Each differencing checkpoint in Hyper-V creates an .avhdx file that acts as a child disk dependent on its parent base disk (.vhdx). When multiple checkpoints are created over time, they form a hierarchical chain.

Read operations must traverse the chain starting from the newest checkpoint down through previous checkpoints until the target data block is located on the parent disk, introducing latency.

Write operations are written to the active checkpoint, but managing and tracking block locations across a deep chain increases storage controller overhead.

Therefore, Option C is the correct answer.

Details

Option A is incorrect: Volume Shadow Copy Service (VSS) is used to create application-consistent snapshots for backups. It does not mitigate or abstract away the underlying disk latency caused by traversing multiple differencing virtual disks during normal dynamic disk I/O operations.

Option B is incorrect: Hyper-V never automatically merges checkpoint chains after a specific time limit (such as 30 days). Merging only occurs when an administrator manually deletes a checkpoint via Hyper-V Manager or PowerShell, which triggers a background merge of the .avhdx files into the base disk or parent tree.

Option C is correct: Deep checkpoint chains directly degrade storage read/write performance due to the overhead of searching through multiple linked .avhdx files. Because of this, Microsoft recommends avoiding long-lived or deep checkpoint chains on production virtual machines.

Option D is incorrect: Differencing checkpoints are not a substitute for proper backups and do not improve backup reliability. In fact, long checkpoint chains increase storage consumption, increase the risk of corruption if a file in the chain is damaged, and complicate host-level backup processes.

Correct :

Option C – Event trace data collectors

Event trace data collectors capture detailed information from Windows event trace providers.

They can log application crash events, heap allocations, and low-level system activity, making them ideal for troubleshooting and crash analysis.

This is the correct answer because the certification emphasizes that event trace data collectors provide the most granular diagnostic data for application failures compared to other collector types.

Incorrect:

Option A – Registry snapshot

Registry snapshots record registry key values at a specific point in time.

While useful for configuration auditing, they do not capture runtime crash details or application behavior.

This option is incorrect because it lacks the dynamic event data needed for crash analysis.

Option B – WMI trace

WMI traces capture activity related to Windows Management Instrumentation queries.

They are useful for monitoring WMI usage but not for detailed crash diagnostics.

This option is incorrect because it focuses on query activity, not application crash events.

Option D – Performance counters

Performance counters measure metrics such as CPU, memory, disk, and network utilization over time.

They are valuable for performance monitoring but do not provide detailed crash or heap allocation data.

This option is incorrect because it only shows resource usage trends, not crash-specific information.

A. Enabling LSA Protection which runs the LSASS process as a Protected Process Light (PPL) so that untrusted code cannot inject into or read LSASS memory.

Local Security Authority (LSA) Protection prevents non-protected processes from reading the memory of or injecting code into the lsass.exe process. Running LSASS as a Protected Process Light (PPL) mitigates common pass-the-hash and credential-harvesting techniques by requiring administrative drivers to be digitally signed with a trusted Microsoft signature before interacting with the LSA process.

B. Requiring BitLocker on all fixed data volumes to prevent offline credential extraction. (Incorrect)

BitLocker provides encryption at rest to protect data if a physical drive is stolen or accessed offline. While essential for overall security, BitLocker does not protect active in-memory credentials or prevent memory-injection attacks against running processes like LSASS while the operating system is booted.

C. Disabling the Print Spooler service which is a known attack vector for privilege escalation. (Incorrect)

Disabling the Print Spooler service reduces a server’s attack surface against spooler-based remote code execution and local privilege escalation vulnerabilities (e.g., PrintNightmare). However, it does not directly manage or enforce memory isolation for the Local Security Authority process.

D. Enabling Windows Defender SmartScreen which prevents unauthorised applications from running on domain-joined servers. (Incorrect)

Windows Defender SmartScreen warns or blocks users from running unrecognized or potentially malicious applications downloaded from the internet. It operates at the application launch and web browser layer rather than providing process memory isolation for system-critical identity processes like LSA.

C. Central Access Policies deployed through Group Policy and claims-based user and device attributes defined in AD DS is correct.

Dynamic Access Control (DAC) uses claims-based authorization to evaluate characteristics of the user, device, and resource. User claims and device claims are based on attributes published by Active Directory Domain Services, while Central Access Policies define the authorization rules that use those claims.

Central Access Policies are deployed to file servers through Group Policy at:

Computer Configuration ? Policies ? Windows Settings ? Security Settings ? File System ? Central Access Policy

The domain controllers must also support the Kerberos extensions required for claims and compound authentication, including the appropriate KDC configuration.

Why the other options are incorrect
A. AD FS servers and Web Application Proxy
Incorrect. AD FS and Web Application Proxy are used primarily for federated identity and web application access. They are not the required Active Directory components for DAC-based file-share authorization.

DAC obtains user and device claims from AD DS and evaluates them through Central Access Policies.

B. Global Catalog servers and FSMO role holders
Incorrect. Global Catalog servers and FSMO role holders are important AD DS infrastructure components, but DAC does not require a specific deployment of either as the two components described in the question. They do not define Central Access Policies or the user and device claims used for authorization.

C. Central Access Policies and AD DS claims
Correct. Central Access Policies provide the centralized authorization rules, while AD DS supplies the user and device attributes that are issued as claims. These claims are evaluated when users access protected files.

D. DNS SRV records and Kerberos SPNs
Incorrect. DNS SRV records help clients locate domain services, and Kerberos SPNs identify services for Kerberos authentication. However, these are not the two DAC components that provide attribute-based authorization.

DAC requires claims support in AD DS, appropriate Kerberos support on domain controllers, and Central Access Policies deployed to file servers.

B is CORRECT

Role: Network Controller Server Role

Function: In Windows Server Software-Defined Networking (SDN), Network Controller is a dedicated, highly available server role (NetworkController). It serves as the central point of automation and management for the entire virtual and physical network infrastructure. It exposes REST APIs that allow management tools (like PowerShell or System Center) to configure and monitor Hyper-V Virtual Switches, Software Load Balancers (SLB), and RAS Gateways.

Option A is INCORRECT

Actual Component: SDN RAS Gateway

The Remote Access Service (RAS) role with Border Gateway Protocol (BGP) enabled is deployed to create SDN Gateways for site-to-site VPNs, GRE tunnels, and external layer 3 routing. While Network Controller manages these gateway VMs, RAS itself is not the role used to implement the Network Controller control plane.

Option C is INCORRECT

Actual Component: Management Application (System Center Suite)

System Center Virtual Machine Manager (SCVMM) is an external management software suite product, not a built-in Windows Server role. While SCVMM can be used to deploy and manage Network Controller via its northbound REST API, Network Controller itself is the underlying Windows Server role.

Option D is INCORRECT

Actual Component: Hyper-V Host Switch Component / Data Plane

Hyper-V Network Virtualization (HNV) is a network virtualization protocol capability running on individual Hyper-V hosts. Network Controller acts as the control plane that pushes HNV policies down to the hosts, but installing Network Controller relies on deploying the Network Controller server role (typically across a 3-node cluster of virtual machines), not simply enabling HNV on Hyper-V hosts.

The correct answer is A. Self-Service Password Reset (SSPR) for hybrid users so that passwords reset in the cloud portal are immediately written back to on-premises AD.

Password write-back is an essential feature of Microsoft Entra ID that enables password changes and resets initiated in the cloud to be synchronized back to an on-premises Active Directory Domain Services (AD DS) environment in real time . Its primary function is to ensure consistency between cloud and on-premises passwords for hybrid users.

The key scenario that requires this feature is Self-Service Password Reset (SSPR). For hybrid users whose passwords are managed on-premises, SSPR allows them to reset their passwords from the cloud portal. However, for this reset to take effect for their on-premises account, password write-back is mandatory . Without this service, the cloud password would be changed, but the on-premises AD password would remain unchanged.

Incorrect:

B. Multi-Factor Authentication registration: MFA registration settings are stored in Microsoft Entra ID, not on-premises AD. Password write-back is for synchronizing password changes, not MFA configuration.

C. Microsoft Entra ID Privileged Identity Management: PIM is for managing and controlling privileged access and role activations. It does not require password write-back for its core functions .

D. Conditional Access device compliance policies: This feature enforces policies based on device health and compliance status, which is determined through Intune and Microsoft Entra ID. It does not rely on password write-back .

The correct answer is C. Folder exclusion for the SQL Server data, log, and backup directories to prevent Defender AV from scanning active database files during I/O operations.

When using Microsoft Defender Antivirus with SQL Server, it’s crucial to add folder exclusions for the directories that contain SQL Server’s data (.mdf), log (.ldf), and backup (.bak) files . This is the recommended practice because scanning these high-activity, large files can lead to significant performance degradation, file locking conflicts, and potential database engine errors . Excluding these active file locations prevents the antivirus from interfering with critical I/O operations during queries, writes, and backups .

Incorrect:

A. Network exclusion for the SQL Server listener port: This is a firewall configuration to allow communication on port 1433, not an antivirus file scanning exclusion .

B. Process exclusion for the SQL Server executable only: While excluding the SQL Server executable (sqlservr.exe) is recommended to prevent scanning of its binaries, it is not sufficient on its own. To fully protect database performance, you must also exclude the data, log, and backup directories. Excluding a process prevents scans of files opened by it, but excluding the process itself would be counterproductive as it ignores all its operations .

D. Full volume exclusion for the entire drive: This is an overly broad approach that creates a significant security gap. Exclusions should be precise and limited to specific, high-risk directories to mitigate potential risks .

Correct :

Option D – TLS 1.3 provides perfect forward secrecy

TLS 1.3 mandates the use of ephemeral key exchange algorithms (such as Elliptic Curve Diffie-Hellman Ephemeral – ECDHE).

This ensures Perfect Forward Secrecy (PFS), meaning that even if a long-term private key is compromised, past session keys cannot be decrypted.

This property makes TLS 1.3 connections significantly more secure than TLS 1.2, which allowed non-ephemeral key exchanges (like RSA).

This is the correct answer because the certification highlights that PFS is a core security improvement in TLS 1.3.

Incorrect:

Option A – Certificate pinning

Certificate pinning is a separate security technique used in applications to prevent man-in-the-middle attacks.

It is not a built-in property of TLS 1.3 itself.

This option is incorrect because TLS 1.3 does not enforce certificate pinning by default.

Option B – RSA key exchange

TLS 1.3 actually removes RSA key exchange due to its lack of forward secrecy.

TLS 1.2 supported RSA, but TLS 1.3 requires ephemeral Diffie-Hellman exchanges.

This option is incorrect because RSA is weaker and not part of TLS 1.3’s design.

Option C – Smaller number of cipher suites

TLS 1.3 does simplify cipher suite configuration by reducing the number of supported suites.

While this reduces complexity, it is not the property that makes TLS 1.3 more secure than TLS 1.2.

This option is incorrect because simplification is about manageability, not enhanced security.

A. The server’s Group Policy Object links and Organisational Unit membership in Active Directory

Incorrect.

Group Policy links and OU membership are Active Directory attributes, not part of Azure Migrate’s dependency visualization.

Dependency maps focus on network communication, not directory structure.

B. Active TCP connections showing which other servers and services the selected server communicates with, helping identify dependencies for migration grouping

Correct.

Azure Migrate’s dependency visualization maps active TCP connections to show which servers and services a workload depends on.

This helps identify migration groups and ensures dependent workloads are migrated together.

Certification highlights this as the key purpose of dependency mapping.

C. The server’s Azure readiness score compared to similar servers in the assessment group

Incorrect.

Readiness scores are part of the assessment report, not the dependency map.

Dependency maps show communication flows, not readiness scoring.

D. The server’s BIOS and hardware configuration details for Azure VM size recommendation

Incorrect.

Hardware details are collected during assessment for sizing recommendations, but they are not part of the dependency visualization.

Dependency maps focus on network communication, not hardware inventory.

Correct:

Option A – Entra Connect synchronises users and credential hashes

Microsoft Entra Domain Services (EDS) provides managed domain services such as Kerberos and NTLM authentication.

Passwords from on-premises AD are not copied directly; instead, Entra Connect synchronises users into Microsoft Entra ID.

EDS then reads the Kerberos and NTLM credential hashes stored in Entra ID to support authentication in the managed domain.

This is the correct answer because the certification emphasizes that the flow is: On-premises AD ? Entra ID via Entra Connect ? Entra Domain Services uses credential hashes.

Incorrect:

Option B – Passwords copied directly via private link

Passwords are never copied directly from AD LDS or AD DS into Entra Domain Services.

Synchronisation always flows through Entra ID, not a private link.

This option is incorrect because it misrepresents the architecture.

Option C – Direct LDAP query at runtime

Entra Domain Services does not query on-premises domain controllers at runtime.

It is a managed domain service that operates independently once credential hashes are synchronised into Entra ID.

This option is incorrect because runtime LDAP queries are not part of the supported model.

Option D – Manual export/import of password hashes

Administrators cannot manually export and import password hashes into Entra Domain Services.

This would be insecure and unsupported.

Synchronisation is always automated via Entra Connect.

A. The percentage of files that must be fully cached locally before tiering the remainder. (Incorrect)

Cloud tiering does not evaluate or enforce policy based on a total percentage of individual files. Instead, tiering behavior is determined by specific thresholds, primarily the total free space remaining on the local storage volume and (optionally) the date of last file access.

B. The minimum percentage of the local volume that must remain free at all times by tiering files to Azure when the threshold is reached.

The Volume Free Space Policy defines a target percentage of unused disk space for the local volume hosting the server endpoint. When available disk space drops below this configured percentage, Azure File Sync automatically tiers the least recently accessed files to the connected Azure file share, converting local files into lightweight pointer (reparse point) files until the target free space percentage is restored.

C. The amount of Azure Files storage pre-provisioned as a local buffer before syncing to the cloud. (Incorrect)

Azure File Sync does not pre-provision local volume space as a cloud buffer. Uncached tiered files remain stored in the Azure file share in the cloud and are downloaded back to the local volume on-demand only when an end user or application attempts to open them.

D. The maximum percentage of the local volume that Azure File Sync uses for its cache database. (Incorrect)

The local volume free space setting directly regulates file storage and tiering behavior on the host disk, not the maximum size allocated for the metadata database or system sync overhead.

Correct answer: C
C. It sends I/O alternately across all available paths, distributing the load evenly across paths.

The MPIO Round Robin policy directs I/O requests across all available active paths in a balanced, rotating sequence. This uses multiple paths for load distribution while also providing redundancy if a path becomes unavailable.

For example, with paths A, B, and C, successive I/O requests may be sent through A, then B, then C, and then continue from A again. The exact scheduling is handled by the Device Specific Module (DSM).

Incorrect:

A. Always uses the lowest-latency path
Incorrect. This describes a path-selection or performance-based policy, not Round Robin. Round Robin does not continuously measure latency and select only the fastest path; it distributes I/O across the available paths.

B. Uses the primary path until failure
Incorrect. This describes Failover Only. Under that policy, one path carries all I/O and standby paths are used only when the active path fails.

C. Alternates I/O across all available paths
Correct. Round Robin uses all available paths in a balanced, round-robin fashion.

D. Aggregates all bandwidth into one logical channel
Incorrect. Round Robin distributes I/O across paths, but it does not bond or combine the paths into one logical network or storage channel whose bandwidth is necessarily the mathematical sum of every path. Performance also depends on the storage controller, DSM, workload, and path configuration.

The correct answer is C. NVGRE (Network Virtualisation using Generic Routing Encapsulation) which encapsulates VM Ethernet frames with a GRE header containing a virtual subnet identifier.

Hyper-V Network Virtualization (HNV) in Windows Server 2025 uses Network Virtualization using Generic Routing Encapsulation (NVGRE) as the primary mechanism to virtualize IP addresses and isolate tenant networks . This technology encapsulates the tenant’s original Ethernet frame within a new IP packet . The crucial component for tenant isolation is a 24-bit Virtual Subnet ID (VSID) stored in the GRE header of the new packet, allowing multiple tenants to use overlapping IP addresses .

Incorrect:

A. IPsec tunnel mode: IPsec is primarily used for encryption and security on a network, not as the tunneling protocol for network virtualization in HNV. While it can encapsulate packets, it is not the standard mechanism for HNV’s overlay networking.

B. VLAN tagging: VLANs (802.1Q) are a traditional layer-2 isolation mechanism for physical networks. They do not provide the scalability required for cloud environments because they are limited to 4094 unique VLANs. HNV uses NVGRE and VXLAN to overcome this limitation .

D. GRE (Generic Routing Encapsulation) which wraps packets in a simple tunnel header: This is a partial description. NVGRE is a specific implementation of GRE that adds the Virtual Subnet ID (VSID), which is essential for isolating tenant traffic on the same physical network. Plain GRE lacks this identifier and is not the HNV implementation .

A. It configures the frequency at which the synchronisation engine polls Active Directory for changes

Incorrect.

Synchronisation frequency is controlled by the scheduler, not attribute flow rules.

Attribute flow rules define how attributes are mapped and transformed, not how often sync occurs.

B. It controls which user accounts are in scope for synchronisation based on OU membership

Incorrect.

OU filtering and scoping are handled by synchronisation filtering configuration, not attribute flow rules.

Attribute flow rules do not determine which accounts are included; they determine how attributes are processed.

C. It determines which domain controllers Entra Connect communicates with during synchronisation

Incorrect.

Domain controller selection is managed by connector configuration, not attribute flow rules.

Attribute flow rules are unrelated to DC communication.

D. It defines how attribute values from the source directory are mapped and transformed to populate corresponding attributes in the target directory

Correct.

Attribute flow rules specify mapping and transformation logic for attributes between on?premises AD and Microsoft Entra ID.

Examples: mapping sAMAccountName to userPrincipalName, or applying expression?based transformations.

Certification highlights this as the primary function of attribute flow rules in Entra Connect.

A. Expiration Date Classifier which assigns properties based on the file creation or modification timestamp. (Incorrect)

FSRM does not feature a built-in mechanism called “Expiration Date Classifier.” While file creation, modification, or last-accessed timestamps can be used to trigger File Management Tasks (such as file expiration or archival), file properties themselves are applied using explicit classification rule mechanisms rather than a timestamp-specific classifier name.

B. Content Classifier which searches file content for specified words or regular expression patterns and assigns a property value when a match is found.

The Content Classifier inspects the actual text stream inside supported file formats using IFilters. It evaluates the file’s text against configured strings or Regular Expressions (Regex)—such as social security numbers, credit card patterns, or sensitive keywords—and automatically attaches the corresponding classification property when a match occurs.

C. Folder Quota Classifier which assigns properties when folder quota thresholds are reached. (Incorrect)

Quotas in FSRM are used strictly to monitor and restrict storage usage on volumes or folders. There is no classifier associated with folder quotas; quota management operates separately under FSRM’s Quota Management node rather than Classification Management.

D. File Classifier which assigns properties based on the folder the file is stored in – this confuses the classification rule type; folder-based rules use the Folder Classifier not a content-based rule. (Incorrect)

“File Classifier” is not a valid classifier mechanism in FSRM. Assigning metadata based on a file’s directory location is handled using folder-based parameters within a rule definition (or via the Folder Classifier implementation), which evaluates file path hierarchy rather than inspecting internal file contents.

The correct answer is A. All updates classified as Important or higher that are approved by Windows Server Update Services or Windows Update.

By default, Cluster-Aware Updating (CAU) utilizes the Microsoft.WindowsUpdatePlugin, which integrates with the existing Windows Update Agent (WUA) and Windows Server Update Services (WSUS) infrastructure . This default plugin is designed to apply updates that are classified as Important from the configured update source, which could be Microsoft Update, Windows Update, or a local WSUS server . This default behavior can be configured to also include Recommended updates if needed .

Incorrect:

B. Only updates that require a reboot to allow CAU to coordinate the node drain and restart sequence: CAU applies all updates in its scope, regardless of whether they require a reboot, to maintain cluster node consistency. It manages the node drain and restart sequence for all updates, not just the ones that require a reboot.

C. Only security updates with a severity rating of Critical or Important: The classification used is simply “Important” (and optionally “Recommended”) as defined by the update source. It is not limited to only security updates that are specifically rated “Critical.”

D. All available updates including driver updates, optional updates, and feature updates: This is incorrect as the default plugin does not include optional updates, feature updates, or many non-Microsoft drivers. Those types of updates typically require the custom Microsoft.HotfixPlugin to be applied, which is not the default behavior .

When new nodes are added to an Azure Stack HCI cluster, Storage Spaces Direct (S2D) detects the new capacity and automatically initiates a background process to redistribute data blocks across all available drives and nodes. This process ensures balanced capacity utilization and maintains optimal read/write performance across the entire storage pool without downtime.

Therefore, Option A is the correct answer.

Details:

Option A is correct: Storage Spaces Direct automatically optimizes storage pool balance when node additions occur. It redistributes existing data slabs across all drives (both existing and new) to maintain uniform data distribution and maximize I/O performance.

Option B is incorrect: Azure Stack HCI supports online, non-disruptive node expansion. You do not need to suspend the cluster or shut down running virtual machines to add new nodes to the storage pool.

Option C is incorrect: S2D does not isolate existing data to older nodes. Leaving existing data unbalanced would create storage bottlenecks and uneven disk usage across the cluster nodes.

Option D is incorrect: Cluster expansion is completely non-destructive. Storage Spaces Direct preserves all existing volume data while integrating the new hardware into the unified storage pool.

Correct Answer: D

D. Active TCP connections and process names showing which applications communicate with each other, enabling assessment of migration group dependencies.

Correct. Agentless dependency analysis in Azure Migrate uses vCenter Server APIs (for VMware) or Hyper-V host APIs to capture active TCP connection data and the processes initiating or listening on those connections. This helps you identify inter-server dependencies and form logical migration groups, ensuring all dependent servers are migrated together without breaking application workflows.

Incorrect Options:

A. The VM’s installed software list and Windows Update compliance status.

Incorrect. Discovering installed software, features, and roles falls under software inventory (app discovery), not dependency analysis. Furthermore, Windows Update compliance status is managed by Azure Update Manager or WSUS/SCCM, not Azure Migrate’s dependency analysis feature.

B. The VM’s GPO configuration and Active Directory OU placement.

Incorrect. Active Directory domain structures, Group Policy Objects (GPOs), and Organizational Unit (OU) placements are not gathered by Azure Migrate’s dependency analysis engine. These configurations are evaluated during identity and domain architecture planning rather than application dependency assessment.

C. The VM’s storage I/O patterns for right-sizing the Azure managed disk type.

Incorrect. Capturing storage IOPS, throughput, and disk utilization patterns is part of performance-based assessment and sizing recommendations, not dependency analysis. While critical for migration readiness and cost estimation, performance metrics are gathered separately from network dependency mapping.

A. Source?initiated which uses Group Policy to configure source computers to forward events to the collector automatically

Correct.

Source?initiated subscriptions scale better because each source computer is configured (commonly via Group Policy) to forward events to the collector.

This eliminates the need for the collector to maintain individual credentials or manual configurations for hundreds of machines.

Certification emphasizes source?initiated as the recommended approach for large environments.

B. Agent?based forwarding which requires installing the Log Analytics agent on each server

Incorrect.

This option refers to Azure Monitor/Log Analytics agent, not Windows Event Forwarding (WEF).

WEF does not require separate agents; it uses built?in Windows Event Collector and WinRM.

Installing agents on each server adds overhead and is not part of WEF subscription configuration.

C. Manual subscription which requires an administrator to configure each source computer individually

Incorrect.

Manual configuration is not scalable and impractical for hundreds of source computers.

Certification highlights automation via Group Policy or scripts, not manual setup.

D. Collector?initiated which requires the WEC server to have credentials for each source computer

Incorrect.

Collector?initiated subscriptions require the collector to authenticate to each source computer.

This approach is less scalable because managing credentials for hundreds of machines is complex and resource?intensive.

Certification notes collector?initiated is suitable for small environments, not large ones.

In System Center Operations Manager (SCOM), a monitor is the specific component responsible for measuring the health state of a managed object (e.g., Healthy, Warning, or Critical). Monitors continuously evaluate operational conditions (such as service states, event logs, or performance thresholds) and directly drive the health rollup hierarchy visible inside Health Explorer.

Therefore, Option A is the correct answer.

Details:

Option A is correct: A monitor actively measures and determines the health state of a target object. When predefined conditions or thresholds are met, the monitor changes the object’s health state, which is then reflected in Health Explorer.

Option B is incorrect: Discoveries are used during target identification to find objects (such as servers, databases, or network devices) in the environment and populate the SCOM inventory. They do not evaluate operational health state.

Option C is incorrect: Rules collect telemetry (such as performance counters, event logs, or script outputs) and can generate alerts or store data for reporting. However, rules do not calculate or maintain a state transition for an object’s health in Health Explorer.

Option D is incorrect: An alert is an informational notification generated as a result of a rule or a monitor changing state. It informs administrators that an event occurred, but it is not the engine that evaluates or determines the underlying health state.

A. Public profile which applies when the server is connected to an untrusted public network

Incorrect.

The Public profile is designed for untrusted networks such as airports, hotels, or coffee shops.

It applies the most restrictive rules to minimize exposure.

It does not apply when the server is connected to a domain network.

B. Private profile which applies when the server is connected to a trusted non?domain network

Incorrect.

The Private profile is intended for trusted networks that are not domain?joined, such as a home or small office LAN.

It allows more relaxed rules than the Public profile but is not used in domain scenarios.

C. Work profile which applies when the server is designated as a workplace device in Windows Security

Incorrect.

There is no “Work profile” in Windows Defender Firewall with Advanced Security.

This option is a distractor and does not exist in the firewall configuration model.

D. Domain profile which applies automatically when the server successfully communicates with the domain it is joined

Correct.

The Domain profile is applied when the computer can authenticate and communicate with a domain controller in the domain it is joined to.

It is the least restrictive profile because domain networks are considered trusted.

Certification objectives emphasize that the Domain profile is automatically selected when domain connectivity is detected.

Active Directory-Integrated DNS uses application directory partitions to scope replication to specific subsets of domain controllers. The ForestDNSZones application partition specifically targets all domain controllers across the entire Active Directory forest that have the DNS Server role installed.

Therefore, Option A is the correct answer.

Detailed Breakdown of Options

Option A is correct: The ForestDNSZones partition replicates DNS zone data exclusively to domain controllers across all domains in the entire forest that are running the DNS server role, making it ideal for enterprise-wide name resolution (such as root domain names or global service records).

Option B is incorrect: DomainDNSZones only replicates within a single domain, not the entire forest. Furthermore, application partitions replicate strictly to DCs running the DNS server role, not all DCs regardless of role.

Option C is incorrect: Legacy DNS storage stores zone data directly in the default domain Naming Context (NC), which replicates to all domain controllers in that specific domain (even those without the DNS server role installed). It does not replicate across the entire forest.

Option D is incorrect: While the Domain DNS application partition (DomainDNSZones) does replicate to all DNS-running DCs, its scope is strictly limited to the local domain, not the entire forest.

A. Apply security to All groups, use Global groups for users, use Domain Local groups for Distribution, and use Policies for permissions

Incorrect.

This option misstates the model. The A?G?DL?P strategy does not use “All groups” or “Distribution” in this way.

Distribution groups are not security principals and cannot be assigned permissions.

B. Place user Accounts into Global groups, nest Global groups into Domain Local groups, and assign Permissions to the Domain Local groups

Correct.

This is the A?G?DL?P model:

A (Accounts) ? Place user accounts into Global groups.

G (Global groups) ? Represent roles or departments.

DL (Domain Local groups) ? Represent resources in the domain.

P (Permissions) ? Assign permissions to the Domain Local groups.

This model simplifies administration, improves scalability, and aligns with Microsoft’s best practices for resource access management.

C. Assign users to Application groups, Group the Application groups into Distribution lists, and Place Distribution lists in Policies

Incorrect.

This option introduces “Application groups” and “Distribution lists,” which are not part of the A?G?DL?P model.

Distribution lists are for email, not security permissions.

D. Place user Accounts into Global groups, assign Permissions directly to Global groups, and use Domain Local groups as Distribution lists

Incorrect.

Assigning permissions directly to Global groups breaks the A?G?DL?P model.

Domain Local groups are intended to hold permissions for resources, not act as distribution lists.

This approach reduces flexibility and makes cross?domain resource management more difficult.

In Azure Automation State Configuration (built on PowerShell Desired State Configuration / DSC), nodes poll the pull server to retrieve declared configurations and report their compliance status.

To enable this for an Azure Arc-enabled server, the server’s Local Configuration Manager (LCM) must be configured with pull settings that point to the Azure Automation account endpoint, registering the machine as an Azure Automation DSC node.

Therefore, Option C is the correct answer.

Details:

Option A is incorrect: Azure Policy can enforce or assess configuration standards via machine configuration (formerly Azure Policy Guest Configuration), but Azure Policy ARM template deployments do not natively convert an Azure Automation State Configuration pull server into an ARM endpoint for DSC node registration.

Option B is incorrect: System Center Configuration Manager (SCCM/MECM) is a separate on-premises management platform. It does not act as a bridge or requirement for reporting compliance to Azure Automation State Configuration.

Option C is correct: Registering an Arc-enabled server as an Azure Automation DSC node configures its local LCM to connect to the Azure Automation pull service. The LCM periodically pulls the assigned node configuration, evaluates local state, applies desired settings, and sends compliance reports back to the Azure Automation service.

Option D is incorrect: While the Arc Custom Script Extension can execute PowerShell scripts locally, running ad-hoc scripts does not register the machine with the Azure Automation State Configuration pull service, nor does it integrate the node into the native Azure Automation DSC compliance dashboard.

Correct Answer: A

A. The Scale-Out File Server cluster running the storage where the Storage QoS policy server role enforces IOPS limits on behalf of all Hyper-V hosts.

Correct. When storing Hyper-V virtual hard disks on shared SMB 3.0 storage backed by a Scale-Out File Server (SOFS) cluster, a centralized Policy Manager (Policy Server Role) runs on the SOFS failover cluster. It acts as the central coordinator to monitor I/O flows and dynamically enforce minimum and maximum IOPS policies across all Hyper-V hosts accessing the shared storage.

Incorrect :

B. The Windows Defender Application Control policy which limits storage throughput for specific VM processes.

Incorrect. Windows Defender Application Control (WDAC) is a security mechanism used to enforce code integrity policies and restrict executable binaries/scripts from running. It plays no role in network I/O, disk throughput, or Storage QoS policies.

C. The Hyper-V hypervisor layer which intercepts all virtual disk I/O before it reaches the physical storage.

Incorrect. While individual Hyper-V nodes do enforce I/O throttling rules assigned to them, the hypervisor layer alone cannot manage aggregated or cluster-wide Storage QoS policies across multiple nodes. Without the SOFS Policy Manager, individual hosts cannot coordinate or balance shared IOPS allocations across the entire cluster.

D. The Failover Cluster manager on each Hyper-V host which tracks IOPS against configured limits.

Incorrect. Failover Cluster Manager is a management console used by administrators to configure cluster resources and policies. It is not a runtime service or storage filter driver responsible for real-time traffic monitoring, tracking, or enforcing IOPS limits.

A. Using Server Manager on the Desktop Experience workstation by adding the Server Core server as a managed server and running Add Roles and Features remotely targeting the core server

Correct.

Server Core does not include the GUI tools like Server Manager locally.

Best practice is to use Server Manager from a workstation or another server running Desktop Experience, add the Server Core machine as a managed server, and then run the Add Roles and Features Wizard remotely.

This aligns with certification objectives: remote management is the supported and scalable method for Server Core.

B. Connecting to the Server Core machine via Remote Desktop and using the Add Roles and Features Wizard in the local Server Manager console

Incorrect.

Server Core does not have the local Server Manager GUI.

Remote Desktop only provides a command?line interface (PowerShell, sconfig), not the Add Roles and Features Wizard.

C. Using Remote Desktop Services RemoteApp to stream Server Manager from a centralised server to the Server Core machine

Incorrect.

RemoteApp can publish applications, but Server Core does not support streaming Server Manager to itself.

Server Manager must be run remotely from a GUI?enabled workstation or server, not streamed to the Core machine.

D. Running the Windows Server Setup installer via PXE boot to add features to the running Server Core installation

Incorrect.

PXE boot is used for OS deployment, not for adding roles/features to an already running Server Core installation.

Features are added via DISM, PowerShell, or remote Server Manager — not through PXE.

The Knowledge Consistency Checker (KCC) is a built-in process that runs on every domain controller. Its primary responsibility is to dynamically create and adjust the replication topology for intra-site (within a site) and inter-site (between sites) Active Directory replication, ensuring all domain controllers receive directory updates via efficient, loop-free paths.

Therefore, Option D is the correct answer.

Detailed Breakdown of Options

Option A is incorrect: Conflict resolution in Active Directory is handled by the replication engine using timestamp algorithms, Version Numbers, and Property Version Numbers (PVNs) to resolve conflicting attribute updates—not by the KCC topology engine.

Option B is incorrect: Encryption of inter-site replication traffic is managed by the underlying transport protocols (RPC over IP or SMTP/IPsec), not the KCC. The KCC only establishes the logical connections across which transport protocols operate.

Option C is incorrect: While the KCC generates connection objects, administrators define the replication schedule on the Site Link objects themselves (e.g., replicating every 180 minutes by default for inter-site links). The KCC uses those site link schedules but does not independently manage or set individual connection schedules.

Option D is correct: The KCC automatically computes and maintains the replication topology for both intra-site and inter-site replication. It creates connection objects between domain controllers to ensure reliable, optimized replication paths while minimizing latency and bandwidth consumption across the forest.

Correct :
Option D – Asynchronous replication

Asynchronous replication does not wait for the destination site to acknowledge each write before committing at the source.

This mode tolerates higher round-trip latency between sites, making it suitable when latency exceeds the synchronous replication limit (typically 5 ms).

The trade-off is that there may be potential data loss equal to the last acknowledged replication sequence if a failure occurs.

This is the correct answer because the certification emphasizes that asynchronous replication is required when latency is too high for synchronous replication.

? Incorrect Options
Option A – Snapshot replication

Windows Server Storage Replica does not use snapshot-based replication.

Snapshots are a different technology (e.g., Volume Shadow Copy Service) and not part of Storage Replica’s supported replication modes.

Therefore, this option is invalid in the context of stretch clusters.

Option B – Synchronous replication

Synchronous replication requires very low latency (?5 ms RTT).

If latency exceeds this limit, synchronous replication cannot be used because it would severely impact performance and application responsiveness.

Thus, this option is incorrect for scenarios with high latency.

Option C – Bidirectional replication

Storage Replica supports one-to-one replication (primary to secondary) but not simultaneous bidirectional replication across sites.

Writes are not distributed across both sites; instead, one site is designated as primary.

This option is not supported and therefore incorrect.

A. Services tab which shows the status of all Windows services running on the server

Incorrect.

The Services tab lists Windows services, their status (running/stopped), and allows start/stop actions.

It does not display system?wide counters like handles, threads, or processes.

B. Users tab which shows logged?on users and their resource consumption

Incorrect.

The Users tab shows which users are logged on and their associated resource usage (CPU, memory, etc.).

It does not provide system?wide totals for handles, threads, or processes.

C. Details tab which shows per?process CPU and memory usage with individual process names

Incorrect.

The Details tab provides granular per?process information (PID, CPU, memory, etc.).

While it shows individual process metrics, it does not summarize system?wide counts of handles, threads, and processes.

D. Performance tab which provides real?time graphs and summary counters for CPU, memory, disk, and network usage

Correct.

The Performance tab is where Task Manager displays real?time graphs and counters.

It includes system?wide totals such as handles, threads, and processes, along with CPU, memory, disk, and network usage.

Certification objectives highlight this tab as the place to monitor overall system resource usage.

Secure Socket Tunneling Protocol (SSTP) is a Microsoft-proprietary VPN protocol integrated into Routing and Remote Access Service (RRAS). It encapsulates PPP traffic over an SSL/TLS channel using TCP port 443. Because TCP port 443 is the standard port for HTTPS traffic, SSTP can easily traverse almost all firewalls, web proxies, and NAT devices without requiring special port openings.

Therefore, Option B is the correct answer.

Details:

Option A is incorrect: Point-to-Point Tunneling Protocol (PPTP) relies on TCP port 1723 and IP Protocol 47 (GRE). It lacks modern encryption standards, is vulnerable to exploitation, and is often blocked by firewalls that restrict non-HTTP/HTTPS traffic.

Option B is correct: SSTP uses SSL/TLS encryption over TCP port 443. This allows VPN connections to establish successfully through network environments where strict outbound firewall rules block traditional VPN protocols.

Option C is incorrect: Layer 2 Tunneling Protocol over IPsec (L2TP/IPsec) uses UDP port 500, UDP port 4500 (for NAT Traversal), and IP Protocol 50 (ESP). While highly secure, it is frequently blocked on networks or public Wi-Fi access points that restrict UDP traffic or IPsec protocols.

Option D is incorrect: Internet Key Exchange version 2 (IKEv2) uses UDP ports 500 and 4500. Although it offers high performance and mobility features (like seamless switching between network interfaces), it does not tunnel over SSL/TLS port 443 and can be blocked by restrictive firewalls.

Correct Answer:

C. Cloud witness removes the dependency on a second on-premises infrastructure component for quorum, providing resilience against scenarios where both the cluster and the on-premises witness become unavailable simultaneously.

In Windows Server Failover Clustering (WSFC), a Cloud Witness uses Azure Blob Storage as a quorum tie-breaker:

Eliminating Multi-Site On-Premises Dependencies: Traditional File Share Witnesses (FSWs) require a separate physical or virtual server located in a separate domain, datacenter, or site to prevent a single point of failure. Deploying a Cloud Witness offloads this witness vote to Azure Blob Storage over HTTPS (port 443).

Cross-Site & Multi-Site Resilience: In multi-site cluster architectures or stretch clusters, placing the witness in the cloud guarantees that if an entire on-premises primary datacenter hosting both the cluster nodes and an on-premises witness goes down, the surviving nodes in secondary locations can still establish a quorum majority with the external Azure Cloud Witness.

Incorrect:

A. Cloud witness requires less configuration than a file share witness: While Cloud Witness setup is simple (requiring an Azure storage account name and access key), deployment simplicity is a convenience feature, not its core high-availability structural advantage over a file share witness.

B. Cloud witness provides automatic failover to a secondary Azure region if the primary Blob Storage becomes unavailable: Cloud Witness reads and writes small timestamp files (blob tags) to a specific Azure Blob Storage container. It does not natively orchestrate region-to-region failover of the storage endpoint for quorum arbitration; high availability is handled natively by Azure Storage replication settings (e.g., LRS/GRS).

D. Cloud witness eliminates the need for quorum disks by replacing all quorum mechanisms: Cloud Witness is simply a type of quorum witness (an alternative to a Disk Witness or File Share Witness). It does not replace the overall WSFC quorum voting model; it provides a single vote within the existing quorum architecture.

B is CORRECT

Role: Microsoft Entra ID Cloud Sync Architecture

Function: Microsoft Entra ID Cloud Sync is designed to streamline identity synchronization by offloading heavy configuration and synchronization processing to Microsoft’s cloud services. Instead of running a heavy local service with a dedicated database (SQL Server Express or full SQL) as Microsoft Entra Connect sync does, Cloud Sync uses lightweight provisioning agents installed on-premises. These lightweight agents act as a bridge, while the synchronization logic, rule processing, and configuration management are executed directly within the Microsoft Entra ID cloud environment.

A is INCORRECT

Actual Requirement: Lightweight Agent (No MIM Required)

Cloud Sync does not require Microsoft Identity Manager (MIM) or any complex server infrastructure. Microsoft Identity Manager is a legacy enterprise identity management system. Cloud Sync was explicitly designed to eliminate heavy local dependencies, running only a lightweight background agent on an existing Windows Server.

C is INCORRECT

Actual Component: Microsoft Entra Connect Sync (Traditional)

The traditional Microsoft Entra Connect sync engine processes transformation rules and identity matching locally on the on-premises sync server before pushing changes to the cloud. Option C describes a local-heavy architecture, which is the exact opposite of Cloud Sync’s cloud-centric model. Additionally, Cloud Sync supports multiple lightweight agents for high availability and failover, rather than relying on a single isolated agent server.

D is INCORRECT

Actual Requirement: On-Premises Provisioning Agent Required

While management happens in the cloud portal, Cloud Sync still requires at least one lightweight provisioning agent installed on an on-premises Windows Server to read from and communicate with local Active Directory Domain Services (AD DS). A completely agentless model is impossible because cloud services cannot directly query an isolated on-premises Active Directory network without a connector/agent.

The correct answer is A. DeployIfNotExists effect which automatically deploys a missing resource or configuration when an Arc-enabled server is found to be non-compliant.

The DeployIfNotExists effect is specifically designed to automatically remediate non-compliant resources. For Azure Arc-enabled servers, when a policy assignment with this effect evaluates a server and finds that a required configuration or extension (like Microsoft Defender for Servers or Change Tracking) is missing, it triggers a template deployment to automatically deploy the missing resource or apply the required configuration . This effectively resolves the non-compliance without manual intervention . For existing non-compliant resources, automatic remediation via this effect can be achieved by creating a remediation task or, when assigning the policy through the Azure portal, by enabling the “Create remediation task” option .

Incorrect:

B. Append effect: This effect adds properties to a resource definition, but only during a resource creation or update request. It is not used for deploying entirely new configurations or extensions to existing non-compliant resources .

C. Audit effect: This effect is used to identify and report non-compliant resources in the compliance dashboard. It does not perform any automatic deployment or remediation actions .

D. Deny effect: This effect is used to prevent the creation or update of a resource that does not meet policy requirements. It is a preventative control and does not deploy or remediate configurations on existing resources .

The correct answer is D. A log search alert rule querying the InsightsMetrics or Perf table for disk utilisation data with a threshold condition and an action group to send notifications.

This is the accurate method for creating a low disk space alert in Azure Monitor . The process involves these key technical components:

Data Source: Performance data for disk space is stored in either the Perf table or the InsightsMetrics table within a Log Analytics workspace .

Query: A Kusto Query Language (KQL) query must be constructed to identify the specific performance counter, e.g., ObjectName == “LogicalDisk” and CounterName == “% Free Space”, and then analyze the data to find values below a threshold .

Alert Rule: This query is used as the basis for a log search alert rule, which continuously evaluates the query results against a configured threshold .

Action Group: An Action Group is attached to the alert rule to define the notification action (e.g., email, SMS) that will be triggered when the alert condition is met .

Here is an analysis of why the other options are incorrect:

A. An activity log alert: This type of alert is triggered by events in the Azure platform itself, such as changes to the virtual machine’s configuration. It does not monitor guest operating system metrics like disk space .

B. A metric alert: While metric alerts exist for Azure VMs, they are primarily for host-level metrics (e.g., CPU percentage). To monitor guest OS performance counters (like disk free space), a log search alert is required .

C. A smart detection rule: This is a feature used for identifying anomalies in logs, not for creating a simple, threshold-based alert on a specific performance metric .

A. A crash?consistent point is higher quality and preferred for application recovery

Incorrect.

Crash?consistent recovery points capture only the disk state at a given moment, similar to pulling the power plug.

They do not guarantee application consistency and are not preferred for application recovery.

B. Application?consistent recovery points are only available for VMs running on VMware

Incorrect.

Application?consistent recovery points are available for supported Windows and Linux workloads, not limited to VMware.

Azure Site Recovery uses Volume Shadow Copy Service (VSS) on Windows or equivalent mechanisms on Linux to ensure application consistency.

C. A crash?consistent recovery point captures the disk state as it was at a moment in time similar to recovering from a power failure, while an application?consistent recovery point uses VSS to ensure all application buffers are flushed and in?flight transactions are written before capture

Correct.

Crash?consistent: captures disk state only, like a sudden power loss.

Application?consistent: uses VSS (Windows) or equivalent to flush buffers and commit transactions, ensuring applications like SQL Server or Exchange are in a consistent state.

Certification highlights this distinction as critical for reliable recovery of production workloads.

D. An application?consistent point captures only disk state while a crash?consistent point captures memory state

Incorrect.

Neither recovery point captures memory state.

Application?consistent captures disk plus application state; crash?consistent captures only disk state.

This option misrepresents both definitions.

Correct :

Option C – DHCP

In Windows Deployment Services (WDS), PXE clients first use DHCP to obtain an IP address.

DHCP can also provide additional options such as Option 66 (Boot Server Host Name) and Option 67 (Bootfile Name), which help the client locate the WDS server and the boot image.

This is the correct answer because DHCP is the protocol that enables PXE clients to discover the WDS server and initiate the network boot process.

Incorrect :

Option A – DNS

DNS resolves hostnames to IP addresses but is not used by PXE clients to discover WDS servers.

PXE relies on DHCP for initial communication, not DNS.

Option B – WINS

WINS resolves NetBIOS names, but PXE boot does not use WINS for server discovery.

This option is outdated and irrelevant to WDS PXE boot.

Option D – ICMP

ICMP is used for diagnostics (e.g., ping) but cannot provide IP addresses or boot server information.

PXE clients do not use ICMP to locate WDS servers.

Correct Answer:
C. Windows Server Standard or Datacenter licences with active Software Assurance or qualifying Azure subscription.

Azure Hybrid Benefit (AHUB) is a licensing cost-saving feature that allows organizations to bring their on-premises Windows Server core licenses to Microsoft Azure, significantly lowering the cost of running Azure IaaS Virtual Machines or Azure Stack HCI:

Software Assurance / Subscription Requirement: To qualify for Azure Hybrid Benefit, on-premises Windows Server core licenses (Standard or Datacenter editions) must be covered by active Software Assurance (SA) or be purchased as qualifying Cloud Solution Provider (CSP) subscription licenses.

Licensing Allocation: Each set of 16 Windows Server core licenses with active SA entitles an organization to run Windows Server on up to two Azure Virtual Machines (up to 8 cores each) or one Azure Virtual Machine (up to 16 cores), paying only base Linux compute rates.

Incorrect:

A. Any server hardware manufacturer OEM licence regardless of Software Assurance coverage: Standard Original Equipment Manufacturer (OEM) licenses purchased pre-installed on server hardware are tied to that specific physical machine and lack Software Assurance rights. They cannot be transferred to Azure via Azure Hybrid Benefit unless Software Assurance was added within 90 days of the OEM purchase under specific volume licensing programs.

B. Windows Server Essentials licences which have special Azure Hybrid Benefit rights: Windows Server Essentials edition does not include Azure Hybrid Benefit rights. AHUB specifically requires core-based Windows Server Standard or Datacenter edition licenses.

D. Any Windows Server licence purchased within the last 3 years regardless of Software Assurance: Purchase recency does not grant cloud mobility or hybrid benefits. Without an active Software Assurance contract or a qualifying active subscription at the time of usage in Azure, perpetual Windows Server licenses cannot be applied via Azure Hybrid Benefit.

The correct answer is B. NTFS or ReFS volumes on fast solid-state storage separate from the data disks to minimise write latency.

Storage Replica logs serve a critical role in the replication process, acting as a staging area for write operations before they are replicated to the destination. The performance of the log volume is therefore fundamental to the overall replication performance, as the log serializes and sequentializes all write I/O . Microsoft explicitly recommends placing log volumes on faster storage than the data volumes to reduce write latency . Log volumes should ideally use flash media like solid-state drives (SSDs) and must not be used for other workloads .

incorrect:

A. ReFS-formatted volumes on spinning magnetic drives: Placing logs on slow spinning magnetic drives would introduce high write latency, which is explicitly discouraged. Log volumes should use faster storage than the data volumes , with solid-state drives being the preferred choice .

C. The same volume as the data being replicated: This is an unsupported configuration. Storage Replica requires a separate, dedicated log volume that is not used for any other purpose .

D. Azure Blob Storage for cloud-based log durability: This is not a supported storage type for Storage Replica log volumes. Log volumes must be local, formatted volumes (NTFS or ReFS) on the source and destination servers .

A. Live migration traffic requires a 1 Gbps dedicated link at a minimum

Incorrect.

While bandwidth is important, Microsoft recommends high?bandwidth dedicated adapters (often 10 Gbps or higher) for optimal performance.

The limitation is not strictly “1 Gbps minimum” — the key requirement is isolation from other traffic, not just speed.

B. Live migration traffic should share the VM network to use the same high?bandwidth switch

Incorrect.

Sharing the VM network introduces contention between VM traffic and migration traffic.

This can degrade performance for both workloads.

Certification emphasizes separating live migration traffic from VM production traffic.

C. Live migration traffic should share the management network to simplify network configuration

Incorrect.

Sharing with management traffic can cause bottlenecks and impact administrative operations.

Best practice is to avoid mixing management and migration traffic.

D. Live migration traffic should use a dedicated high?bandwidth network adapter or VLAN separate from management and VM traffic

Correct.

Microsoft best practice is to isolate live migration traffic on its own dedicated adapter or VLAN.

This ensures predictable performance, avoids contention with VM or management traffic, and leverages high?bandwidth links for fast migrations.

Certification highlights this as the recommended configuration for production environments.

Correct answer: A
A. A machine certificate from a trusted CA bound to the file server is correct. SMB over QUIC establishes a TLS 1.3-encrypted tunnel over UDP port 443, and the SMB server certificate authenticates the file server to connecting clients. The certificate must be issued by a trusted certification authority, contain the appropriate server identity—normally the file server’s fully qualified domain name—and be bound to SMB over QUIC.

The certificate allows the client to verify that it is connecting to the intended server during the TLS handshake. SMB authentication and authorization still control access to the shares after the secure tunnel is established.

Why the other options are incorrect
A. Trusted CA-issued machine certificate
Correct. The file server requires a properly configured server certificate issued by a trusted CA. SMB over QUIC uses that certificate for TLS 1.3 server authentication and encrypted communication.

B. Self-signed certificate distributed to all clients
Incorrect as a general requirement. A self-signed certificate is not automatically trusted by clients and creates certificate-management and trust-distribution issues. The supported configuration requires a certificate issued by a trusted CA.

Distributing a self-signed certificate manually does not represent the standard AZ-802 answer because the essential requirement is a trusted certificate chain and correct server identity.

C. Microsoft Entra application registration
Incorrect. SMB over QUIC does not require an Azure or Microsoft Entra application registration to issue access tokens for the QUIC session. QUIC security is provided by TLS 1.3 and the server certificate; SMB authentication remains a separate layer.

D. IPsec policy with mutual authentication
Incorrect. SMB over QUIC is designed to provide secure SMB connectivity across untrusted networks without requiring a VPN or an IPsec tunnel. It uses QUIC over UDP 443 with TLS 1.3 instead.

Correct Answer:
C. Predictive analysis of future disk usage, CPU usage, networking, and memory based on historical trends so administrators can address capacity issues before they occur.

System Insights is a predictive analytics feature integrated locally into Windows Server that uses machine-learning models to analyze system performance metrics:

Predictive Capacity Forecasting: Unlike traditional monitoring tools that react only after a resource threshold (such as 90% disk space or CPU) has been breached, System Insights analyzes past performance usage trends to forecast future resource exhaustion dates.

Built-in Capabilities: Out of the box, System Insights provides default predictive capabilities including Capacity Forecasting for total storage, volume consumption, network bandwidth demand, and CPU usage. This allows system administrators to proactively adjust allocation or upgrade hardware before shortages disrupt services.

System Insights leverages local ML models for predictive capacity forecasting. Source: Microsoft Learn

Incorrect:

A. Historical analysis of the last 30 days of performance data in a consolidated report: Standard logging utilities, Performance Monitor (perfmon), and Event Viewer capture historical data over specified intervals. System Insights goes beyond simply summarizing past logs by applying machine learning algorithms to project future trends.

B. Real-time alerts for CPU spikes above 90% that persist for more than 5 minutes: Static performance thresholds and real-time threshold alerts are standard features of traditional monitoring platforms (such as Performance Monitor counter alerts or System Center Operations Manager). They are reactive rather than predictive.

D. Integration with Azure Cost Management to predict future Azure spend based on workload growth: System Insights is a local Windows Server host feature managed via PowerShell or Windows Admin Center; it does not analyze or project cloud subscription billing and spend within Azure Cost Management.

Option B is CORRECT

Cmdlet: Enable-PSRemoting

Function: The Enable-PSRemoting cmdlet (or its alias Enable-PSSessionConfiguration) performs all the necessary system changes to allow incoming remote PowerShell sessions in a single step. Specifically, it:

Starts the WinRM service and sets its startup type to Automatic.

Creates an HTTP listener on port 5985 (and/or HTTPS on 5986) to accept requests on any IP address.

Enables Windows Firewall exceptions for WS-Management (WinRM) inbound traffic.

Registers default PSSession configurations and enables all PowerShell session endpoints.

Option A is INCORRECT

Actual Deficit: Incomplete Configuration

Explanation: Configuring and starting the WinRM service alone is insufficient. Without Enable-PSRemoting, the system lacks the WinRM listener to receive requests, the Windows Firewall inbound rules remain closed (blocking port 5985/5986), and the PowerShell session configurations are not registered to process remote commands.

Option C is INCORRECT

Actual Component: Built-in PowerShell Capabilities / Cmdlets

Explanation: PowerShell Remoting is not a Role or Feature installed via Server Manager or Install-WindowsFeature. PowerShell and WinRM components are included natively in Windows Server by default; enabling remoting requires execution of configuration commands (Enable-PSRemoting or Group Policy settings), not a feature installation.

Option D is INCORRECT

Actual Component: Remote Desktop Services (RDP) vs. WinRM

Explanation: Remote Desktop Services and PowerShell Remoting operate on entirely separate protocols and ports. RDP provides graphical/interactive user sessions over TCP port 3389, whereas PowerShell Remoting relies on WinRM (WS-Management protocol) over TCP ports 5985/5986. Enabling Remote Desktop does not configure or open WinRM listeners for PowerShell.

The correct answer is D. A placeholder object in the bastion forest that mirrors a privileged group or user in the production forest with a time-to-live property on membership.

A shadow principal is a specific type of object created in a dedicated bastion forest as part of Active Directory’s Privileged Access Management (PAM) feature, introduced in Windows Server 2016 . It acts as a placeholder that mirrors a privileged group (like Domain Admins) or a user from a production forest .

The key technical details are:

Location: They are created in the bastion forest’s configuration naming context, under CN=Shadow Principal Configuration,CN=Services,CN=Configuration .

Function: They allow administrators in the bastion forest to manage resources in the production forest without directly modifying production groups or ACLs .

Time-to-Live (TTL): Membership in a shadow principal group can be granted for a specific duration (TTL), implementing “just-in-time” privileged access . The TTL is enforced by an expiring link value in Active Directory, which is a new capability enabled by the PAM optional feature and requires a Windows Server 2016 forest functional level .

Here is an analysis of why the other options are incorrect:

A. A service account with delegated permissions: This describes a managed service account or a delegated account, which is a different concept for managing permissions and credentials, not the object used for PAM cross-forest group membership.

B. A read-only copy of a privileged group: This is not a correct definition. A shadow principal is a new object in the bastion forest that references the SID of a production object; it is not a read-only replica .

C. A Group Policy object: Shadow principals are Active Directory objects, not Group Policy Objects (GPOs). GPOs are used for policy settings, not for mapping security principals across forests.

A. Get?ADDomainController -Filter {IsGlobalCatalog -eq $true} | Set?ADDomainController -OperationMasterRole PDCEmulator

Incorrect.

Get?ADDomainController retrieves domain controller objects, and Set?ADDomainController can configure properties.

However, this syntax does not perform FSMO role transfer or seizure.

It is not the supported method for FSMO operations.

B. Move?ADDirectoryServerOperationMasterRole -Identity TargetDC -OperationMasterRole PDCEmulator -Force which forces the role move without requiring communication with the current holder

Correct.

The Move?ADDirectoryServerOperationMasterRole cmdlet is used to transfer or seize FSMO roles.

Adding the -Force parameter seizes the role when the current holder is unavailable, bypassing communication attempts.

Certification emphasizes this cmdlet as the supported PowerShell method for FSMO role seizure.

C. Ntdsutil.exe roles seize PDC which is the only supported method for FSMO role seizure in modern Windows

Incorrect.

ntdsutil.exe was historically used for FSMO role seizure, but modern Windows Server and certification objectives highlight PowerShell as the supported method.

It is no longer the “only” supported method.

D. Move?ADDirectoryServerOperationMasterRole -Identity TargetDC -OperationMasterRole PDCEmulator which transfers the role gracefully when the current holder is available

Incorrect.

This cmdlet without -Force performs a graceful transfer, requiring communication with the current role holder.

It does not seize the role if the current holder is permanently unavailable.

Correct Answer
Option B is correct:

The Move?ADDirectoryServerOperationMasterRole cmdlet with the -Force parameter seizes FSMO roles when the current holder is unavailable.

Options A and D are incorrect because they either misuse cmdlets or describe graceful transfer.

Option C is incorrect because ntdsutil.exe is legacy; PowerShell is the modern supported method.

The correct answer is A. Products and classifications settings in WSUS which specify which Microsoft products and update categories such as Security Updates or Drivers are synchronised.

The Products and Classifications settings in the WSUS Administration Console are the primary configuration options for controlling what updates are downloaded from Microsoft Update. By specifically selecting the Microsoft products (e.g., Windows Server, Microsoft SQL Server) and update classifications (e.g., Critical Updates, Security Updates, Drivers) relevant to your organization, you limit synchronization to only those updates. This selective synchronization is a key strategy for managing storage consumption on the WSUS server.

Incorrect:

B. WSUS downstream server settings: This configures the synchronization source for a downstream server (from an upstream WSUS server) but does not determine which products or classifications are downloaded.

C. WSUS synchronisation interval: This controls how often WSUS checks for new updates, not which ones are downloaded or stored.

D. WSUS reporting settings: This manages report generation and compliance data, which is independent of the content download and storage configuration.

Correct answer: D
D. Microsoft Defender for SQL cloud-based threat protection, automated backups, and Microsoft Entra ID authentication is correct. Azure Arc-enabled SQL Server extends Azure management, security, and identity capabilities to SQL Server instances running outside Azure. Available capabilities include Microsoft Defender for Cloud, Microsoft Entra authentication, inventory and usage reporting, and automated backup features, subject to licensing, SQL Server version, connectivity, and configuration requirements.

Microsoft Defender for Cloud can identify database vulnerabilities and detect anomalous activity that may indicate threats. Microsoft Entra authentication provides centralized identity and access management, although it requires SQL Server 2022 or later.

The Azure extension for SQL Server can also perform automated backups. However, the question’s wording should be understood as describing Arc-enabled capabilities that must be enabled and configured; they are not all activated automatically merely by connecting the instance. Automated backups are disabled by default, and current Microsoft documentation distinguishes local or network-share backups from backup-to-URL scenarios.

Incorrect:

A. Automatic migration to Azure SQL Database
Incorrect. Azure Arc connects and manages the existing on-premises SQL Server instance; it does not automatically migrate its databases to Azure SQL Database. Migration is a separate planning and execution activity.

B. Automatic migration to Azure PAYG licensing
Incorrect. Connecting SQL Server to Azure Arc does not automatically convert an existing on-premises license agreement into Azure pay-as-you-go billing. Azure Arc can provide license and usage visibility, and available capabilities vary by licensing model, but billing-model changes require separate configuration and eligibility.

C. Automatic migration of performance data to Azure SQL Analytics
Incorrect. Azure Arc can provide inventory, monitoring, and management integration, but it does not automatically migrate SQL Server performance data to an Azure SQL Analytics service solely because the instance is connected. Monitoring agents and Azure services must be configured separately when required.

D. Defender for SQL, automated backups, and Microsoft Entra authentication
Correct. These are Azure Arc-enabled SQL Server capabilities, subject to supported versions, licensing, permissions, connectivity, and explicit configuration. Microsoft documentation lists Microsoft Entra authentication and Microsoft Defender for Cloud among the available capabilities, and documents automated backup functionality through the Azure SQL Server extension.

The correct answer is D. The total raw capacity divided by the resiliency factor where three-way mirror has a factor of three and two-way mirror has a factor of two.

This is the accurate method for calculating usable capacity in Storage Spaces Direct, as resiliency is the primary factor that determines storage overhead.

Details:

D. Total raw capacity divided by the resiliency factor: Storage Spaces Direct provides fault tolerance by keeping multiple copies of data, a method often called “resiliency”. For example, in a two-way mirror, the system writes two copies of all data, resulting in a storage efficiency of 50%. This means to store 1 TB of data, you need 2 TB of physical capacity (a factor of two). A three-way mirror, which keeps three copies, has a storage efficiency of approximately 33.3% (a factor of three). Therefore, to find the usable capacity, you divide the total raw storage by the number of copies the chosen resiliency type requires.

Incorrect:

A. Total raw capacity minus 10% reserved for metadata: While Storage Spaces Direct does use some capacity for metadata and may require reserved capacity, the primary determinant of usable space is the resiliency factor. The 10% figure is not a standard, single overriding calculation for capacity planning. The “reserve capacity” is better understood as the storage efficiency loss directly tied to making copies for fault tolerance.

B. The sum of all drive capacities divided by the number of server nodes: This formula does not account for data resiliency. Dividing by the number of server nodes would distribute the total capacity across nodes, but it does not factor in the copies required for mirroring. A two-node cluster with two-way mirroring would not result in usable capacity equal to half the total raw storage just because there are two nodes; the usable capacity is determined by the mirroring factor itself.

C. Total raw capacity minus the OS volume reserved on each server: The operating system volume is a separate reservation and is not a factor in calculating the usable capacity of the storage pool after resiliency. The pool’s capacity is intended for data storage, and the OS volume is carved out separately, not deducted from the pool’s raw capacity for this calculation.

Correct :

Option A – Switch Independent mode

Switch Independent mode allows NIC teaming without requiring any configuration on the physical switch.

Each NIC in the team connects independently to the switch, and Windows Server handles load balancing and failover.

This mode works with any switch type, making it the most flexible option for bandwidth aggregation and redundancy.

This is the correct answer because the certification highlights that Switch Independent mode is the only teaming mode that requires no switch-side configuration.

Incorrect :

Option B – Hyper-V port mode

Hyper-V port mode is a load balancing option within NIC teaming, not a switch compatibility mode.

It distributes traffic based on the virtual machine’s MAC address or port, but it still requires teaming configuration.

It does not guarantee compatibility with any switch without configuration.

Option C – Static teaming

Static teaming requires manual configuration of the switch ports to form a static aggregation group.

This means it is not compatible with all switches unless properly configured.

It is more rigid and less flexible compared to Switch Independent mode.

Option D – LACP (802.3ad)

LACP (Link Aggregation Control Protocol) dynamically negotiates link aggregation with the switch.

It requires the switch to support and be configured for LACP.

This option is incorrect because it does not work with “any switch” without configuration.

A. The server must have a discrete TPM 1.2 chip soldered to the motherboard

Incorrect.

Credential Guard requires TPM 2.0 for secure key storage and attestation.

TPM 1.2 is outdated and insufficient for modern VBS features.

B. The server CPU must support Intel SGX for hardware?based memory isolation

Incorrect.

Intel SGX (Software Guard Extensions) is unrelated to Credential Guard.

Credential Guard relies on hardware virtualization extensions (Intel VT?x or AMD?V), not SGX.

C. The server must have at least 64 GB RAM for the VBS environment to initialise successfully

Incorrect.

There is no requirement for 64 GB RAM.

VBS and Credential Guard can run on systems with far less memory; the requirement is virtualization and Secure Boot support, not excessive RAM.

D. The server must support hardware virtualisation (Intel VT?x or AMD?V) and UEFI firmware with Secure Boot enabled

Correct.

Credential Guard uses Virtualisation?Based Security (VBS), which requires:

Hardware virtualization support (Intel VT?x or AMD?V).

UEFI firmware with Secure Boot enabled.

TPM 2.0 for key protection.

Certification highlights these as mandatory hardware requirements for Credential Guard functionality.

Correct Answer:C. Capturing packets from the adapter’s network interface using port mirroring or ETW session tracing.

Microsoft Defender for Identity relies on lightweight sensors installed directly on Domain Controllers (DCs), Active Directory Federation Services (AD FS), and Active Directory Certificate Services (AD CS) servers:

Deep Packet Inspection & Network Parsing: The sensor monitors incoming and outgoing authentication traffic on the host network adapter. It captures and inspects protocol packets—such as Kerberos, NTLM, LDAP, RPC, and DNS queries—using native capture mechanisms like Npcap/driver tracing or Event Tracing for Windows (ETW) sessions.

Standalone Sensor Port Mirroring: In scenarios where a standalone sensor is used instead of a direct on-DC sensor, the standalone sensor captures network traffic via port mirroring from the physical or virtual switch ports connecting the Domain Controller.

Incorrect:

A. Windows event logs from member servers forwarded to the domain controller for central analysis: Defender for Identity collects local Windows Security Events (such as Event ID 4776 for authentication or 4624 for successful logons) directly from the Domain Controller itself. It does not act as a central Windows Event Forwarding (WEF) collector for all generic member servers across the domain.

B. The domain controller’s CPU usage metrics which indicate cryptomining or resource exhaustion attacks: While the sensor monitors system performance to avoid overwhelming the host DC, CPU resource profiling is managed by general endpoint detection solutions (such as Microsoft Defender for Endpoint) rather than Defender for Identity’s threat detection engine.

D. HTTPS traffic from the domain controller to Azure services to detect exfiltration: The sensor inspects inbound and outbound on-premises identity traffic (Kerberos, NTLM, LDAP, DNS) routed to Active Directory services. It does not monitor outbound HTTPS connections from the domain controller to Azure cloud endpoints to detect data exfiltration.

The correct answer is B. Hot standby mode where one server is active and the other is passive, taking over automatically if the active server becomes unreachable.

Windows Server DHCP failover supports two primary modes: load balance mode and hot standby mode . In hot standby mode, one DHCP server is designated as the active server, handling all client lease requests. The partner server is in a standby role, remaining passive and taking over only if the active server becomes unavailable . This mode provides pure redundancy for DHCP services .

Incorrect:

A. Load balance mode: This is the default DHCP failover mode where both servers are active and simultaneously respond to client requests based on a configurable load-balancing ratio, not a primary/passive configuration .

C. Split scope: While this is a legacy method for DHCP redundancy, it divides the IP range between two servers statically and is not a designated failover mode within the Windows Server DHCP failover feature .

D. Fault tolerance mode requiring a shared cluster disk: This describes a traditional failover cluster configuration, not the DHCP failover feature which uses built-in replication of lease information between two independent servers and does not require shared storage .

Correct answer: C
C. The server has not yet completed an initial software update assessment scan, so update compliance status is unknown.

In Azure Update Manager, Assessment Required indicates that the Arc-enabled Windows Server does not yet have current assessment data. The machine must complete an update assessment scan before Azure Update Manager can determine whether updates are missing and assign a compliance status.

The administrator can select the server and choose Check for updates to trigger the assessment. After the scan finishes, the results are stored and the server’s compliance status is updated.

Incorrect:

A. Critical updates are pending
Incorrect. Assessment Required does not indicate that critical updates are known to be pending. The system has not completed an assessment, so Azure Update Manager does not yet know which updates, if any, are missing.

A status showing pending updates can be determined only after the assessment scan has completed.

B. The server is excluded from update management
Incorrect. The status does not mean that the server is excluded. It means that assessment data is unavailable or has not yet been generated. Azure Update Manager supports update assessment and deployment for Azure Arc-enabled servers.

C. Initial assessment scan has not completed
Correct. The server requires an update assessment before its compliance state can be calculated. The administrator can manually trigger the first assessment or configure periodic assessment for Arc-enabled servers.

D. Defender for Cloud Standard plan upgrade is required
Incorrect. Azure Update Manager does not require a Defender for Cloud Standard plan upgrade merely to perform update assessment. Assessment is an Update Manager capability available for Azure and Azure Arc-enabled machines.

A. Snapshot management and disk provisioning permissions on the VMs and datastores being migrated

Correct.

For agentless VMware migration, the Azure Migrate appliance requires snapshot management and disk provisioning permissions.

These permissions allow the appliance to create and manage VM snapshots and access VM disks during replication.

Certification emphasizes this as the minimum required vSphere permission set for agentless migration.

B. vSphere Administrator role which grants all permissions to the appliance account

Incorrect.

While assigning the full Administrator role would technically work, it is not recommended.

Best practice is to grant only the required permissions (snapshot and disk provisioning) to follow the principle of least privilege.

C. Virtual Machine power operations permission to start and stop VMs during migration

Incorrect.

Migration does not require starting or stopping VMs.

The appliance replicates VM disks using snapshots without impacting VM runtime state.

D. Running the Storage Migration Service to transfer shares and permissions for the migrated file server

Incorrect.

The Storage Migration Service is a Windows Server feature for migrating file servers, not VMware VMs.

It is unrelated to Azure Migrate’s agentless VMware migration process.

A. The managed DHCP and DNS servers must be joined to the same Active Directory domain as the IPAM server and have the IPAM management firewall rules applied via Group Policy.

IPAM relies heavily on Active Directory (AD DS) for discovery, authentication, and remote management of DHCP, DNS, and Domain Controllers. To enable remote management, Group Policy Objects (GPOs) are typically provisioned (using the Invoke-IpamGpoProvisioning cmdlet) to automatically configure the necessary firewall ports, RPC rules, and security groups across target domain members.

B. The managed servers must have the IPAM client agent installed from the IPAM management portal. (Incorrect)

IPAM uses an agentless architecture. It does not deploy or require any proprietary agent software on target DHCP or DNS servers. Instead, it utilizes native remote administration protocols like RPC, WMI, and Remote PowerShell.

C. The IPAM server must be installed on the same server as the DHCP and DNS roles it manages. (Incorrect)

IPAM is designed to provide centralized management across multiple distinct remote servers. Co-locating IPAM on the same operating system instance as an Active Directory Domain Controller or target DHCP/DNS server role is not supported by Microsoft best practices and violates structural separation guidelines.

D. The IPAM server must run on Windows Server Core to reduce attack surface during management communications. (Incorrect)

Running IPAM on a Server Core installation is not a requirement for remote management functionality. While Server Core is supported for many roles, IPAM’s ability to communicate with remote DHCP and DNS servers depends on network connectivity, domain membership, and RPC/WMI permissions—not whether the IPAM server itself uses Server Core or Desktop Experience.

The correct answer is C. A workbook parameter linked to a dropdown that populates the available server names from a query, whose value is then referenced in subsequent visualisation queries.

Azure Monitor Workbooks use parameters as a key capability to build interactive reports and experiences. A dropdown parameter allows consumers to select from a set of values. This dropdown can be populated dynamically by a query, for example, to list available server names from a Log Analytics workspace . The value selected by the user is then referenced in other parts of the workbook, such as visualisation queries, to dynamically scope the result set . This allows the visualisation to change based on the user’s selection, creating an interactive report .

Incorrect:

A. Static query with a hardcoded server name: This approach is not dynamic. Hardcoding a server name means the visualisation will not change when a user selects a different server from a dropdown. This defeats the purpose of interactivity that is central to workbooks .

B. A pinned chart from the Metrics view: While a pinned chart can be part of a dashboard, it does not inherently provide interactivity with a dropdown. Pinned charts are typically static and do not support parameters that allow a user to change the target server dynamically within the workbook.

D. An Azure Dashboard widget that embeds a workbook: An Azure Dashboard widget can indeed embed a workbook. However, the server selection is not handled “externally” in a way that makes the workbook itself interactive. The interactivity—such as a dropdown—would need to be defined within the workbook’s own parameters. The dashboard widget simply displays the workbook; it does not provide external selection logic that replaces the workbook’s internal parameters .

D is CORRECT

Concept: Bare-Metal Recovery (BMR) Requirements

Function: Bare-Metal Recovery (BMR) restores the entire system—including the operating system, registry, system state, installed applications, drivers, and user data—to a clean machine or new unformatted disk. For BMR to succeed, you need:

Windows Recovery Environment (WinRE) Bootable Media: To boot the blank/target machine into the recovery interface.

Access to Backup Storage: Access to the local drive, external media, or network share where the BMR backup image is stored.

Sufficient Disk Capacity: Target disks must be equal to or larger than the original source disks containing the volumes included in the backup.

A is INCORRECT

Actual Process: No Pre-Installed OS Required

Explanation: BMR is specifically built to recover systems where the operating system has completely failed or the physical hard drive has been replaced. The recovery process formats and partitions the target drive automatically during restore; having Windows Server pre-installed is completely unnecessary.

B is INCORRECT

Actual Process: Complete System Restoration

Explanation: A Bare-Metal Recovery restores block-level volume images that include all installed applications, system configurations, services, and registry settings present at the time of backup. Reinstalling applications manually is only necessary for standard volume/file backups, not BMR.

C is INCORRECT

Actual Process: Flexible Hardware Support

Explanation: BMR does not require 100% identical hardware or matching peripheral models (such as the exact same NIC). Windows Server uses plug-and-play to adjust to hardware differences upon first boot after restoration, provided critical storage controller drivers are supported by the OS or supplied during the WinRE boot session.

A. iSCSI which presents block storage over TCP/IP networks using the iSCSI initiator

Incorrect.

iSCSI does provide block?level storage, but it uses TCP/IP over Ethernet networks, not Fibre Channel.

While valid for clustering, it is not the Fibre Channel connectivity type asked in the question.

B. Fibre Channel SAN which connects cluster nodes to shared storage LUNs using HBAs and Fibre Channel switches

Correct.

A Fibre Channel SAN presents shared storage LUNs to each cluster node as if they were local disks.

This is achieved using Host Bus Adapters (HBAs) and Fibre Channel switches.

Certification highlights Fibre Channel SANs as a supported and common shared storage solution for Failover Clustering.

C. SMB 3.0 file shares which provide scale?out file server storage accessible by cluster nodes

Incorrect.

SMB 3.0 file shares are supported for Hyper?V and SQL Server workloads, but they present file?based storage, not block?level disks.

The question specifically asks about presenting storage as a local disk, which SMB does not do.

D. NFS which presents file system storage from a NAS appliance over TCP/IP

Incorrect.

NFS provides file?based storage over TCP/IP, typically used in Linux/UNIX environments.

It does not present block?level disks to Windows Failover Cluster nodes.

A. Dynamic Memory which adjusts VM RAM based on workload demand. (Incorrect)

Dynamic Memory is supported on both Generation 1 and Generation 2 virtual machines. It is a Hyper-V management feature that dynamically adjusts the amount of RAM allocated to a VM based on demand and configured minimum/maximum thresholds, independent of the VM’s firmware architecture.

B. Secure Boot which uses UEFI to validate the VM’s bootloader before the OS starts.

Secure Boot relies strictly on UEFI firmware to verify the digital signatures of the bootloader, operating system kernel, and boot drivers prior to execution. Because Generation 1 virtual machines rely on legacy BIOS architecture, Secure Boot cannot be enabled on Gen 1 VMs.

C. Live Migration which moves a running VM between Hyper-V hosts without downtime. (Incorrect)

Live Migration is a host-level hypervisor feature that operates independently of VM generation. You can perform live migrations on both Generation 1 and Generation 2 VMs across cluster nodes or standalone Hyper-V hosts without taking the workloads offline.

D. Synthetic network adapters providing improved throughput over emulated adapters. (Incorrect)

Synthetic network adapters (VMBus-based) are available and standard on both Generation 1 and Generation 2 VMs. While Generation 1 VMs also support legacy (emulated) network adapters for PXE booting without integration services, synthetic adapters are fully functional across both generations.

The correct answer is D. 180 days which is the default for forests created with Windows Server 2003 SP1 domain functional level or later.

This is the accurate, documented default tombstone lifetime value for modern Windows Server Active Directory forests.

Incorrect:

A. 60 days which is the legacy default still used when upgrading older forests: This is incorrect. The 60-day value is a legacy default from older versions (Windows 2000 Server). While a forest’s configured value does not automatically change after an in-place upgrade of its domain controllers, the default for new forests created with Windows Server 2003 SP1 or later is 180 days. The 60-day figure represents a hard-coded fallback value used when the tombstoneLifetime attribute is explicitly set to null, not the standard default for modern forests.

B. 30 days which is the legacy default used in Windows 2000 Server forests: This is incorrect. The Windows 2000 Server default tombstone lifetime is 60 days, not 30 days.

C. 365 days which is the default set by Microsoft to align with annual backup retention policies: This is incorrect. 365 days is not a default or documented standard value for the tombstone lifetime in Windows Server forests. The documented default is 180 days.

A. Smart card authentication which requires PKI infrastructure not available for Protected Users

Incorrect.

Smart card authentication is supported for Protected Users.

In fact, smart cards are considered a secure method and are not blocked by this group.

B. Kerberos authentication which is replaced by NTLM for Protected Users members

Incorrect.

Protected Users still use Kerberos authentication.

What is blocked are weaker forms of Kerberos encryption (DES, RC4), not Kerberos itself.

NTLM is disabled, but Kerberos remains the primary authentication method.

C. Kerberos AES encryption which is replaced by RC4 for members of Protected Users

Incorrect.

Protected Users enforce stronger encryption (AES) for Kerberos.

RC4 and DES are blocked, not AES.

This option reverses the actual behavior.

D. NTLM authentication, DES and RC4 Kerberos encryption, credential caching, and unconstrained delegation which are all blocked for Protected Users members

Correct.

The Protected Users group enforces stricter security by blocking:

NTLM authentication.

DES and RC4 Kerberos encryption.

Credential caching (no cached credentials on the system).

Unconstrained delegation.

Certification highlights this as the key purpose of the Protected Users group: reducing exposure to credential theft and replay attacks.