Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains domain controllers that run Windows Server 2019 and are configured as shown in the following table.You plan to run the adprep /domainprep commandWhich domain controller should be available for the command to complete?
Answer(s): D
AD DS installation prerequisite validationThe AD DS installation wizard checks that the following prerequisites are met before the installation begins.This provides you with a chance to correct issues that can potentially block installation.For example, Adprep-related prerequisites include:Adprep credential verification: If adprep needs to be run, the installation wizard verifies that the user has sufficient rights to execute the required Adprep operations.*-> Schema master availability check: If the installation wizard determines that adprep /forestprep needs to be run, it verifies that the schema master is online and fails otherwise.Infrastructure master availability check: If the installation wizard determines that adprep /domainprep needs to be run, it verifies that the infrastructure master is online and fails otherwise.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/what-s-new-in-active-directory-domain- services-installation-and-removal
DRAG DROP (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two users named User1 and User2 that are members of the Domain Admins group.You need to harden security for the domain. The solution must meet the following requirements:Minimize risks associated with the Domain Admins group and privilege escalation on the domain. Ensure that the built-in administrator account can perform forest recovery operations.Reduce the attack surface of the Domain Admins groups.Follow the principle of least privilege.How should you modify the Domain Admins group, and which user rights should you assign to the Domain Admins group? To answer, drag the appropriate options to the correct requirements. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Answer(s): A
Box 1: Remove the built-in administrator accountFor the Domain Admins groupNote: The built-in Administrator account in an Active Directory forest can perform forest recovery operations, even if it's removed from the Domain Admins group, because membership in the domain's default Built-in Administrators group grants the necessary privileges, not the Domain Admins group. Forest recovery requires a specific user account with extensive privileges, and the built-in Administrator account is inherently a member of the domain's built-in Administrators group, giving it a high level of control over directory objects and permissions required for recovery.Box 2: Deny access to this computer from the networkEtc.User rightsDedicated Admin Accounts:Do not use the Domain Admins group for everyday tasks like email or web browsing. Instead, create separate, dedicated accounts for administrative tasks.Separate Duties:Ensure that users with Domain Admins privileges do not also perform functions that require them to log in to member servers or workstations.Note:To maximize security for the Domain Admins group, implement a Tiered Administration model using dedicated admin accounts [Box 1: Remove the built-in administrator account], leverage Secure Administrative Workstations (SAWs), and configure Group Policy Objects (GPOs) to deny remote access for members of Domain Admins from member servers and workstations. Additionally, disable the Domain Admins group from logging on locally to member servers and workstations [Box 2], enable robust auditing, and monitor for any compromise or membership changes to the group.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-f-- securing-domain-admins-groups-in-active-directory
DRAG DROP (Drag and Drop is not supported)You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server.You need to encrypt the disks connected to VM1 by using Azure Disk Encryption. The solution must use a key encryption key (KEK).Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
To secure a Windows VM disk with Azure Disk Encryption using a KEK, first, create or select an Azure Key Vault. Then, create a Key Encryption Key (KEK) within that Key Vault, ensuring it's an RSA key. Finally, enable Azure Disk Encryption on the VM, specifying the Key Vault and the KEK to use for protecting the encryption keys, which will also trigger the installation of the ADE VM extension to manage the encryption process.Step 1: Create an Azure Key VaultCreate or Select an Azure Key VaultStep 2: Run Add-AzKeyVaultKeyGenerate a Key Encryption Key (KEK)The Add-AzKeyVaultKey cmdlet creates a key in a key vault in Azure Key Vault, or imports a key into a key vault.Step 3: Run Set-AzVMDiskEncryption ExtensionEnable Azure Disk Encryption on the VM.The Set-AzVMDiskEncryptionExtension cmdlet enables encryption on a running infrastructure as a service (IaaS) virtual machine in Azure. It enables encryption by installing the disk encryption extension on the virtual machine.
https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-overview https://learn.microsoft.com/en-us/powershell/module/az.keyvault/add-azkeyvaultkey https://learn.microsoft.com/en-us/powershell/module/az.compute/set-azvmdiskencryptionextension
DRAG DROP (Drag and Drop is not supported)You have a server named Server1 that runs Windows Server and contains two volumes named C and D.You connect a disk to Server1 that is encrypted by using BitLocker and contains a volume named E.You need to ensure that after a restart, the data on volume E can be accessed without providing a password or a recovery key.Which three actions should you perform on Server1 in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Step 1: Install the BitLocker Drive Encryption Administration Utilities feature Need it to encrypt the OS volume.Note: The "BitLocker Drive Encryption Administration Utilities feature" refers to the suite of tools, including the Control Panel applet and PowerShell cmdlets, that allow users and IT professionals to manage BitLocker encryption on Windows operating systems. These utilities provide the functionality to encrypt entire drives, manage encryption keys, configure startup authentication methods (like PINs or TPMs), and recover encrypted volumes, protecting data from unauthorized access on lost, stolen, or improperly decommissioned devices.Step 2: Encrypt volume CNeed to encrypt the OS volume for bitlocker auto-unlockStep 3: Turn on auto-unlockBitLocker auto-unlock is a feature that allows BitLocker-encrypted data volumes (like a secondary hard drive or a connected USB drive) to be automatically unlocked after the operating system drive has been manually unlocked. It eliminates the need for repeated password entry on the data volume after the main OS drive has been authenticated, providing a seamless user experience for frequently accessed data drives.Key characteristicsRequires OS drive encryption: Auto-unlock only functions if the operating system drive itself is also encrypted and protected with BitLocker.Incorrect:* Install the BitLocker Network Unlock feature.BitLocker Network Unlock is a Windows feature that allows BitLocker-protected computers connected to a wired corporate network to automatically unlock their operating system volume during startup, eliminating the need for a user to enter a PIN or password to begin the boot process.* Install the BitLocker Drive Encryption featureBitLocker drive encryption is a security feature in Microsoft Windows that encrypts entire hard drives or removable drives using the Advanced Encryption Standard (AES) algorithm to protect data from unauthorized access. It utilizes a Trusted Platform Module (TPM) chip or a removable USB startup key to manage encryption keys and unlock the drive, ensuring data is unreadable if the computer is lost, stolen, or tampered with, especially when the operating system is offline.
https://learn.microsoft.com/en-us/answers/questions/1332350/auto-unlock-bitlocked-drives
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a domain controller named DC1.The domain uses Microsoft Entra Connect sync with a Microsoft Entra tenant and uses Microsoft Entra Password Protection to enforce a custom banned password list.You deploy a new domain controller named DC2 to the domain.You discover that the custom banned password list is applied inconsistently and often allows banned passwords to be used.You need to ensure that the custom banned password list is always enforced.What should you do on DC2?
Incremental deploymentMicrosoft Entra Password Protection supports incremental deployment across DCs in an AD DS domain. It's important to understand what this really means and what the tradeoffs are.The Microsoft Entra Password Protection DC agent software can only validate passwords when it's installed on a DC, and only for password changes that are sent to that DC. It's not possible to control which DCs are chosen by Windows client machines for processing user password changes. To guarantee consistent behavior and universal Microsoft Entra Password Protection security enforcement, the DC agent software must be installed on all DCs in a domain.
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad-on-premises
Post your Comments and Discuss Microsoft AZ-801 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-801 content, but please register or login to continue.