Select Two (Multi-Select) Questions

The Schema Master role must be held by a domain controller running Windows Server 2022.

Why wrong: While the Schema Master must be reachable to update the forest level, it does not specifically require the latest version of Windows Server 2022. As long as the Schema Master meets the minimum requirement of Windows Server 2016, the forest level can be raised successfully without necessitating an upgrade to the absolute newest OS.

You must disable the Active Directory Recycle Bin before raising the level.

Why wrong: The Active Directory Recycle Bin is a feature that is actually enhanced or maintained by higher functional levels, and there is no requirement to disable it during a level transition. In fact, many organizations raise their functional level specifically to enable the Recycle Bin, which requires at least the Windows Server 2008 R2 level.

The forest must be configured for DFSR replication for the SYSVOL share.

Why wrong: While migrating from FRS to DFSR is highly recommended and eventually required for modern Windows Server versions, it is technically a prerequisite for raising the functional level to Windows Server 2019, not 2016. Therefore, while it is a best practice for health and performance, it is not a hard block for the 2016 level.

Run the New-ADServiceAccount cmdlet with the -DNSHostName parameter.

Why wrong: The `New-ADServiceAccount` cmdlet is the primary tool for creating the gMSA object in Active Directory. Specifying the `-DNSHostName` and `-PrincipalsAllowedToRetrieveManagedPassword` parameters ensures the account is correctly identified and that the designated web servers have the legal authority to request and use the account's password from the domain controllers.

Install the Active Directory Certificate Services role on a domain controller.

Why wrong: While certificates are used for many security tasks, gMSAs do not rely on Active Directory Certificate Services (AD CS) for their functionality. They use the Key Distribution Service and Kerberos for password management and authentication, making the installation of a Certificate Authority unnecessary for the deployment and operation of managed service accounts.

Raise the domain functional level to Windows Server 2022.

Why wrong: gMSAs were introduced with Windows Server 2012, and the minimum functional level required is Windows Server 2012. There is no requirement to raise the level to Windows Server 2022 to use gMSAs, and doing so would be an unnecessary and disruptive change for an organization only seeking to improve service account security.

Enable the legacy Log Analytics agent

Why wrong: The legacy Log Analytics agent is deprecated and not recommended for new hybrid monitoring deployments. Modern monitoring relies on the Azure Monitor Agent (AMA). Using the legacy agent limits functionality and creates technical debt that will eventually require migration to the modern agent, as the legacy version loses support.

Assign the Log Analytics Contributor role to the machine

Why wrong: Assigning roles to the machine itself is not a standard configuration for enabling monitoring. You configure authentication via the system-assigned managed identity of the Arc-enabled server, which is handled automatically by the Azure platform when the extensions are properly deployed and configured.

A functional Certificate Authority (CA) in the forest.

Why wrong: While gMSAs provide enhanced security, they do not rely on a Public Key Infrastructure (PKI) or certificates for their core functionality. They use the Kerberos protocol and the KDS root key to manage passwords, making a Certificate Authority unnecessary for the deployment of gMSAs themselves.

The Windows Server 2016 forest functional level.

Why wrong: Although newer functional levels offer additional security features, the Windows Server 2016 forest level is not a requirement for gMSAs. The feature became available at the 2012 level, and forcing a 2016 level would be an unnecessary restriction for environments still running older, supported domain controllers.

The installation of the Web Server (IIS) role on a DC.

Why wrong: Managed Service Accounts are used by services like IIS, but the IIS role should never be installed on a domain controller for security reasons. The gMSA is created in Active Directory and then assigned to services running on member servers, not on the domain controllers themselves.

Select the 'Critical Replication Only' checkbox during promotion.

Why wrong: This option allows the promotion to complete after replicating only the essential data needed for the DC to function. The remaining non-critical data, such as application partitions or the Global Catalog, can then replicate in the background, allowing the DC to become operational more quickly under bandwidth constraints.

Set the replication schedule of the site link to 'Never'.

Why wrong: Setting a site link schedule to 'Never' would completely prevent the domain controller from ever synchronizing its database with the rest of the forest. This would leave the new DC in an unusable and inconsistent state, failing to provide any authentication services to the remote office.

Manually copy the C:\Windows\NTDS folder from an existing DC.

Why wrong: Manually copying the NTDS folder is not a supported method for deploying a domain controller and will likely lead to database corruption or a failure to boot. The database must be prepared using the ntdsutil tool to ensure it is in a consistent state for the IFM process.

Enable Azure Disk Encryption on the OS drive.

Why wrong: While Azure Disk Encryption provides security, it is not a specific requirement for the stability or supportability of an Active Directory Domain Controller on an Azure VM. Standard security practices apply, but this action does not address the core requirements for AD DS database integrity or network configuration.

Configure the OS drive to use Read/Write host caching.

Why wrong: Host caching can cause data corruption for Active Directory because the AD database relies on unbuffered writes and forced unit access to ensure integrity. Enabling host caching on a drive containing AD components can lead to inconsistencies if the VM or host experiences an unexpected power loss or failure.

Active Directory Sites and Services

Why wrong: Active Directory Sites and Services is used to manage the physical topology of the network, including sites, subnets, and replication schedules. It does not provide the functionality to mount or view historical snapshots of the Active Directory database or to connect to alternative LDAP ports for database inspection purposes.

wbadmin

Why wrong: The wbadmin command-line tool is used to create and manage system state and volume backups. While it is used to recover the files from the backup media to a disk location, it does not have the capability to mount those files as a searchable directory service or to browse the objects contained within the database.

repadmin

Why wrong: The repadmin tool is primarily used for monitoring and troubleshooting Active Directory replication between domain controllers. It provides detailed information about replication partners and metadata but cannot mount historical database snapshots or provide a mechanism for viewing the contents of an offline Active Directory database file from a backup.

Provides an alternative to the Azure Connected Machine agent

Why wrong: The resource bridge does not replace the Connected Machine agent. The agent is still required for OS-level management, policy enforcement, and monitoring. The bridge is focused on managing the virtualization layer, while the agent focuses on the operating system level, making both necessary for full management.

Eliminates the need for local virtualization software

Why wrong: The resource bridge does not remove the need for virtualization software like VMware or System Center Virtual Machine Manager. It simply acts as a management connector between the existing virtualization environment and Azure, allowing you to interface with your current setup using Azure tools and APIs.

Azure Key Vault

Why wrong: While Azure Key Vault provides similar key management services in the cloud, Shielded VMs on-premises rely on the Host Guardian Service for attestation and key release. Azure Key Vault is not used directly for the health validation or key management of traditional on-premises Hyper-V Shielded VM deployments.

Windows Server Update Services (WSUS)

Why wrong: WSUS is used for managing the distribution of updates and patches within a network. Although keeping hosts updated is a security best practice, WSUS is not a functional requirement for the specific architecture of Shielded VMs or the attestation process performed by the Host Guardian Service.

Network Controller

Why wrong: The Network Controller is a component of Software Defined Networking (SDN) used to manage network infrastructure centrally. While it can be part of a larger Windows Server Software Defined Datacenter deployment, it does not play a role in the attestation or encryption mechanisms required for Shielded VMs.

Configure the firewall to drop all outbound traffic by default.

Why wrong: Blocking all outbound traffic by default is an extreme measure that can break critical server functions like Windows Update, DNS resolution, and NTP time synchronization. Unless the server is in an air-gapped environment, this strategy is generally impractical and detrimental to the standard operation of the Windows operating system.

Enable IPsec encryption for the specific application rule.

Why wrong: While IPsec provides encryption, it is not required to simply allow or block traffic for a specific application. Enabling IPsec adds unnecessary overhead and complexity to the firewall configuration unless the business requirement specifically dictates that the traffic must be encrypted for security or compliance reasons within the network.

Disable the Windows Firewall and use a third-party appliance.

Why wrong: Disabling the Windows Firewall removes a critical layer of defense-in-depth on the host itself. Relying solely on a perimeter appliance leaves the server vulnerable to lateral movement if an attacker gains access to the local network segment. Host-based firewalls are a mandatory component of a secure infrastructure.

Active-Passive Cluster

Why wrong: Active-Passive clustering is a general high-availability concept used in Failover Clustering but is not a specific named mode within the DHCP Failover feature itself. DHCP Failover was specifically designed to provide redundancy without the complexity and shared storage requirements typically associated with traditional Windows Server Failover Clustering.

Split-Scope

Why wrong: Split-Scope is a legacy method of providing DHCP redundancy by manually dividing an IP range between two independent servers. While still functional, it is not a selection within the modern DHCP Failover wizard and lacks the synchronization capabilities that allow servers to share lease information in real-time.

Distributed Relay

Why wrong: Distributed Relay refers to the placement of DHCP relay agents across multiple routers or switches to forward discovery packets to a central server. This is a network routing configuration rather than a high-availability mode for the DHCP service itself, and it does not provide database synchronization between server nodes.

iSCSI Initiator Name Service (iSNS)

Why wrong: iSNS is an optional service used for automated discovery and management of iSCSI devices on a large network. While helpful in complex environments with many targets and initiators, it is not a requirement for basic connectivity. Most small to medium deployments use manual IP discovery or DNS to locate the iSCSI Target Server.

Multipath I/O (MPIO)

Why wrong: Multipath I/O is a framework that allows a server to use multiple physical paths to a storage device for redundancy and load balancing. While highly recommended for production environments to prevent single points of failure in the fabric, it is a client-side configuration and not a required component for the initial target setup.

Fibre Channel Zoning

Why wrong: Fibre Channel Zoning is a security mechanism used in Fibre Channel Storage Area Networks (SANs) to restrict communication between ports. iSCSI uses standard Ethernet networking and TCP/IP protocols, making Fibre Channel concepts irrelevant to its configuration. These are two distinct storage technologies that operate on different physical and logical layers.

The record must be a static record with a zero timestamp.

Why wrong: Static records with a timestamp of zero are actually protected from scavenging. Scavenging only applies to dynamic records that have a non-zero timestamp, which indicates when the record was last refreshed. This prevents critical manually-created infrastructure records from being deleted by the automated cleanup process.

The DNS server must be a member of the Schema Admins group.

Why wrong: DNS scavenging is a local service operation and does not require high-level Active Directory permissions like Schema Admins. The DNS service runs under the computer account or a service account which already has the necessary permissions to manage records within the Active Directory-integrated DNS zones it hosts.

Live Microsoft SQL Server databases

Why wrong: SQL Server databases are constantly changing and perform many small write operations. Data Deduplication is not supported for active SQL database files because the overhead of managing chunks and the potential for file locking conflicts can lead to severe performance degradation and database corruption. Databases require specialized storage optimization techniques rather than block-level deduplication.

Active Exchange Server databases

Why wrong: Exchange Server uses an Extensible Storage Engine (ESE) that performs frequent, random I/O. Similar to SQL Server, active Exchange databases are not supported for Data Deduplication due to the high rate of change and the sensitivity of the transaction logs. Enabling deduplication on these files would likely result in mounting errors and significant latency.

Encrypted volumes using BitLocker

Why wrong: While Data Deduplication can run on a volume encrypted by BitLocker, the deduplication engine itself cannot process files that are encrypted at the file level (such as EFS). Furthermore, if the data is encrypted before it reaches the deduplication engine, the data will appear unique, resulting in zero savings. This makes it an inefficient choice.

Azure Relay

Why wrong: Azure Relay is a service used for hybrid connectivity but is not a required component of the core Storage Migration Service architecture. While migrations can occur to Azure VMs, the service itself operates using standard network protocols between the orchestrator, source, and destination without needing a relay.

iSCSI Target Server

Why wrong: An iSCSI Target Server provides block-level storage over the network, but it is not a requirement for the Storage Migration Service. The service operates at the file and share level, using SMB to move data between systems regardless of the underlying physical or network storage technology.

Network Address Translation (NAT)

Why wrong: NAT is used to map private IP addresses to public ones or to provide internet access to internal resources. It has no role in the east-west storage traffic of an Azure Stack HCI cluster. In fact, introducing NAT into the storage network would add unnecessary latency and complexity, potentially breaking the communication required for the storage pool.

Border Gateway Protocol (BGP)

Why wrong: BGP is a routing protocol used to exchange routing information between autonomous systems on the internet or within large software-defined networks. While used in Azure Stack HCI for SDN (Software Defined Networking) to route tenant traffic, it is not used for the underlying S2D storage traffic, which typically operates on a flat, non-routed Layer 2 network.

802.11ax (Wi-Fi 6)

Why wrong: Wi-Fi 6 is a wireless networking standard. Storage Spaces Direct and Azure Stack HCI require high-speed, wired Ethernet connections (typically 10Gbps, 25Gbps, or higher) to ensure the reliability and low latency necessary for block-level storage replication. Wireless technology is never used for the back-end storage fabric of a hyperconverged cluster due to instability and insufficient throughput.

Storage endpoint

Why wrong: While 'Storage Account' is a related term, 'Storage endpoint' is not a valid technical term for an object within an Azure File Sync Group. The specific object that links the Sync Group to the storage resource in the cloud is always referred to as the cloud endpoint.

Network endpoint

Why wrong: Network endpoints usually refer to Service Endpoints or Private Endpoints used for securing network traffic in Azure. While these might be used to secure the connection to the Storage Account, they are not configuration objects that are added to an Azure File Sync Group topology.

Management endpoint

Why wrong: Management endpoints typically refer to the URLs used to interact with the Azure Resource Manager API. They are not part of the data synchronization logic or the Sync Group configuration, which relies strictly on cloud and server endpoints to define the path of data movement.

All target Windows Servers must have the Remote Desktop Gateway role installed.

Why wrong: One of the primary benefits of Azure Bastion is that it eliminates the need for a Remote Desktop Gateway role or any other public-facing agent on your virtual machines. The Bastion service itself handles the gateway functionality, allowing you to keep your VMs isolated from the internet while still maintaining administrative access.

A Site-to-Site VPN must be established between Azure and on-premises.

Why wrong: Azure Bastion is a standalone service that provides access through the Azure portal via a web browser. It does not require a Site-to-Site VPN or ExpressRoute to function. While those technologies are useful for general hybrid connectivity, Bastion specifically focuses on providing secure, clientless RDP/SSH access without needing a VPN.

Azure Key Vault for storing the WAC login credentials.

Why wrong: While Azure Key Vault is excellent for managing secrets, Windows Admin Center primarily uses the user's own credentials (via Kerberos or CredSSP) or stored credentials within its own local configuration. It does not use Azure Key Vault as a primary mechanism for controlling user-level access permissions to the management console itself.

NTFS permissions on the Windows Admin Center installation folder.

Why wrong: NTFS permissions on the application folders control who can modify the WAC software files on the disk, but they do not control the logical access of users connecting to the web interface. WAC security is handled at the application level through its configuration settings and the underlying Windows authentication mechanisms.

DHCP Reservations for the WAC gateway IP address.

Why wrong: DHCP reservations ensure that the WAC server always receives the same IP address from the network. While this is helpful for ensuring the management console remains reachable at a consistent URL, it provides no security or access control benefits regarding which administrators are authorized to use the tool to manage servers.

Configure a Group Policy Object to enable NTLMv2 only.

Why wrong: Group Policy settings for NTLM authentication restrict the authentication protocol used by the domain but have no impact on JEA configurations. JEA is a PowerShell-specific security feature focused on limiting command execution; it does not control authentication protocols used for network-level access to the server or domain resources.

Modify the local SAM database to include JEA roles.

Why wrong: The SAM database stores local user and group information but is not used for defining PowerShell JEA roles. JEA roles are defined through configuration files in the file system and registered via PowerShell. Modifying the SAM database does not provide the functionality required to implement restricted PowerShell administrative access.

Enable the Credential Guard feature.

Why wrong: Credential Guard is a security feature that uses VBS to protect credentials from memory attacks. While it is an excellent security measure for any Windows Server, it is not a step in the process of implementing JEA. JEA and Credential Guard serve different purposes in the overall server hardening strategy.