HOTSPOT (Drag and Drop is not supported)Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. Contoso.com contains an organizational unit (OU) named OU1.You have an Azure subscription that is linked to a Microsoft Entra tenant named fabrikam.com.You need to sync contoso.com with fabrikam.com. The solution must meet the following requirements:-Support Windows Hello for Business by using a hybrid certificate deployment.-Ensure that the passwords in contoso.com do NOT sync to fabnkam.com.Which Microsoft Entra Connect feature should you use for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: Device writeback Support Windows Hello for Business by using a hybrid certificate deployment.Device registration and device write-back Windows devices must be registered in Microsoft Entra ID. Devices can be registered in Microsoft Entra ID using either Microsoft Entra join or Microsoft Entra hybrid join.Hybrid certificate trust deployments require the device write-back feature. Authentication to AD FS needs both the user and the device to authenticate. Typically the users are synchronized, but not devices. This prevents AD FS from authenticating the device and results in Windows Hello for Business certificate enrollment failures. For this reason, Windows Hello for Business deployments need device write-back.Note: Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Microsoft Entra ID and Active Directory. Device write-back is used to update the msDS-KeyCredentialLink attribute on the computer object.Box 2: Pass-through authentication Ensure that the passwords in contoso.com do NOT sync to fabrikam.com.Microsoft Entra pass-through authentication allows your users to sign in to both on-premises and cloud-based applications using the same passwords. This feature provides your users a better experience - one less password to remember, and reduces IT helpdesk costs because your users are less likely to forget how to sign in. When users sign in using Microsoft Entra ID, this feature validates users' passwords directly against your on-premises Active Directory.Key benefits of using Microsoft Entra pass-through authentication include: * Secure --> On-premises passwords are never stored in the cloud in any form.Incorrect: * Password hash synchronization Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity. Microsoft Entra Connect synchronizes a hash of a user's password from an on-premises Active Directory instance to a cloud-based Microsoft Entra instance.Password hash synchronization is an extension to the directory synchronization feature implemented by Microsoft Entra Connect Sync. You can use this feature to sign in to Microsoft Entra services like Microsoft 365. You sign in to the service by using the same password you use to sign in to your on-premises Active Directory instance.
https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two servers named Server1 and Server2 and the users shown in the following table.Which users can establish a PowerShell remoting session from Server1 to Server2?
Answer(s): E
HOTSPOT (Drag and Drop is not supported)Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. Contoso.com contains an organizational unit (OU) named OU1.You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named fabrikam.com. Fabrikam.com syncs with contoso.com.In Sub1, you create a Microsoft Entra Domain Services domain configured as shown in the following table.In domain1.onmicrosoft.com, you create two OUs named OU1 and OU2.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
If you add a user named User1 to OU1 in contoso.com, User1 will sync with the AADDC Users OU in domain1.onmicrosoft.com. - No User1 belongs to the contoso.com domain, and although there is synchronization between fabrikam.com and contoso.com, the user will not automatically sync with the AADDC Users OU in domain1.onmicrosoft.com.If you add a user named User2 to OU2 in domain1.onmicrosoft.com, User2 will sync with fabrikam.com. - No Users in OUs created in domain1.onmicrosoft.com are specific to that domain and will not sync with fabrikam.com unless explicitly configured with synchronization policies, which does not seem to be the case here.If you add a user named User3 to fabrikam.com, User3 will sync with the Users container in domain1.onmicrosoft.com. - Yes Since fabrikam.com syncs with domain1.onmicrosoft.com, adding a user to fabrikam.com will result in the user being synced to domain1.onmicrosoft.com.
HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.You have a Microsoft Entra tenant.You need to implement Microsoft Entra Connect Sync. The solution must meet the following requirements:-Prevent the password hashes of contoso.com from being synced to the Microsoft Entra tenant.-Minimize user effort when authenticating to Microsoft Entra registered apps.-Minimize the number of on-premises infrastructure components.What should you include in the solution for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Prevent contoso.com password hashes from being synced to the tenant - Pass-through Authentication Pass-through Authentication allows users to authenticate directly against the on-premises Active Directory without syncing password hashes to the cloud, meeting the requirement of not syncing password hashes to the Microsoft Entra tenant.Minimize user effort when authenticating to Microsoft Entra registered apps - Single Sign-On (SSO) Single Sign-On (SSO) minimizes user effort by allowing users to sign in once and access all registered apps without the need to re-enter credentials. This meets the goal of simplifying authentication for users.
HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com.You create the resources shown in the following table.You create the Group Policy Objects (GPOs) shown in the following table.You configure the Group Policy Preferences shown in the following table.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
If User1 signs in to Comp1, a shortcut named Link4 will appear on the computer's desktop - No User1 is in OU1, and Comp1 is in OU2. GPO2, which applies to OU2, contains the setting for Link4 in the UserConfiguration. Since User1 is not part of OU2, Link4 will not appear on the desktop.If User2 signs in to Comp1, a shortcut named Link2 will appear on the computer's desktop - Yes User2 is part of Group1, which is in OU1, and GPO1 is linked to OU1. GPO1's User Configuration will apply, which includes creating the Link2 shortcut.If User3 signs in to Comp1, a shortcut named Link2 will appear on the computer's desktop - No User3 is part of Group1, which is in OU2. GPO2 applies to OU2 and contains settings for Link3 and Link4, not Link2. Therefore, Link2 will not appear on the desktop for User3.
HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains two domains named contoso.com and east.contoso.com. Contoso.com contains two users named CONTOSO\User1 and EAST\User2.You need to ensure that the users can perform the following tasks:-User1 must deploy an additional domain controller to east.contoso.com.-User2 must deploy a new domain controller that will host a domain named west.contoso.com.The solution must follow the principle of least privilege.To which group should you add each user? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: EAST\DOMAIN Admins CONTOSO\User1 User1 must deploy an additional domain controller to east.contoso.com.Domain admin in the east.comtoso.com (EAST) domainIncorrect: * CONTOSO\Domain Admins - wrong domain * CONTSOSO\Enterprise Admins - too powerful Enterprise Admins is a member of the Administrators group in all domains in a forest. * CONTSOSO\Schema Admins - wrong domain, wrong type of adminBox 2: CONTOSO\Domain Admins EAST\User2. User2 must deploy a new domain controller that will host a domain named west.contoso.com.* CONTSOSO\Enterprise Admins - too powerful Enterprise Admins is a member of the Administrators group in all domains in a forest. * CONTSOSO\Schema Admins - type of admin * EAST\DOMAIN Admins - wrong domain
https://www.ravenswoodtechnology.com/ad-roles-enterprise-admins-and-schema-admins
HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains the groups shown in the following table.You need to implement a group nesting strategy.Which groups can be added as members of Group12, and which groups can be added as members of Group21? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Group13 only. Group12 is Global in contoso.com. A global group can contain users, computers and global groups from the same domain. Only Group13 is also a Global group in contoso.com.* Group11 - No Group11 is Domain local group in contoso.com.* Group13 - Yes Group13 is Global group in contoso.com.* Group14 - No Group14 is Universal group in contoso.com.* Group21 Group21 is Universal group in east.contoso.com.Box 2: Group12, Group13, and Group14 only. Group21 Group21 is Universal group in east.contoso.com. A universal group can contain users, global groups, and other universal groups from any domain in the forest.Group21 can contain all groups except Group11 as it is domain local.* Group11 - No Group11 is Domain local group in contoso.com.* Group12 - Yes Group12 is Global in contoso.com.* Group13 - Yes Group13 is Global group in contoso.com.* Group14 - Yes Group14 is Universal group in contoso.com.Note: Active Directory Nested Groups Explained Nesting of Global Groups Global groups are generally used to grant rights to a set of AD users who have similar job responsibilities (such as all accountants or all members of the Marketing department).*-> A global group can contain users, computers and global groups from the same domain. * A global group can be a member of domain local groups or other global groups in the same domain.Nesting of Universal Groups Universal groups generally have other groups, rather than individual users or computers, as members.*-> A universal group can contain users, global groups, and other universal groups from any domain in the forest. * A universal group can be a member of domain local groups or other universal groups. * A universal group cannot be a member of a global group.
https://blog.netwrix.com/2023/04/26/active-directory-nested-groups/
HOTSPOT (Drag and Drop is not supported)Your network contains a Microsoft Entra Domain Services domain named sk230128outlook.onmicrosoft.com. The domain contains a server named Server1 that runs Windows Server.You have the users shown in the following table.The domain contains the Group Policy Objects (GPOs) shown in the following exhibit.The minimum password length for each GPO is configured as shown in the following table.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: Yes Yes - If User1 changes their password, the new password must be at least 10 characters.User1 is a domain user in the AADDC Users organizational unit (OU). The AADDC Users GPO has the minimum password length set to 10.Note: In an Entra Domain, a Group Policy Object (GPO) linked to an Organizational Unit (OU) with a minimum password length will override the default Domain Policy's minimum password length. GPOs linked to OUs have a higher precedence than the default Domain Policy when it comes to password policies.Precedence: When an object (like a user or computer) is located within an OU, the GPO settings linked to that OU take precedence over the default Domain PolicyBox 2: No No - If User2 changes their password, the new password must be at least seven characters.User2 is a local user on Server1. The AADDC Computers GPO has a minimum password length of 7, but it does not apply to local users in a server in the domain. The default Domain Policy has a minimum password length of 9 will be applied.Note: In an Entra Domain Services managed domain, the AADDC Computers GPO minimum password length policy primarily applies to users created directly within the managed domain.Box 3: Yes Yes - If User3 changes their password, the new password must be at least 13 characters.User3 is a domain user in an organizational unit (OU) named OU1.GPO1 is linked to OU1. GPO1 is configured with a minimum password length of 13.
https://learn.microsoft.com/en-us/entra/identity/domain-services/password-policy
Post your Comments and Discuss Microsoft AZ-800 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-800 content, but please register or login to continue.