Free AZ 800: Administering Windows Server Hybrid MCQ Questions and Answers — Questions and Answers
Question 1: An Active Directory Domain Services (AD DS) domain with the name contoso.com is present on your network.<br> You must determine which server is the domain's PDC emulator. <br> Solution: You can execute the netdom.exe query fsmo from a command prompt. <br> Is the objective being met?
- No
- Yes (Correct answer)
Correct answer: Yes
The `netdom.exe query fsmo` command is the standard and correct method to identify the Flexible Single Master Operations (FSMO) role holders in an Active Directory domain, including the Primary Domain Controller (PDC) emulator. Executing this command from a command prompt will display the server holding each FSMO role, thereby successfully meeting the objective of determining the PDC emulator.
Question 2: In Azure AD, you intend to deploy a self-service password reset (SSPR). <br> You must make sure that users who reset their passwords using SSPR can access the AD DS domain's new password resources. <br> What ought you to do?
- Run the Microsoft Azure Active Directory Connect wizard and select Password writeback. (Correct answer)
- Grant the impersonate a client after authentication user right to the Azure AD Connect service account.
- Deploy the Azure AD Password Protection proxy service to the on premises network
- Grant the Change password permission for the domain to the Azure AD Connect service account.
Correct answer: Run the Microsoft Azure Active Directory Connect wizard and select Password writeback.
To ensure that passwords reset in Azure AD using Self-Service Password Reset (SSPR) are synchronized back to the on-premises AD DS domain, the 'Password writeback' feature in Azure AD Connect must be enabled. This feature allows password changes made in the cloud to be written back to the on-premises directory. This ensures consistency and allows users to access on-premises resources with their new password.
Question 3: The domain contoso.com belongs to your Azure Active Directory Domain Services (Azure AD DS) account. <br> An administrator must be given access to manage Group Policy Objects (GPOs). The least privilege principle must be applied to the solution. <br> Which group should the administrator be added to?
- Domain Admins
- Enterprise Admins
- AAD DC Administrators (Correct answer)
- Schema Admins
Correct answer: AAD DC Administrators
In Azure AD Domain Services (Azure AD DS), the `AAD DC Administrators` group is specifically designed to delegate administrative privileges for managing the managed domain, including Group Policy Objects (GPOs). Adding an administrator to this group provides the necessary permissions to manage GPOs while adhering to the principle of least privilege, as it's tailored for AD DS administration rather than broader enterprise roles.
Question 4: An Active Directory Domain Services (AD DS) domain exists on your network. 20 domain controllers, 100 member servers, and 100 client computers are also part of the network. <br> Group Policy preferences are contained in a Group Policy Object (GPO) called GPO1 that you have. <br> You want to connect the domain to GPO1. <br> The preference in GPO1 must ONLY apply to domain member servers and NOT to domain controllers or client computers. Each computer must be affected by all other Group Policy settings in GPO1. The answer must require the least amount of administration. <br> Which kind of item-level targeting ought to be employed?
- Operating System (Correct answer)
- Environment Variable
- Domain
- Security Group
Correct answer: Operating System
To apply a Group Policy Preference (GPP) only to domain member servers and exclude domain controllers and client computers, item-level targeting based on the 'Operating System' is the most efficient method. You can configure the GPP to apply only if the operating system is a server OS (e.g., Windows Server 2016 or later), thereby automatically excluding client OS and domain controllers without complex filtering.
Question 5: A multi-site Active Directory Domain Services (AD DS) forest exists on your network. Both automatically generated connections and manually set site links are used to connect each Active Directory site. <br> The convergence time for Active Directory changes needs to be kept to a minimum. <br> What ought you to do?
- Create a site link bridge that contains all the site links
- For each site link, modify the replication schedule. (Correct answer)
- For each site link, modify the options attribute
- For each site links, modify the site link costs
Correct answer: For each site link, modify the replication schedule.
To minimize the convergence time for Active Directory changes, it is essential to ensure that replication occurs more frequently between sites. Modifying the replication schedule for each site link allows you to define how often replication takes place. Increasing the frequency of replication will directly reduce the time it takes for changes to propagate throughout the Active Directory forest.
Question 6: You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory Domain Services (AD DS) domain. <br> You have a number of Windows 10 devices that are hybrid-joined to Azure AD. <br> You must make sure that users may use Windows Hello for Business to sign in to the devices. <br> Which Azure AD Connect optional feature should you choose?
- Azure AD app and attribute filtering
- Password writeback (Correct answer)
- Directory extension attribute sync
- Group writeback
Correct answer: Password writeback
For users to sign in to hybrid-joined Windows 10 devices using Windows Hello for Business, password writeback must be enabled in Azure AD Connect. Windows Hello for Business relies on the user's password hash being synchronized to Azure AD, and password writeback ensures that any password changes (including those initiated during Hello for Business provisioning) are reflected back to the on-premises AD DS, enabling seamless authentication.
Question 7: Active Directory Domain Services (AD DS) forest contoso.com is a part of your network. A server with the name server1.contoso.com is present in the forest root domain.<br> There is a two-way forest trust between the contoso.com forest and the fabrikam.com AD DS forest. There are 10 child domains in the fabrikam.com forest. <br> You must make sure that only those who are a part of the group fabrikamGroup1 are able to log in to server1.contoso.com. <br> What ought you start with?
- Enable Selective authentication for the trust (Correct answer)
- Change the trust to a one-way external trust
- Enable SID filtering for the trust
- Add fabrikam\Group1 to the local Users group on server1.contoso.com
Correct answer: Enable Selective authentication for the trust
To restrict users from a trusted forest (fabrikam.com) to log in only to specific resources in the trusting forest (contoso.com), 'Selective authentication' must be enabled on the trust. With selective authentication, administrators in the trusting forest must explicitly grant the 'Allowed to Authenticate' permission to users or groups from the trusted forest on the specific resources (like server1.contoso.com) they are permitted to access.
Free AZ 800: Administering Windows Server Hybrid MCQ Questions and Answers
An Active Directory Domain Services (AD DS) domain with the name contoso.com is present on your network.
You must determine which server is the domain's PDC emulator.
Solution: You can execute the netdom.exe query fsmo from a command prompt.
Is the objective being met?