Refer to the Exhibit Practice Questions

DC2

Why wrong: DC2 holds the Infrastructure Master role, which manages cross-domain object references. While important for multi-domain environments, it plays no direct role in the password change process or the immediate processing of account lockouts, which are tasks specifically assigned to the PDC Emulator role holder.

The Schema Master

Why wrong: The Schema Master is a forest-wide role not listed in the domain-level exhibit output provided. It is responsible for structural changes to the Active Directory database and has no involvement in daily user account operations like password resets or the enforcement of account lockout policies.

The Domain Naming Master

Why wrong: The Domain Naming Master manages the addition and removal of domains within the forest. It is not involved in user-level authentication or password management. Issues with this role would prevent architectural changes to the forest but would not cause the password reset symptoms described in the scenario.

The KCC has not yet generated a replication topology for the site.

Why wrong: If the Knowledge Consistency Checker (KCC) had not generated a topology, there would be no inbound neighbor listed in the repadmin output. The fact that DC-01 is listed as a neighbor indicates that the topology exists, but the actual attempt to synchronize data over that connection is failing due to communication errors.

There is a mismatch in the Site Link costs between the two sites.

Why wrong: Site Link costs determine the preferred path for replication but do not cause RPC server unavailable errors. A cost mismatch might lead to replication taking an inefficient route, but it would not prevent the RPC service from being reached if a valid network path and proper firewall rules were in place.

The destination domain controller lacks the Global Catalog role.

Why wrong: The exhibit explicitly shows 'DSA Options: IS_GC' for DC-02, confirming it is a Global Catalog. Even if it were not a GC, the absence of the role would not cause an RPC error during standard domain partition replication. RPC errors are strictly related to the underlying communication layer between the two servers.

It blocks the onboarding of new Arc-enabled servers

Why wrong: The 'audit' effect is non-blocking. To block actions, you would need to use the 'deny' effect. Auditing is specifically designed for monitoring compliance without interrupting existing workflows or preventing new resources from being registered, allowing administrators to gather data before deciding whether to enforce stricter compliance measures.

It automatically remediates non-compliant machines

Why wrong: The 'audit' effect does not perform remediation. To perform remediation, the policy must use the 'deployIfNotExists' or 'modify' effect, which executes an ARM template or update to bring the resource into compliance. Auditing is passive and does not alter the state of the target resource.

It triggers an email notification to the Global Administrator

Why wrong: Azure Policy effects do not natively trigger email notifications to administrators. Alerting would require integrating the policy with Azure Monitor or Azure Event Grid to send notifications via Action Groups. Simply defining the policy effect as 'audit' only records the result in the activity logs and portal.

The Azure Connected Machine agent is corrupted

Why wrong: Corruption would typically result in service crashes or communication errors, not an explicit 403 Forbidden error. A 403 error is an authorized response from the service, confirming that the client reached the service but was refused access due to insufficient privileges on the target resource.

The network firewall is blocking the connection

Why wrong: Firewall blocks generally manifest as connectivity timeouts or 'connection reset' errors. Because the service successfully returned a '403 Forbidden' response, we know the request traveled across the network and reached the Azure service endpoint. Therefore, the network connectivity is functional, and the issue is strictly authorization-related.

The subscription has reached its resource limit

Why wrong: Exceeding subscription limits would typically result in a 429 Too Many Requests or 403 error specifically related to capacity quotas, not access. Authorization issues regarding specific Key Vault contents are distinct from general resource limits and should be investigated via identity and access controls (IAM).

One drive failure

Why wrong: A single drive failure is typical for two-way mirroring or parity configurations. Since this pool is configured with three data copies and a physical disk redundancy of two, it is designed to survive more than just one failure without losing data or impacting volume availability for users.

Three drive failures

Why wrong: While there are three copies of the data, losing three drives simultaneously would mean all copies of certain data blocks are lost, resulting in volume failure. The system redundancy level is explicitly set to two, meaning it cannot survive a third concurrent failure without data loss occurring.

Zero drive failures

Why wrong: A value of zero would imply no redundancy, such as a simple stripe set where any single failure causes total data loss. The exhibit clearly indicates that the pool has been configured with resiliency settings that allow for multiple failures while maintaining operational status and data integrity.

It sets the IQN of the local server.

Why wrong: The local server's IQN is automatically generated or configured at the system level and is not set using the New-IscsiServerTarget command. This command is specifically used to create a target object and define the external clients that are permitted to access the logical units it hosts.

It specifies the IP address of the target portal.

Why wrong: Target portals are the network interfaces on the server that listen for iSCSI traffic. They are managed using different cmdlets or parameters. The InitiatorId specifically uses an IQN or DNS name to identify a client machine, not a network endpoint or local listener address.

It creates a new virtual hard disk.

Why wrong: This command creates the iSCSI target logical object but does not create the underlying storage. A separate command, such as New-IscsiVirtualDisk, must be used to create the VHDX file, which is then associated with the target created in the exhibit using the Add-IscsiVirtualDiskTargetMapping cmdlet.

The user sees the folder but receives 'Access Denied' when opening it.

Why wrong: This behavior occurs when access-based enumeration is disabled. Without ABE, Windows displays all folders within a share to any user who can browse the share level, regardless of whether they have the necessary NTFS permissions to actually open or view the contents of those subfolders.

The user is prompted for credentials when clicking the folder.

Why wrong: Windows does not typically prompt for credentials on a per-folder basis when browsing an SMB share. Authentication happens at the session level. If a user lacks permissions, they are either denied access or, if ABE is enabled, they simply do not see the folder in the first place.

The share becomes read-only for that user.

Why wrong: FolderEnumerationMode affects visibility, not the actual read/write capabilities of the share. The user's ability to write to files is determined by the combination of share permissions and NTFS permissions, while ABE specifically controls whether the user can see items they are not authorized to access.

The SMB server service must be restarted for the change to take effect.

Why wrong: SMB configuration changes in Windows Server 2022 are applied dynamically by the kernel-mode SMB driver. Restarting the service is generally unnecessary for configuration properties like encryption. The connectivity issue points to a protocol mismatch or negotiation failure rather than a pending service restart requirement for the configuration update.

The server's certificate for SMB encryption has expired.

Why wrong: SMB encryption in Windows Server uses symmetric keys negotiated during the session setup, not X.509 certificates. Therefore, certificate expiration is irrelevant to SMB traffic. This is a common point of confusion with TLS-based protocols like HTTPS or LDAPS, which do rely on PKI infrastructure for session encryption.

The firewall is blocking TCP port 445.

Why wrong: The firewall blocking port 445 would prevent all SMB traffic regardless of whether encryption is enabled or disabled. Since users specifically reported issues after the configuration change to enable encryption, the connectivity problem is rooted in the protocol negotiation phase rather than a static network-level block by the firewall.

Force an immediate KCC topology update using repadmin /kcc.

Why wrong: While forcing a KCC update can sometimes fix logical topology issues, it will not resolve a 'remote system not available' error. This error indicates a communication failure at the network or service level, which the KCC cannot bypass until the underlying transport path is restored.

Reset the computer account password for DC1 in Active Directory.

Why wrong: Resetting a computer account password is used for 'Access Denied' errors or secure channel failures, typically indicated by error 5. It is not appropriate for error 1256, which is a connectivity-based failure rather than a credential or authentication-based failure between the domain controllers.

Seize the FSMO roles from DC2 using ntdsutil.

Why wrong: Seizing FSMO roles is a drastic measure taken only when a domain controller is permanently lost. It does not fix replication errors for the naming context. If the connectivity is temporarily broken, seizing roles would create more complexity and potential conflicts once the network issue is resolved.

Primary Domain Controller (PDC) Emulator

Why wrong: The PDC Emulator role is an Operations Master role and is not identified by the 'IS_GC' string. While a PDC Emulator can also be a Global Catalog, the exhibit specifically highlights the Global Catalog attribute rather than any of the five FSMO roles assigned to the server.

Read-Only Domain Controller (RODC)

Why wrong: A Read-Only Domain Controller would be identified by different flags, such as 'IS_RODC', in the output. The 'IS_GC' flag only tells us about the Global Catalog status and does not indicate whether the domain controller is writeable or read-only in its primary database operation.

Schema Master

Why wrong: The Schema Master is a forest-wide FSMO role. While the server in the exhibit might hold this role, the 'IS_GC' output does not provide evidence of FSMO role ownership. FSMO roles are typically checked using 'netdom query fsmo' or similar PowerShell commands rather than replication status tools.

Verify the Azure Subscription Quotas

Why wrong: Subscription quotas limit the number of resources in a tenant but do not cause DNS resolution errors. If a quota was reached, the error would manifest as an authorization or resource limit failure rather than a connectivity-related DNS lookup issue during the initial registration attempt for the agent.

Validate the Azure Service Principal credentials

Why wrong: Service Principal issues typically result in 'Access Denied' or authentication errors, not DNS resolution failures. Validating credentials is a valid troubleshooting step for identity-related problems, but it does not address the fundamental networking layer issue where the client cannot translate the Azure hostname into an IP address.

Restart the Azure Connected Machine service

Why wrong: Restarting the service might trigger a retry, but it will not fix an underlying DNS configuration issue. If the local resolver is unable to reach the Azure infrastructure, restarting the agent will simply result in the same error message because the root cause of the connectivity failure remains present.

Clients cannot renew leases and will lose connectivity immediately.

Why wrong: DHCP failover is specifically designed to prevent immediate connectivity loss. In the event of a communication failure, the remaining server continues to service the clients it is aware of, ensuring that existing devices can maintain their network presence while the administrator works to resolve the underlying connection issue.

The server will grant new leases for the full scope duration.

Why wrong: During a communication interruption, the server is restricted in how long it can extend or grant leases because it cannot synchronize with its partner. Granting full-duration leases without synchronization could lead to IP address conflicts once the partnership is restored and the two databases are reconciled.

The partner server automatically takes over all active leases.

Why wrong: A takeover does not happen automatically in the 'CommunicationInterrupted' state. The servers must wait for the 'Partner Down' state to be manually or automatically triggered (if the transition delay is configured) before one server assumes full responsibility for the entire IP address range and all active client leases.

The script will fail to run because the LocalMachine policy is set to AllSigned.

Why wrong: The 'LocalMachine' scope is lower in the precedence hierarchy than the 'Process' scope. Although 'AllSigned' usually requires scripts to be digitally signed, the 'Bypass' setting at the 'Process' level overrides this restriction for the duration of the current PowerShell session, allowing any script to run regardless of its signature.

The script will prompt the user for confirmation before executing.

Why wrong: A prompt for confirmation typically occurs when the policy is set to 'RemoteSigned' and a script is downloaded from the internet without being unblocked. However, 'Bypass' explicitly suppresses all prompts and warnings. The user will not be asked for permission, and the script will proceed to execute as soon as the command is entered.

The script will only run if the administrator executes it from an elevated prompt.

Why wrong: Elevation (Running as Administrator) does not change how the execution policy is applied. If the policy blocks a script, it will be blocked regardless of whether the prompt is elevated or not. In this case, the 'Bypass' policy at the 'Process' level is what allows the execution, not the administrative status of the user.

The file will be allowed because the 'Allow Signed' rule uses a wildcard for the FileName.

Why wrong: While the 'Allow Signed' rule uses a wildcard, the presence of a specific 'Deny' rule for 'untrusted.exe' overrides it. In WDAC logic, a specific block rule is prioritized over a general allow rule. Therefore, the wildcard does not grant permission to files that are explicitly listed in the deny section of the policy.

The file will be allowed if it is digitally signed by a trusted Windows publisher.

Why wrong: Even if the file is signed by a trusted publisher, the explicit 'Deny' rule in the FileRules section will block it. WDAC evaluates deny rules first. If a match is found in the deny list, the execution is blocked immediately, and the policy does not continue to check for valid signatures or other allow conditions.

The file will be allowed but an audit event will be generated in the event log.

Why wrong: The exhibit shows a standard policy, not an audit-only policy. Unless the 'Option' for 'Audit Mode' is explicitly set in the policy header (not shown in the snippet), a match on a 'Deny' rule results in an active block. The file will not run, and the user will receive a notification that the app is blocked.

The server is experiencing a critical memory leak.

Why wrong: The exhibit specifically shows processor time metrics, not memory-related counters like committed bytes or page faults. While high CPU can sometimes accompany memory swapping, there is no data in this output to support a conclusion regarding memory exhaustion or the health of the RAM subsystem.

Disk I/O latency is causing the high CPU values.

Why wrong: Although disk latency can cause 'IO Wait' which might keep a CPU busy, these counters do not measure disk queue length or latency. Without seeing the '\PhysicalDisk\Avg. Disk sec/Read' or Write counters, it is impossible to determine if the storage subsystem is the root cause of the observed load.

The server is idling normally with background tasks.

Why wrong: Normal idle behavior for a Windows Server typically involves CPU usage well below 10-20% unless a specific maintenance task is running. Sustained values in the 90th percentile indicate significant active processing and are not representative of an idle state or standard low-priority background activity.