AZ-802: Administering Windows Server

By Microsoft · Question Mode

QuestionQ7

Deploy and manage AD DS

HOTSPOT -

Overview

Contoso, Ltd. has its main office in Seattle and branch offices in Los Angeles and Montreal.

Existing Environment

AD DS Environment

The network includes an on-premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest has two domains: contoso.com and canada.contoso.com. The domain controllers are shown in the following table.

Question Image

All domain controllers are global catalog servers.

Server Infrastructure

The network contains the servers shown in the following table.

Question Image

Server4 runs Windows Server in a workgroup. Windows Defender Firewall on Server4 uses the private profile.

Server2 hosts three virtual machines named VM1, VM2, and VM3. VM3 is a file server that stores data in the volumes shown in the following table.

Question Image

Group Policies

The contoso.com domain has the Group Policy Objects (GPOs) shown in the following table.

Question Image

Existing Identities

The forest contains the users shown in the following table.

Question Image

The forest contains the groups shown in the following table.

Question Image

Current Problems

When an administrator signs in to the VM2 console by using Virtual Machine Connection and disconnects without signing out, another administrator can connect to that console session as the currently signed-in user.

Requirements

Technical Requirements

Contoso identifies these technical requirements:

  • Change the replication schedule for every site link to 30 minutes.
  • Promote Server1 to a domain controller in canada.contoso.com.
  • Install and authorize Server3 as a DHCP server.
  • Ensure User1 can manage membership for every group in Contoso\OU3.
  • Ensure Server4 can be managed from Server1 by using PowerShell remoting.
  • Ensure virtual machines can run on VM1.
  • Require users to provide credentials when connecting to VM2.
  • On VM3, enable Data Deduplication on every volume that supports it.

Which groups can be added to Group3 and Group5? Select the appropriate options in the answer area.

Select
Group3:
Group5:
Explanation

Eligibility for group nesting in Active Directory is determined by group scope alone; whether a group is security-enabled or is a distribution group has no bearing on what can be nested inside it. A domain local group can contain user and computer accounts from any domain in the forest, global groups from any domain in the forest, and universal groups from any domain in the forest, but it can only contain other domain local groups that were created in its own domain. A global group is far more restrictive: it can contain only accounts and other global groups created in the same domain where it itself was created, and can never contain a universal or domain local group regardless of domain. Group3 is a domain local group created in contoso.com, so it can accept Group1 (a universal group, valid from any domain), Group2 (a global group in contoso.com), and Group4 and Group5 (global groups created in canada.contoso.com, also valid since domain local groups accept global groups from any domain in the forest) — but not Group6, which is itself a domain local group created in canada.contoso.com, a different domain from Group3's own domain, and domain local groups can only nest other domain local groups from the same domain. Group5 is a global group created in canada.contoso.com, so by the stricter global-group rule it can only contain accounts or global groups from that same domain; among the candidates only Group4, also a global group created in canada.contoso.com, qualifies — Group1 and Group2 fail because they were created in contoso.com, not canada.contoso.com, and Group6 fails because a domain local group can never be nested inside a global group.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!