DRAG DROP (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two servers named Server1 and Server2 that run Windows Server 2022.You plan to deploy an app named App1 that will be load balanced between Server1 and Server2.You need to create an identity that will be used to run App1 on Server1 and Server2. The solution must meet the following requirements:-The password for the identity must be changed regularly.-Administrative effort must be minimized.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Answer(s): A
Step 1: Create a Key Distribution Services (KDS) root keyStep 2: Create a group managed account (gMSA) Group managed service accounts For services that run in your on-premises environment, use group managed service accounts (gMSAs) whenever possible. gMSAs provide a single identity solution for services that run on a server farm or behind a network load balancer. gMSAs can also be used for services that run on a single server. Deploying a new server farm Part 1: Provisioning group Managed Service Accounts You can create a gMSA only if the forest schema has been updated to Windows Server 2012 , the master root key (Step 1) for Active Directory has been deployed, and there is at least one Windows Server 2012 DC in the domain in which the gMSA will be created.Step 3: Install the service account on Server1 and Server2 Part 2: Configuring service identity application service
https://learn.microsoft.com/en-us/entra/architecture/service-accounts-on-premises
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1.On Server1, you install Windows Admin Center and use Windows Admin Center to remove BUILTIN\Users from the allowed groups.You discover that all users can still sign in to Windows Admin Center.You need to prevent unauthorized users from signing in to Windows Admin Center.What should you do in Windows Admin Center?
Answer(s): D
You have on-premises servers that run Windows Server as shown in the following table.You have an Azure subscription that contains a virtual machine named VM1.You need to ensure that you can manage all the servers by using Azure Arc. The solution must minimize administrative effort.On which servers should you install the Azure Connected Machine agent?
Answer(s): E
HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the servers shown in the following table.The domain contains the users shown in the following table.On Server2, you run the Enable-PSRemoting cmdlet.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: Yes Yes - User1 can establish a PowerShell remoting session from Server1 to Server2.User1 is an Administrator of Contoso.Box 2: Yes Yes- User2 can establish a PowerShell remoting session from Server2 to DC1.User2 is a Remote Management User.Box 3: No No - User3 can establish a PowerShell remoting session from Server1 to Server2.User3 is a Power User only. Need to be Administrator or Remote Management User.Note: The Enable-PSRemoting cmdlet configures the computer to receive PowerShell remote commands that are sent by using the WS-Management technology. WS-Management based PowerShell remoting is currently supported only on Windows platform.Example: Create a remote session to the newly enabled endpoint configuration This example shows how to enable PowerShell remoting on a computer, find the configured endpoint names, and create a remote session to one of the endpoints.Enable-PSRemoting -ForceGet-PSSessionConfiguration$session = New-PSSession -ComputerName localhost -ConfigurationName PowerShell.7Invoke-Command -Session $session -ScriptBlock { $PSVersionTable }WARNING: PowerShell remoting has been enabled only for PowerShell Core configurations and does not affect Windows PowerShell remoting configurations. Run this cmdlet in Windows PowerShell to affect all PowerShell remoting configurations.Name : PowerShell.7 PSVersion : 7.3 StartupScript : RunAsUser : Permission : NT AUTHORITY\INTERACTIVE AccessAllowed, BUILTIN\Administrators AccessAllowed, <--* BUILTIN\Remote Management Users AccessAllowed <--*Etc.
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting
Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains a user named User1 and the servers shown in the following table.User1 is a member of the Protected Users security group.User1 performs the following actions:-From Server1, establishes a remote PowerShell session on Server2-From the PowerShell session on Server2, attempts to access a resource on Backup1The request to access the resource on Backup1 is denied.You need to ensure that User1 can access the resources on Backup1 by using the PowerShell session on Server2. The solution must follow the principle of least privilege and minimize administrative effort.What should you configure?
Resource-based constrained delegation across domains Kerberos constrained delegation can be used to provide constrained delegation when the front-end service and the resource services are not in the same domain. Service administrators are able to configure the new delegation by specifying the domain accounts of the front-end services which can impersonate users on the account objects of the resource services.What value does this change add?By supporting constrained delegation across domains, services can be configured to use constrained delegation to authenticate to servers in other domains rather than using unconstrained delegation. This provides authentication support for across domain service solutions by using an existing Kerberos infrastructure without needing to trust front-end services to delegate to any service.This also shifts the decision of whether a server should trust the source of a delegated identity from the delegating-from domain administrator to the resource owner.Incorrect: Not A: Kerberos is an authentication protocol that is used to verify the identity of a user or host.Delegated authentication. Services that run on Windows operating systems can impersonate a client computer when accessing resources on the client's behalf. In many cases, a service can complete its work for the client by accessing resources on the local computer. When a client computer authenticates to the service, NTLM and Kerberos protocol provide the authorization information that a service needs to impersonate the client computer locally. However, some distributed applications are designed so that a front-end service must use the client computer's identity when it connects to back-end services on other computers. Kerberos authentication supports a delegation mechanism that enables a service to act on behalf of its client when connecting to other services.Not B: CredSSP The Credential Security Support Provider (CredSSP) Protocol enables an application to securely delegate a user's credentials from a client to a target server. For example, the Microsoft Terminal Server uses the CredSSP Protocol to securely delegate the user's password or smart card PIN from the client to the server to remotely log on the user and establish a terminal services session.Not C: The Register-PSSessionConfiguration cmdlet creates and registers a new session configuration on the local computer. This is an advanced cmdlet that you can use to create custom sessions for remote users.Every PowerShell session (PSSession) uses a session configuration, also known as an endpoint. When users create a session that connects to the computer, they can select a session configuration or use the default session configuration that's registered when you enable PowerShell remoting. Users can also set the $PSSessionConfigurationName preference variable, which specifies a default configuration for remote sessions created in the current session.
https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-cssp/e36b36f6-edf4-4df1-9905-9e53b7d7c7b7 https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/register-pssessionconfiguration
You have 50 on-premises servers that run Windows Server.You have an Azure subscription.You plan to monitor the on-premises servers by using Azure Monitor.You need to collect event logs from the on-premises servers.What should you do first?
Answer(s): B
To collect event logs from on-premises servers using Azure Monitor, the first step is to create a Log Analytics workspace. The Log Analytics workspace serves as the central repository for all logs and metrics gathered from the monitored systems. After creating the workspace, you can then install the Azure Monitor agent on the on-premises servers and configure data collection rules (DCR) to gather specific logs, such as event logs.
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server and computers that run Windows.You link a Group Policy Object (GPO) to the domain and set Turn on BranchCache to Enabled.You need to enable BranchCache in BranchCache Distributed Cache mode.What should you configure on the computers?
Use Group Policy to Configure Domain Member Client ComputersYou can create a Group Policy Object for all of the computers in your organization, configure domain member client computers with distributed cache mode or hosted cache mode, and then configure Windows Firewall with Advanced Security to allow BranchCache traffic.Note: To configure Windows Firewall with Advanced Security Inbound Traffic Rules 1. In the Group Policy Management console, expand the following path: Forest: example.com, Domains,-example.com, Group Policy Objects, where example.com is the name of the domain where the BranchCache client computer accounts that you want to configure are located.-2. In the Group Policy Management console, ensure that Group Policy Objects is selected, and in the details pane right-click the BranchCache client computers GPO that you created previously. For example, if you named your GPO BranchCache Client Computers, right-click BranchCache Client Computers. Click Edit. The Group Policy Management Editor console opens.3. In the Group Policy Management Editor console, expand the following path: Computer Configuration,-Policies, Windows Settings, Security Settings, Windows Firewall with Advanced Security, Windows Firewall with Advanced Security - LDAP, Inbound Rules.4. Right-click Inbound Rules, and then click New Rule. The New Inbound Rule Wizard opens.5. In Rule Type, click Predefined, expand the list of choices, and then click BranchCache - Content Retrieval-(Uses HTTP). Click Next.6. In Predefined Rules, click Next.7. In Action, ensure that Allow the connection is selected, and then click Finish.8. To create the WS-Discovery firewall exception, again right-click Inbound Rules, and then click New Rule.-The New Inbound Rule Wizard opens.9. In Rule Type, click Predefined, expand the list of choices, and then click BranchCache - Peer Discovery-(Uses WSD). Click Next.10.In Predefined Rules, click Next.11.In Action, ensure that Allow the connection is selected, and then click Finish. Important You must select Allow the connection for the BranchCache client to be able to receive traffic on this port.
https://learn.microsoft.com/en-us/windows-server/networking/branchcache/deploy/use-group-policy-to-configure-domain-member-client-computers
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the servers shown in the following table.You need to ensure that from Server1, you can use Windows Admin Center to manage the DHCP Server role on Server2.What should you do first?
To manage the DHCP Server role on a separate server within the same AD DS domain using Windows Admin Center, you need to install the DHCP Server feature on the target server and ensure it is authorized in AD DS. Additionally, you need to install the DHCP module for Windows Admin Center and connect to the target server from within the Windows Admin Center interface.In essence, you're leveraging the power of Windows Admin Center to manage a remote DHCP server within your AD DS domain by extending its functionality with the DHCP module and connecting to the target server.Install the DHCP module in Windows Admin Center: You'll need to install the DHCP module (extension) within Windows Admin Center to manage the DHCP role.Note: Install and manage extensionsWindows Admin Center is built as an extensible platform where each connection type and tool is an extension that you can install, uninstall, and update individually. You can search for new extensions published by Microsoft and other developers, and install and update them individually without having to update the entire Windows Admin Center installation.
https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/configure/using-extensions
Post your Comments and Discuss Microsoft AZ-800 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-800 content, but please register or login to continue.