You need to deploy a Read-Only Domain Controller (RODC) to a branch office. Which prerequisite must be met before deploying the RODC?
- The forest functional level must be Windows Server 2016 or higher.
- You must install an RODC as the first domain controller in the domain.
- There must be at least one writable domain controller in the domain. (Correct)
- The domain functional level must be Windows Server 2022.
Explanation: To deploy an RODC, the forest functional level must be Windows Server 2003 or higher, and there must be at least one writable domain controller running Windows Server 2008 or higher in the domain. Additionally, you cannot install an RODC as the first domain controller in a domain.
Which of the following Flexible Single Master Operations (FSMO) roles are forest-wide roles? (Choose two.)
- Schema Master (Correct)
- RID Master
- Domain Naming Master (Correct)
- PDC Emulator
- Infrastructure Master
Explanation: The Schema Master and Domain Naming Master are forest-wide FSMO roles. The RID Master, PDC Emulator, and Infrastructure Master are domain-wide roles.
Is it possible to clone a domain controller that holds the PDC Emulator FSMO role?
Explanation: No. A domain controller that holds the PDC Emulator role cannot be cloned. You must transfer the role to another domain controller before cloning.
You are using PowerShell to install Active Directory Domain Services. Which cmdlet installs the AD DS role itself?
- Install-ADDSForest
- Install-WindowsFeature AD-Domain-Services (Correct)
- Set-ADDomainMode
- New-ADComputer
Explanation: The Install-WindowsFeature AD-Domain-Services cmdlet is used to install the AD DS binaries (role). The Install-ADDSForest cmdlet actually promotes the server to a DC.
You are deploying an AD DS forest in Azure via Azure Virtual Machines. It is recommended to configure the DNS server address of the virtual network (VNet) to point to:
- Azure-provided DNS (168.63.129.16)
- Public DNS resolvers (e.g., 8.8.8.8)
- The static private IP addresses of the AD DS VMs (Correct)
- The public IP addresses of the AD DS VMs
Explanation: In Azure, when deploying domain controllers, you should configure the VNet's custom DNS settings to point to the private IP addresses of your Active Directory Domain Controllers.
Which authentication method in Microsoft Entra Connect provides the highest level of on-premises security validation by evaluating on-premises AD policies (like account expiration and logon hours) in real-time during sign-in?
- Password Hash Synchronization (PHS)
- Active Directory Federation Services (AD FS)
- Seamless Single Sign-On (SSO)
- Pass-through Authentication (PTA) (Correct)
Explanation: Pass-through Authentication (PTA) directly validates users' passwords against the on-premises Active Directory in real-time, allowing on-premises policies to apply instantly.
Does Microsoft Entra Cloud Sync require an on-premises SQL Server database to store synchronization state?
Explanation: No. Microsoft Entra Cloud Sync uses a lightweight provisioning agent. All configuration and sync state are stored in the cloud, removing the need for a local SQL database.
Which of the following scenarios are supported by Microsoft Entra Connect Sync but NOT by Microsoft Entra Cloud Sync? (Choose two.)
- Pass-through Authentication (PTA) (Correct)
- Password Hash Synchronization (PHS)
- Device writeback (Correct)
- Synchronization from multiple disconnected forests
Explanation: Entra Connect Sync supports Pass-through Authentication (PTA) and Device writeback. Entra Cloud Sync currently does not support these features.
You want to ensure that users who reset their passwords in the Azure portal have their new passwords synchronized back to the on-premises Active Directory. What must you enable?
- Pass-through Authentication
- Password writeback (Correct)
- Group writeback
- Active Directory Federation Services (AD FS)
Explanation: Password writeback is a feature of Microsoft Entra Connect that allows password changes in the cloud to be written back to an existing on-premises directory in real time.
Which PowerShell module must you use to force an immediate directory synchronization cycle with Microsoft Entra Connect?
- ActiveDirectory
- AzureAD
- ADSync (Correct)
- MSOnline
Explanation: The ADSync module provides the Start-ADSyncSyncCycle cmdlet, which allows you to manually trigger a synchronization cycle (Delta or Initial).
Can you manage Windows Server 2022 Core installations using Windows Admin Center?
Explanation: Yes, Windows Admin Center fully supports managing Windows Server Core installations, providing a GUI for headless servers.
What port is used by default when managing a remote server via PowerShell Remoting (WinRM over HTTP)?
- 3389
- 443
- 5985 (Correct)
- 5986
Explanation: By default, PowerShell Remoting (WinRM) over HTTP uses port 5985. WinRM over HTTPS uses port 5986.
You want to manage multiple on-premises Windows Servers securely from outside your corporate network without using a VPN. Which Azure service can you integrate with Windows Admin Center to achieve this?
- Azure VPN Gateway
- Azure Arc (Correct)
- Azure Front Door
- Azure Bastion
Explanation: Azure Arc combined with Windows Admin Center in the Azure portal allows you to securely manage on-premises servers without opening inbound ports or setting up a VPN.
Which of the following are valid deployment models for Windows Admin Center? (Choose three.)
- Local client deployment (Windows 10/11) (Correct)
- Linux container deployment
- Gateway server deployment (Correct)
- Failover cluster deployment (Correct)
- Azure App Service deployment
Explanation: Windows Admin Center can be deployed on a local Windows 10/11 client, directly on a managed server (gateway server mode), or in a failover cluster for high availability.
To use Just Enough Administration (JEA) for delegating administrative tasks securely, what is used to define the specific commands, modules, and parameters that a user is allowed to run?
- Session Configuration file (.pssc)
- Group Policy Object (GPO)
- Active Directory Security Group
- Role Capability file (.psrc) (Correct)
Explanation: A Role Capability file (.psrc) defines exactly what commands, cmdlets, functions, and providers are exposed to users in a JEA endpoint.
You want to manage patching for both on-premises Windows Servers and Azure VMs from a single pane of glass in Azure. Which Azure service should you use?
- Windows Server Update Services (WSUS)
- System Center Configuration Manager
- Azure Update Manager (Correct)
- Azure Automation Runbooks
Explanation: Azure Update Manager provides a unified interface for assessing and applying updates to both Azure VMs and Arc-enabled on-premises servers.
To onboard an on-premises Windows Server to Azure Arc, what software component must be installed on the local server?
- Microsoft Monitoring Agent (MMA)
- Azure Connected Machine agent (Correct)
- Log Analytics workspace agent
- Windows Admin Center gateway
Explanation: The Azure Connected Machine agent must be installed on the on-premises machine to connect it to Azure Arc.
Can Azure Policy be applied to on-premises servers that are projected into Azure via Azure Arc?
Explanation: Yes, Azure Arc enables you to apply Azure Policies (like guest configuration policies) directly to on-premises servers as if they were Azure VMs.
You are using Azure Automation State Configuration. What underlying Windows technology is this service based on?
- Group Policy Objects (GPO)
- Windows Management Instrumentation (WMI)
- Task Scheduler
- PowerShell Desired State Configuration (DSC) (Correct)
Explanation: Azure Automation State Configuration provides a cloud-based management layer for PowerShell Desired State Configuration (DSC).
Which Azure service collects event logs, performance counters, and security logs from Azure VMs and Azure Arc-enabled servers for deep querying and alerting?
- Azure Key Vault
- Azure Event Hubs
- Azure Monitor Log Analytics (Correct)
- Azure Service Bus
Explanation: Azure Monitor Log Analytics workspaces are used to collect, store, and query logs and metrics from hybrid infrastructure.
In Hyper-V, what type of virtual switch permits communication between virtual machines on the same host and the host operating system itself, but does NOT provide access to the physical network?
- External
- Internal (Correct)
- Private
- Transparent
Explanation: An Internal virtual switch allows communication between VMs on the host and the host OS itself. A Private switch only allows communication between VMs. An External switch allows access to the physical network.
Which of the following features require a Generation 2 virtual machine in Hyper-V? (Choose two.)
- Virtual floppy drive support
- Legacy network adapter support
- Secure Boot (Correct)
- UEFI firmware (Correct)
Explanation: Generation 2 VMs use UEFI firmware, which is required for features like Secure Boot and booting from a SCSI attached virtual hard disk (or PXE boot via standard synthetic network adapter). Generation 1 uses legacy BIOS.
Is it possible to convert a Generation 1 virtual machine to a Generation 2 virtual machine directly in Hyper-V Manager without recreating the VM?
Explanation: No, you cannot change the generation of a virtual machine after it has been created.
You need to export a Hyper-V VM while it is currently running. Is this supported?
- No, the VM must be shut down.
- No, the VM must be saved.
- Yes, a running VM can be exported. (Correct)
Explanation: Yes, starting with Windows Server 2012 R2, you can export a virtual machine or a virtual machine checkpoint while the VM is running.
What PowerShell cmdlet is used to enable nested virtualization on a Hyper-V host for a specific VM?
- Set-VM
- Set-VMProcessor (Correct)
- Enable-VMIntegrationService
- Set-VMFirmware
Explanation: To enable nested virtualization, you must expose hardware virtualization extensions to the VM using the Set-VMProcessor cmdlet with the -ExposeVirtualizationExtensions $true parameter.
Windows Server supports two types of container isolation. What are they? (Choose two.)
- Process isolation (Windows Server containers) (Correct)
- Hyper-V isolation (Correct)
- Sandbox isolation
- Virtual Enclave isolation
Explanation: Windows Server containers share the host kernel. Hyper-V isolation provides a highly isolated environment by running each container in a highly optimized virtual machine, providing its own dedicated kernel.
When running Windows Server containers with process isolation, the host OS and the container OS image must match in which of the following ways?
- They do not need to match.
- The container can be a newer version than the host.
- The container and host OS build versions must match exactly. (Correct)
- The container can be Linux while the host is Windows.
Explanation: For process isolation, the container OS build version must strictly match the host OS build version because they share the same kernel.
Does Hyper-V isolation allow you to run a Windows Server 2019 container on a Windows Server 2022 host?
Explanation: Yes. Because Hyper-V isolated containers have their own kernel, they provide backward compatibility, allowing older container images (like Server 2019) to run on newer hosts (like Server 2022).
Which file is used to define the instructions for building a container image automatically?
- container.xml
- Dockerfile (Correct)
- build.ps1
- docker-compose.yml
Explanation: A Dockerfile is a text document that contains all the commands a user could call on the command line to assemble an image.
You need to deploy a cluster of Windows and Linux containers. Which orchestrator is natively integrated with Azure (AKS) and can also run on-premises via Azure Arc?
- Docker Swarm
- Apache Mesos
- Kubernetes (Correct)
- Windows Admin Center
Explanation: Kubernetes is the industry standard container orchestrator. Azure Kubernetes Service (AKS) manages Kubernetes in Azure, and AKS enabled by Azure Arc manages it on-premises.
Which DNS zone type allows a DNS server to forward queries for a specific domain name to a designated set of DNS servers, rather than sending them to the internet root servers?
- Stub Zone
- Primary Zone
- Secondary Zone
- Conditional Forwarder (Correct)
Explanation: A conditional forwarder is a DNS setting that forwards DNS queries for a specific domain name to the IP addresses of specific DNS servers.
What are two benefits of using Active Directory-integrated DNS zones compared to standard primary zones? (Choose two.)
- Secure dynamic updates (Correct)
- Multi-master replication (Correct)
- No requirement for domain controllers
- Support for Linux DNS natively
Explanation: AD-integrated zones store DNS data in the Active Directory partition, allowing secure dynamic updates and multi-master replication (any DC running DNS can update the zone).
You are configuring Azure Private DNS. Can instances inside an Azure VNet automatically register their hostnames in a linked Azure Private DNS zone?
- No, manual record creation is always required.
- Yes, by enabling auto-registration on the VNet link. (Correct)
- Yes, but only if the VMs are domain-joined.
Explanation: Yes, if you configure a virtual network link to the Private DNS zone and enable the "Auto-registration" feature.
You have an on-premises DNS server and want it to resolve names in an Azure Private DNS zone (e.g., privatelink.database.windows.net). What should you configure in Azure to forward queries to?
- Azure Application Gateway
- Azure Traffic Manager
- Azure DNS Private Resolver (Correct)
- Azure Bastion
Explanation: An Azure DNS Private Resolver allows on-premises DNS servers to query Azure Private DNS zones directly without needing IaaS DNS VMs.
Which Windows Server DNS feature allows you to control how DNS servers handle queries based on factors like the client's IP subnet?
- DNS Policies (Correct)
- DNSSEC
- GlobalNames Zone
- Response Rate Limiting (RRL)
Explanation: DNS Policies allow you to configure traffic management, load balancing, and split-brain DNS based on various criteria, such as the client subnet.
What feature in Windows Server allows you to aggregate multiple physical network adapters into a single virtual adapter to provide fault tolerance and increased bandwidth?
- Receive Side Scaling (RSS)
- VLAN tagging
- NIC Teaming (Correct)
- Quality of Service (QoS)
Explanation: NIC Teaming (also known as Load Balancing/Failover or LBFO) allows multiple network adapters to be placed into a team for bandwidth aggregation and traffic failover.
To configure an Azure Network Adapter on an on-premises Windows Server, you must use Windows Admin Center. True or False?
Explanation: True. The Azure Network Adapter feature, which connects a local server to an Azure VNet via point-to-site VPN with a single click, is a feature of Windows Admin Center.
When configuring a site-to-site VPN from an on-premises Windows Server (using RRAS) to Azure, what Azure resource must be deployed to terminate the VPN connection in the cloud?
- Azure Application Gateway
- Azure ExpressRoute
- Azure VPN Gateway (Correct)
- Azure NAT Gateway
Explanation: An Azure VPN Gateway is required to send encrypted traffic between an Azure virtual network and an on-premises location over the public Internet.
What Windows Server feature provides a centralized framework to manage, monitor, and audit the IP address space and DHCP/DNS servers on your network?
- IPAM (IP Address Management) (Correct)
- NPS (Network Policy Server)
- DirectAccess
- WINS
Explanation: IP Address Management (IPAM) provides centralized administration and monitoring of DNS and DHCP servers, as well as IP address space management.
Which two protocols are commonly used by DHCP failover in Windows Server to ensure high availability? (Choose two concepts related to its architecture.)
- Round-Robin
- Hot Standby (Correct)
- Split-scope
- Load Balance (Correct)
Explanation: DHCP failover in Windows Server can be configured in two modes: Load Balance (Active-Active) and Hot Standby (Active-Passive).
You want to provide a single, logical, hierarchical namespace for shared folders located on different servers. Which technology should you implement?
- Storage Spaces Direct (S2D)
- DFS Replication (DFSR)
- DFS Namespaces (DFSN) (Correct)
- Azure File Sync
Explanation: DFS Namespaces (DFSN) enables you to group shared folders that are located on different servers into one or more logically structured namespaces.
Which Windows Server feature allows you to reduce storage footprint by finding and removing duplication within data without compromising data integrity?
- NTFS Compression
- Data Deduplication (Correct)
- BitLocker
- ReFS
Explanation: Data Deduplication finds and removes duplication within data, storing more data in less space.
Can File Server Resource Manager (FSRM) be used to block users from saving specific types of files, such as MP3s, to a network share?
Explanation: Yes, File Screening Management in FSRM allows you to block specific file types (like audio or video files) from being saved on file servers.
What protocol does BranchCache use to retrieve content from the hosted cache server or distributed cache peers?
- SMB (Server Message Block)
- FTP (File Transfer Protocol)
- RPC (Remote Procedure Call)
- HTTP/HTTPS (Correct)
Explanation: BranchCache uses HTTP/HTTPS for content transfer between peers or from the hosted cache server.
You configure an SMB share on Windows Server 2022. You want to ensure that data traversing the network to this share is encrypted. What should you enable?
- IPsec
- EFS (Encrypting File System)
- SMB Encryption (Correct)
- BitLocker
Explanation: SMB Encryption provides end-to-end encryption of SMB data and protects data from eavesdropping occurrences on internal networks.
What Azure service allows you to centralize your organization's file shares in Azure Files, while keeping the flexibility, performance, and compatibility of an on-premises Windows file server?
- Azure Blob Storage
- Azure File Sync (Correct)
- Azure Backup
- Storage Replica
Explanation: Azure File Sync allows you to centralize your file shares in Azure Files and cache frequently accessed files on local Windows Servers.
In Azure File Sync, which feature ensures that the local Windows Server only caches recently accessed files, replacing older files with pointers to Azure when the disk gets full?
- Offline Files
- Data Deduplication
- Cloud Tiering (Correct)
- BranchCache
Explanation: Cloud tiering is an optional feature of Azure File Sync where frequently accessed files are cached locally on the server while all other files are tiered to Azure Files based on policy.
To deploy Azure File Sync, what agent must be installed on your on-premises Windows Server?
- Azure File Sync Agent (Correct)
- Microsoft Monitoring Agent
- Azure Connected Machine Agent
- Recovery Services Agent
Explanation: You must install the Azure File Sync agent on the Windows Server to register it with your Storage Sync Service and enable synchronization.
When implementing Storage Spaces on a standalone Windows Server, which two provisioning types are available when creating a virtual disk? (Choose two.)
- Dynamic
- Thin (Correct)
- Differencing
- Fixed (Correct)
Explanation: Virtual disks in Storage Spaces can be provisioned as Thin (uses space only as data is written) or Fixed (allocates all storage capacity immediately).
You are configuring Azure File Sync. Can the System Volume (Drive C:) of the Windows Server be used as a server endpoint for Azure File Sync?
- Yes, without any restrictions.
- Yes, but cloud tiering must be disabled.
- No, the system volume is not supported as a server endpoint. (Correct)
Explanation: No. A server endpoint must be located on an NTFS volume. While drive C: is NTFS, Azure File Sync does not support configuring the system volume as a server endpoint.