1. Create the KDS root key in AD DS. 2. Create a group managed service account (gMSA) in Active Directory. 3. Configure the IIS application pool (on WEB1 and WEB2) to run as the gMSA via a specified user account.

The requirement is that every instance of Webapp1 (running on both WEB1 and WEB2) uses the same identity, and that identity ' s password rotates automatically every 30 days, without any administrator manually resetting it. A standalone managed service account (sMSA) is tied to a single computer and cannot be shared across WEB1 and WEB2, so it does not meet the requirement. A group managed service account (gMSA) is designed exactly for this scenario: one AD-managed identity that multiple servers can use simultaneously, with the Key Distribution Service automatically rotating its password (by default every 30 days) without needing manual intervention or downtime. Before any gMSA can be created in the forest, a one-time prerequisite must exist: the KDS root key, which the Key Distribution Service uses to generate and later recompute the gMSA ' s password material. So the correct order is to first create the KDS root key, then create the gMSA object in Active Directory, and finally configure the IIS application pool on each web server to run as that gMSA using the " specified user account " identity option (entered as domain\gMSA$ with no password required, since the password is centrally managed). Creating a system- or user-assigned managed identity in Microsoft Entra ID does not apply here, since Webapp1 runs on IIS on domain-joined VMs, not as an Azure PaaS resource.

DC3 is a domain controller for the existing corp.fabrikam.com AD DS forest, deployed into Vnet1 in Azure. Domain controllers rely on AD-integrated DNS for locating other domain controllers, SRV records, and replication, so DC3 needs to host that zone itself, which requires installing the DNS Server role on DC3 and letting it host an AD-integrated copy of the corp.fabrikam.com zone. Azure ' s default virtual-network-provided DNS resolver has no awareness of AD DS records and cannot host or serve an AD-integrated zone, so every resource in Vnet1 that needs to locate the domain (including Azure VMs and DC3 ' s own replication partners) must be pointed at real DNS servers instead. That is accomplished by configuring the custom DNS Servers setting on Vnet1 to reference DC3 (and, once available, DC1 and DC2), which makes all Azure VMs in the virtual network resolve names through the AD-integrated DNS infrastructure rather than the platform resolver. An Azure DNS zone (public) or an Azure private DNS zone are separate, unrelated Azure-native DNS services that cannot host an AD-integrated zone and are not used for this scenario. Installing the DNS Server role on DC3 and pointing Vnet1 at it together satisfy the requirement.

DHCP1 (New York, Scope1) and DHCP2 (Seattle, Scope2) currently serve only their own local office. To make DHCP highly available across both offices, the modern, supported approach is DHCP Failover, configured per scope (option E), which replicates lease information between DHCP1 and DHCP2 in either load-balance or hot-standby mode so that either server can service either scope ' s clients if its partner becomes unavailable. However, DHCP Failover alone only helps if a client ' s DHCP broadcast can actually reach the surviving partner server across the WAN; broadcasts do not cross routed office boundaries on their own. Configuring a DHCP relay agent on the router (or another relay-capable device) in each office (option B) forwards DHCPDISCOVER broadcasts from local clients to the remote partner server whenever the local DHCP server is down, allowing failover to actually take effect for clients in either office. The legacy split-scope technique of manually carving off a percentage of the other scope ' s addresses (options A and C) is the older, pre-failover workaround and is unnecessary once DHCP Failover is used; there is also no DHCP cluster role delivered through Windows Failover Clustering (option D), since DHCP achieves high availability through Failover mode, not a clustered role.

On a Virtual WAN hub: An ExpressRoute gateway. In the offices: An ExpressRoute circuit connection.

Fabrikam ' s plan is to replace the existing WAN links between the New York and Seattle offices with Azure Virtual WAN and ExpressRoute, connecting both offices to Vnet1 through the Virtual WAN hub. Azure Virtual WAN uses its own hub-native ExpressRoute gateway object (distinct from the standalone virtual network gateway used when ExpressRoute is connected directly to a single VNet); this ExpressRoute gateway is deployed inside the Virtual WAN hub and is required before any ExpressRoute circuit can terminate into that hub. A standard virtual network gateway is used for VNet-to-VNet or VPN scenarios, not for Virtual WAN hub ExpressRoute termination, and an ExpressRoute circuit connection itself is the logical link resource, not something you deploy on the hub. At each office, connectivity into Microsoft ' s network is established through an ExpressRoute circuit connection provisioned with a connectivity provider, which then links, via Microsoft ' s backbone, into the ExpressRoute gateway in the Virtual WAN hub. A Site-to-Site VPN, an Azure application gateway (a web traffic load balancer), and an on-premises data gateway (used for Power Platform/Logic Apps connectors) are all unrelated to this ExpressRoute-based design.

Sync groups: 3. Storage Sync Services: 1.

In Azure File Sync, a sync group defines a single sync topology and can contain exactly one cloud endpoint (one Azure file share) but can contain multiple server endpoints (on-premises server locations) that all sync to that same file share. Fabrikam needs newyorkfiles to sync only to FS1, seattlefiles to sync only to FS2, and companyfiles to sync to both FS1 and FS2. Because each Azure file share can only belong to one sync group, newyorkfiles requires its own sync group with a single server endpoint on FS1, seattlefiles requires its own sync group with a single server endpoint on FS2, and companyfiles requires a third sync group whose one cloud endpoint (companyfiles) has two server endpoints, one on FS1 and one on FS2, which Azure File Sync fully supports within a single sync group. That gives a minimum of three sync groups. A Storage Sync Service is the top-level Azure resource that contains and manages sync groups, and there is no requirement here that forces the shares into separate Storage Sync Service instances (such as differing regions or subscriptions); a single Storage Sync Service can hold all three sync groups. Therefore only one Storage Sync Service is required.

Server1: Set-Item. Server4: Enable-PSRemoting.

The requirement is to manage Server4 from Server1 by using PowerShell remoting. Server4 is a workgroup computer, not a member of either AD DS domain, so the WinRM authentication that PowerShell remoting relies on cannot use Kerberos between Server1 and Server4; it must fall back to NTLM, which WinRM only permits toward hosts explicitly listed in the client ' s TrustedHosts list. On Server1, the correct action is therefore Set-Item, used as Set-Item WSMan:\localhost\Client\TrustedHosts -Value " Server4 " (with -Concatenate as needed), which adds Server4 to Server1 ' s trusted hosts so an NTLM-based remoting session is permitted. On Server4, the target must first be configured to accept remote commands at all, which is done with Enable-PSRemoting; this cmdlet starts and configures the WinRM service, creates a listener, and enables the Windows Remote Management firewall rule for the current network profile, matching Server4 ' s private firewall profile. Enable-ServerManagerStandardUserRemoting only grants a non-administrator limited Server Manager access and does not establish remoting, and Start-Service alone does not create or configure a WinRM listener or firewall exception. Configuring Set-Item on Server1 and Enable-PSRemoting on Server4 together satisfies the requirement.

Statement 1: No. Statement 2: Yes. Statement 3: No.

Password-policy (Account Policy) settings inside a GPO behave differently depending on where the GPO is linked. For domain user accounts, only Account Policy settings defined in a GPO linked at the domain level (or in a fine-grained Password Settings Object) take effect; Account Policy settings in a GPO linked to an OU are ignored for domain accounts and instead apply only to the local SAM password policy of computer objects located in that OU. GPO1 (minimum length 14) is linked to OU1, where Admin1 ' s user object resides, but because it is linked to an OU rather than the domain, it has no effect on Admin1 ' s domain account password requirement. Admin1 ' s domain password is governed only by the Default Domain Policy (minimum length 10), so statement 1 is false. User1 is likewise a domain account subject only to the Default Domain Policy ' s minimum length of 10, so statement 2 is true. GPO2 (minimum length 8) is linked to the Member Servers OU, which contains Server1 as a computer object; this makes GPO2 the effective local password policy for local accounts created on Server1 (overriding the Default Domain Policy locally), not the domain policy ' s 10-character minimum. Therefore a new local account on Server1 needs only eight characters, not ten, making statement 3 false.

Group3: Group1, Group2, Group4, and Group5 only. Group5: Group4 only.

Group nesting in AD DS is governed strictly by group scope, independent of whether a group is security- or distribution-type. A Domain Local group can contain user accounts, Global groups from any domain, and Universal groups from any domain, plus other Domain Local groups from its own domain only. Group3 is a Domain Local group in contoso.com, so it can accept Group1 (Universal, contoso.com), Group2 (Global, contoso.com), and Group4 and Group5 (both Global, canada.contoso.com), since Global groups from any domain are valid Domain Local members. It cannot accept Group6, because Group6 is Domain Local in canada.contoso.com, a different domain, and Domain Local groups may only nest other Domain Local groups from their own domain. That gives Group3: Group1, Group2, Group4, and Group5 only. A Global group, by contrast, can contain only user accounts and other Global groups from the same domain. Group5 is Global in canada.contoso.com, so among the remaining groups only Group4 qualifies, since it is also Global and in the same domain; Group1 (Universal), Group2 (Global but a different domain), and Group6 (Domain Local) are all excluded by scope rules. That gives Group5: Group4 only.

Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true

The requirement is to run virtual machines on VM1 itself, which means enabling nested virtualization so that VM1 (a guest VM hosted on Server2) can install Hyper-V and host its own virtual machines. Nested virtualization on Hyper-V requires the parent VM ' s virtual processor to expose the host ' s hardware virtualization extensions (Intel VT-x or AMD-V) through to the guest. This is done with the Set-VMProcessor cmdlet using the -ExposeVirtualizationExtensions parameter set to $true, run against VM1 from the Hyper-V host (Server2): Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true. VM1 must be turned off before this setting can be applied, and after it is applied, VM1 needs the Hyper-V role installed inside the guest before it can run its own VMs. Set-VM, Set-VMBios, Set-VMHost, and Set-VMFirmware do not control virtualization extension exposure: Set-VM manages general VM configuration such as memory and name, Set-VMHost configures host-wide settings, and Set-VMFirmware/Set-VMBios control boot and firmware settings for generation 2 and generation 1 VMs respectively. Only Set-VMProcessor with -ExposeVirtualizationExtensions satisfies the stated requirement, making it the correct first step.

On Cluster1: Import the Azure Migrate appliance. In Azure: Create an Azure Migrate project.

APP3 and APP4 run as virtual machines on the on-premises Cluster1 Hyper-V failover cluster, so migrating them to Azure uses the Azure Migrate: Server Migration workflow for Hyper-V. That workflow requires an Azure Migrate project to first be created in Azure, since the project is the container that organizes the migration effort, tracks discovered and assessed machines, and holds the configuration for the subsequent discovery and replication work. On the Cluster1 side, the Azure Migrate appliance -- a purpose-built VM or OVA image supplied by Azure Migrate specifically for Hyper-V environments -- must be imported (deployed) onto the Hyper-V host or cluster, where it discovers the VMs running there and orchestrates their replication into Azure. Configuring an Azure Network Adapter, creating a Point-to-Site VPN connection to Vnet1, installing the Azure File Sync agent, and installing the Windows Server Migration Tools are all unrelated actions that do not perform Hyper-V VM discovery or replication for an Azure Migrate project. Similarly, creating a premium block blob storage account, a private endpoint, or a VPN gateway in Azure are not the resource that Azure Migrate itself requires to begin a migration project -- an Azure Migrate project is. Therefore, importing the Azure Migrate appliance onto Cluster1 and creating an Azure Migrate project in Azure are the two required preparatory actions.

1. Add a disk resource to the cluster. 2. Create a Cluster Shared Volume (CSV). 3. Put the disk in maintenance mode. 4. Enable BitLocker on the volume. 5. Update the BitLockerProtectorInfo property of the volume.

BitLocker can only be enabled on a Cluster Shared Volume disk while that disk is taken offline to cluster I/O, so the CSV must exist and be placed into maintenance mode before encryption can be applied. The supported sequence begins by adding the disk resource to the cluster and converting it into a Cluster Shared Volume, since BitLocker-on-CSV support requires the disk to already be a CSV rather than a plain cluster disk. The disk is then put into maintenance mode, which takes it offline to the other cluster nodes so it can be safely encrypted without a node attempting to access it mid-operation. With the CSV disk offline in maintenance mode, BitLocker is enabled on the volume. Finally, the volume ' s BitLockerProtectorInfo property is updated so that Failover Clustering registers the unlock protector, allowing the volume to automatically unlock on every cluster node once maintenance mode ends and the CSV is brought back online. Performing these steps out of order either fails outright -- BitLocker cannot be enabled on a CSV disk that is still online and actively used by the cluster -- or leaves the other cluster nodes unable to bring the encrypted volume back online afterward, since they would lack the registered unlock protector. Therefore, the correct order is: add the disk resource, create the CSV, put the disk in maintenance mode, enable BitLocker, and update BitLockerProtectorInfo.

hvc.exe, ssh User2@VM2

The requirement is to use a direct SSH session to manage all the supported virtual machines on HyperV1, without relying on a network path to the guest. Hyper-V provides hvc.exe, a helper used as an SSH ProxyCommand, that opens an SSH session to a virtual machine over the VMBus (the internal Hyper-V socket/console channel) rather than over the network, which works even when the guest has no reachable IP configuration and only default management tools installed, matching the stated environment. Direct SSH management this way requires the guest to run an SSH server; of the three VMs, only VM2 runs Red Hat Enterprise Linux, which includes OpenSSH server support out of the box, so it is the only VM realistically " supported " for this direct SSH scenario as described, and the account to use is User2, the local account that exists on VM2. VM1 and VM3 both run Windows Server, so " direct SSH, " as intended by this requirement, targets the Linux guest. Connect-PSSession and Connect-WSMan are PowerShell remoting tools, not SSH, and mstsc.exe launches a graphical Remote Desktop session rather than a console-mode SSH session, so none of those alternatives fit. The correct combination is hvc.exe used as the SSH proxy, connecting as User2@VM2.

1. Deploy the Azure Storage Sync service. 2. Install and register the Azure File Sync agent. 3. Create a sync group. 4. Add a server endpoint.

Data1 is a file share on VM1 that must be synced to the Azure Files share1 using Azure File Sync. The documented deployment order starts in Azure: you must first deploy a Storage Sync Service resource, because the on-premises agent registration process needs an existing Storage Sync Service to register against. With that resource in place, the next step, already fixed in the sequence, is to install the Azure File Sync agent on VM1 and register the server with the Storage Sync Service, which establishes the server ' s identity and trust relationship with Azure. After registration, you create a sync group, the container that pairs one Azure file share (the cloud endpoint) with one or more on-premises folders (server endpoints); the sync group must exist before endpoints can be attached to it. Finally, you add a server endpoint pointing at the Data1 path on VM1, which starts the actual namespace and content synchronization with share1. Installing the DFS Replication role service and installing the Storage Replica feature are unrelated technologies, DFS-R replicates between on-premises servers and Storage Replica performs block-level volume replication, neither of which is part of an Azure File Sync deployment, so both are correctly excluded from the sequence.

Task1 is an Azure Automation runbook, and Azure Automation supports a specific, limited set of runbook types: PowerShell (and PowerShell Workflow), Python, and Graphical runbooks (which are authored visually rather than in a scripting language). Of the listed options, PowerShell and Python are the two genuine scripting languages Azure Automation lets you author a runbook in directly, making them the two correct answers. Java and JavaScript are not supported runbook languages in Azure Automation; JavaScript is used elsewhere in Azure (for example, in Azure Functions or Logic Apps custom code), but not for Automation runbooks. Bicep is a domain-specific language for declaratively defining Azure infrastructure as code (compiling down to ARM templates) and has no role as an executable runbook language; you would not write a Task1 runbook in Bicep, since runbooks execute imperative logic rather than declare resource deployments. Therefore, Python and PowerShell are the two languages available for Task1.

1. roles 2. connections 3. connect to server dc2.adatum.com 4. quit 5. seize schema master

Because DC1 has failed and cannot gracefully transfer the schema master role, DC2 must forcibly seize it using ntdsutil.exe. From the initial ntdsutil prompt, the first command is roles, which enters the Role Management submenu where FSMO role transfers and seizures are performed. From within that submenu, the command connections opens the Connections submenu, which is required before you can bind ntdsutil to a specific target domain controller. Inside the Connections submenu, connect to server dc2.adatum.com establishes the bind to DC2, the domain controller that will actually take over the schema master role. The quit command then exits the Connections submenu and returns to the Role Management submenu while keeping the established connection to DC2 active. Finally, seize schema master, executed from the Role Management submenu while bound to DC2, forces DC2 to take ownership of the schema master role even though DC1 (the previous holder) is offline and cannot be contacted to confirm the transfer. The unused command in the list, metadata cleanup, is a separate, later step used to remove the failed DC1 ' s leftover directory metadata once its roles have been reassigned; it is not part of seizing the schema master role itself, so it is correctly left out of this five-step sequence.

Disk1: 2. Disk2: 1.

The requirement is that data on SSPace1 must remain available at all times, meaning the storage pool ' s virtual disks must be able to tolerate physical disk failures without becoming unavailable or losing data. A three-way mirror keeps three copies of every block of data spread across different physical disks, so it remains available and readable even if any two of those disks fail simultaneously; the resiliency is fixed at tolerating two failures regardless of how many total disks (8, in Disk1 ' s case) make up the pool, as long as there are enough disks to support three-way mirroring, which eight comfortably provides. Disk2 uses parity resiliency, which stores a single parity block that can reconstruct data after one physical disk failure; unless dual parity is explicitly configured (which requires being set at virtual disk creation time and is not indicated here), a standard parity virtual disk tolerates only one physical disk failure before data becomes unavailable, regardless of the pool having twelve physical disks. Administrators sometimes assume more disks in a parity pool automatically means more fault tolerance, but the number of disks a parity space can lose is determined by the resiliency configuration (single vs. dual parity), not by the total disk count. Therefore Disk1 tolerates two disk failures and Disk2 tolerates one.

On the domain controllers: Install the Azure Monitor agent. In Azure: Create an Azure Log Analytics workspace.

Centrally managing performance alerts in Azure for on-premises domain controllers is done by connecting those servers to Azure Monitor: the Azure Monitor agent is installed on each domain controller (onboarded to Azure Arc for non-Azure servers, or directly if they are Azure VMs) to collect performance counters and event data, and that telemetry is sent to an Azure Log Analytics workspace, which is the resource that stores the collected data and against which performance-based alert rules are then defined and centrally managed. Creating a Data Collector Set in Performance Monitor and modifying the Performance Monitor Users group are both local, per-server administrative actions that never send any data to Azure and cannot support central, Azure-based alerting. An Azure SQL database, a Storage Sync Service, and an Azure Storage account are all Azure resources, but none of them is the telemetry store that Azure Monitor ' s alerting pipeline is built on -- only a Log Analytics workspace serves that role. Therefore, installing the Azure Monitor agent on the domain controllers and creating an Azure Log Analytics workspace are the two required actions.

BitLocker: C, D, E, and F. Auto-unlock: D, E, and F only.

BitLocker Drive Encryption can be enabled on every volume shown in Server4 ' s disk configuration -- the NTFS-formatted operating system volume (C:), the NTFS data volume (D:), and the two ReFS-formatted data volumes (E: and F:). BitLocker has no file-system restriction that excludes ReFS: Microsoft ' s ReFS documentation and BitLocker ' s own volume support explicitly confirm that ReFS-formatted volumes, including already-encrypted ones that are later expanded, are fully supported, so E: and F: are just as eligible for BitLocker as the NTFS volumes. BitLocker auto-unlock, however, is a feature limited to fixed data volumes: it lets a data volume unlock automatically at startup using a key protected by the already-unlocked operating system volume, and it is not applicable to the OS volume itself, since the OS volume instead relies on the TPM (or a startup key/PIN) to unlock during boot -- there is no separate outer volume for it to depend on. Because C: is the operating system volume, auto-unlock cannot be configured on it, leaving D:, E:, and F: as the volumes eligible for auto-unlock. Therefore, BitLocker can be turned on for all four volumes (C, D, E, and F), while auto-unlock is available only on the three data volumes (D, E, and F).

1. Create an Azure Recovery Services vault. 2. Create a Hyper-V site. 3. Install and register Azure Site Recovery Providers. 4. Create and associate replication policies.

Setting up Azure Site Recovery for a Hyper-V cluster that is not managed by Virtual Machine Manager follows a fixed infrastructure-preparation order. An Azure Recovery Services vault must exist first, since it is the container that every later step registers against. A Hyper-V site is then created in that vault to represent the on-premises Hyper-V environment, because a Hyper-V host or cluster must belong to a site before its hosts can be registered against Azure Site Recovery. The Azure Site Recovery Provider is then installed on the Hyper-V hosts (Cluster2 ' s nodes) and registered to that site/vault, which is what actually connects the cluster nodes to Azure Site Recovery. Only once the hosts are registered can a replication policy be created and associated with the Hyper-V site, since a policy has nothing to attach to until the site and its registered hosts already exist. Installing Azure Connected Machine agents is unrelated to Hyper-V VM replication -- that agent is used for onboarding servers to Azure Arc -- and is not part of this workflow. Therefore, the correct order is: create the vault, create the Hyper-V site, install and register the Providers, and create and associate the replication policy.

Signing in over Remote Desktop requires a user to hold the " Allow log on through Remote Desktop Services " right and the " Access this computer from the network " right, and to be excluded from any matching Deny counterpart, since an explicit Deny always overrides an Allow granted through any other group membership. User1 is a member of Group2 (granted the Remote Desktop Services logon right) but is also a member of Group4, which is explicitly denied " Access this computer from the network " on Server4 -- that network-access denial blocks the RDP connection outright regardless of the Everyone-based network-access Allow or the RDS logon right, so User1 is denied. User2 belongs only to Group2: Group2 grants the RDS logon right, User2 is covered by the Everyone-based network-access Allow, and User2 is not a member of either Group3 or Group4, so neither Deny applies and User2 can sign in successfully. User3 is a member of Group3, which is explicitly denied " Allow log on through Remote Desktop Services " on Server4 -- that denial blocks the RDP logon right itself, so User3 cannot sign in regardless of network-access rights (and User3 is also in Group4, which independently denies network access as well). Therefore, only User2 can successfully sign in to Server4 using Remote Desktop.

Server1 can communicate with: Server2, Server3, and Server4. Server3 can communicate with: Server1 and Server2 only.

Server4 has no isolation connection security rule configured at all, so it never attempts or performs IPsec authentication with any peer. Server1 ' s rule only requests IPsec in both directions rather than requiring it, meaning that if IPsec negotiation does not occur -- as with Server4, which has no IPsec capability configured -- the connection still falls back to succeed in the clear; Server1 can therefore reach Server2, Server3, and Server4. Server3 ' s rule requires IPsec in both directions, meaning a connection only succeeds if IPsec authentication is actually negotiated. Server3 can successfully negotiate IPsec with Server1 (whose " request " setting means it will still respond to and complete an IPsec negotiation when the peer requires it) and with Server2 (which requires inbound and requests outbound IPsec, and likewise supports negotiation), so both of those connections succeed. Server3 cannot successfully negotiate IPsec with Server4, since Server4 has no IPsec capability configured at all, and Server3 ' s " require " setting blocks any connection that cannot be authenticated via IPsec. Therefore, Server1 can communicate with Server2, Server3, and Server4, while Server3 can communicate with only Server1 and Server2.

User1: 9. Admin1: 8.

Fine-grained password policies delivered through Password Settings Objects (PSOs) take precedence over the domain-wide Default Domain Policy for any user they apply to. When more than one PSO would apply to the same user only through different group memberships (as opposed to one being linked directly to the user), the PSO with the lowest numeric precedence value wins. User1 is a member of both Group2 (targeted directly by PSO1, precedence 10, minimum password length 9) and Group4 (targeted directly by PSO2, precedence 20, minimum password length 11); since PSO1 ' s precedence value of 10 is lower than PSO2 ' s 20, PSO1 governs, giving User1 an effective minimum password length of 9. Admin1 is a member only of Domain Admins, which is not targeted by either PSO, so no fine-grained password policy applies. Admin1 is also in OU1, which has GPO1 linked to it with a minimum password length of 10, but Account Policy settings such as password policy configured in an OU-linked GPO never affect the effective password policy of domain user accounts -- only a GPO linked at the domain root can supply a fallback domain-wide default, and PSOs otherwise take precedence over that default. With no applicable PSO, Admin1 ' s effective policy falls back to the Default Domain Policy, whose minimum password length in this environment is 8.

Startup mode for DC1: Directory Services Restore Mode (DSRM). Recovery method: Authoritative subtree restore.

With the Recycle Bin disabled, deleted objects cannot be restored by simply reanimating tombstones, so recovering the Finance OU and its child objects requires restoring them from the pre-deletion system state backup and then forcing that restored data to overwrite the (now-deleted) copies on every other domain controller, which is precisely what an authoritative restore does. Performing any restore of the AD DS database, whether authoritative or non-authoritative, requires the domain controller to be started in Directory Services Restore Mode (DSRM), a special boot mode in which the AD DS database service is offline and can be safely restored from backup instead of running as an active, replicating directory service; Safe Mode with Networking and WinRE do not provide the isolated, non-replicating access to the NTDS database that a restore operation needs. After booting DC1 into DSRM and restoring the system state backup, running an authoritative subtree restore scoped specifically to the Finance OU (using ntdsutil ' s authoritative restore command against that subtree) increments the version numbers only on the objects under Finance so that DC1 ' s restored copies are treated as more current and replicate out to DC2, overwriting the deleted state there, while every other object in the directory retains its current, already-replicated version numbers and is left untouched, preserving the unrelated changes made after the backup. A full non-authoritative restore or an AD DS snapshot export would either overwrite unrelated data or fail to force replication of the recovered objects outward.

In Just Enough Administration (JEA), you restrict what remote users can do by publishing a PowerShell session endpoint that references a session configuration file and one or more role capability files . The AZ-800 “Administering Windows Server Hybrid Core Infrastructure” materials explain that a JEA deployment follows this order: (1) create role capability files (.psrc) in a module’s RoleCapabilities folder to enumerate allowed cmdlets, functions, and parameters; (2) author a session configuration file (.pssc) —typically with New-PSSessionConfigurationFile —that maps users or groups to the role capabilities; and (3) register the endpoint with Register-PSSessionConfiguration , supplying the .pssc path and a Name for the endpoint. Only after registration can helpdesk users connect to the constrained endpoint.

Critically, among the listed cmdlets, Register-PSSessionConfiguration is the one that ac cepts -Name and -Path to a .pssc file, which matches the prompt ( -Path .\hypervJeaConfig __ -Name ' hypervJeaHelpDesk ' -Force ). Enter-PSSession is for connecting to an already published endpoint, and New-PSSessionConfigurationFile creates the .pssc but does not publish it. Likewise, file types .ps1 (script), .psm1 (module), and .psrc (role capability) are not valid for the -Path parameter when registering an endpoint. Therefore, the correct completion is:

Register-PSSessionConfiguration -Path .\hypervJeaConfig.pssc -Name ' hypervJeaHelpDesk ' -Force .

Group1: Apply group policy and Read. Domain Computers: Read only.

By default, Authenticated Users (which includes both user and computer accounts) is granted Read and Apply Group Policy on every new GPO, which is what lets any computer download and evaluate it and lets any signed-in user actually receive its settings; removing that default grant means both permissions must be explicitly re-established for exactly the principals that need them, and no more. Group1 contains the users who must actually receive GPO1 ' s user settings, so it needs both Read (to let the GPO be retrieved and evaluated at all) and Apply Group Policy (to let its settings actually take effect for those users); granting only one would leave the GPO unreadable, or readable but inert, for Group1 ' s members. Domain Computers is different: even though GPO1 contains only User Configuration settings, Group Policy processing on a computer still needs to enumerate and download every GPO linked to its scope in order to evaluate applicability (security filtering, WMI filters) before it can tell whether a given logged-on user should receive it. If Domain Computers has no Read permission at all, computers cannot process GPO1, which breaks correct evaluation for the very users in Group1 who sign in to those computers. Granting Domain Computers only Read — not Apply Group Policy, since GPO1 has no computer settings to apply and granting Apply would exceed least privilege — lets computers process the GPO correctly while ensuring only Group1 ' s members ever receive its settings.

New-AzADServicePrincipal -DisplayName ' arc-for-servers ' -Role ' Azure Connected Machine Onboarding '

At-scale onboarding to Azure Arc with a deployment script authenticates using a service principal rather than an interactive sign-in, and Microsoft ' s guidance for scripted, least-privilege onboarding is to create that service principal with New-AzADServicePrincipal, supplying a -DisplayName and assigning it the built-in Azure Connected Machine Onboarding role, optionally scoped to a specific resource group with -Scope. This role grants only the permissions required to register a machine with Arc and complete the connect operation; it does not include general compute, storage, or networking rights, which is why it satisfies least privilege far better than a broad role such as Contributor. The other two cmdlets in the option list do not fit this task: New-AzADAppCredential only adds or rotates a credential (secret or certificate) on an application object that already exists, and it performs no role assignment; New-AzUserAssignedIdentity creates a standalone managed identity resource, which is a different authentication mechanism used by Azure resources calling other Azure services, not a mechanism a locally run onboarding script can use to authenticate against an Azure AD tenant. For the role value, Virtual Machine Contributor and Virtual Machine User Login both exceed what onboarding needs, since they grant ongoing VM management or interactive sign-in rights rather than the narrow, one-time registration permission the Azure Connected Machine Onboarding role provides.

Server2 can ping Server1 successfully: Yes. Server2 can connect to a file share on Server1: Yes. Server3 can connect to a file share on Server1: No.

Server1 ' s connection security rule, Rule1, requires authentication for both inbound and outbound connections on the Domain profile using the Computer (Kerberos V5) method, and Server1 ' s inbound firewall rules for File and Printer Sharing, including the ICMPv4 and ICMPv6 Echo Request rules and the SMB-In rule, are all enabled and set to Allow. Server2 has an identical connection security rule configured, also using Computer (Kerberos V5) authentication on the Domain profile, so Server1 and Server2 can successfully negotiate the mandatory IPsec security association that Rule1 requires; because the underlying firewall rules for ICMP and SMB traffic already allow the traffic through, Server2 can both successfully ping Server1 and connect to a file share on Server1 once that IPsec authentication succeeds. Server3, however, has no connection security rule configured in this scenario that matches Server1 ' s requirement, so it cannot complete the mandatory IPsec authentication that Rule1 demands for all inbound and outbound traffic on Server1; even though the SMB-In firewall rule would otherwise permit the traffic, the connection security requirement blocks Server3 from establishing the necessary secured session, so Server3 cannot connect to a file share on Server1.

Prestaging a cluster name object involves creating a computer account for Cluster1 in AD DS and then disabling it, which lets the cluster creation process confirm during setup that the prestaged account is not already in active use before it takes ownership of it; leaving the account enabled bypasses this safety check. To let User1 create the Hyper-V failover cluster without granting broader administrative rights, User1 is given Full Control permission specifically on that prestaged Cluster1 computer object rather than on the OU or on user rights more broadly, which satisfies the principle of least privilege while still allowing User1 to complete cluster creation. Creating a user account named Cluster1 instead of a computer account would not produce the cluster name object that cluster validation expects, and granting only Allowed to Authenticate or Create all child objects would not be sufficient for User1 to take ownership of and configure the prestaged object during cluster creation.

Onboarding an on-premises server to Microsoft Defender for Cloud starts with preparing a Log Analytics workspace that will receive security data and back the Defender for Cloud plan. Server1 must then be projected into Azure as an Arc-enabled server by installing the Azure Connected Machine agent, which is what makes an on-premises machine addressable by Azure resource-based services such as Defender for Cloud. Finally, a data collection rule is created and associated with the server so that the Microsoft Defender for Endpoint/Azure Monitor Agent based data required by the enabled Defender for Cloud plan is actually collected from Server1. Skipping the Arc-connection step would leave Server1 without an Azure resource identity, so no later DCR association would be possible until the Connected Machine agent is installed first. Once Server1 appears as an Azure Arc machine, Defender for Cloud ' s Foundational CSPM or Defender for Servers plan can be enabled on it just as it would be on a native Azure VM, giving the on-premises server the same recommendations, alerts, and regulatory compliance coverage.

Confidential disk encryption is a platform feature available only on confidential VM sizes such as the DCasv5/DCadsv5/DCesv6 (and equivalent ECasv5/ECesv6) series, so VM1 must be deployed on a DC-series confidential SKU rather than the NC (GPU) or HB (HPC) families. Confidential disk encryption itself binds the encryption key to the VM ' s own vTPM and, by design, protects the operating system disk; the temp disk can optionally be added through a separate confidential temp disk encryption extension, but data disks are not covered by this mechanism and instead rely on guest-level encryption such as BitLocker if extra protection is required. Consequently the disk scope for confidential disk encryption is the operating system disk only, not the OS disk together with data disks. The encryption keys can be customer-managed and held in a managed HSM or Key Vault with purge protection enabled, ensuring the platform itself cannot access the disk contents outside the attested confidential VM boundary, which is the core security guarantee this feature provides over standard Azure Disk Encryption.

1. Install the BitLocker Drive Encryption feature. 2. Encrypt volume C. 3. Turn on auto-unlock.

Automatic unlocking of a BitLocker-protected fixed data drive is a feature of the core BitLocker Drive Encryption feature (Enable-BitLockerAutoUnlock) and has one hard prerequisite: the operating system volume on that computer must also be protected by BitLocker, because the auto-unlock key for the data volume is itself secured against the encrypted OS volume. Since Server1 ' s OS volume (C) is not stated to be encrypted, it must be encrypted first. BitLocker Network Unlock is an unrelated feature that unlocks operating system volumes over the network during startup in a WDS/DHCP environment — it plays no role in unlocking a fixed data drive and is not a prerequisite for Enable-BitLockerAutoUnlock. The correct sequence is therefore to add the BitLocker Drive Encryption feature, encrypt the OS volume (C), and then turn on auto-unlock for volume E, after which subsequent restarts will mount and unlock volume E automatically without any password or recovery key prompt.

1. The cloud endpoint. 2. The server endpoint. 3. The sync group. 4. Sync1.

A Storage Sync Service (Sync1) cannot be deleted while it still contains an active sync group, and a sync group cannot be deleted while it still has a cloud endpoint or server endpoint attached to it, so the topology must be dismantled from the bottom up before the top-level Sync1 resource can be removed. The cloud endpoint (the link between the sync group and the Azure file share, azshare1) and the server endpoint (the link between the sync group and the on-premises path, Share1) are both direct children of the sync group and must both be removed before the now-empty sync group itself can be deleted; removing the cloud endpoint does not delete the underlying Azure file share azshare1 itself, only the sync association, so azshare1 does not need to be deleted at all to remove Sync1 and is correctly left out of the sequence. Once both endpoints are gone, the sync group has nothing left syncing through it and can be deleted, and once the Storage Sync Service has no remaining sync groups, Sync1 itself can finally be deleted. " The management group " is an unrelated Azure governance/organizational construct with no relationship to Storage Sync Service resources and plays no role in this sequence. Therefore, the correct order is: delete the cloud endpoint, delete the server endpoint, delete the sync group, and finally delete Sync1.

1. az extension add. 2. az vm repair create. 3. az vm repair run. 4. az vm repair restore.

The Azure VM repair commands are delivered as the vm-repair Azure CLI extension rather than as a built-in part of the core CLI, so az extension add, which installs that extension, is always the required first step before any az vm repair subcommand can be invoked in Cloud Shell. Once the extension is installed, az vm repair create copies VM1 ' s operating system disk and attaches that copy to a new, temporary repair virtual machine so it can be examined and worked on without further risking the original VM. The optional az vm repair run step then executes a diagnostic or fix-up script against the disk that is now attached to the temporary repair VM, allowing an administrator to inspect or repair the file system, boot configuration, or other disk-level issue that is preventing VM1 from starting. Finally, az vm repair restore swaps the repaired disk back onto the original VM1 in place of its damaged disk and cleans up the temporary repair VM and its associated resources, completing the recovery process and allowing VM1 to start normally again with its repaired disk.