Microsoft AZ-802 Dumps

By default, a forest trust allows any authenticated user from any domain in the trusted forest to attempt authentication to any resource in the trusting forest, subject only to the resource ' s own permissions; there is no per-resource restriction on which trusted-forest principals are even allowed to try. Selective authentication is the trust-wide setting that changes this: once enabled, users and groups from the trusted forest must be explicitly granted the " Allowed to Authenticate " permission on the specific computer object they need to reach, and only those explicitly granted principals can complete authentication to it at all. Because the requirement is to restrict authentication to server1.contoso.com down to only fabrikam\Group1, out of an entire 10-child-domain trusted forest, the necessary first step is enabling Selective authentication on the forest trust; only after that is in place does it become meaningful to then grant fabrikam\Group1 the Allowed to Authenticate permission on server1 ' s computer object, which is the next step, not the first. Changing the trust to a one-way external trust would abandon the forest-wide relationship entirely and does not itself restrict authentication to one group. Adding fabrikam\Group1 to a local group on Server1 accomplishes nothing without selective authentication enabled, since every other trusted-forest user could still authenticate too. SID filtering addresses a different concern (preventing SID-history spoofing across the trust) and plays no role in restricting which principals may authenticate to a specific server.

The Validate-Dcb cmdlet is specifically designed to verify that Data Center Bridging (DCB) and RDMA-related network settings are correctly and consistently configured on a server that uses converged, teamed adapters such as a Switch Embedded Teaming (SET) team -- a common configuration for Storage Spaces Direct and other RDMA-dependent failover cluster scenarios. It checks settings such as the DCBX willing mode, priority flow control (PFC), enhanced transmission selection (ETS)/QoS, and RDMA-related network adapter properties across the physical adapters underneath the SET team, and reports misconfigurations that would otherwise cause RDMA traffic to silently fall back to TCP or fail, degrading cluster storage performance. Server Manager provides general role/feature installation and basic server management but has no dedicated capability to validate DCB/RDMA network configuration. The Get-NetAdapter cmdlet returns basic adapter state and properties (link speed, status) but does not validate DCB policies, RDMA capability negotiation, or PFC/ETS settings. Failover Cluster Manager ' s Validate a Configuration wizard runs general cluster validation tests (storage, networking, and so on) but does not perform the specialized DCB/RDMA validation that Validate-Dcb provides, and would normally be run only after the underlying RDMA networking has already been confirmed healthy. Because the requirement is specifically to verify RDMA and DCB-related settings on SET-teamed Hyper-V hosts before clustering, the appropriate tool is the Validate-Dcb cmdlet.

Restricting which applications are allowed to modify data inside a set of designated protected folders is specifically the job of Controlled folder access, a ransomware-protection feature configured under Virus & threat protection settings in Microsoft Defender Antivirus, which maintains an allow-list of trusted applications permitted to write to those protected folders while blocking every other process from doing so. Reputation-based protection, by contrast, is found under App & browser control and works through Microsoft Defender SmartScreen, evaluating the reputation of downloaded files, apps, and sites and warning about or blocking ones considered potentially malicious based on reputation data; it has no mechanism whatsoever for restricting which applications can write to a specific folder on the file system, since folder-level write access simply isn ' t within its scope of protection. Because Reputation-based protection governs a completely different aspect of endpoint security -- reputation-based screening of downloaded content rather than folder-level application allow-listing -- configuring it does nothing to address the stated requirement, and only Controlled folder access under Virus & threat protection actually meets this specific goal. Therefore, configuring Reputation-based protection does not meet the goal.

For any non-Azure machine, whether on-premises or hosted in another cloud, to be used as a source for an Azure Monitor Agent-based Microsoft Sentinel data connector such as the Windows Firewall connector, the machine must first be onboarded to Azure Arc as a connected machine. Installing the Azure Connected Machine agent on Server1 is precisely the action that performs this onboarding: it registers Server1 as an Azure Arc-enabled server, giving it an Azure resource identity that can then have extensions such as the Azure Monitor Agent deployed to it and associated with a data collection rule. This Azure Arc onboarding is the documented prerequisite step described in Microsoft ' s guidance for connecting Windows-based, non-Azure servers to Sentinel ' s AMA-based data connectors, and once Server1 is Arc-enabled, the Azure Monitor Agent extension and a data collection rule targeting the Windows Firewall log source can be deployed to it to complete the log collection pipeline. Because installing the Azure Connected Machine agent is exactly the required first step for enabling this scenario, this solution meets the goal.

A connection security rule only adds an authentication (IPsec) requirement to traffic that a firewall rule already permits; it does not, by itself, open or expand what a firewall rule allows. Because each server ' s Windows Defender Firewall is configured to allow communication only between servers on the same network segment, Server1 and Server2 (both on 192.168.1.0/24) are already permitted to communicate, so Server1 ' s Isolation rule, which only requests (not requires) outbound authentication, does not block that traffic even without a matching rule on Server2. Server3 sits on a different segment (192.168.5.0/24) from both Server1 and Server2, and because the firewall ' s same-segment scope restriction governs whether traffic is allowed at all, neither Server2 ' s attempt to reach Server3 nor Server3 ' s attempt to reach Server1 succeeds, regardless of the Server-to-server connection security rule configured on Server3, since that rule can only add authentication to already-permitted traffic and cannot bypass the firewall ' s segment-based scope restriction.

A Site-to-Site VPN in Azure requires three specific resources working together: a virtual network gateway, which is the actual Azure-side VPN gateway deployed into a dedicated gateway subnet of VNet1 and terminates the VPN tunnel from the Azure side; a local network gateway, which is an Azure resource representing the on-premises side of the connection -- it records the on-premises VPN device ' s public IP address and the on-premises address space(s) that need to be reachable through the tunnel; and a VPN connection resource, which ties the virtual network gateway and the local network gateway together with a shared key (or certificate-based configuration) to actually establish and describe the IPsec/IKE tunnel between them. A network security group filters traffic on subnets or NICs and plays no role in establishing the VPN tunnel itself. An Azure NAT gateway provides outbound-only source NAT for a subnet and is unrelated to Site-to-Site VPN connectivity. An Azure Route Server enables dynamic route exchange with network virtual appliances via BGP and is not a required component for a basic S2S VPN setup. Therefore, the three resources required are the VPN connection, the virtual network gateway, and the local network gateway.

Direct access (DAX) mode for persistent memory volumes in Storage Spaces Direct is supported only in combination with the NTFS file system; a persistent memory volume formatted with ReFS can only be used in block access mode, not DAX mode, regardless of when that volume was created. Volume1 and Volume3 are formatted with NTFS, while Volume2 and Volume4 are formatted with ReFS, so DAX is available on Volume1 and Volume3 and is not available on Volume2 or Volume4. Because file system type -- rather than whether a volume is part of the existing deployment or a newly planned addition -- is the determining factor for DAX eligibility, both the currently deployed NTFS volume (Volume1) and the newly planned NTFS volume (Volume3) qualify for DAX. This NTFS-only restriction for DAX, contrasted with block access mode ' s support for both NTFS and ReFS, is a core planning consideration whenever persistent memory is deployed with Storage Spaces Direct. Therefore, Volume1 and Volume3 only is the correct answer.

On DC1: Install the Microsoft Entra Password Protection DC agent. On a member server: Install the Microsoft Entra Password Protection proxy service. In Microsoft Entra ID: Configure Microsoft Entra Password Protection.

Microsoft Entra Password Protection uses a distributed on-premises architecture: the DC agent service runs on every domain controller (including DC1) to evaluate each password change against the banned-password list locally, while a separate proxy service runs on a domain-joined member server -- never on a domain controller itself -- and relays policy download requests from the DC agent out to Microsoft Entra ID over the internet. Because DC1 has no internet access, this design lets DC1 obtain the current banned-password list indirectly through the proxy rather than needing direct outbound connectivity of its own. Both the global banned-password list (covering common weak passwords) and any custom banned terms (such as the company name) are defined and managed centrally in the Microsoft Entra admin center in the cloud, which is why Microsoft Entra Password Protection itself must be configured there. This combination meets both requirements -- blocking known weak passwords and organization-specific terms -- without requiring internet connectivity on the domain controller.

Block the restricted extensions: A file screen. Set the DataUse value: A file classification rule. Move stale archived files: A file management task.

A file screen is the FSRM feature that actively blocks users from saving files of specified extensions, such as .mp3 and .mp4, into a monitored folder, either rejecting the save outright (active screening) or only logging/notifying (passive screening), which directly matches the requirement to prevent users from saving those two file types into the Contracts share. A file classification rule automatically evaluates files against defined conditions (such as file location, content, or existing property values) on a schedule and assigns or updates a classification property, such as a custom DataUse property, without any user action, which is exactly the mechanism needed to automatically set the DataUse value for contract files as they are created or modified, something neither a file screen nor a quota can do since neither of those features write classification property values. A file management task is the FSRM feature that runs on a schedule against files matching a defined classification-property condition (here, DataUse=Archive) and a file-age condition (not accessed for 365 days) and then performs an action, such as moving those matching files to D:\Expired, which is precisely the automated move-based cleanup requirement described; access-denied assistance only customizes the end-user error experience when access is denied and has no file-classification or file-movement capability, and a storage report only produces informational output rather than performing any action.

Ntdsutil.exe is the built-in tool used to create and manage Active Directory Domain Services snapshots, which are point-in-time, volume-shadow-copy-based captures of the AD database that can be taken without stopping the domain controller. Dsamain.exe then mounts one of those snapshots and exposes its contents as a read-only LDAP directory on a separate port, letting an administrator browse, compare, or recover objects from the earlier point in time without performing an authoritative restore. This snapshot-and-mount workflow is the standard low-impact way to inspect prior AD DS state for recovery purposes. Active Directory Administrative Center and Active Directory Users and Computers can browse and compare objects once dsamain.exe has exposed the snapshot as an LDAP endpoint, but neither tool creates the snapshot itself or mounts it as a directory instance, which is why ntdsutil.exe and dsamain.exe are the two tools that must be matched to these specific tasks. Dsmgmt.exe, the fifth tool in the list, is used for different administrative operations such as managing FSMO role seizure or DSRM password resets, and plays no part in the snapshot creation or exposure workflow being tested here.

Since name resolution of server1.contoso.com is failing even though the host is reachable by IP address and the firewall is confirmed to be configured correctly, the next step is to query DNS directly rather than test network connectivity again. The nslookup command queries a DNS server for the record associated with a name (or performs a reverse lookup) and reports whether the expected A/AAAA record exists, which is exactly what is needed to validate the DNS record for server1.contoso.com. tracert and pathping test the network path/latency to a destination, and ipconfig only displays or manages the local machine ' s own IP configuration, none of which validate a DNS record on the DNS server itself. Running nslookup server1.contoso.com against the domain ' s DNS server will either return the expected IP address, confirming the record exists and pointing to a client-side caching or configuration issue, or return an error indicating the record is missing or stale, which would direct troubleshooting toward AD-integrated DNS replication or the record ' s TTL and scavenging settings.

Contractor1: Account is disabled. Admin1: Account is sensitive and cannot be delegated.

The Account is disabled option immediately and completely prevents an account from signing in to any computer at all until an administrator explicitly clears the option, which is exactly the requirement for Contractor1: the account remains fully blocked from interactive sign-in until an administrator re-enables it, unlike options such as User must change password at next logon (which still permits an initial sign-in) or Smart card is required for interactive logon (which changes the authentication method rather than blocking sign-in outright). The requirement for Admin1, that the account ' s credentials must not be usable by any service acting on behalf of other users, describes credential delegation, the mechanism by which a service that has authenticated as Admin1 can reuse those credentials to access further network resources impersonating Admin1; the Account is sensitive and cannot be delegated option sets the underlying userAccountControl flag that prevents any service or application from being granted a delegated (forwardable) Kerberos ticket for that account, so no downstream service can present Admin1 ' s credentials to a third resource on the user ' s behalf, directly satisfying the requirement. Password never expires and User cannot change password address password lifecycle and self-service password changes, not sign-in blocking or delegation, and neither would achieve either stated requirement for Contractor1 or Admin1.

The Balancer tab shows Enable Automatic Balancing of Virtual Machines checked with the Always load balance option left unselected, which corresponds to the cluster ' s AutoBalancerMode being set to 1, meaning node fairness rebalancing is triggered only when a node actually joins the cluster, rather than mode 2, which would also rebalance on a recurring timer. In this mode, adding a new Hyper-V node to Cluster1 constitutes a node-join event, so the cluster ' s node fairness feature does automatically live-migrate one or more virtual machines onto the newly joined node to level out CPU load across all nodes, making statement 1 true. Because rebalancing is not time-triggered under this configuration, simply waiting an hour after running commands, with no node joining or leaving the cluster in between, does not by itself cause any automatic migration from Node1 to Node2, so statement 2 is false. VM6 in the scenario runs on the separate standalone host Host1, not as a clustered virtual machine on a node of Cluster1, and deploying it specifically to Node1 would make it a clustered VM sharing Node1 ' s existing load, but that placement action is not a node-join event either, so it does not trigger the automatic node-fairness rebalance, making statement 3 false as well.

Server2 can ping Server1 successfully: Yes. Server2 can connect to a file share on Server1: Yes. Server3 can connect to a file share on Server1: No.

Server1 ' s connection security rule, Rule1, requires authentication for both inbound and outbound connections on the Domain profile using the Computer (Kerberos V5) method, and Server1 ' s inbound firewall rules for File and Printer Sharing, including the ICMPv4 and ICMPv6 Echo Request rules and the SMB-In rule, are all enabled and set to Allow. Server2 has an identical connection security rule configured, also using Computer (Kerberos V5) authentication on the Domain profile, so Server1 and Server2 can successfully negotiate the mandatory IPsec security association that Rule1 requires; because the underlying firewall rules for ICMP and SMB traffic already allow the traffic through, Server2 can both successfully ping Server1 and connect to a file share on Server1 once that IPsec authentication succeeds. Server3, however, has no connection security rule configured in this scenario that matches Server1 ' s requirement, so it cannot complete the mandatory IPsec authentication that Rule1 demands for all inbound and outbound traffic on Server1; even though the SMB-In firewall rule would otherwise permit the traffic, the connection security requirement blocks Server3 from establishing the necessary secured session, so Server3 cannot connect to a file share on Server1.

The Azure Migrate appliance only continuously discovers the specific hosts and clusters that have been explicitly registered with it as discovery sources through the appliance ' s own configuration manager; it does not automatically expand its discovery scope to cover additional Hyper-V hosts on the network just because they exist. Migrate1 is currently hosted on Server1, but for virtual machines created on Server2 and Server3 to also show up and be tracked in Azure Migrate alongside those on Server1, an administrator must explicitly add Server2 and Server3, or their respective Hyper-V hosts, as additional discovery sources on Migrate1, which causes the appliance to begin enumerating and continuously tracking their virtual machine inventory as well. Creating a GlobalName zone on the DNS server, setting the Computer Browser service ' s startup type to Automatic, and deploying a WINS server are all legacy NetBIOS name-resolution mechanisms from an earlier era of Windows networking, and none of them has any role whatsoever in how the Azure Migrate appliance discovers hosts or virtual machines. Therefore, adding a discovery source on Migrate1 is the correct action to take.

The RD Gateway role is specifically designed to let Remote Desktop clients on the internet connect securely to internal RDS session hosts (or other RDP-enabled servers) by tunneling RDP traffic inside an HTTPS (TLS-protected, port 443) connection, which means the only port that needs to be exposed to the internet is 443 on the RD Gateway server itself; internal RDP port 3389 never has to be opened to the internet on any session host or connection broker, since the gateway terminates the external HTTPS connection and relays the traffic internally, satisfying the requirement to keep internal RDP ports closed from the internet while still allowing full Remote Desktop connectivity for administrators working remotely. RD Connection Broker only manages session load balancing, reconnection, and directing users to the correct session collection within the farm, and has no role in securing or tunneling external connections. RD Virtualization Host supports personal/pooled virtual desktop collections rather than remote access security, and RD Session Host simply hosts the actual RemoteApp programs and desktop sessions, again without any external-access security function. RD Web Access provides a browser-based portal for launching RemoteApp programs and desktops but still relies on an RD Gateway underneath to actually tunnel the RDP traffic securely from the internet, so RD Gateway is the role that directly satisfies the stated requirement.

Azure Monitor diagnostic settings require the destination storage account to be a Standard-tier account, since Premium-tier storage accounts are explicitly unsupported as diagnostic settings destinations regardless of their storage kind, and for a regional resource like VM1 the storage account must also be located in the same Azure region as the resource being monitored. Storage2, of kind BlockBlobStorage, and storage3, of kind FileStorage, are both Premium-tier storage kinds and are therefore ineligible destinations no matter what region they sit in, since Premium performance tiers for those kinds are inherently Premium-only offerings. Storage4 is a general-purpose v2 account, which is Standard-tier and would otherwise be eligible, but it is located in Central US, a different Azure region from VM1 ' s East US, so the regional-match requirement rules it out for this specific VM. Storage1 is the only account in the table that is simultaneously a Standard-tier general-purpose v2 kind and co-located with VM1 in East US, satisfying both the tier and region requirements at once, which makes it the only valid selection for VM1 ' s diagnostic settings destination.

GPO1 is linked at the domain level (contoso.com), so without any further restriction it would normally apply to every computer object in the domain, including Computer1, Server1, Server2, and Server3. However, the shortcut preference item Shortcut1 has item-level targeting configured with an operating system targeting condition that requires the processing computer ' s operating system to match " Windows Server 2022 Family " -- this is evaluated locally on each targeted computer during Group Policy preference processing, and the preference item is applied only when the condition evaluates to true for that specific computer; if the condition fails, the client-side extension simply skips applying that particular preference item on that computer, while the rest of the GPO (if it had other, non-targeted settings) would still apply normally. Checking each computer ' s operating system against the table: Computer1 runs Windows 11 (fails the condition), Server1 runs Windows Server 2016 (fails), Server2 runs Windows Server 2019 (fails), and Server3 runs Windows Server 2022 (matches the " Windows Server 2022 Family " condition). Therefore, even though GPO1 itself is linked domain-wide and would otherwise reach all four computers, the item-level targeting on Shortcut1 restricts its actual application to Server3 only.

New-AzADServicePrincipal -DisplayName ' arc-for-servers ' -Role ' Azure Connected Machine Onboarding '

At-scale onboarding to Azure Arc with a deployment script authenticates using a service principal rather than an interactive sign-in, and Microsoft ' s guidance for scripted, least-privilege onboarding is to create that service principal with New-AzADServicePrincipal, supplying a -DisplayName and assigning it the built-in Azure Connected Machine Onboarding role, optionally scoped to a specific resource group with -Scope. This role grants only the permissions required to register a machine with Arc and complete the connect operation; it does not include general compute, storage, or networking rights, which is why it satisfies least privilege far better than a broad role such as Contributor. The other two cmdlets in the option list do not fit this task: New-AzADAppCredential only adds or rotates a credential (secret or certificate) on an application object that already exists, and it performs no role assignment; New-AzUserAssignedIdentity creates a standalone managed identity resource, which is a different authentication mechanism used by Azure resources calling other Azure services, not a mechanism a locally run onboarding script can use to authenticate against an Azure AD tenant. For the role value, Virtual Machine Contributor and Virtual Machine User Login both exceed what onboarding needs, since they grant ongoing VM management or interactive sign-in rights rather than the narrow, one-time registration permission the Azure Connected Machine Onboarding role provides.

Collecting standard performance counters such as memory usage through VM insights only requires the Azure Monitor Agent together with an associated data collection rule, so VM1 needs no additional agent. The Map feature, however, visualizes process-level dependencies and connections between machines, and that capability is provided specifically by the Dependency agent working alongside the Azure Monitor Agent; the Azure Monitor Agent alone does not populate the Map view. Because VM2 needs the Map feature, it requires both the Azure Monitor Agent and the Dependency agent, while the separate Azure Linux VM Agent is the base platform extension-hosting agent that is already present on the VM and is not an additional monitoring agent to add. Installing only the minimum agents needed for each requirement, rather than deploying the Dependency agent everywhere by default, keeps per-VM overhead lower and matches the stated requirement to minimize the number of agents on each virtual machine.

The Azure Migrate physical server migration support matrix explicitly lists teamed network interface cards as an unsupported source-machine configuration for agent-based, Mobility-service physical server migration, and Server1 ' s configuration table shows NIC Teaming as Enabled, which is precisely the condition the support matrix flags as a blocker. Disabling NIC teaming on Server1 directly removes that one unsupported configuration item, which is the actual root cause preventing the migration from proceeding, and doing so allows the Mobility service already installed on Server1 to establish the network connectivity Azure Migrate needs without the teaming configuration interfering. Reviewing the rest of Server1 ' s configuration confirms that the operating system disk size, the data disk size, the Windows Firewall state, and the Microsoft Defender Antivirus state are all already within Azure Migrate ' s supported limits and were never the actual blocking factor in the first place, so no additional remediation beyond disabling NIC teaming is required. Because this solution directly addresses the one configuration item the support matrix actually flags as unsupported, disabling NIC Teaming on Server1 does meet the stated goal.

repair-bde.exe is a disk-repair utility, not a lookup or reporting tool: its purpose is to attempt to decrypt or repair a corrupted BitLocker-protected volume when normal unlock methods have failed, and it accepts either a recovery password or a previously exported BitLocker key package (a file containing the actual encryption keys needed to decrypt sectors directly) as the credential it uses to perform that repair; running it does not display, output, or otherwise identify the volume ' s 48-digit numerical recovery password value to the administrator at all, and a key package is a different artifact from the recovery password that would actually need to be entered at Server1 ' s BitLocker recovery screen to unlock it through the normal recovery workflow. The stated goal is specifically to identify the recovery key, meaning to determine and retrieve its value, not to repair or decrypt a damaged volume using key material that must already have been exported in advance; even successfully running repair-bde with an exported key package would leave the administrator no closer to knowing what Server1 ' s recovery password actually is, and it does nothing to address a server that is simply sitting at the BitLocker recovery prompt waiting for a password rather than suffering from actual volume corruption. Because this solution does not retrieve or display the recovery key, it does not meet the stated goal.

RDMA over Converged Ethernet (RoCE), which is what SET-teamed adapters typically use to carry RDMA traffic, depends on Data Center Bridging (DCB) being correctly configured end to end, including matching priority flow control (PFC) and traffic class settings between the server ' s network adapters and the physical switches. The Validate-Dcb cmdlet, part of the DcbQos PowerShell module, is the Microsoft-documented tool specifically built to check that DCB and the associated RDMA prerequisites are configured consistently and correctly on a host, and it is the standard troubleshooting step recommended before placing SET-teamed, RDMA-capable adapters into production, particularly ahead of building a Storage Spaces Direct or Hyper-V failover cluster on top of them. Server Manager provides only general role and feature management with no DCB/RDMA validation capability. Get-NetAdapter reports basic adapter status and properties (link state, speed) but does not validate DCB policy correctness. Failover Cluster Manager manages a cluster ' s resources and validates general cluster configuration through the Validate a Configuration Wizard, but the granular DCB/RDMA settings check that this scenario calls for is performed with Validate-Dcb, independent of whether a cluster has even been created yet.

Azure Migrate: Server Migration requires that any BitLocker-encrypted operating system disk be decrypted before that machine can be discovered and migrated, since the replication process cannot properly read and transfer an encrypted OS volume, so Server1, which has BitLocker Drive Encryption enabled on its OS disk, is disqualified from migration regardless of its OS disk otherwise being within supported size limits. The maximum operating system disk size supported for a generation 2 Azure virtual machine is up to 4 TB, compared to the lower 2 TB limit that applies to generation 1 VMs, and Server2 ' s 2,000 GB OS disk and Server3 ' s 4,000 GB OS disk both fall within that generation 2 limit, so neither server is blocked by disk size, and neither has BitLocker enabled, so neither is blocked on that front either. Because Server1 is excluded solely due to its unresolved BitLocker encryption while Server2 and Server3 have no disqualifying configuration at all, Server2 and Server3 only is the correct set of servers that can be migrated to Azure generation 2 virtual machines by using Azure Migrate in this scenario.

Server2 hosts no local DNS zone of its own, so on its own it cannot resolve either the internal contoso.com namespace (hosted only on Server1) or internet names. To route all internet queries to a specific upstream resolver at 131.107.100.200, you configure a standard forwarder on Server2 pointing at that address; a forwarder is used precisely for the general case of " send anything I can ' t answer myself to this server, " which fits the internet-resolution requirement. To resolve the internal contoso.com namespace without touching Server1 at all, you configure a conditional forwarder on Server2 scoped specifically to the domain contoso.com and pointed at Server1 ' s IP address (10.1.1.1); a conditional forwarder only intercepts queries for names under the configured domain, leaving the general forwarder to continue handling everything else, including internet hosts. Together, the conditional forwarder (contoso.com queries go to Server1) and the general forwarder (everything else, i.e., internet hosts, goes to 131.107.100.200) satisfy both requirements using configuration only on Server2. A zone delegation or a secondary zone would each require some cooperating configuration or zone transfer capability on Server1 itself, violating the " no modifications to Server1 " constraint, and a reverse lookup zone resolves IP-to-name queries, which is unrelated to either stated requirement.

The Microsoft Integration Runtime is a compute infrastructure component used by Azure Data Factory and Azure Synapse Analytics pipelines to move and transform data between on-premises data stores and cloud data stores as part of extract-transform-load workloads. It has no relationship whatsoever to Windows event log collection, the Azure Monitor Agent, or the Microsoft Sentinel Windows Firewall data connector, which relies on an entirely separate mechanism built around agent-based log forwarding and data collection rules. Installing the Integration Runtime on Server1 does not create any pipeline that reads Windows Firewall events from the local event log, and it does not register Server1 with Log Analytics or associate it with the data collection rule the connector needs. Because this component addresses a completely unrelated data-movement scenario rather than event log forwarding, installing it on Server1 does not enable Sentinel to collect Windows Firewall logs, so this solution does not meet the goal.

The requirement is narrow: User1 must be able to manage the membership of all the groups located in Contoso\OU3, and nothing more. The Delegation of Control Wizard, run against OU3 specifically, lets an administrator grant User1 exactly the built-in task " Modify the membership of a group, " which grants write access to the member attribute on group objects contained in that OU only. This satisfies the requirement while granting no rights outside OU3, which is the definition of least privilege. Creating the same delegation at the domain root (contoso.com) would technically work but grants far broader scope than needed, since it would apply to every container in the domain, not just OU3, violating least privilege. Adding User1 to Account Operators grants domain-wide rights to create, delete, and modify most user, group, and computer accounts throughout the domain (with some protections for built-in admin accounts), which is excessive for a task limited to group membership in one OU. Server Operators is unrelated to Active Directory object management altogether; it governs local administrative rights on domain controllers themselves. Therefore, delegating control on OU3 is the correct, minimally scoped solution.

Site, subnet, and site-link objects are stored in the Configuration partition, which replicates to every domain controller in the forest but is administratively owned by the forest root domain. By default, only members of Enterprise Admins and members of the Domain Admins group of the forest root domain (contoso.com in this forest) have permissions to modify objects in the Configuration container, including editing a site link ' s replication schedule. Admin1 is a member of Contoso\Enterprise Admins and therefore has forest-wide rights over the Configuration partition. Admin2 is a member of Contoso\Domain Admins; because contoso.com is the forest root domain, this group also carries default rights over the Configuration and Schema partitions. Admin3, however, is a member of Canada\Domain Admins, the Domain Admins group of the canada.contoso.com child domain, which has no inherent rights over the Configuration partition. Consequently, to change the replication schedule on all site links to 30 minutes, only Admin1 and Admin2 currently have the necessary permissions, making option C the correct answer.

Promoting a member server to a domain controller in a specific domain requires membership in either the Enterprise Admins group (forest-wide rights) or the Domain Admins group of that target domain. Server1 is a member server in canada.contoso.com, and the requirement is to promote it to a domain controller in that same domain. Admin1 belongs to Contoso\Enterprise Admins, which has full administrative rights across every domain in the forest, including the right to install AD DS and promote a server anywhere in the forest, so Admin1 qualifies. Admin3 belongs to Canada\Domain Admins, the Domain Admins group of canada.contoso.com itself, which grants full administrative control, including domain controller promotion, within that domain, so Admin3 also qualifies. Admin2, by contrast, is a member of Contoso\Domain Admins, the Domain Admins group of the contoso.com domain; Domain Admins rights are scoped to their own domain and do not extend into a child domain such as canada.contoso.com, so Admin2 cannot promote Server1. User1 has only standard Domain Users membership and holds no administrative rights anywhere. Therefore, only Admin1 and Admin3 currently have sufficient rights, making option C correct.

Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true

The requirement is to run virtual machines on VM1 itself, which means enabling nested virtualization so that VM1 (a guest VM hosted on Server2) can install Hyper-V and host its own virtual machines. Nested virtualization on Hyper-V requires the parent VM ' s virtual processor to expose the host ' s hardware virtualization extensions (Intel VT-x or AMD-V) through to the guest. This is done with the Set-VMProcessor cmdlet using the -ExposeVirtualizationExtensions parameter set to $true, run against VM1 from the Hyper-V host (Server2): Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true. VM1 must be turned off before this setting can be applied, and after it is applied, VM1 needs the Hyper-V role installed inside the guest before it can run its own VMs. Set-VM, Set-VMBios, Set-VMHost, and Set-VMFirmware do not control virtualization extension exposure: Set-VM manages general VM configuration such as memory and name, Set-VMHost configures host-wide settings, and Set-VMFirmware/Set-VMBios control boot and firmware settings for generation 2 and generation 1 VMs respectively. Only Set-VMProcessor with -ExposeVirtualizationExtensions satisfies the stated requirement, making it the correct first step.

Statement 1: No. Statement 2: Yes. Statement 3: No.

Password-policy (Account Policy) settings inside a GPO behave differently depending on where the GPO is linked. For domain user accounts, only Account Policy settings defined in a GPO linked at the domain level (or in a fine-grained Password Settings Object) take effect; Account Policy settings in a GPO linked to an OU are ignored for domain accounts and instead apply only to the local SAM password policy of computer objects located in that OU. GPO1 (minimum length 14) is linked to OU1, where Admin1 ' s user object resides, but because it is linked to an OU rather than the domain, it has no effect on Admin1 ' s domain account password requirement. Admin1 ' s domain password is governed only by the Default Domain Policy (minimum length 10), so statement 1 is false. User1 is likewise a domain account subject only to the Default Domain Policy ' s minimum length of 10, so statement 2 is true. GPO2 (minimum length 8) is linked to the Member Servers OU, which contains Server1 as a computer object; this makes GPO2 the effective local password policy for local accounts created on Server1 (overriding the Default Domain Policy locally), not the domain policy ' s 10-character minimum. Therefore a new local account on Server1 needs only eight characters, not ten, making statement 3 false.

Data Deduplication is a Windows Server file-and-storage feature that can only be enabled on NTFS-formatted data volumes; it cannot be enabled on the operating system (boot/system) volume, and it does not support ReFS or FAT/exFAT volumes at all. VM3 ' s volumes are C (NTFS, the operating system volume), D (NTFS, a data volume), E (ReFS), and F (exFAT). Volume C is excluded because Deduplication is never supported on the volume that hosts the operating system, even though its file system is NTFS. Volume E is excluded because Data Deduplication has no ReFS support in general-purpose deployments; ReFS uses its own separate storage-efficiency mechanisms such as block cloning, not the Deduplication feature. Volume F is excluded because exFAT is a lightweight file system with no support for Windows Server roles or features such as Deduplication, which depends on NTFS-specific metadata structures. That leaves volume D as the only NTFS data volume that is neither the boot volume nor formatted with an unsupported file system, so it is the only volume on which Data Deduplication can currently be enabled, making option C correct.

Group3: Group1, Group2, Group4, and Group5 only. Group5: Group4 only.

Group nesting in AD DS is governed strictly by group scope, independent of whether a group is security- or distribution-type. A Domain Local group can contain user accounts, Global groups from any domain, and Universal groups from any domain, plus other Domain Local groups from its own domain only. Group3 is a Domain Local group in contoso.com, so it can accept Group1 (Universal, contoso.com), Group2 (Global, contoso.com), and Group4 and Group5 (both Global, canada.contoso.com), since Global groups from any domain are valid Domain Local members. It cannot accept Group6, because Group6 is Domain Local in canada.contoso.com, a different domain, and Domain Local groups may only nest other Domain Local groups from their own domain. That gives Group3: Group1, Group2, Group4, and Group5 only. A Global group, by contrast, can contain only user accounts and other Global groups from the same domain. Group5 is Global in canada.contoso.com, so among the remaining groups only Group4 qualifies, since it is also Global and in the same domain; Group1 (Universal), Group2 (Global but a different domain), and Group6 (Domain Local) are all excluded by scope rules. That gives Group5: Group4 only.

Server1: Set-Item. Server4: Enable-PSRemoting.

The requirement is to manage Server4 from Server1 by using PowerShell remoting. Server4 is a workgroup computer, not a member of either AD DS domain, so the WinRM authentication that PowerShell remoting relies on cannot use Kerberos between Server1 and Server4; it must fall back to NTLM, which WinRM only permits toward hosts explicitly listed in the client ' s TrustedHosts list. On Server1, the correct action is therefore Set-Item, used as Set-Item WSMan:\localhost\Client\TrustedHosts -Value " Server4 " (with -Concatenate as needed), which adds Server4 to Server1 ' s trusted hosts so an NTLM-based remoting session is permitted. On Server4, the target must first be configured to accept remote commands at all, which is done with Enable-PSRemoting; this cmdlet starts and configures the WinRM service, creates a listener, and enables the Windows Remote Management firewall rule for the current network profile, matching Server4 ' s private firewall profile. Enable-ServerManagerStandardUserRemoting only grants a non-administrator limited Server Manager access and does not establish remoting, and Start-Service alone does not create or configure a WinRM listener or firewall exception. Configuring Set-Item on Server1 and Enable-PSRemoting on Server4 together satisfies the requirement.

Installing and authorizing a DHCP server in an Active Directory-integrated environment requires two distinct sets of rights: local Administrators group membership on Server3 to install the DHCP Server role itself, and Enterprise Admins group membership to authorize that server in AD DS, because DHCP server authorization is stored as a forest-wide object under CN=NetServices,CN=Services,CN=Configuration and only Enterprise Admins can create or modify objects there by default. Admin1 is a member of Contoso\Enterprise Admins, which grants exactly this forest-wide right and also carries local administrative rights on every domain-joined computer in the forest, including Server3, so Admin1 can both install the role and authorize the server, fully satisfying the requirement on his own. Admin2, a member of only Contoso\Domain Admins, has full administrative rights over contoso.com and its member computers, but Domain Admins does not carry the right to authorize a DHCP server in the forest-wide NetServices container, so Admin2 cannot complete authorization even though he can install the role. Admin3, a member of Canada\Domain Admins, has administrative rights limited to the canada.contoso.com domain and likewise lacks the Enterprise Admins-only authorization right needed here, since Server3 and the DHCP authorization object both fall outside that domain ' s scope of control. Because only Admin1 holds both the local administrative rights needed to install the DHCP Server role on Server3 and the Enterprise Admins membership needed to authorize it in AD DS, Admin1 only is correct.

The stated problem is that when an administrator connects to VM2 ' s console through Virtual Machine Connection and disconnects without signing out, a second administrator who opens the console can silently inherit that still-signed-in session without ever supplying credentials. By default, VMConnect attaches directly to the raw console of the guest, which behaves like walking up to a physical, unlocked machine. Enhanced Session Mode changes this behavior by routing the VMConnect session over the Remote Desktop Protocol into the guest, which means every connection is treated as a new interactive Remote Desktop logon and therefore always prompts for credentials, eliminating the ability to passively inherit someone else ' s open session. Enabling Enhanced Session Mode requires both host-side and guest-side support (the guest operating system must support RDP and have the setting enabled) but is the direct, purpose-built fix for this exact console-sharing problem. The Guest Services integration component only enables basic file-copy functionality between host and guest and has no effect on console/session behavior. Credential Guard protects locally stored credentials from theft using virtualization-based security, and shielded VMs protect a VM ' s disk, state, and console from a compromised or malicious fabric administrator; neither addresses console session takeover between two legitimate administrators. Enhanced Session Mode is therefore the correct solution.

User1: 9. Admin1: 8.

Fine-grained password policies delivered through Password Settings Objects (PSOs) take precedence over the domain-wide Default Domain Policy for any user they apply to. When more than one PSO would apply to the same user only through different group memberships (as opposed to one being linked directly to the user), the PSO with the lowest numeric precedence value wins. User1 is a member of both Group2 (targeted directly by PSO1, precedence 10, minimum password length 9) and Group4 (targeted directly by PSO2, precedence 20, minimum password length 11); since PSO1 ' s precedence value of 10 is lower than PSO2 ' s 20, PSO1 governs, giving User1 an effective minimum password length of 9. Admin1 is a member only of Domain Admins, which is not targeted by either PSO, so no fine-grained password policy applies. Admin1 is also in OU1, which has GPO1 linked to it with a minimum password length of 10, but Account Policy settings such as password policy configured in an OU-linked GPO never affect the effective password policy of domain user accounts -- only a GPO linked at the domain root can supply a fallback domain-wide default, and PSOs otherwise take precedence over that default. With no applicable PSO, Admin1 ' s effective policy falls back to the Default Domain Policy, whose minimum password length in this environment is 8.

Storage Migration Service is designed to migrate a file share such as Share1 to a new server (Server2) while carrying over both the share-level and NTFS folder/file permissions, and it can also perform a cutover of the source server ' s name and IP address if a fully transparent migration is later required. This directly satisfies the requirement to migrate Share1 to Server2 including all the share and folder permissions. File Server Resource Manager (FSRM) only provides quota, file-screening, and storage-reporting capabilities and has no mechanism to migrate data, shares, or permissions between servers. Server Manager is a general-purpose administration console with no dedicated share-migration workflow -- it can be used to create shares manually but cannot transfer existing permissions programmatically. Storage Replica performs block-level volume replication intended for disaster recovery and stretch-cluster scenarios rather than a one-time, permission-preserving share migration to a specific destination server. Therefore, Storage Migration Service is the correct tool to migrate Share1 to Server2 while preserving its share and folder permissions.

Using Hyper-V Replica within a clustered Hyper-V environment such as Cluster3 requires deploying the Hyper-V Replica Broker, which itself runs as a clustered role on the failover cluster; without the Broker, replication cannot follow a protected virtual machine if it live-migrates between Cluster3 ' s nodes, since there would be no single, cluster-aware endpoint tracking which node currently owns each VM ' s replication state. Adding a failover cluster role is exactly how the Hyper-V Replica Broker is deployed onto Cluster3, satisfying the requirement to use Hyper-V Replica to protect Cluster3 ' s virtual machines. Enabling integration services on the virtual machines addresses guest-OS-to-host integration (time synchronization, heartbeat, and similar) rather than providing any replication capability. Adding a generic Windows Server server role does not, by itself, install or configure the Hyper-V Replica Broker -- the Broker must specifically be added as a clustered role through Failover Cluster Manager. Configuring a fault domain for the cluster is not a real Windows Server failover clustering concept and does not provide Hyper-V Replica capability. Therefore, adding a failover cluster role (the Hyper-V Replica Broker) is the correct solution for Cluster3.

BitLocker: C, D, E, and F. Auto-unlock: D, E, and F only.

BitLocker Drive Encryption can be enabled on every volume shown in Server4 ' s disk configuration -- the NTFS-formatted operating system volume (C:), the NTFS data volume (D:), and the two ReFS-formatted data volumes (E: and F:). BitLocker has no file-system restriction that excludes ReFS: Microsoft ' s ReFS documentation and BitLocker ' s own volume support explicitly confirm that ReFS-formatted volumes, including already-encrypted ones that are later expanded, are fully supported, so E: and F: are just as eligible for BitLocker as the NTFS volumes. BitLocker auto-unlock, however, is a feature limited to fixed data volumes: it lets a data volume unlock automatically at startup using a key protected by the already-unlocked operating system volume, and it is not applicable to the OS volume itself, since the OS volume instead relies on the TPM (or a startup key/PIN) to unlock during boot -- there is no separate outer volume for it to depend on. Because C: is the operating system volume, auto-unlock cannot be configured on it, leaving D:, E:, and F: as the volumes eligible for auto-unlock. Therefore, BitLocker can be turned on for all four volumes (C, D, E, and F), while auto-unlock is available only on the three data volumes (D, E, and F).

1. Create an Azure Recovery Services vault. 2. Create a Hyper-V site. 3. Install and register Azure Site Recovery Providers. 4. Create and associate replication policies.

Setting up Azure Site Recovery for a Hyper-V cluster that is not managed by Virtual Machine Manager follows a fixed infrastructure-preparation order. An Azure Recovery Services vault must exist first, since it is the container that every later step registers against. A Hyper-V site is then created in that vault to represent the on-premises Hyper-V environment, because a Hyper-V host or cluster must belong to a site before its hosts can be registered against Azure Site Recovery. The Azure Site Recovery Provider is then installed on the Hyper-V hosts (Cluster2 ' s nodes) and registered to that site/vault, which is what actually connects the cluster nodes to Azure Site Recovery. Only once the hosts are registered can a replication policy be created and associated with the Hyper-V site, since a policy has nothing to attach to until the site and its registered hosts already exist. Installing Azure Connected Machine agents is unrelated to Hyper-V VM replication -- that agent is used for onboarding servers to Azure Arc -- and is not part of this workflow. Therefore, the correct order is: create the vault, create the Hyper-V site, install and register the Providers, and create and associate the replication policy.

The Azure Site Recovery Provider must be installed and registered on every Hyper-V host that is a node of the cluster being protected, because each node is a location the protected virtual machines could reside on after a live migration, and each node must independently be able to track and replicate the VMs it is currently hosting. Cluster2 has four nodes according to the Hyper-V failover clusters table (Cluster1 has six nodes and eighteen virtual machines, Cluster2 has four nodes and twelve virtual machines, and Cluster3 has two nodes and six virtual machines), so a minimum of four Provider installations -- one per node -- is required; installing the Provider on only one, two, or three of the nodes would leave replication unable to follow a protected VM if it live-migrated to whichever node lacks the Provider, breaking continuous replication for that VM the moment it moved. Therefore, four is the minimum number of Azure Site Recovery Provider installations required to fully protect all of Cluster2 ' s virtual machines regardless of which node currently hosts them.

Signing in over Remote Desktop requires a user to hold the " Allow log on through Remote Desktop Services " right and the " Access this computer from the network " right, and to be excluded from any matching Deny counterpart, since an explicit Deny always overrides an Allow granted through any other group membership. User1 is a member of Group2 (granted the Remote Desktop Services logon right) but is also a member of Group4, which is explicitly denied " Access this computer from the network " on Server4 -- that network-access denial blocks the RDP connection outright regardless of the Everyone-based network-access Allow or the RDS logon right, so User1 is denied. User2 belongs only to Group2: Group2 grants the RDS logon right, User2 is covered by the Everyone-based network-access Allow, and User2 is not a member of either Group3 or Group4, so neither Deny applies and User2 can sign in successfully. User3 is a member of Group3, which is explicitly denied " Allow log on through Remote Desktop Services " on Server4 -- that denial blocks the RDP logon right itself, so User3 cannot sign in regardless of network-access rights (and User3 is also in Group4, which independently denies network access as well). Therefore, only User2 can successfully sign in to Server4 using Remote Desktop.

Backing up a standalone Windows Server ' s files, folders, and system state directly to an Azure Recovery Services vault -- exactly what the requirement calls for on Server4 -- is done using the Microsoft Azure Recovery Services (MARS) agent, so installing that agent on Server4 is the necessary first step. Microsoft Azure Backup Server (MABS) is used for application-aware and Hyper-V virtual machine backups rather than direct file/system-state backup of a single standalone server, and while it can also protect servers, it is not the lightweight, direct-to-vault mechanism appropriate for a single standalone server like Server4 and represents unnecessary additional infrastructure. Native Windows Server Backup does not target an Azure Recovery Services vault on its own without additional agent installation, and Storage Replica provides block-level volume replication between servers rather than the point-in-time backup and long-term retention the requirement calls for. Therefore, installing the MARS agent on Server4 is the correct first step to meet this technical requirement.

Promoting a new domain controller that runs a newer operating system version than any existing domain controller in the forest -- here, DC4 running Windows Server 2022 into a forest whose functional level is still Windows Server 2012 R2 -- requires the Active Directory schema to first be extended to support that OS version ' s schema additions (the adprep /forestprep and /domainprep operations, which modern promotion tools such as Install-ADDSDomainController run automatically when needed). Extending the schema requires connectivity to the domain controller holding the Schema Master FSMO role, since schema changes can only be made by contacting that specific role holder; if the Schema Master is offline, the schema extension step fails and the promotion cannot proceed. According to the domain controllers table, DC1 holds both the RID master and the schema master roles. DC2 holds the PDC emulator and infrastructure master roles, and DC3 holds the domain naming master role -- neither of those role sets is relevant to a schema extension. Therefore, DC1, as the Schema Master, must be online for DC4 ' s promotion (and its associated schema extension) to succeed.

On the domain controllers: Install the Azure Monitor agent. In Azure: Create an Azure Log Analytics workspace.

Centrally managing performance alerts in Azure for on-premises domain controllers is done by connecting those servers to Azure Monitor: the Azure Monitor agent is installed on each domain controller (onboarded to Azure Arc for non-Azure servers, or directly if they are Azure VMs) to collect performance counters and event data, and that telemetry is sent to an Azure Log Analytics workspace, which is the resource that stores the collected data and against which performance-based alert rules are then defined and centrally managed. Creating a Data Collector Set in Performance Monitor and modifying the Performance Monitor Users group are both local, per-server administrative actions that never send any data to Azure and cannot support central, Azure-based alerting. An Azure SQL database, a Storage Sync Service, and an Azure Storage account are all Azure resources, but none of them is the telemetry store that Azure Monitor ' s alerting pipeline is built on -- only a Log Analytics workspace serves that role. Therefore, installing the Azure Monitor agent on the domain controllers and creating an Azure Log Analytics workspace are the two required actions.

Restoring deleted objects from the Active Directory Recycle Bin requires permission to view and restore objects inside the forest ' s Deleted Objects container, and by default that container ' s access control list denies access to everyone except the SYSTEM account and members of Domain Admins (and Enterprise Admins at the forest root) -- no delegation to any other built-in group exists out of the box. Among the four groups offered, only Domain Admins carries this permission by default, since Account Operators (which can manage most user, group, and computer objects but has no special access to the hidden Deleted Objects container), Schema Admins (which governs schema modifications, not object restoration), and Backup Operators (which can back up and restore files and the system state, but not perform an online Active Directory Recycle Bin object restore through the Active Directory Administrative Center) all lack the needed access. The case study ' s general instruction to use the principle of least privilege where possible does not change this outcome here, since none of the three lower-privileged alternatives actually has the required capability by default -- Domain Admins is not merely the most convenient choice but the only one of the four that functionally works. Therefore, User1 must be added to Domain Admins to be able to recover objects from the Active Directory Recycle Bin.

Server1 can communicate with: Server2, Server3, and Server4. Server3 can communicate with: Server1 and Server2 only.

Server4 has no isolation connection security rule configured at all, so it never attempts or performs IPsec authentication with any peer. Server1 ' s rule only requests IPsec in both directions rather than requiring it, meaning that if IPsec negotiation does not occur -- as with Server4, which has no IPsec capability configured -- the connection still falls back to succeed in the clear; Server1 can therefore reach Server2, Server3, and Server4. Server3 ' s rule requires IPsec in both directions, meaning a connection only succeeds if IPsec authentication is actually negotiated. Server3 can successfully negotiate IPsec with Server1 (whose " request " setting means it will still respond to and complete an IPsec negotiation when the peer requires it) and with Server2 (which requires inbound and requests outbound IPsec, and likewise supports negotiation), so both of those connections succeed. Server3 cannot successfully negotiate IPsec with Server4, since Server4 has no IPsec capability configured at all, and Server3 ' s " require " setting blocks any connection that cannot be authenticated via IPsec. Therefore, Server1 can communicate with Server2, Server3, and Server4, while Server3 can communicate with only Server1 and Server2.

Task1 is an Azure Automation runbook, and Azure Automation supports a specific, limited set of runbook types: PowerShell (and PowerShell Workflow), Python, and Graphical runbooks (which are authored visually rather than in a scripting language). Of the listed options, PowerShell and Python are the two genuine scripting languages Azure Automation lets you author a runbook in directly, making them the two correct answers. Java and JavaScript are not supported runbook languages in Azure Automation; JavaScript is used elsewhere in Azure (for example, in Azure Functions or Logic Apps custom code), but not for Automation runbooks. Bicep is a domain-specific language for declaratively defining Azure infrastructure as code (compiling down to ARM templates) and has no role as an executable runbook language; you would not write a Task1 runbook in Bicep, since runbooks execute imperative logic rather than declare resource deployments. Therefore, Python and PowerShell are the two languages available for Task1.

1. Deploy the Azure Storage Sync service. 2. Install and register the Azure File Sync agent. 3. Create a sync group. 4. Add a server endpoint.

Data1 is a file share on VM1 that must be synced to the Azure Files share1 using Azure File Sync. The documented deployment order starts in Azure: you must first deploy a Storage Sync Service resource, because the on-premises agent registration process needs an existing Storage Sync Service to register against. With that resource in place, the next step, already fixed in the sequence, is to install the Azure File Sync agent on VM1 and register the server with the Storage Sync Service, which establishes the server ' s identity and trust relationship with Azure. After registration, you create a sync group, the container that pairs one Azure file share (the cloud endpoint) with one or more on-premises folders (server endpoints); the sync group must exist before endpoints can be attached to it. Finally, you add a server endpoint pointing at the Data1 path on VM1, which starts the actual namespace and content synchronization with share1. Installing the DFS Replication role service and installing the Storage Replica feature are unrelated technologies, DFS-R replicates between on-premises servers and Storage Replica performs block-level volume replication, neither of which is part of an Azure File Sync deployment, so both are correctly excluded from the sequence.

Enabling Microsoft Entra ID sign-in on an Azure VM running Windows is implemented through a VM extension named AADLoginForWindows, published by Microsoft.Azure.ActiveDirectory. This extension installs the components needed for the VM to accept Microsoft Entra credentials for RDP sign-in and, when combined with Azure RBAC roles such as Virtual Machine Administrator Login, controls who is authorized to sign in. VM extensions in Azure are deployed and managed with the Set-AzVMExtension cmdlet, which is how this specific extension gets installed onto Server1. Set-AzVM modifies general virtual machine properties, such as size or OS profile settings, but has no mechanism for installing extensions. Add-ADComputerServiceAccount and New-ADComputer are on-premises Active Directory cmdlets used to manage computer objects and service accounts in AD DS; they have no relevance to an Azure VM ' s sign-in method and would not apply here since Server1 ' s sign-in requirement is being satisfied by Microsoft Entra ID, not by joining a domain. Set-AzVMExtension is therefore the correct cmdlet.

Disk1: 2. Disk2: 1.

The requirement is that data on SSPace1 must remain available at all times, meaning the storage pool ' s virtual disks must be able to tolerate physical disk failures without becoming unavailable or losing data. A three-way mirror keeps three copies of every block of data spread across different physical disks, so it remains available and readable even if any two of those disks fail simultaneously; the resiliency is fixed at tolerating two failures regardless of how many total disks (8, in Disk1 ' s case) make up the pool, as long as there are enough disks to support three-way mirroring, which eight comfortably provides. Disk2 uses parity resiliency, which stores a single parity block that can reconstruct data after one physical disk failure; unless dual parity is explicitly configured (which requires being set at virtual disk creation time and is not indicated here), a standard parity virtual disk tolerates only one physical disk failure before data becomes unavailable, regardless of the pool having twelve physical disks. Administrators sometimes assume more disks in a parity pool automatically means more fault tolerance, but the number of disks a parity space can lose is determined by the resiliency configuration (single vs. dual parity), not by the total disk count. Therefore Disk1 tolerates two disk failures and Disk2 tolerates one.

On Cluster1: Import the Azure Migrate appliance. In Azure: Create an Azure Migrate project.

APP3 and APP4 run as virtual machines on the on-premises Cluster1 Hyper-V failover cluster, so migrating them to Azure uses the Azure Migrate: Server Migration workflow for Hyper-V. That workflow requires an Azure Migrate project to first be created in Azure, since the project is the container that organizes the migration effort, tracks discovered and assessed machines, and holds the configuration for the subsequent discovery and replication work. On the Cluster1 side, the Azure Migrate appliance -- a purpose-built VM or OVA image supplied by Azure Migrate specifically for Hyper-V environments -- must be imported (deployed) onto the Hyper-V host or cluster, where it discovers the VMs running there and orchestrates their replication into Azure. Configuring an Azure Network Adapter, creating a Point-to-Site VPN connection to Vnet1, installing the Azure File Sync agent, and installing the Windows Server Migration Tools are all unrelated actions that do not perform Hyper-V VM discovery or replication for an Azure Migrate project. Similarly, creating a premium block blob storage account, a private endpoint, or a VPN gateway in Azure are not the resource that Azure Migrate itself requires to begin a migration project -- an Azure Migrate project is. Therefore, importing the Azure Migrate appliance onto Cluster1 and creating an Azure Migrate project in Azure are the two required preparatory actions.

A Windows Server failover cluster requires a distinct IP address for each individual cluster node ' s network adapter, plus one additional IP address for the cluster ' s own network name resource -- the cluster access point that clients and management tools use to address the cluster as a single logical entity rather than any one specific node. Cluster3 will contain two physical nodes, Node1 and Node2, so at minimum one IP address is required for Node1 ' s network adapter and one for Node2 ' s network adapter. Beyond those two node-level addresses, the cluster core resource itself (the cluster name object and its associated IP address resource) requires one more address so that the cluster can be addressed and managed as a whole and so that any highly available roles hosted on the cluster (such as the file share role planned for Cluster3) can obtain the network identity they need to fail over between nodes. Adding these together -- one for Node1, one for Node2, and one for the cluster ' s own network name -- yields a minimum of three IP addresses required for Cluster3 ' s node and cluster roles. Fewer than three would leave either a node or the cluster itself without a usable network identity, and while additional IP addresses may be consumed by highly available roles later added to the cluster, three is the baseline minimum for the node and cluster roles themselves.

Microsoft Defender for Identity is the Microsoft Sentinel data connector purpose-built to monitor on-premises Active Directory domain controllers and surface exactly the insecure-protocol activity described in the requirement, including authentication attempts and sign-ins that rely on legacy or unsigned protocols such as NTLMv1, SMBv1, and unsigned LDAP binds. It does this by analyzing domain controller network traffic and Windows Events directly on the DCs, which is exactly where this insecure-protocol usage originates. The Threat Intelligence - TAXII connector ingests external threat-intelligence indicator feeds (IP addresses, file hashes, domains) from TAXII-compliant sources and has nothing to do with monitoring authentication protocol usage on domain controllers. The Azure Active Directory (Microsoft Entra ID) connector reports on cloud sign-in and audit log events for the Entra tenant, not on legacy protocol usage against on-premises AD DS domain controllers. Microsoft Defender for Cloud focuses on cloud resource security posture management and workload protection rather than detecting legacy authentication protocol usage against on-premises domain controllers. Therefore, connecting Microsoft Defender for Identity to Microsoft Sentinel is the correct connector to identify connections to the domain controllers that use insecure protocols.

Storage Migration Service is purpose-built to inventory the data, security descriptors, and both share-level and NTFS-level permissions on a source file server such as Fileserver1, transfer that data to a destination server such as Fileserver2, and then perform a cutover that reassigns the source server ' s network identity -- its computer name and IP address -- to the destination server. That cutover step is precisely what allows the existing \\Fileserver1\Data UNC path, already relied upon by the Chicago office application, to continue working unchanged after the migration, since client requests to that path transparently resolve to Fileserver2 once it has taken on Fileserver1 ' s identity. The Microsoft File Server Migration Toolkit and Windows Server Migration Tools are older, largely superseded utilities that can move some file server settings but do not provide this automated inventory-transfer-and-cutover workflow, and neither preserves the source server ' s identity on the destination the way Storage Migration Service does, meaning the UNC path would need to be manually updated or redirected. File Server Resource Manager (FSRM) is a quota, file-screening, and storage-reporting feature entirely unrelated to migrating data between servers. Therefore, Storage Migration Service is the correct tool to perform this migration while preserving the existing UNC path.

DHCP1: Export-DhcpServer, Remove-DhcpServerInDC. DHCP2: Add-DhcpServerInDC, Import-DhcpServer.

Migrating a DHCP server ' s configuration together with its existing leases and reservations by PowerShell follows an export/unauthorize-then-authorize/import pattern across the two servers. On the source server, DHCP1, Export-DhcpServer captures the existing scopes, options, leases, and reservations into a migration file, which is what allows the existing leases and reservations to actually carry over to the replacement server. Remove-DhcpServerInDC is then run on DHCP1 to unauthorize it in Active Directory, which is what prevents DHCP1 from continuing to service client requests once DHCP2 is brought online, satisfying that specific migration requirement. On the target server, DHCP2, Add-DhcpServerInDC authorizes the new server in AD DS so it is permitted to lease addresses on the network, and Import-DhcpServer then applies the configuration file exported from DHCP1, causing DHCP2 to hand out the same address ranges as DHCP1 along with the existing leases and reservations that were captured during export. Add-DhcpServerv4Scope and Remove-DhcpServerv4Scope only create or delete an individual scope ' s address range and do not export, import, or preserve any existing lease or reservation data, so neither is part of this migration sequence. Therefore, DHCP1 requires Export-DhcpServer and Remove-DhcpServerInDC, while DHCP2 requires Add-DhcpServerInDC and Import-DhcpServer.

Enforce the security policy: Microsoft Defender Application Control. Manage the policy settings: Group Policy Objects (GPOs).

Windows Defender Application Control (WDAC) is the platform feature that enforces which applications are authorized to install or run on a Windows Server, directly meeting the stated requirement that only authorized applications can be installed or run on the servers in the forest. Microsoft Defender Application Guard isolates untrusted browsing sessions in a container and Microsoft Defender Credential Guard protects credential material from theft -- neither controls which applications are permitted to execute. Microsoft Defender for Endpoint is an endpoint detection-and-response platform that detects and responds to threats rather than enforcing a whitelist of permitted applications. Because the servers described are on-premises, domain-joined machines rather than Intune-managed, Microsoft Entra-joined devices, the WDAC policy settings here must be managed through Group Policy Objects distributed via AD DS, not through Intune. Configuration profiles in Microsoft Intune and compliance policies in Microsoft Intune are both cloud-management mechanisms that apply only to devices enrolled in and managed by Intune, which these on-premises, domain-joined servers are not. Therefore, WDAC is the enforcing service and Group Policy Objects are the correct management mechanism for these on-premises servers.

1. Add a disk resource to the cluster. 2. Create a Cluster Shared Volume (CSV). 3. Put the disk in maintenance mode. 4. Enable BitLocker on the volume. 5. Update the BitLockerProtectorInfo property of the volume.

BitLocker can only be enabled on a Cluster Shared Volume disk while that disk is taken offline to cluster I/O, so the CSV must exist and be placed into maintenance mode before encryption can be applied. The supported sequence begins by adding the disk resource to the cluster and converting it into a Cluster Shared Volume, since BitLocker-on-CSV support requires the disk to already be a CSV rather than a plain cluster disk. The disk is then put into maintenance mode, which takes it offline to the other cluster nodes so it can be safely encrypted without a node attempting to access it mid-operation. With the CSV disk offline in maintenance mode, BitLocker is enabled on the volume. Finally, the volume ' s BitLockerProtectorInfo property is updated so that Failover Clustering registers the unlock protector, allowing the volume to automatically unlock on every cluster node once maintenance mode ends and the CSV is brought back online. Performing these steps out of order either fails outright -- BitLocker cannot be enabled on a CSV disk that is still online and actively used by the cluster -- or leaves the other cluster nodes unable to bring the encrypted volume back online afterward, since they would lack the registered unlock protector. Therefore, the correct order is: add the disk resource, create the CSV, put the disk in maintenance mode, enable BitLocker, and update BitLockerProtectorInfo.

To enable WebApp1 to handle requests for the website: Add a custom domain name. To point client connections to WebApp1: Modify a DNS record.

For an Azure App Service web app to accept and correctly serve requests addressed to rather than only its default *.azurewebsites.net hostname, the custom domain must be added and bound to WebApp1 -- this is the specific configuration step that makes the app recognize and handle that custom hostname at all. Creating a deployment slot supports staged rollout and swap scenarios and does nothing to bind a custom domain, and creating a private endpoint provides private, VNet-restricted connectivity rather than public custom-domain handling, so neither accomplishes the stated goal. Once WEB1 and WEB2 are decommissioned per the migration plan, client traffic that currently resolves to those on-premises-facing web servers must instead be directed to WebApp1; since DNS is what resolves the name to a specific endpoint, the DNS record for that hostname must be modified (typically to a CNAME record pointing at WebApp1 ' s default hostname, together with the domain-verification TXT record Azure requires before it will accept the custom domain binding). Azure Front Door and Azure Traffic Manager are global routing and load-balancing services meant for multi-region or multi-endpoint failover scenarios and are unnecessary complexity for redirecting a single custom domain to a single web app, and adding HTTP redirect rules on WEB1/WEB2 is not a viable option once those servers have been decommissioned. Therefore, adding a custom domain name to WebApp1 and then modifying the DNS record are the two required actions.

Server administrators can be prevented from configuring Windows Defender Firewall rules by defining firewall policy centrally in a Group Policy Object and linking it to the servers ' organizational unit(s); domain-based GPO firewall policy overrides any local, administrator-configured Windows Defender Firewall rules on the domain-joined servers, since Group Policy-delivered firewall settings take precedence over local policy. Adaptive network hardening in Microsoft Defender for Cloud only generates recommendations to tighten network security group (NSG) rules protecting Azure resources -- it has no visibility into or control over host-based Windows Defender Firewall configuration on on-premises servers. A network security group (NSG) in Sub1 filters traffic at the Azure virtual network boundary and has no bearing on the on-premises Chicago office servers described in the scenario. An Azure Firewall policy governs the centrally managed Azure Firewall network virtual appliance, not the host-based Windows Defender Firewall running locally on each on-premises server. Because the servers in question are on-premises and domain-joined, only a Group Policy Object can centrally enforce and lock down their local Windows Defender Firewall configuration, preventing server administrators from modifying the rules directly on each machine. Therefore, configuring a GPO is the correct way to reduce this security risk.

1. Create the KDS root key in AD DS. 2. Create a group managed service account (gMSA) in Active Directory. 3. Configure the IIS application pool (on WEB1 and WEB2) to run as the gMSA via a specified user account.

The requirement is that every instance of Webapp1 (running on both WEB1 and WEB2) uses the same identity, and that identity ' s password rotates automatically every 30 days, without any administrator manually resetting it. A standalone managed service account (sMSA) is tied to a single computer and cannot be shared across WEB1 and WEB2, so it does not meet the requirement. A group managed service account (gMSA) is designed exactly for this scenario: one AD-managed identity that multiple servers can use simultaneously, with the Key Distribution Service automatically rotating its password (by default every 30 days) without needing manual intervention or downtime. Before any gMSA can be created in the forest, a one-time prerequisite must exist: the KDS root key, which the Key Distribution Service uses to generate and later recompute the gMSA ' s password material. So the correct order is to first create the KDS root key, then create the gMSA object in Active Directory, and finally configure the IIS application pool on each web server to run as that gMSA using the " specified user account " identity option (entered as domain\gMSA$ with no password required, since the password is centrally managed). Creating a system- or user-assigned managed identity in Microsoft Entra ID does not apply here, since Webapp1 runs on IIS on domain-joined VMs, not as an Azure PaaS resource.

GPO4 is already linked to the VirtualDesktops OU, which contains the Azure Virtual Desktop session host computer accounts, so it is correctly targeted at the right computers. The requirement is that the idle lockout behavior configured in GPO4 must apply to whichever user is signed in to a session host, and that the user must still be able to adjust the lockout time manually from their own client, which means the relevant setting is a per-user configuration item rather than a strict, non-negotiable computer policy. By default, user-configuration settings inside a GPO apply based on the OU containing the user account, not the computer the user signs in to; Fabrikam ' s users are located in the AllUsers OU, which is governed by GPO1, not GPO4. Group Policy Loopback Processing, enabled in GPO4 and set to Merge (to allow the client-side adjustment) or Replace, forces the user-configuration portion of GPO4 to apply to any user who logs on to a computer in the VirtualDesktops OU, regardless of where that user ' s own account resides. Security filtering and the Enforced property both affect who a GPO applies to or its precedence in conflicts, but neither one makes a GPO ' s user-side settings follow the computer instead of the user, so loopback processing in GPO4 is correct.

Fabrikam ' s plan is to use Azure Policy to enforce configuration management policies across both its Azure and on-premises servers. Azure Policy ' s guest configuration capability, which evaluates and can remediate in-guest settings, only works against a server that is registered as an Azure resource. For an on-premises or non-Azure server, that registration is achieved by deploying the Azure Connected Machine agent, which onboards the machine as an Azure Arc-enabled server, gives it an Azure resource ID, and makes it a valid target for Azure Policy assignments, including guest configuration policies, in exactly the same way an Azure VM would be. Hybrid joining servers to Microsoft Entra ID affects identity and device management (such as Conditional Access) but does not make a server a valid Azure Policy target. A hybrid runbook worker lets Azure Automation runbooks execute on-premises but is unrelated to Azure Policy enforcement. The Azure Monitor agent collects telemetry into Log Analytics and Azure Monitor but does not register the server as an Arc resource or enable policy assignment on its own; it is typically deployed after Arc onboarding, not instead of it. Deploying the Azure Connected Machine agent is therefore the correct first step.

Sync groups: 3. Storage Sync Services: 1.

In Azure File Sync, a sync group defines a single sync topology and can contain exactly one cloud endpoint (one Azure file share) but can contain multiple server endpoints (on-premises server locations) that all sync to that same file share. Fabrikam needs newyorkfiles to sync only to FS1, seattlefiles to sync only to FS2, and companyfiles to sync to both FS1 and FS2. Because each Azure file share can only belong to one sync group, newyorkfiles requires its own sync group with a single server endpoint on FS1, seattlefiles requires its own sync group with a single server endpoint on FS2, and companyfiles requires a third sync group whose one cloud endpoint (companyfiles) has two server endpoints, one on FS1 and one on FS2, which Azure File Sync fully supports within a single sync group. That gives a minimum of three sync groups. A Storage Sync Service is the top-level Azure resource that contains and manages sync groups, and there is no requirement here that forces the shares into separate Storage Sync Service instances (such as differing regions or subscriptions); a single Storage Sync Service can hold all three sync groups. Therefore only one Storage Sync Service is required.

DC3 is a domain controller for the existing corp.fabrikam.com AD DS forest, deployed into Vnet1 in Azure. Domain controllers rely on AD-integrated DNS for locating other domain controllers, SRV records, and replication, so DC3 needs to host that zone itself, which requires installing the DNS Server role on DC3 and letting it host an AD-integrated copy of the corp.fabrikam.com zone. Azure ' s default virtual-network-provided DNS resolver has no awareness of AD DS records and cannot host or serve an AD-integrated zone, so every resource in Vnet1 that needs to locate the domain (including Azure VMs and DC3 ' s own replication partners) must be pointed at real DNS servers instead. That is accomplished by configuring the custom DNS Servers setting on Vnet1 to reference DC3 (and, once available, DC1 and DC2), which makes all Azure VMs in the virtual network resolve names through the AD-integrated DNS infrastructure rather than the platform resolver. An Azure DNS zone (public) or an Azure private DNS zone are separate, unrelated Azure-native DNS services that cannot host an AD-integrated zone and are not used for this scenario. Installing the DNS Server role on DC3 and pointing Vnet1 at it together satisfy the requirement.

The requirement states that server administrators must request approval before establishing a Remote Desktop connection to an Azure virtual machine, and that once approved, the connection must be established within a defined two-hour window. This request-approve-then-time-limited-access pattern for a specific management port on an Azure VM is precisely what just-in-time (JIT) VM access, a Microsoft Defender for Cloud capability, provides: it keeps the RDP/SSH management ports closed by default in the network security group, requires an explicit access request, and, once approved, opens the port only for a specified time window and only from the requester ' s source IP. Microsoft Entra Privileged Identity Management provides time-bound, approval-based elevation for Microsoft Entra and Azure RBAC roles, not for opening network ports to a VM, so it does not by itself control Remote Desktop network access. The Remote Desktop extension for Azure Cloud Services is a legacy classic-deployment feature unrelated to this scenario. Azure Bastion provides browser-based RDP/SSH without exposing public IPs but does not implement an approval workflow with a bounded connection window. JIT VM access is therefore the correct, purpose-built solution.

On a Virtual WAN hub: An ExpressRoute gateway. In the offices: An ExpressRoute circuit connection.

Fabrikam ' s plan is to replace the existing WAN links between the New York and Seattle offices with Azure Virtual WAN and ExpressRoute, connecting both offices to Vnet1 through the Virtual WAN hub. Azure Virtual WAN uses its own hub-native ExpressRoute gateway object (distinct from the standalone virtual network gateway used when ExpressRoute is connected directly to a single VNet); this ExpressRoute gateway is deployed inside the Virtual WAN hub and is required before any ExpressRoute circuit can terminate into that hub. A standard virtual network gateway is used for VNet-to-VNet or VPN scenarios, not for Virtual WAN hub ExpressRoute termination, and an ExpressRoute circuit connection itself is the logical link resource, not something you deploy on the hub. At each office, connectivity into Microsoft ' s network is established through an ExpressRoute circuit connection provisioned with a connectivity provider, which then links, via Microsoft ' s backbone, into the ExpressRoute gateway in the Virtual WAN hub. A Site-to-Site VPN, an Azure application gateway (a web traffic load balancer), and an on-premises data gateway (used for Power Platform/Logic Apps connectors) are all unrelated to this ExpressRoute-based design.

DC3 is explicitly described as a domain controller named dc3.corp.fabrikam.com that will exist inside Vnet1, meaning it must be a genuine, writable domain controller for Fabrikam ' s existing corp.fabrikam.com AD DS forest, replicating with DC1 and DC2. The only way to run an actual domain controller for an existing on-premises forest inside Azure is to deploy a regular Azure virtual machine, place it on Vnet1, install the AD DS role on it, and promote it as an additional domain controller for corp.fabrikam.com. Microsoft Entra Domain Services is a fundamentally different, fully managed service: it creates its own separate, standalone managed domain and does not add a domain controller to, or replicate directly with, an existing on-premises forest, so it cannot be used to deploy " DC3 " as described. Microsoft Entra Application Proxy publishes on-premises web applications to external users and has nothing to do with domain controller placement. A Microsoft Entra administrative unit is a container used to scope administrative permissions over Microsoft Entra objects and is unrelated to deploying infrastructure. Therefore, an Azure virtual machine, promoted to a domain controller, is the correct implementation for DC3.

DHCP1 (New York, Scope1) and DHCP2 (Seattle, Scope2) currently serve only their own local office. To make DHCP highly available across both offices, the modern, supported approach is DHCP Failover, configured per scope (option E), which replicates lease information between DHCP1 and DHCP2 in either load-balance or hot-standby mode so that either server can service either scope ' s clients if its partner becomes unavailable. However, DHCP Failover alone only helps if a client ' s DHCP broadcast can actually reach the surviving partner server across the WAN; broadcasts do not cross routed office boundaries on their own. Configuring a DHCP relay agent on the router (or another relay-capable device) in each office (option B) forwards DHCPDISCOVER broadcasts from local clients to the remote partner server whenever the local DHCP server is down, allowing failover to actually take effect for clients in either office. The legacy split-scope technique of manually carving off a percentage of the other scope ' s addresses (options A and C) is the older, pre-failover workaround and is unnecessary once DHCP Failover is used; there is also no DHCP cluster role delivered through Windows Failover Clustering (option D), since DHCP achieves high availability through Failover mode, not a clustered role.