D is Correct
Fine-Grained Password Policies (FGPP) allow administrators to define distinct password and account lockout rules for specific sets of users or global security groups without creating multiple domains:

Password Settings Objects (PSOs): FGPP rules are defined using Password Settings Objects (PSOs), which specify parameters such as minimum password length, password complexity, history, and lockout thresholds.

Password Settings Container (PSC): PSOs are stored directly within the Active Directory domain database in the Password Settings Container (PSC) located at CN=Password Settings Container,CN=System,DC=domain,DC=com. They are managed using the Active Directory Administrative Center (ADAC) or PowerShell (New-ADFineGrainedPasswordPolicy).

Incorrect:

A. In the Default Domain Policy GPO at the domain level: Group Policy Objects (GPOs) linked at the domain root can apply only one set of domain-wide password rules. Applying a new GPO with password settings to an OU or site will not affect domain accounts, which is why FGPP and PSOs were introduced.

B. In the domain controller’s local security policy which overrides domain GPO settings: Local security policy (secpol.msc) applies exclusively to local accounts on a specific machine. It cannot define fine-grained domain user password policies across Active Directory.

C. In the Active Directory Sites and Services console as site-specific policy objects: Active Directory Sites and Services governs AD replication topology, subnets, and site boundaries. It does not store or process fine-grained password policy settings or PSOs.

A. The Local Configuration Manager (LCM) on each server which applies and monitors DSC configurations at a configured refresh interval

The Local Configuration Manager (LCM) is the engine on each Windows Server that enforces DSC configurations.

It validates the server’s current state against the DSC definition and re?applies configurations at a scheduled refresh interval to prevent drift.

Certification highlights LCM as the authoritative component for DSC enforcement.

B. The Task Scheduler service which runs DSC scripts stored in the System32 directory

Incorrect.

Task Scheduler can run scripts, but DSC does not rely on Task Scheduler for validation or enforcement.

DSC is managed by LCM, not by scheduled tasks in System32.

C. Azure Policy Guest Configuration which replaces the LCM for all Windows Server DSC scenarios

Incorrect.

Azure Policy Guest Configuration can integrate with DSC for compliance in Azure environments, but it does not replace LCM.

On?premises and hybrid Windows Servers still rely on LCM for DSC enforcement.

D. The Windows Remote Management service which executes DSC scripts when invoked remotely

Incorrect.

WinRM provides the transport protocol for DSC (via WS?Man), but it does not validate or enforce configurations.

Enforcement is handled by LCM, not WinRM.

Correct :

Option A – Three-way mirror

A three-way mirror maintains three copies of the data across different drives or servers.

This resiliency type can tolerate two simultaneous drive or server failures without data loss.

It is the most fault-tolerant mirror option in Storage Spaces Direct (S2D), designed for critical workloads where high availability is required.

This is the correct answer because the certification emphasizes that three-way mirroring provides the highest resiliency among mirror types.

? Incorrect Options
Option B – Two-way mirror

A two-way mirror maintains two copies of the data.

It can only tolerate one drive or server failure at a time.

While it provides redundancy, it does not meet the requirement of tolerating two simultaneous failures.

Option C – Simple (no resiliency)

A simple space stripes data across drives but provides no fault tolerance.

If a drive fails, data is lost.

This option is used only for scenarios where performance is prioritized over resiliency, making it unsuitable for fault tolerance requirements.

Option D – Parity space

A parity space uses parity information to provide resiliency with better capacity efficiency than mirrors.

Standard parity tiers typically tolerate only one failure.

While parity is more space-efficient, it does not meet the requirement of tolerating two simultaneous failures unless configured with dual parity (which is not the default).

Correct
Option D – OU-level GPO settings

Group Policy Objects (GPOs) follow a precedence order: Local ? Site ? Domain ? OU.

When conflicting settings exist, the OU-level GPOs override domain-level GPOs, unless the domain-level GPO is explicitly enforced (via “No Override”).

This is the correct answer because OU-linked GPOs have higher precedence in a non-enforced scenario, meaning users in that OU will receive the OU-level settings.

Incorrect:

Option A – Random application

GPOs are not applied randomly. They follow a strict processing order defined by Active Directory hierarchy.

This option is incorrect because Group Policy processing is deterministic, not random.

Option B – Merge with most restrictive settings

GPOs do not merge by applying the “most restrictive” settings.

Instead, they apply based on precedence, with lower-level (OU) policies overriding higher-level (domain) ones.

This option misrepresents how conflicts are resolved.

Option C – Domain-level GPO always wins

Domain-level GPOs are applied before OU-level GPOs, but they do not have higher precedence.

OU-level GPOs override domain-level settings unless the domain GPO is enforced.

This option is incorrect because it reverses the actual precedence rules.

Correct answer: C. Domain-based DFS Namespace
A domain-based DFS Namespace stores its namespace configuration and metadata in Active Directory Domain Services (AD DS). Because the namespace configuration is available through AD DS, multiple namespace servers can host the same namespace, providing redundancy, load sharing, and higher availability.

Microsoft documentation states that namespace servers can be added to a domain-based namespace to increase availability.

Incorrect:

A. Distributed File System Replication (DFSR)
Incorrect. DFSR replicates file content between folder targets. It is an optional companion technology and does not define where DFS Namespace metadata is stored or determine whether the namespace supports multiple namespace servers.

B. Azure File Sync namespace
Incorrect. Azure File Sync synchronizes file data between Windows Server and Azure file shares. It is not a DFS Namespace type and does not store DFS Namespace metadata in AD DS.

C. Domain-based DFS Namespace
Correct. Its metadata is stored in AD DS, and the namespace can be hosted on multiple namespace servers for redundancy and higher availability.

D. Standalone DFS Namespace
Incorrect. A standalone namespace stores its configuration on the individual namespace server, typically in the server’s registry, rather than in AD DS. It supports only one namespace server, unless the namespace server is configured as a failover cluster resource.

Correct :

D. A synchronisation error alert identifying specific objects that failed to export due to attribute validation failures such as duplicate proxy addresses.
Microsoft Entra Connect Health (for sync) monitors the synchronization process between on-premises Active Directory and Microsoft Entra ID. One of its key capabilities is the Object-level Synchronization Error Report (and related alerts).
This report surfaces objects that failed during the Export operation to Microsoft Entra ID because of attribute-level problems. Common examples include:

Duplicate Attribute errors (e.g., AttributeValueMustBeUnique or QuarantinedAttributeValueMustBeUnique) caused by conflicting proxyAddresses, UserPrincipalName, or similar unique attributes.
Data Validation Failure errors (invalid characters, format issues, etc.).

These errors are visible in the Entra admin center under Connect Health ? Sync errors, and the service can raise corresponding alerts. Administrators can drill into the specific objects, see the conflicting attributes, and take corrective action (often with guided diagnosis for duplicate attributes).

Incorrect

A. A latency alert indicating that replication from AD to Entra ID is taking longer than the threshold.
Latency / performance-related alerts exist (for example, related to sync cycle duration or data freshness), but they do not identify specific objects failing due to attribute validation errors.

B. A connectivity alert indicating that Entra Connect cannot reach Entra ID endpoints.
Connectivity or agent health alerts (e.g., “Health service data isn’t up to date”) indicate that the Health agent cannot communicate with the cloud service. These are infrastructure/reachability issues, not object-level attribute synchronization failures.

C. A licensing alert indicating that users do not have sufficient Entra ID licences for synchronisation.
Licensing is not enforced or alerted at the Entra Connect synchronization layer in this way. Synchronization itself does not require per-user licenses; licensing checks occur elsewhere in Microsoft Entra ID / Microsoft 365.

Correct Answer:
D. A stateless web application hosted on multiple IIS servers where any node can handle any request independently.

Network Load Balancing (NLB) is designed specifically for stateless active-active workloads (such as IIS web servers, FTP servers, or VPN gateways) where client requests do not rely on local session state bound to a single node:

Active-Active Scalability: NLB uses a distributed algorithm to share network traffic across all active nodes under a shared Virtual IP (VIP). Because the workload is stateless, any IIS server in the pool can process any incoming client request independently without requiring shared cluster storage or node-to-node state synchronization.

No Shared Storage Required: NLB operates purely at the networking layer (TCP/IP), making it significantly simpler and more scalable for expanding web farms compared to Failover Clustering.

Incorrect:

A. A file server cluster where multiple nodes access a shared volume simultaneously: High-availability File Servers (such as Scale-Out File Servers) rely on Windows Server Failover Clustering (WSFC) combined with Cluster Shared Volumes (CSV) and SMB 3.0 to manage state, locks, and concurrent storage access across nodes. NLB lacks storage awareness and cannot manage file locks.

B. A SQL Server Always On Availability Group requiring automatic failover with shared database state: SQL Server Always On uses WSFC under the hood as its health and quorum mechanism to manage active/passive or primary/secondary database replicas and handle rapid failover of stateful database engine instances.

C. A Hyper-V Live Migration environment requiring coordinated VM movement between cluster nodes: Live Migration and Hyper-V High Availability require WSFC to coordinate cluster state, VM ownership, CSV storage, and heartbeat monitoring between physical virtualization hosts.

C. System state and individual files and folders stored on the local server volumes.
The Microsoft Azure Recovery Services (MARS) agent is the lightweight agent used by Azure Backup to protect Windows Server (on-premises or Azure VMs). It supports these backup scopes:

Individual files and folders (selective protection of data on local volumes).
Entire volumes.
Windows system state (critical OS configuration data such as Active Directory, registry, COM+ database, boot files, etc.).

Backups are taken using the Windows System Writer via VSS and stored in a Recovery Services vault. This is the documented scope for direct MARS-agent backups.

A. Hyper-V virtual machines by connecting to the host’s VSS writer. — Incorrect
MARS does not protect Hyper-V VMs. Hyper-V VM backup is performed by Microsoft Azure Backup Server (MABS), System Center Data Protection Manager (DPM), or other host-level solutions that interact with the Hyper-V VSS writer. MARS runs inside a guest OS (or on a physical server) and only sees the local file system and system state.

B. SQL Server databases using VSS-aware application-consistent snapshots. — Incorrect
MARS uses only the Windows System Writer and does not invoke application-specific VSS writers. It therefore cannot produce application-consistent SQL Server (or other workload) backups. Application-aware protection for SQL, Exchange, SharePoint, etc., requires MABS/DPM or Azure Backup’s workload-specific solutions.

D. Full VM backup including all disks and configuration captured from the hypervisor layer. — Incorrect
Full VM (IaaS) backups that capture all disks and VM configuration are performed by the Azure Backup VM extension (or agentless crash-consistent backup) at the Azure fabric/hypervisor level. MARS is an in-guest agent that protects only files/folders and system state; it does not create full VM snapshots.

Correct:

D. Mutual CHAP where the initiator authenticates to the target and the target also authenticates back to the initiator using a separate reverse CHAP secret.

In Challenge-Handshake Authentication Protocol (CHAP) for iSCSI:

Standard (One-way) CHAP: The target authenticates the identity of the incoming initiator using a shared secret.

Mutual (Reverse) CHAP: Provides two-way verification. The target authenticates the initiator using the initiator’s CHAP secret, and the initiator authenticates the target using a target (reverse) CHAP secret. Both sides must validate each other before iSCSI storage LUNs are exposed.

Incorrect:

A. Kerberos CHAP where Active Directory issues tickets for iSCSI session authentication.

“Kerberos CHAP” is a fictitious term. Kerberos and CHAP are separate authentication protocols. While Active Directory handles Kerberos authentication for Windows domain services, standard iSCSI CHAP uses symmetric shared secrets defined directly on the initiator and target, not Kerberos tickets.

B. Certificate CHAP where PKI certificates replace shared secrets for iSCSI authentication.

“Certificate CHAP” is not a standard iSCSI authentication method. CHAP fundamentally relies on challenge-response hashing with pre-shared keys/secrets. While iSCSI traffic can be secured at the network layer using IPsec with PKI certificates, CHAP itself does not use digital certificates.

C. One-way CHAP where only the target authenticates the initiator using a shared secret.

One-way CHAP provides unidirectional authentication. It verifies the initiator to the target, but the initiator does not verify the target’s identity, leaving it vulnerable to rogue iSCSI targets.

The correct answer is A. That the Hyper-V host’s firmware, boot configuration, and code integrity policy match a known-good baseline trusted by HGS.

Attestation is the core security process performed by the Host Guardian Service (HGS). Its purpose is to verify the integrity and health of a Hyper-V host before it is allowed to run a shielded virtual machine (VM). This is done by measuring specific host characteristics.

For TPM-trusted attestation, the most secure mode, the HGS checks that the host’s Trusted Platform Module (TPM) identity, boot measurements (like those from a Measured Boot sequence), and Code Integrity policies all match a pre-approved, known-good baseline. This confirms the host is in a trusted state and has not been tampered with.

Here is an analysis of why the other options are incorrect:

B. That the Hyper-V host has sufficient RAM and CPU to run the requested Shielded VM configuration: This is a resource-checking function, typically performed by the Hyper-V host itself or a fabric controller (like VMM), not part of the HGS attestation process. HGS focuses on security and health, not capacity.

C. That the network traffic from the VM is encrypted between the host and the HGS server: While communication with HGS is encrypted (e.g., using TLS), network encryption is not what attestation confirms. Attestation confirms the host’s identity and integrity, not the network path.

D. That the VM’s virtual disks are encrypted with a key known to the guest OS: This describes BitLocker or the VM’s own encryption, which is part of shielding a VM but is not the function of attestation. Attestation is the preliminary step where HGS validates the host’s trustworthiness before providing the keys to unlock and start the VM.

A. Scheduled task creation logged by Event ID 4698 on workstations in the domain

Incorrect.

Event ID 4698 is a standard Windows event log entry for scheduled task creation.

Defender for Identity does not add unique detection value here, since this is already reliably captured in logs.

B. Pass?the?Hash and Overpass?the?Hash attacks where stolen NTLM hashes or Kerberos tickets are used to authenticate without knowing the plaintext password

Correct.

Defender for Identity specializes in detecting advanced credential theft techniques such as Pass?the?Hash and Overpass?the?Hash.

These attacks exploit stolen NTLM hashes or Kerberos tickets to authenticate without the actual password.

Windows event logs alone cannot reliably detect these attacks because they appear as normal authentication events.

Certification highlights this as a key differentiator of Defender for Identity.

C. Account lockouts visible in Event ID 4740 on domain controllers

Incorrect.

Account lockouts are natively logged in AD DS with Event ID 4740.

Defender for Identity does not need to provide special detection for this, as logs already capture it reliably.

D. Failed password attempts visible in Event ID 4625 on domain controllers

Incorrect.

Failed logon attempts are logged with Event ID 4625.

Defender for Identity does not uniquely detect these, since they are already visible in event logs.

Correct : A. It allows SMB file access over the internet or untrusted networks without requiring a VPN by using TLS 1.3 encryption natively in the QUIC transport layer.
SMB over QUIC is an alternative transport for the SMB protocol (available in Windows Server 2025 across all editions, and previously limited to Windows Server 2022 Datacenter: Azure Edition).
It replaces the traditional TCP transport (port 445) with the QUIC protocol running over UDP (typically port 443). QUIC always uses TLS 1.3 for the transport layer, creating an encrypted, authenticated tunnel.
This means:

All SMB traffic (including authentication) is protected inside the TLS 1.3 tunnel.
The solution works securely over the public internet or other untrusted networks.
No separate VPN is required — Microsoft often describes it as an “SMB VPN.”

This is the primary security advantage compared with classic SMB over TCP.

Incorrect

B. It replaces SMB encryption entirely, eliminating the need for SMB signing and sealing.
SMB over QUIC does not replace or eliminate SMB-level features. SMB signing, encryption (sealing), multichannel, compression, and other SMB features continue to work normally inside the QUIC tunnel. QUIC provides transport-level encryption; SMB security features remain available and recommended.

C. It increases SMB throughput by using UDP instead of TCP and removing encryption overhead.
While QUIC can offer performance benefits (lower latency, better loss recovery, 0-RTT, multiplexing), it does not remove encryption — TLS 1.3 encryption is mandatory and always present. Throughput gains are not the main security advantage, and encryption overhead is still incurred (though modern TLS 1.3 is efficient).

D. It restricts SMB access to clients running Windows 11 and Windows Server 2025 only.
Client support exists for Windows 11 (and some earlier versions with updates) and Windows Server. It is not limited exclusively to Windows 11 and Windows Server 2025, and client restriction is not the security advantage described.

D is Correct
BitLocker Drive Encryption provides multi-layered boot-time protection using key protectors. The TPM + PIN combination offers the strongest security posture for an operating system drive:

Multifactor Authentication (MFA) at Boot: Combines “something you have” (the physical Trusted Platform Module hardware chip bound to the system firmware/board) with “something you know” (a user-entered PIN) before the OS boots.

Mitigates Hardware Integrity & Sniffing Attacks: Standard TPM-only unlocking automatically releases the encryption keys if system integrity checks pass. Adding a pre-boot PIN prevents unauthorized boot access even if an attacker gains physical possession of the machine or attempts bus-sniffing / side-channel attacks against the TPM.

Incorrect:

A. Recovery key saved to a USB drive which is the most secure method because it is physically separate: A USB startup/recovery key (“something you have”) can be physically lost, stolen, or copied. It lacks the hardware-bound integrity measurements provided by the TPM chip and lacks a secondary factor like a password or PIN.

B. Password protector without TPM which requires a password at boot: Password-only protection relies purely on software authentication without the pre-boot platform integrity checks (PCR measurements) performed by a TPM. It is vulnerable to brute-force attempts and offline tampering.

C. TPM only which stores the key in the TPM and unlocks automatically at boot: While TPM-only provides transparent protection and checks platform integrity, it automatically unlocks the drive at boot without requiring user interaction. If a device is stolen while powered off, a physical attacker can boot the machine up to the Windows login screen.

The correct answer is B. Configuring on-premises DNS to forward queries for the private zone suffix to the IP address of an Azure DNS Private Resolver inbound endpoint deployed in the connected VNet.

On-premises DNS servers cannot directly query Azure’s private DNS zones (which resolve, for example, *.privatelink.database.windows.net). The standard and supported solution is to create a conditional forwarder on the on-premises DNS servers for the private zone’s domain suffix and point it to a DNS forwarder in Azure that can reach the Azure DNS service .

The current recommended managed service for this forwarder is Azure DNS Private Resolver . You deploy this resolver in a virtual network connected to your on-premises environment and create an inbound endpoint. This endpoint receives a private IP address within the VNet . You then configure your on-premises conditional forwarder with the FQDN of your Azure Private DNS zone to forward queries to this inbound endpoint IP . The resolver then queries Azure DNS, which resolves names from the linked Private DNS zones .

Incorrect:

A. Enabling DNS over HTTPS on all on-premises DNS servers: This is an encryption protocol for DNS queries, not a method for on-premises servers to discover Azure Private DNS zones. The core issue is that Azure Private DNS zones are not directly exposed to on-premises networks; they can only be resolved from within linked virtual networks in Azure . A forwarding mechanism is required, not just secure transport.

C. Creating a DNS delegation in the on-premises DNS zone: This is the standard method for delegating a subdomain to a different authoritative DNS server. However, Azure DNS Private Resolver is a recursive resolver, not an authoritative name server . This means it is designed to resolve queries for a zone by forwarding or recursing, but it is not designed to act as the authoritative source for a zone that you delegate to directly from your on-premises environment. For this reason, delegating a zone via NS records to Azure DNS Private Resolver is not a valid configuration .

D. Installing the DNS role on an Azure VM: This is an older, legacy approach. While it could technically work, it is not the recommended or modern solution, as it requires managing infrastructure-as-a-service (IaaS) VMs. The question asks for the required configuration in the current context, which points to the managed service: Azure DNS Private Resolver .

Correct :

B. The Arc agent is removed by the OS upgrade and must be manually reinstalled and the server re-registered with Azure Arc after the upgrade.

During an in-place operating system upgrade (such as upgrading Windows Server 2019 to Windows Server 2025), low-level system services, drivers, and agent extensions—including the Azure Connected Machine Agent (azcmagent)—are stripped out during the OS migration pass to ensure system stability and compatibility.

Because the OS baseline changes completely, the Azure Arc agent must be reinstalled on the upgraded host and re-registered to re-establish the hybrid identity and secure metadata connection back to Azure.

Incorrect:

A. The Arc agent is automatically updated and the server registration is refreshed without administrator intervention.

In-place OS upgrades do not preserve or automatically upgrade third-party or cloud management agents. The Azure Connected Machine Agent relies on specific registry entries, certificates, and system services created during installation that are not preserved across major operating system upgrades.

C. The Arc agent migrates all server data to Azure IaaS during the upgrade process.

Azure Arc is a management and control-plane agent used for hybrid governance, inventory, monitoring, and policy enforcement; it is not a data migration tool like Azure Migrate. Performing an in-place OS upgrade does not trigger data migration to Azure IaaS VMs.

D. The Arc connection is automatically paused during the upgrade and automatically resumed when the new OS boots.

Operating system upgrades break the agent’s installed files and certificate context needed for communication with Azure Arc endpoints. The agent does not simply “pause” and resume; it requires reinstallation and re-onboarding after the target OS boots up.

The correct answer is B. Deploying Windows Admin Center as a gateway service on a server accessible from both the administrator network and the managed servers. This is the “Gateway server” deployment model . In this scenario, the gateway is installed on a designated server, and administrators connect to it from any browser that can reach the gateway server’s URL (e.g., https://servername.contoso.com) . This enables management of servers that are on a different network segment, as long as the gateway server has connectivity to them.

Incorrect:

A. Installing Windows Admin Center on each managed server as a standalone instance: This describes the “Managed server” deployment model. While this allows remote management of that specific server , it does not address the scenario of managing multiple servers across different networks through a central gateway. It is more suitable for distributed scenarios .

C. Running Windows Admin Center as a local desktop application that tunnels through the Azure portal: Windows Admin Center is a web-based tool, not a local desktop application . While integration with the Azure portal exists, it is not a tunneling mechanism for a local desktop app.

D. Enabling Windows Admin Center through the Windows Server Manager console on each managed server: Windows Admin Center is a separate, browser-based management interface and is not “enabled” through the Server Manager console. Server Manager is a distinct tool from an older generation .

The correct answer is D. Secure Boot which uses a certificate-based chain of trust to verify firmware and bootloader signatures before the OS kernel starts.

In a Secured-core Server, Secure Boot is the foundational component responsible for establishing a hardware root of trust and validating the integrity of all firmware and boot components before the operating system loads . It verifies that each driver and boot component is signed by a trusted certificate, ensuring only authorized code executes during the startup process .

Incorrect:

A. Windows Defender Application Control: This component restricts which applications and drivers can run after the OS has loaded, but it does not validate the pre-boot firmware integrity.

B. Windows Hello for Business: This is an authentication mechanism for administrators, not a firmware or boot integrity validation feature.

C. BitLocker Drive Encryption: This protects data at rest by encrypting the OS drive, but it does not verify the trustworthiness of the boot components themselves.

The correct answer is D. Log search alert rule which runs a KQL query against the Log Analytics workspace and fires when the result count or value meets the configured threshold.

A Log search alert rule (also referred to as a Log Analytics alert) is the specific type of Azure Monitor alert that evaluates a user-defined Kusto Query Language (KQL) query against data stored in a Log Analytics workspace. It fires an alert when the results of the query (e.g., the number of records returned or a calculated metric value) exceed the threshold you have defined in the alert condition.

Incorrect:

A. Smart detection alert: This type of alert uses machine learning (ML) to automatically detect anomalies in your data without requiring the user to define a specific KQL query or threshold. It is not based on a user-provided KQL query.

B. Metric alert rule: This type of alert evaluates platform or custom metrics (numerical time-series data) against a static or dynamic threshold. It does not run KQL queries against Log Analytics data.

C. Activity Log alert: This type of alert triggers when a new Azure resource management operation (e.g., VM start/stop, resource creation) occurs in the Activity Log. It does not evaluate KQL queries or Log Analytics data.

The correct answer is B. Active Directory attribute-level encryption where specific sensitive attributes are encrypted at rest using DPAPI-NG so that only authorised principals can decrypt them.

Windows Server 2025 introduces a significant security enhancement for Active Directory Domain Services (AD DS) that provides cryptographic protection for sensitive attribute values. This feature, often referred to as confidential attribute encryption or attribute-level encryption, ensures that specific high-value attributes are encrypted at rest within the AD DS database . Access to decrypt these values is strictly controlled, allowing only authorized principals to view them . A related requirement is that LDAP clients must use encrypted sessions (such as LDAPS or signing/sealing) to access these protected attributes .

Incorrect:

A. Protected Users security group: This is a security group that restricts Kerberos authentication options for its members (forcing AES encryption and preventing credential delegation), but it is not a feature for encrypting AD DS attributes at rest .

C. Confidential attribute encryption using the BitLocker-protected AD DS database with per-attribute access controls: The feature in Server 2025 is specifically attribute-level encryption using DPAPI-NG, not database-level encryption via BitLocker . While access controls are involved, the core mechanism is encryption of the attribute values themselves.

D. Active Directory Recycle Bin: This feature enables the recovery of deleted AD DS objects and is unrelated to data encryption or protection of sensitive attribute values .

The correct answer is B. SecurityEvent | where TimeGenerated > ago(24h) and EventID == 4625 and Computer == ‘SVR01’

This query uses the correct table, filters, and KQL syntax for analyzing Windows Server security events in Log Analytics . The SecurityEvent table is the standard schema for Windows security logs in Azure Monitor, and ago(24h) is the proper KQL function for a 24-hour lookback period . The query correctly identifies failed login attempts by referencing Event ID 4625 .

Incorrect:

A. WindowsEvent | filter EventID = 4625 and Computer = SVR01 and Time > -24h: WindowsEvent is not the correct table name for security logs—the standard table is SecurityEvent. Also, filter is not a valid KQL operator for table filtering; the correct operator is where. The time filter Time > -24h uses incorrect syntax; the proper function is ago(24h).

C. Event | where EventID == ‘4625’ and TimeGenerated > now() – 24h and Source == ‘SVR01’: Event is not the correct table name for security events. Additionally, the EventID value is incorrectly treated as a string (enclosed in quotes) rather than an integer. The Source field is also not the standard column name for computer identification—the column is Computer.

D. AzureActivity | where OperationName == ‘Login Failed’ and TimeGenerated > ago(24h): AzureActivity is the table for Azure platform activity logs, not for guest OS security events from a Windows Server. Event ID 4625 is a Windows Server security log event and would not be found in the AzureActivity table.

The correct answer is A. SMB Direct requires less CPU overhead by transferring file data directly between the network adapter and application memory without CPU involvement in the data path.

SMB Direct leverages Remote Direct Memory Access (RDMA)-capable network adapters to significantly enhance file server performance . Its primary benefit is delivering high throughput, low latency, and low CPU utilization . This is achieved because RDMA allows data to be transferred directly between the network adapter and application memory, bypassing the CPU for the data movement operations , which frees up CPU cycles for other server applications .

Incorrect:

B. SMB Direct compresses data before transmission reducing bandwidth requirements: Data compression is not a benefit or function of SMB Direct.

C. SMB Direct increases the maximum file size that can be transferred over a single SMB session: SMB Direct does not alter the maximum file size limits of the SMB protocol.

D. SMB Direct provides encryption using TLS 1.3 for all transfers without performance overhead: While modern versions of SMB Direct do support encryption (starting with Windows Server 2022), it uses AES-128 and AES-256, not TLS 1.3 . This encryption does introduce a performance overhead relative to unencrypted traffic, though it is minimized compared to previous implementations .

Correct:

Option D – Forms-based or Windows authentication over HTTPS and optionally Azure Active Directory

Work Folders allows users to securely synchronize files between their devices and a central server without requiring a VPN.

Authentication is handled via Forms-based or Windows authentication over HTTPS, ensuring secure credential exchange.

Additionally, Azure Active Directory (AAD) can be integrated to enable modern authentication scenarios, such as conditional access and MFA.

This is the correct answer because the certification highlights that Work Folders leverages HTTPS-based authentication mechanisms suitable for internet-facing connections.

Incorrect:

Option A – NTLM authentication

NTLM passes hashed credentials but is not the mechanism used by Work Folders over the internet.

NTLM is primarily used in legacy or internal network scenarios, not for secure HTTPS-based synchronization.

Option B – Kerberos authentication

Kerberos requires direct communication with a domain controller to obtain tickets.

Since Work Folders is designed for internet-based access without VPN, Kerberos is not suitable in this scenario.

Option C – SSH key-based authentication

SSH key-based authentication is not supported by Work Folders.

Work Folders relies on HTTPS and Windows/AAD authentication, not SSH protocols.

A. Hybrid Azure AD join cloud trust model using Entra ID as the trust authority with Kerberos Cloud Trust so that on?premises resources are accessed via cloud?issued Kerberos tickets

Correct.

The cloud trust model allows Windows Hello for Business to function without requiring a PKI.

Microsoft Entra ID acts as the trust authority, issuing Kerberos tickets via Kerberos Cloud Trust for accessing on?premises resources.

Certification highlights this as the modern, simplified trust model that eliminates the need for certificate issuance infrastructure.

B. Certificate trust model requiring AD CS to issue authentication certificates to each enrolled device

Incorrect.

The certificate trust model requires a Public Key Infrastructure (PKI) with Active Directory Certificate Services (AD CS).

This contradicts the requirement in the question (no PKI deployment).

C. Key trust model requiring Windows Server 2016 or later domain controllers and deployment of public keys to AD DS

Incorrect.

The key trust model requires public keys to be published in AD DS and domain controllers running Windows Server 2016 or later.

While it avoids certificates, it does not use the cloud trust model and still requires infrastructure changes.

D. NTLM trust model which uses NT hashes instead of certificates for Windows Hello authentication

Incorrect.

NTLM is a legacy authentication protocol.

Windows Hello for Business does not use NTLM for passwordless authentication, and NTLM does not provide the required trust model.

Correct : A. Remote Desktop Web Access which provides a web portal for launching RemoteApp programs and full desktop connections.
In a Remote Desktop Services (RDS) deployment, the Remote Desktop Web Access (RD Web Access) role service provides a browser-based portal. Users connect to an HTTPS web page where they can:

Launch RemoteApp programs
Start full Remote Desktop (session-based or virtual desktop) connections

This is the component that delivers the web-based user experience for accessing published resources.

Incorrect:

B. Remote Desktop Session Host which hosts Windows applications and desktops for remote users.
The RD Session Host is the server that actually runs the applications and user sessions. It does not provide the web portal used to launch those resources.

C. Remote Desktop Gateway which provides encrypted access to RDS through HTTPS for remote users.
RD Gateway acts as a secure reverse-proxy/gateway that allows remote users to reach internal RDS resources over HTTPS (typically port 443) without requiring a full VPN. It handles secure transport but does not itself present the web portal for launching RemoteApps or desktops.

D. Remote Desktop Licensing which manages RDS Client Access Licences.
RD Licensing (RD License Server) is responsible for issuing and tracking RDS CALs. It has no role in providing user access or a web interface.

Correct :

C. The staging folder temporarily stores compressed replication data before it is transmitted to partners, improving replication efficiency for large files.

In Distributed File System Replication (DFSR), the staging folder serves as an operational cache on both sending and receiving replication partners:

Remote Differential Compression (RDC): Before a file (or file modification) is replicated across the network, DFSR compresses the file and breaks it down into staging files located in the DfsrPrivate\Staging directory.

Efficient Transmission: By staging and compressing files, DFSR can apply Remote Differential Compression algorithms to transmit only the modified file blocks (deltas) rather than entire files. On the receiving end, the inbound file payload is stored in its staging folder before being unpacked and committed to the final replicated folder destination.

Incorrect:

A. The staging folder holds files that have been quarantined during a replication conflict: Conflicting files or deleted items are routed to the Conflict and Deleted folder (DfsrPrivate\ConflictAndDeleted), not the staging folder.

B. The staging folder stores encrypted copies of all replicated files as a backup: The staging folder acts purely as a temporary cache for compression and block creation during transit. It is not an encrypted backup repository or archival location.

D. The staging folder permanently archives all versions of replicated files for point-in-time recovery: Staging space operates as a dynamic, FIFO (first-in, first-out) cache governed by high and low watermarks (default 90% and 60% cleanup thresholds). Files in the staging folder are automatically deleted once replication finishes or when staging quota limits are reached.

The correct answer is C. Performing a failover on the replica server which brings the VM online from the last replicated checkpoint.

Hyper-V Replica creates and maintains a copy of a VM on a secondary (replica) server through asynchronous replication . However, this replica VM remains in a disabled state and cannot be powered on . In the event of a primary site failure, the required action to bring the VM online is to manually initiate a planned or unplanned failover operation on the replica server . This process makes the replica VM the active instance, starting it from the latest replicated recovery point .

Incorrect:

A. Converting the replica VM from VHDX to VHD format: Hyper-V Replica supports VHDX natively, and conversion is neither required nor recommended as a prerequisite for failover.

B. Pausing the primary site’s Hyper-V host to synchronise remaining changes: In an unplanned failover (e.g., primary site loss), the primary site is unavailable, so no synchronization is possible. In a planned failover, the system already performs a final synchronization automatically before the failover occurs; pausing the host is not a manual prerequisite.

D. Cancelling replication and reimporting the VM from backup files: This would defeat the purpose of the Hyper-V Replica feature, which is designed to provide rapid failover without resorting to a lengthy restore from backup. Reimporting from backups is a fallback disaster-recovery method, not the intended failover action for Hyper-V Replica.

A. A USN rollback occurs when Active Directory Sites and Services is used to force replication of all partitions simultaneously

Incorrect.

Forcing replication does not cause a USN rollback.

This action simply triggers replication events; it does not reset or lower USN counters.

B. A USN rollback occurs when a DC is restored from a backup or snapshot and its USN counter is lower than the version known by replication partners, causing partners to believe there are no changes to replicate

Correct.

A USN rollback happens when a domain controller is restored from a snapshot or non?authoritative backup.

Its USN values are lower than what replication partners expect, so partners assume no changes exist.

This prevents legitimate updates from replicating, leading to inconsistent directory data across the forest.

Certification highlights this as a serious replication integrity issue.

C. A USN rollback occurs when the replication schedule is too frequent, causing USN values to roll over

Incorrect.

USNs are 64?bit counters and do not roll over under normal replication schedules.

Frequent replication does not cause rollback; rollback is specifically tied to restoring from snapshots/backups.

D. A USN rollback occurs when a DC is promoted from a backup that is newer than the current forest state

Incorrect.

Promoting a DC from a newer backup may cause replication conflicts, but it does not result in a USN rollback.

Rollback is defined by the USN counter being lower than expected, not newer.

Correct : C. Policy Analyzer and Local Group Policy Object (LGPO) tools from the Security Compliance Toolkit which compare, import, and apply baseline GPO settings.
The Microsoft Security Compliance Toolkit (SCT) is the official set of tools used to download, analyze, compare, edit, and apply Microsoft-recommended security baselines (delivered as Group Policy Objects).
Key tools in the toolkit include:

Policy Analyzer — Compares sets of GPOs (including Microsoft baselines against your current policies), highlights differences, redundancies, and conflicts, and can export results.
LGPO.exe (Local Group Policy Object tool) — A command-line utility that imports and applies policy settings from GPO backups, registry.pol files, security templates, or Policy Analyzer “.PolicyRules” files. It is used to apply baseline settings to the local Group Policy of a computer or to prepare them for broader use.

Together, these tools allow administrators to evaluate Microsoft Security Baselines and apply the recommended GPO settings in an on-premises Active Directory environment (or to individual machines via local policy). The baselines themselves are typically imported into Active Directory using Group Policy Management Console after analysis/preparation with the toolkit tools.

Incorrect:

A. Microsoft Baseline Security Analyser (MBSA) which scans servers for security misconfigurations.
MBSA is a legacy scanning tool (now discontinued) used to check for missing updates and basic misconfigurations. It does not apply or manage Microsoft Security Baseline GPOs.

B. Windows Defender System Guard which enforces hardware-based security baselines.
System Guard (and related features such as Secure Launch / System Guard Runtime) provides hardware-rooted integrity and runtime attestation. It is not the tool used to apply GPO-based security baselines.

D. Windows Update for Business which distributes security baseline configurations as Windows updates.
Windows Update for Business manages the deployment of quality and feature updates. It does not distribute or apply Microsoft Security Baseline GPOs.

Correct Answer:
A. PhysicalDisk\Avg. Disk Queue Length which measures the average number of pending I/O requests for a physical disk.

In Performance Monitor (perfmon.exe), the PhysicalDisk\Avg. Disk Queue Length counter measures the average number of read and write requests that were queued and waiting to be serviced by the underlying physical disk array during the sample interval:

Identifying Disk Bottlenecks: A sustained queue length significantly higher than the number of physical spindles (spindles/disks in a RAID volume, typically greater than 2 per disk) indicates that the storage subsystem cannot process I/O operations as fast as applications are requesting them, making the physical disk a system performance bottleneck.

Granular Time Measurement: To measure pure latency per request alongside queue length, administrators also pair this counter with PhysicalDisk\Avg. Disk sec/Transfer (where values higher than 15–20 ms indicate storage latency issues).

Disk Queue Length tracks pending storage I/O requests. Source: Super User

Incorrect:

B. Memory\Available Bytes which measures free physical memory: This counter monitors physical RAM availability (in bytes) accessible to running processes. It is used to identify memory bottlenecks and paging activity, not disk I/O performance.

C. Processor% Processor Time which measures CPU utilisation across all cores: This counter tracks the percentage of time the processor spends executing active threads. Sustained values above 85% indicate a CPU subsystem bottleneck rather than a storage issue.

D. Network Interface\Output Queue Length which measures pending outbound network packets: This counter tracks packet queue backlogs on a network adapter’s output queue (a value greater than 2 indicates a networking bottleneck or bandwidth saturation). It does not measure storage subsystem I/O activity.

The correct answer is D. The deleted object lifetime period which defaults to 180 days and is configurable via the msDS-deletedObjectLifetime attribute.

After the Active Directory Recycle Bin is enabled, deleted objects are retained in a “logically deleted” state for a specific period. During this time, all their attributes are preserved, allowing for a complete restoration . Once this period expires, the object transitions to a “recycled” state where most attributes are stripped, making full recovery impossible .

The duration of this recoverable state is governed by the msDS-deletedObjectLifetime attribute . By default, this attribute is set to null, which means the system uses the value of the tombstoneLifetime attribute, which defaults to 180 days . This 180-day default is a key point in the official documentation .

Incorrect:

A. 7 days which is the default backup retention period: The 7-day period is not a default for the Recycle Bin. The documented default lifetime is 180 days .

B. 30 days which matches the Azure AD soft-delete retention period: This period is related to Azure AD (now Microsoft Entra ID), not to the on-premises Active Directory Recycle Bin feature for Windows Server .

C. Indefinitely until an administrator permanently purges the deleted objects container: Deleted objects are not retained indefinitely. If they are not restored within the set lifetime, they are eventually garbage-collected and permanently removed from the database .

A. NetBIOS over TCP port 139 which provides legacy Windows event notification transport

Incorrect.

NetBIOS over TCP (port 139) is used for legacy file and printer sharing, not event forwarding.

WEF does not rely on NetBIOS for transporting event logs.

B. SNMP traps over UDP port 162 which forward event notifications to a management

Incorrect.

SNMP traps are used in network device monitoring, not Windows Event Forwarding.

WEF is not based on SNMP protocols.

C. Syslog over UDP port 514 which is the standard protocol for Linux and network devices

Incorrect.

Syslog is widely used in Linux and network devices, but Windows Event Forwarding does not use Syslog.

WEF relies on WS?Management, not Syslog.

D. WS?Management (WS?Man) over HTTP or HTTPS using the Windows Remote Management service

Correct.

Windows Event Forwarding uses WS?Management (WS?Man), implemented via Windows Remote Management (WinRM), over HTTP/HTTPS.

This protocol allows secure, standards?based transport of event logs from source computers to the collector.

Certification highlights WS?Man as the supported protocol for WEF.

Correct :

D. The DNS zone and each DNS server must have scavenging enabled and a no-refresh interval and refresh interval configured. For DNS scavenging to function, it must be enabled and configured at multiple levels. Scavenging needs to be activated on the DNS server itself, on the specific DNS zone, and on the individual resource records to be removed . Furthermore, after enabling scavenging, the No-refresh and Refresh intervals must be configured to define the lifecycle of a record’s timestamp and determine when it becomes eligible for removal .

Incorrect:

A. All DNS servers in the domain must be running the same Windows Server version for scavenging to work consistently. This is not a prerequisite for DNS scavenging. Scavenging functions across supported Windows Server versions.

B. DNS conditional forwarders must be disabled to prevent zone conflicts during scavenging. Conditional forwarders are unrelated to the scavenging process. There is no requirement to disable them for scavenging to work.

C. Active Directory replication must be temporarily paused during scavenging to prevent record conflicts. Replication should not be paused. Scavenging is designed to work with Active Directory replication; the safety mechanisms, like the initial waiting period after enabling scavenging, allow time for replication to occur before records are deleted .

A. Hybrid identity with writeback features enabled such as group writeback and device writeback so that cloud changes flow back to on?premises AD

Hybrid identity with writeback features (e.g., password writeback, group writeback, device writeback) ensures that on?premises AD remains authoritative while selected changes made in Microsoft Entra ID are written back to AD.

Certification emphasizes this as the supported model for bidirectional synchronization where AD is the source of truth but cloud changes can flow back.

B. Cloud?only provisioning where all identity changes originate in Microsoft Entra ID

Incorrect.

In cloud?only provisioning, Microsoft Entra ID is the authoritative source.

On?premises AD does not remain authoritative, and changes are not written back to AD.

C. Active Directory Federation Services which replicates the entire AD database to Microsoft Entra ID

Incorrect.

AD FS provides federated authentication, not replication of the AD database.

It does not synchronize or replicate AD attributes into Microsoft Entra ID.

D. Directory synchronisation with password hash sync in one direction from on?premises to cloud only

Incorrect.

Password hash synchronization is one?way only (from AD to Microsoft Entra ID).

It does not allow cloud changes to be written back to AD, so AD cannot remain authoritative with bidirectional updates.

Correct : D. Server for NFS role service under the File and Storage Services role in Server Manager.
To create NFS shares on Windows Server (so that Linux/UNIX clients can access them), you must install the Server for NFS role service. This is done in Server Manager via Add Roles and Features ? expand File and Storage Services ? expand File and iSCSI Services ? select Server for NFS.
You can also install it with PowerShell:
PowerShellInstall-WindowsFeature -Name FS-NFS-Service -IncludeManagementTools
Once installed, you can create NFS shares through Server Manager (File and Storage Services ? Shares ? New Share ? NFS Share) or PowerShell.

Incorrect:

A. File Server Resource Manager which provides quota and file screening for shares.
File Server Resource Manager (FSRM) is a separate role service under File and iSCSI Services. It provides quotas, file screening, storage reports, and classification. It is not required to create or host NFS shares (though it can optionally be used with advanced NFS shares).

B. Network File System feature under the Add Features wizard separate from any role.
There is no standalone “Network File System” feature outside of a role. Server for NFS is a role service under the File and Storage Services role, not a feature selected independently in the Features page of the wizard.

C. Work Folders which synchronises files between clients and the server.
Work Folders is a different role service (also under File and iSCSI Services). It provides user file synchronization for Windows/mobile clients and is unrelated to NFS protocol support for Linux clients.

Correct Answer:
B. The Azure Site Recovery Provider installed on each individual Hyper-V host and the Azure Recovery Services Agent installed on the same host.

When configuring Azure Site Recovery (ASR) to replicate Hyper-V virtual machines without System Center Virtual Machine Manager (SCVMM):

Azure Site Recovery Provider: Installed directly on each on-premises Hyper-V host. It handles control plane management and orchestrates replication workflows by communicating over HTTPS (port 443) with the Azure Site Recovery service.

Microsoft Azure Recovery Services (MARS) Agent: Also installed directly on each Hyper-V host. It manages the data plane, handling the actual data transfer and replication of VHD/VHDX changes directly to Azure Storage.

Because there is no centralized VMM management server in this architecture, both components must be installed on every standalone or clustered Hyper-V host participating in replication.

Incorrect:

A. The Azure Migrate appliance which handles both assessment and replication for Hyper-V workloads: The Azure Migrate appliance is used for evaluating, discovering, and executing one-time agentless migrations of Hyper-V VMs to Azure. It is not the component used for ongoing disaster recovery orchestration via Azure Site Recovery.

C. The Azure Site Recovery Configuration Server VM deployed on-premises which manages all replication: The Configuration Server (along with the Process Server) is an on-premises management appliance required strictly for VMware vSphere and physical server replication scenarios to Azure, not for native Hyper-V workloads.

D. The Hyper-V Replica Broker role which extends built-in Hyper-V Replica to Azure: Hyper-V Replica Broker is a built-in Windows Server Failover Clustering role used to coordinate replica traffic between two on-premises Hyper-V clusters. It is not an Azure Site Recovery agent or provider used to orchestrate replication directly into an Azure Recovery Services vault.

The correct answer is B. It moves infrequently accessed files to Azure Files and replaces them with stub files on the local server, freeing local disk space while maintaining transparent access.

Cloud tiering is a key feature of Azure File Sync that optimizes storage usage on your on-premises servers. Its primary function is to separate the file namespace (the file and folder structure) from the file content .

When cloud tiering is enabled, the Azure File Sync agent monitors file access. Files that are “cool” (infrequently accessed and not recently opened) are moved to the Azure file share in the cloud . On the local server, these files are replaced with a small “stub” or “reparse point” that acts as a pointer to the file’s location in Azure . This process, guided by policies like volume free space and date, helps free up local disk space .

To the end-user or application, these tiered files remain visible and accessible. When a file is accessed, its content is “recalled” from Azure transparently, as if it were still stored locally . This is what “maintaining transparent access” means in option B.

Incorrect:

A. It creates a local read-only cache… that cannot be modified on-premises: Azure File Sync functions as a two-way synchronization service, not a one-way read-only cache. Files on the local server are not read-only and can be modified, with changes syncing back to Azure.

C. It compresses all files on the local server to reduce the storage footprint: Cloud tiering does not compress local files. It moves them entirely to the cloud. Windows Server data deduplication can compress files, but that is a separate feature .

D. It encrypts files stored in Azure Files using customer-managed keys…: This describes a security feature for encrypting data at rest, not the function of cloud tiering.

Correct Answer:
C. To define preferred replication paths and schedules between sites so that AD replication uses efficient WAN links and avoids saturating slower connections.

In Active Directory Domain Services (AD DS), site links are logical paths created in Active Directory Sites and Services that represent network connectivity across geographically separated sites:

Path Preference via Costs: Administrators assign a relative numerical cost (e.g., 10 vs. 100) to each site link. The Knowledge Consistency Checker (KCC) uses these costs to calculate the cheapest, most efficient replication topology across WAN links, directing inter-site traffic along fast, reliable connections while keeping backup/slower links in reserve.

Replication Schedules: Site links allow administrators to configure specific schedules and frequencies (e.g., replicating every 180 minutes or during off-peak hours) so that Active Directory replication does not consume bandwidth during peak business hours.

Incorrect:

A. To encrypt replication traffic between domain controllers in different sites: Inter-site AD replication traffic (using RPC over IP) is encrypted by default using Kerberos or IPSec mechanisms. Site links and cost configurations govern path selection and schedules, not the encryption protocols applied to the traffic.

B. To prevent domain controllers from replicating with each other entirely: The purpose of site links is to facilitate, route, and schedule replication across sites. While site link schedules can restrict when replication happens, site links are not created to block AD replication entirely.

D. To assign IP subnets to sites so that clients locate nearby domain controllers: Subnet mapping is performed using Subnet objects in Active Directory Sites and Services, which associate IP ranges directly with Site objects so DC Locator can route client authentications to local domain controllers. Site links handle inter-site replication paths between domain controllers, not subnet-to-site client assignment.

Correct:

D. Server Configuration tool (sconfig) which provides a text-based menu for core server settings on Server Core installations. On a Server Core installation, which lacks the standard graphical user interface (GUI), the primary local tool for initial and basic configuration is the Server Configuration tool (SConfig) . SConfig is a text-based, menu-driven utility that runs directly in the command prompt, providing a simple interface for managing core server settings such as the computer name, network configuration (IP address), domain/workgroup membership, and enabling remote management . This makes it the correct tool for the described scenario.

Incorrect:

A. Windows Admin Center which requires a browser connection to manage Server Core. While Windows Admin Center is a powerful tool for managing Server Core, it is a remote management solution accessed via a web browser from another machine, not a local, menu-driven console on the server itself . The question specifies a tool that provides a console on a Server Core installation, making this option incorrect.

B. Remote Server Administration Tools (RSAT) which provides GUI-based management from a separate workstation. RSAT is a collection of tools installed on a separate Windows workstation to remotely manage servers, including Server Core. It is not a menu-driven console that runs locally on the Server Core installation .

C. Device Manager which provides a graphical interface for hardware configuration. Device Manager is a graphical tool found in the full Desktop Experience version of Windows. It is not available on a Server Core installation, which lacks the graphical shell, making it an incorrect choice for local management .

A. The server receives an Azure resource ID but no management functionality is available until the server is migrated

Incorrect.

Once the Connected Machine agent is installed, the server is registered as an Azure resource and management functionality is immediately available.

Migration is not required; Azure Arc is specifically designed to extend Azure management to non?Azure servers.

B. The server is migrated to Azure IaaS and its disks are stored in Azure Managed Disks

Incorrect.

Azure Arc does not migrate servers into Azure IaaS.

It enables management of on?premises or other cloud servers without moving them into Azure infrastructure.

C. Azure Policy, Azure Monitor, Defender for Cloud, and Update Manager can be applied to the server as if it were an Azure VM

Correct.

With Azure Arc, the server becomes an Azure resource and can be managed using Azure Policy, Azure Monitor, Microsoft Defender for Cloud, and Update Manager.

Certification highlights this as the key benefit: extending Azure governance, security, and monitoring capabilities to hybrid and on?premises environments.

D. The server can only be managed through Azure Portal and loses access to local administration tools

Incorrect.

Azure Arc does not remove local administration capabilities.

Servers remain fully manageable through local tools (e.g., MMC, PowerShell, Server Manager) while gaining Azure management capabilities.

Correct :

B. Time-limited, just-in-time privileged group membership that automatically expires after a configured period so users do not hold standing administrative access.
Privileged Access Management (PAM) for Active Directory (implemented with Microsoft Identity Manager or by enabling the Privileged Access Management optional feature in a Windows Server 2016+ forest) introduces just-in-time (JIT) administration.
Users (or their privileged accounts) are added to high-privilege groups only when needed and only for a limited time (via a Time-to-Live / TTL value). When the configured period expires, Active Directory automatically removes the membership. This eliminates standing (permanent) privileged access, which is a major attack surface with standard AD group membership.
This is the core security capability that ordinary, permanent AD group membership does not provide.

Incorrect:

A. It forces privileged users to use smart card authentication for all domain sign-ins.
Smart-card (or other strong authentication) requirements are enforced through account policies, authentication policies, or Conditional Access—not by PAM itself. PAM focuses on time-bound membership, not authentication methods.

C. It encrypts AD group membership data to prevent exposure during replication.
AD replication security is handled by the directory’s existing mechanisms (signed/encrypted RPC, Kerberos, etc.). PAM does not add encryption of group membership data.

D. It prevents domain administrators from using personal accounts for non-privileged tasks.
Separating administrative accounts from personal accounts is a best-practice recommendation (and can be supported by processes or other tools), but it is not a capability delivered by PAM. PAM controls the duration of privileged group membership, not how personal accounts are used.

Correct:

Option D – Incremental backup

An Incremental backup copies only the data that has changed since the last backup of any type (full or incremental).

It clears the archive bit (or change tracking flag) after each run, meaning subsequent incremental backups only capture new changes.

This reduces both backup size and time, making it the most efficient option for ongoing backups.

This is the correct answer because the exam emphasizes that incremental backups are designed to minimize storage and time requirements compared to full or differential backups.

Incorrect:

Option A – Copy backup

A Copy backup copies all selected data but does not clear the archive bit.

It is typically used for ad-hoc backups (e.g., before applying a patch) without affecting the normal backup cycle.

It does not reduce backup size or time since it copies everything selected.

Option B – Differential backup

A Differential backup copies all changes since the last full backup, regardless of how many differential backups have been taken in between.

This means differential backups grow larger over time until the next full backup is performed.

While faster than a full backup, it is not as efficient as incremental backups in terms of size and time.

Option C – Full backup

A Full backup copies all data regardless of previous backup state.

It provides a complete restore point but is the most time-consuming and storage-intensive option.

It does not meet the requirement of reducing backup size and time.

Correct : C
C. ReFS integrity streams is correct. Integrity streams use checksums for ReFS metadata and, when enabled, file data. During reads, ReFS compares the calculated checksum with the stored checksum to detect silent corruption. When the volume uses a resilient Storage Spaces mirror or parity configuration, ReFS can obtain a valid alternate copy, repair the corrupted data automatically, and write the corrected data back online—without requiring a separate manual integrity-check scan.

This is the key distinction: integrity streams detect corruption during normal validation, while Storage Spaces resiliency supplies the alternate data needed for automatic correction. If the volume has no resilient copy, ReFS can detect corruption but cannot automatically repair it.

Incorrect:

A. Windows Defender System Scan
Incorrect. Windows Defender protects against malware and other security threats; it is not the ReFS mechanism for checksum validation or silent data-corruption repair.

B. BitLocker encryption
Incorrect. BitLocker encrypts data at rest and protects against unauthorized access. It does not detect or repair corrupted file data.

C. ReFS integrity streams
Correct. They provide checksum-based integrity validation, and with a resilient mirror or parity space, ReFS and Storage Spaces can automatically correct detected corruption during reads.

D. NTFS chkdsk equivalent
Incorrect. ReFS does not depend on a manually run NTFS-style chkdsk scan for this protection. Its integrity mechanisms validate data during normal I/O, and the background ReFS scrubber can proactively scan infrequently accessed data and trigger repairs.

C is Correct

To patch non-Azure hybrid machines using Azure Update Manager, on-premises Windows Servers must first be onboarded as Azure Arc-enabled servers.

For environments where on-premises servers lack direct internet egress:

Azure Arc Private Link Scope (AAPLS): Allows administrators to connect hybrid servers privately to Azure Arc management endpoints without opening inbound or outbound public internet access on the servers.
Scribd

Private Endpoint Routing: Traffic between the on-premises Connected Machine agent and Azure services (such as Azure Update Manager) routes securely over an ExpressRoute or Site-to-Site VPN via a private IP on the corporate network. This satisfies zero-direct-internet-access requirements while enabling cloud-native patch management.

Incorrect:

A. Configuring on-premises servers to download updates directly from Microsoft Update over the internet: This option requires direct outbound internet access to Microsoft’s public CDN, violating the constraint that servers operate without an internet connection.

B. Synchronising Windows Server Update Services to Azure Update Manager through a built-in bridge connector: There is no “bridge connector” between WSUS and Azure Update Manager. While WSUS can sit on-premises to host update binaries locally, Azure Update Manager interacts with servers via the Azure Arc framework, not via a direct WSUS sync channel.

D. Installing the Azure Update Manager extension on each server which handles all connectivity requirements internally: The Azure Update Manager extension relies on underlying network connectivity to the Azure Arc control plane. Installing the extension alone does not solve network isolation or proxy/private path requirements unless an Azure Arc Private Link Scope or corporate proxy is configured.

Correct:

C. Security updates that patch user-mode and kernel-mode code in memory without replacing the full OS image on disk. Hotpatch is designed specifically for security updates. It works by updating the code running in a server’s memory, rather than writing new code to the disk and performing a reboot to load it into memory. The server’s kernel redirects relevant system calls to the new code, which is verified by an integrity check before the old code is removed from memory. This allows the security fix to be applied immediately to a running process.

Incorrect:

A. Cumulative updates that include all previous patches and feature changes for the month. Hotpatch does not support cumulative updates. These are released on a quarterly cycle (typically January, April, July, and October) as a baseline and do require a reboot.

B. Feature updates that introduce new Windows Server capabilities and roles. Feature updates are not supported by Hotpatch. These updates introduce new capabilities and deep changes to the system’s core and require a restart.

D. Driver updates for network adapters and storage controllers. Non-Windows updates, such as drivers and firmware updates, are explicitly not included in the Hotpatch program and require a reboot.

C. Production profile which enables Azure Backup, Azure Monitor, Defender for Cloud, and security baselines appropriate for production workloads.
Azure Automanage provides predefined best-practice configuration profiles. The Production profile is specifically designed for production workloads. It automatically onboards and configures services including Azure Backup (for data protection), Azure Monitor / Machines Insights (for performance and health monitoring), Microsoft Defender for Cloud, security baselines (via Machine Configuration / Guest Configuration), Update Management, Change Tracking, and related management features. These settings follow Azure best practices optimized for higher-business-impact production environments.

A. Custom profile which requires the administrator to specify every setting individually. — Incorrect
Custom profiles exist and let you selectively enable/disable services or adjust certain settings (for example, Backup policy details or Antimalware). They are optional and used when best-practice profiles do not meet specific requirements. They are not the predefined profile that automatically applies the full set of production-optimized security, backup, and monitoring configurations.

B. Dev/Test profile which applies lightweight settings suitable for non-production environments. — Incorrect
The Dev/Test profile is intentionally lighter-weight. It omits Azure Backup (to avoid unnecessary cost for lower-impact machines) and certain other production-oriented services/settings. It is not intended for production workloads that require full hardening, backup, and monitoring.

D. Azure Security Benchmark profile which only applies security baselines without backup. — Incorrect
There is no separate “Azure Security Benchmark profile” among the Automanage best-practice configuration profiles. Security baselines are applied as part of the Production (and to a more limited extent Dev/Test) profiles via Machine Configuration. The Production profile includes backup and monitoring in addition to security baselines; it is not limited to baselines only.

Correct Answer:
C. Resource Monitor (resmon) which shows per-process disk read and write rates in real time.

Resource Monitor (resmon.exe) provides granular, real-time performance tracking for core system resources (CPU, Memory, Disk, Network):

Disk Tab Detail: In Resource Monitor’s Disk tab, the Processes with Disk Activity and Disk Activity tables break down disk I/O per process in real time.

Granular Bandwidth Tracking: Administrators can view the exact process name, process ID (PID), Read (B/sec), Write (B/sec), and Total (B/sec) rates to immediately identify which application or service is consuming the most disk I/O bandwidth at that exact moment.

Incorrect:

A. Event Viewer which logs disk-related events with process details: Event Viewer records system, security, and application logs asynchronously after specific events or errors occur. It is designed for historical log analysis rather than providing real-time, interactive disk bandwidth utilization rates per process.

B. Reliability Monitor which tracks hardware and software failure events over time: Reliability Monitor tracks system stability over time (such as application crashes, OS failures, and software installations) using a historical 1–10 index score. It does not display real-time disk read/write bandwidth.

D. Windows Admin Center Performance tool which shows aggregated server performance metrics: While Windows Admin Center provides modern web-based monitoring, its high-level performance dashboards display overall aggregated server trends (e.g., total IOPS, latency, or total disk throughput across the volume) rather than real-time per-process disk read/write bandwidth breakdown out of the box like Resource Monitor does.

Correct :

A. Get-ScheduledTask -CimSession (New-CimSession -ComputerName SVR01) which connects to the remote server and retrieves all scheduled task definitions.
The Get-ScheduledTask cmdlet (from the ScheduledTasks module) is the native PowerShell cmdlet used to retrieve scheduled task definitions. It supports remote management directly through the -CimSession parameter.
You create a CIM session to the remote computer and pass it to the cmdlet:
PowerShellGet-ScheduledTask -CimSession (New-CimSession -ComputerName SVR01)
(or store the session in a variable first). This is the documented, preferred method for managing scheduled tasks on remote Windows Servers.

Incorrect:

B. Get-Process -ComputerName SVR01 which lists running processes on the remote server.
This retrieves running processes, not scheduled tasks. It is unrelated to Task Scheduler.

C. Invoke-Command -ComputerName SVR01 -ScriptBlock { Get-ScheduledTask } which runs the cmdlet remotely via PowerShell Remoting.
This works as a general PowerShell Remoting technique (it executes Get-ScheduledTask on the remote server), but it is not the direct/native parameter of the ScheduledTasks cmdlets. The module is designed to use -CimSession for remote operations.

D. Get-Service -ComputerName SVR01 which retrieves Windows services on the remote server.
This retrieves Windows services, not scheduled tasks.

Correct Answer:
B. Migrating a Windows Server role such as DHCP or File Services along with its configuration and data from a source server to a destination server.

Windows Server Migration Tools (WSMT) is a built-in feature in Windows Server consisting of PowerShell cmdlets (Export-SmigServerSetting, Import-SmigServerSetting) and utilities designed to assist administrators in transferring server roles, features, operating system settings, and data from a source server to a target server running a newer version of Windows Server.

Role & Data Transfer: WSMT natively supports exporting and importing the configuration, databases, lease scopes, and settings for specific server roles—such as DHCP Server, File and Storage Services, Print and Document Services, and local user/group configurations—from an older operating system instance to a clean, newly installed destination server.

Incorrect:

A. Migrating an on-premises physical server to an Azure VM using agentless replication: Migrating physical machines or virtual servers to Azure VMs using agentless or agent-based replication is handled by Azure Migrate or Azure Site Recovery (ASR), not by WSMT.

C. Migrating Active Directory from Windows Server 2016 to Windows Server 2025 by upgrading the domain functional level: Active Directory Domain Services (AD DS) migrations/upgrades are performed by promoting a new domain controller running the newer OS version into the existing domain, replicating AD/SYSVOL data, transferring FSMO roles, and raising domain/forest functional levels. WSMT is not used for AD DS schema or controller migrations.

D. Migrating a virtual machine between two Hyper-V hosts in a live migration operation: Moving a running VM between Hyper-V hosts without downtime is performed using Hyper-V Live Migration (or Shared Nothing Live Migration) managed via Hyper-V Manager or Failover Cluster Manager, not via Windows Server Migration Tools.

Correct:
C. The Allowed to Authenticate permission granted to the specific trusted users or groups on the resource server’s computer object in the trusting domain. When a forest trust is configured with selective authentication, users from the trusted forest are not automatically granted access to any resource in the trusting forest. Instead, they must be explicitly granted the Allowed to Authenticate permission on the computer object of the specific server they need to access within the trusting domain . This permission must be configured on the resource server’s computer object in Active Directory, effectively acting as a gatekeeper for authentication requests from the trusted forest .

Incorrect:

A. A site link bridge between the two forest sites to allow authentication traffic to flow. Site link bridges are related to Active Directory replication topology and do not govern the authentication permissions required for selective authentication.

B. A Selective Authentication group policy applied at the domain level of the trusting forest. This is not a requirement. Selective authentication is configured at the trust level, not through a Group Policy Object (GPO) applied to a domain . While user-based GPOs might be affected by selective authentication, they do not grant the necessary access permissions .

D. A DNS delegation that allows the trusting forest’s DNS to resolve the trusted forest’s domains. While proper DNS resolution is necessary for forest trusts to function, it is not the specific configuration that grants access to a resource server when selective authentication is enabled.

A. Log Analytics workspace connection which automatically collects all available data types

Incorrect.

A Log Analytics workspace is the destination for collected data, but it does not define what data is collected.

AMA requires a configuration object (Data Collection Rule) to specify sources, filters, and destinations.

B. Azure Policy assignment which deploys the AMA extension and configures data collection

Incorrect.

Azure Policy can be used to deploy AMA across servers, but it does not define the collection rules themselves.

Policy enforces deployment and compliance, not the specifics of what data is collected.

C. Diagnostic settings on the server resource which configure data forwarding to Azure Monitor

Incorrect.

Diagnostic settings apply to Azure resources (VMs, storage accounts, etc.) but not to Arc?enabled or on?premises servers using AMA.

AMA relies on Data Collection Rules, not diagnostic settings.

D. Data Collection Rule (DCR) which specifies the data sources, filtering criteria, and destination workspaces for Azure Monitor Agent

Correct.

Data Collection Rules (DCRs) define:

Which data sources (event logs, performance counters, syslog, etc.) AMA should collect.

Any filtering criteria (e.g., specific event IDs).

The destination (Log Analytics workspace, Event Hub, Storage account).

Certification highlights DCRs as the authoritative configuration object for AMA.

Correct :

D. DNSSEC provides cryptographic signatures on DNS records so that resolvers can verify that responses have not been tampered with or forged.
DNS Security Extensions (DNSSEC) add a layer of authenticity and integrity to the Domain Name System. It works by having the authoritative DNS server digitally sign resource records (using public-key cryptography). Validating resolvers can then check these signatures to confirm that:

The response actually came from the legitimate authoritative source.
The data has not been modified in transit (i.e., it has not been tampered with or forged).

This protection is what standard (unsigned) DNS lacks. Standard DNS responses can be spoofed or altered by attackers (for example, in cache-poisoning or man-in-the-middle attacks).

Incorrect:

A. DNSSEC provides automatic failover to a secondary DNS server when the primary is unavailable.
Failover / high availability is handled by having multiple authoritative name servers, secondary zones, or load-balancing mechanisms. DNSSEC does not provide failover.

B. DNSSEC prevents DNS queries from reaching authoritative servers outside the corporate network.
DNSSEC does not control or restrict query routing. Query policy or network controls (firewalls, split-horizon DNS, etc.) would be used for that purpose.

C. DNSSEC encrypts DNS query and response content to prevent eavesdropping.
DNSSEC provides authentication and integrity, not confidentiality. DNS queries and responses remain readable. Confidentiality (encryption of DNS traffic) is provided by technologies such as DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), or DNSCrypt—not by DNSSEC.

Correct :
A. Azure AD DS is a one-way trust domain where Microsoft manages the domain controllers and schema extensions are not supported.

Microsoft Entra Domain Services (formerly Azure AD DS) provides managed domain services (such as domain join, group policy, LDAP, and Kerberos/NTLM authentication) without needing to deploy, manage, or patch domain controllers:

Managed Infrastructure: Microsoft fully manages the underlying domain controllers, performing OS updates, backups, and health monitoring automatically.

No Schema Extensions: Because it is a managed service operating inside a strict security perimeter, administrators do not have Domain Admin or Enterprise Admin permissions. Custom Active Directory schema extensions are strictly unsupported.

Forest Trust Model: When connecting to an on-premises Active Directory environment, Entra Domain Services supports creating a one-way resource forest trust (or two-way via Enterprise/Premium SKUs) to allow cloud-hosted workloads to trust user accounts authenticated by the managed domain or on-premises AD.

Incorrect:

B. Azure AD DS replicates bidirectionally with on-premises AD DS to maintain a single forest: Entra Domain Services uses a one-way synchronization flow from Microsoft Entra ID into the managed domain. It does not perform direct, bidirectional Active Directory replication (RPC/IP) with on-premises Active Directory domain controllers to form a unified AD DS forest.

C. Azure AD DS supports creating Organisational Units and Group Policy Objects directly within the managed domain: While administrators can create custom OUs (AADDC Computers, AADDC Users) and configure custom GPOs within those specific OUs, this statement alone fails to capture the fundamental architectural and administrative restrictions (like lack of Domain Admin rights and missing schema modification access) that differentiate a managed domain service from a self-managed AD DS domain.

D. Azure AD DS requires an on-premises domain controller to be running at all times for the managed domain to function: Entra Domain Services is a standalone, cloud-native managed service hosted inside an Azure Virtual Network. It functions independently of any on-premises domain controllers or physical infrastructure.

Correct:

A. Dependency Agent data which captures network connection information and process details from inside the VM and sends it to the Log Analytics workspace.

The Map feature in Azure Monitor VM Insights visualizes process-level network connections and dependencies across hybrid Windows Server virtual machines and connected systems.

To render this visual dependency map, Azure requires the Dependency Agent installed alongside the Azure Monitor Agent (AMA). The Dependency Agent monitors internal guest OS process activity and active TCP network connections, streaming this dependency data into the Log Analytics workspace (specifically populating tables like VMConnection and VMBoundPort).

Incorrect:

B. Azure Activity Log data from the server’s Azure resource record.

The Azure Activity Log is a control-plane logging mechanism that records management events on the Azure resource level (e.g., stopping/starting VMs, applying Azure tags, or updating ARM configurations). It has no visibility into internal guest OS processes or network connections.

C. Windows performance counter data collected by the Azure Monitor Agent extension.

Performance counters (such as % Processor Time, Available MBytes, and Disk Transfers/sec) supply data for the Performance tab in VM Insights. While essential for resource monitoring, performance counters only measure quantitative resource utilization and do not track process-level network dependency mappings.

D. Boot diagnostics data from the VM startup screen capture feature.

Boot diagnostics collect serial log output and startup screenshots from hypervisor-level diagnostics to troubleshoot VM boot failures. It operates strictly during VM startup and does not monitor running OS processes or network traffic.

Correct :

B. Node and disk witness quorum using a small witness disk on shared storage so the cluster has three votes total and can survive one node failure.
In a Windows Server Failover Cluster, quorum determines which set of nodes is allowed to keep the cluster online and own resources. The goal is to always maintain a majority of votes so that only one “side” of a potential network partition can run (preventing a split-brain scenario).

In a two-node cluster:

Each node has 1 vote ? total of 2 votes.
A majority requires more than half the votes. With only 2 votes, losing communication between the nodes creates a 1–1 tie. Both nodes could try to take ownership of resources ? split-brain risk and potential data corruption.

Adding a Disk Witness (a small shared disk accessible by both nodes) gives the cluster a third vote. Total votes become 3.

If one node fails or is partitioned, the surviving node + the disk witness still have 2 out of 3 votes ? majority is maintained and the cluster stays online.
This is the classic “Node and Disk Majority” (or Node + Disk Witness) configuration recommended for two-node clusters that have shared storage.

Incorrect:

A. Node majority quorum requiring two node votes out of two total votes to achieve quorum.
Pure Node Majority with only two nodes requires both nodes to be online and communicating. Loss of one node (or network partition) means the remaining node has only 1 of 2 votes and loses quorum. The cluster goes offline and does not safely prevent split-brain in the partition case.

C. Dynamic quorum which automatically removes offline nodes from the quorum vote count.
Dynamic quorum (and dynamic witness) is a modern enhancement that adjusts votes automatically, but it is not itself a complete quorum configuration for a two-node cluster. You still need a witness (disk, file share, or cloud) to provide the third vote. Dynamic quorum alone does not solve the two-node tie problem.

D. No quorum witness, relying only on node votes so that each node has one vote.
This is the pure Node Majority model with two votes. As explained above, it cannot safely handle the failure or partition of one node without risking a split-brain or forcing the cluster offline.

C is Correct
During a Storage Migration Service (SMS) workflow in Windows Server, after data transfer operations complete, the job executes a Transfer Validation step:

Hash & Integrity Verification: This sub-phase performs a file-level verification (such as checksum/hash comparisons, file size checks, and ACL attribute evaluation) between the source and target volumes.

Pre-Cutover Assurance: Running validation ensures that all files, folder structures, SMB shares, and security permissions (NTFS ACLs) have been successfully transferred without corruption or missing data before the administrator initiates the final, disruptive cutover process.

Incorrect:

A. Transfer phase which copies files, shares, and permissions from source to destination: While the transfer phase handles the actual copying of files, folder hierarchies, share configurations, and security attributes from the source to the target server, the copy execution itself does not represent the specific post-transfer verification check used to validate data integrity.

B. Inventory phase which scans the source server and creates a list of files to be migrated: The inventory phase occurs at the very beginning of the SMS job. Its purpose is to scan the source server to discover volumes, file counts, total capacity, shares, and network configurations prior to performing any copy operations.

D. Cutover phase which redirects clients to the new server and decommissions the old server: The cutover phase is the final operational step where IP addresses and computer names are swapped, old shares are taken offline, and client traffic is cut over to the new destination server. Validation must be performed prior to cutover to avoid service disruption with incomplete data.

The correct answer is A. Storage Replica which provides synchronous or asynchronous block-level replication of volumes between the primary and secondary site storage.

Stretch Clustering for disaster recovery explicitly relies on Storage Replica to synchronize storage between sites . It is designed to operate below the file level for continuous replication and supports both synchronous and asynchronous modes .

Here is an analysis of why the other options are incorrect:

B. Windows Server Backup scheduled tasks: This is a backup solution, not a real-time replication technology. It does not provide the continuous data synchronization required for automatic failover in a stretch cluster.

C. Azure Site Recovery: This service is for replicating VMs to Azure or between Azure regions, not for replicating storage volumes between two on-premises sites in a stretch cluster .

D. DFS Replication: This is a file-level replication service with high latency, often measured in hours or days, and is unsuitable for the low-latency, block-level synchronization needed for a stretch cluster .

A. Active Directory Federation Services which provides claims?based identity for web applications

Incorrect.

AD FS is used for federated authentication and claims?based identity for web applications.

It does not host a copy of the AD DS database and is not a domain controller role.

B. Global Catalog server which holds a partial writable replica of the forest

Incorrect.

A Global Catalog server holds a partial, writable replica of all objects in the forest to speed up searches.

It is not read?only and does not serve as the branch office solution described in the scenario.

C. Read?Only Domain Controller (RODC) which holds a non?writable replica of AD DS and caches credentials for local users

Correct.

An RODC is a domain controller that hosts a read?only copy of the AD DS database.

It is designed for branch offices where security or connectivity may be limited.

It can cache credentials for local users to improve authentication performance while preventing unauthorized changes to AD DS.

Certification highlights RODC as the correct solution for this scenario.

D. Active Directory Lightweight Directory Services which provides a standalone directory for applications

Incorrect.

AD LDS provides a standalone directory service for applications, separate from AD DS.

It does not function as a domain controller and does not replicate the AD DS database.

Correct option: D. Audit mode which logs blocked applications in the event log without preventing their execution.
Windows Defender Application Control (WDAC), also known as App Control for Business, supports two primary policy modes:

Audit mode — The policy evaluates applications against the rules and logs events (primarily Event ID 3076 in the Microsoft-Windows-CodeIntegrity/Operational log) for any application that would be blocked. The application is still allowed to run. This mode is used during testing and deployment so administrators can identify missing rules, legitimate applications that need to be allowed, and potential issues before switching to full enforcement.
Enforced (or Enforce) mode — The policy actively blocks applications that do not meet the rules and logs the blocks (Event ID 3077).

Audit mode is the recommended starting point for any new or updated WDAC policy.
Why the other options are incorrect

A. Passive mode which requires manual administrator confirmation before blocking each application.
There is no “Passive mode” in WDAC that prompts for manual confirmation on each application. WDAC operates in Audit or Enforced mode only.
B. Monitor mode which uses Windows Defender AV scanning to flag unapproved applications.
There is no “Monitor mode” in WDAC. Application control decisions are based on the WDAC policy rules (code signing, hashes, path rules, etc.), not on Windows Defender Antivirus scanning.
C. Block mode which actively prevents all unapproved applications from running immediately.
This describes Enforced mode, not the testing/pre-enforcement mode asked for in the question. The question specifically asks for the mode that runs checks but does not block applications.

The correct answer is C. Microsoft iSCSI Initiator which discovers, connects to, and presents iSCSI targets as local block devices.

The iSCSI architecture operates on a client-server model. The iSCSI Initiator is the client-side software component installed on the server that needs to access the storage. Its primary function is to discover available iSCSI targets on the network, establish a connection to them, and then present the connected storage as a local block device (like a directly attached physical disk) to the Windows operating system. The Microsoft iSCSI Initiator is built into Windows Server and is managed via the iscsicpl.exe control panel applet or PowerShell cmdlets.

Incorrect:

A. Server Message Block (SMB) client: SMB is a file-level protocol used for accessing shared folders and files, not block-level storage. It does not present a raw disk to the OS.

B. Windows Network File System (NFS) client: NFS is also a file-level protocol for sharing directories, not block storage. It does not present a target as a local disk for formatting or block-level operations.

D. Multipath I/O (MPIO): MPIO is an additional feature used for fault tolerance and load balancing that works with the iSCSI Initiator by creating multiple connections to the same target. It is not a replacement for the initiator itself and is not strictly required for a basic connection.

B is Correct
The Azure Migrate: Discovery and assessment tool (formerly Server Assessment) performs agentless discovery, inventorying, dependency mapping, and sizing calculations for on-premises workloads:

Lightweight Appliance: For VMware vSphere environments, administrators download an OVA template to deploy a single Azure Migrate appliance as a virtual machine in their vCenter environment.

Agentless vCenter API Integration: The appliance connects directly to VMware vCenter Server using read-only API credentials to discover VM configurations, operational performance metadata (CPU, RAM, disk utilization), and installed software without requiring any agent software or drivers to be installed inside individual guest OS virtual machines.

Incorrect:

A. Azure Arc which discovers and inventories VMs when the Connected Machine agent is installed on each VM: Azure Arc is designed for hybrid server management and governance (enabling policy enforcement, patch management via Azure Update Manager, and logging). It requires installing the Azure Connected Machine agent on every guest machine, making it an agent-based management solution rather than an agentless migration assessment tool.

C. Azure Site Recovery which discovers VMs through the Hyper-V or VMware vCenter API: Azure Site Recovery (ASR) is a disaster recovery orchestration tool designed for ongoing replication and failover, not for executing pre-migration sizing, readiness assessments, or cost estimations. Furthermore, ASR replication for VMware requires installing the Mobility Service agent on each source VM.

D. Microsoft Defender for Cloud which scans the VMware environment and produces a migration readiness report: Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) and workload protection across multi-cloud and hybrid infrastructure. It identifies security vulnerabilities and misconfigurations rather than conducting infrastructure migration readiness and Azure sizing assessments.