Administering Windows Server v1.0

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.

You need to identify which server is the PDC emulator for the domain.

Solution: From Active Directory Domains and Trusts, you right-click Active Directory Domains and Trusts in the console tree, and then select Operations Master.

Does this meet the goal?

HOTSPOT
-


Case Study
-


Company Information
-

Litware, Inc. is a retail company that has a main office in San Francisco and branch offices across North America.

Litware manages an on-premises Windows Server environment arid integrates selected servers with Azure services.

Litware has an Azure subscription linked to a Microsoft Entra hybrid tenant.



Existing Environment
-

Active Directory Infrastructure

The network contains only two on-premises Active Directory Domain Services (AD DS) forests named litware.com and nwtraders.com as shown in the following exhibit.



Active Directory member servers

The forests contain member servers and 1,000 Windows devices.

The domains contain the servers shown in the following table.



BitLocker Drive Encryption (BitLocker) is enabled for all the servers. BitLocker recovery information is stored in AD DS.

The servers have the connection security rules shown in the following table.



Active Directory domain controllers

The domains contain the domain controllers shown in the following table.




Active Directory identities
-

The litware.com forest contains the users shown in the following table.



User2 has attached a removable disk named Disk1 to Host1 and has enabled BitLocker.

The forests contain the groups shown in the following table.




Virtualization configuration
-

HV1 has the virtual switches shown in the following table.



HV1 has five physical network adapters. Two adapters are bound to VSwitch4.

HV1 contains virtual machines that run Windows Server and have the DHCP Server role installed. The virtual machines are configured as shown in the following table.




DNS configuration
-

The litware.com domain hosts the Active Directory-integrated DNS zones shown in the following table.




Azure subscription
-

The Azure subscription contains two resource groups named RG1 and RG2.

The Microsoft Entra tenant contains the identities shown in the following table.



All the identities have the Azure Connected Machine Onboarding role at scope RG2.



Requirements
-


Planned changes
-

Litware plans to implement the following changes:

• Deploy a virtual machine named VM5 that runs Windows Server, is connected to VSwitch3, and obtains an IPv4 address automatically.
• Create a DNS resource record named Record1 in zone1.litware.com and a DNS resource record named Record2 in zone2.litware.com.
• On Host1, add User2 to the local OpenSSH Users group and User3 to the local Administrators group.
• Deploy a domain controller named DC9 to the litware.com domain.
• Create a user named User5 in the litware.com domain.
• Onboard Host2 to Azure Arc as a resource in RG2.
• Move Disk1 from Host1 to Host2.


Technical requirements
-

Litware identifies the following technical requirements:

• The Azure Arc onboarding of Host2 must use automatic machine authentication for Azure sign-ins.
• The deployment of DC9 must minimize initial AD DS replication traffic across the network.
• HV1 must have the maximum possible number of external virtual switches.
• All solutions must follow the principle of least privilege.
• All solutions must minimize administrative effort.
• All solutions must minimize costs.


You need to evaluate possible direct group memberships for User1.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

HOTSPOT
-


Case Study
-


Company Information
-

Litware, Inc. is a retail company that has a main office in San Francisco and branch offices across North America.

Litware manages an on-premises Windows Server environment arid integrates selected servers with Azure services.

Litware has an Azure subscription linked to a Microsoft Entra hybrid tenant.



Existing Environment
-

Active Directory Infrastructure

The network contains only two on-premises Active Directory Domain Services (AD DS) forests named litware.com and nwtraders.com as shown in the following exhibit.



Active Directory member servers

The forests contain member servers and 1,000 Windows devices.

The domains contain the servers shown in the following table.



BitLocker Drive Encryption (BitLocker) is enabled for all the servers. BitLocker recovery information is stored in AD DS.

The servers have the connection security rules shown in the following table.



Active Directory domain controllers

The domains contain the domain controllers shown in the following table.




Active Directory identities
-

The litware.com forest contains the users shown in the following table.



User2 has attached a removable disk named Disk1 to Host1 and has enabled BitLocker.

The forests contain the groups shown in the following table.




Virtualization configuration
-

HV1 has the virtual switches shown in the following table.



HV1 has five physical network adapters. Two adapters are bound to VSwitch4.

HV1 contains virtual machines that run Windows Server and have the DHCP Server role installed. The virtual machines are configured as shown in the following table.




DNS configuration
-

The litware.com domain hosts the Active Directory-integrated DNS zones shown in the following table.




Azure subscription
-

The Azure subscription contains two resource groups named RG1 and RG2.

The Microsoft Entra tenant contains the identities shown in the following table.



All the identities have the Azure Connected Machine Onboarding role at scope RG2.



Requirements
-


Planned changes
-

Litware plans to implement the following changes:

• Deploy a virtual machine named VM5 that runs Windows Server, is connected to VSwitch3, and obtains an IPv4 address automatically.
• Create a DNS resource record named Record1 in zone1.litware.com and a DNS resource record named Record2 in zone2.litware.com.
• On Host1, add User2 to the local OpenSSH Users group and User3 to the local Administrators group.
• Deploy a domain controller named DC9 to the litware.com domain.
• Create a user named User5 in the litware.com domain.
• Onboard Host2 to Azure Arc as a resource in RG2.
• Move Disk1 from Host1 to Host2.


Technical requirements
-

Litware identifies the following technical requirements:

• The Azure Arc onboarding of Host2 must use automatic machine authentication for Azure sign-ins.
• The deployment of DC9 must minimize initial AD DS replication traffic across the network.
• HV1 must have the maximum possible number of external virtual switches.
• All solutions must follow the principle of least privilege.
• All solutions must minimize administrative effort.
• All solutions must minimize costs.


You are evaluating operations master role placement in the litware.com forest.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains privileged users that are members of a global security group named Group1 and are in multiple organizational units (OUs).

The Default Domain Policy configures the password and account lockout policies for standard users.

You need to ensure that only the members of Group1 have different password and account lockout policies.

What should you do?

HOTSPOT
-

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains two domain controllers named DC1 and DC2.

You plan to perform the following actions:

• Add two domain controllers named DC3 and DC4 to contoso.com.
• Configure DC3 as a domain controller and DC4 as a read-only domain controller (RODC).
• Add a new child domain named east.contoso.com that will be hosted on a domain controller named DC5.

You need to use the install from media (IFM) option, whenever possible.

What can you use to prepare the IFM data, and which domain controllers can be promoted by using the IFM option? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

DRAG DROP
-

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a user named User1.

You need to use PowerShell to create a new global security group named Group1 that contains User1.

How should you complete the script? To answer, drag the appropriate cmdlets to the correct targets. Each cmdlet may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

DRAG DROP
-

You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.

You deploy a server to the domain and configure the server to run a service.

You need to ensure that the service can use a group managed service account (gMSA) to authenticate.

Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the domain controllers shown in the following table.



You have a partner organization that has an AD DS forest named fabrikam.com.

You create a trust relationship between contoso.com and fabrikam.com.

You need to configure selective authentication for the trust relationship.

Which domain controller should be granted permissions to fabrikam.com?

HOTSPOT
-

Your network contains the domains shown in the following exhibit.



You need to establish trust relationships as shown in the following exhibit.



Which type of trust can you use for Trust1 and Trust2? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Your network contains an Active Directory Domain Services (AD DS) domain.

You plan to use Active Directory Administrative Center to create a new user named User1.

Which two attributes are required to create User1? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

HOTSPOT
-

Your network contains an Active Directory Domain Services (AD DS) domain.

The domain contains a file server named FS1 that hosts a file share named Finance. The domain contains an organizational unit (OU) named OU1 and a global security group named Group1.

A Group Policy Object (GPO) named GPO1 is linked to OU1.

You need to configure a Group Policy preferences item that maps drive F to \\FS1\Finance for the members of Group1. The item will use Security Group item-level targeting and remove the preferences setting when the setting no longer applies.

The solution must recreate the preferences setting during Group Policy refresh if a user deletes or changes the setting.

What should you configure? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Your network contains an Active Directory Domain Services (AD DS) domain.

The domain contains a client computer named Client1 in an organizational unit (OU) named OU1. Multiple Group Policy Objects (GPOs) are linked at the domain and OU levels.

You need to identify the Group Policy setting that is currently applied to Client1 and the GPO that applied it.

What should you use in Group Policy Management Console (GPMC)?

HOTSPOT -

Your network contains an Active Directory Domain Services (AD DS) domain.

The domain contains three servers named ServerA, ServerB, and ServerC.

From ServerA, you run remote PowerShell commands on ServerB by using Kerberos authentication.

You discover that the commands cannot access a share named Share1 on ServerC.

You need to ensure that the commands running on ServerB can access Share1 by using delegated user credentials.

How should you complete the script? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

DRAG DROP
-


Case Study
-


Overview
-


Company Information
-

A.Datum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.


Fabrikam Partnership
-

A.Datum recently partnered with a company named Fabrikam, Inc.

Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.

Both companies intend to collaborate on several joint projects.



Existing Environment
-


A.Datum AD DS Environment
-

The on-premises network of A. Datum contains an Active Directory Domain Services (AD DS) forest named adatum.com.

The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.




Fabrikam AD DS Environment
-

The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.

The forest contains two domains named fabrikam.com and south.fabrikam.com.

The fabrikam.com domain contains an organizational unit (OU) named Marketing.



Server Infrastructure
-

The adatum.com domain contains the servers shown in the following table.




HyperV1 contains the virtual machines shown in the following table.




All the virtual machines on HyperV1 have only the default management tools installed.

SSPace1 contains the Storage Spaces Virtual disks shown in the following table.





Azure Resources
-

A.Datum has an Azure subscription that contains a Microsoft Entra tenant. Microsoft Entra Connect sync is configured to sync the adatum.com forest with the Microsoft Entra tenant.

The subscription contains the virtual networks shown in the following table.




The subscription contains the Azure Private DNS zones shown in the following table.




The subscription contains the virtual machines shown in the following table.





All the servers are in a workgroup.

The subscription contains a storage account named storage1 that has a file share named share1.



Requirements
-


Planned Changes
-

A.Datum plans to implement the following changes:

• Sync Data1 to share 1.
• Configure an Azure runbook named Task1.
• Enable Microsoft Entra users to sign in to Server1.
• Create an Azure DNS Private Resolver that has the following configurations:
o Name: Private1
o Region: West US
o Virtual network: VNet1
o Inbound endpoint: SubnetB

• Enable users in the adatum.com domain to access the resources in the south.fabrikam.com domain.


Technical Requirements
-

A.Datum identifies the following technical requirements:

• The data on SSPace1 must be always available.
• DC2 must become the schema master if DC1 fails.
• VM3 must be configured to enable per-folder quotas.
• Trusts must allow access to only the required resources.
• The users in the Marketing OU must have access to storage1.
• Azure Automanage must be used on all supported Azure virtual machines.
• A direct SSH session must be used to manage all the supported virtual machines on HyperV1.


DC1 fails.

You need to meet the technical requirements for the schema master.

You run ntdsutil.exe.

Which five commands should you run in sequence? To answer, move the appropriate commands from the list of commands to the answer area and arrange them in the correct order.