Correct Answer: A

The core requirement is to apply user-specific settings (like session idle lock) to any user logging onto an Azure Virtual Desktop (AVD) session host, regardless of where the user’s account is located in Active Directory. The AVD session host computer accounts are in the AVD OU, and GPO4 is linked to this OU.

By default, Group Policy applies user settings from GPOs linked to the user’s OU, not the computer’s OU. To override this behavior, you must use Group Policy Loopback Processing. This is a computer configuration setting that alters how user policies are applied.

When enabled on a GPO that applies to computer objects (in this case, GPO4 applying to the AVD hosts), it forces the system to apply the user configuration settings from GPOs linked to the computer’s OU. This ensures that any user logging on to an AVD host receives the user settings defined in GPO4, fulfilling the security requirement.

Incorrect Answers:

• C: Enabling loopback processing in GPO1 would apply this logic to all computers in the domain, which is not the requirement. The scope needs to be limited to the AVD hosts.
• D, E: The Enforced property prevents a GPO from being overridden by GPOs at a lower level in the AD hierarchy. It does not change the fundamental processing logic of applying user settings based on the computer’s location.
• B, F: Security filtering restricts which users or computers a GPO applies to. It doesn’t solve the underlying problem of applying user settings from a GPO that is scoped to a computer OU.

Correct Answer: B

The case study requires the creation of a new domain controller named dc3.corp.fabrikam.com in an Azure virtual network (Vnet1). This is a standard hybrid identity scenario where an on-premises Active Directory Domain Services (AD DS) forest is extended into Azure. The correct and recommended method to achieve this is to deploy a new Windows Server virtual machine in Azure, install the AD DS role, and then promote it as an additional domain controller for the existing corp.fabrikam.com domain. This allows for authentication, replication, and Group Policy application for resources within the Azure VNet.

Incorrect Answers:

• A: Azure Active Directory Domain Services (Azure AD DS) is incorrect because it is a managed domain service that creates a separate, managed domain. It cannot be used to add a domain controller to an existing on-premises AD DS domain.
• C: an Azure AD administrative unit is incorrect. Administrative Units are used within Azure AD to scope and delegate administrative permissions, not to deploy infrastructure like domain controllers.
• D: Azure AD Application Proxy is incorrect. This service is used for publishing on-premises web applications to external users and is unrelated to deploying domain controllers.

Correct Answer:

The provided sequence correctly configures a Group Managed Service Account (gMSA) to meet the security requirements for Webapp1. A gMSA is the appropriate solution for services running on multiple servers (a server farm) that require a single identity with automatic password management.

1. Step 1: Create the Key Distribution Services (KDS) root key in AD DS. This is a mandatory prerequisite. The KDS root key is used by domain controllers to generate the passwords for gMSA accounts. This action only needs to be performed once per Active Directory forest.
2. Step 2: Create a group managed service account (gMSA) in Active Directory. After the KDS root key is created, the gMSA can be created. This account is designed to be used by multiple servers, satisfying the requirement for Webapp1 on both WEB1 and WEB2 to use the same account. AD DS will automatically manage the password for this account.
3. Step 3: Configure the IIS application pool to run as a specified user account. The final step is to configure the IIS application pool for Webapp1 on both WEB1 and WEB2 to use the newly created gMSA. This applies the security principal to the service.

Correct Mappings and Explanations:

The solution correctly places the components of Azure AD Password Protection to meet the security requirement of banning passwords related to the company name.

• The Azure AD Password Protection DC agent: This component must be installed on All the domain controllers. The DC agent service intercepts all password set and change requests on-premises, validating them against the password policy downloaded from Azure AD. Installing it on every DC ensures consistent enforcement regardless of where a user changes their password.
• The Azure AD Password Protection proxy service: This service is correctly placed on VM1 and VM2 (representing on-premises member servers). The proxy service acts as an intermediary, forwarding requests from the DC agents to Azure AD. It should not be installed on a domain controller, which aligns with the security requirement to prevent DCs from directly contacting the internet.
• A custom banned password list: This is configured in The Azure AD tenant. The custom list, which would include terms like ‘Fabrikam’, ‘Fab’, etc., is managed centrally in the Azure portal. This list is then synchronized to the on-premises DC agents via the proxy service for local enforcement.

Correct Answer: B

The technical requirement is to promote Server1 to a domain controller in the canada.contoso.com domain. To perform this task, an administrator needs appropriate permissions.

Let’s analyze the permissions of each administrator:

• Admin1: Is a member of the Enterprise Admins group. This group has full administrative control over all domains in the entire Active Directory forest. Therefore, Admin1 has the necessary permissions to add a domain controller to any domain, including canada.contoso.com.
• Admin3: Is a member of the Domain Admins group specifically for the canada.contoso.com domain. The Domain Admins group for a specific domain has the rights to promote member servers to domain controllers within that domain. Therefore, Admin3 can perform this task.
• Admin2: Is a member of the Domain Admins group for the contoso.com domain. These permissions are scoped to the contoso.com domain and do not grant administrative rights in the child domain, canada.contoso.com. Therefore, Admin2 cannot promote a server in the child domain.

Based on this analysis, both Admin1 and Admin3 have the required permissions.

Incorrect Answers:

• A: This is incorrect because Admin1 (Enterprise Admin) also has the required permissions.
• C: This is incorrect because Admin3 (Domain Admin for canada.contoso.com) also has the required permissions.
• D: This is incorrect because Admin2’s permissions are limited to the contoso.com domain and do not extend to the canada.contoso.com child domain for this administrative task.

Rationale Breakdown

The question requires identifying which administrators can change the replication schedule for all Active Directory site links. This is a forest-wide administrative task that involves modifying objects within the Configuration partition of the Active Directory forest.

1. Permission Analysis: To modify site links, an administrator needs permissions that span the entire forest. By default, two main groups have these permissions:

• Enterprise Admins: This group has full control over all domains in the forest and can manage forest-level configurations, such as sites and replication.
• Domain Admins of the Forest Root Domain: Members of the Domain Admins group in the forest root domain (contoso.com in this case) also have privileges that extend across the forest, including managing the Configuration partition.

2. User Group Membership Analysis (from the case study):

• Admin1: Is a member of the Enterprise Admins group. Therefore, Admin1 can perform the task.
• Admin2: Is a member of the Domain Admins group in the contoso.com domain, which is the forest root. Therefore, Admin2 can perform the task.
• Admin3: Is a member of the Domain Admins group in the canada.contoso.com child domain. This group’s permissions are scoped to the canada.contoso.com domain only and do not include forest-wide administrative rights. Therefore, Admin3 cannot perform the task.

Based on this analysis, only Admin1 and Admin2 have the required permissions.

✅ Option D (Correct)

Reasoning: Admin1 is a member of Enterprise Admins, and Admin2 is a member of Domain Admins in the forest root domain (contoso.com). Both of these groups have the necessary forest-wide permissions to modify Active Directory site link objects stored in the Configuration partition.

❌ Why the other choices are incorrect:

• Option A, B, E are incorrect: These options incorrectly include Admin3. Admin3 is a Domain Admin for the canada.contoso.com child domain. This role does not grant permissions to make forest-wide configuration changes.
• Option C is incorrect: This option incorrectly excludes Admin2. As a Domain Admin in the forest root domain, Admin2 also has the required privileges.

Correct Answer: D

✅ Option D (Correct)
Reasoning: The requirement is to allow User1 to manage group memberships specifically within the OU named OU3, while adhering to the principle of least privilege. Using the Delegation of Control Wizard on OU3 is the standard and most precise method to achieve this. This grants User1 only the necessary permissions (modify group membership) and restricts the scope of these permissions to objects solely within OU3, perfectly aligning with the principle of least privilege.

❌ Why the other choices are incorrect:

• Option A is incorrect: The Server Operators group grants server administration privileges, not permissions to manage Active Directory groups. This is the wrong permission set.
• Option B is incorrect: Creating a delegation on the entire `contoso.com` domain would grant permissions far beyond the required scope of OU3, violating the principle of least privilege.
• Option C is incorrect: The Account Operators group has broad, domain-wide permissions to manage most user and group accounts. Assigning this role is excessive for the task of managing groups in a single OU and violates the principle of least privilege.

Group3 Membership Analysis

The question asks which groups can be added to Group3, which the case study identifies as a Universal security group in the contoso.com domain. According to Active Directory group nesting rules:

• Universal groups can contain user accounts, Global groups from any domain, and other Universal groups from any domain.
• Universal groups cannot contain Domain Local groups.

The selected answer choice for Group3 includes Group1 and Group5. Both of these are identified as Domain Local groups. Therefore, adding them to a Universal group like Group3 is not a valid operation. The correct potential members for Group3 from the list are Group2 (Global), Group4 (Global), and Group6 (Global). Since the selected answer violates fundamental AD group nesting rules, it is incorrect.

Group5 Membership Analysis

The question asks which groups can be added to Group5, which the case study identifies as a Domain Local security group in the canada.contoso.com domain. According to Active Directory group nesting rules:

• Domain Local groups can contain user accounts, Global groups, and Universal groups from any domain in the forest. They can also contain other Domain Local groups from the same domain.

The selected answer is Group4 only. Group4 is a Global group, so adding it as a member to the Domain Local Group5 is a valid operation. While this selection is technically correct, it is important to note that Group2 (Global), Group3 (Universal), and Group6 (Global) would also be valid members, making the question potentially ambiguous. However, the primary error lies in the selection for Group3.

Correct Answer: C

The requirement is to install and authorize the DHCP server role on Server3. This involves two distinct tasks with different permission requirements:

1. Installing the DHCP Server Role: This action requires local administrator privileges on the target server, Server3. Server3 is a member server in the contoso.com domain.
2. Authorizing the DHCP Server in Active Directory: This action modifies the Active Directory forest configuration and requires membership in the Enterprise Admins group.

Let’s evaluate each administrator:

• Admin1: Is a member of both the Domain Admins group in contoso.com and the Enterprise Admins group. As a Domain Admin for contoso.com, Admin1 is automatically a member of the local Administrators group on Server3, allowing them to install the role. As an Enterprise Admin, Admin1 can authorize the DHCP server in Active Directory. Therefore, Admin1 can perform both required tasks.
• Admin2: Is a member of the Server Operators group. This group does not have the right to install roles and features on a server, nor does it have the necessary Active Directory permissions to authorize a DHCP server.
• Admin3: Is a member of the Domain Admins group in the canada.contoso.com domain. This does not grant administrative rights on servers in the parent contoso.com domain, nor does it grant membership in the forest-level Enterprise Admins group required for DHCP authorization.

Based on this analysis, only Admin1 has the necessary permissions to fulfill the entire requirement.

Rationale Breakdown

The provided solution is incorrect. The Active Directory Sites and Services console is used to manage replication topology, including sites, subnets, and site links. The properties of a site object, such as Default-First-Site-Name, do not contain information about which domain controller holds the Flexible Single Master Operations (FSMO) roles.

To correctly identify the PDC emulator for a domain, you can use one of the following methods:

• PowerShell: Run the command Get-ADDomain | Select-Object PDCEmulator.
• Command Prompt: Run the command netdom query fsmo. This command lists all five FSMO role holders for the domain.
• Active Directory Users and Computers GUI: Right-click the domain name in the console, select Operations Masters, and then click the PDC tab.

The provided solution is incorrect because the steps described identify the Domain Naming Master, not the PDC Emulator. The Domain Naming Master is a forest-wide FSMO (Flexible Single Master Operations) role, responsible for managing the addition and removal of domains in the forest. You view it by right-clicking the root node in the Active Directory Domains and Trusts console.

The PDC Emulator is a domain-wide FSMO role. To find it using the GUI, you must use the Active Directory Users and Computers console, right-click the domain name itself (e.g., contoso.com), and then select ‘Operations Masters…’. This will open a dialog with tabs for the three domain-wide FSMO roles: RID, PDC, and Infrastructure.

✅ Option A (Yes)

Reasoning: The command netdom.exe query fsmo is a valid and direct method for identifying the holders of all five Flexible Single Master Operations (FSMO) roles within an Active Directory domain. The output of this command explicitly lists the server currently holding the PDC Emulator role, along with the other four FSMO roles. Therefore, running this command successfully meets the stated goal.

❌ Why the other choices are incorrect:

• Option B (No) is incorrect: This option is incorrect because the netdom query fsmo command is a well-established and effective tool for this specific task. It directly queries Active Directory and returns the name of the server holding the PDC emulator role.

✅ Option B (Correct)
Reasoning: To allow password changes made in Azure AD via Self-Service Password Reset (SSPR) to be effective for on-premises AD DS resources, the password must be synchronized from the cloud back to the on-premises directory. This capability is called Password Writeback. It is a feature of Azure AD Connect that must be explicitly enabled by running the configuration wizard and selecting the ‘Password writeback’ option under ‘Customize synchronization options’. This configures the necessary components and permissions for secure password synchronization.

❌ Why the other choices are incorrect:

• Option A is incorrect: The Azure AD Password Protection proxy service is used to enforce Azure AD’s smart lockout and banned password policies on-premises. It does not facilitate the synchronization of password resets from Azure AD to AD DS.
• Option C is incorrect: While enabling password writeback does grant permissions to the Azure AD Connect service account, the correct procedure is to enable the feature through the wizard, which configures a specific set of required permissions (including Reset Password, not just Change Password). Manually granting permissions is not the standard or complete method.
• Option D is incorrect: The ‘Impersonate a client after authentication’ user right is not required for password writeback functionality. The permissions needed are specific Active Directory object permissions, not a user rights assignment.

✅ Option A (Correct)
Reasoning: In an Azure Active Directory Domain Services (Azure AD DS) managed domain, administrative tasks are delegated to the AAD DC Administrators group. Members of this group are granted permissions to manage Group Policy Objects (GPOs), create custom Organizational Units (OUs), and join computers to the domain. This is the designated and correct group for an administrator who needs to manage GPOs, aligning with the principle of least privilege within the context of the Azure AD DS managed service.

❌ Why the other choices are incorrect:

• Options B, C, and D are incorrect: In Azure AD DS, customers do not have the permissions to add members to the Domain Admins, Schema Admins, or Enterprise Admins groups. These high-privilege, built-in groups are protected and managed by the Azure service itself to maintain the integrity of the managed domain.
• Option E is incorrect: While the Group Policy Creator Owners group can create GPOs, the AAD DC Administrators group has comprehensive permissions for full GPO lifecycle management (create, edit, delete, link). For the task of ‘managing’ GPOs, AAD DC Administrators is the intended role.

✅ Add Admin1 to the following group: AAD DC Administrators

Reasoning: In an Azure Active Directory Domain Services (Azure AD DS) managed domain, traditional Domain Admins or Enterprise Admins privileges are not available. The AAD DC Administrators group is the designated high-privilege group. Members are granted the necessary permissions to perform administrative tasks such as creating, editing, and linking Group Policy Objects (GPOs), which is required for this scenario.

✅ Instruct Admin1 to apply the custom Group Policy settings by: Creating a new Group Policy Object (GPO) and linking it

Reasoning: Creating a new, separate GPO is the standard best practice for deploying new settings. This isolates the custom configurations, making them easier to manage, troubleshoot, or disable later without affecting default policies. The new GPO can then be linked to the appropriate container, such as the ‘AADDC Computers’ OU, to apply the settings to all computer objects.

The provided solution correctly sequences the steps for a least-privilege deployment of a Read-Only Domain Controller (RODC) into a new Active Directory site. Each step logically builds upon the previous one to meet all the stated requirements.

✅ Step 1: Create a site and a subnet.
Reasoning: This initial step is required to fulfill two requirements. First, it creates the new logical location, ‘RemoteSite1’, for the RODC. Second, by placing the RODC in a separate site, administrators can configure a distinct replication schedule on the site link, thereby controlling replication traffic.

✅ Step 2: Pre-create an RODC account.
Reasoning: This is the core action for enabling a least-privilege installation. Pre-creating, or staging, the RODC account allows a Domain Admin to delegate the precise permission needed for the installation to User1, without granting excessive permissions like Domain or Enterprise Admins. User1 is only a local administrator on the target server.

✅ Step 3: Instruct User1 to run the Active Directory Domain Services installation Wizard on Server1.
Reasoning: With the Active Directory infrastructure prepared (new site) and permissions correctly delegated (pre-created account), User1 now has the authority to complete the final step. Running the wizard will join the server to the domain and promote it to an RODC using the pre-staged account.

✅ Option B (Correct)
Reasoning: The most efficient way to apply a Group Policy preference to member servers while excluding domain controllers and client computers is to use Operating System item-level targeting. This feature allows you to specify criteria based on the OS, including the Product Type. You can configure the targeting to apply only when the Product Type is Server and is not a Domain Controller. This is a built-in mechanism that directly queries the computer’s role without requiring any additional Active Directory configuration, thus minimizing administrative effort as required.

❌ Why the other choices are incorrect:

• A: Domain is incorrect because all the computers (servers, domain controllers, and clients) are members of the same domain. This targeting type cannot be used to differentiate between them.
• C: Security Group is incorrect because while it would work, it would require more administrative effort. You would need to create a new security group, populate it with all member server computer accounts, and maintain its membership over time. Using the built-in Operating System targeting is more direct.
• D: Environment Variable is incorrect because it is not a reliable or standard method for differentiating between computer roles like member server, domain controller, or client workstation.

Correct Order of Actions:

The sequence provided correctly configures the Active Directory sites and replication topology to meet the specified requirements.

✅ Step 1: Create two additional sites named Site2 and Site3. Move DC2 to Site2 and DC3 to Site3.

Reasoning: The first step is to create the site objects that represent the physical locations of the datacenters. Moving each domain controller into its respective site is essential for managing replication traffic based on network topology.

✅ Step 2: Create an additional site link that contains Site1 and Site2.

Reasoning: Site links define the replication paths and schedules between sites. To control the replication schedule between Site1 and Site2 independently, a dedicated site link must be created. This allows for custom configuration of cost, schedule, and interval for that specific path.

✅ Step 3: Remove Site2 from DEFAULTIPSITELINK.

Reasoning: By default, all sites are included in the `DEFAULTIPSITELINK`, which provides a transitive, catch-all replication path. To enforce the use of the new, more specific site link created in Step 2, Site2 must be removed from the default link. This ensures replication follows the explicitly defined path and schedule.

✅ Option A (Correct)

Reasoning: The table shows that DC1 holds the Domain Naming Master FSMO role. This forest-scoped role is exclusively responsible for adding or removing domains and application directory partitions from the Active Directory forest. If this server is unavailable, you cannot create new application partitions.

❌ Why the other choices are incorrect:

• Option B is incorrect: DC2 is the RID Master. This role allocates pools of Relative IDs (RIDs) to other domain controllers for the creation of security principals (users, groups, etc.). It is not involved in partition management.
• Option C is incorrect: DC3 is the PDC Emulator. This role is a backward-compatibility role that also acts as the primary time source and handles urgent password replications and Group Policy updates. It does not manage partitions.
• Option D is incorrect: DC4 is the Schema Master. This role is responsible for processing updates to the Active Directory schema. While the schema defines the structure of the directory, this role does not create partitions themselves.
• Option E is incorrect: DC5 is the Infrastructure Master. This role is responsible for updating cross-domain object references, ensuring that group memberships for users from other domains are current. It has no role in partition creation.

✅ Option A (Correct)
Reasoning: To use on-premises computer objects like Computer1 in Azure AD Conditional Access policies (e.g., requiring a compliant or hybrid-joined device), the devices must first be registered in Azure AD. The ‘Configure Hybrid Azure AD join’ option in Azure AD Connect synchronizes on-premises AD computer objects to Azure AD and completes the registration process, making them available as a condition in policies.

❌ Why the other choices are incorrect:

• Option B is incorrect: While Group2 (Domain Local) needs its scope changed to be synchronized, Group1 is already a Universal group and will sync. This option is both unnecessary for Group1 and incomplete as it doesn’t address how to make Computer1 usable in Conditional Access policies.
• Option C is incorrect: Device writeback is for writing device objects from Azure AD back to on-premises AD, typically for ADFS integration. The goal here is the opposite: to get the on-premises computer object into Azure AD.
• Option D is incorrect: Changing the scope of Group2 from Domain Local to Universal is a necessary prerequisite for that specific group to be synchronized to Azure AD. However, this action alone does not address Computer1, which requires Hybrid Azure AD Join to be usable in device-based Conditional Access policies.

✅ Option A (Correct)
Reasoning: The convergence time for Active Directory is the time it takes for a change to replicate to all domain controllers. For replication between different Active Directory sites (inter-site replication), this is primarily controlled by the site link’s schedule and replication interval. By default, inter-site replication occurs every 180 minutes. To minimize convergence time, you must decrease this replication interval. Modifying the replication schedule for each site link to a more frequent interval (the minimum is 15 minutes) will ensure that changes are replicated between sites more quickly, thus reducing the overall convergence time.

❌ Why the other choices are incorrect:

• Option B is incorrect: Modifying site link costs affects the replication path or topology, not the replication frequency. The Knowledge Consistency Checker (KCC) uses costs to determine the most efficient route for replication but does not change how often replication occurs over that route.
• Option C is incorrect: A site link bridge makes replication paths transitive between sites that are not directly connected. By default, the "Bridge all site links" option is enabled, so creating a manual bridge is often redundant. This action affects the replication topology, not the frequency, and therefore does not minimize convergence time.
• Option D is incorrect: Modifying the options attribute on a site link can enable change notification, which triggers replication when changes occur rather than waiting for the scheduled interval. While this can speed up replication, the schedule still defines the maximum possible delay. The most direct and fundamental method to guarantee a lower convergence time is to reduce the scheduled replication interval itself.

The provided solution correctly sequences the PowerShell cmdlets required to create and deploy a group Managed Service Account (gMSA) for use by a group of servers. The process must begin by creating the Key Distribution Service (KDS) root key, followed by creating the gMSA object in Active Directory, and finally installing the account on each member server.

✅ Step 1: Add-KdsRootKey
Reasoning: This cmdlet creates the KDS root key in Active Directory. This is a prerequisite for creating any gMSA, as the KDS service on domain controllers uses this key to generate and manage passwords for the service accounts. This is a one-time setup step for the forest.

✅ Step 2: New-ADServiceAccount
Reasoning: Once the KDS root key exists, this cmdlet creates the gMSA object in Active Directory. The -PrincipalsAllowedToRetrieveManagedPassword parameter would be used here to specify the ITFarmHosts security group, thereby authorizing its members to use this gMSA.

✅ Step 3: Install-ADServiceAccount
Reasoning: After creating the gMSA in AD, it must be installed on each server that will use it. This cmdlet verifies that the host computer is authorized (i.e., is a member of ITFarmHosts) and prepares the local machine to use the gMSA for services.

✅ Option D (Correct)
Reasoning: To enable Windows Hello for Business in a hybrid environment to access on-premises resources seamlessly, the recommended deployment model is Azure AD Kerberos. A key prerequisite for Azure AD Kerberos is enabling password writeback in Azure AD Connect. This feature facilitates the synchronization of cryptographic material necessary for Azure AD to issue Kerberos Ticket-Granting Tickets (TGTs) that are valid for the on-premises Active Directory domain.

❌ Why the other choices are incorrect:

• Option A is incorrect: Device writeback writes Azure AD device objects back to on-premises AD. This is a prerequisite for setting up hybrid join and for conditional access with ADFS, but it is not the feature that enables the Windows Hello for Business authentication flow itself.
• Option B is incorrect: Group writeback synchronizes Microsoft 365 Groups from Azure AD back to on-premises AD as distribution groups. This feature is unrelated to user or device authentication.
• Option C is incorrect: Azure AD app and attribute filtering is used to limit or restrict which objects and attributes are synchronized to Azure AD, rather than enabling a new capability.
• Option E is incorrect: Directory extension attribute sync is used to synchronize custom attributes from on-premises AD to Azure AD. The attributes required for Windows Hello for Business are standard and do not require this feature.

Admin1: Contoso\Domain Admins

The task of creating and managing Active Directory sites requires permissions to modify the Configuration partition of the forest. By default, the Administrators group in the forest root domain (contoso.com) has full control over this partition. The Contoso\Domain Admins group is a member of the root domain’s Administrators group, thereby inheriting the necessary rights. While Enterprise Admins could also perform this task, Domain Admins is the group with the least privilege that meets the requirement.

Admin2: East\Domain Admins

To deploy new domain controllers into a specific domain, an account needs administrative privileges within that domain. The Domain Admins group for the target domain (east.contoso.com) has the exact permissions required to promote servers to domain controllers. Assigning Admin2 to the East\Domain Admins group correctly follows the principle of least privilege by granting administrative rights only within the necessary child domain, without providing excess permissions in the parent domain or the entire forest.

✅ Why B (No) is Correct

The proposed solution is incorrect because the process of locating a domain controller (DCLocator) occurs before a computer applies Group Policy. A client computer determines its site membership based on its IP address and the corresponding subnet object defined in Active Directory Sites and Services. It must successfully find and authenticate to a domain controller to download and apply any Group Policy Objects (GPOs).

Furthermore, the specific GPO setting, “Try Next Closest Site,” is a failover mechanism. It only comes into play if the client cannot find an available DC in its own assigned site. It does not influence the initial site determination or the primary choice of DCs.

To achieve the goal, the correct procedure is to use the Active Directory Sites and Services console to create a new site for the branch office, create a subnet object that includes the IP addresses of the client computers, associate that subnet with the new site, and then adjust site link costs to ensure the new site has the lowest cost connection to Site1.

❌ Why A (Yes) is Incorrect

This solution would not work because applying a GPO to an OU of computers cannot influence which DC those computers use for their initial authentication, as GPOs are processed only after a successful authentication has already occurred.

This solution is incorrect. The goal is to have clients in a new site (Site4) primarily use domain controllers in Site1.

Active Directory clients locate domain controllers based on site link costs. When a client’s own site has no domain controllers, it will use the domain controllers in the site connected by the lowest-cost site link.

By adding Site4 to the DEFAULTIPSITELINK, it is connected to Site1, Site2, and Site3 with an identical default cost of 100. Because all three sites are equally “close” from a cost perspective, clients in Site4 will be directed to domain controllers in any of the three sites, not primarily Site1.

To achieve the goal, a dedicated site link between Site1 and Site4 with a lower cost than the links to Site2 and Site3 is required.

✅ Option B (Correct)

Reasoning: The proposed solution is incorrect because it fails to address the fundamental issue. The client computers in the new branch office are not associated with any Active Directory site because their IP subnet has not been defined in Active Directory Sites and Services. As a result, these clients are considered ‘site-less’ and will use the default DC locator process, which involves querying DNS for all domain controllers and selecting one based on network response time, with no preference for Site1.

The ‘Try Next Closest Site’ Group Policy setting only affects a client’s behavior after it has failed to find a domain controller in its own defined site. Since these clients have no site, this policy is irrelevant. Furthermore, linking the GPO to Site1 applies its settings to computers whose IP addresses fall within the subnets defined for Site1, not the new branch office clients.

The correct approach would be to create a new site for the branch office, associate the office’s IP subnet with this new site, and then create a low-cost site link between the new site and Site1.

❌ Why the other choices are incorrect:

• Option A is incorrect: As explained above, the solution is ineffective. It misuses a Group Policy setting and targets the wrong location, failing to solve the core problem of the new clients not being part of the AD site topology.

✅ Option C (Correct)
Reasoning: The case study requires using Azure Policy to enforce configuration management on on-premises servers. To achieve this, the on-premises servers must first be managed by Azure. Azure Arc extends Azure management to hybrid environments. The core component for this is the Azure Connected Machine agent, which onboards the on-premises servers into Azure Resource Manager as Azure Arc-enabled servers. Once onboarded, services like Azure Policy for Guest Configuration can be used to manage and enforce their configuration.

❌ Why the other choices are incorrect:

• Option A is incorrect: A hybrid runbook worker is a component of Azure Automation that allows runbooks to execute on non-Azure machines. While it’s a form of automation, it is not the mechanism used to apply Azure Policy for configuration management.
• Option B is incorrect: The Azure Monitor agent is used for collecting telemetry, performance data, and logs for Azure Monitor. Its purpose is monitoring, not configuration enforcement.
• Option D is incorrect: Hybrid Azure AD join is an identity-related feature that registers devices in Azure Active Directory. It enables features like single sign-on and conditional access but is not the tool for enforcing OS-level configuration through Azure Policy.

The requirement is to manage a workgroup server (Server4) from a domain-joined server (Server1) using PowerShell remoting. This requires configuration on both machines.

Server1: Set-Item

Because Server4 is in a workgroup and not in the same trusted domain as Server1, Server1 must be configured to trust Server4. This is done by adding Server4 to the WinRM TrustedHosts list. The Set-Item cmdlet is used to modify this configuration, for example: Set-Item WSMan:\localhost\Client\TrustedHosts -Value 'Server4'.

Server4: Enable-PSRemoting

To accept incoming PowerShell remote connections, Server4 must have remoting enabled. The Enable-PSRemoting cmdlet is the standard method for this. It configures the computer to receive remote commands by starting the WinRM service, creating a network listener, and enabling the required firewall exceptions.

On-premises configuration:

✅ Windows Admin Center

Reasoning: The Azure Network Adapter is a specific feature within Windows Admin Center. It provides a simplified, wizard-driven experience to configure a point-to-site (P2S) VPN connection from an on-premises Windows Server directly to an Azure virtual network, automating many of the complex configuration steps.

Azure resource configuration:

✅ An Azure virtual network gateway

Reasoning: A point-to-site VPN connection requires an endpoint in Azure to terminate the secure tunnel. An Azure virtual network gateway is the specific Azure resource that provides this VPN termination service, enabling secure connectivity between the on-premises server and the Azure VNet.

Correct Sequence:

1. Obtain and install a new certificate. The first step is to acquire a new, valid SSL certificate from the certification authority. This certificate must be installed into the local computer’s certificate store on the server running Windows Admin Center to make it available.
2. Copy the certificate thumbprint. Once the new certificate is installed, its unique thumbprint (a SHA-1 hash) must be copied. This value is required by the Windows Admin Center setup wizard to identify the specific certificate to be used for the web service.
3. Run Windows Admin Center Setup and select Repair. To update the certificate for an existing installation, you must re-run the installer (.msi) and select the ‘Repair’ option. This initiates a reconfiguration wizard that allows you to provide the thumbprint of the new certificate, binding it to the Windows Admin Center service.

Incorrect Options:

• Run Windows Admin Center Setup and select Change: While logical, the documented method for reconfiguring the SSL certificate is to use the ‘Repair’ option, not ‘Change’.
• From Internet Information Services (IIS) Manager, bind a certificate: This is incorrect because Windows Admin Center, when installed on Windows Server, does not use IIS. It hosts its own web service.

In the subscription, create: A Log Analytics workspace

To use Azure Monitor to collect data from on-premises servers, a Log Analytics workspace is the required primary resource. It serves as the central repository in Azure for storing, aggregating, and analyzing log and performance data from various sources, including on-premises machines.

On Server1, install: The Azure Monitor agent

The Azure Monitor agent (AMA) is the modern, recommended software to install on Windows and Linux machines to collect telemetry. It sends data to the configured Log Analytics workspace and uses Data Collection Rules (DCRs) to define which specific data (like events and performance counters) should be gathered from the server.

✅ Option B (Correct)
Reasoning: To connect a server to Azure Arc, the user performing the action requires two sets of permissions: local administrator rights on the server and permissions in Azure. The scenario states that Admin1 is already a local administrator. The missing piece is the necessary Azure permission to create the Azure Arc resource in the target resource group (RG1). The built-in "Azure Connected Machine Onboarding" role is designed for this specific purpose, granting the minimum required permissions (Microsoft.HybridCompute/machines/write) to register a machine. Assigning this role to Admin1 at the RG1 scope is the correct first step to enable them to perform the onboarding.

❌ Why the other choices are incorrect:

• Option A is incorrect: Generating the onboarding script is a necessary step in the process, but Admin1 cannot successfully use it to register the servers until they have the required Azure permissions. The permission assignment must happen first.
• Option C is incorrect: Hybrid Azure AD joining a device registers it with Azure Active Directory for identity and management scenarios like Conditional Access. It is a separate process and is not a prerequisite for onboarding a server to Azure Arc.
• Option D is incorrect: The scenario states that the on-premises AD DS domain is synced with Azure AD. This means an identity for Admin1 already exists in Azure AD. Creating a new cloud-only account is unnecessary and would not be the correct identity to use.

✅ For -Identity: (Get-ADComputer server2.fabrikam.com)

Resource-based constrained delegation (RBCD) is configured on the computer account of the target resource. In this scenario, Server2 is the resource that users need to access via Windows Admin Center. Therefore, the Set-ADComputer cmdlet must modify the identity of Server2 in the fabrikam.com domain.

✅ For -PrincipalsAllowedToDelegateToAccount: (Get-ADComputer server1.contoso.com)

This parameter specifies which security principal is allowed to present delegated credentials to the target resource. The Windows Admin Center gateway on Server1 is the service that needs to delegate user credentials to manage Server2. Thus, the computer account for Server1 is the principal that must be granted this right.

✅ Register-PSSessionConfiguration

Reasoning: The `Register-PSSessionConfiguration` cmdlet is used to create and register a new session configuration endpoint on the local computer. Since the session configuration file has already been created, this is the correct cmdlet to make the Just Enough Administration (JEA) endpoint available for remote connections.

✅ .pssc

Reasoning: PowerShell Session Configuration files use the `.pssc` file extension. This file contains the settings that define the JEA endpoint, such as the roles users can assume and the commands they can run. The `-Path` parameter of the `Register-PSSessionConfiguration` cmdlet requires the path to one of these files.

✅ Option C (Correct)
Reasoning: The Azure Policy Guest Configuration feature requires a mechanism for the agent within the virtual machine to securely authenticate to Azure services. It uses a managed identity for this purpose. The documentation explicitly states that a system-assigned managed identity is required for the Guest Configuration agent to retrieve policy definitions and report compliance status. While assigning a Guest Configuration policy can automatically create this identity, enabling it beforehand is a direct prerequisite to ensure the feature can be used.

❌ Why the other choices are incorrect:

• Option A is incorrect: While Guest Configuration uses PowerShell Desired State Configuration (DSC) technology internally, it utilizes its own specific agent (the Guest Configuration extension), not the general-purpose PowerShell DSC extension (Microsoft.Powershell.DSC).
• Option B is incorrect: The requirement for Azure Policy Guest Configuration is specifically for a system-assigned managed identity. User-assigned managed identities are not supported for this feature.
• Option D is incorrect: The Custom Script Extension is used to run arbitrary scripts on a VM, typically for one-time configuration or software installation. It is not related to the continuous in-guest policy auditing and configuration provided by the Guest Configuration feature.

Rationale

To onboard on-premises servers to Azure Arc at scale using a script, a non-interactive identity is required. This is achieved by creating a service principal in Azure Active Directory. The script then uses this service principal to authenticate against Azure and register the servers.

✅ New-AzADServicePrincipal

Reasoning: The New-AzADServicePrincipal PowerShell cmdlet is used to create a service principal. This is the appropriate type of identity for an automated script that needs to authenticate to Azure Resource Manager to perform actions, such as registering an Arc-enabled server.

✅ ‘Azure Connected Machine Onboarding’

Reasoning: To adhere to the principle of least privilege, the service principal should be assigned the most restrictive role that still allows it to perform the required task. The ‘Azure Connected Machine Onboarding’ role is a built-in role specifically designed for this purpose, granting only the permissions necessary to onboard machines to Azure Arc and nothing more.

✅ Option B (Correct)

Reasoning: The Windows Admin Center (WAC) extension in the Azure portal requires network connectivity between the browser on the management computer (the on-premises Windows 11 PC) and the target Azure virtual machine (VM1). Since VM1 only has a private IP address, it is not reachable over the public internet. A VPN connection (either Site-to-Site or Point-to-Site) or an ExpressRoute circuit establishes a private, secure network path from the on-premises network to the Azure virtual network. This allows the on-premises computer to resolve and communicate with VM1’s private IP address, enabling the browser to connect to the WAC instance.

❌ Why the other choices are incorrect:

• Option A is incorrect: Azure Bastion is a service that provides secure RDP and SSH access to VMs directly through the Azure portal without exposing public IP addresses. It does not provide the general network connectivity required for your on-premises browser to connect to the WAC endpoint on the VM.
• Option C is incorrect: A private endpoint is used to securely connect to Azure PaaS services (like Azure SQL or Storage) from a virtual network by giving the service a private IP address within that VNet. It is not used to establish connectivity from an on-premises location to a VM.
• Option D is incorrect: A network security group (NSG) rule acts as a firewall to allow or deny traffic. While a rule allowing inbound traffic on TCP port 443 (or the WAC port) would be necessary, it does not create the network path. Connectivity must be established first (via VPN or ExpressRoute) before an NSG rule can permit traffic over that path.

✅ Option A (Correct)
Reasoning: When Windows Admin Center is installed as a gateway on a Windows Server, it uses HTTPS for its web interface. The default TCP port for HTTPS is 443. The scenario states the installation used default settings. Therefore, to allow administrators from the main office to connect to the Windows Admin Center gateway’s web interface in the branch office, the branch office firewall must permit inbound traffic on TCP port 443 to the gateway server.

❌ Why the other choices are incorrect:

• Option B is incorrect: TCP port 3389 is used for the Remote Desktop Protocol (RDP), not for accessing the Windows Admin Center web interface.
• Option C is incorrect: TCP port 5985 is the default port for Windows Remote Management (WinRM) over HTTP. While Windows Admin Center uses WinRM to communicate with managed servers, the administrator’s initial connection to the gateway’s web portal is over HTTPS (port 443), not WinRM.
• Option D is incorrect: TCP port 6516 is the default port used when Windows Admin Center is installed on a Windows client operating system (like Windows 10 or 11) in desktop mode. The question specifies the gateway is installed on a Windows Server.

✅ Option A (Correct) Reasoning: The Update Management solution, which is part of an Azure Automation account, is used to assess and deploy updates to both Azure VMs and non-Azure machines like Azure Arc-enabled servers. A primary step is to enable this solution from within the Automation account and explicitly add the target server, Server1, for management.

✅ Option C (Correct) Reasoning: Azure update solutions require an agent on the server to communicate with Azure. While the legacy Automation-based solution uses the Log Analytics Agent (MMA), the modern Azure Update Manager uses the Azure Monitor Agent (AMA). Installing a monitoring agent is a fundamental prerequisite for the server to report its update status to Azure.

❌ Why the other choices are incorrect:

• Option B is incorrect: The ‘Virtual machines’ data source in a Log Analytics workspace is used to connect Azure VMs. Server1 is an on-premises server connected via Azure Arc, and its connection to Log Analytics is managed through the Azure Connected Machine agent and its extensions, not this interface.
• Option D is incorrect: Microsoft Sentinel is a Security Information and Event Management (SIEM) solution. It uses Log Analytics for data analysis and storage but is not related to managing or deploying operating system updates.

In Azure AD: The Azure AD Application Proxy service

Reasoning: The Azure AD Application Proxy is the cloud service responsible for publishing the on-premises application. It handles pre-authentication, where users authenticate with their Azure AD credentials. After successful authentication, the service securely relays the access request to the on-premises connector, enabling single sign-on (SSO).

On-premises: The Azure AD Application Proxy connector

Reasoning: The Application Proxy connector is a lightweight agent installed on an on-premises server. It establishes the connection between the Azure AD service and the internal web app. For Kerberos-based applications, the connector is configured for Kerberos Constrained Delegation (KCD) to impersonate the user and obtain a Kerberos ticket to grant access to the backend application.

The technical requirement is to enable the ability to run virtual machines inside of VM1. This configuration is known as nested virtualization. To enable nested virtualization for a Hyper-V virtual machine, you must expose the hardware-assisted virtualization extensions of the physical host’s CPU to the guest virtual machine.

Set-VMProcessor: This is the correct PowerShell cmdlet used to configure the properties of the virtual processor for a specific virtual machine.

-ExposeVirtualizationExtensions: This parameter of the Set-VMProcessor cmdlet is used to enable or disable nested virtualization. Setting this parameter to $true exposes the virtualization extensions (Intel VT-x or AMD-V) to the virtual machine, allowing it to run a hypervisor.

✅ Option D (Correct)
Reasoning: The scenario describes the default behavior of a basic Hyper-V console session, where disconnecting leaves the session active for the next user to connect. The requirement is to force a credential prompt. Enabling Enhanced Session Mode on the Hyper-V host (Server2) allows the Virtual Machine Connection tool (vmconnect.exe) to use Remote Desktop Protocol (RDP) over the VMBus. This RDP-based connection requires authentication each time a user connects, directly addressing the requirement to force users to provide credentials and preventing one administrator from resuming another’s session without logging in.

❌ Why the other choices are incorrect:

• Option A is incorrect: Shielded virtual machines are a security feature to protect VM data from a compromised Hyper-V host. They do not change the authentication behavior of the Virtual Machine Connection tool.
• Option B is incorrect: The Guest services integration service enables features like file copying between the host and guest. It does not affect the session authentication mechanism.
• Option C is incorrect: Credential Guard is a security feature within the guest operating system that uses virtualization-based security to protect credentials from malware. It does not alter how a user authenticates when connecting to the VM from the Hyper-V host.

Correct Answers

✅ Option A (Correct)

Reasoning: Enhanced Session Mode must be enabled in the Hyper-V settings on the host server (Host1). This feature allows the Virtual Machine Connection tool to use Remote Desktop Protocol (RDP) technology to connect to the guest VM. RDP is what enables the redirection of local resources, such as USB drives, from the client computer (Server1) to the VM session.

✅ Option B (Correct)

Reasoning: After ensuring Enhanced Session Mode is enabled on the host, you must configure the Virtual Machine Connection client on the management server (Server1). Before connecting, selecting “Show Options” reveals settings for redirecting local resources. Here, you can select the specific local drives (including the connected USB hard drive) that you want to be accessible from within the VM session.

Incorrect Answers

❌ Why the other choices are incorrect:

• Option C is incorrect: Switching to a basic session does the opposite of what is required. Basic session mode provides only console-level access and does not support the redirection of local devices.
• Option D is incorrect: Rescanning disks on the Hyper-V host (Host1) would be used to detect storage newly attached directly to the host. The USB drive is connected to the management server (Server1), so this action has no effect on making it available to the VM.
• Option E is incorrect: Attaching a virtual hard disk is a method for adding persistent storage to a VM, not for accessing a physical USB drive connected to a remote management computer.

✅ Option D (Correct)
Reasoning:

Windows Server containers support two isolation modes: process and Hyper-V. The --isolation parameter for the docker run command is used to specify which mode to use. To run a container inside a dedicated, lightweight Hyper-V virtual machine for enhanced security and kernel isolation, you must specify --isolation=hyperv. This directly fulfills the question’s requirement.

❌ Why the other choices are incorrect:

• Option A is incorrect: The --expose parameter is used to expose a port for linking with other containers on the same network; it does not affect the isolation level.
• Option B is incorrect: The --privileged parameter grants extended privileges to a container and is not used to select the Hyper-V isolation mode.
• Option C is incorrect: The --runtime parameter can select a specific container runtime but is not the primary way to set the isolation mode in Windows.
• Option E is incorrect: The --entrypoint parameter overrides the default command executed when the container starts. It defines what the container does, not how it is isolated from the host.

✅ Option B (Nano Server)
Reasoning: Nano Server is the most lightweight and smallest Windows container base image. It is specifically optimized for running modern, containerized applications, particularly those built with .NET Core. Choosing Nano Server directly addresses the requirement to create an image that is "as small as possible," as it has a significantly smaller footprint (hundreds of megabytes) compared to other Windows base images.

❌ Why the other choices are incorrect:

• Option A (Windows Server) and D (Server Core): The Windows Server image is essentially the Server Core image. The Server Core image is a much larger base image (multiple gigabytes) designed for compatibility with traditional Windows Server applications. It includes many more components than are necessary for a .NET Core application, making it an inefficient choice when minimizing size is the primary goal.
• Option C (Windows): This is the largest base image, providing the full Windows API set for maximum application compatibility. It is intended for applications with extensive dependencies that cannot run on Server Core or Nano Server. It is the least appropriate choice for creating the smallest possible image.

✅ Option A (Correct) Reasoning: When an Azure virtual machine (VM) is resized, the operating system (OS) disk (typically C:) and any explicitly attached data disks (such as the one assigned drive letter E:) are preserved along with their contents. Folder1 on volume C: will persist, and the new data disk E: with App1 installed on it will also remain intact. The temporary storage disk (often D: on Windows Server VMs) is ephemeral, meaning its contents are lost during a resize operation or VM deallocation, making Folder2 on volume D: non-persistent. Therefore, only Folder1, volume E, and App1 will be present.
❌ Why the other choices are incorrect:

Option B is incorrect: This option overlooks that the explicitly added data disk (volume E:) and the application installed on it (App1) are also persistent and will remain after a resize operation.

Option C is incorrect: This option incorrectly assumes that Folder2 on volume D: will persist. The D: drive on Windows Azure VMs is typically the temporary storage drive, and its contents are lost when the VM is resized or deallocated.

Option D is incorrect: This option incorrectly includes Folder2. As explained, Folder2 is on the temporary storage disk (D:) which is volatile and will not be present after the VM resize.

✅ Option C (Correct) Reasoning: Changing the virtual machine size in Azure, particularly when moving to a different series or resource allocation, typically requires the VM to be deallocated (stopped) and then started again. This process results in downtime for VM1 as the underlying host resources are re-provisioned or migrated.

❌ Why the other choices are incorrect:

Option A is incorrect: Detaching a data disk and adding a new standard SSD can generally be performed on a running Azure virtual machine without requiring downtime. Modern Azure VMs support hot-attach and hot-detach of data disks, assuming no applications are actively using the disk at the time of detachment.

Option B is incorrect: Detaching a data disk from a running Azure VM does not typically require downtime, provided the disk is not actively in use by the operating system or an application.

Option D is incorrect: Adding a new standard SSD (attaching a data disk) to a running Azure VM can be done without downtime. Azure’s capabilities allow for the dynamic addition of storage.

✅ Register-PSSessionConfiguration

Reasoning: This cmdlet registers a session configuration, making a Just Enough Administration (JEA) endpoint active on a server. Since the question states the configuration files are already created, registering the endpoint is the correct final step to make it available for remote connections by the helpdesk users.

✅ .pssc

Reasoning: The Register-PSSessionConfiguration cmdlet’s -Path parameter requires the file path to a PowerShell Session Configuration file. These files use the .pssc extension and define the settings for the JEA endpoint, including mapping users to specific role capabilities.