Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain controllers.You plan to store a DNS zone in a custom Active Directory partition.You need to create the Active Directory partition for the zone. The partition must replicate to only four of the domain controllers.What should you use?
Answer(s): D
For this question these are the correct answers: * dnscmd.exe * ntdsutil.exeFor this question these are the incorrect answers: * Active Directory Administrative Center * Active Directory Sites and Services * DNS Manager * New-ADObject * Set-DnsServer * Windows Admin CenterExplanation for dnscmd.exe: How to create and apply a custom application directory partition on an Active Directory integrated DNS zoneYou can create a custom Active Directory partition by using the DnsCmd command.Create an application directory partition by using the DnsCmd command Use the DnsCmd command to create an application directory partition. To do this, use the following syntax:DnsCmd ServerName /CreateDirectoryPartition FQDN of partitionTo create an application directory partition that is named CustomDNSPartition on a domain controller that is named DC-1, follow these steps:1. Click Start, click Run, type cmd, and then click OK.2. Type the following command, and then press ENTER:dnscmd DC-1 /createdirectorypartition CustomDNSPartition.contoso.com When the application directory partition has been successfully created, the following information appears:DNS Server DC-1 created directory partition: CustomDNSPartition.contoso.com Command completed successfully.
HOTSPOT (Drag and Drop is not supported)You have an Active Directory Domain Services (AD DS) domain that contains a group named Group1.You need to create a group managed service account (gMSA) named Account1. The solution must ensure that Group1 can use Account1.How should you complete the script? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: New-ADServiceAccount New-ADServiceAccount Creates a new Active Directory managed service account or group managed service account object.Description The New-ADServiceAccount cmdlet creates a new Active Directory managed service account. By default, the cmdlet creates a group managed service account.Example: Create an enabled managed service accountPS C:\> New-ADServiceAccount -Name "Service01" -DNSHostName "Service01.contoso.com" -Enabled $TrueThis command creates an enabled managed service account in Active Directory Domain Services (AD DS).Box 2: -PrincipalsAllowedToDelegateToAccount Parameters include: -PrincipalsAllowedToDelegateToAccount Specifies the accounts that can act on the behalf of users to services running as this managed service account or group-managed service account. This parameter sets the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of the object.Type: ADPrincipalIncorrect: -AuthenticationPolicy Specifies an Active Directory Domain Services authentication policy object. Specify the authentication policy object in one of the following formats:Distinguished name GUID Name This parameter can also get this object through the pipeline or you can set this parameter to an object instance.Type: AuthenticationPolicy-Instance Specifies an instance of a service account object to use as a template for a new service account object.You can use an instance of an existing service account object as a template or you can construct a new service account object for template use. You can construct a new service account using the Windows PowerShell command line or by using a script.Note: Specified attributes are not validated, so attempting to set attributes that do not exist or cannot be set raises an error.Type: ADServiceAccount
https://learn.microsoft.com/en-us/powershell/module/activedirectory/new-adserviceaccount
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant.You deploy an app that adds custom attributes to the domain.From Azure Cloud Shell, you discover that you cannot query the custom attributes of users.You need to ensure that the custom attributes are available in Microsoft Entra ID.Which task should you perform from Microsoft Entra Connect sync first?
You have an Active Directory Domain Services (AD DS) domain that contains the domain controllers shown in the following table.The domain contains an app named App1 that uses a custom application partition to store configuration data.You decommission App1.When you attempt to remove the custom application partition, the process fails.Which domain controller is unavailable?
Answer(s): C
The Domain Naming Master is used to add and to remove domains and application partitions to and from the forest. - Must be online when domains and application partitions in a forest are added or removed.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/fsmo-placement-and-optimization-on-ad-dcs
Your network contains an Active Directory Domain Services (AD DS) domain.You plan to use Active Directory Administrative Center to create a new user named User1.Which two attributes are required to create User1? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): C,D
To create test users 1. Right click the Windows PowerShell icon, click Run as Administrator and type dsac.exe to open ADAC.2. Click Manage, click Add Navigation Nodes and select the appropriate target domain in the Add Navigation Nodes dialog box and then click OK.3. In the Tasks pane, click New and then click User.4. Enter the following information under Account and then click OK:Full name: test1 User SamAccountName logon: test1 Password: p@ssword1 Confirm password: p@ssword1 Repeat the previous steps to create a second user, test2.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/adac/introduction-to-active-directory-administrative-center-enhancements--level-100-
HOTSPOT (Drag and Drop is not supported)Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains the servers shown in the following table.The domain controllers do NOT have internet connectivity.You plan to implement Microsoft Entra Password Protection for the domain.You need to deploy Microsoft Entra Password Protection agents. The solution must meet the following requirements:-All Microsoft Entra Password Protection policies must be enforced.-Agent updates must be applied automatically.-Administrative effort must be minimized.What should you do? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: DC1 and DC2 only Install the Azure AD Password Protection agent onIncorrect: * RODC1 Read-only domain controller considerations Password change or set events aren't processed and persisted on read-only domain controllers (RODCs). Instead, they're forwarded to writable domain controllers. You don't have to install the Microsoft Entra Password Protection DC agent software on RODCs.Box 2: Server2 Install the Azure AD Password Protection Proxy onMicrosoft Entra Password Protection proxy service The following requirements apply to the Microsoft Entra Password Protection proxy service: * Network access must be enabled for the set of ports and URLs specified in the Application Proxy environment setup procedures.* Etc. Note: Deployment strategy The following diagram shows how the basic components of Microsoft Entra Password Protection work together in an on-premises Active Directory environment:
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy
HOTSPOT (Drag and Drop is not supported)Your on-premises network contains a single-domain Active Directory Domain Services (AD DS) forest. You have a Microsoft Entra tenant named contoso.com. The AD DS forest syncs with the Microsoft Entra tenant by using Microsoft Entra Connect.You need to ensure that users in the forest that have a custom attribute of NoSync are excluded from synchronization.How should you configure the Microsoft Entra Connect cloudFiltered attribute, and which tool should you use? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: True Attribute-based filteringInbound filtering Inbound filtering uses the default configuration, where objects going to Microsoft Entra ID must have the metaverse attribute cloudFiltered not set to a value to be synchronized. If this attribute's value is set to True, then the object isn't synchronized. It shouldn't be set to False, by design. To make sure other rules have the ability to contribute a value, this attribute is only supposed to have the values True or NULL (absent).Box 2: Synchronization Rules Editor Example. Negative filtering: "do not sync these" In the following example, you filter out (not synchronize) all users where extensionAttribute15 has the value NoSync.1. Sign in to the server that is running Microsoft Entra Connect Sync by using an account that is a member of the ADSyncAdmins security group. 2. Start *Synchronization Rules Editor* from the Start menu. 3. Make sure Inbound is selected, and click Add New Rule. 4. Etc.
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-configure-filtering
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK.You open a new branch office that contains only client computers.You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.Solution: You create a new site named Site4 and associate Site4 to DEFAULTIPSITELINK.Does this meet the goal?
Answer(s): B
Correct Solution: You create a new subnet object that is associated to Site1.By associating a site with one or more subnets, you assign a set of IP addresses to the siteDNS uses the site name to locate a domain controller in that site (or in the next closest site to the client). DNS then provides the IP address of the domain controller to the client for the purpose of connecting to the domain controller. For this reason, it is important to ensure that the IP address that you assign to a domain controller maps to a subnet that is associated with the site of the respective server objectNote: Assigning computers to sites Server objects are created in AD DS by applications or services, and they are placed into a site based on their IP address. When you add the Active Directory Domain Services server role to a server, a server object is created in the AD DS site that contains the subnet to which the server's IP address maps. If the domain controller's IP address does not map to any site in the forest, the domain controller's server object is created in the site of the domain controller that provides the replication source for AD DS.
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ cc754697(v=ws.11)
Post your Comments and Discuss Microsoft AZ-800 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-800 content, but please register or login to continue.