meeting the stated requirement that only authorized applications can be installed or run on the servers in the forest. Microsoft Defender Application Guard isolates untrusted browsing sessions in a container and Microsoft Defender Credential Guard protects credential material from theft -- neither controls which applications are permitted to execute. Microsoft Defender for Endpoint is an endpoint detection-and-response platform that detects and responds to threats rather than enforcing a whitelist of permitted applications. Because the servers described are on-premises, domain-joined machines rather than Intune-managed, Microsoft Entra-joined devices, the WDAC policy settings here must be managed through Group Policy Objects distributed via AD DS, not through Intune. Configuration profiles in Microsoft Intune and compliance policies in Microsoft Intune are both cloud-management mechanisms that apply only to devices enrolled in and managed by Intune, which these on-premises, domain-joined servers are not. Therefore, WDAC is the enforcing service and Group Policy Objects are the correct management mechanism for these on-premises servers.

A Windows Server failover cluster requires a distinct IP address for each individual cluster node ' s network adapter, plus one additional IP address for the cluster ' s own network name resource -- the cluster access point that clients and management tools use to address the cluster as a single logical entity rather than any one specific node. Cluster3 will contain two physical nodes, Node1 and Node2, so at minimum one IP address is required for Node1 ' s network adapter and one for Node2 ' s network adapter. Beyond those two node-level addresses, the cluster core resource itself (the cluster name object and its associated IP address resource) requires one more address so that the cluster can be addressed and managed as a whole and so that any highly available roles hosted on the cluster (such as the file share role planned for Cluster3) can obtain the network identity they need to fail over between nodes. Adding these together -- one for Node1, one for Node2, and one for the cluster ' s own network name -- yields a minimum of three IP addresses required for Cluster3 ' s node and cluster roles. Fewer than three would leave either a node or the cluster itself without a usable network identity, and while additional IP addresses may be consumed by highly available roles later added to the cluster, three is the baseline minimum for the node and cluster roles themselves.

To enable WebApp1 to handle requests for the website: Add a custom domain name. To point client connections to WebApp1: Modify a DNS record.

For an Azure App Service web app to accept and correctly serve requests addressed to https://www.fabrikam.com rather than only its default *.azurewebsites.net hostname, the custom domain www.fabrikam.com must be added and bound to WebApp1 -- this is the specific configuration step that makes the app recognize and handle that custom hostname at all. Creating a deployment slot supports staged rollout and swap scenarios and does nothing to bind a custom domain, and creating a private endpoint provides private, VNet-restricted connectivity rather than public custom-domain handling, so neither accomplishes the stated goal. Once WEB1 and WEB2 are decommissioned per the migration plan, client traffic that currently resolves to those on-premises-facing web servers must instead be directed to WebApp1; since DNS is what resolves the www.fabrikam.com name to a specific endpoint, the DNS record for that hostname must be modified (typically to a CNAME record pointing at WebApp1 ' s default hostname, together with the domain-verification TXT record Azure requires before it will accept the custom domain binding). Azure Front Door and Azure Traffic Manager are global routing and load-balancing services meant for multi-region or multi-endpoint failover scenarios and are unnecessary complexity for redirecting a single custom domain to a single web app, and adding HTTP redirect rules on WEB1/WEB2 is not a viable option once those servers have been decommissioned. Therefore, adding a custom domain name to WebApp1 and then modifying the DNS record are the two required actions.

Server administrators can be prevented from configuring Windows Defender Firewall rules by defining firewall policy centrally in a Group Policy Object and linking it to the servers ' organizational unit(s); domain-based GPO firewall policy overrides any local, administrator-configured Windows Defender Firewall rules on the domain-joined servers, since Group Policy-delivered firewall settings take precedence over local policy. Adaptive network hardening in Microsoft Defender for Cloud only generates recommendations to tighten network security group (NSG) rules protecting Azure resources -- it has no visibility into or control over host-based Windows Defender Firewall configuration on on-premises servers. A network security group (NSG) in Sub1 filters traffic at the Azure virtual network boundary and has no bearing on the on-premises Chicago office servers described in the scenario. An Azure Firewall policy governs the centrally managed Azure Firewall network virtual appliance, not the host-based Windows Defender Firewall running locally on each on-premises server. Because the servers in question are on-premises and domain-joined, only a Group Policy Object can centrally enforce and lock down their local Windows Defender Firewall configuration, preventing server administrators from modifying the rules directly on each machine. Therefore, configuring a GPO is the correct way to reduce this security risk.

DHCP1: Export-DhcpServer, Remove-DhcpServerInDC. DHCP2: Add-DhcpServerInDC, Import-DhcpServer.

Migrating a DHCP server ' s configuration together with its existing leases and reservations by PowerShell follows an export/unauthorize-then-authorize/import pattern across the two servers. On the source server, DHCP1, Export-DhcpServer captures the existing scopes, options, leases, and reservations into a migration file, which is what allows the existing leases and reservations to actually carry over to the replacement server. Remove-DhcpServerInDC is then run on DHCP1 to unauthorize it in Active Directory, which is what prevents DHCP1 from continuing to service client requests once DHCP2 is brought online, satisfying that specific migration requirement. On the target server, DHCP2, Add-DhcpServerInDC authorizes the new server in AD DS so it is permitted to lease addresses on the network, and Import-DhcpServer then applies the configuration file exported from DHCP1, causing DHCP2 to hand out the same address ranges as DHCP1 along with the existing leases and reservations that were captured during export. Add-DhcpServerv4Scope and Remove-DhcpServerv4Scope only create or delete an individual scope ' s address range and do not export, import, or preserve any existing lease or reservation data, so neither is part of this migration sequence. Therefore, DHCP1 requires Export-DhcpServer and Remove-DhcpServerInDC, while DHCP2 requires Add-DhcpServerInDC and Import-DhcpServer.