AZ-801: Configuring Windows Server Hybrid Advanced Services

By Microsoft · Question Mode

QuestionQ4

Secure Windows Server on-premises and hybrid infrastructures

Existing Environment

The network contains an Active Directory Domain Services (AD DS) domain named contoso.com.

Domain controllers

NameOperating systemOperation master role
DC1Windows Server 2012 R2RID master, schema master
DC2Windows Server 2016PDC emulator, infrastructure master
DC3Windows Server 2016Domain naming master

Users and groups

NameOrganizational unit (OU)/ContainerMember of
User1OU1Group2, Group4
User2UsersGroup2
User3OU1Group3, Group4
Admin1OU1Domain Admins

Password policies

NameMinimum password lengthLinked to
Default Domain Policy8contoso.com
GPO110OU1

The domain contains the following fine-grained password policies (PSOs):

NamePrecedenceMinimum password lengthDirectly applies to
PSO1109Group2
PSO22011Group4

Member servers

NameDescription
Server1Contains a share named Share1
Server2None
Server3None
Server4Has Remote Desktop enabled

Connection security rules

NameEndpoint1Endpoint2Authentication mode
Server1AnyAnyRequest inbound and outbound
Server2AnyAnyRequire inbound and request outbound
Server3AnyAnyRequire inbound and outbound
DC1AnyAnyRequest inbound and outbound
DC2AnyAnyRequest inbound and outbound
DC3AnyAnyRequest inbound and outbound

Effective user rights on the servers

PolicySecurity setting
Access this computer from the networkGroup1, Administrators, Backup Operators, Everyone, Users
Deny access to this computer from the networkGroup4
Allow log on through Remote Desktop ServicesGroup2, Administrators, Remote Desktop Users
Deny log on through Remote Desktop ServicesGroup3

Server4 disks

DiskVolumeSizeFile systemNotes
Disk 0System Reserved100 MBNTFSSystem, Active
Disk 0C:126.39 GBNTFSBoot, page file, crash dump (operating system volume)
Disk 0Recovery523 MB—Recovery partition
Disk 1D: (Data)127.00 GBNTFSPrimary partition
Disk 2E: (Data)127.00 GBReFSPrimary partition
Disk 3F: (Data)127.00 GBReFSPrimary partition

Failover clusters

NameNumber of nodesNumber of virtual machines
Cluster1618
Cluster2412
Cluster326

You need to configure BitLocker on Server4.

Choose the volumes on which you can enable BitLocker and those on which you can enable auto-unlock.

Select
BitLocker:
Auto-unlock:
Explanation

BitLocker can encrypt operating-system and data volumes, including ReFS volumes on supported Windows Server versions. Auto-unlock applies only to BitLocker-protected data volumes; it cannot be configured for the operating-system volume. Thus C, D, E, and F can use BitLocker, while only D, E, and F can use auto-unlock.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!