HOTSPOT
-
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with an Azure AD tenant. The tenant contains a group named Group1 and the users shown in the following table.
 
Domain/OU filtering in Azure AD Connect is configured as shown in the Filtering exhibit. (Click the Filtering tab.)
 
You review the Azure AD Connect configurations as shown in the Configure exhibit. (Click the Configure tab.)
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
You need to identify which server is the PDC emulator for the domain.
Solution: From Active Directory Sites and Services, you right-click Default-First-Site-Name in the console tree, and then select Properties.
Does this meet the goal?

A. Yes

B. No

You need to meet the technical requirements for VM2.
What should you do?

A. Implement shielded virtual machines.

B. Enable the Guest services integration service.

C. Implement Credential Guard.

D. Enable enhanced session mode.

HOTSPOT -
Which groups can you add to Group3 and Group5? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

SIMULATION
-
You need to ensure that SRV1 only leases IP addresses from the range of 192.168.1.190 to 192.168.1.200 to computers that have a MAC address that starts with aabb.
To complete this task, sign in the required computer or computers.

HOTSPOT
-
Your on-premises network contains a single-domain Active Directory Domain Services (AD DS) forest. You have an Azure AD tenant named contoso.com. The AD DS forest syncs with the Azure AD tenant by using Azure AD Connect.
You need to ensure that users in the forest that have a custom attribute of NoSync are excluded from synchronization.
How should you configure the Azure AD Connect cloudFiltered attribute, and which tool should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

DRAG DROP
-
You have a server named Server1 that runs Windows Server and has the Active Directory Federation Services role installed.
You plan to deploy Web Application Proxy to a server named Server2.
You export the Active Directory Federation Services (AD FS) certificate from Server1.
Which actions should you perform on Server2 in sequence? To answer, drag the appropriate actions to the correct order. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
 

HOTSPOT -
Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com. The domain contains a server named Server1 and the users shown in the following table.
 
Server1 contains a folder named D:Folder1. The advanced security settings for Folder1 are configured as shown in the Permissions exhibit. (Click the
Permissions tab.)
 
Folder1 is shared by using the following configurations:
 
The share permissions for Share1 are shown in the following table.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

Your company has a main office and a branch office. The two offices are connected by using a WAN link. Each office contains a firewall that filters WAN traffic.
The network in the branch office contains 10 servers that run Windows Server. All servers are administered from the main office only.
You plan to manage the servers in the branch office by using a Windows Admin Center gateway.
On a server in the branch office, you install the Windows Admin Center gateway by using the defaults settings.
You need to configure the firewall in the branch office to allow the required inbound connection to the Windows Admin Center gateway.
Which inbound TCP port should you allow?

A. 443

B. 3389

C. 5985

D. 6516

HOTSPOT -
You need to meet the technical requirements for VM1.
Which cmdlet should you run first? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK.
You open a new branch office that contains only client computers.
You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.
Solution: You create a new subnet object that is associated to Site1.
Does this meet the goal?

A. Yes

B. No

You have an on-premises server named Server1 that runs Windows Server.
You have an Azure subscription that contains a virtual network named VNet1.
You need to connect Server1 to VNet1 by using Azure Network Adapter.
What should you use?

A. the Azure portal

B. Azure AD Connect

C. Device Manager

D. Windows Admin Center

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the offices shown in the following table.
 
You need to deploy a Network Policy Server (NPS) named NPS1 to enforce network access policies for all remote connections.
What is the minimum number of RADIUS clients that you should add to NPS1?

A. 1

B. 3

C. 8

D. 180

E. 188

HOTSPOT
-
You have an Azure subscription and a computer named Computer1 that runs Windows 11.
From the Azure portal, you deploy a virtual machine named VM1 that runs Windows Server. You configure VM1 to use the default settings.
You need to ensure that you can connect to VM1 by using PowerShell remoting.
Which cmdlet should you run, and what should you use to run the cmdlet? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains 10 servers that run Windows Server. The servers have static IPv4 addresses.
You plan to use DHCP to assign IPv4 addresses to the servers.
You need to ensure that each server always receives the same IPv4 address.
Which type of identifier should you use to create a DHCP reservation for each server?

A. fully qualified domain name (FQDN)

B. universally unique identifier (UUID)

C. NetBIOS name

D. MAC address

Your on-premises network contains an Active Directory domain named contoso.com. You have an Azure AD tenant.
You plan to sync contoso.com with the Azure AD tenant by using Azure AD Connect cloud sync.
You need to create an account that will be used by Azure AD Connect cloud sync.
Which type of account should you create?

A. system-assigned managed identity

B. group managed service account (gMSA)

C. user

D. InetOrgPerson

DRAG DROP
-
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. VM1 contains a 128-GB operating system disk.
You need to increase the size of volume C on VM1 to 250 GB.
Which four actions should you perform in sequence.
To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
 

You have an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with Azure AD by using Azure AD Connect.
You enable password protection for contoso.com.
You need to prevent users from including the word contoso as part of their password.
What should you use?

A. the Azure Active Directory admin center

B. Active Directory Users and Computers

C. Synchronization Service Manager

D. Windows Admin Center

HOTSPOT
-
You have a Windows Server container host named Server1.
You start the containers on Server1 as shown in the following table.
 
You need to validate the status of ProcessA and ProcessC.
Where can you verify that ProcessA and ProcessC are in a running state? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the resources shown in the following table.
 
You plan to replicate a volume from Server1 to Server2 by using Storage Replica.
You need to configure Storage Replica.
Where should you install Windows Admin Center?

A. Server1

B. CLIENT1

C. DC1

D. Server2

HOTSPOT -
Your network contains two VLANs for client computers and one VLAN for a datacenter. Each VLAN is assigned an IPv4 subnet. Currently, all the client computers use static IP addresses.
You plan to deploy a DHCP server to the VLAN in the datacenter.
You need to use the DHCP server to provide IP configurations to all the client computers.
What is the minimum number of scopes and DHCP relays you should create? To answer, select the appropriate option the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

SIMULATION
-
SRV1 contains a virtual machine named VM1.
You need attach c:vhdsDisk1.vhdx to VM1. The solution must ensure that Disk1 can be expanded dynamically when VM1 runs.
To complete this task, sign in the required computer or computers.

SIMULATION
-
You need to ensure that the minimum password length for members of the BranchAdmins group is 12 characters. The solution must affect only the BranchAdmins group.
To complete this task, sign in the required computer or computers.

You have an Azure virtual machine named VM1 that has a private IP address only.
You configure the Windows Admin Center extension on VM1.
You have an on-premises computer that runs Windows 11. You use the computer for server management.
You need to ensure that you can use Windows Admin Center from the Azure portal to manage VM1.
What should you configure?

A. an Azure Bastion host on the virtual network that contains VM1.

B. a VPN connection to the virtual network that contains VM1.

C. a private endpoint on the virtual network that contains VM1.

D. a network security group (NSG) rule that allows inbound traffic on port 443.

DRAG DROP
-
Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site.
You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1.
You need to recommend a deployment plan that meets the following requirements:
•	Ensures that a user named User1 can perform the RODC installation on Server1
•	Ensures that Server1 is in a new site named RemoteSite1
•	Uses the principle of least privilege
Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
 

SIMULATION
-
You need to create a group-managed service account (gMSA) named gMSA1 and make gMSA1 available on SRV1.
To complete this task, sign in to the required computer or computers.

You have a server named Server1 that runs Windows Server. Server1 has the storage pools shown in the following table.
 
You plan to create a virtual disk named VDisk1 that will use storage tiers.
Which pools can you use to create VDisk1?

A. Pool2 only

B. Pool1 only

C. Pool1, Pool2, and Pool3

D. Pool1 and Pool2 only

E. Pool3 only

F. Pool2 and Pool3 only

G. Pool1 and Pool3 only

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain controllers.
You plan to store a DNS zone in a custom Active Directory partition.
You need to create the Active Directory partition for the zone. The partition must replicate to only four of the domain controllers.
What should you use?

A. ntdsutil.exe

B. Active Directory Sites and Services

C. Set-DnsServer

D. DNS Manager

HOTSPOT -
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
The network contains the servers shown in the following table.
 
You plan to implement IP Address Management (IPAM).
You need to use the Group Policy based provisioning method for managed servers. The solution must support server discovery.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT -
You have an Azure Active Directory Domain Services (Azure AD DS) domain.
You create a new user named Admin1.
You need Admin1 to deploy custom Group Policy settings to all the computers in the domain. The solution must use the principle of least privilege.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point
Hot Area:
 

You need to implement an availability solution for DHCP that meets the networking requirements.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. On DHCP1, create a scope that contains 25 percent of the IP addresses from Scope2.

B. On the router in each office, configure a DHCP relay.

C. DHCP2, configure a scope that contains 25 percent of the IP addresses from Scope1.

D. On each DHCP server, install the Failover Clustering feature and add the DHCP cluster role.

E. On each DHCP scope, configure DHCP failover.

HOTSPOT
-
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the users shown in the following table.
 
The domain has the Group Policy Objects (GPOs) shown in the following table.
 
The GPOs are configured to map a drive named H as shown in the following table.
 
For each of the following statements, select Yes if the statement is true, Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

HOTSPOT -
Your network contains a two-domain on-premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the domain controllers shown in the following table.
 
All domain controllers are backed up by using Azure Backup.
You create an Active Directory site named Site3. Site1, Site2, and Site3 each has a dedicated site link to the Hub site.
In Site3, you install a new server named Server1.
You need to promote Server1 to an RODC in child.contoso.com by using the Install from Media (IFM) option. The solution must minimize network traffic.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

What should you implement for the deployment of DC3?

A. Azure Active Directory Domain Services (Azure AD DS)

B. an Azure virtual machine

C. an Azure AD administrative unit

D. Azure AD Application Proxy

HOTSPOT -
You have an on-premises DNS server named Server1 that runs Windows Server. Server1 hosts a DNS zone named fabnkam.com.
You have an Azure subscription that contains the resources shown in the following table.
 
You need to design a solution that will automatically resolve the names of any PaaS resources for which you configure private endpoints in Vnet1.
How should you configure the name resolution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT -
You have 10 on-premises servers that run Windows Server.
You plan to use Azure Network Adapter to connect the servers to the resources in Azure.
Which prerequisites do you require on-premises and in Azure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

DRAG DROP
-
You have a disaggregated cluster deployment. The deployment contains a scale-out file server (SOFS) cluster that runs Windows Server and a compute cluster that has the Hyper-V role enabled.
You need to implement Storage Quality of Service (QoS). The solution must ensure that you can control the bandwidth usage between the SOFS cluster and the Hyper-V cluster.
Which cmdlet should you run on each cluster? To answer, drag the appropriate cmdlets to the correct clusters. Each cmdlet may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
 

Your network contains a multi-site Active Directory Domain Services (AD DS) forest. Each Active Directory site is connected by using manually configured site links and automatically generated connections.
You need to minimize the latency for changes to Active Directory.
What should you do?

A. For each site links, modify the site link costs.

B. Create a site link bridge that contains all the site links.

C. For each site link, modify the options attribute.

D. For each site link, modify the replication schedule.

You need to configure remote administration to meet the security requirements.
What should you use?

A. an Azure Bastion host

B. Azure AD Privileged Identity Management (PIM)

C. the Remote Desktop extension for Azure Cloud Services

D. just in time (JIT) VM access

You have an Azure subscription that contains the virtual networks shown in the following table.
 
You deploy a virtual machine named VM1 that runs Windows Server. VM1 is connected to Subnet11.
You plan to add an additional network interface named NIC1 to VM1.
To which subnets can NIC1 be attached?

A. Subnet11 only

B. Subnet12 only

C. Subnet11 and Subnetl2 only

D. Submet12 and Subnet21 only

E. Subnet11, Subnet12, Subnet21, and Subnet31

HOTSPOT -
You have a server named Server1 that runs Windows Server and has the Hyper-V server role installed.
You need to limit which Hyper-V module cmdlets helpdesk users can use when administering Server1 remotely.
You configure Just Enough Administration (JEA) and successfully build the role capabilities and session configuration files.
How should you complete the PowerShell command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT
-
You have an Azure subscription that contains a virtual network named VNet1. Vnet1 contains three subnets named Subnet1, Subnet2, and Subnet3.
You deploy a virtual machine that has the following settings:
•	Name:VM1
•	Subnet: Subnet2
•	Network interface name: NIC1
•	Operating system: Windows Server 2022
You need to ensure that VM1 can route traffic between Subnet1 and Subnet3. The solution must minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server.
You plan to manage VM1 by using a PowerShell runbook.
You need to create the runbook.
What should you create first?

A. an Azure Automation account

B. an Azure workbook

C. a Log Analytics workspace

D. a Microsoft Power Automate flow

Your on-premises network has an IP address range of 10.0.0.0/23.
You have an Azure virtual network named VNet1 that contains a virtual machine named VM1.
VNet1 has an IP address range of 10.0.1.0/24.
You need to deploy a Site-to-Site (S2S) VPN to connect the on-premises network to VNet1.
What should you do first?

A. Deploy Azure Bastion to VNet1.

B. Deploy Azure Extended Network.

C. Configure VNet1 to use the IP address range of 10.0.2.0/24.

D. Configure VNet1 to use an IP address range of 10.0.1.128/25.

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a user named User1 and the servers shown in the following table.
 
You need to ensure that User1 can manage only Scope1 and Scope3.
What should you do?

A. Add User1 to the DHCP Administrators group on Server1 and Server2.

B. Implement IP Address Management (IPAM).

C. Add User1 to the DHCP Administrators domain local group.

D. Implement Windows Admin Center and add connections to Server1 and Server2.

HOTSPOT
-
Overview
-
Company Information
-
ADatum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Fabrikam Partnership
-
ADatum recently partnered with 2 company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
Existing Environment
-
ADatum AD DS Environment
-
The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
 
Fabrikam AD DS Environment
-
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
Server Infrastructure
-
The adatum.com domain contains the servers shown in the following table.
 
HyperV1 contains the virtual machines shown in the following table.
 
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
 
Azure Resources
-
ADatum has an Azure subscription that contains an Azure AD tenant. Azure AD Connect is configured to sync the adatum.com forest with Azure AD.
The subscription contains the virtual networks shown in the following table.
 
The subscription contains the Azure Private DNS zones shown in the following table.
 
The subscription contains the virtual machines shown in the following table.
 
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Requirements
-
Planned Changes
-
ADatum plans to implement the following changes:
•	Sync Data1 to share1.
•	Configure an Azure runbook named Task1.
•	Enable Azure AD users to sign in to Server1.
•	Create an Azure DNS Private Resolver that has the following configurations:
•	Name: Private1
•	Region: West US
•	Virtual network: VNet1
•	Inbound endpoint: SubnetB
•	Enable users in the adatum.com domain to access the resources in the south.fabrikam.com domain.
Technical Requirements
-
ADatum identifies the following technical requirements:
•	The data on SSPace1 must be available always.
•	DC2 must become the schema master if DC1 fails.
•	VM3 must be configured to enable per-folder quotas.
•	Trusts must allow access to only the required resources.
•	The users in the Marketing OU must have access to storage1.
•	Azure Automanage must be used on all supported Azure virtual machines.
•	A direct SSH session must be used to manage all the supported virtual machines on HyperV1.
You need to meet technical requirements for HyperV1.
Which command should you run? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

You have an Azure subscription that contains the following resources.
✑ An Azure Log Analytics workspace
✑ An Azure Automation account
✑ Azure Arc
You have an on-premises server named Server1 that is onboarded to Azure Arc.
You need to manage Microsoft updates on Server1 by using Azure Arc.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. From the Automation account, enable Update Management for Server1.

B. From the Virtual machines data source of the Log Analytics workspace, connect Server1.

C. On Server1, install the Azure Monitor agent

D. Add Microsoft Sentinel to the Log Analytics workspace

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a DNS server named Server1. Server1 hosts a DNS zone named fabrikam.com that was signed by DNSSEC.
You need to ensure that all the member servers in the domain perform DNSSEC validation for the fabrikam.com namespace.
What should you do?

A. On Server1, run the Add-DnsServerTrustAnchor cmdlet.

B. On each member server, run the Add-DnsServerTrustAnchor cmdlet.

C. From a Group Policy Object (GPO), add a rule to the Name Resolution Policy Table (NRPT).

D. From a Group Policy Object (GPO), modify the Network List Manager policies.

SIMULATION
-
You need to ensure that the Azure file share named share1 can sync to on-premises servers.
The required source files are located in a folder named dc1.contoso.cominstall.
You do NOT need to specify the on-premises servers at this time.
To complete this task, sign in the required computer or computers.

DRAG DROP
-
Your network contains an Active Directory domain, a web app named App1, and a perimeter network. The perimeter network contains a server named Server1 that runs Windows Server.
You plan to provide external access to App1.
You need to implement the Web Application Proxy role service on Server1.
Which role should you add to Server1, and which role should you add to the network? To answer, drag the appropriate roles to the correct targets. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.