HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two domain controllers named DC1 and DC2.Active Directory Recycle Bin is disabled.You discover that an organizational unit (OU) named Finance and its child objects were deleted from DC1. The deletion replicated to DC2. DC1 has a system state backup from before the deletion. Changes to other AD DS objects were made after the backup.You need to recover only the Finance OU and its child objects. The solution must ensure that the recovered objects replicate to DC2, and the unrelated AD DS changes are preserved.What should you configure? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: Directory Services Restore Mode (DSRM) Directory Services Restore Mode (DSRM) (also referred to in the system configuration boot options as Active Directory repair) must be configured for DC1.Stops AD DS: Booting into DSRM ensures that Active Directory Domain Services are offline while allowing you to access the database files for restoration.Performs Authoritative Restore: After doing a non-authoritative system state restore from the backup, you use the ntdsutil tool while still in DSRM to mark the specific deleted OU and its child objects as authoritative.Preserves Later Changes: Marking only the target objects as authoritative ensures that when the domain controller reboots into normal mode and replicates, the restored OU overrides the deletion on the second controller, while newer, unrelated changes made after the backup are preserved.Box 2: Authoritative subtree restore An authoritative restore of a specific subtree using the ntdsutil command-line tool (while in DSRM) is the appropriate recovery method
https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/abandoned-objects-block-replication-global-catalog-naming-contexts
HOTSPOT (Drag and Drop is not supported)Your network contains the Active Directory Domain Services (AD DS) forests shown in the following table.You need to configure trust relationships as shown in the following table.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: No No, contoso.com users cannot access resources in adatum.com after both trusts are configured.Forest Trusts are not transitive across multiple forests: While a forest trust allows transitivity within the participant forests (covering all their child domains), the transitivity stops at the forest boundary. It does not automatically cross over into a third forest.The Trust Chain Breaks: In the configuration, you have established separate trust relationships linking contoso.com ↔ fabrikam.com and fabrikam.com ↔ adatum.com. Because trust cannot route implicitly through fabrikam.com from one external forest to another, there is no valid authentication path between contoso.com and adatum.com.Box 2: Yes Yes, a single two-way forest trust between contoso.com and fabrikam.com satisfies the first required trust relationship.By definition, a forest trust is inherently transitive across all child domains within the involved forests.When you establish a two-way forest trust between the root domains (contoso.com and fabrikam.com), the trust relationship automatically extends to all domains inside both forest infrastructures.This allows users from any domain in the contoso.com forest (contoso.com, europe.contoso.com, and asia.contoso.com) to be authenticated and access authorized resources in any domain in the fabrikam.com forest (fabrikam.com and research.fabrikam.com), and vice versa. No separate domain-level trusts are required to achieve this scope of access.Box 3: Yes Yes, a one-way external trust in which research.fabrikam.com trusts adatum.com fully satisfies the second trust relationship requirement.Direction of Trust vs. Direction of Access: In Active Directory, trust flows in one direction while resource access flows in the exact opposite direction. Setting up a one-way trust where research.fabrikam.com (the resource domain) trusts adatum.com (the user domain) means that authentication requests are passed to adatum.com. As a result, users from adatum.com are allowed to authenticate and access authorized resources inside research.fabrikam.com.Non-Transitivity of External Trusts: External trusts are explicitly non-transitive. This ensures that trust and access are strictly limited to the two specific domains involved (adatum.com and research.fabrikam.com). Users from adatum.com will not gain unauthorized access to the parent domain (fabrikam.com), keeping the rest of the forest isolated and secure.
https://learn.microsoft.com/en-us/entra/identity/domain-services/concepts-forest-trust
Your network contains an Active Directory Domain Services (AD DS) domain.A Group Policy Object (GPO) named Security Baseline is linked to the domain. The link is configured as Enforced.A GPO named Kiosk Baseline is linked to an organizational unit (OU) named Kiosks.Client computers in the Kiosks OU receive Group Policy settings from the Security Baseline GPO.You need to ensure that the computers in Kiosks receive settings from the Kiosk Baseline GPO. Security Baseline must continue to apply to other client computers in the domain.What should you do?
To make sure the computers in the organizational unit (OU) receive settings from Kiosk Baseline GPO, you must configure the Kiosk Baseline GPO link as Enforced.➔ ➔ ➔ Group Policy Objects (GPOs) are normally processed in the following order: Local Site Domain Organizational Unit (OU). Under default rules, settings applied closer to the client computer (the OU) override settings applied higher up (the Domain).However, when a GPO link is marked as Enforced (previously known as "No Override"), it breaks the standard order of precedence.A higher-level Enforced GPO (the domain-level GPO) will always override conflicting settings in a lower-level standard GPO (the OU-level GPO).When multiple GPOs are set to Enforced, Active Directory reverses its default logic: the Enforced GPO linked at the lowest level (closest to the object) wins.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing
HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.The domain contains a user named User1 and two global security groups named Group1 and Group2. User1 is a member of both groups.A Group Policy Object (GPO) named GPO1 is linked to the domain. GPO1 contains the following User Configuration preference items.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: No No, drive S will not be mapped.Failed Targeting: Item-level targeting requires both membership in the first global group and an IP address in the range of 10.10.0.0 to 10.10.255.255.IP Mismatch: The sign-in IP address (10.20.5.20) is outside the specified range. Because the targeting rule uses an AND condition, the entire filter evaluates to false.Removal Rule: The option Remove this item when it is no longer valid is selected, meaning the preference item will not apply or will be removed if the conditions are not met.Box 2: Yes Yes, the user will not have driven S in File Explorer after signing in.Targeting Condition Fails: Item-level targeting requires both the first global group and the IP address range 10.10.0.0 through 10.10.255.255. Removing the user from Group1 makes this targeting rule false.Removal Option Active: The setting "Remove this item when it is no longer valid" is selected. When targeting fails, the Group Policy engine actively removes the configuration.Continuous Evaluation: "Apply once and do not reapply" is disabled. This means the preference re-evaluates the targeting rules at every sign-in and policy update, enforcing the removal when conditions are no longer met.Box 3: Yes Yes, the shortcut is created once and never reapplied or recreated on future Group Policy refreshes.Targeting is met: The targeting uses an OR condition (member of the second global group OR local file exists). Because the user is in the second global group, the targeting condition evaluates to true even though the local file C:\Program files\SalesApp\SalesApp.exe does not exist on the client computer.Apply once setting: The option Apply once and do not reapply is selected for the shortcut. Group Policy Preferences applies the setting a single time and ignores it on all subsequent policy refreshes.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups
DRAG DROP (Drag and Drop is not supported)Your network contains an Active Directory Domain Services (AD DS) forest.The forest contains a root domain named contoso.com and a child domain named branch.contoso.com. The domain contains a domain controller named DC1 that holds all the domain-wide FSMO roles.DC1 fails and cannot be restored, causing the following issues: ● Recent password changes are NOT recognized immediately during sign-ins to contoso.com. ● Domains cannot be added or removed from the forest.You need to seize the minimum domain-wide FSMO roles on a domain controller named DC2 to resolve the issues.Which role should you seize for each issue? To answer, drag the appropriate roles to the correct issue. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Box 1: PDC Emulator The PDC Emulator (Primary Domain Controller Emulator) FSMO role is appropriate.Password Processing: The PDC Emulator processes password changes and preferentially receives urgent replication of password updates from other domain controllers.Authentication Forwarding: If a sign-in attempt fails on a local domain controller because a recent password change has not yet replicated there, that domain controller forwards the authentication request directly to the PDC Emulator to verify against the latest password.Box 2: Domain naming master The Domain Naming Master role must be chosen and seized to fix this issue.Forest-wide scope: It is one of two unique forest-wide FSMO roles.Domain operations: It controls the addition or removal of domains in an Active Directory forest.Failure impact: When the domain controller holding this role fails and cannot be recovered, no new domains can be added and existing domains cannot be removed until the role is seized on a working second domain controller
https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/view-transfer-fsmo-roles
Post your Comments and Discuss Microsoft AZ-802 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-802 content, but please register or login to continue.