Hard Difficulty Questions

DC01.fabrikam.com

Why wrong: According to the exhibit, DC01 holds the Domain Naming Master role, which is responsible for managing the addition and removal of domains in the forest. While it is a critical forest-wide role, it has no authority over schema modifications, and any attempt to extend the schema while targeting this DC will fail.

Any domain controller in the forest root domain.

Why wrong: Schema modifications are not a general capability of all domain controllers. While every DC holds a read-only copy of the schema, only the specific DC designated as the Schema Master can perform write operations. Targeting an arbitrary DC in the root domain will not satisfy the architectural requirement for schema write access.

The Infrastructure Master for the forest root domain.

Why wrong: The Infrastructure Master is responsible for updating cross-domain object references and does not play a role in schema management. Using this DC for a schema extension is incorrect, as its specialized function is unrelated to the underlying directory definitions that the schema extension utility needs to modify and replicate forest-wide.

Run the New-ADServiceAccount cmdlet with the -DNSHostName parameter.

Why wrong: The `New-ADServiceAccount` cmdlet is the primary tool for creating the gMSA object in Active Directory. Specifying the `-DNSHostName` and `-PrincipalsAllowedToRetrieveManagedPassword` parameters ensures the account is correctly identified and that the designated web servers have the legal authority to request and use the account's password from the domain controllers.

Install the Active Directory Certificate Services role on a domain controller.

Why wrong: While certificates are used for many security tasks, gMSAs do not rely on Active Directory Certificate Services (AD CS) for their functionality. They use the Key Distribution Service and Kerberos for password management and authentication, making the installation of a Certificate Authority unnecessary for the deployment and operation of managed service accounts.

Raise the domain functional level to Windows Server 2022.

Why wrong: gMSAs were introduced with Windows Server 2012, and the minimum functional level required is Windows Server 2012. There is no requirement to raise the level to Windows Server 2022 to use gMSAs, and doing so would be an unnecessary and disruptive change for an organization only seeking to improve service account security.

The Default Domain Policy.

Why wrong: The Default Domain Policy is only applied to users if no Fine-Grained Password Policy is directly assigned to the user or to any groups the user belongs to. Since the user is a member of groups that have specific PSOs assigned, those PSOs will take priority over the global domain-wide password settings.

The PSO assigned to the Sales-Group.

Why wrong: The Sales-Group has a higher precedence value of 50. In the logic used by Active Directory for Password Settings Objects, higher numbers represent lower priority. Consequently, the settings from this PSO will be ignored in favor of the PSO with the lower numeric value assigned to the user's other group membership.

Both policies will be merged, and the most restrictive settings will apply.

Why wrong: Active Directory does not merge Fine-Grained Password Policies or resolve conflicts by choosing the most restrictive individual setting. Instead, it selects a single Password Settings Object based on the lowest precedence value or direct assignment. Only one PSO can be effective for a specific user object at any given time.

Enable the legacy Log Analytics agent

Why wrong: The legacy Log Analytics agent is deprecated and not recommended for new hybrid monitoring deployments. Modern monitoring relies on the Azure Monitor Agent (AMA). Using the legacy agent limits functionality and creates technical debt that will eventually require migration to the modern agent, as the legacy version loses support.

Assign the Log Analytics Contributor role to the machine

Why wrong: Assigning roles to the machine itself is not a standard configuration for enabling monitoring. You configure authentication via the system-assigned managed identity of the Arc-enabled server, which is handled automatically by the Azure platform when the extensions are properly deployed and configured.

A functional Certificate Authority (CA) in the forest.

Why wrong: While gMSAs provide enhanced security, they do not rely on a Public Key Infrastructure (PKI) or certificates for their core functionality. They use the Kerberos protocol and the KDS root key to manage passwords, making a Certificate Authority unnecessary for the deployment of gMSAs themselves.

The Windows Server 2016 forest functional level.

Why wrong: Although newer functional levels offer additional security features, the Windows Server 2016 forest level is not a requirement for gMSAs. The feature became available at the 2012 level, and forcing a 2016 level would be an unnecessary restriction for environments still running older, supported domain controllers.

The installation of the Web Server (IIS) role on a DC.

Why wrong: Managed Service Accounts are used by services like IIS, but the IIS role should never be installed on a domain controller for security reasons. The gMSA is created in Active Directory and then assigned to services running on member servers, not on the domain controllers themselves.

Configure the branch office domain controller as a Global Catalog server.

Why wrong: While making the server a Global Catalog would solve the logon issue, it would also significantly increase WAN traffic. A Global Catalog must replicate a partial attribute set for every object in the entire forest. In a large forest with a slow WAN link, this extra replication traffic could saturate the available bandwidth.

Convert all Universal Groups to Global Groups.

Why wrong: Converting groups is often not feasible due to the different scopes and nesting rules. Global groups can only contain members from the same domain, whereas Universal groups are used to grant permissions across the forest. Changing the group type would break the existing administrative model and potentially disrupt access to resources across the forest.

Increase the replication frequency of the Site Link to 15 minutes.

Why wrong: Increasing replication frequency does not solve the problem of a completely disconnected WAN link. If the link is down, no replication can occur regardless of the configured interval. Furthermore, more frequent replication would actually increase the total bandwidth consumption on the already slow link, worsening the performance for other branch office traffic.

A two-way forest trust with forest-wide authentication.

Why wrong: A two-way trust would allow users from both forests to potentially access each other's resources, which exceeds the requirement. Furthermore, forest-wide authentication automatically adds trusted users to the 'Authenticated Users' group, granting them broad access that the scenario specifically aims to restrict for security reasons.

An external trust with SID filtering disabled.

Why wrong: External trusts are intended for specific domains rather than entire forests and are less efficient for forest-wide resource sharing. Disabling SID filtering is a significant security risk that could allow for privilege escalation attacks, which is contrary to the requirement of maintaining a highly secure environment.

A realm trust with a non-Windows Kerberos environment.

Why wrong: Realm trusts are specifically used to establish a relationship between an Active Directory domain and a non-Windows Kerberos v5 realm, such as Linux. Since both organizations in this scenario are using Active Directory forests, a standard forest trust is the appropriate and required solution.

The KCC has not yet generated a replication topology for the site.

Why wrong: If the Knowledge Consistency Checker (KCC) had not generated a topology, there would be no inbound neighbor listed in the repadmin output. The fact that DC-01 is listed as a neighbor indicates that the topology exists, but the actual attempt to synchronize data over that connection is failing due to communication errors.

There is a mismatch in the Site Link costs between the two sites.

Why wrong: Site Link costs determine the preferred path for replication but do not cause RPC server unavailable errors. A cost mismatch might lead to replication taking an inefficient route, but it would not prevent the RPC service from being reached if a valid network path and proper firewall rules were in place.

The destination domain controller lacks the Global Catalog role.

Why wrong: The exhibit explicitly shows 'DSA Options: IS_GC' for DC-02, confirming it is a Global Catalog. Even if it were not a GC, the absence of the role would not cause an RPC error during standard domain partition replication. RPC errors are strictly related to the underlying communication layer between the two servers.

It blocks the onboarding of new Arc-enabled servers

Why wrong: The 'audit' effect is non-blocking. To block actions, you would need to use the 'deny' effect. Auditing is specifically designed for monitoring compliance without interrupting existing workflows or preventing new resources from being registered, allowing administrators to gather data before deciding whether to enforce stricter compliance measures.

It automatically remediates non-compliant machines

Why wrong: The 'audit' effect does not perform remediation. To perform remediation, the policy must use the 'deployIfNotExists' or 'modify' effect, which executes an ARM template or update to bring the resource into compliance. Auditing is passive and does not alter the state of the target resource.

It triggers an email notification to the Global Administrator

Why wrong: Azure Policy effects do not natively trigger email notifications to administrators. Alerting would require integrating the policy with Azure Monitor or Azure Event Grid to send notifications via Action Groups. Simply defining the policy effect as 'audit' only records the result in the activity logs and portal.

The Azure Connected Machine agent is corrupted

Why wrong: Corruption would typically result in service crashes or communication errors, not an explicit 403 Forbidden error. A 403 error is an authorized response from the service, confirming that the client reached the service but was refused access due to insufficient privileges on the target resource.

The network firewall is blocking the connection

Why wrong: Firewall blocks generally manifest as connectivity timeouts or 'connection reset' errors. Because the service successfully returned a '403 Forbidden' response, we know the request traveled across the network and reached the Azure service endpoint. Therefore, the network connectivity is functional, and the issue is strictly authorization-related.

The subscription has reached its resource limit

Why wrong: Exceeding subscription limits would typically result in a 429 Too Many Requests or 403 error specifically related to capacity quotas, not access. Authorization issues regarding specific Key Vault contents are distinct from general resource limits and should be investigated via identity and access controls (IAM).

Hyper-V Replica Broker

Why wrong: The Hyper-V Replica Broker is used specifically for managing replication in a clustered environment, but it is not a requirement for the basic failover functionality of the cluster itself. It provides a unified contact point for replication traffic rather than the underlying mechanism that handles host failure and VM restart.

NIC Teaming on the VM

Why wrong: NIC Teaming within the guest virtual machine provides network redundancy for the guest but is not a component of the host-level high-availability cluster. While it improves the resilience of the VM's network connection, it does not facilitate the failover of the entire VM from one physical host to another.

Active Directory Certificate Services

Why wrong: Active Directory Certificate Services provides PKI infrastructure but does not offer the specialized attestation or key release mechanisms required for Shielded VMs. While it can issue certificates used within the environment, it lacks the specific logic to verify host health against a known baseline before allowing a protected VM to boot.

Network Controller

Why wrong: Network Controller is a component of Software Defined Networking used to manage virtual and physical network infrastructure centrally. It does not play a role in the security attestation or encryption key management required to shield virtual machines from unauthorized access by host administrators or malicious software on the virtualization host.

Windows Defender Application Control

Why wrong: Windows Defender Application Control is used to restrict which applications and scripts are allowed to run on a host system. While it enhances host security, it is not the primary service responsible for the attestation of host health or the management of encryption keys for Shielded Virtual Machine environments.

To enable Discrete Device Assignment (DDA) for a GPU.

Why wrong: Discrete Device Assignment (DDA) is used to pass through a physical PCIe device directly to a virtual machine. This requires different PowerShell commands, such as Add-VMPassignDevice, and is unrelated to the virtualization extensions of the processor, which focus on enabling the hypervisor role within the guest OS.

To allow the VM to use Dynamic Memory across multiple NUMA nodes.

Why wrong: Dynamic Memory and NUMA spanning are managed through memory-specific settings in the VM configuration. The ExposeVirtualizationExtensions parameter specifically handles hardware-assisted virtualization features of the CPU, not the memory management or the spanning of resources across physical processor sockets or memory banks.

To activate the Shielded VM protection for a Linux-based guest.

Why wrong: Shielded VM protection is enabled using the Set-VMSecurity cmdlet and requires a Guardian and a shielding data file. It is a security feature involving encryption and attestation, whereas exposing virtualization extensions is a hardware feature pass-through designed to support secondary hypervisors inside the virtual machine.

It automatically upgrades any VM to the D4s_v3 size.

Why wrong: The policy uses a 'deny' effect, which prevents the creation of non-compliant resources rather than modifying them. Azure Policy does not have an 'upgrade' mechanism in this context; it simply evaluates the request against the rules and rejects it if the specified SKU name is not in the allowed list.

It allows the creation of any VM size except the two listed.

Why wrong: The logic 'notIn' combined with 'deny' means that if the VM size is NOT one of the two listed, the request is denied. Therefore, it effectively restricts the administrator to using ONLY the Standard_D2s_v3 and Standard_D4s_v3 sizes, rejecting all other possible virtual machine SKUs in the Azure catalog.

It audits VMs that are not using the D2s or D4s sizes.

Why wrong: The 'effect' field is explicitly set to 'deny', which means the operation will be blocked immediately upon attempted creation. An 'audit' effect would allow the creation of the virtual machine but would flag the resource as non-compliant in the Azure Policy compliance dashboard for later review by administrators.

Create a Virtual Fibre Channel SAN

Why wrong: Virtual Fibre Channel is used to provide a virtual machine with direct access to a Fibre Channel storage array. It has no relation to Hyper-V Replica, which is a software-based replication mechanism that operates at the host level to copy virtual hard disk changes over standard IP-based networks.

Install the Windows Server Backup feature

Why wrong: While Windows Server Backup is used for creating point-in-time backups of servers, it is not a prerequisite for Hyper-V Replica. Replica is a separate, continuous data protection feature that uses its own engine to track and transmit changes to virtual hard disks, independent of the standard backup infrastructure.

Azure Key Vault

Why wrong: While Azure Key Vault provides similar key management services in the cloud, Shielded VMs on-premises rely on the Host Guardian Service for attestation and key release. Azure Key Vault is not used directly for the health validation or key management of traditional on-premises Hyper-V Shielded VM deployments.

Windows Server Update Services (WSUS)

Why wrong: WSUS is used for managing the distribution of updates and patches within a network. Although keeping hosts updated is a security best practice, WSUS is not a functional requirement for the specific architecture of Shielded VMs or the attestation process performed by the Host Guardian Service.

Network Controller

Why wrong: The Network Controller is a component of Software Defined Networking (SDN) used to manage network infrastructure centrally. While it can be part of a larger Windows Server Software Defined Datacenter deployment, it does not play a role in the attestation or encryption mechanisms required for Shielded VMs.

Configure the firewall to drop all outbound traffic by default.

Why wrong: Blocking all outbound traffic by default is an extreme measure that can break critical server functions like Windows Update, DNS resolution, and NTP time synchronization. Unless the server is in an air-gapped environment, this strategy is generally impractical and detrimental to the standard operation of the Windows operating system.

Enable IPsec encryption for the specific application rule.

Why wrong: While IPsec provides encryption, it is not required to simply allow or block traffic for a specific application. Enabling IPsec adds unnecessary overhead and complexity to the firewall configuration unless the business requirement specifically dictates that the traffic must be encrypted for security or compliance reasons within the network.

Disable the Windows Firewall and use a third-party appliance.

Why wrong: Disabling the Windows Firewall removes a critical layer of defense-in-depth on the host itself. Relying solely on a perimeter appliance leaves the server vulnerable to lateral movement if an attacker gains access to the local network segment. Host-based firewalls are a mandatory component of a secure infrastructure.

Capacity Only

Why wrong: The 'Capacity Only' eviction policy means the VM will only be evicted if Azure needs the hardware capacity back for pay-as-you-go customers. This does not take the price into account, so the VM will continue running regardless of price fluctuations as long as the hardware cluster has available space.

Stop-Deallocate

Why wrong: Stop-Deallocate is an eviction 'type' rather than a 'policy.' It determines what happens to the VM when an eviction is triggered by the policy. Choosing this type ensures that the VM's state is preserved on disk, but it does not control the logic of why the eviction occurred.

Delete

Why wrong: Like Stop-Deallocate, 'Delete' is an eviction 'type' that defines the fate of the VM and its associated disks once the eviction policy is met. It is used for completely transient workloads where data does not need to be persisted, but it is not the policy that evaluates eviction criteria.

Enable the iSCSI target role on the server.

Why wrong: Enabling the iSCSI target role allows the server to act as a storage provider, but it does not automatically configure or leverage RDMA for network acceleration. RDMA is a transport optimization, whereas iSCSI is a storage protocol; they are distinct technologies that require separate configuration to work together effectively.

Configure the network adapter to use the RoCEv2 protocol.

Why wrong: Since the adapter displays RoCEv2 as a capability, you should enable and configure this protocol to enable low-latency, high-throughput network transfers. RoCEv2 is highly efficient for data center networking and is the preferred RDMA protocol for modern Windows Server environments to maximize IOPS and minimize processing latency.

Update the network adapter firmware to the latest version.

Why wrong: Updating firmware is a good practice for stability, but it is not the configuration step required to actually enable the RDMA feature on the OS level. The system already reports the capability is present, so the task at hand is administrative activation, not a hardware-level update or patching.

One drive failure

Why wrong: A single drive failure is typical for two-way mirroring or parity configurations. Since this pool is configured with three data copies and a physical disk redundancy of two, it is designed to survive more than just one failure without losing data or impacting volume availability for users.

Three drive failures

Why wrong: While there are three copies of the data, losing three drives simultaneously would mean all copies of certain data blocks are lost, resulting in volume failure. The system redundancy level is explicitly set to two, meaning it cannot survive a third concurrent failure without data loss occurring.

Zero drive failures

Why wrong: A value of zero would imply no redundancy, such as a simple stripe set where any single failure causes total data loss. The exhibit clearly indicates that the pool has been configured with resiliency settings that allow for multiple failures while maintaining operational status and data integrity.