A. SMB compression applies only to files larger than 10 GB

Incorrect.

SMB compression does not impose a strict 10 GB threshold.

Compression can apply to smaller files, though efficiency is greater for large files.

The limitation is not defined by a fixed size requirement.

B. SMB Direct requires both client and server to run Windows Server with RDMA?capable network adapters

Incorrect.

This describes SMB Direct, which uses RDMA for low?latency transfers.

It is unrelated to SMB compression limitations.

Compression can work without RDMA adapters.

C. SMB compression requires RDMA network adapters to achieve meaningful bandwidth reduction

Incorrect.

SMB compression does not require RDMA adapters.

RDMA improves performance for SMB Direct, but compression is independent and works over standard TCP/IP.

D. SMB compression cannot be used simultaneously with SMB encryption

Correct.

SMB compression and SMB encryption are mutually exclusive features.

If SMB encryption is enabled, compression cannot be applied to the same transfer.

Certification highlights this as the key limitation of SMB compression in Windows Server 2025.

The correct answer is D. WS-Federation and SAML 2.0 which provide browser redirect-based authentication and claims-based identity for web application SSO.

AD FS (Active Directory Federation Services) provides Single Sign-On (SSO) for web applications using a claims-based identity model . The core protocols it utilizes for browser-based SSO scenarios are WS-Federation and SAML 2.0 . These are the “traditional” web SSO protocols that work by redirecting the user’s browser to AD FS for authentication and then returning security tokens containing claims about the user’s identity .

Incorrect:

A. RADIUS which authenticates network access requests from VPN clients: RADIUS is a networking protocol used for authenticating users accessing network services like VPNs or wireless networks . It is not a browser-based SSO protocol used by AD FS for web applications.

B. OpenID Connect only which has replaced all legacy protocols in AD FS 2019: This is incorrect for two reasons. First, while AD FS 2019 and later versions do support OpenID Connect and OAuth 2.0 for modern applications and APIs , they have not “replaced” WS-Federation and SAML 2.0, which are still supported. Second, OpenID Connect is primarily an identity layer on top of OAuth 2.0, designed for modern app and API scenarios, not all web SSO.

C. Kerberos which provides SSO for domain-joined Windows clients accessing internal resources: Kerberos is the primary authentication protocol for Active Directory on the internal network, providing SSO for domain-joined Windows clients . While AD FS can leverage Windows Integrated Authentication (which uses Kerberos) for SSO in an intranet environment, Kerberos itself is not the web SSO protocol that AD FS uses to issue tokens to web applications.

Correct:

D. Event Viewer filtered for the System log with source Kernel-Power or BugCheck events which record unexpected shutdown causes and stop codes.

Event Viewer is the primary built-in Windows Server tool for post-mortem analysis of system crashes and unexpected shutdowns.

Unexpected shutdowns and system crashes (Blue Screens of Death / BSODs) write critical failure details to the System log:

Event ID 41 (Kernel-Power): Indicates the system rebooted or shut down unexpectedly without performing a clean shutdown sequence first.

Event ID 1001 (BugCheck): Logs the specific stop code (e.g., 0x0000000A), memory dump location, and parameter details needed to identify the driver or hardware failure that triggered the crash.

Event ID 6008 (EventLog): Logs that the previous system shutdown was unexpected.

Incorrect:

A. Disk Management which shows volume health status and identifies disk errors causing shutdowns.

Disk Management (diskmgmt.msc) is a graphical MMC snap-in used to create, format, resize, and manage disk partitions and dynamic volumes. It does not analyze historical event logs, read boot configuration data, or log kernel shutdown events.

B. Windows Memory Diagnostic which tests RAM for errors after an unexpected shutdown.

Windows Memory Diagnostic (mdsched.exe) runs hardware diagnostics on system RAM during a reboot to detect physical memory faults. While bad RAM can cause unexpected crashes, Memory Diagnostic itself does not analyze saved event logs or read past shutdown stop codes.

C. System File Checker (sfc /scannow) which verifies and repairs corrupted system files.

System File Checker is a command-line utility used to scan and repair corrupted or missing protected Windows system files using cached source copies. It is a repair tool, not an diagnostic tool designed to analyze saved log files to explain why a prior crash occurred.

A. File shares containing large numbers of similar document files

Incorrect.

File shares with many similar documents (e.g., Office files, PDFs) are ideal candidates for deduplication.

Deduplication can significantly reduce storage consumption in this scenario.

B. VDI gold image VHD files that are not currently in use

Incorrect.

Deduplication works well for VDI scenarios, especially gold images and base VHDs that contain large amounts of duplicate data.

This is a recommended workload type for deduplication.

C. Running virtual machine VHD/VHDX files that are actively in use by a running Hyper?V VM

Correct.

Deduplication is not appropriate for actively running VM disks.

Applying deduplication to live VHD/VHDX files can cause performance degradation and potential corruption because the workload is highly write?intensive.

Certification explicitly warns against using deduplication on active VM storage volumes.

D. Software deployment shares containing multiple copies of similar installation files

Incorrect.

Deployment shares often contain duplicate installation binaries.

Deduplication is highly effective in reducing storage consumption in this scenario.

A. The Configuration Server VM deployed on-premises is correct. For Azure Site Recovery protection of on-premises VMware VMs, the configuration server is the central on-premises management point. In the classic architecture, the configuration server machine runs the Configuration Server, Process Server, and Master Target Server components.

Its responsibilities include:

Coordinating communication between the on-premises VMware environment and Azure.

Managing and orchestrating replication.

Hosting the Process Server, which receives replication data, performs caching, compression, and encryption, and sends the data to Azure Storage.

Hosting the Master Target Server, which handles replication data during failback.

Installing the Mobility Service on protected VMs and supporting machine discovery.

The configuration server communicates with protected VMs over HTTPS and orchestrates replication with Azure over HTTPS.

Incorrect:

A. Configuration Server VM
Correct. It is the on-premises control and coordination component and, in the standard deployment, hosts the Process Server and Master Target Server.

B. MABS agent installed on the vCenter Server
Incorrect. Microsoft Azure Backup Server (MABS) is a backup product and is not the Azure Site Recovery component used to manage VMware VM replication. The configuration server is deployed as the required Site Recovery management appliance; MABS is not installed on vCenter for this purpose.

C. Mobility Service agent installed on each protected VM
Incorrect. The Mobility Service runs on each protected VM and captures or replicates changes from that VM, but it is an agent rather than the central management point. It does not host the Process Server or Master Target Server and does not orchestrate the overall VMware-to-Azure deployment.

D. Azure Recovery Services vault
Incorrect. The Recovery Services vault is the Azure-side resource used to configure and manage Site Recovery protection, store replication metadata, and coordinate recovery operations. It is not the on-premises replication target or proxy component, and replicated VM data is sent to Azure Storage rather than being stored directly as ordinary data in the vault.

B. Event ID 4720 which records the creation of a new user account in Active Directory.
In the Windows Security event log (collected into the Azure Monitor Log Analytics SecurityEvent table), Event ID 4720 is generated whenever a new user account is created. This applies to both domain accounts (on domain controllers) and local SAM accounts. The event records the subject (who performed the creation), the new account details (name, SID, SAM account name, UPN, etc.), and account attributes. It is the standard event used to audit and detect user account creation in Active Directory.

A. Event ID 4625 which records failed logon attempts. — Incorrect
Event ID 4625 is logged for failed logon attempts (including the failure reason/status code). It is used for detecting brute-force or password-spray activity, not account creation.

C. Event ID 4732 which records the addition of a member to a security-enabled local group. — Incorrect
Event ID 4732 records when a member is added to a security-enabled local group (for example, adding a user to the local Administrators group). It is a group membership change event, not an account creation event.

D. Event ID 4776 which records attempts to validate credentials against the local SAM database. — Incorrect
Event ID 4776 is logged when a computer attempts to validate credentials via NTLM against the local Security Account Manager (SAM) database (or domain controller for domain accounts in certain scenarios). It is an authentication/validation event, not related to creating user accounts.

Correct Answer:
C. Domain user NTLM hashes and Kerberos Ticket Granting Tickets by storing them in an isolated virtualisation-based security environment inaccessible to the main OS.

Windows Defender Credential Guard uses Virtualization-Based Security (VBS) to isolate secrets so that only privileged system software can access them:

LSASS Isolation: In standard Windows configurations, the Local Security Authority Subsystem Service (lsass.exe) process stores domain credentials (such as Kerberos Ticket Granting Tickets, NTLM hashes, and cached credentials) directly in operating system memory. Credential Guard moves the portion of LSASS that manages these secrets into an isolated Hyper-V container running in Virtual Trust Level 1 (VTL1).

Mitigating Credential Dumping: Even if an attacker achieves administrative privileges or local kernel-level compromise on the host operating system (VTL0), tools like Mimikatz cannot read or extract domain credentials from process memory because the memory space is protected hardware-wise by the Hyper-V hypervisor.

Incorrect:

A. File share credentials cached by Windows Credential Manager: Credential Guard does not protect generic credentials stored in the standard Windows Credential Manager (such as web browser saved passwords, saved RDP credentials, or custom application passwords).

B. Local administrator account NTLM hashes stored in the SAM database: Credential Guard specifically protects active domain-based authentication secrets stored in LSASS memory (Kerberos TGTs and NTLM session hashes). It does not encrypt or protect local accounts stored on disk in the Security Account Manager (SAM) database or protect local account authentication secrets in the same manner.

D. TPM-stored BitLocker recovery keys which are moved to the VBS environment: BitLocker drive encryption keys and recovery passwords are bound directly to the Trusted Platform Module (TPM) hardware or Active Directory/Entra ID. They operate at the firmware/boot level and are not managed or relocated into the LSASS VBS container by Credential Guard.

The correct answer is C. The zone’s DNSKEY record trust anchor distributed to all validating resolvers so they can verify the chain of trust from the trust anchor to the signed records.

For DNSSEC to function, a validating resolver must have a starting point to establish the “chain of trust.” This starting point is the trust anchor. A trust anchor is a pre-configured copy of the zone’s DNSKEY resource record (or a DS record derived from it) that the resolver explicitly trusts. When a resolver receives a signed DNS response, it uses this trust anchor to verify the cryptographic signatures on the records, validating their authenticity and integrity. Without a configured trust anchor, the resolver cannot perform this validation.

Incorrect::

A. A Certificate Authority that issues TLS certificates: This is the foundation of HTTPS and secure web browsing, not DNSSEC. DNSSEC uses a hierarchical system of cryptographic keys and digital signatures, not TLS certificates from a public CA.

B. DNS forwarders pointing to public DNSSEC-validating resolvers: While this configuration would allow clients to get validated answers, it is not a requirement. Clients can perform validation themselves if they have the necessary trust anchors. Forwarding is an architectural choice, not a prerequisite for DNSSEC validation.

D. An OCSP responder that confirms the validity of DNSSEC keys: OCSP (Online Certificate Status Protocol) is a mechanism for checking the revocation status of TLS certificates. It is not part of the DNSSEC protocol, which uses signatures and expiration times for key management.

A. A buffer overflow which allows writing data beyond allocated memory boundaries

Incorrect.

A buffer overflow occurs when a program writes beyond the bounds of allocated memory, often leading to corruption or security vulnerabilities.

It does not typically cause continuous memory growth; instead, it causes crashes or exploits.

B. A stack overflow where recursive function calls exhaust the thread stack space

Incorrect.

A stack overflow happens when the call stack is exhausted, usually due to uncontrolled recursion.

This results in immediate crashes, not gradual memory growth over time.

C. A memory leak where a process allocates memory but fails to release it, causing total committed memory to grow until resources are exhausted

Correct.

A memory leak occurs when applications allocate memory but fail to free it.

Over time, this causes memory usage to continuously increase until the system runs out of resources.

Certification highlights this as the classic cause of gradual memory growth requiring a reboot to recover.

D. A race condition where two threads access shared memory simultaneously causing inconsistent state

Incorrect.

A race condition causes unpredictable behavior due to concurrent access, often leading to inconsistent data or crashes.

It does not inherently cause continuous memory growth.

Correct Answer:
C. Resource-Based Constrained Delegation (RBCD) which configures delegation on the resource service rather than the front-end service and specifies which accounts can delegate to it.

Resource-Based Constrained Delegation (RBCD) represents the most restrictive, granular, and secure form of Kerberos delegation introduced in Active Directory:

Resource-Centric Control: Traditional Kerberos Constrained Delegation (KCD) sets the msDS-AllowedToDelegateTo attribute on the front-end service account, granting it broad permission to impersonate users to a list of backend SPNs. In contrast, RBCD places control directly on the target resource by setting its msDS-AllowedToActOnBehalfOfOtherIdentity attribute.

Principle of Least Privilege: Because the back-end resource explicitly defines which front-end service accounts are authorized to send delegated Kerberos tickets to it, resource owners maintain strict boundaries over their own assets. Furthermore, RBCD removes the requirement for SeEnableDelegationPrivilege (which requires Domain Admin rights to configure traditional KCD), allowing local administrators of the resource object to manage access safely.

Incorrect:

A. Protocol transition delegation which allows any authentication protocol for the initial user authentication before Kerberos delegation: Protocol Transition (configured via S4U2Self / “Use any authentication protocol”) expands delegation flexibility rather than restricting it. It permits a front-end service to authenticate a user via non-Kerberos methods (such as NTLM, OAuth, or HTTP basic auth) and still request a Kerberos service ticket (S4U2Proxy) to a back-end resource on the user’s behalf.

B. Constrained delegation using Kerberos only which restricts the services the account can access but requires the user to authenticate via Kerberos first: Traditional Kerberos-only Constrained Delegation is configured on the front-end account itself and is less restrictive than RBCD. It grants the front-end service account broad domain permissions to delegate to specific SPNs, but does not give the back-end resource the ability to restrict or enforce which incoming front-end services it will accept.

D. Unconstrained delegation which allows the service to impersonate the user to any service in the domain: Unconstrained delegation is the least restrictive and most insecure model. When a user authenticates to a service configured with unconstrained delegation, the user’s full Ticket Granting Ticket (TGT) is cached in the service’s LSASS memory, allowing that service to impersonate the user across any service across the entire Active Directory domain.

The correct answer is B. The enforced GPO applies to the child OU despite Block Inheritance being configured.

In Group Policy processing, Enforced is a setting applied to a Group Policy Object (GPO) link, while Block Inheritance is a setting applied to an Active Directory container like an Organizational Unit (OU) . The Enforced setting is designed to override Block Inheritance . If a GPO linked to a parent OU is marked as Enforced, it will apply to all child containers, even if those child containers have Block Inheritance enabled .

Incorrect:

A. The enforced GPO applies only to computer objects in the child OU but not to user objects.
This is incorrect. An enforced GPO applies to both user and computer objects within its scope, provided the relevant settings are configured. The Enforced property affects the inheritance of the policy, not its target object type.

C. The enforced GPO is blocked along with all other GPOs when Block Inheritance is active.
This is the opposite of how these features interact. The primary purpose of the Enforced setting is to ensure that a GPO is not blocked by a child OU’s Block Inheritance setting .

D. The GPO linked to the parent OU that contains the organisational policy settings for the child OU computers.
This is a descriptive statement rather than an explanation of the effect. It does not address the specific behavior when both Enforced and Block Inheritance are configured.

B. TCP Chimney Offload is deprecated and disabled by default on modern Windows Server versions due to stability issues in certain hardware configurations.
TCP Chimney Offload (also known as TCP Offload Engine / TOE) allows the operating system to offload TCP connection processing to a compatible network adapter. Microsoft has deprecated this feature. Official guidance states that TCP Chimney Offload (along with IPsec Task Offload) should not be used because it is deprecated in Windows Server 2016 and later, may adversely affect server and networking performance, and Microsoft may remove support for it in the future. It is disabled by default on modern Windows Server versions. The Windows TCP/IP stack is generally more efficient than hardware TOE implementations, and the feature saw limited adoption and hardware support.

A. TCP Chimney Offload must be enabled to achieve gigabit network speeds on Windows Server VMs. — Incorrect
Modern Windows Server achieves high network speeds (including multi-gigabit) using other offloads such as checksum offload, Large Send Offload (LSO), Receive Side Scaling (RSS), and Receive Segment Coalescing (RSC). TCP Chimney Offload is neither required nor recommended for performance.

C. TCP Chimney Offload should be enabled on all adapters to maximise throughput. — Incorrect
The opposite is true. Microsoft explicitly advises against enabling it. Enabling it can introduce instability or performance degradation with certain drivers/hardware, which is why it was disabled by default and later deprecated.

D. TCP Chimney Offload is required for SMB Direct and should always be enabled alongside RDMA. — Incorrect
SMB Direct relies on Remote Direct Memory Access (RDMA) (RoCE or iWARP), not TCP Chimney Offload. These are separate technologies. TCP Chimney Offload is unrelated to RDMA/SMB Direct and is not required (or recommended) for it.

A. By executing DSC?based configuration definition packages through the Machine Configuration extension installed on the server

Correct.

Azure Automanage Machine Configuration uses Desired State Configuration (DSC) packages delivered via the Machine Configuration extension.

These packages define compliance rules and are executed locally on the Arc?enabled server to collect configuration data.

Certification highlights this as the supported mechanism for assessing and enforcing OS settings.

B. By reading the server’s Azure resource metadata stored in Azure Resource Manager

Incorrect.

Resource metadata in ARM describes the resource object but does not provide detailed OS configuration data.

Machine Configuration requires local execution of DSC packages, not metadata inspection.

C. By connecting via SSH to the server and running PowerShell commands on demand

Incorrect.

SSH is not used by Machine Configuration for assessment.

The process is agent?based via the extension, not interactive remote sessions.

D. By capturing scheduled task output from a compliance scanning script deployed via Azure Automation

Incorrect.

Azure Automation can run scripts, but Machine Configuration does not rely on scheduled task outputs.

Compliance assessment is handled through DSC packages executed by the extension.

Correct Answer:
C. WSFC quorum determines whether the cluster itself is operational so that automatic failover of Availability Group replicas only occurs when the cluster has quorum and the primary replica is unavailable.

In SQL Server Always On Availability Groups, Windows Server Failover Clustering (WSFC) serves as the underlying health detection and cluster state mechanism:

Cluster Health & Split-Brain Prevention: The quorum model relies on a voting majority across cluster nodes and witness resources (such as a File Share Witness or Cloud Witness) to ensure that the overall WSFC cluster remains healthy and operational.

Automatic Failover Gatekeeper: SQL Server manages database synchronization, but automatic failover of an Availability Group (AG) can take place only if the underlying WSFC cluster maintains quorum. If the primary replica fails while quorum is maintained, the cluster service initiates and coordinates the failover transition to an available secondary replica. If quorum is lost, the cluster brings all AG resources offline to prevent data corruption or split-brain scenarios.

Incorrect:

A. WSFC quorum assigns ownership of the Availability Group listener IP address to the active replica: The WSFC Resource Manager (and the AG resource configuration inside WSFC), not the quorum mechanism itself, binds and transitions ownership of the Virtual IP (VIP) and Network Name resource (the listener) to the node hosting the primary replica. Quorum strictly defines the voting threshold for cluster health.

B. WSFC quorum is not involved in Availability Group failover which is managed entirely by SQL Server: Always On AGs (in standard WSFC-based deployments) depend directly on WSFC services for cluster membership, node heartbeat monitoring, and failover coordination. Without quorum, SQL Server cannot safely execute automatic failover.

D. WSFC quorum controls which databases are included in the availability group: Databases are joined to an Availability Group at the application layer inside SQL Server Management Studio (SSMS) or via T-SQL / PowerShell. WSFC has no awareness or control over individual database inclusions within an AG.

The correct answer is B. The Dynamic Memory balancer reduces memory assigned to VMs with lower priority until their working set pressure increases.

When host memory becomes scarce, Hyper-V’s Dynamic Memory balancer intervenes to manage allocation. The balancer uses a Memory Priority setting assigned to each virtual machine to determine which VMs should be affected first. It will reclaim physical memory from lower-priority VMs before higher-priority ones, allowing the host to continue operating and start new VMs. This process is typically performed by inflating a “balloon driver” within the guest OS, which prompts the guest to page its own memory to disk, or by other memory management techniques. Performance metrics like “Average Pressure” help monitor when memory is critically low; if this value exceeds 100, it indicates the host is out of memory and VMs are paging heavily.

Incorrect:

A. Dynamic Memory is disabled automatically: This is incorrect. Dynamic Memory is not disabled automatically when host memory reaches a specific threshold; it remains active and its balancer continues to manage allocation based on priority.

C. The host swaps VM memory to disk: While memory pressure may cause VMs to page within their own guest OS, the Hyper-V host itself does not directly swap VM memory to a host page file as the primary mechanism. The process involves the guest OS and the balloon driver to intelligently manage its own memory.

D. All VMs are paused and their memory is balanced equally: This is incorrect. Hyper-V does not pause all VMs to balance memory equally. It dynamically reallocates memory from lower-priority VMs to higher-priority ones while the VMs continue to run.

A is Correct
The fundamental functional distinction between Group Policy Settings (Policies) and Group Policy Preferences (GPP) lies in enforcement vs. personalization:

Group Policy Settings (Strict Enforcement): Write to managed policy keys in the registry (e.g., HKLM\Software\Policies or HKCU\Software\Policies). The operating system locks these settings down, disabling or graying out UI controls so that users cannot override or alter the configured values.

Group Policy Preferences (Initial Configuration / Non-Enforced): Write directly to standard registry locations, local user profiles, drive mappings, environment variables, or shortcuts. They establish a baseline configuration when applied, but allow users to customize or change the setting afterward without the OS continually forcing it back (unless specifically configured to apply once and not re-apply).

Group Policy Preferences node allows configuring non-enforced baselines. Source: Petri IT Knowledgebase

Incorrect:

B. Preferences apply only to domain-joined computers while settings can also be applied to workgroup computers: Both Group Policy settings and Group Policy preferences rely on the Active Directory Group Policy infrastructure and Client-Side Extensions (CSEs). Neither GPO processing engine natively processes domain-level GPOs on standalone workgroup machines (except local GPOs via gpedit.msc, which contain limited local settings, not Active Directory GPP objects).

C. Preferences are only available in Windows Server 2019 and later while settings work on all versions: Group Policy Preferences were integrated natively into Active Directory starting with Windows Server 2008. They are not exclusive to Windows Server 2019 or later.

D. Preferences require client-side extensions to be installed separately while settings are built into Windows: Client-Side Extensions (CSEs) for handling Group Policy Preferences have been natively built into all supported client and server versions of Windows (Windows 7 / Windows Server 2008 R2 and newer) out of the box. No separate installation is required.

Correct :
A. The vendor class identifier in the DHCP Discover message which identifies the device type or manufacturer.

In Windows Server DHCP Policy-Based Assignment (PBA), administrators can evaluate incoming client attributes inside DHCP broadcast packets (DHCPDISCOVER and DHCPREQUEST) to conditionally assign dedicated IP ranges or specific scope options:

Vendor Class Identifier (Option 60): The Vendor Class Identifier string is sent natively within the client’s DHCP packet to broadcast its hardware vendor, operating system, or device type (e.g., VoIP phones, printers, hypervisor hosts, or specific hardware manufacturer strings).

Policy Matching: By matching against the Vendor Class attribute, Windows Server DHCP automatically groups network traffic and serves leases from customized IP address sub-ranges or applies unique DHCP options (such as default gateways or DNS settings) tailored specifically to that vendor’s hardware.

Windows Server DHCP Policies evaluate client conditions like Vendor Class. Source: Microsoft Learn

Incorrect:

B. The MAC address prefix of the network adapter which identifies the manufacturer: While the Organizationally Unique Identifier (OUI)—the first 3 bytes / 6 hexadecimal digits of a MAC address—can identify a network interface manufacturer, a MAC address prefix is categorized under the MAC Address criteria condition in DHCP policy rules, not under a dedicated “manufacturer” attribute. Furthermore, the question specifically asks about identifying device type/manufacturer attributes via client-provided class options.

C. The client’s computer name registered in Active Directory: DHCP servers evaluate incoming DHCP packet fields (such as MAC Address, Vendor Class, User Class, Client Identifier, or Relay Agent Information). Active Directory computer object names are not evaluated natively by DHCP scope policy rules during initial address broadcast requests.

D. The client’s current IP address from a previous DHCP lease: A client’s previous lease address is dynamic and can expire or change over time. DHCP policies evaluate client configuration metadata during the request handshake to determine which IP pool to assign from; they do not use historic lease addresses as a filtering condition for manufacturer classification.

The correct answer is B. Data Collection Rule transformations which apply KQL-based filtering during ingestion to drop unwanted records.

Data Collection Rule (DCR) transformations are the primary, built-in Azure Monitor mechanism for filtering and modifying incoming data before it is stored in a Log Analytics workspace, with reducing data ingestion costs as a key stated use case. These transformations use a Kusto Query Language (KQL) statement that runs against the incoming data and can drop records that match certain criteria, effectively filtering out specific event types. The transformation is applied after the data source delivers the data to the Azure Monitor ingestion pipeline and before it is sent to the destination, allowing you to control ingestion volume and associated costs. This filtering can happen on the Azure Monitor Agent (client-side) or at the ingestion endpoint, with client-side filtering providing the additional benefit of reducing network egress costs.

Incorrect:

A. Log Analytics workspace archive tier: This feature is used for moving older data to cheaper storage for long-term retention. It does not affect which data is ingested and therefore does not reduce initial ingestion costs.

C. Azure Monitor diagnostic settings retention policy: This policy determines how long data is retained in the workspace after it has already been ingested and billed. It does not prevent data from being ingested in the first place.

D. Azure Policy initiative: Azure Policy is used for governance and compliance, such as auditing resource configurations. It is not designed to apply data transformations or filter log data at the point of ingestion into a Log Analytics workspace.

A. One?way incoming trust from forest B to forest A which allows only forest B users to access forest

Incorrect.

A one?way trust allows authentication only in one direction.

In this case, only forest B users could access forest A resources, but forest A users could not access forest B.

This does not meet the requirement for bidirectional access.

B. Two?way forest trust which creates bidirectional transitivity so users in both forests can authenticate and access resources in the other forest

Correct.

A two?way forest trust establishes bidirectional authentication between two forests.

It is transitive, meaning users in either forest can access resources in the other forest without needing multiple trust configurations.

Certification highlights this as the most efficient trust type for full collaboration between forests.

C. Two separate one?way trusts each in opposite directions

Incorrect.

While this technically allows bidirectional access, it requires two separate trust configurations.

This is less efficient than a single two?way forest trust and is not the recommended approach.

D. External trust which provides transitivity across child domains in both forests

Incorrect.

External trusts are non?transitive and are used between domains in different forests, typically for legacy or limited scenarios.

They do not provide forest?wide bidirectional transitivity.

Correct Answer:
B. Self-updating mode where the cluster runs a CAU clustered role that coordinates draining, updating, and resuming each node in sequence.

Cluster-Aware Updating (CAU) automates software updates on failover cluster nodes while maintaining service availability:

No External Orchestrator: In Self-updating mode, the CAU feature is registered as a clustered role (Add-CauClusterRole) directly on the Failover Cluster itself.

Automated Node Lifecycle: The active CAU orchestrator node drains workload roles (putting the node into Maintenance Mode via Pause and Drain), installs updates, reboots the target node if required, resumes node operations, and then moves systematically to the next cluster node until all members are updated.

Incorrect:

A. Passive updating mode where CAU monitors Windows Update and defers reboots to scheduled maintenance windows only: “Passive updating mode” is not a recognized operating mode of Cluster-Aware Updating. CAU operates actively using either Self-updating mode or Remote-updating mode.

C. Remote-updating mode which requires a separate orchestrator computer outside the cluster to coordinate the patching sequence: Remote-updating mode is a valid CAU deployment model, but it explicitly requires an external management computer (a remote machine running Windows Client/Server with CAU tools installed) to act as the orchestrator. It is not self-coordinating within the cluster.

D. Manual updating mode which requires an administrator to initiate and monitor each node’s patch cycle: While administrators can manually execute updating runs via Invoke-CauRun or the CAU UI, “Manual updating mode” is not a formal CAU operational mode name, nor does it represent the automated, orchestrator-free architecture described.

A is CORRECT

Role: RID (Relative Identifier) Master

Function: In Active Directory Domain Services (AD DS), every security principal (user, group, computer) requires a globally unique Security Identifier (SID). A SID is formed by combining the Domain SID with a unique Relative Identifier (RID). The RID Master allocates blocks/pools of unique RIDs (500 by default) to each Domain Controller (DC) in the domain. When a DC creates a new object, it assigns a RID from its local pool. Once its pool runs low, the DC requests another pool from the RID Master.

B is INCORRECT

Actual Component: Knowledge Consistency Checker (KCC) / Intersite Topology Generator (ISTG)

Explanation: Replication topology within a site is dynamically generated and maintained by the KCC service running locally on each DC. For inter-site replication topology between different AD sites, a specific DC in each site acts as the ISTG. This is an automated service mechanism, not an FSMO role.

C is INCORRECT

Actual Component: PDC (Primary Domain Controller) Emulator Master

Explanation: The PDC Emulator processes password updates, receives immediate replication of password changes from other DCs in the domain, and acts as the primary authority when password authentication fails on another DC due to recent password changes. It also manages time synchronization and domain group policy updates.

D is INCORRECT

Actual Component: Any local Domain Controller (Multi-Master Architecture)

Explanation: Active Directory uses a multi-master authentication model. Interactive user logon requests are authenticated by any available DC in the client’s local site using Kerberos v5 (or NTLM fallback). There is no single DC acting as a centralized primary authentication source for all logons.

The correct answer is A. The source server receives a new temporary name and the destination server assumes the source server’s original name and IP address.

During the cutover phase of Storage Migration Service, the network identity of the source computer is transferred to the destination computer . The process accomplishes this by removing the source computer from the domain to free up its Active Directory account . The destination computer is then renamed to the source computer’s original name and assigned its IP address, effectively assuming its identity . To avoid conflicts, the source computer is renamed to a new, temporary name (which you can specify or let the service generate randomly) . After cutover, the source server retains its data but is no longer accessible to users and applications .

Incorrect::

B. The source server continues running with the same name and IP as the destination server simultaneously: This is incorrect, as a name and IP conflict on the network would be a critical error. A primary goal of the cutover process is to transfer the identity, not create a duplicate .

C. The source server is joined to a different domain to prevent identity conflicts: The source server is not moved to a different domain. While it is removed from the domain to free its AD account, it is later re-added to the same domain with its new identity .

D. The source server is automatically decommissioned and removed from Active Directory: The service does not automatically decommission the source server. Instead, it renames the server and leaves it online, allowing you to decommission it manually at your convenience .

The correct answer is B. Microsoft Intune compliance policies combined with Conditional Access which enforce device health requirements through Azure AD before granting access to resources.

Network Access Protection (NAP) was a legacy technology in Windows Server that enforced health compliance for devices connecting to the network. It was officially deprecated in Windows Server 2012 R2 and is not available in Windows Server 2016 and later versions.

The modern, cloud-based replacement for this functionality leverages Microsoft Intune and Microsoft Entra Conditional Access (formerly Azure AD). This approach allows administrators to evaluate the health and compliance status of a device—such as whether it has the latest updates or antivirus protection—before granting access to corporate resources.

Incorrect:

A. DHCP-based scope assignment: This describes a specific enforcement method used by NAP but is not the modern replacement. The broader technology NAP itself is deprecated.

C. Windows Defender Application Guard: This is a security feature that isolates untrusted browser sessions, but it does not enforce network access compliance for devices.

D. Windows Internet Connection Sharing: This is a networking feature for sharing an internet connection and is unrelated to device health enforcement or network access control.

Correct :

Option A – Synchronisation rules

In Microsoft Identity Manager (MIM), synchronisation rules define how attributes from external systems (like HR databases) map to Active Directory (AD DS) attributes.

When a new employee record is created in the HR system, the synchronization rules can automatically provision an AD account if the record meets defined conditions.

This is the correct answer because the certification emphasizes that synchronization rules are the mechanism enabling automatic identity lifecycle management between HR systems and AD DS.

Incorrect :

Option B – Group Policy preferences

Group Policy preferences configure settings for users and computers but do not create AD accounts.

They cannot provision identities based on HR system records.

This option is incorrect because GPOs manage configuration, not identity lifecycle.

Option C – Azure AD Connect

Azure AD Connect synchronizes identities between on-premises AD and Azure AD.

It does not directly import HR data or provision accounts from HR systems.

This option is incorrect because it misrepresents Azure AD Connect’s role—it is not an HR-driven provisioning tool.

Option D – Active Directory Administrative Centre bulk import

AD Administrative Centre allows manual or bulk import of accounts but requires administrator intervention.

It does not automatically process HR system records or REST API responses.

This option is incorrect because it is a manual tool, not an automated provisioning mechanism.

A. DHCP Server which assigns IP addresses in different address pools based on compliance status

Incorrect.

DHCP can assign IP addresses but does not evaluate authentication or health requirements.

NPS handles policy evaluation, not DHCP.

B. Network Policy Server connection request policy and network policy which evaluate authentication, authorisation, and health conditions for each access request

Correct.

NPS uses connection request policies and network policies to evaluate:

Authentication (credentials, certificates, EAP methods).

Authorization (group membership, conditions).

Health requirements (NAP integration, compliance checks).

This ensures only compliant and authorized users/devices gain access.

Certification highlights NPS policies as the central enforcement mechanism in 802.1X scenarios.

C. Active Directory Certificate Services which issues certificates for 802.1X EAP?TLS authentication

Incorrect.

AD CS issues certificates used in authentication, but it does not evaluate health or access policies.

Certificates are part of the authentication mechanism, not the policy enforcement engine.

D. Windows Defender Firewall which blocks non?compliant clients before they can reach the NPS server

Incorrect.

Windows Defender Firewall enforces local traffic rules but does not evaluate RADIUS authentication or health compliance.

NPS is the component responsible for policy evaluation, not the firewall.

Correct answer: C

C. Providing a software-defined WAN gateway where the Windows Server advertises and learns routes dynamically with connected peers is correct. Windows Server Routing and Remote Access Service (RRAS) supports BGP as a dynamic routing protocol. BGP reduces manual route configuration by automatically learning routes from configured peers and advertising eligible routes to those peers.

This is particularly useful for a software-defined networking or multitenant gateway, where a Windows Server can establish BGP peering with connected routers or remote sites and dynamically exchange network prefixes. Microsoft documents this scenario for RRAS multitenant gateways, including advertising custom routes to BGP peers.

Incorrect:

A. Providing DHCP failover
Incorrect. DHCP failover synchronizes DHCP lease and scope information between DHCP servers. It does not use BGP, which exchanges IP routing information between network peers.

B. Replacing DNS on domain controllers
Incorrect. DNS resolves names to IP addresses, while BGP exchanges network reachability information. BGP does not replace DNS or provide domain-name resolution.

C. Providing a software-defined WAN gateway
Correct. RRAS can use BGP to dynamically learn and advertise routes with connected peers, making it suitable for software-defined gateway and multitenant routing scenarios.

D. Encrypting network traffic
Incorrect. BGP is a routing protocol, not an encryption protocol. It determines which network routes are learned and advertised; it does not encrypt traffic between a server and its gateway. Encryption would require technologies such as IPsec or a VPN.

The correct answer is C. VSS coordinates with VSS-aware applications to quiesce writes and create a consistent point-in-time snapshot of application data while the application continues to run.

The Volume Shadow Copy Service (VSS) is a Microsoft Windows service that facilitates communication between backup software and business applications to create consistent backups of data that is in use. Its primary role during a backup is to coordinate with VSS-aware applications (like SQL Server or Exchange Server) and Windows components. It instructs these applications to “quiesce” or temporarily freeze their write operations and flush all I/O buffers to ensure data is in a consistent state for a point-in-time snapshot (shadow copy). Once the snapshot is created, applications are allowed to resume normal operation. This process ensures that the backup contains a stable, application-consistent set of data rather than a “crash-consistent” one that might be incomplete or corrupted.

Incorrect:

A. VSS replaces the Windows backup agent by directly streaming data to the backup server: This is incorrect. VSS does not replace the backup agent or stream data. Its purpose is to create a stable snapshot that the backup application (the requester) can then read and copy to a backup destination.

B. VSS provides a network transport layer that copies backup data to the backup server: This is incorrect. VSS is a service for orchestrating snapshot creation, not for data transport. The actual movement of backup data is handled by the backup software.

D. VSS encrypts backup data before it is written to the backup media: This is incorrect. Encryption is a separate security function and is not a role performed by VSS.

Correct :

Option B – Windows Server 2016 and later

Microsoft supports in-place upgrades from Windows Server 2016, 2019, and 2022 directly to Windows Server 2025.

These versions are within the supported upgrade path, ensuring compatibility and stability during the upgrade process.

This is the correct answer because the certification emphasizes that only recent versions (2016 and later) are eligible for direct in-place upgrades to Windows Server 2025.

Incorrect:

Option A – Windows Server 2012

Windows Server 2012 is too old and falls outside the supported in-place upgrade path.

To reach Windows Server 2025, administrators would need to perform sequential upgrades (e.g., 2012 ? 2016 ? 2025).

It cannot be upgraded directly to 2025.

Option C – Windows Server 2003

Windows Server 2003 is end-of-life and cannot be upgraded directly to modern versions.

There is no “Legacy Upgrade Tool” to bridge such a large gap.

Migration would require a clean installation and data migration, not an in-place upgrade.

Option D – Any Windows Server version

Not all versions are supported for direct in-place upgrades.

Microsoft enforces strict upgrade paths, and older versions (2012, 2008, 2003) require intermediate upgrades or migrations.

This option is incorrect because it ignores version restrictions.

Correct :

Option C – When the domain controller is the only DC in a site and the forest has multiple domains

A Global Catalog (GC) server holds a partial replica of all objects in the forest, enabling queries across domains.

If a site has only one domain controller and the forest contains multiple domains, that DC must be a GC server to resolve queries for objects outside its own domain.

This is the correct answer because the certification emphasizes that GC servers are required in multi-domain forests to support authentication and directory lookups across domains.

Incorrect:

Option A – Windows Server 2025 requires Global Catalog by default

Windows Server 2025 does not automatically require all domain controllers to be Global Catalog servers.

GC assignment is a configuration choice, not a default requirement.

This option is incorrect because it misrepresents the role of GC in newer versions.

Option B – RODC caching credentials for branch office users

A Read-Only Domain Controller (RODC) can cache credentials for branch office users, but it does not require being a GC server for that purpose.

GC functionality is unrelated to credential caching in RODCs.

Option D – Domain controller holding the PDC Emulator FSMO role

The PDC Emulator FSMO role handles time synchronization, password updates, and legacy compatibility.

It does not require the DC to be a Global Catalog server.

This option is incorrect because FSMO roles and GC functionality are independent.

Correct Answer:

B. DISM /Online /Cleanup-Image /StartComponentCleanup /ResetBase which removes superseded component versions reducing the WinSxS folder size.

The Deployment Image Servicing and Management (DISM) tool manages the Windows Component Store located in the C:\Windows\WinSxS directory:

Component Store Cleanup: When cumulative updates are installed, older versions of components are preserved in WinSxS so that updates can be rolled back if necessary.

ResetBase Switch: Executing /StartComponentCleanup cleans up superseded component versions. Adding the /ResetBase switch permanently deletes all superseded versions of every component in the store, significantly shrinking the image/disk footprint. (Note: Using /ResetBase prevents previously installed updates from being uninstalled.)

Incorrect:

A. DISM /Online /Cleanup-Image /CheckHealth which reports whether the image is corrupted: The /CheckHealth switch performs a rapid query against the local system flags to determine whether component store corruption has already been detected. It does not perform cleanup operations or reduce image size.

C. DISM /Online /Remove-Capability which removes optional features reducing the installed size: The /Remove-Capability (or /Disable-Feature) parameter uninstalls Windows capabilities or optional features (such as OpenSSH Server or XPS Viewer). It does not target or clean up superseded update packages in the WinSxS component store.

D. DISM /Online /Cleanup-Image /ScanHealth which scans the image for corruptions: The /ScanHealth switch thoroughly checks the component store for system file corruptions and logs the findings. It is a diagnostic scan and does not clean up or reclaim disk space.

Correct:

Option A – WSL 2

WSL 2 introduces a real Linux kernel running inside a lightweight Hyper-V utility VM.

This provides full system call compatibility, allowing Linux applications to run natively and with better performance compared to WSL 1.

It is the correct answer because the certification highlights that WSL 2 is the version that delivers a genuine Linux kernel, enabling advanced workloads and compatibility with modern Linux distributions.

Incorrect:

Option B – Windows Containers in Linux mode

Windows Containers in Linux mode provide containerized environments but are not the same as WSL.

They run Linux containers using a separate kernel abstraction, not a real Linux kernel in WSL.

This option confuses containerization with subsystem functionality.

Option C – Windows Subsystem for Linux Enterprise

There is no separate product called “Windows Subsystem for Linux Enterprise.”

WSL is included with Windows, and licensing is not split into enterprise editions.

This option is incorrect because it refers to a non-existent product.

Option D – WSL 1

WSL 1 translates Linux system calls into Windows NT kernel calls.

It does not run a real Linux kernel, which limits compatibility with certain applications.

This makes it unsuitable for workloads requiring full system call support, unlike WSL 2.

Correct : B. Hyper-V isolation which runs each container in a lightweight Hyper-V VM giving each container its own kernel instance.
Windows Server containers support two isolation modes:

Process isolation — Containers share the host operating system kernel. This is the lighter-weight option with lower overhead.
Hyper-V isolation — Each container runs inside a highly optimized, lightweight Hyper-V virtual machine. As a result, each container gets its own dedicated kernel instance.

Hyper-V isolation provides stronger security boundaries and better isolation between containers (and between containers and the host) because a compromise of one container’s kernel does not affect the host or other containers. The trade-off is higher resource consumption (memory, CPU, and startup time) compared with process isolation.

Incorrect:

A. Docker Compose isolation which orchestrates multiple containers in a shared network namespace.
Docker Compose is a tool for defining and running multi-container applications. It is not an isolation type for Windows containers.

C. Process isolation which shares the host OS kernel and provides lightweight container isolation.
This describes the other (lighter) isolation mode. Process isolation shares the host kernel and therefore offers less isolation than Hyper-V isolation.

D. Linux container on Windows (LCOW) which runs Linux containers on a Windows host using a Linux kernel.
LCOW was an earlier experimental feature for running Linux containers on Windows. It is not one of the two standard isolation levels for Windows containers, and the feature has been deprecated in favor of other approaches (such as running Linux containers in a full Linux VM or using WSL).

Correct answer: B
B. As a container base image for Windows Server containers is correct. In the current Windows Server servicing model, Nano Server is no longer supported as a standalone installation option for physical or virtual Windows Server host deployments. Since Windows Server version 1709, Nano Server has been available only as a container base operating-system image.

Nano Server provides a minimal footprint for suitable containerized workloads, particularly applications designed for its supported APIs, such as modern .NET applications. It runs inside a supported container host, such as Server Core, rather than functioning as the host operating system itself.

Incorrect:

A. Alternative hypervisor host
Incorrect. Nano Server was historically deployable as a lightweight Hyper-V host, but that installation model is no longer supported under the current servicing model. Nano Server is now intended for containers, not standalone hypervisor-host deployments.

B. Container base image
Correct. Nano Server is supported as a minimal Windows Server container base image for compatible containerized applications.

C. Replacement for Server Core
Incorrect. Nano Server is not a smaller, feature-equivalent replacement for Server Core. Server Core remains a Windows Server installation option and can also serve as a container host. Nano Server is a specialized container image with a smaller API and feature set, so applications must be compatible with it.

D. Fully functional domain controller
Incorrect. Nano Server is not supported as a general-purpose standalone Windows Server installation or as a domain controller. Its current supported role is as a container base image, not as a full server operating system.

B. Using Azure Policy to deploy the MDE extension to Arc-enabled servers meeting a specific tag condition.
For Azure Arc-enabled Windows Servers, Microsoft Defender for Endpoint (MDE) onboarding is performed by deploying the MDE.Windows extension (publisher: Microsoft.Azure.AzureDefenderForServers). Azure Policy provides a built-in DeployIfNotExists policy (“[Preview]: Deploy Microsoft Defender for Endpoint agent on Windows Azure Arc machines”) that automatically provisions this extension on eligible Arc-enabled Windows machines. Policy assignments can include conditions such as tags, resource groups, or other filters so that only matching servers receive the extension and are onboarded. This is the automated, scalable method that works with Azure Arc.

A. Using SCCM compliance baseline to push the MDE client to managed servers. — Incorrect
Microsoft Configuration Manager (SCCM/MECM) can deploy the onboarding package or client via compliance baselines or software deployment, but this is a traditional Configuration Manager method. It does not specifically or automatically provision the MDE extension on Azure Arc-enabled servers; Arc-enabled machines are managed through Azure constructs (Policy, extensions, etc.).

C. Manually running the onboarding script from the Defender portal on each server. — Incorrect
Downloading and running the local onboarding script (or package) from the Microsoft Defender portal is a valid manual method for individual servers. It is not an automated provisioning method and does not leverage Azure Arc’s extension model or Azure Policy.

D. Enabling automatic onboarding in Windows Security Center on each server. — Incorrect
Windows Security Center (or Windows Security app) does not provide an automatic onboarding toggle that provisions the MDE sensor for Azure Arc-enabled servers. Onboarding for servers is handled through Defender for Endpoint onboarding packages, Defender for Cloud integration, Azure Policy, or management tools—not through a local Security Center setting.

Correct:

B. eDrive performs encryption in the drive hardware so the CPU is not used for encryption operations, improving system performance compared to software BitLocker.

Encrypted Hard Drive (eDrive) relies on hardware-based encryption built into Self-Encrypting Drives (SEDs) compliant with IEEE 1667 and TCG Opal storage standards.

When BitLocker is configured on an eDrive-compatible disk, BitLocker delegates cryptographic operations to the drive’s onboard controller. Because the disk controller processes AES encryption/decryption natively in hardware, host CPU cycles and memory bandwidth are preserved for operating system and application workloads, resulting in higher overall system performance and reduced latency.

Incorrect:

A. eDrive encryption performance is identical to software BitLocker making hardware encryption unnecessary.

Hardware-offloaded encryption significantly reduces host CPU utilization under heavy disk I/O compared to software BitLocker. Although CPU instructions like AES-NI mitigate software overhead, eDrive offloads processing entirely to the drive controller.

C. eDrive provides higher maximum storage capacity than software-encrypted drives.

Total formatted storage capacity is dictated strictly by the physical disk hardware, platter/NAND density, and file system configuration—not by whether encryption is processed in software or hardware.

D. eDrive allows BitLocker to be disabled without decrypting the drive contents.

Disabling BitLocker management or decryption workflows on an eDrive requires standard administrative key management. It does not alter fundamental BitLocker lifecycle requirements, nor is it an operational advantage of hardware SEDs.

The correct answer is B. Complete memory dump which saves the entire contents of physical RAM to a dump file.

The Complete Memory Dump is the largest of the Windows Server crash dump types, recording all the contents of system memory when a system crash occurs . This type includes data from all processes, including user-mode process memory, and the resulting dump file size equals the amount of installed physical RAM . Its primary advantage is containing the most information to help find the cause of a crash .

Incorrect:

A. Automatic memory dump: This option is functionally a Kernel Memory Dump but with more flexibility in the system paging file size . It does not save the complete contents of physical RAM; it saves only kernel-mode memory.

C. Small memory dump (minidump): This is the smallest dump type, capturing only the bugcheck code and a small set of memory pages, which is typically limited to 256 KB . It is explicitly designed to be minimal and does not capture the full RAM contents.

D. Kernel memory dump: This dump type records only the kernel memory allocated to the operating system and kernel-mode drivers . It omits all memory allocated to user-mode programs and unallocated memory, making it significantly smaller than a Complete Memory Dump .

A. Data is compressed before transmission to the destination, which is the primary feature of asynchronous mode

Incorrect.

Compression may be used to optimize replication traffic, but it is not the defining characteristic of asynchronous replication.

The key concept is timing of write acknowledgments, not compression.

B. Writes are acknowledged to the application immediately after writing to the source; replication to the destination occurs in the background so some recent data may not yet be replicated if a failure occurs

Correct.

In asynchronous replication, the source acknowledges the write to the application as soon as it is committed locally.

Replication to the destination happens afterward, in the background.

This introduces an RPO greater than zero — meaning some recent writes may be lost if the source fails before replication completes.

Certification highlights this trade?off: lower latency but potential data loss.

C. Every write to the source volume is synchronously confirmed by the destination before the write completes

Incorrect.

This describes synchronous replication, not asynchronous.

In synchronous mode, the write is acknowledged only after both source and destination commit the data, ensuring RPO = 0.

D. Writes are batched every 30 seconds and sent to the destination as a transaction, providing a fixed 30?second RPO

Incorrect.

Asynchronous replication does not use fixed batching intervals like 30 seconds.

Replication occurs continuously in the background, not in rigid time?based batches.

The RPO is variable, depending on replication latency and workload.

Correct option: A. The Azure Arc extension for Windows Admin Center which allows onboarding and managing Arc-enabled servers within the WAC interface.
Windows Admin Center (WAC) supports integration with Azure Arc-enabled servers. Through the Azure hybrid services / Azure Arc capabilities in WAC (and the related Windows Admin Center extension experience), administrators can:

Onboard on-premises Windows servers to Azure Arc directly from the WAC interface.
Manage Arc-enabled servers (hybrid machines) using familiar WAC tools.

This provides a unified management experience for both traditional on-premises servers and Arc-enabled servers without needing separate tools or a full VPN for many management tasks.

Incorrect:

B. The Azure Backup extension which configures backup policies from Windows Admin Center.
There is Azure Backup integration available in WAC, but it is used for configuring and managing Azure Backup policies/vaults, not for onboarding or managing Azure Arc-enabled servers.

C. The Failover Clustering extension which manages Failover Cluster configurations.
The Failover Clustering extension (or built-in clustering tools) in WAC is used to manage Windows Server Failover Clusters. It has no relation to Azure Arc-enabled servers.

D. The Active Directory extension which provides AD management within Windows Admin Center.
Active Directory management tools/extensions in WAC allow administration of AD DS objects and domain controllers. They are unrelated to Azure Arc.

Correct Answer:
A. Server Core uses less RAM and CPU for OS processes because the graphical shell, desktop experience components, and GUI applications are not loaded.

Server Core is the default, recommended installation option for Windows Server because it excludes the heavy graphical user interface (GUI) shell:

Resource Efficiency: By stripping out explorer.exe, Server Manager, Microsoft Management Consoles (MMCs), and desktop rendering frameworks, Server Core leaves a significantly smaller memory and CPU footprint for OS background processes.

Maximized Workload Density: Because baseline operating system overhead is minimized, more system RAM and processing power remain available for production workloads (such as Hyper-V virtual machines, SQL Server instances, or containerized applications).

Server Core removes graphical shell elements to reduce OS resource consumption. Source: Medium

Incorrect:

B. Server Core supports higher maximum RAM than Server with Desktop Experience: Architectural hardware limits (such as maximum supported RAM and CPU socket capacity) are defined strictly by the edition of Windows Server (e.g., Standard vs. Datacenter vs. Datacenter: Azure Edition), not by whether Server Core or Desktop Experience is installed.

C. Server Core provides GPU acceleration for graphical workloads by removing the CPU-based rendering stack: Server Core does not provide GPU hardware acceleration for graphical workloads; in fact, heavy 3D or graphical rendering applications often fail to run on Server Core due to missing desktop APIs and display subsystem dependencies.

D. Server Core achieves higher maximum network throughput because GUI rendering is offloaded to a remote machine: Network throughput hardware limits (such as network interface card bandwidth, RDMA capabilities, and TCP chimney/RSS settings) are governed by hardware and network protocols, not by the absence of local GUI rendering.

The correct answer is D. Disabling the SMB 1.0/CIFS File Sharing Support Windows feature on all servers and clients so that SMB 1.0 is not offered or accepted during protocol negotiation.

Incorrect:

A. Enabling SMB signing on all servers: SMB signing is a security mechanism that digitally signs SMB packets to prevent tampering. It does not prevent the negotiation process from falling back to the SMB 1.0 protocol. A client that only supports SMB 1.0 would still be able to connect using that vulnerable protocol, as the server would still offer it if enabled.

B. Blocking TCP port 445 inbound at the firewall: While this would prevent external SMB connections, it is not the appropriate solution to prevent protocol downgrade attacks. The threat of a client negotiating down to SMB 1.0 exists internally as well. A client on the same network could still initiate this negotiation, and the server would accept it if the protocol is still installed and active. The focus of the question is on the protocol negotiation mechanism, which requires disabling the protocol itself.

C. Installing the latest Windows cumulative update: Windows updates patch vulnerabilities but do not automatically remove the SMB 1.0 feature. As of Windows Server 2019, the SMB 1.0/CIFS File Sharing Support is still an optional feature that must be manually uninstalled or disabled, as it is no longer installed by default but can be re-enabled.

A. Standard checkpoint which captures the full memory state and disk image at the point in time

Incorrect.

Standard checkpoints capture both the VM’s memory state and disk state.

They are intended for development and testing, not production workloads, because restoring them can cause application consistency issues.

B. Production checkpoint which uses VSS inside the guest to create an application?consistent snapshot without capturing memory state

Correct.

Production checkpoints use Volume Shadow Copy Service (VSS) inside the guest OS to create an application?consistent snapshot.

They do not capture memory state, making them suitable for production workloads.

Only changed blocks are written to a differencing disk, minimizing performance impact.

C. Differencing checkpoint which chains differencing disks infinitely to track all changes

Incorrect.

Hyper?V does use differencing disks under the hood for checkpoints, but there is no separate “differencing checkpoint” type.

Infinite chaining is not recommended and is not a defined checkpoint model in Hyper?V.

D. Application?consistent snapshot using VSS which quiesces the VM’s applications before capture

Incorrect.

While this describes the mechanism used by production checkpoints, it is not the official checkpoint type name.

The correct terminology in Hyper?V is Production Checkpoint, not “application?consistent snapshot.”

The correct answer is B. DNS policy with a zone scope per location where each scope contains different resource records for the same hostname, and client subnet criteria determine which scope answers the query.

To deliver location-aware DNS responses, the recommended configuration uses DNS policies in conjunction with zone scopes. The process involves:

Defining DNS client subnets for each location (e.g., a subnet for London, another for Seattle).

Creating a zone scope for each location within the relevant DNS zone.

Adding the same hostname (e.g., http://www.contoso.com) with a different IP address to each location-specific zone scope.

Creating a query resolution policy that maps each client subnet to its corresponding zone scope. The DNS server then uses the ClientSubnet criteria in the policy to determine which zone scope—and therefore which IP address—to return to the client.

Incorrect:

A. DNS recursion scope: This controls how the DNS server performs recursive queries (e.g., whether to deny recursion or use specific forwarders) for certain client groups. It does not define different IP address responses for the same hostname.

C. DNS round-robin: This rotates through multiple IP addresses for the same hostname in a simple cyclical order, distributing traffic in a best-effort manner. It does not consider the client’s network location.

D. DNS scavenging: This is an aging and cleanup feature that removes stale DNS resource records based on time stamps, not a policy for conditional response based on client location.

Correct Answer:
C. TCP port 445 which is the standard SMB port used for Azure Files connections over the internet or private network.

Azure Files exposes fully managed file shares accessible via the industry-standard Server Message Block (SMB) protocol (specifically SMB 3.0+ with encryption support):

SMB over TCP Port 445: Mounting an Azure file share directly using a storage account key relies on native SMB communications. Client operating systems establish direct TCP connections over port 445 to the endpoint (.file.core.windows.net).

Transport Encryption: SMB 3.x enforces encryption in transit over TCP port 445, securing data transmitted across public internet connections or private networks (such as ExpressRoute or VPNs).

Azure Files requires outbound TCP port 445 for direct SMB mounting. Source: Microsoft Learn

Incorrect:

A. TCP port 443 which is used for HTTPS connections to Azure storage: TCP port 443 handles HTTPS REST API calls (used by tools like Azure Storage Explorer, Azure PowerShell, or SMB over QUIC for QUIC-enabled clients). Standard file share mounting (net use or New-PSDrive) over SMB direct does not route traffic across HTTPS port 443.

B. TCP port 139 which is the legacy NetBIOS session service port for SMB over NetBIOS: TCP port 139 was used historically for legacy NetBIOS Session Service communication in older Windows networks. Modern SMB (SMB 2.x and 3.x) operates directly over TCP port 445 without relying on NetBIOS.

D. UDP port 137 which is used for NetBIOS name resolution when accessing network shares: UDP port 137 handles legacy NetBIOS Name Service (NBNS) queries. Azure Files relies on standard DNS resolution rather than local NetBIOS broadcast name resolution.

The correct answer is D. Route-based VPN with Azure VPN Gateway in active-active mode using two public IPs so that both gateway instances forward traffic simultaneously for improved throughput and availability.

An Azure VPN Gateway can be configured in two high-availability modes: active-standby or active-active. In an active-active configuration, each gateway instance is assigned its own unique public IP address and establishes its own IPsec/IKE Site-to-Site (S2S) VPN tunnel to your on-premises VPN device .

In this mode, both gateway instances are active and handle traffic simultaneously. This architecture provides higher availability by removing a single point of failure; if one instance becomes unavailable due to a planned maintenance event or an unplanned disruption, traffic is automatically and seamlessly switched to the other active tunnel . It can also offer improved throughput compared to the default active-standby mode .

This configuration requires a route-based VPN gateway, not a policy-based one . It also requires two Standard SKU public IP addresses assigned as static .

Incorrect:

A. Point-to-site VPN: This gateway type connects individual client devices to an Azure VNet, not a site-to-site connection from an on-premises network. It does not support the active-active site-to-site gateway configuration described in the question.

B. Policy-based VPN: This gateway type uses static routing tables and does not support an active-active mode configuration. Active-active mode is a feature exclusively available for route-based VPN gateways .

C. ExpressRoute: This is a separate, private connectivity service from Azure to on-premises networks that bypasses the public internet. It is not a type of VPN, and while it can be used for connectivity, it is not the VPN type that supports the active-active configuration described.

A. Using PowerShell to import the CSV with Import?Csv and pipe the results to New?ADUser for bulk creation

Correct.

PowerShell provides the most efficient and scalable method for bulk provisioning.

The Import?Csv cmdlet reads the CSV file, and piping the results to New?ADUser automates account creation.

Certification emphasizes PowerShell scripting as the recommended approach for bulk operations in AD DS.

B. Creating users one at a time in Active Directory Users and Computers

Incorrect.

This is a manual, GUI?based process.

It is inefficient and error?prone for large?scale provisioning (200 accounts).

Certification highlights automation as best practice.

C. Using Active Directory Administrative Center with its bulk import wizard

Incorrect.

ADAC provides some bulk management features, but it does not have a native CSV import wizard for mass user creation.

PowerShell remains the supported and efficient method for scripted bulk provisioning.

D. Using the dsadd command?line tool with individual commands per user

Incorrect.

dsadd can create users, but it requires individual commands per account.

It does not support direct CSV import or efficient bulk automation.

Certification notes that dsadd is legacy and PowerShell supersedes it for modern administration.

A. Active Directory Lightweight Directory Services which stores file server metadata

Incorrect.

AD LDS provides a standalone directory service for applications.

It does not manage file shares or permissions and is unrelated to Storage Migration Service.

B. File and Storage Services role with the File Server role service installed on the destination server to receive the migrated shares and permissions

Correct.

The File and Storage Services role with the File Server role service must be installed on the destination server.

This enables the server to host migrated file shares, NTFS permissions, and SMB configurations.

Certification emphasizes this as the required role for Storage Migration Service to function correctly.

C. File Server Resource Manager which manages quotas and file screens

Incorrect.

FSRM is an optional role service that provides quota management, file screening, and reporting.

It does not enable the server to receive migrated shares or act as the destination for Storage Migration Service.

D. Remote Desktop Services which provides the application hosting environment for management tools

Incorrect.

RDS provides remote desktop and application virtualization capabilities.

It is unrelated to Storage Migration Service and does not host file shares or permissions.

Correct option: A. CSV IO redirection which routes IO from the node that lost storage connectivity through another cluster node that still has access.
Cluster Shared Volumes (CSV) enable multiple nodes in a Windows Server Failover Cluster (typically Hyper-V hosts) to access the same NTFS/ReFS volume at the same time.
When a node loses direct connectivity to the underlying storage (for example, a SAN path failure), CSV IO redirection (also called redirected IO or redirected mode) allows that node to continue performing storage operations. The node sends its IO requests over the cluster network to another healthy node that still has direct access to the storage. That node performs the IO on behalf of the disconnected node and returns the results.
This keeps virtual machines and other workloads online during transient storage path failures, providing high availability at the storage access layer.

Incorrect:

B. CSV cache which stores frequently accessed blocks in node RAM for read acceleration.
CSV Cache (or CSV Read Cache) improves read performance by caching hot data in RAM on the nodes. It does not provide a failover path when a node loses storage connectivity.

C. Cluster network adapter teaming which provides network path redundancy for CSV traffic.
NIC teaming (or SET – Switch Embedded Teaming) provides network redundancy and bandwidth aggregation. While a resilient cluster network is important for redirected IO to work well, teaming itself is not the CSV feature that redirects storage IO.

D. Storage Spaces Direct which distributes storage across all cluster nodes.
Storage Spaces Direct (S2D) is a software-defined storage technology that pools local disks across cluster nodes. It is a different storage architecture and is not a feature of traditional CSV on shared storage (SAN/NAS).

Correct answer: D
D. AD LDS runs as an application service without domain controller functionality and can store application-specific directory data independently of an AD DS domain.

AD LDS provides LDAP directory services for applications without requiring the server to become an AD DS domain controller or requiring the application data to be stored in an AD DS domain. It can run on a member server or standalone server, and multiple independent AD LDS instances can run on one server, each with its own schema and directory data.

Unlike AD DS, AD LDS does not provide domain infrastructure such as domains, forests, Group Policy, global catalogs, or Windows operating-system directory services.

Why the other options are incorrect
A. Automatically replicates to all domain controllers
Incorrect. AD LDS does not automatically replicate its data to all AD DS domain controllers in the forest. AD LDS instances can use their own replication configuration and maintain independent directory data.

B. Requires joining an existing AD domain
Incorrect. AD LDS can run on a member server or a standalone server and does not require an existing AD DS domain or forest. It can optionally use AD DS security principals for authentication when AD DS is available, but that is not an installation requirement.

C. Does not support LDAP
Incorrect. AD LDS is specifically an LDAP-based directory service for directory-enabled applications. It uses standard LDAP access rather than a proprietary query protocol.

D. Runs as an application service independently of AD DS
Correct. This describes the central distinction between AD LDS and AD DS: application-focused directory storage without domain-controller and domain-infrastructure dependencies.

Correct Answer:
B. Certification Authority Web Enrollment which provides a web-based interface for certificate requests.

Certification Authority Web Enrollment is a core role service of Active Directory Certificate Services (AD CS) running on Internet Information Services (IIS):

Interactive Web Interface: It exposes an interactive web page (typically accessed at https:///certsrv) that enables users and administrators to connect via standard web browsers over HTTP or HTTPS.

Browser-Based Workflows: Users can submit custom certificate requests (PKCS #10), download pending certificates, request base CA certificates or certificate revocation lists (CRLs), and renew user certificates directly through a web browser without needing MMC snap-ins or RPC connectivity.

CA Web Enrollment provides a browser-accessible interface (/certsrv) for certificate tasks. Source: Microsoft Learn

Incorrect:

A. Network Device Enrollment Service (NDES) which allows network devices to request certificates via SCEP: NDES acts as an enrollment proxy that enables routers, switches, smart cards, and mobile devices (via MDM) to request certificates using the Simple Certificate Enrollment Protocol (SCEP). It is designed for automated device provisioning, not interactive web browser certificate requests.

C. Online Certificate Status Protocol (OCSP) Responder which provides real-time certificate revocation status: The OCSP Responder role service processes and responds to real-time client queries regarding the revocation status of specific certificates without downloading full Certificate Revocation Lists (CRLs). It does not issue or generate certificates.

D. Certificate Enrollment Policy Web Service which provides a policy endpoint for autoenrolment clients: The Certificate Enrollment Policy (CEP) Web Service—used alongside the Certificate Enrollment Web Service (CES)—enables Active Directory domain-joined computers to query enrollment policies and request certificates over HTTPS across domain or forest boundaries. It is an automated programmatic endpoint for Windows clients rather than an interactive web UI for browser users.

C. SMB relay attacks where a man-in-the-middle intercepts and forwards SMB authentication to a different server on behalf of the client.
SMB signing cryptographically signs each SMB message using a session key derived from the authentication. This ensures message integrity and authenticates the sender/recipient. In Windows Server 2025, SMB signing is required by default for outbound connections (and more broadly in related client editions).
Required signing prevents SMB relay (NTLM relay) attacks: an attacker acting as a man-in-the-middle cannot successfully intercept authentication material from a client and forward/relay it to another server, because the relayed packets lack a valid signature matching the intended session. Signature mismatches cause the connection to be rejected. Microsoft documentation explicitly states that SMB signing protects against relay and spoofing attacks.

A. Replay attacks where captured authentication tokens are reused to access shares. — Incorrect
While signing provides some protection against simple message replay/tampering, the primary and specifically documented attack mitigated by required SMB signing is the relay (man-in-the-middle credential forwarding) attack. Replay of captured tokens is addressed more broadly by other mechanisms (session keys, Kerberos tickets, etc.).

B. Brute force password attacks against the SMB authentication protocol. — Incorrect
SMB signing does not affect password strength, authentication protocol resistance to guessing, or offline cracking. Brute-force protection comes from account lockout policies, strong passwords, multifactor authentication, and blocking NTLM where possible—not from message signing.

D. Ransomware encryption of SMB shares by a process running on the server. — Incorrect
Ransomware that runs locally on the server (or with sufficient privileges) can still encrypt files on SMB shares. SMB signing protects the network protocol path; it does not prevent local or privileged processes from modifying share contents.

The correct answer is A. Azure Monitor Agent extension which installs AMA on the Arc-enabled server and links it to a Data Collection Rule for telemetry collection.

Azure Monitor Agent (AMA) is the modern, recommended agent for collecting telemetry data like Windows event logs and performance counters from Azure Arc-enabled servers . It works in conjunction with Data Collection Rules (DCRs) that define what data to collect and where to send it, such as a Log Analytics workspace . After the AMA extension is installed on an Arc-enabled server and associated with a DCR that has Windows event logs and performance counters as data sources, the telemetry begins to flow .

Here is an analysis of why the other options are incorrect:

B. CustomScriptExtension: This extension runs scripts on a machine for post-deployment configuration or troubleshooting. It is not designed to collect operational or performance data for Azure Monitor .

C. Microsoft Defender for Endpoint extension: This extension is for endpoint detection and response (EDR) security capabilities. It is not a general-purpose telemetry collection agent for Log Analytics .

D. Network Watcher extension: This extension is used specifically for capturing network traffic and monitoring network connectivity, often in conjunction with the Azure Monitor Agent. It does not collect Windows event logs or performance counters .

A. Ready which means the VM meets all Azure requirements and can be migrated without modification

Correct.

The Ready status indicates that the VM satisfies Azure requirements (supported OS, configuration, disk type, etc.) and can be migrated directly without changes.

Certification highlights this as the ideal outcome of Azure Migrate assessment.

B. Conditionally ready which means the VM can be migrated but requires specific Azure configuration post?migration

Incorrect.

“Conditionally ready” means the VM can migrate but requires adjustments (e.g., unsupported drivers, configuration changes, or Azure?specific settings).

This does not guarantee migration without modification.

C. Not ready which means the VM has characteristics incompatible with Azure IaaS

Incorrect.

“Not ready” indicates incompatibility (unsupported OS, hardware, or configuration).

Such VMs cannot be migrated without remediation.

D. Ready with conditions which applies when the VM requires agent installation before migration

Incorrect.

This phrasing is not an official Azure Migrate readiness status.

Agent installation may be required for assessment, but the readiness classification is Ready, Conditionally ready, or Not ready.

Correct:

D. In the Log Analytics workspace associated with the server where KQL queries against the ConfigurationChange and ConfigurationData tables return change history.

Azure Change Tracking and Inventory (collected via the Azure Monitor Agent / AMA) streams guest-level telemetry directly to an designated Log Analytics workspace.

Change events (such as software updates, file edits, registry key modifications, or service status changes) are stored in specific KQL-queryable tables:

ConfigurationChange: Records granular timeline delta/change events.

ConfigurationData: Stores inventory baseline snapshots (e.g., currently installed applications, services, and files).

Incorrect:

A. In the Arc-enabled server’s local event log which is accessible via Event Viewer.

While Windows Server logs local events to the Event Viewer (such as Service Control Manager events), Change Tracking aggregates, normalizes, and retains this history centrally in Azure for long-term reporting and cross-server analysis rather than keeping it strictly local.

B. In the Azure Resource Graph database which stores all Arc-enabled server configuration data.

Azure Resource Graph (ARG) queries Azure Resource Manager (ARM) management-plane properties and metadata across subscriptions (such as OS type, Arc agent version, or Azure tags). ARG does not store high-frequency, guest OS-level file, registry, or service change logs.

C. In the Azure Automation account runbook output logs which capture change events as script output.

Even though legacy Change Tracking integrated with Azure Automation accounts, change telemetry was stored in Log Analytics workspace tables, not inside runbook execution output logs. Runbook logs only capture standard output from automation scripts.

Correct : B. Azure hybrid services integration within Windows Admin Center which provides a guided workflow to register a server with Azure Arc from the WAC server management view.
Windows Admin Center includes an Azure hybrid services tool/blade. From a connected server’s management view, administrators can:

Select Azure hybrid services.
Choose Discover Azure services.
Under the Azure Arc section (“Leverage Azure policies and solutions to manage your servers with Azure Arc”), select Set up.
Follow the guided workflow to choose the subscription, resource group, region, and (optionally) proxy settings.

WAC then downloads and installs the Azure Connected Machine agent and registers the server with Azure Arc. This is the built-in, server-centric way to extend WAC-managed servers into Azure Arc without leaving the Windows Admin Center interface.

Incorrect:

A. Azure Site Recovery integration which configures replication from WAC without the ASR portal.
Azure Site Recovery integration exists in WAC and allows configuring replication, but it is for disaster recovery/replication, not for registering servers with Azure Arc.

C. Azure Backup integration which configures backup policies for WAC-managed servers.
Azure Backup integration lets you configure backup vaults and policies from WAC. It does not onboard servers to Azure Arc.

D. Azure Security Center integration which shows Defender for Cloud recommendations in WAC.
Microsoft Defender for Cloud (formerly Azure Security Center) integration can surface recommendations, but it is a security posture feature, not the mechanism used to register servers with Azure Arc.

Correct Answer:
A. The Configuration Manager client and Hybrid Azure AD join or Azure AD join so that the device is enrolled in both ConfigMgr and Intune simultaneously.

Co-management bridges on-premises Configuration Manager (SCCM) infrastructure with cloud-native Microsoft Intune, allowing administrators to dual-manage Windows endpoints and transition individual management workloads (such as compliance policies, device configuration, or patch management) to the cloud at their own pace:

Dual Management Requirements: For a client device to participate in co-management, it must be managed by the Configuration Manager client and simultaneously enrolled in Microsoft Intune (MDM).

Identity Prerequisite: Enrolling an on-premises managed device into Intune requires cloud identity integration via Microsoft Entra hybrid join (joined to local Active Directory and registered with Microsoft Entra ID) or Microsoft Entra join (direct cloud join). This allows Intune to authenticate and auto-enroll the ConfigMgr-managed endpoint.

Co-management enables dual management via ConfigMgr agent and Intune enrollment. Source: Anoop C Nair

Incorrect:

B. The client must be Azure AD joined only and cannot be hybrid joined: Microsoft Entra hybrid join (formerly Hybrid Azure AD join) is actually the most common path for existing on-premises domain-joined endpoints moving to co-management. Devices do not need to be exclusively cloud-joined.

C. The Intune Management Extension must be separately installed on each device: The Intune Management Extension (IME) installs automatically when PowerShell scripts or Win32 apps are deployed from Intune to an enrolled Windows device. Administrators do not need to manually install it as a prerequisite for co-management enablement.

D. The device must be completely wiped and re-enrolled in Intune before ConfigMgr can be removed: Co-management is designed specifically to eliminate the need to wipe or re-image existing machines. It enables seamless in-place dual management, allowing workload authority to be shifted dynamically between ConfigMgr and Intune without user disruption.

The correct answer is C. A hard quota prevents users from writing data beyond the configured limit, while a soft quota monitors and reports usage but does not block writes when the threshold is exceeded.

In File Server Resource Manager (FSRM), a hard quota enforces a strict storage limit by blocking writes from users once the limit is reached . It proactively prevents further storage consumption beyond the configured threshold.

A soft quota, in contrast, is non-intrusive; it simply monitors and reports on storage usage, generating notifications (e.g., email alerts or event log entries) when usage reaches a configured threshold, but it does not actively prevent users from writing data beyond that limit .

Incorrect:

A. A hard quota encrypts files when the storage limit is reached: This describes a function unrelated to encryption. Neither hard nor soft quotas in FSRM encrypt files; encryption is a separate feature (e.g., EFS or BitLocker).

B. A hard quota uses NTFS disk quotas while a soft quota uses FSRM monitoring only: FSRM quotas are independent of the legacy NTFS disk quotas feature. Both hard and soft quotas are implemented via FSRM and operate at the volume or folder level.

D. A hard quota applies to all users equally while a soft quota can be applied per-user: Both hard and soft quotas in FSRM apply to the volume or folder level, affecting all users equally. Per-user quotas are a feature of the legacy NTFS quota system, not of FSRM.

A. A Role Capability file (.psrc) that specifies which modules, functions, cmdlets, and parameters are available to roles in the JEA session

JEA uses Role Capability files (.psrc) to define what commands, modules, functions, and parameters are available to delegated roles.

These files are referenced in a Session Configuration file (.pssc), but the .psrc is the key object that enforces restrictions.

Certification highlights .psrc files as the mechanism for defining least?privilege access in JEA.

B. A Group Policy preference (.xml) that filters allowed PowerShell commands per user

Incorrect.

Group Policy preferences can configure system settings but do not define JEA session restrictions.

JEA is managed through PowerShell configuration files, not Group Policy XML.

C. A PowerShell script module (.psm1) that imports restricted cmdlets for the session

Incorrect.

.psm1 files define PowerShell modules, but they do not enforce JEA restrictions.

JEA relies on .psrc files to specify allowed commands, not module scripts.

D. A constrained language mode script (.cslm) that defines per?user command restrictions

Incorrect.

Constrained Language Mode is a PowerShell execution mode, not a file type used by JEA.

JEA does not use .cslm files; it uses .psrc and .pssc files.

A is Correct
The Active Directory Administrative Tier Model (and modern Enterprise Access Model) enforces strict security boundaries to prevent lateral movement and credential theft:

Preventing Credential Theft: In Active Directory, logging into a lower-tier machine (such as a Tier 2 end-user laptop) with high-privilege credentials (such as a Domain Admin / Tier 0 account) leaves vulnerable credential artifacts (hashes, Kerberos tickets, or LSASS tokens) in memory. An attacker who compromises that end-user laptop can steal those credentials to achieve full domain compromise (Pass-the-Hash / Pass-the-Ticket).

Privileged Access Workstations (PAWs): A dedicated Tier 0 PAW is a heavily hardened physical or virtual host restricted exclusively to Tier 0 administrative tasks (managing Domain Controllers, PKI, and core identity services). It prohibits standard web browsing, email access, and productivity applications to eliminate primary malware entry points and keep highly sensitive credentials strictly isolated.

AD Tier Model isolates credentials to prevent cross-tier privilege escalation. Source: itm8

Incorrect:

B. To host all administrative tools in a centralised location accessible by all administrators simultaneously: A Tier 0 workstation is not a shared multi-user jump box or general remote administrative server. Broadly opening access to multiple administrators or mixing administration tiers on a shared server undermines tier-isolation security principles.

C. To provide a high-performance workstation for administrators who need to run resource-intensive management tasks: The primary purpose of a Tier 0 PAW is security isolation and risk reduction, not raw compute, GPU, or memory performance for heavy processing workloads.

D. To provide a workstation that automatically rotates privileged account passwords after each administrative session: Password rotation and Just-In-Time (JIT) / Privileged Access Management (PAM) workflows are managed by identity access software or vaulting solutions (such as Microsoft Entra Privileged Identity Management or Local Administrator Password Solution – LAPS), not by the physical or virtual workstation hardware itself.

The correct answer is D. Allowing a standalone on-premises server to access Azure VNet resources privately without requiring the entire on-premises network to have VPN connectivity.

The primary use case for the Azure Network Adapter is to provide a simple, one-click Point-to-Site (P2S) VPN connection from a single on-premises server to an Azure Virtual Network . This is ideal for scenarios where you need to connect only a few servers and want to avoid the complexity and hardware requirements of a full Site-to-Site VPN .

Incorrect:

A. Enabling Azure AD authentication for local Windows Server login: This is a function of Azure AD Connect or Microsoft Entra Domain Services, not the Azure Network Adapter feature.

B. Replacing an ExpressRoute circuit for all on-premises to Azure traffic: The Azure Network Adapter is for point-to-site connectivity for individual servers. It is not designed to replace high-bandwidth, enterprise-grade, private connectivity like ExpressRoute for all traffic.

C. Providing a site-to-site VPN between the on-premises network and Azure without configuring a VPN gateway: The Azure Network Adapter explicitly creates a Point-to-Site VPN, not a Site-to-Site VPN . Furthermore, it requires the creation of an Azure VPN Gateway, albeit automated through Windows Admin Center . The process does not bypass the need for a gateway.

A. MABS requires less storage than MARS because it uses deduplication at the agent level

Incorrect.

MABS does not primarily differentiate itself from MARS by deduplication.

Deduplication is not the defining advantage of MABS in Hyper?V VM protection.

B. MABS provides application?consistent backups of running VMs using VSS integration inside the guest

Correct.

MABS integrates with Volume Shadow Copy Service (VSS) to provide application?consistent backups of Hyper?V VMs.

This ensures that applications like SQL Server or Exchange are properly quiesced during backup, avoiding corruption.

Certification highlights this as the key advantage of MABS over the MARS agent, which only supports file/folder backup and lacks VM?level application consistency.

C. MABS does not require Azure connectivity and operates entirely on?premises

Incorrect.

MABS requires Azure connectivity for cloud backup storage.

It can use local disk or tape for short?term storage, but Azure connectivity is still required for cloud integration.

D. MABS agents are installed inside each VM while MARS operates at the hypervisor level

Incorrect.

MABS does not require agents inside each VM.

It integrates with Hyper?V at the host level to protect VMs, unlike MARS which is limited to file/folder backup.