HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com that has the domains shown in the following table.You are creating a disaster recovery plan for the forest.What is the minimum number of domain naming FSMO role holders and RID master FSMO role holders that should be online to maintain full functionality of the forest? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: 1 Domain naming role holdersIn a multi-domain Active Directory forest, you should have at least one Domain Naming Master and one RID Master online for full functionality. The Domain Naming Master role is forest-wide, while the RID Master role is per-domain. Having at least one of each ensures that domain creation and object creation/movement can continue without interruption.Box 2: 5 RID master: Five RID masters, one for each domain.
https://theitbros.com/fsmo-roles/
HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com.You have a partner company named ADatum Corporation that has an AD DS forest named adatum.com.You configure the trust relationship shown in the following exhibit.The forests contain the groups shown in the following table.The ADatum domains contain the member servers shown in the following table.For each of the following statements, select Yes if the statement is true Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: No No - Group2 can be assigned permissions for the resources on Server2.Group2 is a Domain local group in the adatum.com domain. Server2 is in the west.adatum.com.A domain local group in one domain cannot be directly assigned resources in a server located in a subdomain. Domain local groups are primarily used to grant permissions to resources within the same domain where they are created. While they can contain members from other domains, their scope of permissions is limited to the domain they belong to.Note: Domain local groups are designed to manage access to resources within their own domain.Box 2: Yes Yes - Group3 can be added as a member of Group1.Group3 is a Global group in the west.adatum.com. Group1 is a Domain local group in contoso.com. A global group from one domain can be added as a member to a domain local group in another domain, provided the domains trust each other. This is a common practice for managing permissions across domainsBox 3: Yes Yes - Group4 can be assigned permissions for the resources on Server1.Group4 is a Universal group in the contoso.com domain. Server1 is in the adatum.com domain. A Universal group in one domain can indeed be assigned permissions to resources in another domain,provided both domains are part of the same Active Directory forest. This is one of the key features of Universal groups, which allows for centralized management of permissions across multiple domains.
https://blog.netwrix.com/2023/04/26/active-directory-nested-groups/ https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.Your network contains an Active Directory Domains Services (AD DS) domain named contoso.com.You implement a central store.You create a new Group Policy Object (GPO) named GPO1.When you attempt to edit GPO1, you see the settings shown in the exhibit. (Click the Exhibit tab.)You need to ensure that all settings are available.Solution: You delete the \\contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions folder.Does this meet the goal?
Answer(s): B
In an Active Directory Domains Services (AD DS) domain with a central store, how to ensure that a GPO have all settings available?Correct: * You copy the contents of the C:\Windows\PolicyDefinitions folder to the central store. To ensure a Group Policy Object (GPO) in an Active Directory domain with a central store has all settings available, you need to ensure the .admx and .adml files for those settings are present in the central store (the PolicyDefinitions folder within the SYSVOL share). These files contain the administrative templates that define the available settings within a GPO.Incorrect: * You delete the \\contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions folder. * You modify the properties of GPO1.Note:1. Understanding the Central Store: The central store is a designated location on a domain controller (typically \\<domain>\SYSVOL\<domain> \Policies\PolicyDefinitions) where administrative template files (.admx and .adml) are stored. It ensures that all domain controllers have the same set of administrative templates for managing Group Policy, preventing inconsistencies. It replaces the older method of storing templates within individual GPOs.2. Ensuring Template Availability: Locate and Download Templates: Download the necessary .admx and .adml files for the specific features or applications you want to manage. These can often be found on Microsoft's website, from the application vendor, or in the operating system's installation media.3. Managing GPOs: Edit GPOs: Open Group Policy Management (GPMC) and edit the desired GPO. *-> Access Settings: When you browse the Computer or User Configuration settings in the Group Policy Management Editor, the available settings will be populated based on the templates in the central store. Configure Settings: Configure the desired settings within the GPO as needed.
https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/create-and-manage-central-store
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.Your network contains an Active Directory Domains Services (AD DS) domain named contoso.com.You implement a central store.You create a new Group Policy Object (GPO) named GPO1.When you attempt to edit GPO1, you see the settings shown in the exhibit. (Click the Exhibit tab.)You need to ensure that all settings are available.Solution: You modify the properties of GPO1.Does this meet the goal?
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.Your network contains an Active Directory Domains Services (AD DS) domain named contoso.com.You implement a central store.You create a new Group Policy Object (GPO) named GPO1.When you attempt to edit GPO1, you see the settings shown in the exhibit. (Click the Exhibit tab.)You need to ensure that all settings are available.Solution: You copy the contents of the C:\Windows\PolicyDefinitions folder to the central store.Does this meet the goal?
Your network contains an Active Directory Domains Services (AD DS) forest named adatum.com. Adatum.com contains the users shown in the following table.You deploy a workgroup server named RODC1 that runs Windows Server. RODC1 contains a user named User4 that is a member of the local Administrators group.You pre-create a read-only domain controller (RODC) account named RODC1 in east.adatum.com and delegate RODC installation and administration permissions to User3.You sign-in to RODC1 as User4.Which credentials can be used to promote RODC1 to a RODC in east.adatum.com?
Answer(s): C
* User1 - Yes An Enterprise admin can promote a workgroup server to a domain controller within an existing Active Directory subdomain. This process involves installing the Active Directory Domain Services (AD DS) role on the server and then using the AD DS Configuration Wizard to add it as a domain controller for the specific subdomain.* User2 - Yes User2 is domain admin in the subdomain.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-installation-and-removal-wizard-page-descriptions
HOTSPOT (Drag and Drop is not supported)Your on-premises network contains an Active Directory Domain Services (AD DS) domain named fabrikam.com. The domain contains a domain controller named DC1. DC1 has the DNS Server role installed and hosts the DNS primary zone for fabrikam.com.You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a virtual machine named VM1.The on-premises network is connected to Azure by using a Site-to-Site (S2S) VPN.From the Azure Command-Line interface (CLI), you run the following commands.New-AzPrivateDnsZone -Name azure.fabrikam.com -ResourceGroupName RG1New-AzPrivateDnsVirtualNetworkLink -ZoneName "azure.fabrikam.com" -ResourceGroupName "RG1" -Name "DNSlink" -VirtualNetworkId $VNET1.idFor each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: No No - Adding a zone delegation to fabrikam.com will enable on-premises hosts to resolve records in azure.fabrikam.comA zone delegation to fabrikam.com is not the correct method; you need to configure conditional forwarding from your on-premises DNS server to the Azure DNS virtual network link to resolve records in azure. fabrikam.com. A zone delegation would delegate the entire fabrikam.com zone to Azure, which is not what you want.Box 2: Yes Yes - Adding a conditional forwarder to DC1 will enable on-premises hosts to resolve records in azure.fabrikan.com Conditional forwarding What it is: Conditional forwarding sends specific DNS queries to a different DNS server.How to implement: On your on-premises DNS server, you will configure a conditional forwarder. You will specify that queries for the azure.fabrikam.com subdomain should be sent to the DNS servers in your Azure Virtual Network. In Azure, you will need to ensure the virtual network is configured to use the on-premises DNS servers for its DNS resolution.Why it's right: This allows your on-premises DNS server to continue resolving records for on-premises.fabrikam.com while forwarding only the specific azure.fabrikam.com queries to Azure. This way, on-premises hosts can resolve both on-premises and Azure resources by querying only their local DNS server.Box 3: Yes Yes - VM1 will be registered in azure.fabrikam.com automatically.A virtual machine in the Azure virtual network can be automatically registered in the fabrikam.com domain, but it depends on the proper DNS configuration. For this to work, the Azure virtual network must be configured to use the on-premises DNS servers for name resolution, which is a common setup for a hybrid environment where Azure resources need to join the existing domain.
https://learn.microsoft.com/en-us/azure/architecture/example-scenario/identity/adds-extend-domain https://learn.microsoft.com/en-us/azure/architecture/example-scenario/identity/adds-extend-domain
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two domain controllers named DC1 and DC2. DC2 runs on a Hyper-V virtual machine.You plan to deploy a new domain controller by cloning DC2.You need to create the CustomDCCloneAllowList.xml and the DCCloneConfig.xml files for DC2.In which folder should you save the files?
Answer(s): D
Place both the CustomDCCloneAllowList.xml and DCCloneConfig.xml files in the directory where the Active Directory database (ntds.dit) is located, which is typically C:\Windows\NTDS on the source domain controller. Alternatively, both files can be placed on the root of a removable media drive.File locations CustomDCCloneAllowList.xml Primary location: The C:\Windows\NTDS folder on the source domain controller, as it is the same location as the ntds.dit file. Alternative location: The root of a removable read/write media drive (e.g., a USB drive). DCCloneConfig.xml Primary location: The C:\Windows\NTDS folder on the source domain controller, as this is the default location where the New-ADDCCloneConfigFile cmdlet places the file when run on the source DC.Alternative location: The root of a removable read/write media drive.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/virtualized-domain-controller-deployment-and-configuration
Post your Comments and Discuss Microsoft AZ-800 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-800 content, but please register or login to continue.