Preview real exam questions, verified answers and available explanations before choosing a study plan.
Case study
Case Study 2
Overview
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.
Existing Environment
On-premises Servers
The on-premises network contains servers that run Windows Server as shown in the following table.
DC1 hosts all the operation master roles.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.
On-premises Network
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.
Identity Infrastructure
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with a Microsoft Entra tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.
Requirements
Planned Changes
Fabrikam identifies the following planned changes:
1. Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1. 2. Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be connected to Vnet1 by using ExpressRoute. 3. Create three Azure file shares named newyorkhiles, seattlefiles, and companyfiles. 4. Create a domain controller named dc3.corp.fabrikam.com in Vnet1. 5. Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined. 6. License all servers for Microsoft Defender for servers. 7. Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.
Networking Requirements
Fabrikam identifies the following networking requirements:
1. Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over ExpressRoute. 2. If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease. 3. Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.
Security Requirements
Fabrikam identifies the following security requirements:
1. Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer. 2. Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours. 3. Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|. 4. Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days. 5. Prevent domain controllers from directly contacting hosts on the internet.
File Sharing Requirements
You need to configure the synchronization of Azure files to meet the following requirements:
1. Ensure that seattlefiles syncs to FS2. 2. Ensure that newyorkfiles syncs to FS1. 3. Ensure that companyfiles syncs to both FS1 and FS2.
Question 1
Testlet 2Hotspot
HOTSPOT
You need to configure Azure File Sync to meet the file sharing requirements.
What should you do? To answer, select the appropriate options in the answer area.
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
Question 2
Testlet 3Hotspot
HOTSPOT
You have an Active Directory Domain Services (AD DS) domain that contains a group named Group1.
You need to create a group managed service account (gMSA) named Account1. The solution must ensure that Group1 can use Account1.
How should you complete the script? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Question 3
Testlet 3Hotspot
HOTSPOT
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com.
You have a partner company named ADatum Corporation that has an AD DS forest named adatum.com.
You configure the trust relationship shown in the following exhibit.
The forests contain the groups shown in the following table.
The ADatum domains contain the member servers shown in the following table.
For each of the following statements, select Yes if the statement is true Otherwise, select No.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: No
No - Group2 can be assigned permissions for the resources on Server2. Group2 is a Domain local group in the adatum.com domain. Server2 is in the west.adatum.com. A domain local group in one domain cannot be directly assigned resources in a server located in a subdomain. Domain local groups are primarily used to grant permissions to resources within the same domain where they are created. While they can contain members from other domains, their scope of permissions is limited to the domain they belong to. Note: Domain local groups are designed to manage access to resources within their own domain.
Box 2: Yes Yes - Group3 can be added as a member of Group1. Group3 is a Global group in the west.adatum.com. Group1 is a Domain local group in contoso.com. A global group from one domain can be added as a member to a domain local group in another domain, provided the domains trust each other. This is a common practice for managing permissions across domains
Box 3: Yes Yes - Group4 can be assigned permissions for the resources on Server1. Group4 is a Universal group in the contoso.com domain. Server1 is in the adatum.com domain. A Universal group in one domain can indeed be assigned permissions to resources in another domain, provided both domains are part of the same Active Directory forest. This is one of the key features of Universal groups, which allows for centralized management of permissions across multiple domains.
Your network contains an on-premises Active Directory Domain Services (AD DS) domain.
The domain contains a user named User1 and the servers shown in the following table.
User1 is a member of the Protected Users security group.
User1 performs the following actions:
1. From Server1, establishes a remote PowerShell session on Server2 2. From the PowerShell session on Server2, attempts to access a resource on Backup1
The request to access the resource on 8ackup1 is denied.
You need to ensure that User1 can access the resources on Backup1 by using the PowerShell session on Server2.
The solution must follow the principle of least privilege and minimize administrative effort.
What should you configure?
A
Kerberos delegation (unconstrained)
B
CredSSP
C
PSSessionConfigu ration by using RunAs
D
resource-based Kerberos constrained delegation
Reveal answer detailsClose answer details
Correct answerD
Case study
Case Study 4
Simulation
Simulation
Question 5
Testlet 4Lab simulation
Simulation
You need to configure SRV1 as a DNS server. SRV1 must be able resolve names from the contoso.com domain by using DC1.
All other names must be resolved by using the root hint servers.
To complete this task, sign in the required computer or computers.
Reveal model answerClose model answer
One possible solution to configure SRV1 as a DNS server that can resolve names from the contoso.com domain by using DC1 and all other names by using the root hint servers is to use conditional forwarding. Conditional forwarding allows a DNS server to forward queries for a specific domain name to another DNS server, while using the normal forwarding or root hint servers for other queries. Here are the steps to configure conditional forwarding on SRV1:
On SRV1, open DNS Manager from the Administrative Tools menu or by typing dnsmgmt.msc in the Run box.
In the left pane, right-click on Conditional Forwarders and select New Conditional Forwarder.
In the New Conditional Forwarder dialog box, enter contoso.com as the DNS Domain name.
In the IP addresses of the master servers box, enter the IP address of DC1, which is the DNS server for the contoso.com domain. You can also click on Resolve to verify the name resolution of DC1.
Optionally, you can check the box Store this conditional forwarder in Active Directory, and replicate it as follows if you want to store and replicate the conditional forwarder in AD DS. You can also select the replication scope from the drop-down list.
Click OK to create the conditional forwarder.
Now, SRV1 will forward any queries for the contoso.com domain to DC1, and use the root hint servers for any other queries. You can test the name resolution by using the nslookup command on SRV1 or another computer that uses SRV1 as its DNS server. For example, you can run the following commands:
The first command should return the IP address of www.contoso.com from DC1, and the second command should return the IP address of www.microsoft.com from a root hint server.
Case study
Case Study 3
Overview
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
Question 6
Testlet 3Hotspot
HOTSPOT
Your network contains two Active Directory forests and a domain trust as shown in the following exhibit.
The domain trust has the following configurations:
The forests contain the network shares shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Question 7
Testlet 3Single choice
Please finish the following requirement on Azure Active Directory Domain Services (Microsoft Entra DS) domain named contoso.com.
You need to provide a solution to administrator with the ability to manage Group Policy Objects (GPOs). The principle of least privilege must be fulfilled.
You need to you add the administrator to the group:
A
AAD DC Administrators
B
Enterprise Admins
C
Schema Admins
D
Domain Admins
Reveal answer detailsClose answer details
Correct answerB
Case study
Case Study 4
Simulation
Simulation
Question 8
Testlet 4Lab simulation
Simulation
You need to ensure that a DHCP scope named scope1 on SRV1 can service client requests.
To complete this task, sign in the required computer or computers.
Reveal model answerClose model answer
One possible solution to ensure that a DHCP scope named scope1 on SRV1 can service client requests is to activate the scope on the DHCP server. A scope must be activated before it can assign IP addresses to DHCP clients. To activate a DHCP scope on SRV1, perform the following steps:
On SRV1, openDNS Managerfrom theAdministrative Toolsmenu or by typingdnsmgmt.mscin the Run box.
In the left pane, expand your DHCP server and click onIPv4.
In the right pane, right-click on the scope that you want to activate, such asscope1, and selectActivate.
Wait for the scope to be activated. You can verify the activation status by checking the icon next to the scope name. A green arrow indicates that the scope is active, while a red arrow indicates that the scope is inactive.
Now, the DHCP scope named scope1 on SRV1 can service client requests and lease IP addresses to DHCP clients. You can test the DHCP service by using theipconfig /renewcommand on a DHCP client computer that is connected to the same subnet as the scope.
Case study
Case Study 3
Overview
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
Question 9
Testlet 3Single choice
You have a server named Server1 that runs Windows Server. The disks on Server1 are configured as shown in the following exhibit.
You need to convert volume E to ReFS. The solution must meet the following requirements:
1. The data on volume E needs to be retained. 2. Minimize administrative effort.
What should you do first?
A
Back up the data on volume E.
B
Take Disk 2 offline.
C
Convert Disk 2 to a dynamic disk.
D
Run convert.exe.
Reveal answer detailsClose answer details
Correct answerA
Question 10
Testlet 3Single choice
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The root domain contains the domain controllers shown in the following table.
A failure of which domain controller will prevent you from creating application partitions?
You create an Azure virtual machine named Server1 that runs Windows Server.
Server1 has the disk configurations shown in the following exhibit.
You need to create a new 100-GB volume on Server1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Reveal answer detailsClose answer details
Explanation
Step 1: Create and attach a new data disk Add a data disk. 1. Sign in to the Azure portal. 2. Search for and select Virtual machines. 3. Select a virtual machine from the list. 4. On the Virtual machine pane, select Disks. 5. On the Disks pane, select Create and attach a new disk. 6. In the drop-downs for the new disk, make the selections you want, and name the disk. 7. Select Save to create and attach the new data disk to the VM.
Step 2: Initialize the disk
Initialize a new data disk. 1. Connect to the VM. 2. Select the Windows Start menu inside the running VM and enter diskmgmt.msc in the search box. The Disk Management console opens. 3. Disk Management recognizes that you have a new, uninitialized disk and the Initialize Disk window appears. 4. Verify the new disk is selected and then select OK to initialize it. 5. The new disk appears as unallocated. Right-click anywhere on the disk and select New simple volume. The New Simple Volume Wizard window opens. 6. Etc.
You have a Windows Server 2022 container host named Host1 that has the Subsystem for Linux installed and the container images shown in the following table.
You need to deploy the images to Host1. The solution must maximize the isolation of the containers.
Which images can you run by using process isolation, and which images can you run by using Hyper-V isolation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Question 13
Testlet 3Hotspot
HOTSPOT
You have a Group Policy Object (GPO) named GPO1 that contains user settings only.
You plan to apply GPO1 to a global security group named Group1.
You link GPO1 to the domain, and you remove all the permissions granted to the Authenticated Users group.
You need to configure permissions for GPOI to meet the following requirements:
1. GPO1 must apply only to the users in Group1. 2. The solution must use the principle of least privilege.
Which permissions should you grant to Group1 and the Domain Computers group? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Question 14
Testlet 3Hotspot
HOTSPOT
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a child domain named east.contoso.com.
In the contoso.com domain, you create two users named Admin1 and Admin2.
You need to ensure that the users can perform the following tasks:
1. Admin1 can create and manage Active Directory sites. 2. Admin2 can deploy domain controllers to the east.contoso.com domain.
The solution must use the principle of least privilege.
To which group should you add each user? To answer, select the appropriate options in the answer area.
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1.
On Server 1, you install Windows Admin Center and use Windows Admin Center to remove BUILTlN \Users from the allowed groups.
You discover that all users can still sign in to Windows Admin Center.
You need to prevent unauthorized users from signing in to Windows Admin Center.
What should you do in Windows Admin Center?
A
Set Performance Profile to On
B
Set Require manage-as sessions to re-authenticate to On
C
From the Proxy settings, configure a bypass list.
D
Add a security group to the allowed groups.
Reveal answer detailsClose answer details
Correct answerD
Case study
Case Study 4
Simulation
Simulation
Question 16
Testlet 4Lab simulation
Simulation
You need to create an Active Directory Domain Services (AD DS) site named Site2 that is associated to an IP address range of 192.168.2.0 to 192.168.2.255.
To complete this task, sign in the required computer or computers.
Reveal model answerClose model answer
Phase 1: Creating a new site Step l: Navigate to Server Manager >Tools > Active Directory Sites and Services Step 2: In the Active Directory Sites and Service window, right-click Sites and select New Site
Step 4: Select the DEFAULTIPSITELINK and click OK Step 5: Click OK to complete the site creation Phase 2: Create subnet Step 6: In the Active Directory Sites and Services MIMC, right-click Subnets and select New Subnet...
Step 7:In the New Object - subnet window, type192.168.2.0/24 Step 8: In the Select a site object for this prefix option select Site2 and click OK
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
Question 17
Testlet 3Single choice
You have an on-premises server named Server1 that runs Windows Server.
You have an Azure subscription that contains a virtual network named VNet1.
You need to connect Server1 to VNet1 by using Azure Network Adapter.
What should you use?
A
the Azure portal
B
Microsoft Entra Connect
C
Device Manager
D
Windows Admin Center
Reveal answer detailsClose answer details
Correct answerD
Explanation
Connect standalone servers by using Azure Network Adapter. You can connect an on-premises standalone server to Microsoft Azure virtual networks by using the Azure Network Adapter that you deploy through the Windows Admin Center (WAC).
Use a Windows Server with Windows Admin Center installed to deploy the Azure Network Adapter.
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.
Existing Environment
On-premises Servers
The on-premises network contains servers that run Windows Server as shown in the following table.
DC1 hosts all the operation master roles.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.
On-premises Network
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.
Identity Infrastructure
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with a Microsoft Entra tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.
Requirements
Planned Changes
Fabrikam identifies the following planned changes:
1. Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1. 2. Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be connected to Vnet1 by using ExpressRoute. 3. Create three Azure file shares named newyorkhiles, seattlefiles, and companyfiles. 4. Create a domain controller named dc3.corp.fabrikam.com in Vnet1. 5. Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined. 6. License all servers for Microsoft Defender for servers. 7. Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.
Networking Requirements
Fabrikam identifies the following networking requirements:
1. Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over ExpressRoute. 2. If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease. 3. Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.
Security Requirements
Fabrikam identifies the following security requirements:
1. Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer. 2. Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours. 3. Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|. 4. Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days. 5. Prevent domain controllers from directly contacting hosts on the internet.
File Sharing Requirements
You need to configure the synchronization of Azure files to meet the following requirements:
1. Ensure that seattlefiles syncs to FS2. 2. Ensure that newyorkfiles syncs to FS1. 3. Ensure that companyfiles syncs to both FS1 and FS2.
Question 18
Testlet 2Single choice
What should you implement for the deployment of DC3?
A
Azure Active Directory Domain Services (Microsoft Entra DS).
B
Microsoft Entra Application Proxy.
C
An Azure virtual machine.
D
An Microsoft Entra administrative unit.
Reveal answer detailsClose answer details
Correct answerC
Explanation
Create a domain controller named dc3.corp.fabrikam.com in Vnet1. In a hybrid network, you can configure Azure virtual machines as domain controllers. The domain controllers in Azure communicate with the on-premises domain controllers in the same way that on-premises domain controllers communicate with each other.
Case study
Case Study 3
Overview
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
Question 19
Testlet 3Drag & drop
DRAG DROP
You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.
You deploy five servers to the domain. You add the servers to a group named ITFarmHosts.
You plan to configure a Network Load Balancing (NLB) cluster named NLBCluster.contoso.com that will contain the five servers.
You need to ensure that the NLB service on the nodes of the cluster can use a group managed service account (gMSA) to authenticate.
Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
The domain contains the users shown in the following table.
The domain has the Group Policy Objects (GPOs) shown in the following table.
The GPOs are configured as shown in the following table.
For each of the following statements, select Yes if the statement is true, Otherwise, select No.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Question 21
Testlet 3Single choice
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a user named User1. User1 is a member of a group named Group1 and is in an organizational unit (OU) named OU1.
The domain has minimum password lengths configured as shown in the following table.
What is the minimum password length that User1 should use when changing to a new password?
A
7
B
8
C
10
D
12
E
14
Reveal answer detailsClose answer details
Correct answerA
Question 22
Testlet 3Single choice
You have an on-premises server named Server1 that runs Windows Server. Server1 contains an app named App1 and a firewall named Firewall1.
You have an Azure subscription.
Internal users connect to App1 by using WebSockets.
You need to make App1 available to users on the internet. The solution must minimize the number of inbound ports open on Firewall1.
What should you include in the solution?
A
Microsoft Application Request Routing (ARR) Version 2
B
Azure Application Gateway
C
Azure Relay
D
Web Application Proxy
Reveal answer detailsClose answer details
Correct answerC
Case study
Case Study 1
Overview
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Existing Environment
AD DS Environment
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.
All the domain controllers are global catalog servers.
Server infrastructure
The network contains the servers shown in the following table.
A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.
Group Policies
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.
Existing Identities
The forest contains the users shown in the following table.
The forest contains the groups shown in the following table.
Current Problems
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without signing out, another administrator can connect to the console session as the currently signed in user.
Requirements
Technical Requirements
Contoso identifies the following technical requirements:
1. Change the replication schedule for all site links to 30 minutes. 2. Promote Server1 to a domain controller in canada.contoso.com. 3. Install and authorize Server3 as a DHCP server. 4. Ensure that User1 can manage the membership of all the groups in Contoso\OU3. 5. Ensure that you can manage Server4 from Server1 by using PowerShell remoting. 6. Ensure that you can run virtual machines on VM1. 7. Force users to provide credentials when they connect to VM2. 8. On VM3, ensure that Data Deduplication on all volumes is possible.
Question 23
Testlet 1Hotspot
HOTSPOT
For each of the following statements, select Yes if the statement is true. Otherwise. select No.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Case study
Case Study 3
Overview
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
Question 24
Testlet 3Single choice
You have an Active Directory Domain Services (AD DS) domain that contains the domain controllers shown in the following table.
The domain contains an app named App1 that uses a custom application partition to store configuration data.
You decommission App1.
When you attempt to remove the custom application partition, the process fails.
Which domain controller is unavailable?
A
DC1
B
DC2
C
DC3
D
DC4
Reveal answer detailsClose answer details
Correct answerC
Explanation
The Domain Naming Master is used to add and to remove domains and application partitions to and from the forest. - Must be online when domains and application partitions in a forest are added or removed.
You have an Azure subscription that contains the storage accounts shown in the following table.
In the East US Azure region, you create a storage sync service named Sync1.
You need to create a sync group in Sync1.
Which storage accounts can you use, and what can you specify as the cloud endpoints. To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: storage1 and storage3 only Storage1 and storage3 are in the same region as the storage sync service. They are both of acceptable types, StorageV2 and FileStorage respectively.
Incorrect: * storage2 Storage2 is BlobBlobStorage.
* storage4 Storage4 is in another region.
Note: There are two main types of storage accounts you will use for Azure Files deployments:
* General purpose version 2 (GPv2) storage accounts: GPv2 storage accounts allow you to deploy Azure file shares on standard/hard disk-based (HDD-based) hardware. In addition to storing Azure file shares, GPv2 storage accounts can store other storage resources such as blob containers, queues, or tables.
* FileStorage storage accounts: FileStorage storage accounts allow you to deploy Azure file shares on premium/solid-state disk-based (SSD-based) hardware.
Region The storage account for the Azure file share must be located in the same region as the Storage Sync Service.
Box 2: share1 and share3 only A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with each other. A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server endpoints.
A cloud endpoint is a pointer to an Azure file share. All server endpoints will sync with a cloud endpoint, making the cloud endpoint the hub. The storage account for the Azure file share must be located in the same region as the Storage Sync Service.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
The network contains the servers shown in the following table.
You plan to implement IP Address Management (IPAM).
You need to use the Group Policy based provisioning method for managed servers. The solution must support server discovery.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Question 27
Testlet 3Single choice
You have a server named Server1 that runs Windows Server 2019 and hosts a container named Container1.
Container1 uses a Windows Server 2019 base image that was built by using a Docker file.
You upgrade Server1 to Windows Server 2022.
You need to ensure that Container1 will run on Server1.
The solution must minimize administrative effort.
What should you do?
A
Start Container1 in Hyper-V isolation mode.
B
Modify the Docker file.
C
Start Container1 in process isolation mode.
D
Rebuild the base image for Container1.
Reveal answer detailsClose answer details
Correct answerA
Explanation
When you upgrade Server1 to Windows Server 2022, you are running a newer version of the operating system than the one that the container (which is based on a Windows Server 2019 image) was built for.
Containers running in process isolation mode must use a base image that matches the host OS version or be very close. Since the base image for Container1 is built on Windows Server 2019 and the host is now Windows Server 2022, process isolation would not work without rebuilding the image.
To minimize administrative effort, you can run the container in Hyper-V isolation mode, which provides compatibility by allowing containers to run with a different kernel version than the host. Hyper-V isolation creates a lightweight virtual machine for each container, allowing it to run in its own isolated environment.
Question 28
Testlet 3Hotspot
HOTSPOT
Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com. The domain contains a file server named Server1 and three users named User1, User2, and User3.
Server1 contains a shared folder named Share1 that has the following configurations:
The share permissions for Share1 are configured as shown in the Share Permissions exhibit.
Share1 contains a file named File1.bxt. The advanced security settings for File1.txt are configured as shown in the File Permissions exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box1: no-has change but not full controll cannot take ownership Box2: yes Box 3:yes
Case study
Case Study 2
Overview
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.
Existing Environment
On-premises Servers
The on-premises network contains servers that run Windows Server as shown in the following table.
DC1 hosts all the operation master roles.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.
On-premises Network
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.
Identity Infrastructure
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with a Microsoft Entra tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.
Requirements
Planned Changes
Fabrikam identifies the following planned changes:
1. Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1. 2. Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be connected to Vnet1 by using ExpressRoute. 3. Create three Azure file shares named newyorkhiles, seattlefiles, and companyfiles. 4. Create a domain controller named dc3.corp.fabrikam.com in Vnet1. 5. Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined. 6. License all servers for Microsoft Defender for servers. 7. Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.
Networking Requirements
Fabrikam identifies the following networking requirements:
1. Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over ExpressRoute. 2. If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease. 3. Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.
Security Requirements
Fabrikam identifies the following security requirements:
1. Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer. 2. Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours. 3. Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|. 4. Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days. 5. Prevent domain controllers from directly contacting hosts on the internet.
File Sharing Requirements
You need to configure the synchronization of Azure files to meet the following requirements:
1. Ensure that seattlefiles syncs to FS2. 2. Ensure that newyorkfiles syncs to FS1. 3. Ensure that companyfiles syncs to both FS1 and FS2.
Question 29
Testlet 2Multiple choice
You need to implement a name resolution solution that meets the networking requirements.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A
Create an Azure private DNS zone named corp.fabhkam.com.
B
Create a virtual network link in the coip.fabnkam.com Azure private DNS zone.
C
Create an Azure DNS zone named corp.fabrikam.com.
D
Configure the DNS Servers settings for Vnet1.
E
Enable autoregistration in the corp.fabnkam.com Azure private DNS zone.
F
On DC3, install the DNS Server role.
G
Configure a conditional forwarder on DC3.
Reveal answer detailsClose answer details
Correct answersD, F
Explanation
Virtual machines in an Azure virtual network receive their DNS configuration from the DNS settings configured on the virtual network. You need to configure the Azure virtual network to use DC3 as the DNS server. Then all virtual machines in the virtual network will use DC3 and their DNS server.
Case study
Case Study 3
Overview
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
Question 30
Testlet 3Single choice
You have a server named Server1 that hosts Windows containers.
You plan to deploy an application that will have multiple containers. Each container will be on the same subnet. Each container requires a separate MAC address and IP address. Each container must be able to communicate by using its IP address.
You need to create a Docker network that supports the deployment of the application.
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.
Existing Environment
On-premises Servers
The on-premises network contains servers that run Windows Server as shown in the following table.
DC1 hosts all the operation master roles.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.
On-premises Network
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.
Identity Infrastructure
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with a Microsoft Entra tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.
Requirements
Planned Changes
Fabrikam identifies the following planned changes:
1. Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1. 2. Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be connected to Vnet1 by using ExpressRoute. 3. Create three Azure file shares named newyorkhiles, seattlefiles, and companyfiles. 4. Create a domain controller named dc3.corp.fabrikam.com in Vnet1. 5. Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined. 6. License all servers for Microsoft Defender for servers. 7. Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.
Networking Requirements
Fabrikam identifies the following networking requirements:
1. Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over ExpressRoute. 2. If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease. 3. Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.
Security Requirements
Fabrikam identifies the following security requirements:
1. Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer. 2. Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours. 3. Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|. 4. Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days. 5. Prevent domain controllers from directly contacting hosts on the internet.
File Sharing Requirements
You need to configure the synchronization of Azure files to meet the following requirements:
1. Ensure that seattlefiles syncs to FS2. 2. Ensure that newyorkfiles syncs to FS1. 3. Ensure that companyfiles syncs to both FS1 and FS2.
Question 31
Testlet 2Single choice
You are planning the implementation Azure Arc to support the planned changes.
You need to configure the environment to support configuration management policies.
What should you do?
A
Hybrid Microsoft Entra join all the servers.
B
Create a hybrid runbook worker m Azure Automation.
C
Deploy the Azure Connected Machine agent to all the servers.
D
Deploy the Azure Monitor agent to all the servers.
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
Question 32
Testlet 3Drag & drop
DRAG DROP
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. VM1 contains a 128-GB operating system disk.
You need to increase the size of volume C on VM1 to 250 GB.
Which four actions should you perform in sequence?
To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Reveal answer detailsClose answer details
Explanation
How to expand virtual hard disks attached to a Windows virtual machine You may need to expand the OS disk if you're supporting a legacy application that installs components on the OS disk or if you're migrating a physical PC or VM from on-premises that has a larger OS disk.
Step 1: Stop VM1. Resize a managed disk by using PowerShell
1. Stop the VM before resizing the disk: Stop-AzVM -ResourceGroupName $rgName -Name $vmName
Step 2: Resize the operating system disk. 2. Obtain a reference to the managed OS disk. Set the size of the managed OS disk to the desired value and update the Disk:
Step 4: Resize Volume C. Expand the volume in the operating system When you've expanded the disk for the VM, you need to go into the OS and expand the volume to encompass the new space.
You have a server named Server1 that has Windows Admin Center installed. The certificate used by Windows Admin Center was obtained from a certification authority (CA).
The certificate expires.
You need to replace the certificate.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
You need to identify which server is the PDC emulator for the domain.
Solution: From Active Directory Sites and Services, you right-click Default-First-Site-Name in the console tree, and then select Properties.
Does this meet the goal?
A
Yes
B
No
Reveal answer detailsClose answer details
Correct answerB
Question 35
Testlet 3Hotspot
HOTSPOT
You have a Windows server named Server1.
You add two 4-TB hard drives named Disk1 and Disk2 to Server1.
You need to format the drives. The solution must meet the following requirements:
1. Disk1 must support disk level quotas. 2. Disk2 must support Data Deduplication.
Which type of file system should you use for each drive? To answer, select the appropriate options in the answer area.
NOTE; Each correct selection is worth one point.
Reveal answer detailsClose answer details
Question 36
Testlet 3Hotspot
HOTSPOT
You have a server named Server1 that runs Windows Server and contains three volumes named C, D, and E.
Files are stored on Server1 as shown in the following table.
For volume D, Data Deduplication is enabled and set to General purpose file server.
You perform the following actions:
1. Move File1 to volume D. 2. Copy File2 to volume D and name the copy File4. 3. Move File3 to volume E
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
You have a server named Server1 that runs Windows Server and has the Hyper V server role installed. Server1 hosts a virtual machine named VM1.
Server1 has an NVMe storage device. The device is currently assigned to VM1 by using Discrete Device Assignment.
You need to make the device available to Server1.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
"Boot diagnostics must be enabled for the VM" "The Azure account accessing Serial Console must have Virtual Machine Contributor role for both the VM and the boot diagnostics storage account"
Question 39
Testlet 3Single choice
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a server named Server1 that runs Windows Server 2022 and has the DHCP Server role. Server1 contains a single DHCP scope named Scope1.
You deploy five printers to the network.
You need to ensure that the printers are always assigned the same IP address.
Solution: You create a DHCP reservation for each printer.
Does this meet the requirement?
A
Yes
B
No
Reveal answer detailsClose answer details
Correct answerB
Question 40
Testlet 3Single choice
You need to ensure that VM3 meets the technical requirements.
What should you install first?
A
Enhanced Storage
B
the iSNS Server service
C
File Server Resource Manager (FSRM)
D
Windows Standards-Based Storage Management
Reveal answer detailsClose answer details
Correct answerC
Explanation
VM3 must be configured to enable per-folder quotas. VM3 is a Windows Server 2022 Standard server, joined to the adatum.com domain, and has the File and Storage Services role installed.
Configure Disk Quota using FSRM (Windows Server 2012 R2) File Server Resource Manager is a pack of tools for Windows Server® 2008 or above that allows administrators to control and manage the quantity and type of data files that is stored on their network or servers.
Disk Quota is a tool part of the FSRM Pack of tools. It helps to Manage the capacity of a storage device on the server or network. Example: Configure Disk Quota on DC1
Step 1 Go to Server Manager
Step 2 On the Server Manager Console. Select "Tools" on the right top corner and choose "File Server Resource Manager"
Step 3 On the File Server Resource Manager console, select "Quota Management -> Quotas", Then Right-Click on "Quotas". Select "Create Quota"
You have an Azure virtual machine named Server1 that runs a network management application. Server1 has the following network configurations:
1. Network interface: Nic1 2. IP address: 10.1.1.1/24 3. Connected to: Vnet1/Subnet1
You need to connect Server1 to an additional subnet named Vnet1/Subnet2.
What should you do?
A
Modify the IP configurations of Nic1.
B
Add an IP configuration to Nic1.
C
Add a network interface to Server1.
D
Create a private endpoint on Subnet2.
Reveal answer detailsClose answer details
Correct answerC
Explanation
First add another network interface to Server1, then connect it to Subnet2.
Virtual network and subnets.
A subnet is a range of IP addresses in the virtual network. You can divide a virtual network into multiple subnets for organization and security. Each NIC in a VM is connected to one subnet in one virtual network. NICs connected to subnets (same or different) within a virtual network can communicate with each other without any extra configuration.
Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site.
You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1.
You need to recommend a deployment plan that meets the following requirements:
1. Ensures that a user named User1 can perform the RODC installation on Server1 2. Ensures that you can control the AD DS replication schedule to the Server1 3. Ensures that Server1 is in a new site named RemoteSite1 4. Uses the principle of least privilege
Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Reveal answer detailsClose answer details
Explanation
Box 1. We need to create a site and subnet for the remote site. The new site will be added to the Default IP Site Link so we don't need to create a new site link. You configure the replication schedule on the site link.
Box 2. When we pre-create an RODC account, we can specify who is allowed to attach the server to the prestaged account. This means that the User1 does not need to be added to the Domain Admins group.
Box3. User1 can connect the RODC to the prestaged account by running the AD DS installation wizard.
You need to ensure that Automanage meets the technical requirements.
On which Azure virtual machines should you enable Automanage?
A
Server1 only
B
Server2 only
C
Server1 and Server2 only
D
Server2 and Server3 only
E
Server1 and Server4 only
Reveal answer detailsClose answer details
Correct answerD
Explanation
Azure Automanage must be used on all supported Azure virtual machines. Automanage does not support Trusted Launch VMs. This excludes Server1 and Server4.
Note: What are all of the prerequisites required to enable Azure Automanage? The following are prerequisites for enabling Azure Automanage:
Supported Windows Server versions and Linux distros VMs must be in a supported region
User must have correct permissions Non-scale set VMs only Automanage does not support Sandbox subscriptions at this time *-> Automanage does not support Trusted Launch VMs at this time
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.
Existing Environment
On-premises Servers
The on-premises network contains servers that run Windows Server as shown in the following table.
DC1 hosts all the operation master roles.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.
On-premises Network
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.
Identity Infrastructure
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with a Microsoft Entra tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.
Requirements
Planned Changes
Fabrikam identifies the following planned changes:
1. Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1. 2. Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be connected to Vnet1 by using ExpressRoute. 3. Create three Azure file shares named newyorkhiles, seattlefiles, and companyfiles. 4. Create a domain controller named dc3.corp.fabrikam.com in Vnet1. 5. Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined. 6. License all servers for Microsoft Defender for servers. 7. Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.
Networking Requirements
Fabrikam identifies the following networking requirements:
1. Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over ExpressRoute. 2. If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease. 3. Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.
Security Requirements
Fabrikam identifies the following security requirements:
1. Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer. 2. Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours. 3. Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|. 4. Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days. 5. Prevent domain controllers from directly contacting hosts on the internet.
File Sharing Requirements
You need to configure the synchronization of Azure files to meet the following requirements:
1. Ensure that seattlefiles syncs to FS2. 2. Ensure that newyorkfiles syncs to FS1. 3. Ensure that companyfiles syncs to both FS1 and FS2.
QUESTION 1
HOTSPOT
You need to configure Azure File Sync to meet the file sharing requirements.
What should you do? To answer, select the appropriate options in the answer area.
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
QUESTION 2
HOTSPOT
You have an Active Directory Domain Services (AD DS) domain that contains a group named Group1.
You need to create a group managed service account (gMSA) named Account1. The solution must ensure that Group1 can use Account1.
How should you complete the script? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
QUESTION 3
HOTSPOT
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com.
You have a partner company named ADatum Corporation that has an AD DS forest named adatum.com.
You configure the trust relationship shown in the following exhibit.
The forests contain the groups shown in the following table.
The ADatum domains contain the member servers shown in the following table.
For each of the following statements, select Yes if the statement is true Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: No
No - Group2 can be assigned permissions for the resources on Server2. Group2 is a Domain local group in the adatum.com domain. Server2 is in the west.adatum.com. A domain local group in one domain cannot be directly assigned resources in a server located in a subdomain. Domain local groups are primarily used to grant permissions to resources within the same domain where they are created. While they can contain members from other domains, their scope of permissions is limited to the domain they belong to. Note: Domain local groups are designed to manage access to resources within their own domain.
Box 2: Yes Yes - Group3 can be added as a member of Group1. Group3 is a Global group in the west.adatum.com. Group1 is a Domain local group in contoso.com. A global group from one domain can be added as a member to a domain local group in another domain, provided the domains trust each other. This is a common practice for managing permissions across domains
Box 3: Yes Yes - Group4 can be assigned permissions for the resources on Server1. Group4 is a Universal group in the contoso.com domain. Server1 is in the adatum.com domain. A Universal group in one domain can indeed be assigned permissions to resources in another domain, provided both domains are part of the same Active Directory forest. This is one of the key features of Universal groups, which allows for centralized management of permissions across multiple domains.
Your network contains an on-premises Active Directory Domain Services (AD DS) domain.
The domain contains a user named User1 and the servers shown in the following table.
User1 is a member of the Protected Users security group.
User1 performs the following actions:
1. From Server1, establishes a remote PowerShell session on Server2 2. From the PowerShell session on Server2, attempts to access a resource on Backup1
The request to access the resource on 8ackup1 is denied.
You need to ensure that User1 can access the resources on Backup1 by using the PowerShell session on Server2.
The solution must follow the principle of least privilege and minimize administrative effort.
What should you configure?
A.
Kerberos delegation (unconstrained)
B.
CredSSP
C.
PSSessionConfigu ration by using RunAs
D.
resource-based Kerberos constrained delegation
Correct Answer: D
Case Study 4
Case Study Questions
Simulation
Simulation
QUESTION 5
Simulation
You need to configure SRV1 as a DNS server. SRV1 must be able resolve names from the contoso.com domain by using DC1.
All other names must be resolved by using the root hint servers.
To complete this task, sign in the required computer or computers.
Correct Answer:
One possible solution to configure SRV1 as a DNS server that can resolve names from the contoso.com domain by using DC1 and all other names by using the root hint servers is to use conditional forwarding. Conditional forwarding allows a DNS server to forward queries for a specific domain name to another DNS server, while using the normal forwarding or root hint servers for other queries. Here are the steps to configure conditional forwarding on SRV1:
On SRV1, open DNS Manager from the Administrative Tools menu or by typing dnsmgmt.msc in the Run box.
In the left pane, right-click on Conditional Forwarders and select New Conditional Forwarder.
In the New Conditional Forwarder dialog box, enter contoso.com as the DNS Domain name.
In the IP addresses of the master servers box, enter the IP address of DC1, which is the DNS server for the contoso.com domain. You can also click on Resolve to verify the name resolution of DC1.
Optionally, you can check the box Store this conditional forwarder in Active Directory, and replicate it as follows if you want to store and replicate the conditional forwarder in AD DS. You can also select the replication scope from the drop-down list.
Click OK to create the conditional forwarder.
Now, SRV1 will forward any queries for the contoso.com domain to DC1, and use the root hint servers for any other queries. You can test the name resolution by using the nslookup command on SRV1 or another computer that uses SRV1 as its DNS server. For example, you can run the following commands:
The first command should return the IP address of www.contoso.com from DC1, and the second command should return the IP address of www.microsoft.com from a root hint server.
Case Study 3
Case Study Questions
Overview
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
QUESTION 6
HOTSPOT
Your network contains two Active Directory forests and a domain trust as shown in the following exhibit.
The domain trust has the following configurations:
The forests contain the network shares shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
Correct Answer:
QUESTION 7
Please finish the following requirement on Azure Active Directory Domain Services (Microsoft Entra DS) domain named contoso.com.
You need to provide a solution to administrator with the ability to manage Group Policy Objects (GPOs). The principle of least privilege must be fulfilled.
You need to you add the administrator to the group:
A.
AAD DC Administrators
B.
Enterprise Admins
C.
Schema Admins
D.
Domain Admins
Correct Answer: B
Case Study 4
Case Study Questions
Simulation
Simulation
QUESTION 8
Simulation
You need to ensure that a DHCP scope named scope1 on SRV1 can service client requests.
To complete this task, sign in the required computer or computers.
Correct Answer:
One possible solution to ensure that a DHCP scope named scope1 on SRV1 can service client requests is to activate the scope on the DHCP server. A scope must be activated before it can assign IP addresses to DHCP clients. To activate a DHCP scope on SRV1, perform the following steps:
On SRV1, openDNS Managerfrom theAdministrative Toolsmenu or by typingdnsmgmt.mscin the Run box.
In the left pane, expand your DHCP server and click onIPv4.
In the right pane, right-click on the scope that you want to activate, such asscope1, and selectActivate.
Wait for the scope to be activated. You can verify the activation status by checking the icon next to the scope name. A green arrow indicates that the scope is active, while a red arrow indicates that the scope is inactive.
Now, the DHCP scope named scope1 on SRV1 can service client requests and lease IP addresses to DHCP clients. You can test the DHCP service by using theipconfig /renewcommand on a DHCP client computer that is connected to the same subnet as the scope.
Case Study 3
Case Study Questions
Overview
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
QUESTION 9
You have a server named Server1 that runs Windows Server. The disks on Server1 are configured as shown in the following exhibit.
You need to convert volume E to ReFS. The solution must meet the following requirements:
1. The data on volume E needs to be retained. 2. Minimize administrative effort.
What should you do first?
A.
Back up the data on volume E.
B.
Take Disk 2 offline.
C.
Convert Disk 2 to a dynamic disk.
D.
Run convert.exe.
Correct Answer: A
QUESTION 10
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The root domain contains the domain controllers shown in the following table.
A failure of which domain controller will prevent you from creating application partitions?
You create an Azure virtual machine named Server1 that runs Windows Server.
Server1 has the disk configurations shown in the following exhibit.
You need to create a new 100-GB volume on Server1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation
Explanation/Reference:
Step 1: Create and attach a new data disk Add a data disk. 1. Sign in to the Azure portal. 2. Search for and select Virtual machines. 3. Select a virtual machine from the list. 4. On the Virtual machine pane, select Disks. 5. On the Disks pane, select Create and attach a new disk. 6. In the drop-downs for the new disk, make the selections you want, and name the disk. 7. Select Save to create and attach the new data disk to the VM.
Step 2: Initialize the disk
Initialize a new data disk. 1. Connect to the VM. 2. Select the Windows Start menu inside the running VM and enter diskmgmt.msc in the search box. The Disk Management console opens. 3. Disk Management recognizes that you have a new, uninitialized disk and the Initialize Disk window appears. 4. Verify the new disk is selected and then select OK to initialize it. 5. The new disk appears as unallocated. Right-click anywhere on the disk and select New simple volume. The New Simple Volume Wizard window opens. 6. Etc.
You have a Windows Server 2022 container host named Host1 that has the Subsystem for Linux installed and the container images shown in the following table.
You need to deploy the images to Host1. The solution must maximize the isolation of the containers.
Which images can you run by using process isolation, and which images can you run by using Hyper-V isolation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
QUESTION 13
HOTSPOT
You have a Group Policy Object (GPO) named GPO1 that contains user settings only.
You plan to apply GPO1 to a global security group named Group1.
You link GPO1 to the domain, and you remove all the permissions granted to the Authenticated Users group.
You need to configure permissions for GPOI to meet the following requirements:
1. GPO1 must apply only to the users in Group1. 2. The solution must use the principle of least privilege.
Which permissions should you grant to Group1 and the Domain Computers group? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
QUESTION 14
HOTSPOT
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a child domain named east.contoso.com.
In the contoso.com domain, you create two users named Admin1 and Admin2.
You need to ensure that the users can perform the following tasks:
1. Admin1 can create and manage Active Directory sites. 2. Admin2 can deploy domain controllers to the east.contoso.com domain.
The solution must use the principle of least privilege.
To which group should you add each user? To answer, select the appropriate options in the answer area.
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1.
On Server 1, you install Windows Admin Center and use Windows Admin Center to remove BUILTlN \Users from the allowed groups.
You discover that all users can still sign in to Windows Admin Center.
You need to prevent unauthorized users from signing in to Windows Admin Center.
What should you do in Windows Admin Center?
A.
Set Performance Profile to On
B.
Set Require manage-as sessions to re-authenticate to On
C.
From the Proxy settings, configure a bypass list.
D.
Add a security group to the allowed groups.
Correct Answer: D
Case Study 4
Case Study Questions
Simulation
Simulation
QUESTION 16
Simulation
You need to create an Active Directory Domain Services (AD DS) site named Site2 that is associated to an IP address range of 192.168.2.0 to 192.168.2.255.
To complete this task, sign in the required computer or computers.
Correct Answer:
Phase 1: Creating a new site Step l: Navigate to Server Manager >Tools > Active Directory Sites and Services Step 2: In the Active Directory Sites and Service window, right-click Sites and select New Site
Step 4: Select the DEFAULTIPSITELINK and click OK Step 5: Click OK to complete the site creation Phase 2: Create subnet Step 6: In the Active Directory Sites and Services MIMC, right-click Subnets and select New Subnet...
Step 7:In the New Object - subnet window, type192.168.2.0/24 Step 8: In the Select a site object for this prefix option select Site2 and click OK
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
QUESTION 17
You have an on-premises server named Server1 that runs Windows Server.
You have an Azure subscription that contains a virtual network named VNet1.
You need to connect Server1 to VNet1 by using Azure Network Adapter.
What should you use?
A.
the Azure portal
B.
Microsoft Entra Connect
C.
Device Manager
D.
Windows Admin Center
Correct Answer: D
Explanation
Explanation/Reference:
Connect standalone servers by using Azure Network Adapter. You can connect an on-premises standalone server to Microsoft Azure virtual networks by using the Azure Network Adapter that you deploy through the Windows Admin Center (WAC).
Use a Windows Server with Windows Admin Center installed to deploy the Azure Network Adapter.
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.
Existing Environment
On-premises Servers
The on-premises network contains servers that run Windows Server as shown in the following table.
DC1 hosts all the operation master roles.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.
On-premises Network
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.
Identity Infrastructure
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with a Microsoft Entra tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.
Requirements
Planned Changes
Fabrikam identifies the following planned changes:
1. Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1. 2. Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be connected to Vnet1 by using ExpressRoute. 3. Create three Azure file shares named newyorkhiles, seattlefiles, and companyfiles. 4. Create a domain controller named dc3.corp.fabrikam.com in Vnet1. 5. Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined. 6. License all servers for Microsoft Defender for servers. 7. Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.
Networking Requirements
Fabrikam identifies the following networking requirements:
1. Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over ExpressRoute. 2. If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease. 3. Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.
Security Requirements
Fabrikam identifies the following security requirements:
1. Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer. 2. Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours. 3. Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|. 4. Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days. 5. Prevent domain controllers from directly contacting hosts on the internet.
File Sharing Requirements
You need to configure the synchronization of Azure files to meet the following requirements:
1. Ensure that seattlefiles syncs to FS2. 2. Ensure that newyorkfiles syncs to FS1. 3. Ensure that companyfiles syncs to both FS1 and FS2.
QUESTION 18
What should you implement for the deployment of DC3?
A.
Azure Active Directory Domain Services (Microsoft Entra DS).
B.
Microsoft Entra Application Proxy.
C.
An Azure virtual machine.
D.
An Microsoft Entra administrative unit.
Correct Answer: C
Explanation
Explanation/Reference:
Create a domain controller named dc3.corp.fabrikam.com in Vnet1. In a hybrid network, you can configure Azure virtual machines as domain controllers. The domain controllers in Azure communicate with the on-premises domain controllers in the same way that on-premises domain controllers communicate with each other.
Case Study 3
Case Study Questions
Overview
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
QUESTION 19
DRAG DROP
You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.
You deploy five servers to the domain. You add the servers to a group named ITFarmHosts.
You plan to configure a Network Load Balancing (NLB) cluster named NLBCluster.contoso.com that will contain the five servers.
You need to ensure that the NLB service on the nodes of the cluster can use a group managed service account (gMSA) to authenticate.
Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
The domain contains the users shown in the following table.
The domain has the Group Policy Objects (GPOs) shown in the following table.
The GPOs are configured as shown in the following table.
For each of the following statements, select Yes if the statement is true, Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
QUESTION 21
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a user named User1. User1 is a member of a group named Group1 and is in an organizational unit (OU) named OU1.
The domain has minimum password lengths configured as shown in the following table.
What is the minimum password length that User1 should use when changing to a new password?
A.
7
B.
8
C.
10
D.
12
E.
14
Correct Answer: A
QUESTION 22
You have an on-premises server named Server1 that runs Windows Server. Server1 contains an app named App1 and a firewall named Firewall1.
You have an Azure subscription.
Internal users connect to App1 by using WebSockets.
You need to make App1 available to users on the internet. The solution must minimize the number of inbound ports open on Firewall1.
What should you include in the solution?
A.
Microsoft Application Request Routing (ARR) Version 2
B.
Azure Application Gateway
C.
Azure Relay
D.
Web Application Proxy
Correct Answer: C
Case Study 1
Case Study Questions
Overview
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Existing Environment
AD DS Environment
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.
All the domain controllers are global catalog servers.
Server infrastructure
The network contains the servers shown in the following table.
A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.
Group Policies
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.
Existing Identities
The forest contains the users shown in the following table.
The forest contains the groups shown in the following table.
Current Problems
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without signing out, another administrator can connect to the console session as the currently signed in user.
Requirements
Technical Requirements
Contoso identifies the following technical requirements:
1. Change the replication schedule for all site links to 30 minutes. 2. Promote Server1 to a domain controller in canada.contoso.com. 3. Install and authorize Server3 as a DHCP server. 4. Ensure that User1 can manage the membership of all the groups in Contoso\OU3. 5. Ensure that you can manage Server4 from Server1 by using PowerShell remoting. 6. Ensure that you can run virtual machines on VM1. 7. Force users to provide credentials when they connect to VM2. 8. On VM3, ensure that Data Deduplication on all volumes is possible.
QUESTION 23
HOTSPOT
For each of the following statements, select Yes if the statement is true. Otherwise. select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Case Study 3
Case Study Questions
Overview
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
QUESTION 24
You have an Active Directory Domain Services (AD DS) domain that contains the domain controllers shown in the following table.
The domain contains an app named App1 that uses a custom application partition to store configuration data.
You decommission App1.
When you attempt to remove the custom application partition, the process fails.
Which domain controller is unavailable?
A.
DC1
B.
DC2
C.
DC3
D.
DC4
Correct Answer: C
Explanation
Explanation/Reference:
The Domain Naming Master is used to add and to remove domains and application partitions to and from the forest. - Must be online when domains and application partitions in a forest are added or removed.
You have an Azure subscription that contains the storage accounts shown in the following table.
In the East US Azure region, you create a storage sync service named Sync1.
You need to create a sync group in Sync1.
Which storage accounts can you use, and what can you specify as the cloud endpoints. To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: storage1 and storage3 only Storage1 and storage3 are in the same region as the storage sync service. They are both of acceptable types, StorageV2 and FileStorage respectively.
Incorrect: * storage2 Storage2 is BlobBlobStorage.
* storage4 Storage4 is in another region.
Note: There are two main types of storage accounts you will use for Azure Files deployments:
* General purpose version 2 (GPv2) storage accounts: GPv2 storage accounts allow you to deploy Azure file shares on standard/hard disk-based (HDD-based) hardware. In addition to storing Azure file shares, GPv2 storage accounts can store other storage resources such as blob containers, queues, or tables.
* FileStorage storage accounts: FileStorage storage accounts allow you to deploy Azure file shares on premium/solid-state disk-based (SSD-based) hardware.
Region The storage account for the Azure file share must be located in the same region as the Storage Sync Service.
Box 2: share1 and share3 only A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with each other. A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server endpoints.
A cloud endpoint is a pointer to an Azure file share. All server endpoints will sync with a cloud endpoint, making the cloud endpoint the hub. The storage account for the Azure file share must be located in the same region as the Storage Sync Service.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
The network contains the servers shown in the following table.
You plan to implement IP Address Management (IPAM).
You need to use the Group Policy based provisioning method for managed servers. The solution must support server discovery.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
QUESTION 27
You have a server named Server1 that runs Windows Server 2019 and hosts a container named Container1.
Container1 uses a Windows Server 2019 base image that was built by using a Docker file.
You upgrade Server1 to Windows Server 2022.
You need to ensure that Container1 will run on Server1.
The solution must minimize administrative effort.
What should you do?
A.
Start Container1 in Hyper-V isolation mode.
B.
Modify the Docker file.
C.
Start Container1 in process isolation mode.
D.
Rebuild the base image for Container1.
Correct Answer: A
Explanation
Explanation/Reference:
When you upgrade Server1 to Windows Server 2022, you are running a newer version of the operating system than the one that the container (which is based on a Windows Server 2019 image) was built for.
Containers running in process isolation mode must use a base image that matches the host OS version or be very close. Since the base image for Container1 is built on Windows Server 2019 and the host is now Windows Server 2022, process isolation would not work without rebuilding the image.
To minimize administrative effort, you can run the container in Hyper-V isolation mode, which provides compatibility by allowing containers to run with a different kernel version than the host. Hyper-V isolation creates a lightweight virtual machine for each container, allowing it to run in its own isolated environment.
QUESTION 28
HOTSPOT
Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com. The domain contains a file server named Server1 and three users named User1, User2, and User3.
Server1 contains a shared folder named Share1 that has the following configurations:
The share permissions for Share1 are configured as shown in the Share Permissions exhibit.
Share1 contains a file named File1.bxt. The advanced security settings for File1.txt are configured as shown in the File Permissions exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box1: no-has change but not full controll cannot take ownership Box2: yes Box 3:yes
Case Study 2
Case Study Questions
Overview
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.
Existing Environment
On-premises Servers
The on-premises network contains servers that run Windows Server as shown in the following table.
DC1 hosts all the operation master roles.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.
On-premises Network
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.
Identity Infrastructure
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with a Microsoft Entra tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.
Requirements
Planned Changes
Fabrikam identifies the following planned changes:
1. Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1. 2. Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be connected to Vnet1 by using ExpressRoute. 3. Create three Azure file shares named newyorkhiles, seattlefiles, and companyfiles. 4. Create a domain controller named dc3.corp.fabrikam.com in Vnet1. 5. Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined. 6. License all servers for Microsoft Defender for servers. 7. Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.
Networking Requirements
Fabrikam identifies the following networking requirements:
1. Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over ExpressRoute. 2. If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease. 3. Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.
Security Requirements
Fabrikam identifies the following security requirements:
1. Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer. 2. Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours. 3. Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|. 4. Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days. 5. Prevent domain controllers from directly contacting hosts on the internet.
File Sharing Requirements
You need to configure the synchronization of Azure files to meet the following requirements:
1. Ensure that seattlefiles syncs to FS2. 2. Ensure that newyorkfiles syncs to FS1. 3. Ensure that companyfiles syncs to both FS1 and FS2.
QUESTION 29
You need to implement a name resolution solution that meets the networking requirements.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A.
Create an Azure private DNS zone named corp.fabhkam.com.
B.
Create a virtual network link in the coip.fabnkam.com Azure private DNS zone.
C.
Create an Azure DNS zone named corp.fabrikam.com.
D.
Configure the DNS Servers settings for Vnet1.
E.
Enable autoregistration in the corp.fabnkam.com Azure private DNS zone.
F.
On DC3, install the DNS Server role.
G.
Configure a conditional forwarder on DC3.
Correct Answer: DF
Explanation
Explanation/Reference:
Virtual machines in an Azure virtual network receive their DNS configuration from the DNS settings configured on the virtual network. You need to configure the Azure virtual network to use DC3 as the DNS server. Then all virtual machines in the virtual network will use DC3 and their DNS server.
Case Study 3
Case Study Questions
Overview
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
QUESTION 30
You have a server named Server1 that hosts Windows containers.
You plan to deploy an application that will have multiple containers. Each container will be on the same subnet. Each container requires a separate MAC address and IP address. Each container must be able to communicate by using its IP address.
You need to create a Docker network that supports the deployment of the application.
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.
Existing Environment
On-premises Servers
The on-premises network contains servers that run Windows Server as shown in the following table.
DC1 hosts all the operation master roles.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.
On-premises Network
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.
Identity Infrastructure
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with a Microsoft Entra tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.
Requirements
Planned Changes
Fabrikam identifies the following planned changes:
1. Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1. 2. Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be connected to Vnet1 by using ExpressRoute. 3. Create three Azure file shares named newyorkhiles, seattlefiles, and companyfiles. 4. Create a domain controller named dc3.corp.fabrikam.com in Vnet1. 5. Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined. 6. License all servers for Microsoft Defender for servers. 7. Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.
Networking Requirements
Fabrikam identifies the following networking requirements:
1. Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over ExpressRoute. 2. If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease. 3. Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.
Security Requirements
Fabrikam identifies the following security requirements:
1. Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer. 2. Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours. 3. Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|. 4. Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days. 5. Prevent domain controllers from directly contacting hosts on the internet.
File Sharing Requirements
You need to configure the synchronization of Azure files to meet the following requirements:
1. Ensure that seattlefiles syncs to FS2. 2. Ensure that newyorkfiles syncs to FS1. 3. Ensure that companyfiles syncs to both FS1 and FS2.
QUESTION 31
You are planning the implementation Azure Arc to support the planned changes.
You need to configure the environment to support configuration management policies.
What should you do?
A.
Hybrid Microsoft Entra join all the servers.
B.
Create a hybrid runbook worker m Azure Automation.
C.
Deploy the Azure Connected Machine agent to all the servers.
D.
Deploy the Azure Monitor agent to all the servers.
Company Information ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
ADatum AD DS Environment
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
Fabrikam AD DS Environment
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
Azure Resources
ADatum has an Azure subscription that contains an Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
Sync Data1 to share1. Configure an Azure runbook named Task1. Enable Microsoft Entra users to sign in to Server1. Create an Azure DNS Private Resolver that has the following configurations: - Name: Private1 - Region: West US - Virtual network: VNet1 - Inbound endpoint: SubnetB
QUESTION 32
DRAG DROP
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. VM1 contains a 128-GB operating system disk.
You need to increase the size of volume C on VM1 to 250 GB.
Which four actions should you perform in sequence?
To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation
Explanation/Reference:
How to expand virtual hard disks attached to a Windows virtual machine You may need to expand the OS disk if you're supporting a legacy application that installs components on the OS disk or if you're migrating a physical PC or VM from on-premises that has a larger OS disk.
Step 1: Stop VM1. Resize a managed disk by using PowerShell
1. Stop the VM before resizing the disk: Stop-AzVM -ResourceGroupName $rgName -Name $vmName
Step 2: Resize the operating system disk. 2. Obtain a reference to the managed OS disk. Set the size of the managed OS disk to the desired value and update the Disk:
Step 4: Resize Volume C. Expand the volume in the operating system When you've expanded the disk for the VM, you need to go into the OS and expand the volume to encompass the new space.
You have a server named Server1 that has Windows Admin Center installed. The certificate used by Windows Admin Center was obtained from a certification authority (CA).
The certificate expires.
You need to replace the certificate.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
You need to identify which server is the PDC emulator for the domain.
Solution: From Active Directory Sites and Services, you right-click Default-First-Site-Name in the console tree, and then select Properties.
Does this meet the goal?
A.
Yes
B.
No
Correct Answer: B
QUESTION 35
HOTSPOT
You have a Windows server named Server1.
You add two 4-TB hard drives named Disk1 and Disk2 to Server1.
You need to format the drives. The solution must meet the following requirements:
1. Disk1 must support disk level quotas. 2. Disk2 must support Data Deduplication.
Which type of file system should you use for each drive? To answer, select the appropriate options in the answer area.
NOTE; Each correct selection is worth one point.
Correct Answer:
QUESTION 36
HOTSPOT
You have a server named Server1 that runs Windows Server and contains three volumes named C, D, and E.
Files are stored on Server1 as shown in the following table.
For volume D, Data Deduplication is enabled and set to General purpose file server.
You perform the following actions:
1. Move File1 to volume D. 2. Copy File2 to volume D and name the copy File4. 3. Move File3 to volume E
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
You have a server named Server1 that runs Windows Server and has the Hyper V server role installed. Server1 hosts a virtual machine named VM1.
Server1 has an NVMe storage device. The device is currently assigned to VM1 by using Discrete Device Assignment.
You need to make the device available to Server1.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
"Boot diagnostics must be enabled for the VM" "The Azure account accessing Serial Console must have Virtual Machine Contributor role for both the VM and the boot diagnostics storage account"
QUESTION 39
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a server named Server1 that runs Windows Server 2022 and has the DHCP Server role. Server1 contains a single DHCP scope named Scope1.
You deploy five printers to the network.
You need to ensure that the printers are always assigned the same IP address.
Solution: You create a DHCP reservation for each printer.
Does this meet the requirement?
A.
Yes
B.
No
Correct Answer: B
QUESTION 40
You need to ensure that VM3 meets the technical requirements.
What should you install first?
A.
Enhanced Storage
B.
the iSNS Server service
C.
File Server Resource Manager (FSRM)
D.
Windows Standards-Based Storage Management
Correct Answer: C
Explanation
Explanation/Reference:
VM3 must be configured to enable per-folder quotas. VM3 is a Windows Server 2022 Standard server, joined to the adatum.com domain, and has the File and Storage Services role installed.
Configure Disk Quota using FSRM (Windows Server 2012 R2) File Server Resource Manager is a pack of tools for Windows Server® 2008 or above that allows administrators to control and manage the quantity and type of data files that is stored on their network or servers.
Disk Quota is a tool part of the FSRM Pack of tools. It helps to Manage the capacity of a storage device on the server or network. Example: Configure Disk Quota on DC1
Step 1 Go to Server Manager
Step 2 On the Server Manager Console. Select "Tools" on the right top corner and choose "File Server Resource Manager"
Step 3 On the File Server Resource Manager console, select "Quota Management -> Quotas", Then Right-Click on "Quotas". Select "Create Quota"
You have an Azure virtual machine named Server1 that runs a network management application. Server1 has the following network configurations:
1. Network interface: Nic1 2. IP address: 10.1.1.1/24 3. Connected to: Vnet1/Subnet1
You need to connect Server1 to an additional subnet named Vnet1/Subnet2.
What should you do?
A.
Modify the IP configurations of Nic1.
B.
Add an IP configuration to Nic1.
C.
Add a network interface to Server1.
D.
Create a private endpoint on Subnet2.
Correct Answer: C
Explanation
Explanation/Reference:
First add another network interface to Server1, then connect it to Subnet2.
Virtual network and subnets.
A subnet is a range of IP addresses in the virtual network. You can divide a virtual network into multiple subnets for organization and security. Each NIC in a VM is connected to one subnet in one virtual network. NICs connected to subnets (same or different) within a virtual network can communicate with each other without any extra configuration.
Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site.
You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1.
You need to recommend a deployment plan that meets the following requirements:
1. Ensures that a user named User1 can perform the RODC installation on Server1 2. Ensures that you can control the AD DS replication schedule to the Server1 3. Ensures that Server1 is in a new site named RemoteSite1 4. Uses the principle of least privilege
Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation
Explanation/Reference:
Box 1. We need to create a site and subnet for the remote site. The new site will be added to the Default IP Site Link so we don't need to create a new site link. You configure the replication schedule on the site link.
Box 2. When we pre-create an RODC account, we can specify who is allowed to attach the server to the prestaged account. This means that the User1 does not need to be added to the Domain Admins group.
Box3. User1 can connect the RODC to the prestaged account by running the AD DS installation wizard.
You need to ensure that Automanage meets the technical requirements.
On which Azure virtual machines should you enable Automanage?
A.
Server1 only
B.
Server2 only
C.
Server1 and Server2 only
D.
Server2 and Server3 only
E.
Server1 and Server4 only
Correct Answer: D
Explanation
Explanation/Reference:
Azure Automanage must be used on all supported Azure virtual machines. Automanage does not support Trusted Launch VMs. This excludes Server1 and Server4.
Note: What are all of the prerequisites required to enable Azure Automanage? The following are prerequisites for enabling Azure Automanage:
Supported Windows Server versions and Linux distros VMs must be in a supported region
User must have correct permissions Non-scale set VMs only Automanage does not support Sandbox subscriptions at this time *-> Automanage does not support Trusted Launch VMs at this time
