SIMULATIONYou need to create a group-managed service account (gMSA) named gMSA1 and make gMSA1 available on SRV1.To complete this task, sign in to the required computer or computers.
Answer(s): A
To create a gMSA using the New-ADServiceAccount cmdlet.Step 1: On the Windows Server 2012 domain controller (here SRV1), run Windows PowerShell from the Taskbar.Step 2: At the command prompt for the Windows PowerShell, type the following commands, and then press ENTER. (The Active Directory module will load automatically.)New-ADServiceAccount gMSA1Enter the command on a single line.Step 3: Install the gMSA on the host The Install-ADServiceAccount cmdlet installs an existing gMSA on the server on which the cmdlet is run. Use the cmdlet with the following syntax:Install-ADServiceAccount ` -Identity <ADServiceAccount> Run the following PowerShell commands as administrator.Install-ADServiceAccount gMSA1Note: Managed Service Accounts container To work effectively, gMSAs must be in the Managed Service Accounts container.
https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/getting-started-with-group-managed-service-accounts https://learn.microsoft.com/en-us/entra/architecture/service-accounts-group-managed
SIMULATIONYou use a Group Policy preference to map \\dc1.contoso.com\install as drive H for all users. If a user already has an existing drive mapping for H, the new drive mapping must take precedence.To complete this task, sign in to the required computer or computers.
Mapping drives using Group Policy preferencesSteps involved:1. Open Group Policy Management.2. Right-click the domain or the required subfolder to create a new GPO, or select an already existing one. Right-click and select Edit to open the Group Policy Management Editor.3. Go to User Configuration > Preferences > Windows Settings > Drive Maps.4. Right-click and select New > Mapped Drive.5. Under the General tab (see Figure below), do the following:6. Action: Select Create or Update.7. Location: Specify the full file path, e.g. \\Anjali-dc1\c.Specify: \\dc1.contoso.com\install8. Reconnect: Enable this to auto connect the drive.9. Label as: Pick a suitable name for the shared drive, e.g. SharedDrive.10. Drive Letter: Select a suitable letter for the drive, e.g. K.Specify H(11. Connect as: Enter a username and password if you want users to connect with certain credentials other than their own Windows login credentials.)(12. Hide/Show this drive: Select whether you want to hide the folder or make it visible on the network.)(13. Hide/Show all drives: Select whether, by default, all the shared drives/folders are hidden or visible.)
https://blogs.manageengine.com/active-directory/active-directory-academy/2019/11/18/mapping-drives-using-group-policy-preferences.html
HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.The domain contains the users shown in the following table.The domain has the Group Policy Objects (GPOs) shown in the following table.The GPOs are configured as shown in the following table.For each of the following statements, select Yes if the statement is true, Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: Yes Yes - When User1 changes their password, at least eight characters must be used for the new password.User1 is in Conotoso.com. The Default Domain policy is linked to Contoso.com. The Default Domain policy has a minimum password requirement of 8 characters.Box 2: No No - When User2 changes their password, at least 12 characters must be used for the new password.User1 is in Conotoso.com/Users. The Default Domain Controller policy has a minimum password requirement of 12 characters, but it will not apply to User1.Box 3: Yes Yes -When User3 changes their password, at least 10 characters must be used for the new password.User3 is in Conotoso.com/OU1. The GPO1 is linked to OU1. GPO1 has a minimum password requirement of 10 characters.
HOTSPOT (Drag and Drop is not supported)Your network contains the domains shown in the following exhibit.You need to establish trust relationships as shown in the following exhibit.Which type of trust can you use for Trust1 and Trust2? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Shortcut trust only Trust1Shortcut trusts are one-way transitive trusts. These trusts are created manually. These trusts are created when one domain needs to trust another domain by bypassing the hierarchy of trusts such as parent-child trusts or forest-root trusts. A shortcut trust is usually established to shorten what is called a trust path.Box 2: Forest trust or external trust only Trust2External trust An external trust is a one-way non-transitive trust. These trusts are manually established. An external trust is established with an external domain outside the forest of the trusting domain.Forest trust Forest trusts are transitive, and they can either be one-way or two-way trusts. Forest trusts are ones that occur between forests, and these trusts are manually created. When one forest trusts another forest, all the domains within the two forests will automatically trust each other.Note: Forest trusts Forest trusts help you to manage a segmented AD DS infrastructures and support access to resources and other objects across multiple forests. Forest trusts are useful for service providers, companies undergoing mergers or acquisitions, collaborative business extranets, and companies seeking a solution for administrative autonomy.Using forest trusts, you can link two different forests to form a one-way or two-way transitive trust relationship. A forest trust allows administrators to connect two AD DS forests with a single trust relationship to provide a seamless authentication and authorization experience across the forests.A forest trust can only be created between a forest root domain in one forest and a forest root domain in another forest. Forest trusts can only be created between two forests and can't be implicitly extended to a third forest. This behavior means that if a forest trust is created between Forest 1 and Forest 2, and another forest trust is created between Forest 2 and Forest 3, Forest 1 doesn't have an implicit trust with Forest 3.The following diagram shows two separate forest trust relationships between three AD DS forests in a single organization.This example configuration provides the following access:Users in Forest 2 can access resources in any domain in either Forest 1 or Forest 3 Users in Forest 3 can access resources in any domain in Forest 2 Users in Forest 1 can access resources in any domain in Forest 2
https://www.windows-active-directory.com/active-directory-trusts.html https://learn.microsoft.com/en-us/entra/identity/domain-services/concepts-forest-trust
HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the users shown in the following table.The domain has the Group Policy Objects (GPOs) shown in the following table.The GPOs are configured to map a drive named H as shown in the following table.For each of the following statements, select Yes if the statement is true, Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: No No - For User1, \\server2\share maps to drive H.User1 is located in Contoso\Users. GPO1 is linked to Contoso.com. GPO1 enforce is enable for the GPO link. GPO1 is configured to map drive H to \\server1\shareBox 2: Yes Yes - For User2, \\server1\share maps to drive H.User2 is located in Contoso\OU1. GPO2 is linked to Contoso\OU1. Enforcement is not configured for GPO2. GPO2 is configured to map drive H to \\server2\share However, GPO1 is enforced. GPO1 is configured to map drive H to \\server1\shareNote: To enforce the Group Policy settings in a specific GPO, you can specify the No Override option. If you specify this option, policy settings in GPOs that are in lower-level Active Directory containers cannot override the policy. For example, if you define a GPO at the domain level, and you specify the No Override option, the policies that the GPO contains apply to all organizational units in that domain. Lower-level organizational units will not override the policy applied at the domain level.Box 3: Yes Yes - For User3, \\server3\share maps to drive H.GPO3, which has block inheritance enabled for OU2, will be applied to User3. GPO3 is configured to map drive H to \\server3\shareNote: To block inheritance of Group Policy from parent Active Directory containers, you can specify the Block inheritance option. For example, if you specify the Block inheritance option for an organizational unit, it prevents the application of policy at that level from higher-level Active Directory containers such as a higher-level organizational unit or domain.
https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/overriding-and-blocking-group-policy
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a user named User1. User1 is a member of a group named Group1 and is in an organizational unit (OU) named OU1.The domain has minimum password lengths configured as shown in the following table.What is the minimum password length that User1 should use when changing to a new password?
The PSO (password settings object) linked directly to User1 has the highest precedence (lowest value).Note 1: When multiple password policies exist, the policy with the highest precedence, or priority, is applied to a user. The lower the number, the higher the priority. The default password policy has a priority of 200.Note 2: You create fine-grained password policies with password settings objects (PSOs).If multiple PSOs are linked to a user or group, the resultant PSO that is applied is determined as follows:1. A PSO that is linked directly to the user object is the resultant PSO. (Multiple PSOs should not be directly linked to a user object.)2. If no PSO is linked directly to the user object, the global security group memberships of the user, and all PSOs that are applicable to the user based on those global group memberships, are compared. The PSO with the lowest precedence value is the resultant PSO.If no PSO is obtained from conditions (1) and (2), the Default Domain Policy is applied.Example: Fill in or edit fields inside the property page to create a new Password Settings object. The Name and Precedence fields are required.
https://learn.microsoft.com/en-us/entra/identity/domain-services/password-policy https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/adac/introduction-to-active-directory-administrative-center-enhancements--level-100-https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ cc770394(v=ws.10)
SIMULATIONYou need to create a Group Policy Object (GPO) named GPO1 that only applies to a group named MemberServers.To complete this task, sign in the required computer or computers.
Step 1: Open Group Policy Management by navigating to the Start menu > Windows Administrative Tools, then select Group Policy Management.Step 2: Right-click Group Policy Objects, then select New to create a new GPO.Step 3: Enter a name [here GPO1] for the new GPO that you can identify what it is for easily, then click OK. Step 4: Select the GPO from Group Policy Objects list, then in the Security Filtering section, Add and Remove users, groups, and computers that the GPO should apply to. [Here add group MemberServers]Step 5: Close the GPO Editor when you are done.Now, the GPO is created.
https://support.globalsign.com/aeg/aeg-how-create-and-link-gpo-active-directory
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the domain controllers shown in the following table.You have a partner organization that has an AD DS forest named fabrikam.com.You create a trust relationship between contoso.com and fabrikam.com.You need to configure selective authentication for the trust relationship.Which domain controller should be granted permissions to fabrikam.com?
Answer(s): D
* Before an authentication request made with the Kerberos version 5 authentication protocol can follow the forest trust path, the service principal name (SPN) of the resource computer must be resolved to a location in the other forest.* RID Master FSMO Role The Relative ID Master assigns blocks of Security Identifiers (SID) to different DCs they can use for newly created objects. Each object in AD has an SID, and the last few digits of the SID are the Relative portion. In order to keep multiple objects from having the same SID, the RID Master grants each DC the privilege of assigning certain SIDs.Note: How selective authentication affects domain controller behavior When selective authentication is enabled, all authentication requests made over a trust to the trusting forest are tagged with an identifier that subjects the request to closer scrutiny by the domain controllers in the domain where the target resource is located. This is important because the mere presence of this identifier triggers the domain controller in the resource domain to first check whether the user requesting the access has been given explicit permissions to the Active Directory object where the resource is hosted. The appropriate permission to the resource object in Active Directory is verified before the domain controller sends a service ticket back to the requesting workstation in the trusted forest. The following illustration summarizes how domain controllers in the trusting forest are affected when selective authentication is enabled.Effect of Selective Authentication on Domain Controllers in the Trusting ForestNote 2: Authentication Settings Used on Interforest Trusts
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc755321(v=ws.10) https://www.varonis.com/blog/fsmo-roles
Post your Comments and Discuss Microsoft AZ-800 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-800 content, but please register or login to continue.