AZ-802 Practice Exam 1 — 50 Explained Questions
50 questions
Open this course’s practice exams →Windows Server · Public course · v1.1.1
AZ-802: Administering Windows Server
Study Windows Server identity, virtual machines, networking, storage, security and hybrid management with flashcards, explained questions and four practice exams.
1051 flashcards · 506 practice questions
Open study modesLearn IT smarter. Your progress stays in your browser.
Choose topics, then use Flashcards, Learn, Write, Match, Practice Questions or Mock Exam when the course has suitable content.
Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.
Topics in this course
AD DSAD DS | Deploy and manage AD DS domain controllersAD DS | Configure and manage multi-site, multi-domain, and multi-forest environmentsAD DS | Create and manage AD DS security principalsAD DS | Manage Windows Server by using domain-based Group PoliciesHybrid server managementHybrid server management | Configure remote management for Windows Server instances in a hybrid environmentHybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environmentVirtual machinesVirtual machines | Manage Hyper-V and guest VMVirtual machines | Manage Windows Server VMs in AzureNetworkingNetworking | Implement on-premises and hybrid name resolutionNetworking | Manage IP addressing in on-premises and hybrid scenariosStorage and file servicesStorage and file services | Configure and manage Azure FilesStorage and file services | Configure and manage Windows Server file sharesStorage and file services | Configure Windows Server storageSecuritySecurity | Secure Windows Server operating systemSecurity | Secure AD DSMonitoring and troubleshootingMonitoring and troubleshooting | Monitor by using Windows Server tools and Azure servicesMonitoring and troubleshooting | Troubleshoot Windows Server issuesMonitoring and troubleshooting | Troubleshoot Active DirectoryPractice exams
Fixed question sets within this course. Open study modes to take an exam and save results in your browser.
AZ-802 Practice Exam 2 — 50 Explained Questions
50 questions
Open this course’s practice exams →AZ-802 Practice Exam 3 — 50 Explained Questions
50 questions
Open this course’s practice exams →AZ-802 Practice Exam 4 — 50 Explained Questions
50 questions
Open this course’s practice exams →Flashcards
What is the difference between installing the AD DS role and promoting a server?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Role installation adds AD DS binaries. Promotion creates or joins the directory as a domain controller and requires a restart.
Which ADDSDeployment cmdlet creates a new forest?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Install-ADDSForest creates a new forest. Install-ADDSDomain creates a domain; Install-ADDSDomainController adds a DC to an existing domain.
What does Test-ADDSDomainControllerInstallation do?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It checks prerequisites for an additional DC installation without promoting the server. A successful test does not replace post-promotion health checks.
What is the purpose of the DSRM password?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It provides a local recovery credential for Directory Services Restore Mode when normal domain authentication is unavailable. Protect it independently for each DC.
Which identity normally has permission to add a writable DC to an existing domain?
AD DS · AD DS | Deploy and manage AD DS domain controllers
A Domain Admin or an account with equivalent delegated permissions can perform the installation. Forest/schema preparation can require additional forest-level privileges.
What DNS configuration should a prospective replica DC use before promotion?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Use reachable DNS capable of resolving the existing AD domain and its service records. Public DNS alone cannot locate private domain services.
What post-promotion checks establish directory availability?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Verify AD/DNS health, SYSVOL and NETLOGON shares, replication, and relevant event logs. dcdiag and repadmin help assess these layers.
What does installation from media change about DC promotion?
AD DS · AD DS | Deploy and manage AD DS domain controllers
IFM reduces initial replication traffic by supplying directory data locally. It still requires a live DC for remaining changes and does not create an isolated independent replica.
Why should a healthy DC be demoted before its server is removed?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Normal demotion updates directory topology and removes its DC role cleanly. Check FSMO roles and surviving DNS/DC capacity before retirement.
Does installing a newer Windows Server DC automatically raise the domain functional level?
AD DS · AD DS | Deploy and manage AD DS domain controllers
No. DC operating-system version and functional level are separate choices; validate all DC version requirements before raising levels.
Where should an Azure DC's stable private IP address be configured?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Set the Azure NIC's private IP allocation to static. Normally leave DHCP enabled inside the Windows guest so Azure supplies the reserved address.
What DNS setting enables Azure workload VMs to discover customer-managed AD DS?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Configure the workload VNet/client DNS to reachable AD DNS private addresses. Azure-provided DNS alone does not publish the existing domain's AD service records.
How should NTDS data disks on Azure DCs be cached?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Use persistent managed data disks with host caching set to None for the AD database, logs, and SYSVOL. Do not place these on the temporary/resource disk.
How should Azure-hosted DC availability be designed?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Deploy at least two DC VMs in separate availability zones where available, or an availability set where zones are unsuitable. Maintain AD-aware backups as well as VM availability.
What provides private connectivity for an AD DS extension into Azure?
AD DS · AD DS | Deploy and manage AD DS domain controllers
A site-to-site VPN or ExpressRoute can connect the on-premises network and Azure VNet. Allow required DNS, authentication, replication, and management traffic across the path.
Why are AD sites and subnet objects needed for Azure DCs?
AD DS · AD DS | Deploy and manage AD DS domain controllers
They map Azure network prefixes to an AD site, guiding nearby DC selection and replication topology. Connectivity alone does not create this directory mapping.
Why should Azure DCs generally avoid a public IP address?
AD DS · AD DS | Deploy and manage AD DS domain controllers
DC management and directory traffic should use restricted private paths. Bastion or private management access avoids exposing administrative endpoints directly to the internet.
What must clients do after their VNet custom DNS setting changes?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Refresh the guest's DHCP-derived configuration or restart as appropriate so the new DNS servers take effect. A portal change alone may not immediately update an existing guest.
Does VNet peering automatically copy custom DNS settings between VNets?
AD DS · AD DS | Deploy and manage AD DS domain controllers
No. Configure appropriate custom DNS on each connected workload network and verify DNS reachability.
Why is a raw VHD copy insufficient as the DC's backup strategy?
AD DS · AD DS | Deploy and manage AD DS domain controllers
An arbitrary disk copy is not an AD-aware consistent backup with a tested restore procedure. Virtualization safeguards do not replace directory backup and recovery planning.
When is an RODC a suitable deployment choice?
AD DS · AD DS | Deploy and manage AD DS domain controllers
A branch with weak physical security can use an RODC to provide local directory services while limiting writable-directory and credential exposure. Its WAN dependencies still require planning.
Can an RODC originate ordinary directory updates?
AD DS · AD DS | Deploy and manage AD DS domain controllers
No. It receives directory changes from writable DCs; directory writes require a writable DC.
Can an RODC provide DNS and global catalog services?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Yes, it can host read-only AD-integrated DNS and act as a global catalog. These roles do not make its directory writable.
What is staged RODC installation?
AD DS · AD DS | Deploy and manage AD DS domain controllers
An administrator precreates an RODC account, selects its delegated administrator and policies, and a branch operator attaches the matching server to that account.
Which promotion parameter attaches to a precreated RODC account?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Install-ADDSDomainController uses -UseExistingAccount in the staged installation workflow. The server must match the prepared account.
What authority does RODC administrator role separation give a branch operator?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It allows administration of the RODC server without granting broad domain administration. It does not authorize arbitrary AD directory changes.
What happens when an RODC receives authentication for an uncached account?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It needs a reachable writable DC to validate the account. Password Replication Policy then governs whether the credential may be cached.
Why should user and computer credential caching be planned for a branch outage?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Workstation/domain authentication can depend on both identities. Caching a permitted user alone does not ensure the computer's domain authentication succeeds offline.
Which rule wins when an account is both allowed and denied in RODC PRP?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Deny takes precedence over allow. Evaluate nested group membership as well as direct entries.
Does an allowed PRP entry prove a password is cached?
AD DS · AD DS | Deploy and manage AD DS domain controllers
No. Allowed means eligible for replication; the revealed/cached list shows secrets actually stored on the RODC.
What is the difference between RODC authenticated and revealed account lists?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Authenticated accounts can include authentication forwarded to a writable DC. Revealed accounts indicate credentials actually cached on the RODC.
What is the default membership of Allowed RODC Password Replication Group?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It is empty by default. Populate carefully scoped branch groups instead of broadly allowing privileged identities.
Why are highly privileged accounts denied RODC password caching?
AD DS · AD DS | Deploy and manage AD DS domain controllers
A stolen or compromised branch DC could expose its cached secrets. Excluding valuable administrative credentials reduces the resulting compromise.
What does repadmin /prp view BR-RODC01 reveal inspect?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It displays accounts whose passwords have been revealed to that RODC. This checks actual exposure rather than only PRP eligibility.
What credential action follows theft of an RODC?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Identify actually exposed accounts and reset their relevant user/computer credentials through a controlled incident response. Changing PRP alone does not invalidate stolen secrets.
What permission error can permit unexpected RODC password replication?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Improperly granting Replicating Directory Changes All to RODC-related principals can bypass the intended credential restriction. Investigate sensitive replication permissions.
What should be checked if RODC cache results disagree with visible PRP membership?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Check nested membership, PRP attributes and group membership consistency across DCs, and replication permissions. Different DC views can reflect replication faults.
Which FSMO roles exist once per forest?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Schema master and domain naming master are forest-wide. RID master, PDC emulator, and infrastructure master exist once per domain.
What does the schema master coordinate?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It authorizes updates to the forest schema. Ordinary user authentication can continue when this role is temporarily unavailable.
What does the domain naming master coordinate?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It authorizes adding or removing domains and application partitions in the forest. It is not the DNS server for every domain.
What is the RID master's principal responsibility?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It allocates RID pools to domain DCs so they can create unique security principal SIDs. Existing local pools can let object creation continue temporarily during an outage.
Why does the PDC emulator matter to password-change troubleshooting?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It receives preferential password updates and can be consulted after another DC rejects a recently changed password. It also supports account lockout coordination and time hierarchy.
What is the infrastructure master's job?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It maintains references to objects in other domains. GC placement constraints have exceptions when all DCs are GCs or the forest uses AD Recycle Bin.
When should an FSMO role be transferred rather than seized?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Transfer when the current holder is reachable and functioning, such as during planned retirement. Seize only when transfer is impossible and the holder cannot return as a valid role owner.
What does -Force mean on Move-ADDirectoryServerOperationMasterRole?
AD DS · AD DS | Deploy and manage AD DS domain controllers
It attempts transfer and can seize when transfer fails. It should not be used as a routine synonym for a normal planned move.
How can an administrator inventory FSMO ownership?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Use Get-ADForest for schema/domain-naming owners and Get-ADDomain for domain role owners, or netdom query fsmo. Verify replication after any move.
What should happen to an old role holder after seizure?
AD DS · AD DS | Deploy and manage AD DS domain controllers
Retire or properly rebuild/demote the former owner before reintroduction. Reconnecting a stale DC unchanged risks conflicting directory state.
If ResourceDomain trusts AccountDomain, whose users can authenticate for ResourceDomain resources?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
Users in AccountDomain are trusted by ResourceDomain. The resource domain is the trusting side; resource permissions must still grant access.
Does creating a trust automatically grant file permissions?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
No. A trust enables authentication routing; resource ACLs and any selective-authentication gate separately control access.
How do parent-child trusts connect domains in one forest?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
They are created automatically as two-way transitive trusts within the forest. They do not create an independent forest security boundary.
What distinguishes an external trust from a forest trust?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
An external trust is a nontransitive relationship between specific domains. A forest trust routes authentication among domains of two participating forests.
Does a forest trust from A to B and B to C automatically allow A to trust C?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
No. Forest-trust transitivity covers domains inside its two participating forests, not an unlimited chain of other forest trusts.
What does selective authentication add to a trust?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
It requires explicit Allowed to authenticate permission on target computers before authentication to those resources. Resource ACL permissions remain necessary.
What is the purpose of SID filtering on a trust?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
It limits acceptance of inappropriate SIDs presented across the trust. Disabling it to accommodate SIDHistory requires a deliberate security-reviewed migration design.
What prerequisites should be verified before creating a trust?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
Verify reciprocal DNS resolution, routed service connectivity, compatible functional levels, and suitable authority on the participating sides.
What is a shortcut trust used for?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
It shortens an authentication path between domains in the same forest. It changes routing efficiency without replacing resource authorization.
What does an AD site represent?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
A site represents network locality based on IP subnets. It can contain DCs from multiple domains, and one domain can span several sites.
How does a client learn its intended AD site?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
Its IP address is matched to an AD subnet object associated with a site. Correct subnet mappings support nearby DC discovery.
Which command reports the current client site?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
nltest /dsgetsite reports the discovered site. Use it with subnet and DC-placement checks when clients select distant DCs.
What does a site-link cost control?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
It influences replication path preference, generally favoring the lower total cost. It does not define the replication interval.
What is the difference between a site-link schedule and interval?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
The schedule defines when intersite replication is permitted. The interval defines how often it is attempted inside those permitted windows.
What are the default and minimum intersite replication intervals?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
The default interval is 180 minutes, and the minimum is 15 minutes. A closed schedule still prevents replication outside its allowed window.
Does creating an AD site link create network routing?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
No. It models a logical replication path; the IP network must independently allow the necessary traffic.
Why might unrestricted site-link bridging be unsuitable?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
Default transitive bridging assumes suitable network reachability. A partially routed topology may require bridges that reflect actual connectivity.
How can universal group membership caching help a branch site?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
It can reduce dependency on a local global catalog for subsequent membership lookup. Initial retrieval and cache freshness still require appropriate connectivity.
Which component builds AD replication connection topology?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
The Knowledge Consistency Checker creates replication connections. Intersite topology generation coordinates connections between sites.
What does a connection object under a DC's NTDS Settings represent?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
It represents inbound replication to that DC from its named source partner. Its location identifies the destination.
Which directory partitions replicate forest-wide to DCs?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
The schema and configuration partitions replicate throughout the forest. A DC's domain partition replicates within its own domain.
What additional data does a global catalog replicate?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
It holds a partial read-only replica of objects in other forest domains using selected attributes. It does not hold every attribute or password from every domain.
Why can AD replication succeed while a GPO remains incomplete?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
The GPO container replicates in AD, while its template and scripts replicate through SYSVOL. Modern SYSVOL uses DFS Replication, which must be checked separately.
Which commands summarize and inspect AD replication partners?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
repadmin /replsummary summarizes replication health; repadmin /showrepl DC02 shows that DC's inbound partner status.
Why can fixing DNS resolve an RPC replication failure?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
Replication partners must resolve and contact the correct DC endpoints. An RPC error can reflect name resolution or service connectivity rather than directory corruption.
Why is repeatedly forcing replication insufficient for an unreachable partner?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
Synchronization requests do not repair DNS, routing, RPC access, or a failed source. Correct the underlying cause and then verify replication.
Why should long-isolated DCs not be blindly reconnected?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
Isolation beyond applicable deletion-retention limits can leave lingering objects. Controlled recovery must assess their directory state before replication resumes.
Why can assigning one preferred bridgehead reduce resilience?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
It can prevent alternate suitable DCs from handling intersite replication after failure. Allow automatic partner selection unless network requirements justify constraints.
Why does renaming an AD user normally preserve resource permissions?
AD DS · AD DS | Create and manage AD DS security principals
Permissions refer to the account's SID, which remains the same when renamed. The display or logon name is not the security identity.
What happens to an account's SID if it is deleted and recreated with the same name?
AD DS · AD DS | Create and manage AD DS security principals
The replacement receives a new SID. Name reuse alone does not restore permissions granted to the deleted identity.
Which AD group category can be used on a resource DACL?
AD DS · AD DS | Create and manage AD DS security principals
A security group can receive permissions. A distribution group is intended for messaging and is not a DACL authorization principal.
What members can a global group normally contain?
AD DS · AD DS | Create and manage AD DS security principals
Accounts and global groups from its own domain. A trust does not allow a global group to contain arbitrary external-domain users.
Where can a domain-local group normally grant resource permissions?
AD DS · AD DS | Create and manage AD DS security principals
It grants permissions on resources in its own domain. Its membership can include eligible principals from trusted domains.
What does AGDLP mean?
AD DS · AD DS | Create and manage AD DS security principals
Accounts join Global role groups, which join Domain Local resource groups, which receive Permissions. This separates business membership from resource rights.
Why should ordinary user creation specify the intended OU?
AD DS · AD DS | Create and manage AD DS security principals
OU placement determines delegation and applicable policies. Creating an account in an unintended container can change who manages it and which policies apply.
What should be checked after adding a user to a group but access is still denied?
AD DS · AD DS | Create and manage AD DS security principals
Check replication, nested membership, the user's actual fresh logon token, and resource ACLs. Existing tokens may not reflect new membership.
Why is disabling a departing user's account not the entire offboarding process?
AD DS · AD DS | Create and manage AD DS security principals
Disabling blocks new account authentication but does not automatically remove ownership, every application grant, or all existing sessions. Complete the intended access and retention workflow.
What does AGUDLP add to AGDLP?
AD DS · AD DS | Create and manage AD DS security principals
It adds a Universal group between domain-specific Global role groups and Domain Local resource groups. This aggregates a stable role across domains within one forest.
Which forest limits apply to universal group membership?
AD DS · AD DS | Create and manage AD DS security principals
Universal groups can aggregate eligible users/global/universal groups from their own forest. They are not general cross-forest containers.
How can resource-domain groups grant access to users in a trusted external forest?
AD DS · AD DS | Create and manage AD DS security principals
Nest an appropriate external global group or eligible principal into a resource-domain domain-local group, then grant that group resource permissions.
What is a foreign security principal object?
AD DS · AD DS | Create and manage AD DS security principals
It represents an external security principal's SID in the local directory. It is not a copied user account with a local password database.
Why nest stable global groups into a universal group?
AD DS · AD DS | Create and manage AD DS security principals
It limits forest-wide universal membership churn as individual users change within domain-specific global groups. GC replication and tokens still need consideration.
Why specify a target domain when administering multi-domain accounts?
AD DS · AD DS | Create and manage AD DS security principals
Commands/consoles can default to an unintended DC or domain. Use the appropriate -Server or connection context to manage the correct directory object.
Can a global group in Domain A contain a user from Domain B because the domains trust each other?
AD DS · AD DS | Create and manage AD DS security principals
No. Global membership is limited to accounts/global groups from its own domain. Use eligible universal/domain-local nesting for broader designs.
Why must group-scope conversion be validated before execution?
AD DS · AD DS | Create and manage AD DS security principals
Existing members and parent-group memberships can violate the target scope's constraints. Conversion must fit the intended membership and authorization model.
Why does a cross-forest trust not eliminate group-token troubleshooting?
AD DS · AD DS | Create and manage AD DS security principals
Membership changes still require replication and suitable token renewal, and resource ACLs/selective authentication remain separate checks.
When is a gMSA preferable to a manually maintained domain-user service identity?
AD DS · AD DS | Create and manage AD DS security principals
Use it for a supported service running on approved domain hosts, especially a server farm. AD manages its password rather than administrators sharing or rotating it manually.
What distinguishes an sMSA from a gMSA?
AD DS · AD DS | Create and manage AD DS security principals
An sMSA provides managed service credentials for one host. A gMSA can be used by multiple authorized hosts.
How does a virtual account authenticate to remote domain resources?
AD DS · AD DS | Create and manage AD DS security principals
A local virtual account such as NT SERVICE\ServiceName uses the host computer's identity for network access. It is not a shared domain account for a server farm.
What remote identity does NetworkService normally use?
AD DS · AD DS | Create and manage AD DS security principals
It normally authenticates as the computer account while having fewer local privileges than LocalSystem.
How does LocalService differ from NetworkService for remote access?
AD DS · AD DS | Create and manage AD DS security principals
LocalService generally presents anonymous network credentials. NetworkService normally uses the domain computer identity.
What forest infrastructure is required to generate gMSA passwords?
AD DS · AD DS | Create and manage AD DS security principals
A KDS root key must be available to the relevant DCs. Confirm an existing key before creating another.
Why allow the documented 10-hour KDS convergence period in production?
AD DS · AD DS | Create and manage AD DS security principals
It allows replication convergence before hosts depend on generated passwords. Immediate/backdated lab shortcuts do not repair production replication problems.
Which gMSA property authorizes hosts to retrieve its managed password?
AD DS · AD DS | Create and manage AD DS security principals
PrincipalsAllowedToRetrieveManagedPassword identifies the eligible principals, commonly a security group of approved computer accounts.
Which two host cmdlets install and validate a gMSA?
AD DS · AD DS | Create and manage AD DS security principals
Install-ADServiceAccount installs it locally; Test-ADServiceAccount checks whether the host can use it. Run them on the authorized service host.
How is the gMSA account name supplied to a compatible Windows service?
AD DS · AD DS | Create and manage AD DS security principals
Use its domain identity with a trailing dollar sign, such as CORP\gmsaWeb$. Do not manually type the generated managed password.
Why can a newly added authorized computer fail gMSA password retrieval?
AD DS · AD DS | Create and manage AD DS security principals
The host's group membership token may be stale. Refresh its machine authentication state, such as through a controlled reboot, after verifying replication.
What does a gMSA not automatically solve?
AD DS · AD DS | Create and manage AD DS security principals
It does not prove application compatibility, grant all resource permissions, or make Kerberos delegation safe. Check SPNs, required logon rights, and service-specific support.
What are the two components of a domain GPO?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
The Group Policy Container is stored in AD; the Group Policy Template is stored in SYSVOL. Both must be available and consistent.
Where can a domain GPO be linked?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
It can be linked to a site, domain, or OU. Groups and individual users are filtering targets rather than direct link containers.
What is the normal Group Policy processing order?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
Local, Site, Domain, then parent-to-child OUs. Later applicable settings normally win conflicts.
Which GPO link wins a conflict at the same container?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
Link order 1 has the highest precedence among applicable links at that container. Settings in different areas still accumulate.
What does Not configured mean for a setting?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
That GPO does not manage the setting. It is not an explicit instruction to disable the feature.
How do Block inheritance and Enforced differ?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
Block inheritance is a container setting that stops ordinary inherited links. Enforced is a link setting that survives inheritance blocking and resists lower-level overrides.
What permissions are needed for a target to apply security-filtered GPO settings?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
The target needs Read and Apply Group Policy, subject to deny entries. Enforcing a link does not bypass these permissions.
What does a WMI filter evaluate?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
It evaluates a computer condition to filter the entire GPO. It differs from per-item preference targeting.
How does loopback Merge select user settings?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
It processes the user's normal user GPO list, then the user settings selected from the computer's location. The computer-based list wins conflicts.
How does loopback Replace select user settings?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
It uses only the user GPO list selected from the computer's location. This suits controlled session hosts or kiosks.
What is the normal background refresh interval for member computers?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
Normally 90 minutes plus up to 30 minutes of random offset. Some settings still require foreground processing, logoff, or restart.
Which tools help verify applied GPOs and winning settings?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
Use gpresult, RSoP, or GPMC Group Policy Results with effective local state. Check denied GPO reasons, AD/SYSVOL, and GroupPolicy events.
How do preferences differ from enforced policy settings?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
Preferences generally configure settings that users may change, though refresh can reapply them. Enforced policy settings take precedence in a conflict.
What does the Create action normally do?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
It creates the item if absent and leaves an existing item unchanged. Confirm the preference extension's supported behavior.
What does the Update action normally do?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
It changes specified properties while preserving unspecified ones, and commonly creates the item if absent. It avoids unnecessary deletion and recreation.
What does the Replace action normally do?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
It deletes and recreates the item. Repeated replacement can interrupt resources such as active drive mappings.
What does item-level targeting control?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
It evaluates conditions for an individual preference item. Other items in the same GPO can use different conditions.
What does Apply once and do not reapply accomplish?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
It supplies an initial preference without resetting later user changes during normal reapplication.
Why can a preference remain after the GPO leaves scope?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
Preferences often persist unless removal behavior is configured. Where supported, Remove this item when it is no longer applied supplies cleanup and automatically sets the action to Replace; test the resulting refresh behavior.
Why should reusable passwords never be stored in Group Policy preferences?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
Historical cpassword secrets in SYSVOL are recoverable. Use Windows LAPS or managed service accounts for the appropriate password-management requirement.
Why are local-group preference replacement options security-sensitive?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
Replacing membership or deleting existing members can remove necessary administrators or add unintended access. Choose explicit add/remove semantics and test effective membership.
What is the Windows Admin Center gateway responsible for?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
It accepts the administrator’s browser connection and performs management operations against the selected servers using Windows management interfaces. The gateway and the managed target can be different machines.
When does a shared Windows Server gateway fit better than a local Windows Admin Center desktop installation?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
A shared gateway provides one browser-accessible management endpoint for several administrators. A local desktop installation is suitable for individual administration or evaluation.
What must a production Windows Admin Center HTTPS certificate identify?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
The certificate must identify the gateway name used by clients and chain to a CA those clients trust. A certificate installed on the gateway alone does not establish client trust.
Which two authorization boundaries matter when using a local Windows Admin Center gateway?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Access to the gateway and permission to administer the target server are separate. A user who can open the gateway still needs a suitable identity and rights for the target operation.
What must precede deploying Windows Admin Center in Azure for an on-premises server?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Onboard the supported server to Azure Arc, then deploy the Windows Admin Center extension to its Arc resource. The portal connection uses the configured Arc service path.
Which Azure roles are documented for connecting to Windows Admin Center on an Arc server?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Reader and Windows Admin Center Administrator Login at an applicable scope covering the Arc resource. Installing the extension and registering providers involve separate permissions.
The login role contains dataActions and cannot be assigned at management-group scope.
Does Windows Admin Center through Azure Arc require an inbound public RDP port?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
No. The portal experience uses the server’s outbound service connectivity; its required outbound HTTPS endpoints still must be reachable.
Why can a local Windows Admin Center extension list differ from the portal experience?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
The portal experience supports a defined per-server tool set. A third-party tool available on a local gateway is not automatically supported by the Azure-hosted access experience.
Which default TCP ports does WinRM use for HTTP and HTTPS listeners?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
TCP 5985 for HTTP and TCP 5986 for HTTPS. A listener, firewall path and valid authentication are still required.
What does Test-WSMan establish about a target?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
It tests whether the target’s WSMan endpoint responds. It does not prove that the current user has authorization for every PowerShell endpoint or resource operation.
When should you use New-PSSession rather than repeated one-off Invoke-Command calls?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Use New-PSSession when you need a reusable remote session and its session state across commands. Invoke-Command can execute a one-off block without retaining that persistent state.
Where does a path such as C:\Logs inside an Invoke-Command script block refer?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
It refers to the remote machine executing that script block. Local and remote filesystem paths, modules and service names belong to their respective execution contexts.
Why may an object returned by PowerShell remoting lack its original methods?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Returned objects are commonly serialized copies. Perform operations requiring the live object inside the remote script block instead of assuming all methods survive serialization.
What causes the classic PowerShell second-hop problem?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Credentials used for a session from workstation A to server B are not automatically delegated when B accesses a resource on server C as that user. Successful authentication to B is insufficient evidence of identity delegation to C.
Does resource-based Kerberos constrained delegation universally fix another WinRM hop?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
No. Microsoft’s second-hop guidance excludes WinRM for this method. A supported SMB or other service delegation scenario must not be generalized to a second WinRM session.
What credential exposure does CredSSP introduce on the intermediate server?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
CredSSP delegates and caches the user’s credentials on that server. It requires a trusted intermediate server and an intentional decision about that exposure.
What does a JEA role capability file define?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
The cmdlets, functions, external commands and parameter constraints exposed to a role. It defines what the operator is permitted to do through the endpoint.
What does a JEA session configuration file control?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
It maps identities to role capabilities and configures endpoint behavior such as run-as identity and transcripts. Role definitions must be exposed through a registered session endpoint.
Why might a JEA endpoint use a gMSA for network-resource access?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
A gMSA supplies a controlled domain service identity to which you can grant the required network permissions. A local virtual account’s network identity differs and commonly uses the computer account.
How should a JEA endpoint be tested before rollout?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Test an intended allowed action and a forbidden command or parameter value. Verify that the endpoint rejects operations outside the designed role, not merely that a session can connect.
What is the role of the SSH server host key?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
It allows the client to verify the server’s identity. User authentication then proves who is requesting access; the host key does not grant the user administrative rights.
What is different about the OpenSSH Server component in Windows Server 2025?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
It is installed by default. Administrators still need to enable and configure the sshd service and confirm the required firewall access.
Which service and default port should you check for Windows OpenSSH server access?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Check the sshd service and TCP 22, including the OpenSSH-Server-In-TCP firewall rule and the permitted source scope.
Why does a successful ordinary SSH shell not prove PowerShell remoting over SSH is configured?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
PowerShell remoting requires a configured SSH subsystem that launches the PowerShell remoting host. An ordinary interactive shell can work without that subsystem.
Which PowerShell session parameter selects the SSH transport for a named target?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
HostName selects the SSH connection path in commands such as Enter-PSSession and New-PSSession. ComputerName normally selects the WSMan remoting path.
Can you assume WinRM JEA endpoint configuration is available over PowerShell SSH remoting?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
No. Current PowerShell SSH-remoting documentation does not support the WinRM endpoint-configuration and JEA hosting model. Choose a supported transport for the required endpoint behavior.
Why do SSH authorized-key file permissions matter on Windows?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
The key file must be stored in the correct location and protected with appropriate ACLs for the account and sshd configuration. A matching public key in an inaccessible or improperly protected file can still fail authentication.
What should you do when an SSH client reports an unexpected server host-key change?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Verify the server’s identity and the reason for the change before trusting the new key. A planned rebuild is possible, but the warning can also indicate the wrong endpoint or interception.
What does Network Level Authentication change in an RDP connection?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
It requires authentication before the full remote session is established. This reduces the exposure of the remote session to unauthenticated clients.
Which default TCP port carries a direct RDP connection?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
TCP 3389. The listener, network rules, Windows Firewall and user logon authorization must all permit the connection.
Why can Remote Desktop Users membership fail to grant RDP logon?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Effective policy can remove the required logon right or assign a deny right. Membership alone does not override the effective user-rights policy.
Which takes precedence when a user has both Allow and Deny log on through Remote Desktop Services?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
The Deny log on through Remote Desktop Services right takes precedence. Investigate effective group memberships and applied policy.
Are the two built-in Windows Server administrative RDP connections a multiuser application-hosting license?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
No. Those connections support administration. Serving multiple application users requires the appropriate RDS deployment and licensing.
Why does a successful ping not prove that Remote Desktop is ready?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Ping tests ICMP reachability, not the RDP listener, TCP 3389 path, NLA authentication or remote logon rights. Test those layers separately.
Which report helps identify domain policy controlling RDP user rights on a server?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
A Resultant Set of Policy or gpresult report shows the effective policies. Review the applied Allow and Deny remote-logon rights instead of editing only the local setting.
What should you verify before disabling NLA to troubleshoot an RDP authentication failure?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
Check client compatibility, valid credentials, account state and effective logon rights. Retain NLA when possible rather than treating a weaker authentication setting as the default repair.
What does Azure Arc-enabled servers add to an existing Windows server?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
It creates an Azure management resource and connects the existing server to supported Azure management services. The workload continues to run on its original physical server or hypervisor.
Which Connected Machine agent component manages the Arc machine’s Azure identity?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The Hybrid Instance Metadata Service, HIMDS, manages the connection and the machine identity used for Azure authentication. It is distinct from the telemetry agent.
Which Windows service handles machine configuration within the Connected Machine agent?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
GCArcService handles the Arc machine-configuration service. ExtensionService handles VM extensions, and himds handles hybrid metadata and identity.
What does azcmagent show help you inspect?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
It displays Connected Machine agent configuration and connection information for the local Arc server. A connected status is a control-path check, not proof that every extension or workload is healthy.
What network direction is central to normal Azure Arc server connectivity?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The agent initiates outbound connections to the required Azure service endpoints. Permit the documented HTTPS/DNS path and configure a proxy when the environment requires one.
What does the selected Azure region of an Arc server resource represent?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
It locates the Azure management resource metadata. It does not move the server’s operating system or business data to that region.
Why should you not clone an already-onboarded Arc machine as a reusable server image?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Arc registration and identity must be unique to the server. Use the documented preparation and registration workflow instead of copying the enrolled identity to unrelated machines.
Does Azure Contributor automatically authorize all Windows logon and filesystem actions on an Arc server?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
No. Azure resource permissions and guest Windows permissions are separate. The chosen access tool and operation determine which identity and authorization layer are required.
What additional scope does Azure Machine Configuration provide beyond ordinary Azure resource-policy checks?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
It audits or configures operating-system settings inside the guest. Azure resource compliance alone does not establish the actual guest setting.
What does Machine Configuration Audit mode do?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
It reports the observed configuration without applying the requested setting. An audit failure is a finding, not evidence that a repair has run.
How does Apply and Monitor differ from Apply and Autocorrect?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Apply and Monitor applies the configuration and reports later drift. Apply and Autocorrect also brings drifted settings back into conformance.
What prerequisites are required for Machine Configuration on an Azure VM?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The supported machine-configuration extension and a system-assigned managed identity are required. The service uses that identity and extension to obtain and evaluate assignments.
Why is a separate Machine Configuration VM extension normally unnecessary on an Arc-enabled server?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The Connected Machine agent includes the relevant machine-configuration capability. Do not apply Azure-VM extension prerequisites indiscriminately to an Arc server.
Which Azure resource provider is associated with Machine Configuration assignments?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Microsoft.GuestConfiguration. Required resource providers and permissions must be available in the target subscription.
What connects a machine-configuration package to a target machine?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
A guest assignment identifies the configuration to evaluate or apply on that machine. The package contains the settings and dependencies needed by the guest configuration engine.
Why can a correcting GPO and an autocorrecting machine configuration produce repeated drift?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
If they demand different values for the same setting, each controller can undo the other’s change. Define a consistent desired state and management authority before enabling correction.
What identifies a VM extension deployment on an Arc server?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The extension publisher, type and handler version identify the component to install. Select a supported Arc extension for the server’s OS and cloud.
Why must Arc extension support be checked separately from Azure VM extension support?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The Arc catalog and prerequisites can differ from the Azure VM catalog. An extension supported on an Azure VM is not automatically supported on every Arc server.
Which Connected Machine agent component installs and manages Arc extensions?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The extension manager, represented by ExtensionService on Windows, manages extension installation, removal and upgrade. HIMDS has a separate metadata and identity role.
Which extension settings field is intended for confidential values?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Use protected settings where the extension supports them. Ordinary settings should not contain credentials or secrets visible through normal resource configuration.
Why can an Arc server be Connected while an extension fails to install?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The control connection can work while the extension has a separate problem, such as blocked download endpoints, an unsupported handler or local installation failure. Inspect extension provisioning state and local logs.
What does automatic extension upgrade update?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
It updates supported extension handler versions according to the publisher’s rollout. It does not replace Windows operating-system patching.
What two sources of error detail should be checked for a failed Arc extension deployment?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Check the Azure extension provisioning result and the extension’s local handler logs. The Azure error and local execution failure often describe different parts of the same deployment.
Why is permission to deploy Arc extensions a powerful administrative permission?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Extensions can install agents or run tasks inside the server with high local privileges. Scope and audit Azure extension-management permissions accordingly.
Which Windows update source does Azure Update Manager use for a managed server?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
It uses the guest’s configured update source, such as Microsoft Update or WSUS. It does not replace that source with a universal Azure patch repository.
Does Azure Update Manager require the retired Automation Update Management Log Analytics architecture?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
No. Azure Update Manager is a separate service for assessment and patching of Azure VMs and Arc-connected servers. Do not use old MMA/workspace requirements as its current architecture.
How does update assessment differ from update installation?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Assessment discovers applicable updates and reports the state. Installation attempts to apply the selected updates; a successful assessment does not prove patch installation will succeed.
What does a scheduled maintenance configuration define for patching?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
It defines a maintenance window and patch settings such as update selection and reboot behavior. Machines must be associated with the configuration or selected through its supported dynamic scope.
Which Azure VM patch-orchestration option is recommended for scheduled Update Manager patching?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Customer Managed Schedules. Configure the supported scheduling prerequisites rather than assuming every guest-patching mode has identical behavior.
Why must patch deployment include enough maintenance-window time?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The window must accommodate installation and required reboot behavior. A window that is too short can leave selected updates unapplied or only partially completed.
Why should dynamic patching scope be verified before a scheduled run?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Tags and other selection criteria determine which machines are included at run time. A scope or tag mismatch can omit a server even when it is visible in Azure inventory.
Why should redundant domain controllers or application nodes be patched in separate waves?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Separating waves preserves a functioning authentication or application path while a peer is updating or restarting. Validate health before progressing to the next wave.
What should you investigate when update assessment succeeds but installation fails?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Check the configured update source, guest servicing state, patch extension, selected orchestration mode, machine power state, maintenance duration and reboot requirements. Use the installation result rather than assuming assessment certified each prerequisite.
Does automatic extension upgrade satisfy a Windows security-update rollout?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
No. Updating an extension handler and installing Windows OS updates are separate maintenance tasks. Plan and verify each through the appropriate service.
How do a runbook and a runbook job differ?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
A runbook is the stored automation definition. A job is one execution of that runbook, with its own input, output streams and result state.
When is a Hybrid Runbook Worker preferable to the Azure cloud sandbox?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Choose a worker when execution needs the worker’s local network path, installed modules or on-premises resources. The cloud sandbox does not automatically acquire a branch server’s private route.
Does Azure Arc onboarding alone make a server a Hybrid Runbook Worker?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
No. Deploy and configure the supported extension-based worker and associate it with the intended worker group. Arc registration is a management prerequisite, not the full worker configuration.
Which Windows account runs Hybrid Runbook Worker jobs by default?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The System account runs Windows hybrid jobs by default. A configured Hybrid Worker credential or explicit resource credentials can change how local resources are accessed.
Does an Azure managed identity automatically authorize a runbook to read an AD-authenticated SMB share?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
No. Azure authentication and Windows share/filesystem authorization are separate. Grant the actual Windows execution identity the required local or domain resource access.
Which Azure identity takes precedence for an Arc worker when the Automation account managed identity is enabled?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The Automation account’s system-assigned managed identity is used for the documented hybrid-job Azure authentication path. The Arc worker identity cannot be substituted for it in that configuration.
What must be available on a Hybrid Runbook Worker for a chosen PowerShell runtime?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
The supported runtime and compatible modules must exist on the worker, with the relevant extension/runtime configuration. Selecting a runtime in the runbook does not install every dependency on the worker.
Does testing a runbook draft publish it for normal scheduled execution?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
No. Test the draft, then publish the intended version. Configure the schedule or job against the published version and chosen execution environment.
Why can a completed PowerShell runbook job still contain errors?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
Nonterminating errors may not stop the script or fail the job. Review output/error streams and use intentional error handling to reflect the required business outcome.
What problem does Disable-AzContextAutosave -Scope Process help prevent in a worker runbook?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
It helps prevent reuse of an unintended persisted Azure context. Authenticate deliberately and set the subscription/context for the job’s required operations.
What makes a runbook safe to retry after partial completion?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
It checks existing state and brings it to the desired result without blindly recreating resources or duplicating actions. Verify each effect and handle failures deliberately.
What does configuring Hybrid Worker Credentials for a Windows worker group change?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
It supplies a configured credential asset for hybrid jobs in that group to use instead of the default System context. It does not itself grant an Azure RBAC role.
What transport provides Enhanced Session Mode's richer VMConnect experience?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Remote Desktop Protocol is carried through the Hyper-V connection, allowing redirection and a richer display without a working guest IP network.
Which host policy permits Enhanced Session Mode?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
In Hyper-V Settings, select Enhanced Session Mode Policy and enable Allow enhanced session mode.
Which user setting requests an enhanced VMConnect session?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Enable Use enhanced session mode under the user's Enhanced Session Mode settings. The host policy must also permit the feature.
What guest requirements does Microsoft document for Enhanced Session Mode?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The guest must have Remote Desktop Services enabled and run at least Windows 10 or Windows Server 2016 in the documented Windows workflow.
How do you choose local drives and devices to redirect into VMConnect?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Open the enhanced connection's Show options and choose the required local resources before connecting. Redirect only resources needed for the task.
Which VMConnect mode remains useful before guest networking and enhanced-session prerequisites are ready?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Basic session mode provides console display and keyboard/mouse access. Enhanced mode adds RDP-based capabilities once its prerequisites are met.
What host-side PowerShell setting allows enhanced sessions?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Set-VMHost -EnableEnhancedSessionMode $true permits enhanced sessions. Get-VMHost can display the EnableEnhancedSessionMode property for verification.
What should you check when VMConnect remains in basic mode despite the host policy being enabled?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Check the user's Use enhanced session mode setting, guest OS support, guest startup state, and Remote Desktop Services configuration. Host permission alone does not prepare the guest.
What does Get-VM -ComputerName HV01 manage?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It queries virtualization objects on the Hyper-V host HV01. It does not execute a command inside a guest merely because that guest is listed.
How does network PowerShell remoting differ from PowerShell Direct?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Network remoting targets a reachable computer and its remoting endpoint. PowerShell Direct executes inside a locally running supported Windows VM through the host-to-guest channel without depending on guest networking.
What Windows versions support the documented PowerShell Direct workflow?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The host and guest require supported Windows versions, including Windows Server 2016 or later or Windows 10 or later. Use the documented Windows PowerShell Direct cmdlets.
Which permissions and credentials are needed for PowerShell Direct into a VM?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The caller must have Hyper-V administrator rights on the host and supply valid credentials inside the guest. Host administration does not imply guest administrator access.
How can PowerShell Direct run one command inside a local Windows VM?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use Invoke-Command -VMName 'APP01' -Credential $guestCredential -ScriptBlock { Get-NetIPConfiguration } on the Hyper-V host.
How do you retain a PowerShell Direct session for several operations?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Create it with New-PSSession -VMName and guest credentials, reuse it with session-based cmdlets, then remove it with Remove-PSSession.
Which guest service should be inspected when PowerShell Direct fails on a supported running Windows VM?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Inspect the Hyper-V PowerShell Direct Service, vmicvmsession, along with credentials and guest readiness. Guest firewall or DNS changes do not fix a missing Direct endpoint.
What underlying transport enables a configured SSH Direct path to a Linux guest?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Hyper-V sockets use the host-to-guest VMBus path; Linux uses a compatible VSOCK endpoint. An SSH endpoint must be configured for that socket transport.
Socket support alone is not a complete SSH Direct distribution or host-version compatibility guarantee.
Does an ordinary Linux SSH listener on TCP 22 prove SSH Direct is configured?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
No. TCP SSH proves an IP endpoint exists; a Direct workflow needs the compatible Hyper-V socket endpoint and host tooling. Authentication and host-key checks still apply.
Verify the specific host and Linux implementation rather than assume a universal compatibility matrix.
How can a lab verify that Linux guest access actually bypasses the guest network?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Disconnect the guest network and test the supported configured socket path. A successful connection with networking present can hide an implementation's IP fallback.
What does nested virtualization expose to a Hyper-V VM?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It exposes CPU virtualization extensions so the VM can run its own hypervisor and inner VMs. The middle VM becomes a virtualization host.
What Intel prerequisites are documented for nested Hyper-V?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use Intel VT-x with EPT, Windows Server 2016 or later on the outer host, and VM configuration version 8.0 or later.
What AMD prerequisites are documented for nested Hyper-V?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
AMD EPYC/Ryzen or later requires Windows Server 2022 or later on the outer host and VM configuration version 9.3 or later.
Which command exposes virtualization extensions to a stopped VM?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Run Set-VMProcessor -VMName 'NestedHost01' -ExposeVirtualizationExtensions $true on the outer host while the VM is off.
What must you install inside a Windows VM after exposing virtualization extensions?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Install and configure Hyper-V in the middle VM. Exposing CPU extensions alone does not install the role or create inner guests.
When do nested guests need MAC address spoofing on the middle VM's adapter?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Enable it when inner guest MAC addresses must pass through the outer switch. The surrounding network must permit that design.
What nested-network design can be used when MAC spoofing is unavailable?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Create an internal virtual switch and NAT inside the middle VM. Give inner guests suitable IP, gateway, and DNS settings; NAT alone does not provide DHCP.
What memory limitation applies once Hyper-V is running inside the middle VM?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Its memory cannot fluctuate with Dynamic Memory or be resized while running. Shut down that VM before changing its memory.
What Azure VM security type does the documented nested-virtualization workflow require?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use Standard security type with a VM size supporting nesting. Confirm current size and platform prerequisites before deployment.
What is the purpose of Startup RAM for a Hyper-V VM?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It is the RAM available during boot and installation. Meet the guest's startup requirements even when Maximum RAM is much higher.
What does Minimum RAM control with Dynamic Memory?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It sets the lower assigned-memory boundary after startup. An excessively low minimum can increase guest paging and latency.
What does Maximum RAM guarantee with Dynamic Memory?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It defines the upper allocation limit, not a reservation or guarantee. Host available memory and guest support still limit actual allocation.
What does the Dynamic Memory buffer request?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It requests extra RAM above reported guest demand. Hyper-V attempts to provide it but cannot guarantee it during host pressure.
When does memory priority affect VM allocation?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It expresses relative preference when the host cannot satisfy every VM's memory request. A higher priority does not create additional physical RAM.
Which metrics help distinguish guest demand from assigned Hyper-V RAM?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Inspect MemoryDemand, MemoryAssigned, and MemoryStatus on the VM, together with guest paging and host available memory.
When is static memory a suitable choice?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Choose it when the application requires fixed RAM or a feature such as DDA or running nested Hyper-V requires a stable allocation.
Under what circumstances can Hyper-V use Smart Paging?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It temporarily bridges a VM restart when startup RAM exceeds assigned RAM, physical RAM is unavailable, and memory cannot be reclaimed. It is not used as general RAM overcommit or to solve insufficient failover capacity.
Which Set-VMMemory properties configure a Dynamic Memory range?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use DynamicMemoryEnabled, StartupBytes, MinimumBytes, and MaximumBytes. Buffer and Priority tune extra allocation and relative preference.
What does Hyper-V heartbeat integration indicate?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It reports guest OS responsiveness. The VM's Running state alone only shows that the host allocated resources and started it.
Which integration service lets the host request an orderly guest shutdown?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The guest shutdown service delivers a cooperative shutdown request to the guest. A nonresponsive guest or missing service may prevent graceful completion.
Which integration service supplies guest identity and IP metadata to the host?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Data exchange, also called key-value pair exchange or KVP, supplies guest metadata. Missing displayed IP information does not alone prove network failure.
What does Hyper-V's backup integration coordinate in Windows guests?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It works with VSS to support consistent backup and production checkpoints. Application writers and guest support must also be healthy.
What integration function enables Copy-VMFile from the host?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Guest Service Interface enables host-to-guest file copying. Enable it for the VM and ensure the corresponding supported guest component is available.
How are integration services maintained in modern Windows guests?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
They are built into supported modern Windows and updated through normal Windows servicing. Guest updates and host-side feature enablement both matter.
How do you inspect which integration services are enabled for a VM?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Run Get-VMIntegrationService -VMName 'APP01' on the Hyper-V host and inspect service status and enabled state.
Why should time synchronization for a virtualized domain controller be planned deliberately?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The domain's intended Windows Time hierarchy and authoritative source must be preserved. A host time setting should not unintentionally replace the forest-root PDC emulator's planned source.
Should Linux guests be assumed to support every Hyper-V integration function?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
No. Check the supported distribution/kernel integration feature matrix and required components; availability differs by release and service.
What resource does Discrete Device Assignment give a VM?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
DDA passes an entire compatible PCIe device into one VM, where a native vendor driver controls it. The host and other VMs cannot share that assigned device.
Which device classes does Microsoft explicitly support for DDA?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Graphics adapters and NVMe storage devices. For other device classes, obtain the hardware vendor's support statement rather than assume universal support.
What server hardware capabilities are important for DDA?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Server-class hardware must provide native PCIe control, ACS, and the required IOMMU isolation. Assess the specific server and device rather than infer support from the PCIe slot alone.
What information does SurveyDDA provide before device assignment?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It checks assignability and reports the device location path and MMIO requirements. It can explain why a device or platform is unsuitable.
What memory and automatic-stop settings are required for a DDA VM?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use static memory and set AutomaticStopAction to TurnOff. DDA does not support Dynamic Memory or saved-state operation.
What is the host-device preparation order for DDA?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Prepare the stopped VM, disable the device in the host, dismount it from the host partition, and then assign its PCIe location path to the VM. Install the appropriate native driver in the guest.
Why might a DDA VM need additional MMIO space?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Assigned devices map registers and device memory into the VM address space. Allocate enough low/high MMIO for the specific devices plus appropriate overhead.
How does a vendor DDA mitigation driver differ from the guest device driver?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The mitigation driver addresses assignment security on the host. The guest driver operates the assigned device; installing one does not substitute for the other.
What does Force mean when dismounting a DDA device without a mitigation driver?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It bypasses the security warning about the absent mitigation driver. Assess that security decision for the device and trust boundary; it is not a performance option.
Does Windows Server 2025 clustered GPU DDA permit live migration?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
No. Its supported Datacenter GPU-pool design can restart a VM where an available device exists after failure, but DDA live migration remains unsupported.
How does GPU partitioning allocate an accelerator to VMs?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It assigns hardware-isolated fractions of a supported GPU to different VMs through SR-IOV. Each VM accesses its allocated GPU resources.
Which Windows Server release introduced supported GPU-P live migration?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Windows Server 2025 introduced it on qualifying hardware and drivers. Earlier support for some GPU functions does not imply this migration capability.
What edition is required for GPU-P clustering to protect against unplanned downtime?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The documented clustered design requires Windows Server 2025 Datacenter. Standalone-node planned live migration and cluster recovery are different requirements.
Which CPU capability is important for GPU-P live migration?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
IOMMU DMA bit tracking is required. Examples include AMD EPYC 7003 or later and fourth-generation Intel Xeon Scalable processors.
What is the GPU-P distinction between AMD EPYC 7002 and 7003 processors?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
EPYC 7002 supports GPU partitioning but not its live migration. EPYC 7003 or later is an example of migration-capable DMA bit-tracking hardware.
What NVIDIA driver requirement applies to GPU-P live migration?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use the driver supplied with NVIDIA vGPU Software v18.x or later, along with supported GPU hardware and required licensing.
What does a Paravirtualization GPU status in Windows Admin Center indicate?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The partition-capable driver exists, but server SR-IOV is not enabled. Complete firmware configuration before proceeding with partition assignment.
How do you select a GPU's partition count?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Inspect ValidPartitionCounts with Get-VMHostPartitionableGpu and choose one of the OEM-supported values. Arbitrary partition counts are not supported.
What must remain homogeneous across GPU-P migration destinations?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use compatible matching GPU make/model, capacity, and partition count across hosts. Heterogeneous GPU configurations are unsupported for this design.
What transport impact should be planned for GPU-P live migration?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Hyper-V falls back to TCP/IP with compression for migration with a GPU partition. Budget CPU and network headroom and allow for longer migrations.
Can one physical GPU simultaneously provide DDA and GPU-P?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
No. Choose either complete-device assignment or partitioning for that GPU; their host ownership models differ.
What additional state does a standard Hyper-V checkpoint capture?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It captures VM memory and device state along with disk/configuration state. Restoring it can resume old in-memory application state.
How do Windows production checkpoints obtain consistent disk state?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
They use supported guest VSS coordination rather than capturing live memory. Guest writers and backup integration must work.
How does restoring a production checkpoint differ from restoring a standard checkpoint?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
A production checkpoint restores consistent disk state and the VM starts from off. A standard checkpoint can resume saved memory/device state.
What is the difference between Production and ProductionOnly checkpoint settings?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Production may fall back to a standard checkpoint if the production mechanism fails. ProductionOnly fails instead of taking a standard checkpoint.
Where do new virtual-disk writes go after a checkpoint is created?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
They go into a differencing child, commonly an AVHDX file, preserving the earlier parent state. The child and parent remain part of one dependency chain.
What happens when a checkpoint is removed through Hyper-V management?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Hyper-V merges required disk changes and removes the checkpoint safely. Do not manually delete AVHDX files from the disk chain.
Why is a checkpoint insufficient as an independent backup?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It depends on the VM's storage and disk chain. Loss of that storage can remove both the current VM and all checkpoints.
Which command prevents standard-checkpoint fallback?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use Set-VM -Name 'APP01' -CheckpointType ProductionOnly. Verify the setting before creating the required checkpoint.
What operational risks grow when checkpoints remain for a long time?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Differencing files consume storage and complicate chain/merge management. Monitor capacity, verify recovery, and remove checkpoints when their short-term purpose ends.
What happens to a clustered Hyper-V VM after its host fails?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The failover cluster can restart the VM on another node with accessible storage and sufficient resources. An unplanned restart does not preserve the failed host's live memory.
What must be done to make an existing Hyper-V VM a cluster-managed role?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Place its files on supported resilient storage and add it to the prepared cluster, for example with Add-ClusterVirtualMachineRole -VMName 'APP01'.
What storage arrangements commonly support highly available Hyper-V VMs?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use supported resilient storage accessible by the eligible nodes, such as Cluster Shared Volumes or appropriate SMB 3 storage. Storage Spaces Direct can supply clustered storage in a supported design.
Why are consistently named virtual switches important on cluster nodes?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The VM must find the intended compatible network attachment after migration or failover. Matching names alone still requires matching uplink, VLAN, and network design.
What does live migration provide during planned Hyper-V host maintenance?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It moves a running VM to another prepared host with a brief final handoff. It cannot transfer live state from a host that has already failed.
What capacity should surviving Hyper-V cluster nodes retain?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Enough CPU, startup RAM, storage access, and network capacity for the planned failure tolerance. Idle Dynamic Memory minimums do not establish failover capacity.
What is the role of a quorum witness in a Hyper-V cluster?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It participates in quorum decisions so the cluster can maintain a valid majority. It does not store the VMs or add compute capacity.
How does guest clustering differ from Hyper-V host clustering?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Guest clustering protects an application through nodes inside VMs. Host clustering manages VM availability and placement at the virtualization layer.
Why should a Hyper-V failover cluster be validated before production deployment?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Validation tests the intended hardware, storage, networking, and cluster configuration for compatibility. Resolve relevant failures before relying on automatic recovery.
How do fixed and dynamically expanding Hyper-V disks differ?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
A fixed disk allocates its configured space up front; a dynamic disk grows its file as data is written toward its maximum. Both present a configured virtual capacity to the guest.
What is a differencing virtual disk's key dependency?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It stores changes relative to a parent disk and needs that parent to interpret unchanged blocks. Protect the chain and avoid modifying its parent outside the supported workflow.
What does Resize-VHD change?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It changes the virtual disk's capacity. Expanding the disk does not automatically extend the guest's partition or filesystem.
Which Hyper-V disk formats can Resize-VHD expand and shrink?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It can expand VHD and VHDX, but shrink only VHDX. A shrink cannot go below the VHDX MinimumSize.
What attachment supports the documented online resize path for a Hyper-V VHDX?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use a supported VHDX attached to the VM's SCSI chain. An IDE-attached disk requires the VM to be offline.
What must happen inside Windows after its Hyper-V disk is expanded?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Rescan if necessary and extend the partition into suitable adjacent unallocated space. The guest volume is a separate layer from VHDX capacity.
How does compacting a dynamic disk differ from reducing virtual capacity?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Compacting reclaims eligible unused space in the disk file. Resizing changes the virtual capacity visible to the guest; these are different operations.
Which PowerShell command shows a VHDX's resize information?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Get-VHD returns properties such as virtual Size, FileSize, and MinimumSize. Use the correct property for capacity, physical file usage, or shrink limits.
Why should you check host free space before growing a dynamically expanding VHDX?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The file may consume additional real storage as the guest writes data. A large virtual maximum does not reserve or guarantee enough host disk space.
What should be checked before moving or editing disks with checkpoints?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Identify the attached differencing chain and supported management operation. Manipulating a base disk alone can omit current changes or break checkpoint dependencies.
What does Connect-VMNetworkAdapter configure?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It attaches a VM's virtual NIC to the named Hyper-V virtual switch. Guest IP configuration is a separate task.
What does access VLAN mode provide to a VM adapter?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It associates the adapter with one VLAN. The virtual and physical switch configuration must agree with the intended network.
When should a VM adapter use trunk VLAN mode?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use it for a suitable guest or appliance that handles multiple VLAN tags. Configure the allowed VLAN list and native VLAN deliberately.
What does DHCP Guard block on a Hyper-V VM adapter?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It blocks DHCP-server traffic from that guest. Do not enable it on an authorized VM that must serve DHCP clients.
What traffic is Router Guard intended to restrict?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Router Guard restricts router advertisement and redirect messages sent by the VM. It is distinct from DHCP Guard, which filters DHCP-server traffic.
Why might MAC address spoofing be enabled for a VM adapter?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
A justified appliance or nested-guest design may need traffic with source MAC addresses different from the assigned VM NIC MAC. Enable it only for the intended requirement.
What VM-adapter feature supports capturing another VM's traffic for analysis?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Port mirroring copies traffic from configured source ports to a designated destination port. Configure the capture guest and switch relationships appropriately.
What prerequisites should be checked for Hyper-V SR-IOV networking?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Check physical NIC, firmware, switch configuration, and guest driver support. Enabling a virtual setting cannot add missing hardware capability.
How do you verify a Hyper-V VM's VLAN and switch attachment?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Inspect Get-VMNetworkAdapter and Get-VMNetworkAdapterVlan for the VM, then compare its intended guest IP network and physical path.
What does Switch Embedded Teaming combine on a Hyper-V host?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
SET integrates supported physical-NIC teaming with the Hyper-V virtual switch, providing uplink resilience and aggregate traffic distribution.
Which teaming mode does SET support?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
SET operates switch-independently. It does not use LACP port-channel negotiation; configure physical switch ports for the selected design.
What adapter consistency is required for a SET team?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use matched adapters with compatible manufacturer/model, speed, firmware, driver, and configuration. Do not build the supported design from arbitrary dissimilar uplinks.
How do you create a vSwitch with SET on two prepared uplinks?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use New-VMSwitch -Name 'Production' -NetAdapterName 'NIC1','NIC2' -EnableEmbeddedTeaming $true. Include the appropriate management-OS sharing choice.
Which command inspects a virtual switch's embedded team?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Get-VMSwitchTeam -Name 'Production' displays the embedded team's configuration and member information.
Does a two-uplink team guarantee twice one uplink's speed for a single flow?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
No. It improves aggregate capacity and failover, but distribution algorithms and flow placement limit an individual flow's throughput.
What host-side permission enables supported teaming of a VM's virtual adapters?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Set-VMNetworkAdapter -VMName 'APP01' -AllowTeaming On permits the guest teaming behavior. Create the actual supported team inside Windows separately.
Why should guest teamed NICs lead to independent paths?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Two adapters sharing the same failed uplink, switch, or host have that common failure boundary. Teaming does not remove shared dependencies or survive host loss by itself.
How should SET and legacy LBFO be distinguished in a new Hyper-V design?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
SET is embedded in the vSwitch and is the modern host design; LBFO is the separate older teaming mechanism. Continued LBFO cmdlet availability does not establish that an LBFO-backed vSwitch is the preferred current configuration.
Which Hyper-V switch type connects VMs to the physical network?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
An external switch uses a physical Ethernet adapter. The uplink, VLAN, and surrounding network determine actual connectivity.
Which Hyper-V switch type allows VM-to-host communication without a physical uplink?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
An internal switch connects the VMs and the host's virtual adapter. It does not automatically provide routing or NAT to external networks.
Which Hyper-V switch type excludes the host management OS from the connected network?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
A private switch connects attached VMs to each other only. It does not create a host virtual adapter for that network.
What does AllowManagementOS control on an external switch?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It allows the host management OS to share the physical uplink through a virtual adapter. It does not automatically configure every guest's addressing.
Where should host IP settings normally be placed after an external vSwitch takes over its shared uplink?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Configure the appropriate management vEthernet adapter. The physical adapter is now bound into the virtual-switch uplink design.
Does creating an internal virtual switch automatically configure NAT?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
No. Configure a host virtual-adapter address, a NAT object, and suitable guest addresses and gateway separately.
What network layer does the Hyper-V Virtual Switch primarily implement?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It is a software Layer 2 Ethernet switch with extensible security and traffic policies. A switch alone does not supply Layer 3 routing services.
What should be prepared before changing an external switch over a remote management connection?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Maintain console access or another management path because uplink binding and host network changes can interrupt the current session.
What recovery need does Hyper-V Replica address?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It keeps an asynchronous VM copy on another host or cluster for disaster recovery. It does not require the source and replica to share storage.
Which replication intervals does Hyper-V Replica support?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The documented choices are 30 seconds, 5 minutes, or 15 minutes. Actual recovery-point age can worsen when replication backlog accumulates.
How do Kerberos and certificate-based Replica connections differ?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Kerberos uses HTTP, normally port 80, without transport encryption. Certificate-based HTTPS, normally port 443, provides encrypted transport and needs appropriate certificate trust.
Why is a Hyper-V Replica Broker used for a receiving cluster?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It supplies a cluster endpoint and directs replication toward the node owning the VM. The VM may change owners without requiring a fixed individual-node endpoint.
How can initial Hyper-V Replica data be seeded?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Use immediate or scheduled network transfer, external media, or a suitable existing restored initial copy. Choose based on dataset size and available bandwidth.
What does a Hyper-V Replica test failover create?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
It creates a temporary isolated test copy at the replica site. The primary continues operating and replication continues while recovery is validated.
What does successful planned Replica failover require?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Stop the primary, transfer remaining changes, and complete the coordinated role switch. A successful planned failover can avoid data loss.
What data risk exists during unplanned Replica failover?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
Changes not sent to the replica can be lost. Select the recovery point and prevent the old primary from becoming a competing active copy.
What is the topology of extended Hyper-V replication?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
The primary replicates to a replica, which replicates onward to a third host. It is not two independent direct replication targets from the primary.
Why must a Replica recovery test include DNS, networking, and application dependencies?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
A healthy disk-replication status does not prove the recovered service can be reached or authenticated. Validate recovery-site addressing and dependency startup as well.
Where should persistent workload data be stored on an Azure Windows VM?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Use suitable persistent managed data disks or another durable service. A size-provided temporary/resource disk is scratch storage and can lose its contents.
How does an ephemeral OS disk differ from a persistent managed OS disk?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
An ephemeral OS disk uses local VM storage for replaceable instances. A persistent managed OS disk retains OS data independently of the host-local lifecycle.
Which Azure disk classes are data-only rather than OS-disk choices?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Ultra Disk and Premium SSD v2 are data-only choices. Check size, region, redundancy, and other compatibility requirements before selecting them.
What guest work is needed after attaching a new Azure managed data disk?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Bring the disk online, initialize it appropriately, create a volume, and format it inside Windows. Azure attachment alone does not make a usable filesystem.
What two layers must be changed to expand an Azure Windows data volume?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Increase the Azure disk capacity, then extend the guest partition/filesystem into the additional space. Follow attachment and online-expansion support for the chosen disk.
Can an Azure managed disk normally be shrunk as the reverse of expansion?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
No. To reduce required capacity, provision a suitable smaller disk and migrate data using a supported process.
What performance limits should be compared when an Azure disk is throttled?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Compare the individual disk's IOPS/throughput limits with the VM's aggregate disk limits and guest workload behavior. A faster disk cannot bypass the VM ceiling.
What host-caching limitation applies to Ultra Disk and Premium SSD v2?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
They do not support host caching. For other supported disk types, select cache mode according to application guidance.
Why are independent disk snapshots insufficient proof of multi-disk application consistency?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Separate snapshots do not automatically coordinate all database disks and transactions. Use an application-consistent recovery process for that requirement.
What does zone-redundant disk storage provide?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Supported ZRS disks replicate across availability zones for disk resilience. ZRS does not automatically start another VM or create an application replica.
What is vertical scaling for an Azure VM?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
It changes VM size and associated CPU, RAM, and supported resource limits. A resize normally restarts the VM and must satisfy compatibility and capacity constraints.
What checks should precede an Azure VM resize?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Check target SKU availability, regional/family quota, placement capacity, attached disk/NIC limits, and feature compatibility. Plan restart or required deallocation.
Why can an Azure resize require deallocation first?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
The target size may be unavailable on the current hardware cluster. Deallocation permits placement elsewhere and can affect temporary data and allocation-dependent resources.
How does Stopped differ from Deallocated for Azure compute billing?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Stopped can retain host allocation and incur compute charges. Deallocated releases compute allocation; persistent disks and other resources may still incur charges.
What is horizontal scaling for an Azure application?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
It adds or removes instances instead of changing one VM's size. The application must handle multiple instances and use an appropriate load-balancing/state design.
What does a VM scale set provide beyond creating several independent VMs?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
It provides instance orchestration, scaling, health, and upgrade controls. Configure image/model, networking, initialization, and scaling behavior for the workload.
How do Uniform and Flexible scale-set instance management differ?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Uniform manages scale-set-specific instances from a common VM profile. Flexible orchestrates standard Azure IaaS VMs that support standard VM management APIs.
What should an autoscale policy specify?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Define metrics or schedules, minimum and maximum capacity, scale actions, and suitable timing/cooldown behavior. Verify the workload metric and instance initialization.
Does scale-set autoscale replicate stateful application data automatically?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
No. Design data, sessions, and consistency separately using suitable shared or replicated services; creating more instances does not copy all application state.
What failure boundary does an availability-set fault domain represent?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
It groups VMs sharing infrastructure such as a power source and network switch. Spreading instances reduces correlated infrastructure failure.
What is an availability-set update domain?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
It groups VMs and underlying hardware that can restart together during planned platform maintenance. Azure schedules maintenance across update domains rather than all at once.
What are the documented maximum availability-set domain counts?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
An availability set can have up to three fault domains and twenty update domains, subject to regional/platform support. Plan the counts when creating the set.
Can availability-set domain counts be changed after creation?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
The documented fault/update domain settings cannot be changed after the set is created. Treat them as deployment design choices.
What is an Azure availability zone?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
It is a physically separate datacenter group within a supported Azure region with distinct power, network, and cooling infrastructure.
Does placing one VM in a zone create VM replicas in other zones?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
No. A zonal VM occupies its chosen zone. Deploy multiple workload instances across zones and provide suitable application/data failover.
What extra application configuration is needed with multiple VMs in a set or across zones?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Provide load balancing or application failover, health checks, and suitable data/state handling. Placement isolation alone does not make requests switch to a healthy replica.
How do availability zones differ from cross-region disaster recovery?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Zones isolate failures within one region. A regional disaster requires a separately designed recovery path in another region.
What latency tradeoff can influence availability-set versus zone placement?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Availability-set VMs are closer together and can have lower inter-VM latency. Zones provide broader isolation, so assess latency alongside resilience requirements.
What does just-in-time VM access control in Azure?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
JIT restricts selected management ports and temporarily permits approved source addresses for a requested window through supported NSG/firewall controls.
Which Defender for Servers plan provides JIT machine access?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Defender for Servers Plan 2 provides the feature. Confirm the supported machine and network-control prerequisites as well.
What is configured in a JIT access policy?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Select management ports, permitted source addresses, and maximum access duration. Authorized requests open a time-limited network window.
What does JIT not create for the requester?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
It does not create a route, VPN, guest logon account, or guest OS permission. Azure authorization to request access and guest authentication remain separate.
Why should existing management-port rules be reviewed before enabling JIT?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Existing higher-priority broad allows can take precedence over JIT restrictions. Review effective NSG and supported firewall behavior.
Does expiry of a JIT window forcibly terminate existing sessions?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
The time window closes the allowed network access configuration, but established connections are not forcibly disconnected merely by expiry.
How does Azure Bastion reach the target VM?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
It connects to the VM's private IP using RDP or SSH. The target VM does not need its own public management IP.
Which Bastion tiers support native-client connections?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Standard and Premium support native SSH/RDP client connections. Verify the chosen feature and connection prerequisites rather than assume all tiers are identical.
Which Bastion SKU supports private-only deployment and session recording?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Premium provides these capabilities. Dedicated Basic, Standard, and Premium designs have requirements different from Developer's shared model.
What guest connectivity is still required when using Bastion?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
The guest must allow the relevant RDP/SSH listener and firewall traffic from the Bastion path, with valid guest authentication. Bastion does not repair a stopped guest service.
Where should a stable primary private IP be configured for an Azure VM?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Set static private allocation on the Azure NIC/IP configuration, then keep Windows aligned with platform provisioning. Do not only hard-code an arbitrary guest address.
Which addresses does Azure reserve in every subnet?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Azure reserves the first four addresses and the final address. For 10.20.0.0/24, these are .0 through .3 and .255.
What network constraint applies to multiple NICs on one Azure VM?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
The NICs must meet the common-VNet constraints and the VM size's NIC-count limit. Use suitable subnets within that supported VNet design.
How are NSG rule priorities evaluated?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Lower numeric priorities are evaluated first, and the first matching rule determines the decision within that NSG. Rules match source/destination, ports, and protocol.
If both subnet and NIC NSGs are associated, which must allow a connection?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Both applicable NSGs must allow it, followed by guest firewall and listener requirements. An allow in one does not override a deny in the other.
What does an NSG's stateful behavior mean for reply traffic?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Allowed flows are tracked; response traffic does not need a separately mirrored rule for every established connection. New flows still undergo applicable rule evaluation.
What configuration is needed when an Azure VM acts as a routed network appliance?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Enable IP forwarding on its Azure NIC and configure forwarding in the guest OS. Provide appropriate routes, reachable next hops, and return paths.
Does VNet peering automatically provide transitive routing through a third VNet?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
No. Design explicit supported transit using appropriate gateways, routing, or appliances; two peering relationships alone are not a transit configuration.
What egress requirement applies to new private subnets with APIs released after March 31, 2026?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
VMs need an explicit outbound method for public endpoints, such as a NAT Gateway or supported firewall/load-balancer/public-IP design. Existing VNets are not automatically changed by this new default.
Which Azure networking evidence helps diagnose a reachable route but blocked VM connection?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
Inspect effective security rules, effective routes, Network Watcher connection diagnostics, and the guest firewall/listener. Separate route reachability from security and application acceptance.
Where is an AD-integrated DNS zone stored?
Networking · Networking | Implement on-premises and hybrid name resolution
It is stored in AD DS, normally in a DNS application directory partition. AD replication carries its records rather than a separate zone-transfer topology between those replicas.
Which servers can host a writable AD-integrated DNS zone?
Networking · Networking | Implement on-premises and hybrid name resolution
Eligible domain controllers running DNS and holding the relevant directory partition can host its writable replicas. A standalone member server does not obtain that directory-backed writable role.
What is the benefit of AD-integrated DNS multi-master updates?
Networking · Networking | Implement on-premises and hybrid name resolution
An eligible writable DNS/DC replica containing the zone can accept updates. A standard file-backed primary/secondary design instead has one writable primary.
How do DomainDnsZones and ForestDnsZones differ?
Networking · Networking | Implement on-premises and hybrid name resolution
They define domain-wide versus forest-wide DNS application-partition replication scope. Select the scope appropriate to which DNS/DC replicas should receive the data.
What zone type supports secure dynamic updates in Windows DNS?
Networking · Networking | Implement on-premises and hybrid name resolution
AD-integrated zones support secure dynamic updates using directory security and record permissions. Ordinary nonsecure updates do not provide the same authenticated ownership control.
Why can a client fail to update an existing secure DNS record?
Networking · Networking | Implement on-premises and hybrid name resolution
The authenticating identity may lack permission or ownership of that record. Inspect the record ACL and the identity performing the update.
Why use dedicated DNS-update credentials on DHCP servers?
Networking · Networking | Implement on-premises and hybrid name resolution
A consistent authorized identity can create and maintain DHCP-managed records, including across failover partners. Mismatched identities can prevent one partner updating another's records.
Which DNS records are especially important for AD domain-controller discovery?
Networking · Networking | Implement on-premises and hybrid name resolution
SRV records advertise services such as LDAP and Kerberos, supported by correct host records. Point domain clients to DNS resolvers that can resolve the AD namespace.
What should be checked when AD-integrated DNS replicas show different records?
Networking · Networking | Implement on-premises and hybrid name resolution
Check zone partition/replication scope, server enrollment, and AD replication health, then distinguish replicated zone data from client/server caches.
How do primary and secondary Windows DNS zones differ?
Networking · Networking | Implement on-premises and hybrid name resolution
A primary is the writable authority for its stored zone. A secondary holds a read-only copy obtained through zone transfer from a master.
What records does a DNS stub zone retain?
Networking · Networking | Implement on-premises and hybrid name resolution
It retains records needed to locate the zone's authority, such as SOA, NS, and necessary glue. It is not a full secondary copy of all host records.
What is the purpose of a reverse lookup zone?
Networking · Networking | Implement on-premises and hybrid name resolution
It supports resolving an IP address to a name, commonly using PTR records. A forward A record alone does not guarantee the corresponding reverse record exists.
What does a DNS A record map?
Networking · Networking | Implement on-premises and hybrid name resolution
It maps a DNS name to an IPv4 address. Use AAAA for IPv6.
What does a DNS CNAME record provide?
Networking · Networking | Implement on-premises and hybrid name resolution
It makes an alias refer to another canonical DNS name. The target still needs appropriate address resolution.
What does a DNS SRV record identify?
Networking · Networking | Implement on-premises and hybrid name resolution
It identifies a service's target host, port, and selection information such as priority/weight. It supports service discovery rather than replacing the target's address record.
What does an NS delegation in a parent DNS zone establish?
Networking · Networking | Implement on-premises and hybrid name resolution
It directs resolution for a child namespace to that child's authoritative servers. Add required glue where the referral needs it.
How should DNS zone transfers be restricted?
Networking · Networking | Implement on-premises and hybrid name resolution
Permit only intended secondary/master participants according to the chosen design. An unrestricted transfer can expose zone data to unnecessary recipients.
How does DNS TTL affect a planned address change?
Networking · Networking | Implement on-premises and hybrid name resolution
It limits how long cached answers may remain usable. Adjusting an authoritative record does not immediately purge every existing resolver cache.
What should be checked when a secondary zone remains stale?
Networking · Networking | Implement on-premises and hybrid name resolution
Check master addresses, zone-transfer permissions, transport/reachability, and zone serial/transfer status. Editing a read-only secondary is not the primary update workflow.
What does a server-level DNS forwarder handle?
Networking · Networking | Implement on-premises and hybrid name resolution
It provides an upstream path for general recursive queries not answered locally or controlled by a more specific applicable path.
What does a conditional DNS forwarder select?
Networking · Networking | Implement on-premises and hybrid name resolution
It sends queries for a specific DNS suffix to configured target DNS servers. Other namespaces can use the normal resolver path.
How does a conditional forwarder differ from a stub zone?
Networking · Networking | Implement on-premises and hybrid name resolution
A conditional forwarder has configured query targets for a suffix. A stub holds authority-locator records learned from the zone's masters.
Can a Windows DNS server host a zone and a conditional forwarder with exactly the same name?
Networking · Networking | Implement on-premises and hybrid name resolution
No. Choose the namespace's hosted-zone or conditional-forwarder role rather than create both for the identical name.
Does authoritative NXDOMAIN normally trigger a public-forwarder retry for the same name?
Networking · Networking | Implement on-premises and hybrid name resolution
No. NXDOMAIN is a terminal negative answer from the applicable authority. It differs from a target timeout or retryable failure.
What are DNS root hints used for?
Networking · Networking | Implement on-premises and hybrid name resolution
They identify starting points for iterative resolution. They can be used when the resolver configuration and time budget permit that path.
When can Windows DNS fall back from unresponsive forwarders to root hints?
Networking · Networking | Implement on-premises and hybrid name resolution
Recursion and root-hint fallback must be enabled, applicable forwarders must be exhausted, and the overall recursion timeout must not already have expired.
What risk does a mutual conditional-forwarder loop create?
Networking · Networking | Implement on-premises and hybrid name resolution
Queries can circulate or time out when each target sends the same suffix back. Ensure each forwarding path terminates at the appropriate authority or resolver.
Which command configures a general Windows DNS forwarder?
Networking · Networking | Implement on-premises and hybrid name resolution
Set-DnsServerForwarder -IPAddress '10.10.0.10','10.10.0.11' sets upstream servers. Inspect Get-DnsServerForwarder to verify the intended configuration.
Which transport paths should be allowed between a resolver and its DNS forwarders?
Networking · Networking | Implement on-premises and hybrid name resolution
Allow the required UDP and TCP port 53 paths. TCP can be needed for large or truncated DNS responses and other DNS operations.
What does an Azure DNS Private Resolver inbound endpoint receive?
Networking · Networking | Implement on-premises and hybrid name resolution
It receives DNS queries at a private IP in Azure, allowing on-premises resolvers to forward Azure-private namespaces through private connectivity.
What does a Private Resolver outbound endpoint do?
Networking · Networking | Implement on-premises and hybrid name resolution
It forwards matching queries toward target DNS servers through a configured forwarding ruleset. Ruleset links determine which VNets use that path.
What must be linked for an Azure Private DNS zone to resolve in a VNet context?
Networking · Networking | Implement on-premises and hybrid name resolution
Create the appropriate virtual-network link to the private zone. Peering alone does not automatically link every private zone.
What subnet design is required for Private Resolver endpoints?
Networking · Networking | Implement on-premises and hybrid name resolution
Use dedicated endpoint subnets delegated to Microsoft.Network/dnsResolvers and meeting current endpoint requirements. Do not treat them as general VM subnets.
What private network connectivity is required between on-premises DNS and Azure resolver endpoints?
Networking · Networking | Implement on-premises and hybrid name resolution
Provide a routed VPN or ExpressRoute path with return routes and DNS transport permitted. Private Resolver does not create that network connection.
How can on-premises Windows DNS resolve an Azure-private namespace through Private Resolver?
Networking · Networking | Implement on-premises and hybrid name resolution
Configure a conditional forwarder for the appropriate suffix pointing to the inbound endpoint's private IP. Link the authoritative Azure private zone to the resolver VNet.
How can Azure clients resolve an on-premises AD DNS suffix through Private Resolver?
Networking · Networking | Implement on-premises and hybrid name resolution
Create a forwarding rule targeting the on-premises DNS servers, associate the outbound endpoint, and link the ruleset to the intended client VNets.
How does custom VNet DNS affect Private Resolver ruleset use?
Networking · Networking | Implement on-premises and hybrid name resolution
Clients query their configured custom DNS servers. Those servers must implement the required forwarding path; a linked ruleset does not silently replace the custom server configuration.
Can an on-premises client directly use 168.63.129.16 as a routed Azure DNS server?
Networking · Networking | Implement on-premises and hybrid name resolution
No. Azure's special resolver address is used within its supported Azure context. Use an inbound resolver endpoint or a suitable Azure DNS-forwarding VM for on-premises queries.
What should be checked when a private endpoint resolves publicly from on-premises?
Networking · Networking | Implement on-premises and hybrid name resolution
Check the service's correct Private Link DNS suffix, private records and VNet links, on-premises conditional forwarding, and the actual resolver the client uses.
What is still unproven after a hybrid name resolves to the correct private address?
Networking · Networking | Implement on-premises and hybrid name resolution
Routing, security rules, guest/application listening, and authorization still require verification. A DNS answer alone does not prove service connectivity.
What is a Windows DNS zone scope?
Networking · Networking | Implement on-premises and hybrid name resolution
It is a distinct record set within one zone. The same name can have different addresses in different scopes.
What is a Windows DNS recursion scope?
Networking · Networking | Implement on-premises and hybrid name resolution
It contains recursion behavior and forwarder settings. Policies can select it for queries that require recursive resolution.
What does a DNS client-subnet object provide for policy?
Networking · Networking | Implement on-premises and hybrid name resolution
It names an IPv4/IPv6 subnet criterion that policies can match. The authoritative server must see source information that matches the intended criterion.
How can DNS policy implement split-brain answers?
Networking · Networking | Implement on-premises and hybrid name resolution
Create different scoped records for the same name and select the appropriate scope using criteria such as client subnet or server interface.
Which criteria can Windows DNS query policies use?
Networking · Networking | Implement on-premises and hybrid name resolution
They can match client subnet, queried name/type, server interface, transport or IP protocol, and time-of-day conditions. Configure applicable policy scope and order deliberately.
How do DNS policy DENY and IGNORE actions differ?
Networking · Networking | Implement on-premises and hybrid name resolution
DENY rejects the matching query, while IGNORE drops it without a normal answer. IGNORE can therefore appear to a client as a timeout.
Do DNS policy definitions replicate with an AD-integrated zone?
Networking · Networking | Implement on-premises and hybrid name resolution
No. Scoped zone data can replicate, but policy definitions are local to each DNS server. Configure policies on every server that must apply them.
Which zone scope supports dynamic updates and scavenging?
Networking · Networking | Implement on-premises and hybrid name resolution
The default scope supports these functions. Nondefault scopes require their own record-management plan.
Why is weighted DNS distribution different from a health-aware load balancer?
Networking · Networking | Implement on-premises and hybrid name resolution
DNS replies are cached and policy weights distribute answers rather than probe each application instance. Cached clients may continue using a failed target.
What should be created before a policy references a nondefault zone scope?
Networking · Networking | Implement on-premises and hybrid name resolution
Create the scope and its required resource records, plus any named client-subnet criteria. Then configure the policy and test matching and default behavior.
What security properties does DNSSEC provide?
Networking · Networking | Implement on-premises and hybrid name resolution
It provides authenticated origin, data integrity, and authenticated denial of existence for DNS data. It does not encrypt DNS queries or application traffic.
How does DNSSEC differ from secure dynamic DNS updates?
Networking · Networking | Implement on-premises and hybrid name resolution
DNSSEC validates signed answers. Secure dynamic updates authorize changes to zone records; the two protect different stages of DNS operation.
What does an RRSIG record contain?
Networking · Networking | Implement on-premises and hybrid name resolution
It contains a digital signature for a DNS resource-record set. A validator checks it against the appropriate public key and trust chain.
What does a DNSKEY record publish?
Networking · Networking | Implement on-premises and hybrid name resolution
It publishes a zone's public signing key. Possessing a key alone is not enough unless the validator trusts it through an anchor or authenticated chain.
What role does a DS record play in DNSSEC?
Networking · Networking | Implement on-premises and hybrid name resolution
A parent-zone DS links the child to the authenticated delegation chain. Signing a child does not automatically install the needed DS in its parent.
How do a DNSSEC ZSK and KSK commonly divide responsibilities?
Networking · Networking | Implement on-premises and hybrid name resolution
The zone-signing key signs ordinary record sets; the key-signing key signs the DNSKEY set. Plan rollover and signature validity for each.
What do NSEC and NSEC3 provide?
Networking · Networking | Implement on-premises and hybrid name resolution
They support authenticated denial of existence. NSEC3 uses hashed names but is not general encryption or complete confidentiality.
What does a validating DNS resolver need for trust?
Networking · Networking | Implement on-premises and hybrid name resolution
It needs a configured trust anchor or an authenticated chain from a trusted parent. Unsigned or broken delegation data can prevent required validation.
How can Windows clients be required to check DNSSEC validation for a namespace?
Networking · Networking | Implement on-premises and hybrid name resolution
Configure a suitable NRPT rule, commonly through Group Policy, with DNSSEC enabled and validation required. Check the effective client policy.
Does Resolve-DnsName -DnssecOk alone prove successful DNSSEC validation?
Networking · Networking | Implement on-premises and hybrid name resolution
No. It requests DNSSEC data; receiving signatures is different from validating them through a trusted chain and enforcing the required policy.
What should be investigated when DNS works normally but required DNSSEC validation fails?
Networking · Networking | Implement on-premises and hybrid name resolution
Check trust anchors, DS/DNSKEY chain, signature validity and rollover, system time, effective NRPT, and DNS transport handling.
What is the normal initial DHCPv4 message sequence?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Discover, Offer, Request, Acknowledge, commonly called DORA. The exchange obtains an address lease and configuration.
Which UDP ports do DHCPv4 clients and servers normally use?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Clients use UDP 68 and servers use UDP 67. Permit the required client, relay, and server paths.
What network-address prerequisite should a Windows DHCP server have?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Configure a suitable static IPv4 address for the server before deploying the role. It needs a stable reachable endpoint.
Which command installs the Windows DHCP role and management tools?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Install-WindowsFeature -Name DHCP -IncludeManagementTools installs the role/tools. Authorization and usable scopes are configured separately.
Why authorize a Windows DHCP server in an AD environment?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Authorization registers the permitted DHCP server in AD for the Windows DHCP service's domain checks. It is not a physical network block against every rogue device.
Which commands register and verify Windows DHCP authorization?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Add-DhcpServerInDC registers the server's DNS name and address. Get-DhcpServerInDC lists authorized servers.
Why is a DHCP relay needed across a routed subnet boundary?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Initial client broadcasts normally do not cross routers. The relay forwards requests and supplies subnet context so the server can select the correct scope.
What must exist beyond the installed role before clients receive useful leases?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
The service must be ready and authorized where required, bound to the intended interface, and have an active scope with free addresses and correct options.
Does deploying Windows DHCP in Azure replace Azure VM primary address provisioning?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
No. Azure's platform supplies supported primary NIC addressing; configure Azure NIC allocation appropriately. On-premises broadcast/relay behavior is a separate design.
What initial evidence should ipconfig /all provide during an addressing investigation?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Inspect address, subnet mask, gateway, DNS servers, DHCP server, and lease details. Compare them with the intended network before changing configuration.
What does an automatically assigned IPv4 169.254.x.x address commonly indicate?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
The client did not obtain a usable DHCP lease and selected link-local addressing. The address alone does not identify whether the server, relay, path, or client failed.
How can a wrong subnet mask affect off-subnet traffic?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
The client may consider a remote destination local and ARP for it instead of using the gateway. Verify prefix/mask as well as the IP address.
What symptom suggests a gateway/path problem rather than only DNS?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Same-subnet communication works but remote destinations fail by IP. Verify gateway, routes, firewall behavior, and return paths before focusing on DNS.
What symptom suggests a DNS problem after basic routing works?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
The required destination succeeds by IP but fails by its expected name. Verify the actual resolver and record path, then test the application with its required hostname.
Why should on-premises and Azure hybrid address spaces normally be nonoverlapping?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Overlapping prefixes create ambiguous or unsupported routing relationships in the intended VPN/peering design. Plan distinct prefixes and valid return routes.
What does Network Watcher IP flow verify report?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
It evaluates specified TCP/UDP traffic against applicable NSG and security-admin rules, returning allowed/denied and the matching rule. It does not prove the guest application is listening.
Why is a failed ping insufficient to prove a TCP application is unreachable?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
ICMP may be blocked while the application's TCP port works. Test the required destination and port and inspect the applicable security path.
What can cause one-way hybrid connectivity despite a source-side route?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
The remote network may lack a return route, or a stateful firewall/appliance path may be asymmetric. Check both directions rather than only the outbound route.
What configuration defines an IPv4 DHCP scope?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
It defines a subnet lease range, mask, exclusions, lease duration, and options. The range must fit the intended subnet and available addressing plan.
What is the purpose of a DHCP exclusion range?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
It prevents listed pool addresses from being offered dynamically, commonly protecting infrastructure addresses assigned statically.
What must be done before a correctly configured new DHCP scope serves clients?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Activate the scope and verify service/authorization, reachability, and free-address capacity. A saved inactive scope does not offer normal leases.
What does DHCP option 003 configure?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
It supplies the client's router/default gateway. Set it to the appropriate gateway for that scope's subnet.
What does DHCP option 006 configure?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
It supplies DNS server addresses. Domain clients should receive resolvers able to locate the AD namespace.
What does DHCP option 015 configure?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
It supplies the DNS domain/suffix used by clients. It does not replace DNS server addresses or a default gateway.
What is the purpose of a DHCP superscope?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
It groups scopes for a multinet arrangement on one physical network. It does not create VLANs, routing, or new physical broadcast domains.
What lease-duration tradeoff applies to transient-client networks?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Shorter leases can free unused addresses sooner but cause more renewal traffic. Choose duration from client turnover, capacity, and operational needs.
Why inspect effective client options rather than only server-level defaults?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
More specific scope, policy, or reservation settings may override inherited values. Verify what the affected client actually receives.
What does a DHCP IPv4 reservation associate?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
It associates a selected scope address with a particular client identifier, commonly the NIC's MAC address. The server leases that address to the matching client.
How does a reservation differ from manually configured static addressing?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
A reserved device remains a DHCP client and obtains a lease and options from DHCP. A manual static address is configured locally without that lease-selection process.
What must a device support to use a DHCP reservation?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
It must use DHCP and send the matching identifier. A device configured only with a manual static IP does not request the reserved lease.
Which command creates a DHCP IPv4 reservation?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Add-DhcpServerv4Reservation uses ScopeId, IPAddress, and ClientId to reserve an address. Use the identifier actually presented by the client.
What should be verified before choosing the ClientId for a reservation?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Inspect the actual client/lease identifier rather than guess from a label or another adapter. The request must match the configured identifier.
Why can replacing a network adapter break a reservation match?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
The client may present a different MAC/client identifier. Update the reservation deliberately after verifying the new identifier.
How can MAC randomization affect reservations?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
A changing client identifier may no longer match the intended reservation. Use a supported stable identifier/configuration for clients needing predictable leased addresses.
Does a reservation remove the need for DHCP availability?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
No. The reserved device still depends on DHCP for lease acquisition and renewal; an already valid lease can remain usable until its limits require renewal.
What should happen to reservation changes in a DHCP failover deployment?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Replicate the changed scope configuration from the intended source to the partner. Lease synchronization alone does not guarantee the partner received a new reservation setting.
How many partners can share one Windows DHCP failover-enabled scope?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Two DHCP servers participate in that scope's failover relationship. A server can have other relationships, but one scope cannot have three failover partners.
Which IP protocol version supports Windows DHCP scope failover?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
The described failover protocol supports DHCPv4 scopes. DHCPv6 availability requires a different supported design.
How does DHCP failover load balance mode operate?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Both partners normally serve clients according to the configured distribution ratio, commonly 50:50. They synchronize lease information.
How does hot standby DHCP failover differ?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
One partner normally serves the scope; the other is standby with a reserve for the appropriate failure behavior. It suits local service backed by another site.
What does maximum client lead time protect?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
MCLT limits lease extension beyond information known to the partner and supports safe takeover timing. It helps prevent duplicate address assignment during disrupted communication.
Why does Communication Interrupted not prove a DHCP partner is dead?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
The server-to-server connection failed, but the partner may still serve clients. Follow safe lease-ownership rules and verify failure before forcing Partner Down.
What permits full-pool takeover after a confirmed DHCP partner failure?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
The appropriate Partner Down state and required MCLT waiting behavior permit safe use of the full pool. A lost link alone does not authorize immediate unsafe reuse.
Which TCP port is used for DHCP failover partner communication?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
TCP 647 carries failover messages. DHCP client/relay UDP paths must also remain available to both partners.
What happens to scope configuration during initial failover creation?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
The configured source scopes are created on the partner as part of relationship setup. Start from the intended source rather than conflicting independently configured full scopes.
Are later DHCP scope/options/reservation changes automatically equivalent to lease synchronization?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
No. Replicate configuration changes explicitly from the intended source to the partner, for example using Invoke-DhcpServerv4FailoverReplication.
Why should DHCP relays target both failover partners?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Clients must reach the surviving server as well as the normal one. Healthy partner synchronization cannot compensate for a relay pointing only to a failed endpoint.
What identity and clock prerequisites matter for DHCP failover?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
Keep partner clocks synchronized and use matching authorized DNS-update credentials when they update secure DNS. Otherwise setup/state or record updates can fail.
Which protocols can Azure Files shares provide?
Storage and file services · Storage and file services | Configure and manage Azure Files
SMB and NFS. Select a supported protocol, media tier, billing model, region and redundancy for the workload; one share is not simultaneously an SMB and NFS share.
What distinguishes direct Azure Files access from Azure File Sync?
Storage and file services · Storage and file services | Configure and manage Azure Files
Direct clients mount a cloud file share. File Sync synchronizes that share with Windows Server endpoints that provide local access and optional caching.
Which network port does a normal SMB Azure Files mount require?
Storage and file services · Storage and file services | Configure and manage Azure Files
TCP 445. A private endpoint or VPN changes the network path but does not change the SMB port.
What must DNS return when an Azure Files client uses a private endpoint?
Storage and file services · Storage and file services | Configure and manage Azure Files
The storage account file endpoint name must resolve through the private-link DNS design to the intended private IP. Correct routing and storage firewall access are also required.
What availability failure does ZRS protect Azure Files against?
Storage and file services · Storage and file services | Configure and manage Azure Files
An availability-zone failure within the primary region. Geo-redundancy additionally replicates asynchronously to another region and can lose recent writes during failover.
Can an HDD Azure file share be converted directly into an SSD share?
Storage and file services · Storage and file services | Configure and manage Azure Files
No. Create a supported SSD share and migrate the data; changing access tier within an eligible HDD billing model is a different operation.
What does an Azure Files share snapshot provide?
Storage and file services · Storage and file services | Configure and manage Azure Files
A point-in-time read-only view useful for recovery. It does not replace a planned retention, backup and disaster-recovery strategy.
Does Azure Files permit reading the secondary endpoint of an RA-GRS account?
Storage and file services · Storage and file services | Configure and manage Azure Files
No. Azure Files does not expose read access to the secondary; RA-GRS file shares are treated and billed as geo-redundant shares.
Which three user identity sources can Azure Files use for SMB authentication?
Storage and file services · Storage and file services | Configure and manage Azure Files
AD DS, Microsoft Entra Domain Services, or Microsoft Entra Kerberos. Only one user identity source can be enabled per storage account.
What two authorization layers govern ordinary identity-based Azure Files access?
Storage and file services · Storage and file services | Configure and manage Azure Files
Share-level permission and directory/file Windows ACLs. A grant at one layer does not normally remove restrictions at the other.
Does Azure resource Contributor automatically permit reading Azure Files over SMB?
Storage and file services · Storage and file services | Configure and manage Azure Files
No. Management-plane resource rights differ from data-plane share roles and file ACLs. Assign appropriate data access explicitly.
What does Storage File Data SMB Share Reader allow?
Storage and file services · Storage and file services | Configure and manage Azure Files
Read access at the share gate, further limited by file and directory ACLs. It cannot grant writes even if a file ACL allows them.
What is Storage File Data SMB Share Elevated Contributor intended to add?
Storage and file services · Storage and file services | Configure and manage Azure Files
It adds permission modification to normal read/write/delete capabilities at the share gate. Appropriate file ACL authority remains required; it is not the privileged ACL-bypass role.
What does a default Azure Files share permission apply to?
Storage and file services · Storage and file services | Configure and manage Azure Files
All authenticated users of the configured identity source and all shares in the storage account. It is broad and must be combined with carefully scoped file ACLs.
Do Microsoft Entra Kerberos users need a domain-controller connection for each Azure Files authentication?
Storage and file services · Storage and file services | Configure and manage Azure Files
No. Entra issues Kerberos tickets; hybrid identities still need AD DS connectivity for Windows ACL administration. Current support includes eligible updated cloud-only Windows clients.
How are cloud-only Entra identities assigned Azure Files directory permissions?
Storage and file services · Storage and file services | Configure and manage Azure Files
Use supported cloud-only ACL management such as the Azure portal or RestSetAcls. Do not assume ordinary on-premises AD SID lookup supplies cloud-only identities.
Why should storage account keys not be the routine user access mechanism?
Storage and file services · Storage and file services | Configure and manage Azure Files
Keys provide broad shared access rather than individual identity-based permissions. Kerberos and scoped data roles/ACLs provide more suitable user access controls.
What does an Azure File Sync sync group connect?
Storage and file services · Storage and file services | Configure and manage Azure Files
One Azure Files cloud endpoint and one or more Windows Server endpoints sharing a synchronized namespace.
What is a File Sync server endpoint?
Storage and file services · Storage and file services | Configure and manage Azure Files
A path on a registered supported Windows Server NTFS volume. It is not simply an arbitrary network SMB share.
Which transport carries File Sync synchronization to Azure?
Storage and file services · Storage and file services | Configure and manage Azure Files
HTTPS over TCP 443. Local clients can still access the server endpoint using SMB; those are separate connections.
What is cloud tiering in Azure File Sync?
Storage and file services · Storage and file services | Configure and manage Azure Files
Cold content can be replaced locally by placeholders while the full dataset remains in Azure Files. Reading tiered data triggers recall.
What does a 20 percent cloud-tiering free-space policy mean?
Storage and file services · Storage and file services | Configure and manage Azure Files
The service aims to keep 20 percent of the volume free. It does not mean retain 20 percent of the dataset locally.
Which cloud-tiering policy takes priority when local space is constrained?
Storage and file services · Storage and file services | Configure and manage Azure Files
The volume free-space policy takes precedence over the optional date policy. Policy evaluation is periodic.
Which File Sync data remains readable during an internet outage?
Storage and file services · Storage and file services | Configure and manage Azure Files
Fully cached local content remains readable. Tiered content requiring recall needs Azure connectivity.
Where should a tiered File Sync dataset normally be backed up?
Storage and file services · Storage and file services | Configure and manage Azure Files
Back up the Azure file share, or a fully hydrated supported endpoint without tiered files. Ordinary placeholder backups can skip content or cause mass recall.
Why can direct changes to the cloud endpoint appear locally later than server changes?
Storage and file services · Storage and file services | Configure and manage Azure Files
Cloud changes first require change detection; the documented regular cloud change-detection job runs once every 24 hours.
What does an Online registered File Sync server prove?
Storage and file services · Storage and file services | Configure and manage Azure Files
It communicates with the service. It does not prove every endpoint or file has synchronized successfully.
Which File Sync event records a completed sync session and its result?
Storage and file services · Storage and file services | Configure and manage Azure Files
Telemetry event 9102 records completed sessions. Correlate endpoint, timestamps, result and persistent per-file errors.
Which File Sync event helps determine whether an active session is progressing?
Storage and file services · Storage and file services | Configure and manage Azure Files
Event 9302 shows active-session progress. Compare applied-item counts over time rather than treating a long session as automatically stuck.
Which File Sync event records per-item sync errors?
Storage and file services · Storage and file services | Configure and manage Azure Files
Event 9121. Use its filename and error details to investigate individual files that failed while other files synchronized.
Where are local File Sync agent telemetry logs found?
Storage and file services · Storage and file services | Configure and manage Azure Files
Event Viewer under Applications and Services Logs, Microsoft, FileSync, Agent. Use the telemetry channels relevant to the symptom.
Which counters expose File Sync transfer and operation activity?
Storage and file services · Storage and file services | Configure and manage Azure Files
AFS Bytes Transferred and AFS Sync Operations in Performance Monitor. Compare them with session events and workload demand.
What can unexpectedly high cloud-tiering recall bytes indicate?
Storage and file services · Storage and file services | Configure and manage Azure Files
A scanner, indexer, backup, or changed working set may be recalling cold files. Correlate the timing with local processes and cache policy.
What File Sync conditions are useful Azure Monitor alert signals?
Storage and file services · Storage and file services | Configure and manage Azure Files
Offline registered servers, files not syncing, unsuccessful sessions, low disk-space mode, agent expiry and abnormal recalls. Configure endpoint dimensions and action groups.
Which DFS component can remain when migrating DFS Replication to File Sync?
Storage and file services · Storage and file services | Configure and manage Azure Files
DFS Namespaces can retain the stable user path. File Sync replaces replication; it does not replace namespace referrals.
What should be validated before using a DFS-R member as the initial File Sync seed?
Storage and file services · Storage and file services | Configure and manage Azure Files
Confirm that it has the complete, healthy intended dataset, appropriate ACLs, and supported local storage.
Should cloud tiering be enabled on the initial DFS-R migration endpoint?
Storage and file services · Storage and file services | Configure and manage Azure Files
Start with tiering disabled and let the complete cloud upload finish before later tiering enablement.
When are remaining DFS-R members introduced as File Sync endpoints?
Storage and file services · Storage and file services | Configure and manage Azure Files
After the first dataset upload and server registration, disable DFS-R as prescribed, then create the remaining endpoints with tiering disabled.
Why must active DFS-R overlap with File Sync be tightly controlled during migration?
Storage and file services · Storage and file services | Configure and manage Azure Files
Two replication systems acting on the same tree can conflict. Follow the documented transition instead of leaving multiple active overlapped locations.
Can a DFS-R read-only replicated folder be a File Sync endpoint?
Storage and file services · Storage and file services | Configure and manage Azure Files
No. Do not use the read-only DFS-R folder as an Azure File Sync endpoint.
Which configuration is separate from migrating the replicated file content?
Storage and file services · Storage and file services | Configure and manage Azure Files
DFS namespace targets, SMB share permissions, user mappings and backup policies need explicit validation or update.
Why does rollback after new-target writes require reconciliation?
Storage and file services · Storage and file services | Configure and manage Azure Files
The retired source no longer contains those writes. Switching referrals back without copying accepted changes can lose user work.
What inventory should precede a migration to Azure Files?
Storage and file services · Storage and file services | Configure and manage Azure Files
Measure capacity, file count, churn, paths, ACLs, unsupported metadata, open-file behavior and performance requirements.
When is direct SMB migration preferable to File Sync migration?
Storage and file services · Storage and file services | Configure and manage Azure Files
Use direct migration when users will access Azure Files without retaining a Windows Server cache. File Sync fits retained local SMB/cache needs.
Does copying files recreate SMB share permissions and DFS configuration?
Storage and file services · Storage and file services | Configure and manage Azure Files
No. Recreate or redirect share access, namespace targets, mapped drives and backup policies separately.
What does RoboCopy /COPYALL request during migration?
Storage and file services · Storage and file services | Configure and manage Azure Files
/COPYALL requests data, attributes, timestamps, security ACLs, ownership and auditing (/COPY:DATSOU). For Azure Files, the documented migration command uses /COPY:DATSO; do not assume auditing information or every NTFS feature is preserved.
Why is RoboCopy /MIR significant for an existing target?
Storage and file services · Storage and file services | Configure and manage Azure Files
It mirrors and deletes target entries missing from the source. Review target ownership and deletion impact before using it.
How are RoboCopy exit codes interpreted?
Storage and file services · Storage and file services | Configure and manage Azure Files
They are bitmasks. Values below 8 can indicate successful copying with differences; 8 or higher indicates at least one failure to investigate.
What cutover sequence reduces downtime during a share migration?
Storage and file services · Storage and file services | Configure and manage Azure Files
Perform an initial copy and incremental passes, freeze source writes, finish the final delta, validate and redirect clients.
What should validate a successful file-share migration beyond copy counts?
Storage and file services · Storage and file services | Configure and manage Azure Files
Sample contents, supported metadata, effective ordinary-user access, application workflows, performance and recovery configuration.
Which permission layers constrain ordinary remote Windows SMB access?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Both the SMB share permissions and filesystem ACLs. Local file access does not traverse the share permission gate.
What does access-based enumeration do for a share?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
It hides entries users cannot enumerate. It does not replace the underlying file permissions or grant access.
Which cmdlet creates a Windows SMB share?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
New-SmbShare exposes an existing directory and can configure share permissions and properties. Set the directory ACL separately.
Which cmdlet displays SMB share permissions?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Get-SmbShareAccess. Compare its results with the directory ACL when diagnosing effective access.
What does the EncryptData SMB share setting require?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
It requires encryption for access to that share. Confirm the client supports the necessary SMB encryption capability.
Does a dollar sign at the end of an SMB share name secure it?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
No. It hides the share from normal browsing, while explicit UNC access still depends on authentication and permissions.
Which cmdlet identifies server-side files open over SMB?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Get-SmbOpenFile identifies open handles and their clients. Use it to distinguish locks from permission denial.
Why does mirrored disk storage not by itself make an SMB share highly available?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Disk redundancy does not recover the file server service or host. Use a supported clustered file-server architecture for service availability.
Which filesystem is supported by FSRM?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
NTFS. FSRM does not support ReFS volumes.
How does an FSRM folder quota differ from an NTFS per-user quota?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
FSRM limits the folder tree regardless of file owner. NTFS disk quotas measure usage by user on a volume.
What does a hard FSRM quota do?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
It blocks growth beyond its configured limit. Threshold notifications can warn before enforcement occurs.
What does a soft FSRM quota do?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
It measures and can notify when thresholds are reached but does not block writes beyond the limit.
What is an auto-apply FSRM quota used for?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
It automatically creates template-based quotas on existing and newly created subfolders, such as home directories.
How do active and passive FSRM file screens differ?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Active screening blocks configured file-name patterns. Passive screening records/notifies without preventing the write.
Why is an extension-based file screen not malware detection?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
It matches filename patterns rather than proving file content or safety. Renaming a file can bypass simple extension matching.
What can FSRM classification and file-management tasks provide?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
They classify files using configured properties/rules and perform conditional actions such as an approved expiration workflow. They do not replace access ACLs.
What does DFS Namespaces provide?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
A stable logical UNC path and referrals to underlying SMB folder targets. It does not itself copy the targets files.
Where is domain-based DFS namespace metadata stored?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
In AD DS. Multiple namespace servers can improve root availability; the data targets need their own availability design.
What does a DFS folder target identify?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
An underlying UNC share location that can serve a namespace folder. Validate direct share access and content before adding interchangeable targets.
Why might a client keep using an old DFS target after configuration changes?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
DFS referrals are cached. Check the client referral cache and refresh behavior as well as the namespace configuration.
How does DFS Replication differ from DFS Namespaces?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
DFS-R asynchronously synchronizes replicated folders; DFS-N routes users to folder targets. Either role can exist without the other.
What does Remote Differential Compression do for DFS-R?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
It identifies changed portions of files to reduce transfer. It is not distributed file locking or a mechanism that merges conflicting edits.
What does the primary member mean during DFS-R initialization?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Its content seeds initial replication. It is not a permanent single writer after initialization.
Why are continuously open databases unsuitable for ordinary DFS-R replication?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
DFS-R cannot replicate a file while it remains open and does not provide application-level transactional consistency.
Which filesystem does DFS-R require for replicated folders?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
NTFS. It relies on NTFS capabilities such as the change journal and does not support ReFS replicated folders.
What transport and default port does SMB over QUIC use?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
A TLS 1.3 encrypted QUIC tunnel over UDP 443. SMB authorization still applies inside the tunnel.
Which Windows Server editions support SMB over QUIC?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Server 2022 requires Datacenter: Azure Edition. Server 2025 or later supports any edition; Windows 11 is the standard client.
Is SMB over QUIC enabled automatically on a capable file server?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
No. An administrator must opt in and configure a suitable server certificate mapping.
What certificate name requirement applies to SMB over QUIC?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
DNS subject alternative names must match the names clients use. The trusted server certificate also requires a private key and Server Authentication usage.
How can a Windows client explicitly require QUIC when mounting SMB?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Use New-SmbMapping -TransportType QUIC or NET USE /TRANSPORT:QUIC. Otherwise clients normally attempt TCP before QUIC.
How should SMB over QUIC be configured on Windows Server 2025 under current guidance?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Use PowerShell server certificate mapping cmdlets. The documented Windows Admin Center configuration method is not currently supported for Server 2025.
Why can renewed certificates require an SMB over QUIC configuration update?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Renewal changes the certificate thumbprint. Update the server certificate mapping to the new valid certificate.
What does optional SMB QUIC client access control add?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Device admission based on trusted client certificates and allow/deny rules. Passing admission does not grant the user share or file access.
How are conflicting QUIC client certificate allow and deny entries resolved?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Any deny for a checked certificate in the client chain takes priority over an allow. Access entries identify certificate hashes with SHA-256.
How do SMB signing and encryption differ?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Signing protects message integrity and authenticity. Encryption additionally protects data confidentiality in transit; signing alone does not hide file content.
What SMB property can require encryption for one share?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
EncryptData. Server/client-wide encryption policies are a separate scope and must be supported by the peers.
What does SMB dialect negotiation select?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
The highest mutually supported allowed dialect. Policy restrictions and peer capabilities determine whether a connection can be established.
Which cmdlets inspect local SMB client and server configuration?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Get-SmbClientConfiguration and Get-SmbServerConfiguration. Get-SmbConnection displays negotiated active client connections.
Which SMB feature discovers multiple suitable paths and RDMA capability?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
SMB Multichannel. Disabling it prevents SMB Direct even when RDMA adapters are installed.
What protection was introduced with SMB 3.1.1 preauthentication integrity?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
It protects the negotiation and session-setup exchange against tampering. It does not replace later content encryption.
What signing default applies to Windows Server 2025 in current guidance?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
Outbound SMB signing is required by default. Inspect effective settings and distinguish it from Windows 11 24H2 client-edition defaults.
Why can SMB by an IP address fail after NTLM is blocked?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
The normal Kerberos service-name path may not be used. Correct DNS/SPN naming rather than treating IP connectivity as authentication proof.
When is SMB compression most beneficial?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
For sufficiently compressible data and a suitable CPU/network tradeoff. Already compressed content can offer little benefit.
What is the normal order from a new disk to a usable file volume?
Storage and file services · Storage and file services | Configure Windows Server storage
Identify the disk, bring it online as appropriate, initialize, partition, format and assign a drive letter or mount point. A share is optional and separate.
Why is GPT normally selected for a modern large data disk?
Storage and file services · Storage and file services | Configure Windows Server storage
GPT supports large disks and many partitions. MBR has a roughly 2-TiB addressability limit with conventional sector sizes.
Which identifiers should be checked before initializing a disk?
Storage and file services · Storage and file services | Configure Windows Server storage
Check disk number together with unique ID or serial number, capacity and existing partition state. Disk numbering alone can change.
What is a volume mount point?
Storage and file services · Storage and file services | Configure Windows Server storage
A volume attached under an empty NTFS directory instead of a drive letter. It helps organize many volumes without consuming letters.
What must be expanded before extending a guest partition?
Storage and file services · Storage and file services | Configure Windows Server storage
The underlying physical/virtual disk or LUN must expose additional capacity. Then extend the supported partition/filesystem into usable free space.
Why can a thin-provisioned volume report free space when writes fail?
Storage and file services · Storage and file services | Configure Windows Server storage
Its backing pool may have exhausted physical capacity. Monitor pool free space separately from filesystem free space.
What can an offline shared SAN disk indicate?
Storage and file services · Storage and file services | Configure Windows Server storage
Ownership or SAN policy may intentionally keep it offline. Verify cluster ownership and disk identity before changing state.
Which filesystem cannot be shrunk under current Windows Server support?
Storage and file services · Storage and file services | Configure Windows Server storage
ReFS cannot be shrunk. NTFS supports shrinking subject to supported layout and immovable-data constraints.
How do a Storage Spaces pool and virtual disk differ?
Storage and file services · Storage and file services | Configure Windows Server storage
A pool groups eligible physical capacity. A virtual disk consumes that capacity with a chosen layout; Windows then partitions and formats it.
Which Storage Spaces layout provides no disk-failure redundancy?
Storage and file services · Storage and file services | Configure Windows Server storage
Simple layout stripes data without protection. It is suitable only when loss is acceptable or the data is reproducible.
What capacity cost does a two-way mirror normally impose?
Storage and file services · Storage and file services | Configure Windows Server storage
It stores two copies, so usable capacity is roughly half raw capacity before metadata and repair headroom. Placement must support the intended failure tolerance.
When is parity often appropriate for Storage Spaces?
Storage and file services · Storage and file services | Configure Windows Server storage
Capacity-sensitive, predominantly read or archive workloads. Parity generally has greater write overhead than mirroring.
How does fixed provisioning differ from thin provisioning?
Storage and file services · Storage and file services | Configure Windows Server storage
Fixed provisioning allocates backing capacity up front. Thin provisioning allocates as data grows and requires independent monitoring of real pool capacity.
Which cmdlets inspect Storage Spaces physical and virtual health?
Storage and file services · Storage and file services | Configure Windows Server storage
Get-PhysicalDisk, Get-StoragePool and Get-VirtualDisk show device, pool and virtual-disk state. Get-StorageJob shows repairs.
Why may adding one disk not enable every virtual disk to expand?
Storage and file services · Storage and file services | Configure Windows Server storage
Columns, resiliency and placement requirements determine usable allocation. Total raw free capacity alone does not prove a supported expansion is possible.
What should be verified after replacing a failed pooled drive?
Storage and file services · Storage and file services | Configure Windows Server storage
Confirm repair-job completion and restored virtual-disk resiliency, not merely that the filesystem is mounted. Retain independent backups.
What storage does Storage Spaces Direct pool?
Storage and file services · Storage and file services | Configure Windows Server storage
Eligible directly attached drives across failover-cluster nodes, using a software storage bus. It differs from a conventional shared SAN.
Which Windows Server edition is required for S2D?
Storage and file services · Storage and file services | Configure Windows Server storage
Windows Server Datacenter. Azure Local is a separately managed related solution, not simply the same licensing and deployment model.
How do hyperconverged and disaggregated S2D designs differ?
Storage and file services · Storage and file services | Configure Windows Server storage
Hyperconverged nodes run Hyper-V and storage together. Disaggregated storage nodes provide Scale-Out File Server shares to separate compute hosts.
What networking does the S2D deployment guidance require?
Storage and file services · Storage and file services | Configure Windows Server storage
High-bandwidth, low-latency networking with at least 10-GbE. RDMA is recommended and needs compatible adapters, drivers and network configuration.
Why is cluster validation required before enabling S2D?
Storage and file services · Storage and file services | Configure Windows Server storage
It checks hardware, storage, network and system suitability, including S2D tests. A successful role installation does not establish a supported cluster.
What does Enable-ClusterStorageSpacesDirect do?
Storage and file services · Storage and file services | Configure Windows Server storage
It enables the clustered storage system, discovers eligible drives and configures the pool/cache and storage tiers.
What do Cluster Shared Volumes provide in hyperconverged S2D?
Storage and file services · Storage and file services | Configure Windows Server storage
They give clustered Hyper-V hosts supported access to shared storage volumes for VM files, coordinated by the cluster.
Why does S2D still need quorum and witness planning?
Storage and file services · Storage and file services | Configure Windows Server storage
Data resiliency and cluster voting are different. Enough data copies do not ensure the cluster can remain operational after node failures.
What should be checked before another S2D node enters maintenance?
Storage and file services · Storage and file services | Configure Windows Server storage
Current faults, repair jobs, fault-domain protection, capacity and quorum. Drain workloads and follow supported storage maintenance procedures.
At what layer does Storage Replica replicate?
Storage and file services · Storage and file services | Configure Windows Server storage
Volume blocks, below the file layer. It can replicate open-file changes but provides crash consistency rather than automatic application-transaction consistency.
When does synchronous Storage Replica acknowledge a write?
Storage and file services · Storage and file services | Configure Windows Server storage
After the remote replication log durably records it. This protects acknowledged writes when the remote destination survives but adds round-trip latency.
What recovery-point tradeoff does asynchronous Storage Replica make?
Storage and file services · Storage and file services | Configure Windows Server storage
It acknowledges locally before remote confirmation, allowing higher latency/distance while recent unreplicated writes can be lost.
Which Storage Replica topologies are supported?
Storage and file services · Storage and file services | Configure Windows Server storage
Server-to-server, cluster-to-cluster and stretched cluster. Application failover design is separate from the replication partnership.
Why does Storage Replica need separate fast log volumes?
Storage and file services · Storage and file services | Configure Windows Server storage
The replication logs are part of the write path and require suitable performance and capacity. They should not host unrelated workloads.
What does Test-SRTopology assess?
Storage and file services · Storage and file services | Configure Windows Server storage
The proposed workload, storage, bandwidth and latency for replication. Use its report before committing to a partnership.
What restrictions apply to Storage Replica on Server Standard 2019 and later?
Storage and file services · Storage and file services | Configure Windows Server storage
One replicated volume up to 2 TB. Datacenter removes those edition limits.
Can users normally write directly to an active Storage Replica destination volume?
Storage and file services · Storage and file services | Configure Windows Server storage
No. Direct ordinary access would conflict with incoming block changes; supported test-failover snapshots are a separate capability.
Why does Storage Replica not replace retained backups?
Storage and file services · Storage and file services | Configure Windows Server storage
Replication also copies deletions, corruptions and malicious writes. Retained recovery points protect against those changes.
How does Data Deduplication reduce storage consumption?
Storage and file services · Storage and file services | Configure Windows Server storage
It stores repeated data chunks once and replaces duplicate ranges with references, while applications normally see their original logical files.
What happens immediately when deduplication is enabled on a volume?
Storage and file services · Storage and file services | Configure Windows Server storage
The volume becomes eligible for scheduled/background optimization. Existing files are not instantly all optimized.
What does a deduplication usage type select?
Storage and file services · Storage and file services | Configure Windows Server storage
Workload-specific defaults for optimization behavior. Select a supported workload and evaluate suitability rather than assuming all VM/database files qualify.
What does a deduplication garbage-collection job reclaim?
Storage and file services · Storage and file services | Configure Windows Server storage
Chunks no longer referenced by optimized files. It differs from optimization, which finds and consolidates repeated content.
What does deduplication scrubbing do?
Storage and file services · Storage and file services | Configure Windows Server storage
It checks chunk-store integrity and attempts supported repair. Monitor its results rather than equating savings with integrity.
Does disabling deduplication expand already optimized files?
Storage and file services · Storage and file services | Configure Windows Server storage
No. Use a supported unoptimization workflow with adequate free capacity to expand optimized data.
From which Windows Server release can Data Deduplication support ReFS?
Storage and file services · Storage and file services | Configure Windows Server storage
Windows Server 2019, in supported configurations. FSRM and DFS-R still independently require NTFS.
Does dedup optimization itself trigger DFS-R file-content replication?
Storage and file services · Storage and file services | Configure Windows Server storage
No. Optimization changes physical representation rather than logical file content; DFS-R uses its own RDC transfer mechanism.
What should be checked when expected deduplication savings are low?
Storage and file services · Storage and file services | Configure Windows Server storage
File age, exclusions, job completion, resource limits and data characteristics. Already compressed or encrypted content often yields low savings.
What capability does SMB Direct use?
Storage and file services · Storage and file services | Configure Windows Server storage
Remote Direct Memory Access on suitable network adapters, providing high throughput with low latency and reduced CPU overhead.
Which SMB feature is required to discover and use RDMA paths?
Storage and file services · Storage and file services | Configure Windows Server storage
SMB Multichannel. Without it, SMB uses TCP even if the adapters support RDMA.
Which endpoints must support RDMA for SMB Direct?
Storage and file services · Storage and file services | Configure Windows Server storage
Both client and server need compatible enabled RDMA adapters, drivers and network paths.
Does attaching an RDMA NIC to a Hyper-V virtual switch automatically give guest vNICs RDMA?
Storage and file services · Storage and file services | Configure Windows Server storage
No. Ordinary guest virtual adapters do not automatically expose the host adapter RDMA capability.
Which PowerShell check identifies enabled RDMA-capable adapters?
Storage and file services · Storage and file services | Configure Windows Server storage
Get-NetAdapterRdma. Combine it with SMB interface and multichannel connection checks while traffic is active.
Which counters demonstrate actual SMB Direct data movement?
Storage and file services · Storage and file services | Configure Windows Server storage
SMB Direct Connection Bytes RDMA Read/sec and Bytes RDMA Written/sec. Adapter capability alone does not prove traffic uses RDMA.
What changed for encrypted SMB Direct in Server 2022 and Windows 11?
Storage and file services · Storage and file services | Configure Windows Server storage
Encryption supports direct data placement with modest performance overhead. Earlier encryption performance limitations must not be applied universally.
What should be checked if SMB falls back to TCP despite RDMA adapters?
Storage and file services · Storage and file services | Configure Windows Server storage
Multichannel, enabled RDMA, adapter/driver support, selected interfaces, routing and RDMA-type-specific network configuration.
What does clustered Storage QoS control?
Storage and file services · Storage and file services | Configure Windows Server storage
Storage performance goals and limits for VM VHD/VHDX flows on supported Hyper-V CSV or Scale-Out File Server storage.
What does MaximumIOPS represent in Storage QoS?
Storage and file services · Storage and file services | Configure Windows Server storage
A ceiling on normalized IOPS for the assigned policy scope. It can constrain a noisy workload.
What limits the ability to satisfy MinimumIOPS?
Storage and file services · Storage and file services | Configure Windows Server storage
Actual workload demand and available storage capacity. A reservation cannot create physical throughput that the storage system lacks.
What does an Aggregated Storage QoS policy share?
Storage and file services · Storage and file services | Configure Windows Server storage
One allocation of IOPS and bandwidth among all assigned flows. It is useful for a tenant or multi-VM application budget.
What does a Dedicated Storage QoS policy provide?
Storage and file services · Storage and file services | Configure Windows Server storage
Independent allocations for assigned VM/disk groupings rather than one cross-tenant shared allocation. Multiple disks with the same policy on one VM can share its allocation.
How many normalized operations is a 256-KiB I/O with the default 8-KiB normalization?
Storage and file services · Storage and file services | Configure Windows Server storage
32 normalized operations. Normalized IOPS therefore differs from raw request count for large I/O.
How is a cluster Storage QoS policy attached to a VM disk?
Storage and file services · Storage and file services | Configure Windows Server storage
Set the disk QoSPolicyID using the storage cluster policy GUID, such as with Set-VMHardDiskDrive.
What does InsufficientThroughput mean in Storage QoS?
Storage and file services · Storage and file services | Configure Windows Server storage
A flow demands its assigned minimum but storage cannot satisfy it. Investigate contention and physical limits rather than increasing the minimum blindly.
Why can a QoS policy become invalid after a VM disk moves to another cluster?
Storage and file services · Storage and file services | Configure Windows Server storage
The referenced policy GUID may not exist on the destination storage cluster. Recreate or reassign a suitable destination policy.
Which filesystem is supported for a Windows boot volume?
Storage and file services · Storage and file services | Configure Windows Server storage
NTFS. ReFS is not supported as a bootable Windows filesystem.
How does ReFS detect corruption?
Storage and file services · Storage and file services | Configure Windows Server storage
It checksums metadata and can use optional integrity streams for file data. File-data checksumming is not automatically implied for every file.
What enables ReFS to repair detected corruption automatically?
Storage and file services · Storage and file services | Configure Windows Server storage
A healthy alternate copy in a supported resilient storage configuration, such as mirrored or parity Storage Spaces. Detection alone cannot recreate missing data.
What does ReFS block cloning accelerate?
Storage and file services · Storage and file services | Configure Windows Server storage
Supported file-range copy operations by sharing existing blocks instead of duplicating all data immediately; virtualization and backup tools can benefit.
Which filesystem should be selected for File Sync, DFS-R or FSRM?
Storage and file services · Storage and file services | Configure Windows Server storage
NTFS. Those services have their own filesystem requirements; ReFS integrity features do not remove them.
Which filesystem supports built-in disk quotas and volume shrinking?
Storage and file services · Storage and file services | Configure Windows Server storage
NTFS. Current ReFS does not support built-in disk quotas or shrinking.
Can both NTFS and ReFS data volumes use BitLocker?
Storage and file services · Storage and file services | Configure Windows Server storage
Yes. Volume encryption is distinct from the filesystem feature differences.
What version distinction matters for EFS on ReFS?
Storage and file services · Storage and file services | Configure Windows Server storage
Current documentation adds ReFS EFS support on Windows Server 2025. Do not assume that support applies to older Server releases.
What must be checked before moving a ReFS volume to an older host?
Storage and file services · Storage and file services | Configure Windows Server storage
The host must support the volume ReFS format version and workload. Newer format features are not automatically readable on older releases.
What does iSCSI present to an initiator?
Storage and file services · Storage and file services | Configure Windows Server storage
Block storage using SCSI commands over TCP, normally port 3260. The resulting LUN appears as a disk rather than an SMB directory.
How do an iSCSI initiator and target differ?
Storage and file services · Storage and file services | Configure Windows Server storage
The initiator consumes storage; the target presents LUNs/virtual disks and authorizes intended initiators.
What is an iSCSI IQN used for?
Storage and file services · Storage and file services | Configure Windows Server storage
It identifies an initiator or target for discovery/authorization. The identifier itself is not a secret credential.
Does CHAP encrypt iSCSI data?
Storage and file services · Storage and file services | Configure Windows Server storage
No. CHAP authenticates peers; protected networks or supported IPsec designs provide transport confidentiality.
What is a persistent iSCSI connection intended to do?
Storage and file services · Storage and file services | Configure Windows Server storage
Reconnect to the target after restart. Confirm the initiator service and saved session settings before relying on boot-time storage.
What does MPIO provide for suitable iSCSI storage?
Storage and file services · Storage and file services | Configure Windows Server storage
Coordinated multiple independent paths to the same storage device. Additional uncoordinated sessions are not equivalent to a configured multipath design.
Can two ordinary independent servers safely write the same NTFS iSCSI LUN concurrently?
Storage and file services · Storage and file services | Configure Windows Server storage
Not without a supported clustering/application ownership design. Concurrent uncoordinated filesystem ownership risks corruption.
What should be examined for intermittent iSCSI disconnects?
Storage and file services · Storage and file services | Configure Windows Server storage
TCP reachability, target mapping, initiator authorization, MPIO paths, driver/firmware health and iScsiPrt/Disk/StorPort events on host and array.
What layer does BitLocker protect?
Storage and file services · Storage and file services | Configure Windows Server storage
A volume data at rest. It does not replace file ACLs or SMB encryption after the volume is unlocked.
What does a TPM-based BitLocker protector bind unlocking to?
Storage and file services · Storage and file services | Configure Windows Server storage
Expected boot integrity measurements. Firmware, Secure Boot or boot-configuration changes can cause recovery.
Why should recovery escrow be planned before enabling BitLocker?
Storage and file services · Storage and file services | Configure Windows Server storage
A lost protector or changed boot state can otherwise make data inaccessible. Verify authorized retrieval, not only successful encryption.
When is used-space-only encryption especially suitable?
Storage and file services · Storage and file services | Configure Windows Server storage
A new sanitized volume, because it encrypts allocated data as it is written. A reused volume can contain recoverable old plaintext in unused sectors.
How does suspending BitLocker differ from decrypting?
Storage and file services · Storage and file services | Configure Windows Server storage
Suspension temporarily changes protector enforcement while data remains encrypted. Decryption converts the volume back to plaintext.
Which cmdlet inspects BitLocker volume status and protectors?
Storage and file services · Storage and file services | Configure Windows Server storage
Get-BitLockerVolume. Distinguish conversion status, protection status and protector identifiers.
Which cmdlet backs up a selected recovery-password protector to AD DS?
Storage and file services · Storage and file services | Configure Windows Server storage
Backup-BitLockerKeyProtector with the mount point and KeyProtectorId. Confirm the correct protector and actual escrow policy.
What should follow an approved firmware change made with BitLocker suspended?
Storage and file services · Storage and file services | Configure Windows Server storage
Resume protection and verify normal unlocking and protection status. Confirm any revised recovery information is securely stored.
Which identifier should match a BitLocker recovery password to a locked volume?
Storage and file services · Storage and file services | Configure Windows Server storage
Match the displayed recovery key ID to the corresponding escrow record. A computer can have several historical recovery protectors.
Which cmdlet can unlock a data volume with its recovery password?
Storage and file services · Storage and file services | Configure Windows Server storage
Unlock-BitLocker -MountPoint D: -RecoveryPassword <48-digit-password>. Obtain the matching password through an authorized secure process.
What should be investigated after a BitLocker recovery prompt is resolved?
Storage and file services · Storage and file services | Configure Windows Server storage
Identify firmware/TPM/boot/policy changes or storage problems that triggered it, then verify protection and rotate used recovery credentials as required.
What can repair-bde do for a severely damaged BitLocker drive?
Storage and file services · Storage and file services | Configure Windows Server storage
Salvage decryptable data to a separate output volume/image using valid key material. It is not a way to bypass missing encryption keys.
What extra input can repair-bde need when BitLocker metadata is corrupted?
Storage and file services · Storage and file services | Configure Windows Server storage
A matching key package in addition to the recovery password or key. The package is bound to the corresponding volume.
What happens to a repair-bde output volume?
Storage and file services · Storage and file services | Configure Windows Server storage
Its contents are overwritten by recovered decrypted data. Use a reviewed separate target and preserve any existing target data first.
What encryption-state limitation applies to repair-bde?
Storage and file services · Storage and file services | Configure Windows Server storage
It cannot repair a drive that failed during encryption or decryption and assumes the source was fully encrypted.
What key material is needed to recover EFS files?
Storage and file services · Storage and file services | Configure Windows Server storage
The user EFS certificate/private key or a valid Data Recovery Agent private key. Taking ownership does not supply decryption material.
What threat does exploit protection primarily reduce?
Security · Security | Secure Windows Server operating system
It applies process mitigations that make exploitation of vulnerable software harder. It complements malware detection and software execution controls.
What does Data Execution Prevention do?
Security · Security | Secure Windows Server operating system
DEP prevents execution from memory marked for data. It does not decide which publishers are allowed to install software.
What does Address Space Layout Randomization do?
Security · Security | Secure Windows Server operating system
ASLR changes memory layout so useful addresses are harder for an exploit to predict. Application/platform support influences its effectiveness.
What does Control Flow Guard constrain?
Security · Security | Secure Windows Server operating system
CFG restricts indirect control-flow transfers to valid targets. It addresses exploit behavior rather than general file reputation.
How do program-specific and system exploit mitigations relate?
Security · Security | Secure Windows Server operating system
System settings provide defaults, and a program-specific configuration can override them. Inspect the targeted executable's effective settings.
Why target an exact executable path rather than just its file name?
Security · Security | Secure Windows Server operating system
A path narrows the configuration to the intended program location. Name-only targeting can affect other executables with the same name.
Is audit mode available for every exploit mitigation?
Security · Security | Secure Windows Server operating system
No. Only supported mitigations offer audit behavior; confirm the selected mitigation before planning a nonblocking pilot.
How can exploit protection settings be deployed with Group Policy?
Security · Security | Secure Windows Server operating system
Export a tested configuration as XML and deploy it with Use a common set of exploit protection settings. Targets must be able to read the XML.
How should a compatibility failure after mitigation rollout be handled?
Security · Security | Secure Windows Server operating system
Identify the failing mitigation and use a narrow tested exception if necessary. Validate full workflows and process/restart requirements rather than disabling all protections.
What does App Control for Business control?
Security · Security | Secure Windows Server operating system
Code-integrity policy defines which software/code is trusted to run. It can cover kernel/user-mode code and other supported script/installer paths.
What is the operational difference between App Control audit and enforcement?
Security · Security | Secure Windows Server operating system
Audit permits untrusted code while recording events. Enforcement blocks disallowed code and records relevant events.
What OS requirement applies to the OSConfig App Control workflow?
Security · Security | Secure Windows Server operating system
It requires production-signed Windows Server 2025 and the OSConfig module. This specific workflow is not a generic deployment method for earlier Server releases.
Are OSConfig App Control audit policies automatically configured by installing Windows Server 2025?
Security · Security | Secure Windows Server operating system
No. Administrators must configure the desired policies; installation alone does not enable the documented audit scenarios.
Why can a hash allow rule break after a legitimate application update?
Security · Security | Secure Windows Server operating system
The file's hash changes with new content. Properly scoped publisher rules can accommodate signed updates, but must avoid excessive trust.
Why review audit events before enforcement?
Security · Security | Secure Windows Server operating system
They reveal legitimate applications, agents, scripts, and update workflows that the policy would block. Use the evidence to refine narrow allow or supplemental rules.
What does citool -lp verify?
Security · Security | Secure Windows Server operating system
It lists code-integrity policies present on the device. Check expected policy names and mode alongside actual execution/events.
How should OSConfig-managed App Control policy be removed?
Security · Security | Secure Windows Server operating system
Use the corresponding Remove-OSConfigDesiredConfiguration scenario. Manual removal can be reversed by OSConfig drift control.
Does an AppLocker allow rule automatically permit code under App Control?
Security · Security | Secure Windows Server operating system
No. AppLocker and App Control have different policy models. Validate the effective App Control policy for the program.
What does Credential Guard isolate?
Security · Security | Secure Windows Server operating system
It uses virtualization-based security to protect supported NTLM hashes, Kerberos TGTs, and domain credentials from access by normal OS processes.
Which Windows Server 2025 machines qualify for default Credential Guard enablement?
Security · Security | Secure Windows Server operating system
Eligible domain-joined, non-DC servers meeting platform requirements qualify unless explicitly disabled. Installation on every server does not guarantee it is running.
Is the Windows Server 2025 default enablement protected with UEFI lock?
Security · Security | Secure Windows Server operating system
No. Default enablement is without UEFI lock, permitting administrative remote disablement.
How does UEFI lock change Credential Guard management?
Security · Security | Secure Windows Server operating system
It strengthens resistance to remote disablement and requires a physical-presence recovery process to remove the lock. Plan this tradeoff before enabling it.
What policy setting configures Credential Guard in a domain GPO?
Security · Security | Secure Windows Server operating system
Turn On Virtualization Based Security under Computer Configuration, Administrative Templates, System, Device Guard includes Credential Guard configuration.
Which reported state confirms Credential Guard is running?
Security · Security | Secure Windows Server operating system
Win32_DeviceGuard.SecurityServicesRunning containing 1 identifies Credential Guard. Check actual running state after the required restart.
Does Credential Guard protect the AD database or local SAM?
Security · Security | Secure Windows Server operating system
No. It does not protect those databases or every voluntarily supplied application credential. DC and local-account protection remain necessary.
Why is Credential Guard not recommended on domain controllers?
Security · Security | Secure Windows Server operating system
Microsoft says it provides no additional protection for the DC's directory secrets and can introduce compatibility problems. The member-server default excludes DCs.
Is Credential Guard supported on Exchange Server?
Security · Security | Secure Windows Server operating system
Enabling it on Exchange Server is unsupported. Validate application-specific compatibility before rollout.
Does default enablement override an earlier explicit disable setting?
Security · Security | Secure Windows Server operating system
No. An explicit disable configured before an update is preserved rather than overwritten by default enablement.
What is SmartScreen application reputation used for?
Security · Security | Secure Windows Server operating system
It evaluates downloaded applications/files and can warn or block suspicious or unrecognized content. It complements antivirus and application execution policy.
What does enabling Configure Windows Defender SmartScreen for Explorer do?
Security · Security | Secure Windows Server operating system
It turns on application reputation and prevents users from turning it off. The chosen warning/bypass behavior determines whether users can proceed.
How does Warn and prevent bypass differ from a bypassable warning?
Security · Security | Secure Windows Server operating system
It prevents users from ignoring the SmartScreen warning. A warning alone can leave an override path.
Does configuring Explorer SmartScreen automatically configure Microsoft Edge?
Security · Security | Secure Windows Server operating system
No. Edge has separate SmartScreen browser policies. Verify each required protection surface.
Which Edge policy prevents continuing past suspicious-site warnings?
Security · Security | Secure Windows Server operating system
Prevent bypassing Windows Defender SmartScreen prompts for sites prevents the relevant site-warning override when enabled.
Which Edge policy prevents ignoring unverified-download warnings?
Security · Security | Secure Windows Server operating system
Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads controls the download-warning override.
What should be checked before applying SmartScreen settings to Windows Server?
Security · Security | Secure Windows Server operating system
Check the deployed OS/browser's supported templates and interactive workflow. Client-only MDM settings should not be assumed supported by every Server release.
Why is SmartScreen not equivalent to a trusted-software allowlist?
Security · Security | Secure Windows Server operating system
Reputation decisions and warnings differ from explicit code-integrity execution rules. Unknown reputation does not necessarily prove malware.
Where should a GPO for member-server OS hardening normally be linked?
Security · Security | Secure Windows Server operating system
Link it to the intended computer OU or another appropriate computer scope. Verify the actual server computer objects are in scope.
Why use a separate security baseline for domain controllers?
Security · Security | Secure Windows Server operating system
DC roles have distinct services, privileges, and dependencies. A member-server configuration should not be assumed suitable for directory servers.
Which kinds of OS controls can domain Group Policy configure?
Security · Security | Secure Windows Server operating system
It can manage supported security options, user rights, advanced auditing, firewall, Defender, and administrative template settings. Scope and platform support still apply.
Why pilot user-right assignment changes before broad rollout?
Security · Security | Secure Windows Server operating system
Changes to local/RDP/service logon can interrupt administration or service operation. Test intended users and recovery access with the effective rights.
How should approved baseline exceptions be managed?
Security · Security | Secure Windows Server operating system
Give them narrow, reviewable scope and rationale, and verify the effective winning values. Competing settings should not silently broaden access.
What proves more than a successful GPO application report?
Security · Security | Secure Windows Server operating system
Check effective local security state and actual administrative/application workflows. A report alone does not establish every control's behavior.
Does an OU-linked account-policy GPO create a separate domain-user password policy?
Security · Security | Secure Windows Server operating system
No. Use domain account policy or fine-grained password policies for domain users; member-server OU policy can affect local accounts.
Why do AD and SYSVOL availability matter to security GPO rollout?
Security · Security | Secure Windows Server operating system
The AD GPO container and SYSVOL template are separate replicated components. A mismatch can leave clients without the intended security settings.
Why should GPO and OSConfig use consistent values for a shared setting?
Security · Security | Secure Windows Server operating system
Competing authorities can repeatedly overwrite each other and cause drift/conflict. Establish a consistent desired value and authority.
Which Windows Server versions support the documented OSConfig security baseline workflow?
Security · Security | Secure Windows Server operating system
Windows Server 2025 is supported. OSConfig does not support earlier Windows Server versions.
Does installing Microsoft.OSConfig apply a security baseline automatically?
Security · Security | Secure Windows Server operating system
No. Install the module, then set the desired scenario for the server's role and verify the result.
Which OSConfig scenario targets a Windows Server 2025 domain controller?
Security · Security | Secure Windows Server operating system
SecurityBaseline/WindowsServer/2025/DomainController is the documented role scenario. Select MemberServer or WorkgroupMember for their respective roles.
What does Set-OSConfigDesiredConfiguration with -Default accomplish?
Security · Security | Secure Windows Server operating system
It applies the scenario's default desired configuration. It is a configuration operation rather than merely a compliance query.
What does Get-OSConfigDesiredConfiguration show?
Security · Security | Secure Windows Server operating system
It reports the desired scenario settings and compliance details, including noncompliance reasons. Check per-setting status after any required restart.
What is OSConfig drift control intended to do?
Security · Security | Secure Windows Server operating system
It maintains managed settings against deviation from the desired configuration. Manual changes can be reapplied to the managed value.
How can an approved OSConfig baseline exception be expressed?
Security · Security | Secure Windows Server operating system
Use the documented scenario-specific setting override, such as -Setting <name> -Value <value>. Verify the installed module's supported parameter syntax.
What must be considered when removing an OSConfig scenario?
Security · Security | Secure Windows Server operating system
Use Remove-OSConfigDesiredConfiguration for that scenario, then verify the resulting state. Do not assume removal restores every historical local choice.
Why can a server role change require reassignment of an Arc-managed security baseline?
Security · Security | Secure Windows Server operating system
If an Arc-connected server changes role, such as becoming a domain controller, delete and reapply the machine-configuration assignment so the platform detects the new role. This concerns the Windows server role, not an Azure RBAC role.
Why should OSConfig baseline rollout include remote-workflow tests?
Security · Security | Secure Windows Server operating system
Baseline restrictions can affect RDP redirection, protocols, authentication, and administration. Compliance should be checked alongside supported operational requirements.
What problem does Windows LAPS address?
Security · Security | Secure Windows Server operating system
It manages unique rotated passwords for designated local administrator accounts, reducing lateral movement from shared local secrets. It can also manage supported DC DSRM passwords.
What one-time AD preparation does Update-LapsADSchema perform?
Security · Security | Secure Windows Server operating system
It extends the forest schema with Windows LAPS attributes. Run it with appropriate schema authority before AD-backed password management.
What does Set-LapsADComputerSelfPermission authorize?
Security · Security | Secure Windows Server operating system
It grants computers permission to update LAPS attributes on their own AD objects at the selected scope. This differs from granting helpdesk password-reading rights.
Which BackupDirectory value stores Windows LAPS passwords in AD DS?
Security · Security | Secure Windows Server operating system
Set BackupDirectory to 2 for Windows Server Active Directory backup.
What domain functional level is required for Windows LAPS AD password encryption?
Security · Security | Secure Windows Server operating system
DFL 2016 or later permits encryption. Earlier DFL can support clear-text AD storage but not this encryption feature.
Does having a Server 2016 DC prevent LAPS encryption at DFL 2016?
Security · Security | Secure Windows Server operating system
No. The DFL permits encryption, but Server 2016 DCs do not support their own Windows LAPS DSRM management. Supported Server 2019-or-later DCs can use that feature.
Does AD password read permission automatically grant decryption?
Security · Security | Secure Windows Server operating system
No. ADPasswordEncryptionPrincipal controls the authorized decryptor when the password is stored. Read rights and encryption authorization are separate.
What is the default ADPasswordEncryptionPrincipal when encryption is enabled?
Security · Security | Secure Windows Server operating system
Domain Admins is the default authorized decryptor unless another supported principal is configured.
How does LAPS identify the default built-in administrator after it is renamed?
Security · Security | Secure Windows Server operating system
It uses the account's well-known RID rather than relying solely on its visible name. A specifically named custom account needs suitable account provisioning.
How do Reset-LapsPassword and Set-LapsADPasswordExpirationTime differ?
Security · Security | Secure Windows Server operating system
Reset-LapsPassword requests immediate local rotation. Changing expiration in AD takes effect when the device next processes the relevant policy/state.
What event confirms a successful LAPS password backup to AD?
Security · Security | Secure Windows Server operating system
Event 10018 in the LAPS Operational log reports successful AD password update. Check backup/decryption status rather than merely policy presence.
What recovery-version boundary applies to Get-LapsADPassword -RecoveryMode?
Security · Security | Secure Windows Server operating system
The documented improved recovery starts with Insider build 27695 and later. Verify the recovery host actually supports the parameter before relying on offline recovery.
How does Defender for Servers differ from Defender Antivirus?
Security · Security | Secure Windows Server operating system
Defender Antivirus provides local malware protection. Defender for Servers is a Defender for Cloud plan integrating server security capabilities such as endpoint detection and posture.
What is Defender for Servers Plan 1 focused on?
Security · Security | Secure Windows Server operating system
It focuses on EDR capabilities through Defender for Endpoint integration. Select Plan 2 when its additional supported capabilities are needed.
What additional scanning capability does Plan 2 provide?
Security · Security | Secure Windows Server operating system
It adds agentless vulnerability, malware, and secrets scanning for supported Azure/AWS/GCP cloud workloads. It does not automatically scan physical on-premises disks without agents.
Does Arc registration alone prove Defender for Endpoint onboarding?
Security · Security | Secure Windows Server operating system
No. Check the selected Defender plan, supported onboarding/provisioning, connectivity, and actual endpoint protection state.
How do current Defender for Servers features collect protection data?
Security · Security | Secure Windows Server operating system
Most use Defender for Endpoint integration and/or agentless scanning. Log Analytics agent or AMA is not a universal prerequisite for current plan features.
What scope difference exists between enabling Plan 1 and Plan 2?
Security · Security | Secure Windows Server operating system
Plan 1 can be enabled at individual server resource scope; Plan 2 cannot. Both can be disabled at resource scope, with normal enablement planned at subscription level.
Does direct MDE onboarding provide every Plan 2 feature on non-Azure servers?
Security · Security | Secure Windows Server operating system
No. It supports all Plan 1 capabilities and applicable additional capabilities; some Plan 2 features require Arc or particular cloud environments.
Is file integrity monitoring automatically fully configured by Plan 2 enablement?
Security · Security | Secure Windows Server operating system
No. It requires configuration after enabling Plan 2, subject to supported environment and onboarding requirements.
What extension is needed for Plan 2 OS configuration assessment?
Security · Security | Secure Windows Server operating system
The machine must have the Azure Machine Configuration extension for that assessment capability. This is separate from EDR onboarding.
What should be inspected when a protected server is missing endpoint alerts?
Security · Security | Secure Windows Server operating system
Check plan scope, supported OS, MDE onboarding/health, outbound connectivity, provisioning, and actual inventory. A running antivirus service alone does not prove EDR integration.
What Windows Firewall profiles can apply?
Security · Security | Secure Windows Server operating system
Domain, Private, and Public profiles govern traffic according to network identification. Domain membership alone does not prove every interface has the Domain profile.
What wins when an explicit block rule conflicts with a normal allow rule?
Security · Security | Secure Windows Server operating system
The explicit block rule takes precedence. Adding another overlapping normal allow does not neutralize it.
Does Windows Firewall support administrator-assigned weighted rule ordering?
Security · Security | Secure Windows Server operating system
No. Effective behavior follows its rule precedence and matching conditions. Do not use a supposed rule-order number to resolve a block.
What should an inbound allow rule match?
Security · Security | Secure Windows Server operating system
Match the required application or listener, protocol, local port, remote scope, and active profile. Keep permissions as narrow as operational requirements allow.
Does opening a firewall port start the corresponding server service?
Security · Security | Secure Windows Server operating system
No. A listener must exist independently. Check the listener and routing as well as effective firewall policy when access fails.
What does a connection security rule control?
Security · Security | Secure Windows Server operating system
It uses IPsec to require or request endpoint authentication and traffic protection. It does not alone grant application traffic permission through the firewall.
How do IPsec Request and Require differ?
Security · Security | Secure Windows Server operating system
Request attempts security but permits unsecured fallback. Require demands matching IPsec security for covered traffic.
What is the difference between IPsec transport and tunnel modes?
Security · Security | Secure Windows Server operating system
Transport protects endpoint traffic; tunnel mode protects traffic between tunnel endpoints. Choose the mode and selectors for the actual topology.
Which commands inspect negotiated IPsec security associations?
Security · Security | Secure Windows Server operating system
Get-NetIPsecMainModeSA and Get-NetIPsecQuickModeSA inspect active associations. Use them with authentication and crypto proposal checks.
Why can a local allow rule fail on a GPO-managed firewall?
Security · Security | Secure Windows Server operating system
The effective policy can exclude local-rule merging or include another matching block. Inspect ActiveStore and applicable profile/filter conditions.
How can different password policies be assigned to domain users inside one domain?
Security · Security | Secure AD DS
Use fine-grained password policies represented by Password Settings Objects. Assign them to user objects or global security groups.
Can a fine-grained password policy be linked directly to an OU?
Security · Security | Secure AD DS
No. Use a global security group representing the population or assign a user directly. OU-linked account policy does not create an FGPP.
Which scope normally controls the default domain-user password policy?
Security · Security | Secure AD DS
Domain-level account policy, usually in the selected domain-root GPO, controls the domain default. Member-server OU account policy can affect local accounts.
Which PSO wins when a user has one direct PSO and another through a group?
Security · Security | Secure AD DS
The directly assigned PSO takes precedence over group-associated PSOs. Verify the user's resultant policy.
How are competing PSOs at the same assignment level prioritized?
Security · Security | Secure AD DS
A lower msDS-PasswordSettingsPrecedence number has higher priority. Do not assume the longest minimum length wins.
Which cmdlet checks a user's resultant fine-grained password policy?
Security · Security | Secure AD DS
Get-ADUserResultantPasswordPolicy returns the user's resultant PSO. Inspect the domain default separately when no applicable PSO is returned.
Why combine password history with a suitable minimum age?
Security · Security | Secure AD DS
History prevents reuse of remembered passwords, while minimum age can prevent immediate cycling through replacements. Select settings with the organization's reset workflow in mind.
Why should reversible password encryption normally remain disabled?
Security · Security | Secure AD DS
It stores password material in a recoverable form and substantially weakens protection. Enable only for a specific unavoidable compatible requirement.
Why should lockout settings be chosen carefully?
Security · Security | Secure AD DS
They can limit repeated attempts but can also be abused to deny service. Diagnose stored old credentials and account usage before treating every lockout as an attack.
What functional-level prerequisite does the current ADAC FGPP deployment guide specify?
Security · Security | Secure AD DS
Its documented workflow specifies Windows Server 2012 or later domain functional level. This is distinct from the feature's historical introduction.
What does Microsoft Entra Password Protection add to AD DS?
Security · Security | Secure AD DS
It adds global and tenant-custom banned-password validation to password changes/resets. Normal domain and FGPP validation still applies.
Where is an on-premises password evaluated for banned terms?
Security · Security | Secure AD DS
The DC agent evaluates it locally using cached policy. The user's password is not sent to Entra ID for live cloud validation.
What is the proxy service's role?
Security · Security | Secure AD DS
It relays policy retrieval between DC agents and Entra ID. It is not the component that evaluates each user password.
Why deploy at least two Password Protection proxies?
Security · Security | Secure AD DS
They provide policy-download redundancy. Agents can keep enforcing cached policy during a temporary proxy outage.
What SYSVOL replication technology is required for DC agents?
Security · Security | Secure AD DS
The domain must use DFS Replication. An installer succeeding in an FRS domain does not mean the product works correctly.
Which DCs must have agents to avoid gaps in password-change enforcement?
Security · Security | Secure AD DS
Deploy agents to writable DCs that process password changes/resets. An unprotected writable DC can allow a request to bypass the component.
How do Audit and Enforced modes differ?
Security · Security | Secure AD DS
Audit logs would-reject passwords while allowing the change. Enforced rejects failures of banned-password validation.
Must DCs have direct internet access for Password Protection?
Security · Security | Secure AD DS
No. They retrieve policy through registered proxies; allow required DC-to-proxy RPC and proxy outbound TLS service connectivity.
What happens during a cloud/proxy outage when a DC has cached policy?
Security · Security | Secure AD DS
It continues evaluating password changes against the cached policy. Lack of live cloud access does not immediately disable local evaluation.
What happens if no cached banned-password policy is available?
Security · Security | Secure AD DS
This component accepts the password and logs a warning, while normal AD password rules still apply. Monitor policy freshness and initial deployment.
How should forest and proxy registration be aligned?
Security · Security | Secure AD DS
Register the forest and its proxies to the same Entra tenant. Each proxy supports DCs from the forest it belongs to.
Can Password Protection Proxy and Microsoft Entra Application Proxy share a host?
Security · Security | Secure AD DS
The documented agent-updater versions are incompatible side by side. Use separate hosts rather than assuming the similarly named proxy products can be coinstalled.
Who should normally be considered for Protected Users membership?
Security · Security | Secure AD DS
Selected human accounts needing stronger credential restrictions, after compatibility testing. Do not use it as a blanket service/computer-account protection group.
What client-version boundary applies to Protected Users protections?
Security · Security | Secure AD DS
Client protections require Windows 8.1 or Windows Server 2012 R2 or later. Older clients do not gain the same local protections merely from group membership.
What domain functional level enables DC-side Protected Users restrictions?
Security · Security | Secure AD DS
Windows Server 2012 R2 or later DFL enables the documented authentication restrictions.
Can Protected Users authenticate with NTLM at the required DFL?
Security · Security | Secure AD DS
No. DC-side restrictions prohibit NTLM for these users, which can break legacy applications that require it.
Which Kerberos encryption readiness matters before adding a user?
Security · Security | Secure AD DS
Ensure the account can use AES keys, commonly by a suitable password change on a compatible DC. DES/RC4 preauthentication is restricted.
How is delegation affected for Protected Users?
Security · Security | Secure AD DS
Members cannot use constrained or unconstrained Kerberos delegation under the documented DC protections. Group membership can explain failures even without the sensitive-account flag.
What TGT lifetime applies to Protected Users by default?
Security · Security | Secure AD DS
The documented restriction limits TGT lifetime and renewal to an initial four hours. A longer domain default does not automatically remove it.
Why can offline sign-in change for Protected Users on supported clients?
Security · Security | Secure AD DS
Supported clients do not create the usual cached-logon verifier for these users. Plan connectivity and privileged recovery access.
Why avoid adding every administrator at once?
Security · Security | Secure AD DS
NTLM, encryption, offline-logon, and delegation dependencies can lock out the entire administrative population. Pilot accounts and preserve a tested access path.
What do authentication policies and silos add beyond Protected Users?
Security · Security | Secure AD DS
They can apply configurable host/device restrictions or TGT constraints, including supported service/computer scenarios. Audit policy impact before enforcement.
Why must DCs be secured more stringently than ordinary member servers?
Security · Security | Secure AD DS
They store and control the directory's identities and security data. Privileged compromise can undermine the domain and its managed systems.
Why is Server Core often preferred for a DC?
Security · Security | Secure AD DS
It reduces installed components and interactive attack surface. Use secure remote administration with the tools needed for the role.
Why avoid browsing or unrelated workloads on a DC?
Security · Security | Secure AD DS
Browsers, email, utilities, and application workloads add attack paths to a highly privileged system. Use dedicated secured administration endpoints.
Why protect a virtual DC's host and storage administrators?
Security · Security | Secure AD DS
Control of the hypervisor or VM files can compromise the DC even without an initial Domain Admin password. Treat the supporting fabric as directory-sensitive.
What benefit can BitLocker provide for a supported physical DC deployment?
Security · Security | Secure AD DS
It helps protect directory data when disks or the machine are stolen. Preserve recovery material and verify supported hardware/storage configuration.
When can an RODC reduce branch security exposure?
Security · Security | Secure AD DS
When physical security is weaker and local writable AD data is unnecessary, it limits writable-directory and cached-password exposure. Keep caching narrowly scoped.
Why must DC backup protection be part of hardening?
Security · Security | Secure AD DS
Backups can expose directory secrets and support privileged recovery. Restrict backup access and test independent AD recovery workflows.
How should required cloud-security connectivity from a DC be handled?
Security · Security | Secure AD DS
Permit tightly controlled documented service endpoints, using supported proxy designs where applicable. General-purpose internet browsing should remain restricted.
Does upgrading a DC OS alone complete directory hardening?
Security · Security | Secure AD DS
No. Patch, configure supported role security settings, restrict access, protect credentials/fabric/backups, and verify operational state.
Which Windows Server 2025 OSConfig scenario is appropriate for DC hardening?
Security · Security | Secure AD DS
Use SecurityBaseline/WindowsServer/2025/DomainController for the documented role-aware baseline. Pilot required authentication and administrative workflows.
How should RDP access to DCs be scoped?
Security · Security | Secure AD DS
Allow only authorized identities from intended secured management systems. Combine user-right assignments with host/network firewall restrictions.
Does permission to administer an OU require interactive logon to a DC?
Security · Security | Secure AD DS
No. Delegated directory tasks can be performed from appropriate remote administration tools. Keep OS/DC interactive access separately restricted.
Why should DC management traffic use dedicated secure paths?
Security · Security | Secure AD DS
It limits administrative endpoint exposure and credential use on untrusted systems. Verify required directory services still remain reachable.
What risk comes from an overly broad Deny log on through Remote Desktop Services assignment?
Security · Security | Secure AD DS
Deny rights can override allowed users and lock out intended administrators. Review nested membership and recovery paths before rollout.
Does blocking all inbound DC traffic constitute successful hardening?
Security · Security | Secure AD DS
No. Clients and replication partners need directory protocols. Restrict unnecessary exposure while preserving documented service dependencies.
Why are Domain Admin sessions on lower-trust workstations risky?
Security · Security | Secure AD DS
A compromised workstation can expose privileged credentials or tokens. Use separate administration identities and secured administrative devices.
Why must DC console and physical access be restricted too?
Security · Security | Secure AD DS
Local storage, boot, and console access can undermine OS or directory security. Remote restrictions alone do not protect a physically exposed DC.
Why restrict who can modify GPOs governing DCs?
Security · Security | Secure AD DS
Editing those policies can change security rights, network access, and execution controls on directory authorities. Protect GPO permissions and audit changes.
How should DC access restrictions be verified?
Security · Security | Secure AD DS
Test authorized management, denied ordinary-user access, and necessary client/replication flows. Check effective user rights and firewall policy rather than only edited settings.
What does Account is sensitive and cannot be delegated do?
Security · Security | Secure AD DS
It prevents delegation of that user's security context. Use it deliberately for identities that must not be forwarded to downstream services.
Why is disabling Kerberos preauthentication for a user dangerous?
Security · Security | Secure AD DS
It permits unauthenticated requests for encrypted AS responses that can support offline password attacks. Leave preauthentication required unless an explicit compatible need is justified.
Why avoid Use Kerberos DES encryption types for a normal user?
Security · Security | Secure AD DS
DES is obsolete and weak. Validate modern AES-compatible authentication instead of retaining a legacy-only encryption option.
What does Smart card is required for interactive logon change?
Security · Security | Secure AD DS
It requires the smart-card authentication path for interactive logon. Provision compatible certificates, trust, readers, and recovery procedures.
Why should Store password using reversible encryption normally stay disabled?
Security · Security | Secure AD DS
It substantially weakens password secrecy by enabling recoverable storage. Use it only for an unavoidable documented protocol requirement.
Why is Password never expires not a substitute for service-account design?
Security · Security | Secure AD DS
A conventional account still needs protected credential lifecycle and least privilege. Use supported managed service accounts where appropriate.
Why separate daily-work and privileged user accounts?
Security · Security | Secure AD DS
It reduces exposure of administrative credentials during browsing, email, and lower-trust activity. Use the privileged identity only on approved administration paths.
What does disabling an unused AD account accomplish?
Security · Security | Secure AD DS
It prevents new authentication using that account, but other grants, sessions, and retention responsibilities still need review.
Why should logon-hour and workstation restrictions be tested?
Security · Security | Secure AD DS
They constrain intended account use but are not a complete application authorization model. Verify their effect on actual workflows and recovery access.
How does Domain Admins differ from Enterprise Admins in scope?
Security · Security | Secure AD DS
Domain Admins has broad authority within its domain. Enterprise Admins can affect the forest and should be tightly controlled.
What task justifies temporary Schema Admins membership?
Security · Security | Secure AD DS
An authorized schema modification requiring that privilege. Remove temporary membership after the task rather than using it for ordinary administration.
Why protect the domain's Builtin Administrators group?
Security · Security | Secure AD DS
It has broad DC/domain administrative authority. Its name does not make it a low-risk local-only group on a DC.
Why is Backup Operators membership security-sensitive?
Security · Security | Secure AD DS
Backup/restore privileges can bypass file ACLs and expose or alter sensitive data. It is not an ordinary password-reset delegation role.
Why should Server Operators and similar built-in operator roles be reviewed carefully?
Security · Security | Secure AD DS
Their operational privileges can affect critical server services and security. Assess actual rights rather than treating the group name as a harmless support role.
What is AdminSDHolder's function?
Security · Security | Secure AD DS
Its security descriptor supplies the permissions template for protected administrative accounts/groups in the domain.
What does SDProp do for protected accounts?
Security · Security | Secure AD DS
It periodically compares and reapplies AdminSDHolder-derived protection on the PDC emulator. Protected objects' ACL inheritance can differ from ordinary OU objects.
Why might normal OU delegation not apply to a privileged account in that OU?
Security · Security | Secure AD DS
AdminSDHolder/SDProp protection can disable normal inherited ACL behavior. Investigate the protected status rather than broadly increasing helpdesk rights.
Why keep Enterprise Admins and Schema Admins membership minimal?
Security · Security | Secure AD DS
These roles enable high-impact forest/schema changes. Use justified task-time membership, protect membership modification, and audit activity.
What is administrative delegation in AD?
Security · Security | Secure AD DS
It grants selected directory operations to an identity/group at a chosen scope. It differs from assigning broad Domain Admin membership.
Why delegate permissions to a group rather than individual technicians?
Security · Security | Secure AD DS
Group membership supplies a manageable role boundary for staffing changes and review. The delegated ACL can remain stable.
What should be specified in a Delegation of Control workflow?
Security · Security | Secure AD DS
Choose the target OU/container, object types, operations, and inheritance that match the task. Test both allowed and excluded objects.
Does reset-password delegation automatically permit group-membership edits?
Security · Security | Secure AD DS
No. Directory rights are operation-specific. Grant only the separate operations actually required.
Why can OU delegation fail for protected administrative accounts?
Security · Security | Secure AD DS
AdminSDHolder/SDProp can replace or protect ACLs outside normal OU inheritance. Do not broaden ordinary helpdesk delegation to bypass that protection.
Why are directory replication rights especially sensitive?
Security · Security | Secure AD DS
Rights that permit replication of secrets can enable credential extraction. They should not be added casually as a fix for ordinary delegation or RODC issues.
How does administrative delegation differ from Kerberos delegation?
Security · Security | Secure AD DS
Administrative delegation grants directory management rights. Kerberos delegation lets a service access another service in a user's security context.
What distinguishes constrained from unconstrained Kerberos delegation?
Security · Security | Secure AD DS
Constrained delegation restricts permitted target services; unconstrained delegation allows broader credential forwarding exposure. Use a deliberate least-privilege design.
Where is resource-based constrained delegation authorized?
Security · Security | Secure AD DS
On the resource-side service/computer object, specifying allowed delegating principals. Protect write access to that object's delegation-related properties.
Can sensitive/nondelegable users be forwarded through RBCD?
Security · Security | Secure AD DS
The Account is sensitive and cannot be delegated property prevents their context from being delegated. RBCD does not bypass that restriction.
Does using a gMSA automatically make every delegation configuration safe?
Security · Security | Secure AD DS
No. Managed passwords do not determine safe targets or resource-side authorization. Review delegated identities, SPNs, and object write permissions.
What is the basic Kerberos ticket sequence for domain service access?
Security · Security | Secure AD DS
The client obtains a TGT from the KDC, requests a service ticket for the service SPN, and presents that ticket to the service. Service identity and keys must match.
Why must a service SPN be unique and correctly assigned?
Security · Security | Secure AD DS
It identifies the service account for Kerberos ticket issuance and decryption. Missing or duplicate registration can cause authentication failure or unexpected fallback.
Why do DNS and accurate time matter to Kerberos?
Security · Security | Secure AD DS
DNS locates domain/services and time participates in ticket validation. Resolve names and clock problems before weakening authentication.
Why can using an IP address instead of the service DNS name alter authentication?
Security · Security | Secure AD DS
The expected name/SPN mapping can be absent, preventing the normal Kerberos path and leading to another protocol. Verify actual tickets and service registration.
What does LDAP signing protect?
Security · Security | Secure AD DS
It provides message integrity and authenticity for non-TLS SASL LDAP sessions. It does not provide confidentiality by itself.
What protects LDAP simple-bind credentials in transit?
Security · Security | Secure AD DS
TLS through LDAPS or STARTTLS supplies confidentiality, integrity, and server identity. Plain simple binds expose credentials without appropriate transport protection.
What does SASL sealing add beyond signing?
Security · Security | Secure AD DS
It adds confidentiality along with integrity for supported non-TLS SASL sessions. Signing alone leaves message contents readable.
What does LDAP channel binding protect?
Security · Security | Secure AD DS
It binds SASL authentication to its specific TLS connection to resist relay over a different TLS session. It applies to TLS plus SASL, not simple binds.
What is the Windows Server 2025 default for new AD deployment signing?
Security · Security | Secure AD DS
New AD deployments require LDAP signing by default. Inspect effective policy in upgraded environments because existing settings can be preserved.
How does channel binding When supported differ from Always?
Security · Security | Secure AD DS
When supported requires valid CBT from supporting clients while allowing nonsupporting clients. Always rejects applicable TLS+SASL clients without a valid CBT.
What is the new Windows Server 2025 AD channel-binding default?
Security · Security | Secure AD DS
When supported is the documented default for new deployments. It is distinct from enforcing Always for every applicable client.
Which LDAP events help identify unsigned client dependencies?
Security · Security | Secure AD DS
Directory Service summary events such as 2887 and per-client 2889 with relevant diagnostic logging help identify clients before stricter enforcement.
Does cloud MFA automatically prompt during every on-premises Kerberos or LDAP exchange?
Security · Security | Secure AD DS
No. Cloud authentication controls do not automatically retrofit every traditional AD protocol session. Design supported authentication methods for the workload.
What do a Performance Monitor object, counter and instance represent?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
An object is a subsystem, a counter measures a property, and an instance identifies a particular process, disk, interface or similar component.
Why can a _Total CPU counter conceal a bottleneck?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
It averages across processors. One saturated core can limit a serial workload while total utilization remains moderate.
What makes a performance baseline useful?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
It records representative healthy workloads over relevant periods. Compare similar workload, hardware and sampling context when judging an incident.
Why is Pages/sec alone insufficient evidence of a memory leak?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
It includes paging activity that can be legitimate. Correlate available memory, commitment, hard paging and process Private Bytes growth.
Which disk measurements should be interpreted together?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Latency, IOPS, throughput, queue and workload/storage limits. A queue value alone does not establish poor performance.
How should a counter sampling interval be chosen?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Match the incident duration and logging budget. Long intervals can conceal brief spikes; very short intervals increase data volume and overhead.
What does Get-Counter -SampleInterval 5 -MaxSamples 120 request?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
It takes 120 counter samples at five-second intervals, roughly a ten-minute capture. It records evidence rather than repairing the system.
Why must counter paths be checked on a non-English Windows server?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Counter names can be localized. An English path may not resolve even when the corresponding performance object exists.
What is a Data Collector Set?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
A reusable definition grouping performance counters, event traces or configuration collection with output, scheduling and run conditions.
When is a Data Collector Set preferable to watching a live graph?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
When an issue must be captured unattended, overnight or during a reproducible workload for later correlated analysis.
Which DCS settings make an unattended collection usable?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Relevant counters, sample interval, output location, run-as permissions, schedule, stop conditions and log retention/size limits.
What is the purpose of BLG counter output?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
It preserves binary performance-counter data efficiently for later Performance Monitor analysis. CSV is useful for external processing.
What does logman create counter configure?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
It creates a named counter collector with specified counters, format, sample interval and output. Starting collection is a separate operation.
Which logman commands control an existing collection run?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
logman start <name> and logman stop <name>. Verify output and stop/rotation behavior before leaving it unattended.
Why should DCS log-size or stop conditions be configured?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Unbounded diagnostic logging can fill a disk and worsen an incident. Keep sufficient data with a bounded capture/retention design.
Why might remote counter collection fail while a local capture works?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Remote permissions, firewall, name resolution or management connectivity may be missing. Confirm the collection path independently.
What server health views can Windows Admin Center combine?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Performance, events, services, storage and cluster views support operational investigation. Correlate the relevant views with the failing workload.
Does inability to connect through WAC prove the managed application is down?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
No. Gateway, remoting, credentials or management-network problems can block WAC while the application continues serving users.
What role does Azure Monitor add to WAC-based operations?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Persistent centralized telemetry, alert evaluation and notifications. WAC provides an administrative surface and links to the monitoring configuration.
Which guest collection architecture should a new hybrid monitoring deployment use?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Use Azure Arc for the non-Azure server management path, Azure Monitor Agent and associated DCRs. Avoid deploying the retired legacy Log Analytics agent.
What must exist before a guest low-space alert can be trusted?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Working collection of the appropriate server/volume metric or log, a valid rule condition and an action group. Verify actual telemetry first.
Why should a disk-space alert identify the volume?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
One nearly full volume can be hidden by aggregation with healthy disks. Dimension-aware alerts point the operator to the affected resource.
What should a test of WAC-linked Azure alerting verify?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Confirm the condition generates the expected alert, notification and resolution, with a clear affected server and volume.
How do management and monitoring permissions differ?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Permission to manage the server or deploy a monitoring extension does not automatically grant permission to read every Azure log workspace.
What does Windows Server System Insights analyze by default?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Local historical data to forecast CPU capacity, networking capacity, total storage consumption and per-volume consumption.
Does System Insights require Azure to run its default forecasts?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
No. Its predictive processing runs locally on supported Windows Server 2019 and later systems.
How does predictive capacity analysis differ from a current-utilization alert?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
A forecast estimates future exhaustion from historical trends. A static current threshold triggers only after measured utilization crosses it.
What does Critical mean for default System Insights capacity forecasts?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Predicted demand exceeds available capacity within the next seven days. Inspect the status description and capability data.
What does Warning mean for default System Insights capacity forecasts?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Predicted demand exceeds available capacity within the next 30 days, outside the more urgent critical window.
Why can a new System Insights capability return no prediction?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
The default model needs history; zero to five days of data produces no forecast. None is not automatically a failed feature.
Which cmdlets inspect System Insights capabilities and their outputs?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Get-InsightsCapability and Get-InsightsCapabilityResult. Examine the status, description and capability-specific result data.
Why should a forecast be reconsidered after a major workload change?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Models use previous behavior. A new retention policy, import or workload can make past growth less representative of future demand.
Why is an event ID alone insufficient to identify a Windows error?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
IDs are scoped to providers. Correlate provider, message, timestamp, computer and event ID.
How do Windows logs and Applications and Services logs differ?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Windows logs include System, Application and Security. Component-specific operational logs appear under Applications and Services.
What does wevtutil epl System C:\Lab\System.evtx do?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
It exports the System event log as an EVTX file. It does not clear the original log or enable new auditing.
Why use Get-WinEvent with a FilterHashtable?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
It filters by properties such as log, level and time before returning records, avoiding a broad read of a busy log.
What tradeoff does overwrite-as-needed event-log retention make?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
It allows continued logging by replacing old records. Important evidence may be lost if collection/export occurs too late.
What risk accompanies retaining or archiving logs without capacity planning?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
The disk can fill or logging can stop under the configured full-log policy. Match size and retention to audit and workload needs.
What does Windows Event Forwarding provide?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Subscribed event collection from source computers to a collector. Scope, permissions, transport and collector retention still require configuration.
Why does absence of a Security event not prove an operation never happened?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
The relevant audit policy, log access or retention may be missing. Confirm event generation and collection before interpreting absence.
What does an Azure Monitor data collection rule define?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Data sources, filters/counters, destinations and supported processing transformations for its collection scenario.
What does a DCR association do for Azure Monitor Agent?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
It connects a rule to a monitored resource so the agent downloads that configuration and collects its specified data.
Does installing AMA automatically collect every Windows log?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
No. A matching DCR association and enabled data source are required; agent installation alone does not specify all guest collection.
Can one DCR serve multiple machines?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Yes. Associations are many-to-many: one rule can serve multiple resources and a resource can use multiple rules.
Which table receives standard Windows events collected by an AMA event DCR?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Event in Log Analytics. The Sentinel Windows Security Events via AMA connector can instead send security events to SecurityEvent.
What does System!*[System[(Level=1 or Level=2)]] select in an event DCR?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Critical and error events in the System log. It is a log-name plus XPath selector, not a performance-counter path.
Can AMA Windows-event DCRs subscribe to Analytic or Debug channels?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
No, not through this event-subscription mechanism. Use supported standard/operational channels and validate the filter locally.
When does an AMA deployment require a Data Collection Endpoint?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Private Link and relevant shared AMPLS DNS contexts require a DCE, and certain data sources also require one. Public-endpoint AMA does not universally need a DCE; check the selected source and destination requirements.
How do logs-based performance counters and OpenTelemetry guest metrics differ?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
A logs-based counter DCR can write Perf to Log Analytics. The new OpenTelemetry metrics experience uses an Azure Monitor workspace.
What elements form an Azure Monitor alert rule?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Resource scope, signal and condition, evaluation logic, severity and actions. Validate the signal exists before enabling the rule.
When should a metric alert be used?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
For a numeric time-series condition such as sustained CPU utilization or a disk metric threshold.
When should a log-search alert be used?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
When a KQL query over collected logs identifies the condition, such as repeated specific Windows service failures.
What does an activity-log alert detect?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Azure management-plane operations or supported activity events. It does not collect all guest Windows event logs.
What is an Azure Monitor action group?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
A reusable notification or approved automation target set invoked by alert rules. It is separate from the detection condition.
How do Average and Maximum aggregations affect an alert?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Average over a longer window detects sustained load. Maximum over a shorter window captures bursts and can produce more noise.
Why split a storage alert by computer and volume?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
To evaluate affected resources separately instead of averaging one full volume with healthy volumes.
What is the purpose of alert processing rules during maintenance?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
They can suppress or modify action handling for matching alerts without changing the underlying collection and detection rule.
Why should missing telemetry have its own alert?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
A lack of error rows can mean missing collection rather than health. Detect heartbeat/data absence according to the expected reporting pattern.
How do Azure VM host metrics differ from guest telemetry?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Azure collects host metrics automatically. Guest memory, local performance details and Windows events require a configured guest collection path.
What three pieces enable AMA-based VM guest monitoring?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Install Azure Monitor Agent, define suitable DCRs and associate them with the VM. The portal onboarding flow can configure these pieces.
Which guest metrics route is recommended for new Azure VM portal monitoring?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
The OpenTelemetry metrics experience using an Azure Monitor workspace. Classic logs-based metrics remains available for existing compatible deployments.
Which workspace receives classic logs-based VM Insights metrics?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
A Log Analytics workspace. The classic predefined guest metrics use InsightsMetrics; additional standard counter DCRs can use Perf.
Should a classic predefined VM Insights metrics DCR be freely edited to add counters?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
No. Current enablement guidance says not to modify that predefined logs-based DCR; use additional appropriate collection rules for other requirements.
What must a non-Azure VM have before using the supported AMA extension management path?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Azure Connected Machine agent onboarding to Azure Arc-enabled servers. It supplies the management path for deploying AMA.
What is the current status of Dependency Agent and VM Insights Map?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Deprecated, with retirement scheduled for 30 June 2028. Current guidance says not to initiate new Dependency Agent installations.
Why can a slow Azure VM need disk and VM-size limit analysis?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
A disk can hit provisioned IOPS/throughput limits, and the VM size can impose aggregate caps. Guest filesystem health alone does not rule out throttling.
What can VM Activity Log and boot diagnostics add to performance analysis?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
Activity Log shows management changes such as resizing or extension operations; boot diagnostics helps when the guest cannot start.
Why is ping success insufficient proof that SMB or RDP works?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
ICMP reachability does not prove the service TCP port is reachable or the application authenticates. Test the actual protocol and operation.
What does Test-NetConnection server -Port 445 test?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
TCP connectivity to the SMB port, with optional DNS and route details. It does not prove SMB authentication or file permissions.
Which local settings should be examined early in a connectivity incident?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
IP address, prefix, gateway, DNS servers, interface state and selected routes. Compare with the intended subnet and a working peer.
What should be checked on the destination when the expected TCP service port fails?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Service state, listening address/port and effective Windows Firewall rules/profile, then upstream network filtering.
Why can a correct forward route still fail to deliver an application connection?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
The return path may be missing, asymmetric or filtered. Validate routing and stateful security in both directions.
Which Azure controls can filter or redirect VM network traffic?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
NIC/subnet NSGs, user-defined/effective routes, NVAs, gateways and firewalls. Inspect the effective packet path.
What does working small traffic but failing large transfers suggest?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
An MTU/fragmentation or loss problem may exist. Correlate packet sizes, retransmissions and captures rather than assuming credentials failed.
Why does a successful TCP 443 test not validate SMB over QUIC?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
QUIC normally uses UDP 443. Exercise an actual QUIC SMB connection to validate its transport and security layers.
How can name versus IP testing help isolate a connection failure?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
If the IP path works while the name fails, inspect DNS selection and returned addresses. Authentication can still require the correct name/SPN.
What does Resolve-DnsName -Server specify?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
The DNS server to query. It helps compare authoritative, internal and client-selected resolver responses.
What does Resolve-DnsName -DnsOnly exclude?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
LLMNR and NetBIOS resolution. It isolates the DNS result rather than allowing alternate local-name mechanisms.
What should be examined when one site resolves a hostname differently?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Client DNS settings, split-horizon zones, conditional forwarding, cached records and the intended authoritative zone.
What does a DNS timeout suggest compared with NXDOMAIN?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
A timeout suggests no usable response, such as reachability/server problems. NXDOMAIN is a negative answer that the queried name does not exist.
What can negative DNS caching do after a missing record is created?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Clients may keep an earlier negative answer until expiry or a controlled cache refresh. Validate the record at the intended resolver first.
Which DNS records are critical to domain-controller discovery?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
AD SRV records and valid DC host records. Point domain clients to DNS servers that resolve the AD namespace.
What DNS result is needed for an Azure Files private endpoint?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
The normal storage file endpoint name must resolve through the private-link design to the intended reachable private IP.
Which stages should Windows Update troubleshooting distinguish?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Scan/detection, download, installation and post-install/restart. Different stages have different policy, network and servicing causes.
Which event log exposes Windows Update client operational activity?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Applications and Services Logs, Microsoft, Windows, WindowsUpdateClient, Operational. Correlate errors with the update attempt time.
What does Get-WindowsUpdateLog produce on modern Windows?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
A readable static WindowsUpdate.log assembled from ETL traces. Run it again for a refreshed view; the output is not continuously updated.
What does CBS.log help diagnose?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Component-based servicing and update installation. Scan/download errors may require Windows Update trace and network/policy evidence instead.
What should be checked when a server receives no expected WSUS updates?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Effective update-source policy, WSUS reachability, product/classification approval, applicability and detection timing. Missing approval is distinct from a failed installation.
Why might a downloaded update be not applicable?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
OS version, architecture, installed/superseding packages or prerequisites can differ from the package requirements. Check the exact update applicability.
What does DISM /Online /Cleanup-Image /ScanHealth assess?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
It checks component-store corruption in the running OS. It does not approve WSUS updates or automatically correct every network download failure.
What should be verified after repairing an update failure?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Rescan and complete the original update, confirm installation/restart state and validate workload health. A cleared error alone is not completion.
What time source type is normal for domain members?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
NT5DS, which follows the AD domain time hierarchy. The forest-root PDC emulator normally uses a reliable external source.
Which domain controller anchors the forest time hierarchy?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
The PDC emulator in the forest-root domain. Configure its intended reliable source and inspect effective configuration.
Which port does Windows Time NTP synchronization use?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
UDP 123. A successful TCP test does not validate the NTP exchange.
What does w32tm /query /source show?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
The current selected synchronization source. Combine it with status and configuration to distinguish configured peers from the active source.
What does w32tm /query /configuration reveal?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Effective time-service settings, including policy influence. Local changes can be overridden by Group Policy.
What does w32tm /stripchart /computer:<peer> measure?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Offset relative to a peer over repeated samples. Its diagnostic source port differs from the built-in NTP client behavior.
Why can large clock skew cause authentication symptoms?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Kerberos requires time agreement within policy tolerance. Correct the time source/path instead of assuming every ticket failure is a password issue.
What should follow correcting a Windows Time source problem?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Resynchronize as appropriate and verify selected source, recent successful sync, offset and downstream domain member behavior.
What should be established before changing capacity for a slow server?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Identify the affected workload, incident time, recent changes and bottleneck evidence. Added resources may hide a regression without fixing it.
How can a single saturated core affect server performance?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
A serial process can be CPU-bound despite moderate total CPU. Examine per-core and process behavior before assuming spare CPUs solve it.
What pattern supports investigating a process memory leak?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Sustained Private Bytes growth across comparable demand, shrinking available memory and rising commitment. One paging spike is insufficient.
How can storage throttling differ from disk failure on an Azure VM?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
The disk or VM can reach provisioned IOPS/throughput limits while otherwise healthy. Correlate guest latency with platform limits.
Why should a queue be interpreted relative to capacity?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
CPU counts, storage parallelism and workload demand differ. A fixed queue threshold cannot diagnose every server or array.
What should be compared when a regression affects one server only?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
A working peer with similar workload, OS/configuration, resource allocation and recent changes. Avoid comparing incomparable demand periods.
Why collect before, during and after a performance incident?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Aligned counters, events and application measurements show whether the suspected resource change correlates with the symptom and recovery.
What should validate a performance fix?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Repeat the original application operation and confirm latency/throughput plus resource health. A different counter becoming low is not sufficient.
Why does successful VM or Arc resource creation not prove extension success?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Extensions execute inside the guest through an agent and have separate handler provisioning and workload execution states.
Which agent manages extensions on Azure VMs?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
The Azure VM Agent. On Arc-enabled servers the Connected Machine/extension management components provide a different management path.
What does an extension instance view provide?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Detailed provisioning status, substatus and errors. Correlate those details with the handler version and operation time.
Where are Windows Azure VM extension logs normally found?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Under C:\WindowsAzure\Logs\Plugins. Inspect the extension-specific handler/output and guest-agent health.
Where is the Arc extension service log on Windows?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
C:\ProgramData\GuestConfig\ext_mgr_logs\gc_ext.log. It includes extension download and package-verification issues.
What does azcmagent check test during Arc connectivity diagnosis?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
It tests communication with required network endpoints and reports endpoint, proxy, private-link, or Arc gateway paths. Use it to distinguish network reachability from extension handler/script health.
How do package-download failures differ from script failures?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Download/verification failures concern the handler/network path. A script can fail after installation due to arguments, permissions or workload prerequisites.
What should be done before rerunning a failed extension?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Preserve logs, identify and fix the actual cause, use its supported rerun/update procedure and verify the intended guest state.
What should be classified first in an encryption-related access failure?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Distinguish locked BitLocker, missing EFS key, Azure key dependency, and physical/filesystem damage. Similar symptoms need different recovery paths.
Which BitLocker properties should be inspected before modifying protectors?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Volume lock/conversion/protection status and protector IDs. Preserve recovery material and identify the actual affected volume.
What can recurring BitLocker recovery after firmware changes indicate?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Boot integrity measurements changed or protection was not correctly resumed. Investigate the trigger and verify effective configuration.
Why is clearing a TPM not a substitute for a BitLocker recovery key?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
It does not recreate missing encryption key material and can remove usable TPM-backed secrets.
Why can BitLocker unlock successfully while individual files remain unreadable?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
The files may additionally use EFS or deny access through ACLs. Volume and per-file encryption/authorization are separate layers.
What does unexpected RAW state imply in an encrypted-storage incident?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
It can indicate storage-path or filesystem damage, not necessarily a missing password. Preserve evidence and diagnose the lower layers.
What Azure encryption dependency should be checked when a workload uses customer-managed keys?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Key availability/version, authorized access and Key Vault/network configuration. Identify the actual encryption design instead of treating every failure as guest BitLocker.
What should verify a recovered encrypted volume?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Confirm real file reads, normal protection state and the underlying cause; rotate used recovery credentials according to policy.
What layer sequence helps isolate a storage incident?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Physical/path, disk, pool/virtual disk, partition, filesystem, then share/application. An inaccessible share does not identify the failed layer.
What can Get-Disk and Get-Volume distinguish?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Disk presentation/online state from partition/filesystem volume state. A present disk does not guarantee its volume is mounted or readable.
What does Get-StorageJob reveal during a Storage Spaces issue?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Repair or allocation jobs in progress. Active repair can affect latency and remaining failure tolerance.
Why check pool capacity separately from volume free space?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
Thin volumes can show logical free space while backing physical capacity is exhausted. Both layers can block writes.
Why should an unexpected RAW volume not be formatted as routine troubleshooting?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
It may contain damaged existing data. Preserve the source/backups and identify storage-path or filesystem failures before destructive changes.
What evidence should be correlated for intermittent iSCSI disk loss?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
iScsiPrt/Disk/StorPort events, MPIO path state, target mappings and array/network health, using the incident timestamps.
Does ReFS use exactly the same repair procedure as NTFS?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
No. Use the supported ReFS integrity/salvage workflow and underlying storage health checks rather than assuming NTFS chkdsk behavior.
What proves a storage recovery is complete beyond a drive letter appearing?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
A real read/write workload succeeds and expected redundancy/path health is restored. Mounted state alone can conceal degradation.
What prerequisite functional level does AD Recycle Bin require?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Windows Server 2008 R2 or later forest functional level. Enabling it is a forest-wide, irreversible change requiring appropriate forest administrative rights.
Must AD Recycle Bin be enabled before an object is deleted?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Yes, for its full deleted-object restoration benefits. Enabling it later does not retroactively preserve all attributes of already tombstoned objects.
What recovery advantage does AD Recycle Bin provide?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
It restores deleted objects with preserved attributes and links such as memberships, without a DC database restore or reboot.
What does Restore-ADObject -Identity <GUID> restore?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
The specific deleted AD object when it remains restorable. Identify the exact GUID and intended parent instead of matching an ambiguous name.
What ordering matters when recovering a deleted OU tree?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Restore missing parents before their child objects. A deleted child cannot simply return to a parent that does not exist.
Why must deleted-object retention be checked in the actual forest?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Configured deleted-object and tombstone lifetimes determine restorability. Do not assume every forest uses a 180-day period.
Can AD Recycle Bin restore an object after it becomes recycled?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
No. The restorable deleted-object period has ended; an appropriate alternate recovery method is needed.
What should be verified after an object restore?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Parent location, attributes, memberships and replication to relevant DCs, followed by the object real workload behavior.
What does Ntds.dit contain?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
The AD DS database. ESE transaction logs and checkpoints support consistent database operations; an active-file copy is not a supported system-state backup.
What is Directory Services Restore Mode?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
A DC recovery startup mode with its local AD database offline, used for the supported directory restoration workflow.
Which credentials are used for local DSRM recovery sign-in?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
The local Administrator account with the DSRM password. Do not assume the current domain administrator password is the DSRM credential.
How does a nonauthoritative database restore interact with healthy partners?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
The restored DC receives newer directory changes from its replication partners and catches up.
Why can nonauthoritative restore fail to recover a deletion replicated everywhere?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Healthy partners can replicate the deletion back. A restorable Recycle Bin object or targeted authoritative recovery may be needed.
What does marking restored AD data authoritative change?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
It raises attribute versions so selected restored data wins replication over partners existing versions. Use the required object/subtree scope.
When is ntdsutil authoritative marking performed?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
After restoring the supported directory backup in DSRM, before restarting normally and allowing AD replication.
Why is an authoritative AD database restore separate from SYSVOL recovery?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
The directory database holds objects and GPO metadata; SYSVOL holds policy files/scripts with its own DFS-R recovery procedure.
What should validate a recovered DC?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
DNS, DC advertising, authentication, AD replication, SYSVOL/NETLOGON and appropriate FSMO/time configuration, not just a successful local login.
What does SYSVOL contain in an AD domain?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Group Policy file content and scripts. Its DFS-R replication is distinct from AD database object replication.
What should be established before forcing SYSVOL synchronization?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Identify a verified good content source, inspect DFS-R events and repair underlying AD/DNS/network problems. Preserve policies/scripts.
When is nonauthoritative DFS-R SYSVOL synchronization appropriate?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
When an affected DC should replace its local SYSVOL state by synchronizing from a verified healthy partner.
Which subscription attribute is toggled for nonauthoritative DFS-R SYSVOL synchronization?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
msDFSR-Enabled is set FALSE, replicated/polled, then TRUE with another replicated/polled change, following the documented ordering.
What does DFS-R SYSVOL event 4114 indicate in the documented procedure?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
The subscription has stopped replicating after being disabled. It is an expected checkpoint before re-enabling synchronization.
Which DFS-R events confirm nonauthoritative SYSVOL initialization?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Events 4614 and 4604 appear in the documented initialization sequence. Verify the completed state and actual share/content health.
Which setting identifies the chosen authoritative SYSVOL DC in the recovery procedure?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
msDFSR-options=1 on its SYSVOL Subscription, alongside the coordinated enable/disable and service ordering; event 4602 confirms authoritative initialization.
Do D2/D4 BurFlags apply to DFS-R SYSVOL?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
No. They are FRS settings. DFS-R SYSVOL uses its documented AD subscription-attribute procedure.
Does restoring a deleted GPO AD object automatically restore its SYSVOL files?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
No. Recover both the directory metadata and corresponding policy files coherently, using appropriate GPO or system-state backups.
What does repadmin /replsummary provide?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
A broad AD replication failure summary. Use it to identify affected sources/destinations and then inspect detailed partner/context failures.
What does repadmin /showrepl show?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Inbound replication partners, naming contexts and last-success/error information for a DC. Different partitions can have different failures.
Why check AD DNS early in replication troubleshooting?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
DC discovery and partner identification depend on valid host, SRV and GUID-related records and the correct resolver path.
What can RPC unavailable replication errors indicate?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Routing, firewall, endpoint mapper/dynamic-port or service availability problems. Test the path rather than repeatedly forcing synchronization.
What can access-denied replication errors indicate?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Authentication, authorization, machine-account or related security/time issues. A reachable network does not establish replication permission.
Why should intentional offline staged DCs be identified?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Expected deployment outages can explain replication errors. Distinguish an intentional offline partner from an unexpected failure before remediation.
Why is a DC offline beyond tombstone lifetime risky?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
It can retain obsolete objects and trigger replication safeguards. Use a supported lingering-object or rebuild strategy rather than bypassing protections.
How should an AD replication repair be validated?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Check sustained clean reports and propagation of relevant changes across DCs, then independently verify DFS-R SYSVOL and real authentication behavior.
What should be distinguished in a domain sign-in incident?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Affected accounts, sites, clients and DCs, plus online domain authentication versus cached sign-in. The scope guides the next test.
What does nltest /dsgetdc:<domain> help verify?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Whether the client can discover a suitable domain controller. Discovery still must be followed by service/authentication checks.
What does dcdiag contribute to AD troubleshooting?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Targeted DC health tests such as DNS, advertising and services. Interpret actual failures and test scope rather than assuming one pass proves all AD healthy.
Which services are relevant to normal AD authentication and policy health?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
AD DS, DNS, Netlogon, KDC and DFS-R/SYSVOL, with network and disk health. AD Web Services also matters for many management tools.
What does a failure isolated to one branch suggest?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Branch DNS, routing, site/subnet mapping or DC selection may differ. Compare the affected site with a working one.
What should be checked for a single user who cannot authenticate?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Account state, password/expiry, lockout, logon restrictions and relevant failure events. A domain-wide rebuild is not implied.
How should repeated account lockouts be investigated?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Identify the source host/service and stale stored credentials using failure timing and logs, then correct the actual recurring attempt.
Why is successful authentication insufficient proof of file access?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Authorization still requires the proper share and file permissions. Diagnose authentication and resource ACLs as separate checkpoints.
What infrastructure does Kerberos depend on?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Working DNS, reachable KDC/DC services, acceptable time agreement, valid account keys and correct service identity/SPNs.
How do a TGT and a service ticket differ?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
A TGT is used to request service tickets from the KDC. A service ticket targets the SPN of the resource the client accesses.
Which command displays cached Kerberos tickets?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
klist. Use klist get <service-SPN> for a targeted ticket request when diagnosing a particular service.
What does setspn -Q <SPN> inspect?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
It queries registrations for that SPN. Verify the actual service account and expected hostname before changing ownership.
What does KDC_ERR_S_PRINCIPAL_UNKNOWN suggest?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
The requested service principal cannot be found. Check the requested name, service class and relevant SPN registration.
What does KDC_ERR_PRINCIPAL_NOT_UNIQUE suggest?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
The service principal resolves ambiguously, commonly due to duplicate SPNs. Identify the correct service identity and remove the erroneous registration.
Why can KRB_AP_ERR_MODIFIED point to wrong SPN ownership?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
The service may receive a ticket encrypted for another account key and fail to decrypt it. DNS misdirection or key mismatch can also contribute.
Why prefer setspn -S over -A for a reviewed new registration?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
-S verifies duplicate SPNs before adding. It does not remove the need to identify the correct account and service.
Why can a second-hop Kerberos failure require delegation analysis?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
The first service may not be allowed to delegate to the backend SPN, or the user may prohibit delegation. Valid first-hop credentials do not imply delegation rights.
What relationship does a domain member secure channel use?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
The member local machine-account secret and the corresponding AD computer account secret, maintained through Netlogon.
What can cause a member computer-account password mismatch?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Snapshot rollback, old machine restore, duplicated identities or inconsistent DC data. Check reachability and replication before resetting.
What does Test-ComputerSecureChannel return on a supported member?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
True or False for its domain secure channel; -Verbose adds diagnostic detail and -Server selects a preferred DC.
Which option attempts a member secure-channel repair?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Test-ComputerSecureChannel -Repair with appropriate credentials and a reachable selected DC. Retest afterward.
Can Test-ComputerSecureChannel reliably diagnose domain controllers?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
No. It is for domain members and can return false-positive errors on DCs; use documented netdom/nltest procedures for DCs.
Why should DNS and time be checked before repairing a member trust?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Failure to locate/reach an appropriate DC or authenticate due to skew can resemble trust failure without proving a lost machine secret.
What does success against one DC but failure against another suggest?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Investigate replication and computer-account consistency across those DCs before repeated resets.
Why is domain rejoin normally broader than a targeted secure-channel repair?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
Rejoin can affect the computer identity and service dependencies. Prefer the appropriate supported targeted repair when its prerequisites hold.
Practice questions
These are original study questions. Multiple-response practice uses exact-set scoring in the app, with no partial credit.
1. An administrator wants another writable replica in an existing domain. The AD DS role is installed. Which next step completes the requested deployment?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Run Install-ADDSDomainController for the existing domain
Install-ADDSDomainController promotes an additional replica. Install-ADDSForest creates a forest, the Test cmdlet only checks prerequisites, and a domain join leaves a member server without the DC role.
Open this question’s page →2. A branch has a constrained WAN but can contact a healthy writable DC. The administrator wants to reduce the initial data transfer when adding a replica. Which approach fits?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Use installation from media and retain live DC connectivity
Installation from media reduces initial replication but still requires a live DC for remaining updates. An arbitrary VM disk copy is not a supported independent promotion workflow; removing all live connectivity defeats IFM requirements. A second forest does not add a replica to the existing domain.
Open this question’s page →3. A newly promoted DC accepts logons, but clients cannot retrieve domain policy from it. Which validation should come first?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Check SYSVOL/NETLOGON availability and DFS Replication events
SYSVOL/NETLOGON and DFS Replication directly support policy-file availability. Refresh intervals do not restore missing server-side files. Schema-master transfer addresses another operation, and AD replication is separate from SYSVOL file replication.
Open this question’s page →4. A server will become an additional writable DC in a healthy domain. Which two preparations directly support successful promotion? Select two answers.
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answers
- Configure DNS that resolves the existing AD domain
- Verify replication health and network reachability
AD-capable DNS and healthy reachable partners support discovery and replication. A public resolver lacks private AD service records; role installation adds binaries but does not promote the server.
Open this question’s page →5. An Azure application VM can ping an on-premises DC over VPN but cannot join the domain. It uses Azure-provided DNS. Which change targets the likely cause?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Configure reachable AD DNS private addresses for the workload VNet and refresh the VM DNS configuration
AD DNS resolves the SRV records needed for domain discovery. A public IP does not fix private DNS, a load balancer is not the AD DC Locator mechanism, and moving the PDC role does not populate the client's DNS service records.
Open this question’s page →6. You deploy an Azure DC that must retain its directory data after host maintenance. Which disk design follows the reference architecture?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Persistent data disk for NTDS, logs, and SYSVOL with caching None
Persistent data storage with caching None follows the AD DS write-consistency guidance. The temporary disk and ephemeral OS storage are unsuitable for persistent directory state. ReadWrite host caching is not the prescribed NTDS data-disk setting.
Open this question’s page →7. Azure clients find a distant on-premises DC even though Azure DCs and VPN connectivity are healthy. Which directory change should be investigated?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Map the Azure subnet to the intended AD site and check DC placement
Subnet/site mappings guide DC Locator locality. External forwarder preference and public DNS do not create the missing AD site mapping or private discovery data. LDAP load balancing does not replace correct AD site configuration.
Open this question’s page →8. A production deployment extends AD DS into Azure. Which two choices meet resilience and address-stability requirements? Select two answers.
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answers
- Deploy two DCs across availability zones where supported
- Reserve static private IPs on the Azure DC NICs
Azure NIC reservations preserve DC addresses, and multiple zone-separated DCs reduce a shared availability failure. Guest-only unrelated static addressing conflicts with Azure network provisioning. Temporary disks do not provide durable directory storage.
Open this question’s page →9. A branch needs local domain authentication, has poor physical security, and has no requirement for local directory writes. Which DC model best limits exposure?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- An RODC with narrowly scoped password caching
An RODC limits writable-directory and cached-secret exposure while supporting branch services. Broad writable/password exposure fails the security requirement. A duplicate forest changes identity design, and installed binaries on a member server do not provide DC authentication.
Open this question’s page →10. A central administrator wants a branch technician to install a prepared RODC without joining Domain Admins. Which workflow fits?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Precreate the RODC account, delegate its installation, then use -UseExistingAccount
Staged installation separates central directory preparation from delegated branch deployment. Schema Admins is unnecessary broad authority; binaries without promotion do not form a DC. A new forest would not attach the server to the prepared RODC account.
Open this question’s page →11. During a WAN outage, an RODC serves directory reads but cannot authenticate a newly transferred employee. The employee password has never been cached. What explains the failure?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Uncached authentication needs a writable DC
Uncached credentials require validation by a writable DC. PRP eligibility does not prove caching; global catalog membership data is not a cache of every domain password. Workstation cached sign-in is separate from validating new domain authentication at the RODC.
Open this question’s page →12. Which two capabilities can an RODC provide without becoming a writable domain controller? Select two answers.
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answers
- Global catalog queries
- A read-only AD-integrated DNS service
RODCs can host read-only AD DNS and a GC. Normal directory changes and authoritative password resets still need writable DC services; hosting DNS or GC does not remove that boundary.
Open this question’s page →13. A user belongs to a group allowed to cache on an RODC and a group denied caching. What is the effective caching result?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- The user's credential is denied caching
PRP deny precedence blocks caching. Addition time does not override it, WAN failure does not change eligibility, and a GC role does not bypass PRP.
Open this question’s page →14. A branch administrator plans a WAN outage. The branch users and computers are allowed by PRP, but have not used this RODC. Which preparation supports local authentication?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Prepopulate approved user and computer credentials and verify the revealed list
Prepopulation supplies permitted secrets before loss of connectivity and verification confirms them. Eligibility alone does not prove caching. Allowing Domain Admins or deleting deny controls unnecessarily exposes high-value credentials.
Open this question’s page →15. A denied account's password appears in an RODC's revealed list. Which investigation best targets a documented cause?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Inspect effective group membership, replication consistency, and Replicating Directory Changes All permissions
Incorrect replication privileges or inconsistent replicated PRP/group state can explain unexpected caching. FSMO placement, workstation cached-logon settings, and GPO refresh frequency do not govern the RODC password replication authorization.
Open this question’s page →16. A branch RODC is stolen. Which two actions directly address credential exposure? Select two answers.
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answers
- Identify credentials actually revealed to the RODC
- Reset exposed user and computer secrets through incident response
The revealed list identifies actual cached-secret exposure, and resetting those secrets invalidates compromised credentials. PRP edits do not revoke a stolen password; focusing only on the installer ignores other exposed accounts.
Open this question’s page →17. Only schema modification fails while users continue authenticating. Which FSMO role is most directly relevant?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Schema master
Schema modifications require the schema master. RID allocation creates unique principal identifiers, the infrastructure master maintains cross-domain references, and the domain naming master manages domain/application-partition changes.
Open this question’s page →18. A healthy DC that owns the RID master will be retired next week. Which operation should be planned?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Transfer the role to a healthy suitable DC and verify ownership
Planned retirement of a healthy owner calls for transfer and verification. Seizure is a recovery path when transfer cannot work; deleting the VM leaves unmanaged role ownership. Functional-level changes do not create multiple RID masters.
Open this question’s page →19. After one DC fails, new user creation works briefly on some DCs and later fails when their RID pools are exhausted. Which missing role explains that pattern?
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- RID master
DCs consume local RID pools, then need the RID master for additional allocation. The schema master governs schema updates, the infrastructure master cross-domain references, and the domain naming master forest domain changes; none replenishes RID pools.
Open this question’s page →20. Which two circumstances justify considering FSMO seizure rather than routine transfer? Select two answers.
AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answers
- The former owner is permanently lost and a required role must be restored
- Transfer cannot succeed and the old owner will be retired or rebuilt before any return
Permanent loss and impossible transfer with controlled retirement support seizure. Healthy planned maintenance supports transfer if a move is needed. FSMO is single-master coordination and cannot be duplicated across every DC.
Open this question’s page →21. The Accounts forest contains employees; the Resources forest hosts a file server. Only employees need access to Resources. Which one-way relationship expresses that direction?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answer
- Resources trusts Accounts
The resource side must trust the account side to accept its users. Reversing the trust enables the opposite access direction. DNS forwarders provide discovery rather than an authentication relationship; a distribution group alone neither creates trust nor grants security permissions.
Open this question’s page →22. A forest trust uses selective authentication. Employees have a group on a file ACL but still cannot authenticate to the target server. What additional permission should be examined?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answer
- Allowed to authenticate on the target computer
Selective authentication adds Allowed to authenticate on the target computer. Reading its object or listing a share does not satisfy that authentication gate. User password-reset delegation is a directory administration right rather than target-computer authentication authorization.
Open this question’s page →23. Forest A trusts B, and B trusts C. A user from C cannot access A through these forest trusts. Which explanation fits?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answer
- Forest trusts do not create transitivity across a third forest
Forest trusts are transitive across domains in the two participating forests but not across a chain into a third forest. They do not require Domain Admin for normal resource access or copy user accounts/passwords into the other forest.
Open this question’s page →24. Which two checks remain necessary after a trust validates successfully? Select two answers.
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answers
- Verify Allowed to authenticate when selective authentication is used
- Verify resource ACL authorization for the trusted identity
Trust validation establishes the relationship, while resource ACLs and selective authentication still control access. Trusts grant no automatic Modify permission, and SID filtering should not be universally disabled.
Open this question’s page →25. Users on 10.50.8.0/24 select a distant DC while a healthy local DC exists. The subnet has no AD subnet object. What is the most direct correction?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answer
- Create 10.50.8.0/24 and associate it with the local AD site
Subnet-to-site association supplies the missing locality mapping. Link costs choose replication routes, OUs scope policy/delegation, and functional level does not map client addresses to sites.
Open this question’s page →26. A site link permits replication from 08:00 to 12:00 with a 30-minute interval. What does this configuration permit?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answer
- Replication opportunities every 30 minutes within the allowed window
The interval operates inside the permitted schedule. It does not open closed hours or limit an open four-hour window to a single attempt. Cost changes route preference, not timing.
Open this question’s page →27. A hub-and-spoke WAN prevents direct spoke-to-spoke routing, but AD topology assumes transitive connectivity. What should an administrator review?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answer
- Site-link bridging and whether the implied paths are reachable
Site-link bridging can imply connectivity absent from a partially routed WAN. Changing timing alone cannot make an unreachable path work. Bridgehead selection also requires reachable paths and does not by itself correct inappropriate transitive assumptions.
Open this question’s page →28. Which two objects are central to placing a new network prefix into the AD locality model? Select two answers.
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answers
- An AD site associated with that subnet
- An AD subnet object for the network prefix
Subnet and site objects map addresses to directory network locality. Distribution groups model messaging membership, and forest trusts connect identities rather than individual network prefixes.
Open this question’s page →29. An inbound connection object is stored under DC02's NTDS Settings and names DC01 as its source. Which replication direction does it represent?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answer
- DC02 receives changes from DC01
The object under the destination's NTDS Settings represents inbound AD replication from the named source. The opposite direction requires its own topology; this is not merely a SYSVOL DFSR object.
Open this question’s page →30. A policy's AD container is current on DC02, but its SYSVOL files are stale. Which subsystem is the next focus?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answer
- DFS Replication for SYSVOL
SYSVOL templates/scripts use DFS Replication separately from AD containers. RID allocation concerns new SIDs; trust authentication concerns external access; the GC partial attribute set does not replicate SYSVOL files.
Open this question’s page →31. repadmin shows RPC failures for one source partner. What is the best initial troubleshooting path?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answer
- Check source name resolution, reachability, RPC/service access, and partner availability
Source discovery and RPC/service reachability directly explain transport failures. FSMO seizure and object deletion are recovery changes unsupported by this evidence. Repeated synchronization does not restore an unreachable endpoint.
Open this question’s page →32. Which two statements correctly distinguish directory replication scope? Select two answers.
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments
✓ Correct answers
- A GC holds partial replicas of other forest domains
- Schema and configuration data replicate throughout the forest
Forest-wide schema/configuration and GC partial cross-domain replicas are the correct scopes. A writable DC has its own writable domain partition, not every domain. SYSVOL scripts use file replication rather than schema attributes.
Open this question’s page →33. A renamed employee retains access to a folder. Which property most directly explains this?
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answer
- The account SID remains unchanged
The unchanged SID preserves the identity referenced by the ACL. Display-name matching and UPN spelling are not the security principal stored in the NTFS access entry. Renaming does not create a replacement SID or a second account.
Open this question’s page →34. Finance users need Modify on a share. Which group design best follows AGDLP?
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answer
- Finance accounts in a global role group, nested into a domain-local Modify group on the ACL
AGDLP uses global role membership and a domain-local resource permission group. Individual ACL entries bypass that model, distribution groups are not DACL security principals, and global membership is limited to its own domain.
Open this question’s page →35. A user was added to the correct security group, but an existing session still lacks access. Replication and the ACL are correct. What should be checked next?
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answer
- Whether the session token was refreshed through a new logon
A fresh logon token can incorporate new membership. Distribution conversion removes the security-group purpose; GPO filtering does not replace the resource ACL. Display-name matching does not control SID-based file authorization.
Open this question’s page →36. Which two practices support manageable AD user permissions? Select two answers.
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answers
- Assign resource rights to security groups rather than many individual users
- Place new users in the intended OU and role groups
Security-group rights simplify permission management, while intended OU and role placement supports policy and delegation. Recreation changes the SID unnecessarily; distribution groups cannot serve the required DACL authorization role.
Open this question’s page →37. Finance employees in two domains of the same forest need a common role applied to a share in a third domain. Which design follows AGUDLP?
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answer
- Domain global groups into a forest universal group, then a resource-domain domain-local group with the ACL
AGUDLP aggregates domain global groups in a same-forest universal group and assigns rights through a resource domain-local group. One global group cannot contain accounts from both domains; distribution groups are not NTFS authorization principals. Nesting a domain-local group inside global groups violates the global membership model and reverses the intended hierarchy.
Open this question’s page →38. The Resources forest trusts Partners. Partner employees belong to a Partners global group. Which resource-side arrangement can grant share access?
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answer
- Add the external global group to a Resources domain-local group and grant its resource permissions
A resource-domain domain-local group can contain eligible trusted principals such as the external global group. A Resources global group cannot contain external users, and universal membership does not span forests this way. Trust access does not copy password databases.
Open this question’s page →39. A multi-domain script changes an account with the expected name but in the wrong domain. Which improvement prevents this ambiguity?
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answer
- Target the intended domain/DC explicitly with -Server and verify the object identity
Explicit domain/DC context and identity verification target the intended object. An unqualified lookup or unchecked first match retains ambiguity. More privilege does not distinguish same-named objects in different domains.
Open this question’s page →40. Which two statements about multi-forest group design are correct? Select two answers.
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answers
- Foreign security principals represent external SIDs locally
- Resource-domain domain-local groups can hold eligible trusted external groups
Foreign security principals represent external identities, and domain-local resource groups can incorporate eligible trusted principals. Universal membership remains within its forest; trust validation does not refresh already issued logon tokens.
Open this question’s page →41. A supported web service runs on three domain member servers and needs one identity with automatic password rotation. Which account type fits?
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answer
- A gMSA authorized for the three computer accounts
A gMSA supports multiple approved hosts and managed passwords. An sMSA is for one host; LocalService does not provide the required shared domain identity. A shared Domain Admin password violates the least-privilege service design.
Open this question’s page →42. A newly created gMSA works on older approved hosts but fails on a server just added to its authorized host group. DC replication is healthy. What should be checked next?
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answer
- Refresh the server's machine group-membership token and test the account
A stale machine token can omit the newly granted host-group membership. Adding all users broadens secret access, and Domain Admins is unnecessary service privilege. Recreating root keys per startup introduces risk without addressing host-token state.
Open this question’s page →43. A production forest has a new KDS root key and several DCs. Hosts attempt gMSA retrieval immediately and failures vary by DC. What is the most appropriate response?
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answer
- Allow documented convergence, verify replication, and retest retrieval
The convergence period and healthy replication allow DCs to generate the same managed credentials reliably. Backdating is a lab shortcut, not a production repair. A gMSA uses generated managed passwords, and disabling Kerberos does not fix KDS readiness.
Open this question’s page →44. Which two conditions should be verified before using a gMSA for a service? Select two answers.
AD DS · AD DS | Create and manage AD DS security principals
✓ Correct answers
- The host is authorized to retrieve the managed password
- The application supports gMSA authentication
Application compatibility and host retrieval authorization are required. Domain Admin membership is not a default or necessary prerequisite. Manual password entry defeats the managed-account model.
Open this question’s page →45. Two applicable GPOs linked to the same OU conflict on one setting. Neither link is enforced. Which has higher precedence at that OU?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
✓ Correct answer
- The GPO with link order 1
Link order 1 has highest precedence at the same container. The largest number and creation date do not supply this precedence. Conflicting single-value settings do not always merge, although settings in separate areas can accumulate.
Open this question’s page →46. A session host must apply its machine-location user policy instead of a visitor's ordinary user-OU policy. Which configuration fits?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
✓ Correct answer
- Enable loopback Replace in applicable computer policy
Replace uses only the computer-location user GPO list. Merge retains the ordinary user list before adding the computer-based list. GPOs cannot be linked directly to user accounts, and disabling computer processing prevents the intended loopback configuration.
Open this question’s page →47. A domain GPO link is enforced, but the pilot computer lacks Apply Group Policy permission. The GPO does not apply. Why?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
✓ Correct answer
- Enforced affects precedence and inheritance but does not bypass security filtering
Enforcement does not grant Read or Apply Group Policy permissions. It is not a Schema Admin-only mode, survives ordinary block inheritance, and does not disable computer settings.
Open this question’s page →48. Which two checks are appropriate when a domain GPO fails to apply? Select two answers.
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
✓ Correct answers
- Confirm the target's OU/link scope and filtering permissions
- Inspect gpresult and AD/SYSVOL availability
Scope/permissions and result/replication checks identify application failures. A forced refresh cannot remove extension restart/logoff requirements. Central Store files define editor templates rather than proving client policy application.
Open this question’s page →49. A broadly scoped GPO contains several drive maps. Only the Finance map should depend on Finance membership. What is the best configuration?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
✓ Correct answer
- Use Security Group item-level targeting on the Finance map
Item-level targeting scopes just the Finance item. Filtering the whole GPO also removes unrelated maps for others; groups are not direct GPO link containers. Replacing every map neither provides membership targeting nor avoids disruption.
Open this question’s page →50. Users report that open applications lose their mapped drive at policy refresh. The preference uses Replace. Which action should be considered for ordinary maintenance?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
✓ Correct answer
- Use Update when preserving the mapping is suitable
Update can preserve the existing mapping while changing specified properties. Delete removes it; Create normally leaves an existing item unchanged rather than overwriting it. Privileged membership does not correct replacement semantics.
Open this question’s page →51. A former Finance member retains an old mapped drive after the preference no longer targets them. What likely explains the lingering mapping?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
✓ Correct answer
- Out-of-scope removal was not configured
Preferences can persist unless supported removal behavior or an explicit cleanup action is used. A lingering mapping does not prove current targeting. Apply once prevents reapplication rather than guaranteeing cleanup, and renaming the GPO does not delete the old mapping.
Open this question’s page →52. Which two statements correctly describe the separate common processing options for Group Policy preferences? Select two answers.
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies
✓ Correct answers
- Apply once and do not reapply skips subsequent reapplication after the initial item processing
- Remove this item when it is no longer applied configures cleanup and automatically selects Replace where supported
Apply once is an initial-only processing choice. The separate removal option provides deliberate cleanup and selects Replace where supported. These statements describe each option individually; they do not prescribe combining them. Apply once does not mean repeated replacement, and preferences can persist after leaving scope unless cleanup is configured.
Open this question’s page →53. A team needs a shared browser console to administer several on-premises Windows servers. Which deployment best meets that requirement?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- A Windows Admin Center gateway on a supported Windows Server
A shared Windows Admin Center gateway provides the common management URL. Individual desktop installations do not provide the requested shared endpoint. A data collection rule defines telemetry collection, and an RDS licensing server issues client access licenses rather than acting as a server-management console.
Open this question’s page →54. An Arc-enabled branch server has outbound internet access but no public IP or VPN. Administrators need the supported Windows Admin Center portal experience. What should they do?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- Deploy the Windows Admin Center extension to the Arc resource and permit its required outbound HTTPS endpoints
The Arc WAC extension and outbound service endpoints support the portal experience without inbound connectivity. AMA supplies telemetry rather than this console; inbound WinRM alone does not deploy the portal extension. A desktop gateway is a separate deployment and does not configure the requested Arc portal access.
Open this question’s page →55. An administrator can view an Arc server in Azure but cannot connect to its installed Windows Admin Center extension. The administrator has Reader only. Which additional role directly addresses the documented connection permission?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- Windows Admin Center Administrator Login
Windows Admin Center Administrator Login supplies the documented data action in addition to Reader. Virtual Machine Administrator Login targets a different Azure VM sign-in experience, onboarding permission registers Arc servers rather than granting WAC login, and VM resource contribution does not replace the WAC login data action.
Open this question’s page →56. You are preparing Windows Admin Center in Azure for a supported Arc-enabled server. Which two conditions must be satisfied for the documented portal connection? Select two answers.
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answers
- The connecting identity has Reader and Windows Admin Center Administrator Login covering the Arc resource
- The server can reach the required outbound HTTPS service endpoints
The documented Azure login roles and required outbound service reachability are both necessary. A public RDP rule is not part of this connection path, a workspace shared key does not authenticate WAC, and the portal supports its own tool set rather than requiring all local gateway extensions.
Open this question’s page →57. An administrator wants to run the same read-only service query on ten Windows servers and collect results. Which command is the most direct fit?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- Invoke-Command with the server list and a Get-Service script block
Invoke-Command runs the query on the specified remote computers and returns results. Enter-PSSession creates a single interactive session; local Get-Service examines the local host. Creating sessions alone does not execute the requested query.
Open this question’s page →58. From workstation A, you open a PowerShell session on B. A command on B cannot read C’s SMB share as your user, although B resolves C and reaches TCP 445. What should you investigate first?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- The identity used from B to C and whether the access method supports the required delegation
The additional resource request introduces a second-hop identity boundary. Check the executing identity and supported delegation design. The working first-hop transport, demonstrated SMB connectivity and successful name resolution do not establish the identity that accesses C.
Open this question’s page →59. Help-desk staff must restart only the Spooler service without acquiring unrestricted local administrator access. What is the most appropriate design?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- A JEA endpoint exposing a constrained restart operation for Spooler and mapping the help-desk group to that role
The constrained endpoint grants the requested operation without broad standing privilege. Unrestricted script execution or local Administrators defeats the boundary. Changing startup type does not restrict what operators can execute through an unrestricted endpoint.
Open this question’s page →60. A JEA design allows operators to call a role function that writes to a domain file share. A dedicated gMSA will execute the function. Which two actions are required? Select two answers.
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answers
- Configure the endpoint to use the intended gMSA run-as identity
- Grant that gMSA the required share and filesystem access
Configure the run-as identity and authorize that identity at the resource. gMSA status does not confer universal share permissions. Domain Admins membership is unnecessary and excessive for the operators. Unrestricted external commands weaken JEA rather than satisfying the defined resource rights.
Open this question’s page →61. A remoting design must open a second WinRM session from B to C. An engineer proposes resource-based Kerberos constrained delegation as a universal fix. How should you assess the proposal?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- Reject the universal assumption: this method is not documented to support the second WinRM hop
The second-hop documentation explicitly identifies the WinRM limitation of resource-based constrained delegation. Delegation support is service-specific. DNS zone type does not remove that protocol limitation, and TrustedHosts does not grant endpoint authorization or automatically delegate credentials.
Open this question’s page →62. A remote query returns a service object to the management computer. A method available on the live remote object is unavailable locally. What is the best approach?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- Invoke the method inside the remote script block while the live object exists there
Remoting commonly returns serialized data rather than the live remote object. Execute the operation remotely while that object exists there. A same-named local service is a different target; wrapping data or creating a new session does not reconstruct the old copy's native methods.
Open this question’s page →63. A Windows Server 2025 host has the OpenSSH component installed but refuses SSH connections. No process is listening on TCP 22. What is the first configuration to check?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- Whether the sshd service is enabled and running
Installed OpenSSH binaries do not start a listener. Check sshd and then its network path. Authorized keys and host-key trust become relevant after transport reaches the server; an allow rule does not start a stopped SSH service.
Open this question’s page →64. An ordinary SSH shell works between a Linux administrator workstation and Windows Server. New-PSSession -HostName fails because the server cannot find the PowerShell subsystem. Which change addresses the stated cause?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- Configure the sshd PowerShell subsystem to launch the installed PowerShell remoting host
PowerShell over SSH needs its configured subsystem even when ordinary SSH succeeds. WinRM is another transport, a password change does not define the missing subsystem, and -ComputerName selects the WSMan path rather than repairing SSH configuration.
Open this question’s page →65. A security baseline requires named JEA role capabilities and the supported Windows endpoint-configuration model. Which remoting choice satisfies that requirement?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- A configured JEA endpoint over WSMan/WinRM
The requested JEA hosting model is supported through Windows PowerShell endpoints over WSMan/WinRM. Current SSH remoting does not provide that endpoint-configuration/JEA model. A firewall rule alone is not a server or endpoint, and an RDP desktop does not impose the requested PowerShell role capabilities.
Open this question’s page →66. You are configuring key-based SSH access to a Windows server. Which two checks are directly relevant to successful, trusted access? Select two answers.
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answers
- The correct authorized-key file has appropriate permissions and the matching public key
- The client validates the expected server host key
Expected host-key validation establishes server trust, and the correct account's key file with appropriate ACLs supports key authentication. WinRM TrustedHosts is separate; a different user's file does not authorize the intended user. Administrative accounts still need the correct configured key location and permissions.
Open this question’s page →67. A remote desktop design requires users to authenticate before the Windows session is fully established. Which setting provides that behavior?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- Network Level Authentication
NLA authenticates before the full remote session is established. A TLS certificate protects server identity/transport, while group membership and logon rights authorize access; those controls alone do not select the NLA pre-session authentication behavior.
Open this question’s page →68. A user belongs to Remote Desktop Users and is included in an allow-logon policy. A security GPO also assigns that user’s group Deny log on through Remote Desktop Services. What is the expected outcome?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- RDP logon is denied because the deny right takes precedence
The deny remote-logon right overrides an allow right. Group membership and name resolution do not remove that restriction. RDS licensing grace does not override security user-rights assignments. Review effective policy and the intended group scope.
Open this question’s page →69. A business proposes using only Windows Server’s two administrative RDP connections to host a line-of-business desktop for thirty employees. Which conclusion is correct?
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answer
- The administrative connections do not replace an appropriately deployed and licensed RDS service
Administrative RDP access is not a substitute for multiuser RDS application delivery and licensing. Disconnecting users or changing group membership does not create the required licensing entitlement. Azure Reader concerns control-plane visibility and does not change Windows desktop-service licensing.
Open this question’s page →70. A user can ping a Windows server's verified IP address but cannot open a direct RDP session to that address. Which two areas still need checking? Select two answers.
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment
✓ Correct answers
- The RDP listener and TCP3389 firewall/network path
- NLA authentication and effective remote-logon rights
Ping proves neither the RDP listener/packet path nor authentication and authorization. Inspect those layers. Successful ICMP is already demonstrated; DNS does not explain this stated IP connection, and a resource display name does not prove RDP readiness.
Open this question’s page →71. A physical Windows server must stay in its branch office while administrators apply supported Azure governance and extension management. Which service provides that management representation?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Azure Arc-enabled servers
Azure Arc represents the existing server for supported governance and extensions while it runs in place. Migration discovery, telemetry alone, or an unsupported extension target does not establish that Arc management representation.
Open this question’s page →72. An Arc onboarding attempt fails where direct outbound HTTPS is blocked and an approved proxy path has not been configured for the agent. What should be corrected first?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- The agent's supported proxy configuration and required service-endpoint connectivity
The agent requires its own supported path to Azure service endpoints. A user display name or inbound RDP does not provide that path. Browser proxy settings alone do not configure the Connected Machine agent's effective proxy.
Open this question’s page →73. An Arc server shows Connected, but no guest performance counters arrive in Log Analytics. What additional configuration should you investigate?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Azure Monitor Agent and the appropriate data collection rule association
Arc management connectivity does not configure a guest telemetry pipeline. AMA plus a suitable DCR association collects the required counters. Heartbeats alone, an unconfigured AMA, and resource diagnostics alone do not establish the specified guest-counter collection.
Open this question’s page →74. Before onboarding a supported Windows server to Azure Arc, which two requirements should you verify? Select two answers.
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answers
- The server can resolve and reach required endpoints with an accurate clock
- The installer has appropriate local privileges and the onboarding identity has the required Azure permissions
Arc onboarding requires local installation permissions, appropriate Azure authorization and functional connectivity/time. Workload migration and DC promotion are not prerequisites. Copying an existing registration violates the need for a unique machine identity.
Open this question’s page →75. A Machine Configuration policy reports that a server’s TLS setting is noncompliant. The assignment is Audit mode. Which behavior should you expect?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- The finding is reported without the setting being automatically changed
Audit reports guest state without applying it. Initial application with monitoring describes Apply and Monitor; automatic drift repair describes Apply and Autocorrect. Resource tag checks do not evaluate the stated guest TLS configuration.
Open this question’s page →76. A guest setting must be configured initially, and later drift must be reported for an administrator to approve remediation. Which mode matches that requirement?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Apply and Monitor
Apply and Monitor establishes the configuration and observes subsequent drift. Audit does not provide the initial application; Autocorrect would repair drift without the requested separate approval. A resource tag check does not manage the guest setting.
Open this question’s page →77. A new Azure VM must evaluate guest configuration assignments, but its required guest extension and system-assigned identity are absent. What should you do?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Deploy the Machine Configuration prerequisites using the supported extension and identity workflow
Azure VM guest configuration needs its supported extension and system-assigned identity. A user-assigned identity alone is not that prerequisite; AMA is a telemetry agent, and tags do not install the guest configuration engine.
Open this question’s page →78. Which two statements correctly distinguish guest configuration deployment across Azure VMs and Arc servers? Select two answers.
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answers
- Arc servers include the guest-configuration capability in the Connected Machine agent
- Azure VMs need the supported machine-configuration extension and a system-assigned managed identity
Azure VM prerequisites and the Arc agent’s included capability differ. Audit only reports, Apply and Monitor observes later drift, and resource metadata does not prove guest registry state. These distinctions prevent deploying the wrong prerequisites or assuming remediation occurred.
Open this question’s page →79. A component supported on Azure VMs is proposed for a non-Azure Windows server. What must you verify before deploying it as an Arc extension?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Support in the Arc extension catalog for that OS, cloud and handler
Check the Arc catalog and deployment requirements because support is not identical across execution environments. A matching name or ping response does not verify handler support. An on-premises server is not placed into an Azure VM availability set merely by Arc registration.
Open this question’s page →80. An Arc Custom Script extension needs a confidential parameter supported by its handler. Where should that value be provided?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- In the supported protected-settings field, with deliberate secret handling
Protected settings are designed for sensitive handler input. Ordinary settings, names and tags can expose the secret through routine configuration access. Protected settings still require appropriate access control and logging hygiene; they are not a reason to broadcast secrets elsewhere.
Open this question’s page →81. An Arc server remains Connected. A new extension fails because its package URL is unreachable from the guest. What is the most direct repair?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Restore the supported package-download endpoint path and recheck the extension result
The failure identifies a package path separate from the working Arc connection. Restore that path and inspect results/logs. Azure authorization, display names and heartbeat-only checks do not repair the unreachable package URL.
Open this question’s page →82. Which two actions form a sound troubleshooting sequence for an Arc extension that reports Failed? Select two answers.
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answers
- Inspect the local handler logs and relevant package/network prerequisites
- Read the Azure extension provisioning error
Use the Azure provisioning error and local execution evidence to isolate the fault. Connected does not certify each extension, handler upgrade is not OS patch installation, and broadly granting deployment rights adds privilege without diagnosing the failure.
Open this question’s page →83. A Windows server is configured to obtain approved updates from WSUS. After you enable Azure Update Manager, where does it obtain the guest’s applicable update content?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Through the server’s configured Windows update source, including WSUS
Update Manager uses the guest’s configured update mechanism and source. It does not override WSUS with a universal Azure repository. Workspace data and resource tags are not operating-system update content repositories.
Open this question’s page →84. An Azure VM must participate in scheduled Azure Update Manager maintenance. Which patch-orchestration configuration is the documented recommended choice?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Customer Managed Schedules
Customer Managed Schedules is the documented orchestration choice for scheduled VM patching. The alternative orchestration modes have different behavior and do not replace the required schedule prerequisites; extension-handler upgrades are distinct from OS patches.
Open this question’s page →85. A server appears in Update Manager and assesses successfully. Its installation run is incomplete after the short maintenance window closes. What should you review next?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Installation results, window duration and required reboot/servicing state
The incomplete installation in a short window calls for installation details, elapsed time and servicing/reboot review. Assessment does not prove installation, handler upgrades are separate, and selection criteria do not explain completion once the server was already included.
Open this question’s page →86. Two application nodes must remain available while scheduled patches are installed. Which two design choices best support that requirement? Select two answers.
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answers
- Verify application health before patching the next node
- Use separate patch waves or maintenance associations for the nodes
Separate waves and health checks preserve and verify a surviving application path. Simultaneous restarts increase outage risk. Assessment does not prove post-installation availability, and ignoring required reboots can leave updates incomplete.
Open this question’s page →87. A server with the wrong environment tag is omitted from a scheduled Update Manager run that uses dynamic scope. What is the most direct correction?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Correct and verify the scope criteria or server tag, then confirm the server's inclusion in the intended run
Runtime scope selection depends on its criteria such as tags. Correct and verify that membership. Classification, orchestration mode or manual assessment alone does not make a mismatched resource satisfy the dynamic tag criteria.
Open this question’s page →88. A nightly runbook must inventory SMB shares reachable only through a branch network. Which execution environment best fits that requirement?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- A supported Hybrid Runbook Worker with access to the branch shares
A configured worker executes through its own network and environment. The cloud sandbox does not inherit a laptop VPN; Arc registration alone does not create a worker. A worker without the required route still cannot reach branch-only shares.
Open this question’s page →89. A runbook passes its test-pane checks, but the expected new version is not used by scheduled jobs. What step should you verify?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- That the intended runbook version was published and the schedule/job targets it
Draft testing/saving is separate from publishing the version used by normal jobs. An open test pane does not publish it. Worker dependencies may be necessary but do not publish the intended runbook definition.
Open this question’s page →90. An Arc server runs a Hybrid Runbook Worker. Its Automation account has an enabled system-assigned managed identity. The runbook uses the documented managed-identity Azure sign-in path. Which identity should receive the required Azure resource role?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- The Automation account's system-assigned managed identity
The enabled Automation account system-assigned identity takes precedence for the documented Arc-worker sign-in path. The Arc identity cannot replace it in this configuration, and the Automation account user-assigned identity is not supported for that hybrid flow. Windows System is the local execution context rather than the selected Azure identity.
Open this question’s page →91. A Windows hybrid job must read an AD-authenticated share and write to Azure Storage. Which two authorization checks are needed? Select two answers.
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answers
- The Azure identity selected by the supported sign-in flow has the required storage permissions
- The Windows execution identity has the required share and filesystem permissions
Windows and Azure operations use separate authorization layers. Grant the actual identity the rights needed at each resource. Azure Contributor does not automatically grant domain SMB/NTFS rights, local administrator status does not grant Azure storage data access, and connectivity does not supply either authorization.
Open this question’s page →92. A worker runbook logs several nonterminating PowerShell errors and its job still reports Completed. Which conclusion is most appropriate?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Review the error streams and business result; job completion alone does not prove each operation succeeded
PowerShell can continue after nonterminating errors. Inspect the actual operations and error streams, and design failure handling to match the required outcome. Repeated execution without diagnosis can repeat a partial failure, and classifying every error as networking ignores the available evidence.
Open this question’s page →93. A runbook using Az modules must operate only in a specified subscription, and prior worker jobs may have saved an Azure context. Which two measures directly address that risk? Select two answers.
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answers
- Disable context autosave for the process and authenticate deliberately
- Set and use the intended subscription context for the operations
Deliberate authentication plus an explicit subscription context avoids accidentally using a previous worker session’s saved context. Assuming the previous subscription is correct is unsafe. Plaintext secrets and broad Owner permissions neither isolate the intended context nor satisfy least privilege.
Open this question’s page →94. A Windows Server 2025 VM has a broken IP configuration. Its Remote Desktop Services and both enhanced-session settings are ready. An administrator needs local-drive redirection through VMConnect. Which feature meets the requirement?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Enhanced Session Mode
Enhanced Session Mode uses the Hyper-V path and supports local-drive redirection without guest IP connectivity. Network RDP requires a reachable guest IP. Basic VMConnect provides console access but lacks enhanced resource redirection, and full-screen basic display changes presentation rather than adding that feature.
Open this question’s page →95. A Hyper-V host permits enhanced sessions, and a supported Windows guest has Remote Desktop Services enabled. A particular administrator still opens basic VMConnect sessions. Which setting should be checked first?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Use enhanced session mode in that user's Hyper-V settings
Use enhanced session mode requests the feature for that user and complements the already enabled host policy. Full-screen basic mode does not request redirection. An IP port-forwarding rule and access VLAN concern network RDP paths rather than the Hyper-V enhanced transport.
Open this question’s page →96. After enabling Enhanced Session Mode on a host, an administrator connects to a supported Windows Server guest that is still booting and has Remote Desktop Services disabled. Why is host configuration insufficient?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Enhanced sessions also need the guest service and a usable guest logon environment
The guest must be ready and have Remote Desktop Services enabled. Host policy does not automatically enable that guest service. A VM generation does not substitute for the service, and an external switch supplies networking rather than the missing session endpoint.
Open this question’s page →97. An administrator will use Enhanced Session Mode with a supported Windows Server 2025 guest. Which two preparations are required? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Allow enhanced session mode in the host policy
- Enable Remote Desktop Services in the guest
Host permission and guest Remote Desktop Services are required; the user's enhanced-session setting must also be enabled. A public IP and an external switch are unnecessary for the Hyper-V transport. Shared AD-domain membership is not a general enhanced-session prerequisite; valid guest logon rights still matter.
Open this question’s page →98. APP01 is a locally running Windows Server 2025 guest on HV01. Its virtual NIC configuration is broken, but an administrator has host Hyper-V rights and valid guest credentials. Which command runs a guest diagnostic without using that NIC?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Invoke-Command -VMName 'APP01' -Credential $cred -ScriptBlock { Get-NetIPConfiguration }
Invoke-Command with VMName uses PowerShell Direct on the local host to execute inside the guest. Get-VM queries host VM objects. Invoke-Command and Enter-PSSession with ComputerName rely on the guest's network remoting path, which is broken here.
Open this question’s page →99. An administrator has a working PowerShell Direct connection and needs to copy two files and run several commands in the same guest context. Which approach best fits?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Create a New-PSSession with VMName and reuse the session
A persistent New-PSSession with VMName retains the Direct guest context and supports repeated session operations and file copying. Public IPs are unnecessary for Direct. Get-VM queries virtualization objects, and host rights do not replace valid guest credentials.
Open this question’s page →100. A remote administrator can reach HV01. APP01 runs there, but the administrator's workstation cannot find APP01 with a local PowerShell Direct VMName command. What is the appropriate next step?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Run the Direct operation on HV01 after establishing authorized access to that host
PowerShell Direct targets a VM running locally on the host where the operation executes, so first accessing HV01 addresses placement. Opening guest WinRM or changing TrustedHosts concerns network remoting and does not change Direct's locality. Installing PowerShell 7 does not convert Direct into a cross-host discovery mechanism.
Open this question’s page →101. A Linux VM has ordinary TCP SSH working, and the team wants to validate a proposed SSH Direct implementation. Which two checks establish the intended network-independent path? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Verify a compatible Linux Hyper-V socket/VSOCK SSH endpoint and host tooling
- Test the configured connection with guest networking disconnected
Compatible socket endpoint/tooling and a test without guest networking verify the intended path. A TCP 22 test only verifies IP SSH. Linux PowerShell does not provide the Windows PowerShell Direct guest endpoint. Disabling host-key checking weakens authentication and does not create socket support.
Open this question’s page →102. A lab uses an Intel VT-x/EPT Hyper-V host running Windows Server 2025. A VM will run Hyper-V itself. What host-side action enables the inner hypervisor to use virtualization extensions?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Set ExposeVirtualizationExtensions to true while the VM is off
ExposeVirtualizationExtensions makes the CPU capability available to the middle VM. MAC spoofing concerns nested network traffic. Outer-host management tools do not expose guest CPU instructions, and a larger vCPU count alone does not enable nesting.
Open this question’s page →103. Nested guests must reach external resources, but the public-cloud network cannot accept their MAC addresses. Which configuration meets this constraint?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- An internal switch and NAT in the middle VM with inner-guest IP/gateway configuration
Internal switching plus NAT presents the middle VM's reachable path to the surrounding network and needs inner-guest addressing. MAC spoofing conflicts with the stated constraint. A private switch alone has no external routing path. A memory ceiling does not establish connectivity.
Open this question’s page →104. An AMD-based outer Hyper-V host runs Windows Server 2019, and its VM configuration version is 9.0. The team cannot enable supported nested Hyper-V. Which documented requirement explains the failure?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- AMD nesting needs Windows Server 2022 or later and configuration version 9.3 or later
The AMD path requires the documented newer outer host OS and VM configuration. The Intel minimum is not the AMD rule. Upgrading only the guest or increasing vCPUs does not supply the required outer-host support and configuration version.
Open this question’s page →105. Hyper-V is running inside a Windows Server middle VM. Which two statements are correct? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Shut down the middle VM before changing its assigned memory
- Inner guests using NAT need valid addresses and a gateway toward the NAT adapter
The running nested hypervisor imposes the memory-change restriction, and NAT clients need correctly configured addressing and gateway. Dynamic Memory cannot vary that middle VM's memory normally in this state. New-NetNat creates translation rather than a DHCP scope, and exposing extensions does not install the Hyper-V role.
Open this question’s page →106. A Windows VM needs 2 GB to boot. Its Dynamic Memory settings are 512 MB Startup RAM and 8 GB Maximum RAM. Why might it fail to start?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Maximum RAM does not replace the startup allocation required for boot
Startup RAM must meet boot requirements; a high maximum only permits later growth. Dynamic Memory does not preallocate every maximum, its buffer is not a permanent maximum reservation, and priority governs relative host allocation rather than bypassing guest boot needs.
Open this question’s page →107. A variable-load application boots with 2 GB, can safely idle at 1 GB, and may need up to 6 GB. Which configuration fits?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Dynamic Memory with 2 GB startup, 1 GB minimum, and 6 GB maximum
The specified Dynamic Memory range matches boot, idle, and peak needs while allowing demand-based changes. Static 1 GB may not meet boot requirements and does not use Dynamic Memory buffer behavior. A maximum is not guaranteed reserved RAM. Static 6 GB stays fixed rather than ballooning to a minimum.
Open this question’s page →108. A cluster node fails, and surviving nodes lack enough startup RAM for all VMs. The team proposes relying on Smart Paging for failover. What is the correct assessment?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Reserve physical capacity because Smart Paging does not solve insufficient failover RAM
Smart Paging is a constrained restart mechanism and does not substitute for failover capacity. It does not guarantee failover startup RAM, more paging-file space does not remove that physical requirement, and priority expresses relative preference rather than reserving every maximum.
Open this question’s page →109. Several Dynamic Memory VMs slow down during host pressure. Which two observations directly help assess memory allocation? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Inspect host available RAM and guest paging
- Compare each VM's MemoryDemand with MemoryAssigned
Demand versus assignment and host/guest paging evidence reveal allocation pressure. Maximum RAM is a ceiling rather than an allocation promise. Buffer is attempted extra memory, and priority neither proves sufficient capacity nor rules out an application leak.
Open this question’s page →110. Hyper-V Manager reports a VM as Running, but the team needs an indication that its guest OS is responsive. Which integration function is most relevant?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Heartbeat
Heartbeat is the dedicated guest responsiveness signal. Guest Service Interface supports operations such as file copy, KVP exchanges metadata, and time synchronization coordinates clocks; none is the dedicated heartbeat indication.
Open this question’s page →111. An administrator needs to copy a host file into a supported running guest without using its network. Copy-VMFile fails because the corresponding VM integration function is disabled. What should be enabled?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Guest Service Interface
Guest Service Interface supports Copy-VMFile. Heartbeat reports responsiveness, shutdown coordinates a graceful guest stop, and backup/VSS integration coordinates consistency rather than this file-copy channel.
Open this question’s page →112. A production checkpoint fails on a Windows guest although host storage has adequate free space. Guest VSS writers report errors. What should the administrator investigate next?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Guest VSS writers and backup integration health
Production consistency depends on healthy guest VSS writers and backup integration. Standard checkpoints capture memory instead of supplying the required production mechanism. Disabling backup integration does not repair writers, and file copying does not coordinate application quiescing.
Open this question’s page →113. Which two statements about integration services are correct? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Both VM-side enablement and compatible guest components matter
- KVP metadata absence can occur even when the guest network works
Integration functions need host configuration and supported guest implementation. KVP may fail separately from the network. Running state does not establish application health, Linux feature support varies, and PowerShell Direct still requires valid guest credentials.
Open this question’s page →114. A supported application VM needs exclusive use of an entire PCIe GPU and its native vendor features. Planned live migration is not required. Which feature fits?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Discrete Device Assignment
DDA gives one VM the complete assignable device and native driver access. GPU partitioning shares GPU fractions. Enhanced Session Mode redirects session resources, and Guest Service Interface supports integration tasks such as file copy; neither assigns a whole accelerator.
Open this question’s page →115. A DDA-capable GPU is ready for a Windows VM. Which host preparation should precede assignment?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Use static VM memory, configure TurnOff, dismount the disabled host device, then assign its location path
Static memory, TurnOff, and dismount-before-assignment meet DDA's state and ownership requirements. Dynamic Memory and Save are unsupported. An active host-owned device cannot simultaneously be passed through. A guest driver cannot substitute for hardware isolation and assignability verification.
Open this question’s page →116. A VM with several assigned GPUs fails to use all device memory. SurveyDDA reports MMIO requirements above the VM's current allocation. Which change addresses the evidence?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Increase the VM's MMIO allocation to cover the assigned devices and overhead
The combined assigned devices need sufficient mapped-I/O address space plus overhead. Ordinary RAM alone does not change that mapping gap. Dynamic Memory is unsupported with DDA, and counting only one device can still leave the combined requirement unsatisfied.
Open this question’s page →117. A team plans a supported Windows Server 2025 Datacenter clustered GPU DDA deployment. Which two expectations are valid? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- The assigned GPU is dedicated to the VM rather than shared as partitions
- A failed VM can restart where a GPU-pool device is available
GPU pools can support restart placement in the documented clustered design, and DDA still dedicates the complete device. DDA does not support live migration or Dynamic Memory. Cluster membership does not establish device-class or hardware-vendor support.
Open this question’s page →118. Several Windows VDI VMs need fractions of one supported GPU. Hosts run Windows Server 2025 with migration-capable hardware and drivers. Which feature supports this sharing and planned live migration?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- GPU partitioning
GPU partitioning supplies hardware-isolated fractions and supports qualifying Server 2025 live migration. DDA dedicates the whole device and blocks live migration. Enhanced sessions concern interactive resource redirection, while checkpoints capture recovery state; neither supplies the required shared accelerator design.
Open this question’s page →119. Windows Admin Center reports a GPU as Paravirtualization after the partition driver was installed. What should be checked before assigning partitions?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- SR-IOV and virtualization support in server firmware
Paravirtualization indicates driver capability without enabled SR-IOV, so firmware configuration is relevant. Ordinary VM RAM does not enable SR-IOV. DDA establishes a different whole-device ownership model, and unsupported partition counts do not correct firmware readiness.
Open this question’s page →120. Two GPU-P hosts use the same GPU and partition count, but one has an AMD EPYC 7002 processor. Partitions work, yet the team requires supported live migration. What is missing?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Migration-capable IOMMU DMA bit-tracking hardware on the EPYC 7002 host
EPYC 7002 supports partitioning but not GPU-P live migration; qualifying DMA bit-tracking hardware is required. Increasing partition count or guest VRAM does not add that CPU capability. A GPU cannot simultaneously provide DDA and GPU-P.
Open this question’s page →121. A supported Server 2025 GPU-P deployment needs planned migration between hosts. Which two preparations directly meet GPU-specific requirements? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Keep GPU model, capacity, and partition count homogeneous
- Use supported migration-capable hardware and qualifying host/guest drivers
Homogeneous GPU configuration and qualifying hardware/drivers meet the documented migration requirements. Partition count must come from supported values. DDA does not provide live migration, and consumer GPU support cannot be inferred without a supported hardware/driver entry.
Open this question’s page →122. A database change must have a VSS-based checkpoint, and policy forbids saved-memory fallback. Which CheckpointType should be configured?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- ProductionOnly
ProductionOnly permits the production mechanism or failure, avoiding standard fallback. Production can fall back to Standard. Standard captures memory state, and Disabled prevents the required checkpoint altogether.
Open this question’s page →123. An administrator wants to remove a successful pre-change checkpoint and retain the VM's latest writes. Which action is appropriate?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Remove the checkpoint with Hyper-V management and allow the merge
Hyper-V removal coordinates the dependency chain and merges retained changes. Direct AVHDX deletion destroys part of that chain. A child depends on its parent, so detaching the parent is unsafe. Restoring discards or changes the intended current state rather than simply removing the no-longer-needed recovery point.
Open this question’s page →124. A Windows VM configured for ProductionOnly cannot create a checkpoint. Host disk capacity is adequate, and a VSS writer inside the guest is failed. What explains the behavior?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Production consistency failed and the configured setting prohibits standard fallback
ProductionOnly fails when production consistency cannot be obtained, matching the failed writer. It does not capture saved memory. External switching is not a checkpoint prerequisite, and a memory ceiling does not repair VSS writer failures.
Open this question’s page →125. Which two statements accurately describe Hyper-V checkpoints? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Checkpoint disk data depends on a parent/child chain
- Standard checkpoints can preserve old guest memory state
Standard checkpoint memory and the dependent disk chain explain recovery behavior. Checkpoints are not independent off-host copies. Production consistency still requires supported healthy guest applications/writers. Hyper-V-managed removal, rather than manual AVHDX deletion, performs supported merging.
Open this question’s page →126. A company needs Windows VMs to restart on another on-premises host automatically after one host fails. Which design best fits?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- A validated Hyper-V failover cluster with resilient accessible VM storage and clustered VM roles
The cluster manages VM recovery and requires accessible storage and clustered roles. Independent hosts with inaccessible local files cannot recover those VMs automatically. Checkpoints supply local recovery state, and enhanced sessions provide access; neither creates failover orchestration.
Open this question’s page →127. A prepared failover cluster can access APP01's files on supported storage, but APP01 is still only an ordinary Hyper-V VM. Which command places it under cluster control?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Add-ClusterVirtualMachineRole -VMName 'APP01'
Add-ClusterVirtualMachineRole creates the cluster-managed VM role. Get-ClusterGroup inspects existing roles. Move-VM performs a supported VM move rather than registering a cluster role, and Checkpoint-VM creates a recovery point.
Open this question’s page →128. A cluster's storage remains healthy after a node failure, but some VMs cannot restart because surviving nodes lack RAM. What design issue is indicated?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Failover capacity was not sized for the lost node's VM demand
Surviving-node RAM and compute capacity must accommodate the selected failure tolerance. A witness supplies quorum votes rather than VM memory. Live migration needs a functioning source, and checkpoint storage cannot supply required physical startup RAM.
Open this question’s page →129. A team plans Hyper-V maintenance and unplanned host-failure recovery. Which two statements should guide the design? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Cluster failover can restart a VM using resilient accessible disks
- Live migration uses a working source host for a planned move
Planned migration transfers running state from a live source, while cluster failover restarts using accessible disks. Switch names must also map to correct networking. A cloud witness participates in quorum, and host clustering does not automatically implement application-level guest clustering.
Open this question’s page →130. A VM's VHDX was expanded from 100 GB to 200 GB. Windows still reports its volume as 100 GB. Which step is still required?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Extend the guest partition into the new unallocated capacity
Disk capacity and partition size are separate, so extend the guest partition. Optimize-VHD reclaims eligible physical file space rather than extending a volume. Block size is not a partition-extension operation, and another differencing disk adds a dependency rather than growing the guest filesystem.
Open this question’s page →131. An administrator must expand a data disk while a Hyper-V VM continues running. Which documented attachment permits online Resize-VHD?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- A supported VHDX on the VM's SCSI chain
The supported SCSI attachment provides the online resize path. IDE requires the VM to be offline, so VHDX format alone does not bypass controller constraints. Editing a parent behind an active checkpoint child risks the disk chain rather than supplying a valid online operation.
Open this question’s page →132. Resize-VHD rejects a requested shrink of a VHDX to 40 GB. Get-VHD reports MinimumSize as 60 GB. What explains the error?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- The requested capacity is below the disk's current minimum supported shrink size
A VHDX cannot be shrunk below its reported MinimumSize. Resize-VHD can shrink VHDX rather than VHD. Compaction does not automatically remove the virtual capacity boundary, and drive-letter changes do not alter the VHDX allocation/layout constraints.
Open this question’s page →133. Which two statements about Hyper-V virtual disks are correct? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- A dynamic disk can grow its physical file as guest data is written
- A differencing disk depends on its parent
Differencing disks need parent data, and dynamic files grow with writes. Compaction targets eligible file space rather than automatically reducing guest capacity. A guest partition needs its own extension, and a virtual maximum does not guarantee physical host capacity.
Open this question’s page →134. An untrusted Windows VM should remain a DHCP client but must not distribute leases to other VMs. Which adapter control meets that requirement?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- DHCP Guard
DHCP Guard restricts DHCP-server messages from the VM without being a blanket DHCP-client prohibition. Router Guard addresses unauthorized routing advertisements. MAC spoofing changes permitted source-MAC behavior, and port mirroring copies traffic for analysis rather than blocking rogue DHCP replies.
Open this question’s page →135. APP01 must use VLAN 120 through the Production switch as an ordinary single-VLAN guest. Which configuration fits?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Connect its adapter to Production and set access VLAN 120
The guest adapter needs the correct switch and its own access VLAN. A management OS VLAN setting does not automatically apply to guest adapters. An unrestricted trunk is unnecessary and needs guest tag handling. A Windows IP address cannot connect a disconnected virtual NIC.
Open this question’s page →136. A new Hyper-V VM hosts the authorized DHCP role. Clients on its reachable VLAN send Discover messages, but no offers leave the VM's switch port. DHCP Guard is enabled on its adapter. What should be corrected?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Disable DHCP Guard for the authorized DHCP-server adapter
DHCP Guard blocks the very server messages this authorized VM must send. Router Guard addresses different traffic, and MAC spoofing does not remove DHCP Guard filtering. Trunk mode introduces VLAN-handling changes rather than correcting the identified guard rule.
Open this question’s page →137. A diagnostic VM will inspect copied traffic while a nested-host VM must send inner-guest source MACs. Which two settings fit these separate needs? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Allow MAC spoofing on the nested-host adapter where the network permits it
- Configure port mirroring toward the diagnostic VM
Port mirroring creates diagnostic copies, and permitted MAC spoofing allows the nested source addresses. DHCP Guard and Router Guard filter their respective traffic and do not create captures. Trunk mode controls VLAN tags, not authorization for different source MACs.
Open this question’s page →138. A new Windows Server 2025 Hyper-V host needs a vSwitch with two compatible physical uplinks and switch-independent failover. Which approach fits the modern embedded design?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Switch Embedded Teaming
SET integrates host uplinks and the vSwitch using switch-independent operation. Guest-only LBFO does not team host uplinks, and a single guest NIC cannot provide such a guest team. SET does not require LACP. Unrelated vSwitches alone do not implement a common teamed uplink.
Open this question’s page →139. Two matched host adapters are ready for SET. Which command creates the intended embedded team?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- New-VMSwitch -Name 'Production' -NetAdapterName 'NIC1','NIC2' -EnableEmbeddedTeaming $true
The multi-adapter New-VMSwitch with EnableEmbeddedTeaming creates the intended host SET. A private switch has no physical uplinks. AllowTeaming permits guest teaming rather than creating a host team. A switch on NIC1 alone does not supply the two-uplink embedded team.
Open this question’s page →140. A Windows guest has two teamed virtual NICs, but both lead through the same host uplink. Both lose connectivity when that uplink fails. What is the main design issue?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- The teamed guest adapters share a failed physical dependency
A common uplink remains a single failure boundary for both guest paths. Guest teaming does not survive host loss automatically. LACP is not a universal supported guest-teaming requirement, and another virtual IP does not create physical path independence.
Open this question’s page →141. Which two statements guide a supported SET deployment? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Use matched compatible physical adapters
- Configure physical ports for switch-independent operation rather than SET LACP
Matched adapters and correct switch-independent physical configuration meet SET's design. Aggregate bandwidth is not a single-flow guarantee. AllowTeaming affects guest adapters, and arbitrary dissimilar drivers/adapters do not meet SET compatibility requirements.
Open this question’s page →142. A lab must let three VMs communicate with each other while excluding the Hyper-V host's management OS and physical network. Which switch type fits?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Private
Private switching connects attached VMs only. Internal also connects the host. Both external variants attach to a physical network; disabling management-OS sharing removes the host's shared adapter but does not isolate the VMs from that physical network.
Open this question’s page →143. Two VMs need to communicate with the host for a local test but do not need a physical uplink. Which command creates the intended switch?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- New-VMSwitch -Name 'Lab' -SwitchType Internal
An Internal switch includes the host virtual adapter without a physical uplink. Private excludes host participation. NetAdapterName creates an external switch. VLAN configuration changes an adapter's tagging and does not create the required switch.
Open this question’s page →144. An administrator creates an internal switch and gives the VMs private addresses. VM-to-host traffic works, but Internet access fails. No router or NAT exists. What is missing?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- A configured routing/NAT path and suitable guest gateway
Internal switching supplies local Layer 2 connectivity; external access needs routing/NAT and a usable gateway. Another isolated switch, a traffic permission alone, or a VLAN tag does not create the missing Layer 3 path.
Open this question’s page →145. An external Hyper-V switch will share NIC1 with the management OS. Which two statements are correct? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Changing the switch/uplink can disrupt remote management
- The host can use a management vEthernet adapter on the switch
Sharing creates the host virtual-adapter path, and rebinding can disrupt the management session. AllowManagementOS does not configure NAT. An external uplink connects to the physical network. Host and guest adapter VLANs are separately configured.
Open this question’s page →146. A company needs a VM copy at a remote site without shared source/target storage and accepts a nonzero recovery point. Which feature fits?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Hyper-V Replica
Replica maintains an asynchronous independent-site VM copy. A local cluster around source storage does not by itself create the remote copy. A source-volume checkpoint shares that volume's failure boundary. Live migration is a planned move from a healthy host, not an offline disaster-recovery replica.
Open this question’s page →147. Replica traffic crosses an untrusted network and must be encrypted in transit. Which authentication/transport selection meets this requirement?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Certificate-based HTTPS with suitable trust
Certificate-based HTTPS encrypts the Replica transport. Kerberos authenticates HTTP but does not supply HTTPS encryption. Interval changes affect timing, and a Broker supplies cluster routing, not transport encryption by itself.
Open this question’s page →148. The primary site is unavailable. A replica can start, but its last received changes are several minutes old. Which expectation is correct for an unplanned failover?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Unsent primary changes may be lost, so choose the recovery point and fence the old primary
Asynchronous replication cannot restore unsent changes, and fencing avoids competing copies. VM configuration does not contain all unsent transactions. Parallel activation creates conflict risk. Zero loss depends on a successful coordinated final transfer during planned failover, which is unavailable here.
Open this question’s page →149. The team wants to validate Replica recovery without disrupting the primary. Which two actions fit? Select two answers.
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answers
- Run a test failover at the replica site
- Verify the isolated test VM's boot and application dependencies
Test failover creates an isolated temporary copy for boot/application checks while primary operation and replication continue. A primary shutdown is a planned-failover step rather than required testing. The temporary test copy does not permanently replace the replica, and replication health alone does not validate recovery connectivity.
Open this question’s page →150. A Windows application must retain its only copy of business data after Azure host maintenance. Which location is appropriate?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- A suitable persistent managed data disk
A persistent managed data disk provides storage independent of the temporary host-local lifecycle. Temporary/resource storage and allocation-local scratch paths are disposable. An ephemeral OS disk is intended for replaceable instances and is not an appropriate sole durable database copy.
Open this question’s page →151. A new managed disk appears in Windows Disk Management after Azure attachment but has no usable drive. What should be done next?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- Initialize it appropriately, create a partition, and format the volume in Windows
Guest disk initialization and filesystem creation are separate from Azure attachment. Resizing the VM does not create a filesystem, host caching does not format it, and changing LUN does not automatically create the guest volume.
Open this question’s page →152. An application reaches the VM's aggregate storage throughput limit even though its managed disks could individually deliver more. Which change addresses the demonstrated bottleneck?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- Select a compatible VM size with sufficient aggregate storage throughput
A VM-size throughput ceiling requires an appropriate compatible VM capacity or workload redesign. Disk capacity alone does not remove that ceiling. Premium SSD v2 has no host caching support. A temporary disk cannot preserve the required durable data model.
Open this question’s page →153. Which two statements are correct for Azure managed-disk planning? Select two answers.
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answers
- Ultra Disk and Premium SSD v2 cannot be used as OS disks
- Guest partition extension is needed after disk capacity grows
The two disk classes are data-only, and expansion still needs guest partition work. Separate snapshots do not guarantee multi-disk consistency. ZRS provides disk redundancy rather than VM replicas. Ordinary managed-disk shrinking is unsupported; migrate to a smaller disk when required.
Open this question’s page →154. A replaceable web tier experiences daily demand variation and must add or remove instances automatically. Which design fits?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- A VM scale set with workload autoscale and load balancing
A scale set supplies horizontal instance orchestration and autoscale; load balancing directs traffic across healthy instances. A larger single VM is vertical capacity without automatic instance scaling. An availability set controls placement, and disk snapshots preserve recovery data rather than manage instance counts.
Open this question’s page →155. A resize target is supported and quota is available, but Get-AzVMSize for the current VM does not offer it on the allocated hardware cluster. What should be planned?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- Deallocate before resizing, with temporary-data and restart implications
Deallocation may be required to place the VM on hardware offering the target size. Guest configuration cannot change Azure's allocated SKU. Disk capacity does not expose another hardware family, and an availability set does not replace the required resize/placement workflow.
Open this question’s page →156. An Azure VM was shut down inside Windows. Its state is Stopped, and compute charges continue. What explains this?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- The host allocation remains; deallocation is needed to release compute allocation
Stopped can retain compute allocation whereas Deallocated releases it. A clean guest shutdown or flushed disk writes does not deallocate the Azure resource. Persistent disk charges can continue after deallocation and do not prove allocated compute remains.
Open this question’s page →157. Which two choices are appropriate when scaling an Azure application? Select two answers.
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answers
- Design shared or replicated application state before horizontal scale-out
- Check quota and resource compatibility before vertical resize
Resize must fit quota and supported resources, and horizontal scaling needs an explicit state design. Autoscale does not automatically copy local databases. Flexible uses standard VM objects/APIs rather than only Uniform's child APIs. Deallocation can lose temporary data.
Open this question’s page →158. An Azure application needs isolation from a datacenter-group outage within one region. Which design best addresses the requirement?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- Deploy redundant application instances across availability zones
Multiple instances across zones provide the intended physical separation when application failover is configured. One zonal VM is not automatically replicated. A single fault domain shares infrastructure, and a larger single VM remains one application instance.
Open this question’s page →159. A region lacks availability-zone support. Two application VMs must reduce correlated rack/power and planned-maintenance failures. Which placement should be selected at deployment?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- An availability set with appropriate fault and update domains
An availability set distributes the VMs across infrastructure and maintenance groups. Deliberate co-placement increases shared failure exposure. Disk ZRS does not supply VM placement or running application instances. Static IP allocation stabilizes addresses rather than isolating hardware.
Open this question’s page →160. Two zone-separated web VMs exist, but clients use only the first VM's address. The first zone fails and requests fail. What additional design is missing?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- A traffic/failover mechanism that directs clients to a healthy instance
Clients need a load-balancing or application/client failover path to the surviving instance. Update-domain settings, disk redundancy, or more capacity on an unselected VM do not redirect requests from the failed address.
Open this question’s page →161. Which two statements about Azure VM availability are correct? Select two answers.
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answers
- Availability zones are distinct locations within a region
- Fault domains separate common infrastructure dependencies within an availability set
Fault domains and zones define their respective infrastructure boundaries. VM replicas and application-data replication require explicit designs. Zones remain inside one region, so they do not by themselves provide cross-region recovery.
Open this question’s page →162. Administrators need browser-based RDP to Azure VMs without public IPs on those VMs. Which service is intended for this?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- Azure Bastion
Bastion reaches private VM IPs through a managed RDP/SSH service. JIT controls time-limited port access but does not create the connection path. Public VM IPs conflict with the stated design, and availability sets govern placement rather than remote-session transport.
Open this question’s page →163. A company requires Bastion native-client access and a private-only Bastion deployment. Which SKU meets both requirements?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- Premium
Premium includes native-client capabilities and private-only deployment. Basic lacks the required advanced native-client features, Developer uses a shared development model, and Standard provides native-client capabilities but not Premium's private-only deployment feature.
Open this question’s page →164. A JIT request is approved, but the user still cannot log on to Windows. Routing and network-port tests succeed, and the account lacks guest logon rights. What explains this?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- JIT network authorization does not grant Windows guest logon rights
JIT permits a network window while guest authentication and logon rights remain required. It does not assign Remote Desktop Users membership, turn an NSG rule into a credential, or grant OS rights through a longer window.
Open this question’s page →165. Which two checks matter for secure JIT/Bastion management access? Select two answers.
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answers
- Verify guest listener, firewall, and logon prerequisites
- Review effective management-port rules for higher-priority broad allows
Effective rules determine whether JIT restrictions work, and guest service/authentication prerequisites remain necessary. JIT does not create routes, Bastion does not bypass guest authentication, and deployment requirements vary by Bastion tier and private-only design.
Open this question’s page →166. A Windows server in Azure needs a predictable private address. Which approach should be used?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- Configure static private allocation on the Azure NIC and align the guest configuration
Azure NIC static allocation establishes the supported predictable address. Guest-only arbitrary addressing can conflict with platform provisioning. Dynamic allocation is not guaranteed sequential, and reserved addresses cannot be assigned to the VM.
Open this question’s page →167. An inbound TCP 443 connection is allowed by the subnet NSG but denied by the NIC NSG. Windows has a working listener. What must change for this new flow?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- The applicable NIC NSG must also permit the required traffic
Both associated NSGs must allow the flow; the NIC deny still blocks it. One NSG's allow cannot override the other. DNS suffix does not repair an explicit IP/port deny, and unrelated outbound traffic does not authorize a new inbound flow.
Open this question’s page →168. A newly deployed VM in a private subnet created with an API released after March 31, 2026 can reach other private resources but cannot reach Windows Update. No explicit egress exists. What is the likely missing configuration?
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answer
- An explicit outbound connectivity method such as NAT Gateway
The new private-subnet default requires explicit outbound connectivity to public endpoints. Private DNS can resolve names but cannot create egress. Another NIC without a routing/translation plan adds no Internet path. Inbound RDP permission is unrelated to the required outbound update flow.
Open this question’s page →169. A routed network appliance runs as an Azure VM. Which two preparations are required for forwarding traffic through it? Select two answers.
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answers
- Configure routes and return paths through reachable next hops
- Enable forwarding on the Azure NIC and in the guest OS
Forwarding is configured at Azure NIC and guest layers, and paths must exist in both directions. Guest-only configuration does not replace NIC forwarding settings. Peering is not automatically transitive, and DNS resolution alone establishes neither routes nor security permissions.
Open this question’s page →170. A domain needs multiple DNS/DC servers that can accept authenticated updates and replicate zone data through AD. Which zone design fits?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- An AD-integrated zone with secure dynamic updates
AD integration supplies directory replication, multi-master writable replicas, and secure updates. File-backed secondaries are read-only. A stub holds authority-locator records rather than a full writable database. A conditional forwarder routes queries rather than hosting the AD records.
Open this question’s page →171. DNS records must replicate to eligible DNS/DC servers throughout one forest rather than only one domain. Which application-partition scope fits?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- ForestDnsZones
ForestDnsZones provides the forest-wide directory scope. DomainDnsZones limits the application-partition scope to one domain. A local zone file and workstation caches do not supply forest-wide AD zone replication.
Open this question’s page →172. A DHCP failover partner leases addresses successfully but cannot update secure DNS records created by the other server. Their DNS-update credentials differ. What should be investigated?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- Record ownership/ACLs and a consistent authorized DNS-update identity on both partners
Secure updates enforce identity and ownership, so aligned authorized DHCP credentials and ACL review address the cause. Anonymous writes weaken the stated security requirement. TTL governs caching rather than write permissions, and stub zones are not complete writable record stores.
Open this question’s page →173. Which two properties are associated with AD-integrated DNS? Select two answers.
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answers
- Secure dynamic updates can protect record changes
- Zone data can replicate through AD DS
AD replication and secure update support are core properties. Writable directory-backed hosting requires an eligible DNS domain controller and relevant partition. Separate zone transfers are not the required AD replica path. DomainDnsZones is domain-scoped rather than forest-wide.
Open this question’s page →174. A branch DNS server needs a complete read-only copy of a partner zone received through authorized transfers. Which zone type fits?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- Secondary
A secondary receives the full read-only zone copy through transfers. A stub retains authority-locator records, a conditional forwarder routes queries, and an independent primary creates a separate writable authority rather than the requested synchronized read-only copy.
Open this question’s page →175. A new alias portal.contoso.com should follow app01.contoso.com's address changes. Which record type is appropriate for the alias?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- CNAME targeting app01.contoso.com
CNAME points the alias to the canonical name so that target resolution determines the address. PTR is for reverse mapping, NS identifies zone authority, and an A record stores an IPv4 address rather than a DNS-name target.
Open this question’s page →176. A primary zone's host record changed, but one secondary continues serving its older data. Clients querying the primary get the new address. What should be investigated?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- Secondary transfer permissions, master reachability, and serial/transfer status
Older data at the authoritative secondary points to its transfer path and state. Client caches do not explain that server's stored older records, and TTL is caching behavior rather than database synchronization. A secondary is read-only and cannot be repaired by treating it as the writable update authority.
Open this question’s page →177. Which two pairings correctly describe DNS records? Select two answers.
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answers
- A: name to IPv4 address
- PTR: reverse IP-to-name mapping
A maps IPv4 and PTR supports reverse names. AAAA maps IPv6, CNAME is an alias rather than a zone copy, and NS identifies authoritative name servers; DNSSEC RRSIG holds signatures.
Open this question’s page →178. Only queries for partner.contoso.com must go to a partner's DNS servers; all other names should keep the current resolution path. Which configuration fits?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- A conditional forwarder for partner.contoso.com
A conditional forwarder chooses targets by suffix while preserving other paths. A general forwarder changes broader recursive behavior. An empty primary makes this server authoritative and may return terminal negatives. Hosts-file entries do not provide maintainable suffix-based DNS forwarding.
Open this question’s page →179. The administrator needs to configure upstream DNS servers for general recursive resolution on a Windows DNS server. Which command is appropriate?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- Set-DnsServerForwarder -IPAddress '10.10.0.10','10.10.0.11'
Set-DnsServerForwarder configures the general upstream resolver path. Creating a primary zone changes authority, an A record maps a name to an address, and clearing cache removes stored answers without configuring upstream targets.
Open this question’s page →180. A Windows DNS server is authoritative for contoso.com but has no record for missing.contoso.com. It returns NXDOMAIN even though a general forwarder is configured. Why?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- The hosted authoritative zone supplies a terminal negative answer
Local authority determines the result for its namespace, and NXDOMAIN is terminal. It is not the same as a timeout. A general forwarder does not override hosted authority, and a DNS-server alias does not change the query-resolution precedence.
Open this question’s page →181. A server-level forwarder does not respond. Which two conditions matter before root-hint fallback can occur? Select two answers.
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answers
- Recursion and root-hint fallback must be permitted
- The overall recursion timeout must still allow another path
Fallback needs permitted recursion/root-hint behavior and remaining time after applicable forwarders are exhausted. Terminal authoritative negatives are not simply discarded. Identical hosted-zone and conditional-forwarder names cannot coexist, and reverse zones are not required for normal forward Internet resolution.
Open this question’s page →182. On-premises clients must resolve an Azure private zone through a managed DNS service. Which endpoint should on-premises DNS forward to?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- Private Resolver inbound endpoint
The inbound endpoint listens for queries into Azure and resolves in the linked context. Outbound endpoints send rule-selected queries out. The special Azure resolver address is not a directly routed on-premises endpoint, and a ruleset link alone does not provide an inbound listener.
Open this question’s page →183. Azure VMs using Azure-provided DNS must resolve corp.contoso.com on-premises. Private connectivity is ready. Which configuration is required?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- An outbound endpoint, a suffix rule targeting on-premises DNS, and ruleset links for client VNets
The outbound endpoint, suffix rule and ruleset links establish Azure-to-on-premises DNS forwarding. Inbound alone serves queries arriving into Azure. An empty hosted private zone does not fetch on-premises authoritative records; connectivity alone does not configure the DNS path.
Open this question’s page →184. A private endpoint resolves correctly from Azure but publicly from on-premises. The VPN works. On-premises DNS has no relevant conditional forwarder. What is the most direct next step?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- Configure the appropriate private namespace path to the resolver inbound IP and verify zone links/records
The missing DNS forwarding path explains the different resolution context; verify the correct service suffix and linked private data. An outbound endpoint is not the inbound listener. Replacing private data with public addresses defeats the private requirement. Network connectivity alone does not route DNS queries to the proper resolver.
Open this question’s page →185. Which two statements correctly describe hybrid DNS? Select two answers.
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answers
- Custom DNS servers need their own suitable forwarding path
- Private-zone links and resolver ruleset links serve different configuration purposes
Zone links select private authoritative resolution context, while ruleset links expose forwarding rules; custom servers must forward appropriately. Peering does not automatically publish private zones, the resolver does not build the VPN, and DNS correctness does not grant application access.
Open this question’s page →186. Internal and external users must receive different addresses for app.contoso.com from the same Windows DNS zone. Which feature fits?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- DNS query policy selecting different zone scopes
Policies can select scope-specific records by appropriate source/interface criteria. TTL changes caching rather than source-specific answers. PTR is reverse mapping, and a general forwarder does not implement authoritative scoped answers for the same hosted name.
Open this question’s page →187. An administrator will configure a Branch subnet policy selecting BranchAnswer for lab.contoso.com. Which preparation is necessary?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- Create the named client-subnet object, zone scope, and scoped records before referencing them
The policy must reference existing criteria and authoritative scoped data. A default record does not automatically create another scope. Recursion scopes hold recursion settings rather than authoritative record sets. Nondefault scopes do not support the default-scope scavenging/dynamic-update workflow.
Open this question’s page →188. Two AD DNS servers have identical scoped records but give different split-brain answers. Only one has the new query policy. What explains the difference?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- DNS policy definitions are local and must be configured on both servers
Scoped records can replicate through AD while query policies remain local. ForestDnsZones does not replicate those policy definitions. Identical data does not guarantee identical handling, and TTL controls caching rather than policy deployment.
Open this question’s page →189. Which two statements should guide DNS policy design? Select two answers.
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answers
- Account for caching when using weighted DNS answers
- Keep appropriate default-scope answers for clients that do not match
Unmatched clients need suitable default behavior, and cached answers influence observed weight distribution. DNS weights do not provide application health probes. Dynamic updates apply to the default scope, and forwarding can make the authoritative server see the forwarder's source rather than the original client's subnet.
Open this question’s page →190. A company must detect forged DNS answers but has a separate confidentiality requirement handled elsewhere. Which DNS feature provides answer authenticity and integrity?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- DNSSEC
DNSSEC signs data for authenticity and integrity validation. Secure dynamic updates authorize record modification rather than validating received answers. TTL and aliasing do not add cryptographic answer validation.
Open this question’s page →191. A child zone is signed, but validators following its signed parent cannot establish the intended chain. The parent has no child DS record. Which step is missing?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- Publish the correct child delegation DS data in the parent through the appropriate process
The parent DS connects the trusted delegation to the child's key. TTL does not authenticate delegation. A published child DNSKEY or newly signed child records still leave the stated parent-to-child trust chain incomplete.
Open this question’s page →192. A Windows client receives RRSIG records with Resolve-DnsName -DnssecOk, but the team claims this alone proves enforced validation. What is the correct assessment?
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answer
- Requesting signatures is different from validating trust and enforcing effective NRPT requirements
DnssecOk requests DNSSEC data; trust-chain validation and required policy must be checked. It does not encrypt traffic. An untrusted or invalid signature is not proof of authenticity, and nslookup is not an equivalent DNSSEC-aware enforcement test.
Open this question’s page →193. Which two statements about DNSSEC are correct? Select two answers.
Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answers
- NSEC/NSEC3 support authenticated nonexistence answers
- RRSIG carries signatures for record sets
RRSIG supplies signatures and NSEC/NSEC3 prove nonexistence. DNSSEC does not encrypt queries. Update authorization does not replace answer validation, and parent delegation/trust publication requires its own process.
Open this question’s page →194. A Windows DHCP server is in a different routed subnet from its clients. Broadcast requests do not reach it. Which component is normally needed?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- A DHCP relay targeting the server
A relay forwards the initial DHCP requests across the routed boundary and supplies subnet context. DNS forwarding and PTR records handle name resolution, not DHCP broadcast delivery. A shorter lease affects timing rather than making routers forward broadcasts.
Open this question’s page →195. A Windows Server 2025 domain member has a static address and the DHCP role installed. The team needs to register it as an authorized DHCP server in AD. Which command fits?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- Add-DhcpServerInDC with the server DNS name and address
Add-DhcpServerInDC registers DHCP authorization. Scope creation defines an address pool, option configuration supplies client settings, and lease inspection reads assignments; none performs AD authorization.
Open this question’s page →196. The DHCP role is installed and authorized, but a new scope is still InActive. Clients have no usable lease, and the path to the server works. What should be checked next?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- Activate the correctly configured scope and confirm free addresses/options
The identified inactive scope must be made usable and checked for capacity/options. DNS TTL does not activate DHCP. Reservations are scope settings and do not automatically activate it. Network reachability does not remove the domain authorization requirement.
Open this question’s page →197. Which two preparations support DHCP service to routed client VLANs? Select two answers.
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answers
- Configure active scopes matching the clients' subnets
- Permit DHCP paths and configure relay targets for remote servers
Clients need matching active scopes and relay/transport reachability. Role installation does not build scopes. AD authorization is a Windows DHCP directory control rather than a universal network firewall, and VPN connectivity does not automatically implement broadcast relay.
Open this question’s page →198. A Windows client has 169.254.x.x addressing when it should use DHCP. What is the best initial interpretation?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- No usable DHCP lease was obtained; investigate client, relay, server, and path
Link-local addressing suggests lease acquisition failed but does not isolate the cause. It does not prove DNS corruption or a VPN failure. A reservation only works when the matching DHCP client can obtain its lease; it does not guarantee routed addressing during acquisition failure.
Open this question’s page →199. An Azure Windows VM cannot connect to a remote TCP service. The team needs to identify whether applicable NSG rules allow the specified flow. Which tool fits that question?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- Network Watcher IP flow verify with the relevant TCP tuple
IP flow verify tests the applicable TCP/UDP security decision and identifies matching rules. DNS lookup verifies name data, Running verifies VM allocation/state, and disk listings concern storage; none evaluates the specified NSG flow.
Open this question’s page →200. A Windows server reaches its same-subnet peers but cannot reach a known remote service by IP. DNS resolution is already correct. Which evidence should be examined next?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- Default gateway, effective routes, and the remote return path
IP failure beyond the subnet points toward gateway/routing/security and return-path evidence. TTL, a forward record, and PTR creation concern names and do not repair a failed routed connection when the destination IP is already known.
Open this question’s page →201. A hybrid application name resolves to the expected private IP but the application is still unavailable. Which two checks are appropriate? Select two answers.
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answers
- Inspect effective routes and return connectivity across the hybrid link
- Test the required application port and guest listener/firewall
Application-port/listener tests and bidirectional routes address the remaining connectivity layers. DNS only supplies the address. Reserved Azure addresses cannot be assigned, and ICMP failure is not conclusive evidence about TCP.
Open this question’s page →202. A subnet has manually addressed infrastructure in part of the DHCP pool. Which scope feature prevents those addresses from being offered to ordinary clients?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- An exclusion range
Exclusions explicitly remove those addresses from dynamic offers. Reverse DNS maps addresses to names. A shorter lease does not prohibit duplicate allocation of static infrastructure addresses. A superscope groups scopes rather than excluding addresses.
Open this question’s page →203. Domain clients receive leases but cannot locate domain services because the scope supplies public DNS servers. Which option should be corrected?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- 006 DNS servers, pointing clients to appropriate AD resolvers
Option 006 selects the DNS resolvers needed for AD records. Option 003 supplies a gateway address, not a domain-name resolver. Option 015 supplies a suffix but does not replace the DNS server list. Lease duration does not choose the resolver.
Open this question’s page →204. An administrator creates a superscope for two logical IP networks on one physical segment and expects it to create separate VLANs. What is wrong with the expectation?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- A superscope groups lease scopes and does not create VLAN isolation or routing
Superscopes represent a multinet scope grouping; network segmentation and routes must be designed separately. They do not tag packets, are not DNS directory partitions, and adding address ranges does not create router interfaces.
Open this question’s page →205. Which two scope settings directly provide client network configuration? Select two answers.
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answers
- Option 006 for DNS servers
- Option 003 for the default gateway
Option 003 provides the gateway and 006 the DNS server list. Option 015 supplies a domain suffix rather than resolver addresses. Exclusions restrict pool addresses; superscope labels do not create routes.
Open this question’s page →206. A network printer must use a predictable leased address while receiving DHCP options. Which feature meets the requirement?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- A DHCP reservation for its actual client identifier
A reservation preserves DHCP leasing/options for the matching client. A manual static IP disables the requested lease workflow. DNS records do not select a lease, and an exclusion alone stops ordinary offers without assigning the address to this device.
Open this question’s page →207. A reservation must be created for a device whose identifier is known. Which command matches this task?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- Add-DhcpServerv4Reservation -ScopeId 10.40.10.0 -IPAddress 10.40.10.120 -ClientId '00-15-5D-40-10-01'
Add-DhcpServerv4Reservation binds the address to ClientId. An exclusion only withholds an address from dynamic offers. Router option configuration supplies a gateway. Add-DhcpServerInDC registers server authorization rather than reserving a client's address.
Open this question’s page →208. A printer received its reserved address before a NIC replacement. It now receives another lease, and its new requests show a different client identifier. What should be corrected?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- Verify and update the reservation's ClientId for the replacement NIC
The reservation matches the request's identifier, which changed with the NIC. DNS TTL and gateways do not define that match. The descriptive printer/reservation name is not a substitute for the configured ClientId.
Open this question’s page →209. Which two statements about DHCP reservations are correct? Select two answers.
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answers
- The reserved device remains a DHCP client
- The configured identifier must match the client's request
Reservations still use DHCP and require identifier matching. They do not remove acquisition/renewal dependencies. Exclusions only restrict pool use, and reverse DNS is not the client identifier used for reservation selection.
Open this question’s page →210. A branch should normally receive leases from its local DHCP server, with a central server used when the local one fails. Which failover mode fits?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- Hot standby
Hot standby matches active local service backed by a standby partner. Load balance normally distributes client service across both partners. One scope supports only two partners, and the described Windows failover protocol does not support DHCPv6 scopes.
Open this question’s page →211. An administrator changes a reservation and DNS options on the intended source server of a failover relationship. Lease synchronization remains healthy. What is needed to make partner configuration match?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- Explicitly replicate the updated scope configuration from the intended source
Later scope configuration changes need explicit replication from the desired source. Automatic lease synchronization is not the same operation. Deleting a lease database removes state rather than safely copying settings, and different DNS credentials can break secure record updates.
Open this question’s page →212. DHCP01 fails. DHCP02 is healthy, but clients in a remote VLAN cannot obtain new leases. The VLAN relay targets only DHCP01. What is the direct missing configuration?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- A relay target/path to DHCP02 as well
The client relay needs a path to the surviving DHCP02. MCLT governs lease timing, not routing. Server-to-server failover communication and a larger reserve cannot deliver client requests whose relay still targets only the failed endpoint.
Open this question’s page →213. Partners lose their TCP connection, but the remote server may still be serving clients. Which two actions preserve a safe recovery approach? Select two answers.
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answers
- Investigate the partner/link state before forcing Partner Down
- Respect MCLT and safe lease-ownership rules during takeover
Communication failure must be diagnosed, and safe takeover timing/ownership prevent conflicting leases. Immediate unrestricted pool reuse risks duplicates. Communication Interrupted does not prove a dead partner, and a single scope cannot join a three-partner failover relationship.
Open this question’s page →214. A department wants a managed SMB share without maintaining a caching server. Which service fits?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Azure Files mounted directly
Direct Azure Files supplies the managed SMB endpoint. File Sync adds Windows Server synchronization; DFS Replication requires file servers; an iSCSI LUN supplies blocks and needs a file server to expose SMB.
Open this question’s page →215. Clients reach an Azure Files private endpoint IP, but the usual account.file.core.windows.net name resolves publicly. What should be corrected?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Private-link DNS resolution for the file endpoint
Private-link DNS must send the normal file endpoint name to its private IP. ACL inheritance concerns authorization after connection; signing governs SMB security negotiation; redundancy does not correct client DNS.
Open this question’s page →216. An HDD Azure file share needs SSD latency. Which migration approach is supported?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Create an SSD share and copy supported data and permissions
Moving between HDD and SSD requires a new share and migration. HDD access tiers are not an SSD conversion; ZRS changes redundancy; cloud tiering manages a server cache.
Open this question’s page →217. A team plans direct SMB access to Azure Files through private endpoints. Select two requirements.
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answers
- Reachability to the file endpoint on TCP 445
- DNS resolution to the intended private endpoint
Direct SMB requires TCP 445 and correct private-endpoint DNS/routing. Azure Files does not offer the Windows Server SMB-over-QUIC transport; File Sync endpoints are optional; Azure manages the share filesystem.
Open this question’s page →218. A user has SMB Share Reader and a file ACL granting Modify. What effective remote operation is allowed?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Read, subject to the ACL
The share gate limits access to reading even when Modify allows more. File ACLs cannot expand the share role; Reader does not grant ACL administration; differing levels are not inherently a denial.
Open this question’s page →219. An administrator must edit ACLs without using the account key, using the standard ACL-respecting model. Which combination fits?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- SMB Share Elevated Contributor plus appropriate Full Control ACL
Elevated Contributor permits permission changes when the file ACL also authorizes them. Resource Reader provides management visibility; SMB Reader cannot modify permissions; Contributor with Read ACL cannot administer ACLs.
Open this question’s page →220. An updated Entra-joined Windows 11 client uses a hybrid user and cannot obtain Azure Files tickets after an MFA policy change. What targeted check fits?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Check the storage account enterprise application MFA exclusion
The storage-account application must be excluded from applicable MFA requirements for this flow. A tenant-wide exclusion is unnecessary; a second identity source is unsupported; subscription Owner does not fix ticket issuance.
Open this question’s page →221. For Azure Files SMB using AD DS and user-specific share RBAC, select two required permission preparations.
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answers
- Synchronize the relevant identities to Microsoft Entra ID
- Grant share permission and suitable Windows ACLs
User-specific share roles target Entra representations of AD identities, and ACLs also apply. Only one user identity source is enabled; management Contributor is not SMB data access; SAS is not an SMB user authentication replacement.
Open this question’s page →222. A branch needs local SMB access to a centrally synchronized cloud dataset, retaining only hot content locally. Which design fits?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Azure File Sync with cloud tiering
File Sync provides server endpoints and cloud tiering. A snapshot is a recovery view; a DFS namespace only provides referrals; the iSCSI proposal does not provide this supported synchronization/cache design.
Open this question’s page →223. A deployment has a storage sync service and an Azure file share in different regions. Which correction is required for a cloud endpoint?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Use an Azure file share in the storage sync service region
The cloud endpoint storage account must be in the storage sync service region. Relocating only the Windows server, changing the share access tier, or adding a server endpoint does not change the incompatible cloud endpoint location.
Open this question’s page →224. After increasing the free-space target from 20 percent to 80 percent, branch users experience many recalls. What explains the change?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- The policy leaves a much smaller local cache
An 80 percent free-space target permits much less local cached data. It is not a cached-file percentage; tiering retains cloud content; free-space pressure takes priority over the date policy.
Open this question’s page →225. An endpoint uses cloud tiering. Select two valid operational expectations.
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answers
- Cached content can be read while Azure is unreachable
- Reading a placeholder may require an Azure recall
Cached files remain local; tiered files need recall connectivity. Local backup can omit or recall placeholders; tiering preserves cloud content; File Sync server endpoints require NTFS.
Open this question’s page →226. A registered server is Online, but one critical file is missing from the cloud share. What should be examined next?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Endpoint per-item errors and synchronization progress
Endpoint errors and progress distinguish communication health from file synchronization. Resource-group availability is not per-file evidence; Online is insufficient; a namespace display name does not report sync results.
Open this question’s page →227. An operator wants notification when one File Sync server stops communicating. Which design fits?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- A server-online metric alert scoped by server with an action group
The server-online metric and server dimension detect communication loss, and an action group routes notification. Per-file errors measure a different condition; capacity measures storage use; an action group without an alert condition cannot detect the outage.
Open this question’s page →228. A File Sync session is long-running after a bulk import. Event 9302 shows its applied count rising steadily. What is the best interpretation?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Synchronization is making progress; continue checking throughput and errors
An advancing count shows real progress, though throughput and item failures still merit monitoring. Duration alone does not justify re-registration; Online does not clear errors; progress is not evidence of an unsupported filesystem.
Open this question’s page →229. A tiered branch server has a recall spike and growing disk pressure. Select two useful investigations.
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answers
- Review cache policy and actual working-set demand
- Correlate antivirus or indexing activity with the spike
Scanners and cache settings can drive recall and pressure. Online concerns communication, not recall outcomes; sync uses TCP HTTPS; share quota alone does not explain endpoint recall behavior.
Open this question’s page →230. An organization replaces DFS-R with File Sync but must preserve \\contoso.com\Files. What should remain?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- DFS Namespaces with validated folder targets
DFS Namespaces preserves the logical UNC path and referrals. DFS-R supplies replication rather than that namespace. Local drive letters do not preserve the domain UNC, and a snapshot is a data recovery view rather than a namespace root.
Open this question’s page →231. A migration seed server has the complete dataset. Which first-endpoint setting follows the documented DFS-R transition?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Create it without cloud tiering and finish the upload
The initial endpoint uploads the complete dataset with tiering disabled. Immediate tiering and concurrent overlapped members do not follow the transition; a DFS-R read-only folder is unsupported.
Open this question’s page →232. After File Sync migration, direct access to both shares works but clients still use an old target through DFS. What is the likely next check?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Namespace target configuration and cached referrals
DFS target configuration and cached referrals determine which server the logical path returns. Successful File Sync upload does not update every namespace target. Cache policy and cloud access tier affect data placement/performance rather than referral selection.
Open this question’s page →233. Before retiring DFS-R and enabling tiering after migration, select two validations.
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answers
- Confirm all File Sync endpoints have converged
- Test ordinary-user access through the retained namespace
Convergence and namespace user tests establish data and access readiness. Copying does not recreate every share setting; premature seed removal risks incomplete data; dual replication is not a safe default rollback design.
Open this question’s page →234. A Windows file server will be retired and users will mount Azure Files directly. Which tool is suitable for a staged SMB copy?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- RoboCopy with reviewed metadata and cutover options
RoboCopy can migrate Windows shares over SMB. DFS Namespaces supplies referrals; Storage QoS manages I/O; key escrow protects encryption recovery and does not migrate data.
Open this question’s page →235. The initial copy finishes while users continue writing to the source. What is needed before final redirection?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Freeze writes and run a final incremental pass
A write freeze and final delta capture accepted source changes before redirection. Preserved timestamps alone do not prove those changes were copied. Repeated passes during continuing writes do not establish a final consistent cutover, and mapped-drive changes do not transfer missing data.
Open this question’s page →236. A RoboCopy job exits with code 3 and no failed files in its reviewed log. What does this imply?
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- The bitmask can indicate successful copying plus extra files
Code 3 can combine copied files and extra files; it is below the failure threshold of 8. Nonzero is not automatically fatal, and copy success proves neither share configuration nor a need to reformat.
Open this question’s page →237. A migration must preserve security and support rollback. Select two preparations.
Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answers
- Retain a validated source and plan reconciliation of post-cutover writes
- Inventory supported ACL and metadata fidelity
Metadata assessment and a reconciliation-aware rollback plan protect fidelity and accepted writes. Azure Files does not reproduce every NTFS feature; copy counts do not prove effective access or application readiness; copying does not assign Azure RBAC.
Open this question’s page →238. A user has share Read and NTFS Modify on a Windows Server folder. What can the user do over SMB?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- Read permitted files
Share Read limits remote access to reading. NTFS cannot expand that gate; ordinary reading rights do not administer shares; hidden naming has no permission effect.
Open this question’s page →239. Users should see only project folders they can enumerate, while existing ACLs control access. What should be enabled?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- Access-based enumeration
Access-based enumeration filters visible entries using access. Hidden naming only affects browsing of the share itself; caching changes offline behavior; a broad grant does not selectively hide project folders.
Open this question’s page →240. A user can read and create files but cannot replace one open workbook. What should be checked first?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- SMB open-file handles and the application lock
Open SMB/application handles can explain a workbook-specific sharing violation. A share that allows creating files is not simply read-only for all operations. Enumeration controls visibility, and the hidden-name suffix does not release a lock.
Open this question’s page →241. A server administrator creates a secure departmental share. Select two appropriate configuration tasks.
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answers
- Assign a suitable folder ACL
- Grant required access to department security groups at the share
Folder ACLs and group-based share access provide the two authorization gates. A hidden name is not security; share creation does not replace all file ACLs; blanket volume ownership is unnecessary and expands control.
Open this question’s page →242. A department folder must stop growing at 200 GiB regardless of who owns its files. Which control fits?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- An FSRM hard folder quota
A hard folder quota enforces the tree limit across owners. A soft quota only measures/notifies; a per-user quota follows ownership; enumeration controls visibility rather than capacity.
Open this question’s page →243. Every newly created home folder under D:\Homes must receive the same 10-GiB limit. What should be configured?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- An auto-apply quota based on a quota template
Auto-apply creates individual template-based subfolder quotas. One parent quota combines all users; screens match filenames; namespace targets do not enforce storage limits.
Open this question’s page →244. An administrator cannot configure FSRM quotas on a ReFS data volume. What is the supported explanation?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- FSRM requires NTFS
FSRM's supported filesystem is NTFS. A drive letter, resilient layout, or deduplication does not change FSRM's ReFS support boundary.
Open this question’s page →245. A team wants to assess prohibited file types before enforcing a restriction. Select two appropriate choices.
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answers
- Use passive screening initially
- Configure notifications or reports for matches
Passive screening plus reporting observes behavior without blocking. Active screening enforces a block; extension rules do not inspect safety; FSRM screening does not replace folder authorization.
Open this question’s page →246. A company wants one UNC path referring clients to shares near their sites. Which role provides that path?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- DFS Namespaces
DFS Namespaces provides referrals and a logical path. DFS-R copies files; Storage Replica copies volume blocks; S2D pools cluster storage. None of those alone creates the namespace.
Open this question’s page →247. Two shares become targets of one DFS namespace folder. What additional preparation is needed before they serve the same writable dataset?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- Coordinate or replicate their contents and validate access
Targets need consistent coordinated content and permissions. DFS-N does not replicate; drive letters do not coordinate data; namespace servers generally refer clients rather than proxy each file operation.
Open this question’s page →248. A DFS-R folder contains large changing files and repeated staging cleanup events. What should be reviewed?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- Staging capacity, free space and replication backlog
Repeated staging cleanup under churn calls for staging capacity, free space, and backlog review. Namespace availability and referral caching concern DFS-N rather than DFS-R staging. The initial primary member is not a permanent write master.
Open this question’s page →249. A DFS deployment needs a stable path and replicated branch documents. Select two correct design statements.
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answers
- DFS-N supplies the logical path and referrals
- DFS-R can asynchronously copy suitable NTFS folders
DFS-N routes clients and DFS-R synchronizes suitable folders. DFS-R has no distributed document lock; targets alone do not synchronize; the initial primary member is not a lasting write master.
Open this question’s page →250. A Windows Server 2025 Standard file server must provide remote SMB over an untrusted network without exposing TCP 445. Which design fits?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- SMB over QUIC with a trusted server certificate
Server 2025 Standard supports QUIC over UDP 443 with TLS. SMB Direct is RDMA for suitable networks; File Sync is synchronization, not the client transport; SMB1 over TCP 443 is not this feature.
Open this question’s page →251. Which command explicitly tests a Windows 11 mount through QUIC?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- New-SmbMapping -RemotePath \\files.contoso.com\Data -TransportType QUIC
New-SmbMapping with QUIC exercises the intended UDP transport and SMB access. Test-NetConnection tests TCP; share-access inspection is local permission evidence; RDMA inspection concerns SMB Direct.
Open this question’s page →252. A QUIC server certificate was renewed and clients now fail to connect. DNS and UDP reachability are unchanged. What should be checked?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- The server mapping uses the renewed certificate thumbprint
Renewal changes the certificate thumbprint, so mapping must reference the new valid certificate. Share ACLs do not select the tunnel certificate. RDMA belongs to SMB Direct, and Server 2025 Standard already supports QUIC.
Open this question’s page →253. For a Windows Server 2025 QUIC deployment, select two requirements.
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answers
- Client reachability through the configured UDP port
- A suitable trusted server certificate with its private key
The server certificate and UDP transport are core requirements. RDMA belongs to SMB Direct; client certificates are an optional admission layer; user authentication and ACLs remain required.
Open this question’s page →254. A requirement says SMB file contents must be confidential in transit. Which setting directly meets it?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- Require SMB encryption
Encryption protects confidentiality. Signing authenticates message integrity; enumeration changes visibility; a hidden name only affects browsing and does not encrypt traffic.
Open this question’s page →255. An administrator must confirm the dialect used by an existing Windows client share connection. Which cmdlet fits?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- Get-SmbConnection
Get-SmbConnection reports active negotiated connection details. Client configuration lists local settings rather than proving a particular negotiated dialect, share access lists permissions, and RDMA inspection establishes adapter capability rather than SMB dialect.
Open this question’s page →256. After NTLM is blocked, SMB access by a new DNS alias fails but the server real name works. What should be investigated?
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- The alias DNS mapping and appropriate service SPN
Kerberos service tickets depend on correct name/SPN identity, explaining a new-alias failure after NTLM blocking. Dialect range, signing, and session timeout do not create the missing Kerberos service identity.
Open this question’s page →257. A supported deployment must use encrypted SMB Direct. Select two relevant checks.
Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answers
- Keep SMB Multichannel enabled
- Use compatible RDMA endpoints with Server 2022 or later encryption support
Multichannel discovers RDMA, and Server 2022 or later supports encrypted direct placement. Signing alone is not confidentiality; the historical blanket encryption limitation is obsolete; cloud tiering is unrelated.
Open this question’s page →258. A new empty 6-TiB Windows data disk must use its full capacity. Which partition style fits?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- GPT
GPT supports the large disk. Conventional MBR has about a 2-TiB addressability limit. NTFS formatting and drive-letter assignments do not remove that partition-table address limit.
Open this question’s page →259. An Azure data disk was enlarged, but the guest volume still has its old size. What is the next guest task after verifying the new disk size?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Extend the partition and supported filesystem into the new free space
After the disk exposes extra capacity, the intended partition/filesystem still needs extension. A rescan discovers capacity but does not guarantee extension; compaction reclaims eligible file allocation; another partition does not enlarge the existing volume.
Open this question’s page →260. A thin Storage Spaces volume has 500 GiB free but writes fail and its pool is full. Which layer needs capacity remediation?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- The physical storage pool
Thin free space is logical, while the full backing pool cannot allocate more physical storage. Advertising more virtual capacity or extending logical limits does not add the required physical pool capacity.
Open this question’s page →261. Before configuring a newly presented data disk, select two useful checks.
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answers
- Check whether offline state reflects SAN or cluster ownership policy
- Confirm disk identity and whether existing data is present
Identity and ownership checks prevent acting on the wrong disk or shared owner. Disk numbers alone are insufficient; RAW can indicate damaged existing data rather than empty media; mount points can replace drive letters.
Open this question’s page →262. A scratch dataset is reproducible and maximum capacity is more important than disk-failure protection. Which layout fits?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Simple
Simple provides striping without redundancy and fits reproducible scratch data. Mirrors and parity reserve capacity for protection; parity is not overhead-free.
Open this question’s page →263. A write-sensitive file workload needs protection from one drive failure. Which layout is generally preferable to parity?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- A suitable two-way mirror
A suitable mirror protects against a drive failure with good write behavior. Simple layouts lack redundancy regardless of provisioning; a quota limits consumption but does not protect data.
Open this question’s page →264. A replaced disk is healthy and the volume is accessible, but Get-StorageJob shows repair in progress. What should an operator conclude?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Data access has resumed but full resiliency still requires repair completion
The repair job reports reconstruction still in progress. Mounted access, a newly added disk, or one device's healthy status does not prove virtual-disk redundancy has already been restored.
Open this question’s page →265. For resilient Storage Spaces growth, select two planning factors.
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answers
- Layout and column requirements for allocation
- Capacity reserved for repairs and future growth
Placement requirements and repair headroom determine safe growth. Thin logical space omits physical availability; mirrors consume extra copies; resiliency does not protect against replicated deletion or all disasters.
Open this question’s page →266. A design pools local disks across Hyper-V hosts and runs VMs on the same nodes. What is it?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Hyperconverged Storage Spaces Direct
Hyperconverged S2D combines storage and compute on the same nodes. Disaggregated S2D separates compute hosts. Conventional single-server Storage Spaces does not pool local drives across cluster nodes, and a SAN-only design uses external shared storage instead.
Open this question’s page →267. An administrator has installed roles on Datacenter nodes. Which task belongs before enabling S2D?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Validate the cluster including Storage Spaces Direct tests
Validation checks prerequisites before enablement. Roles alone do not validate hardware; network preparation precedes deployment; a mirror does not replace cluster quorum.
Open this question’s page →268. An S2D cluster has a failed drive and active repair. A second node is scheduled for maintenance. What is the best next step?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Check remaining protection and quorum before draining the node
Current fault placement, repairs and quorum determine safe maintenance. Copy count alone is insufficient; removing witness can reduce voting resilience; a VM heartbeat does not verify storage repair.
Open this question’s page →269. For a Windows Server S2D deployment, select two prerequisites.
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answers
- Supported local drives and validated high-bandwidth cluster networking
- Windows Server Datacenter on cluster nodes
Datacenter and validated hardware/networking are required. S2D uses local drives rather than requiring a SAN; ReFS is not bootable; DFS namespaces do not supply the S2D cluster.
Open this question’s page →270. A disaster-recovery requirement specifies zero loss of acknowledged filesystem writes and a suitably low-latency link. Which mode fits?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Synchronous Storage Replica
Synchronous replication waits for remote log persistence. Asynchronous mode can lose recent writes; DFS-R waits for file closure; weekly copies have a large recovery-point gap.
Open this question’s page →271. A Server 2025 Standard system needs to replicate a 5-TB volume. What edition issue must be resolved?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Standard limits a replicated volume to 2 TB; use a suitable Datacenter design
The Standard volume limit applies to replicated data volume size. A small log, DFS namespace or asynchronous mode does not remove the edition restriction.
Open this question’s page →272. An asynchronous partnership queue continually grows during business hours. What should be investigated?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Write churn versus link and destination throughput
A growing asynchronous queue indicates changes arrive faster than the link or destination can persist them. Block replication does not wait for file closure. Quotas do not add throughput, and changing mode does not remove the physical capacity bottleneck.
Open this question’s page →273. Before creating a Storage Replica partnership, select two appropriate preparations.
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answers
- Assess the topology using Test-SRTopology
- Provide suitable data volumes and separate log volumes
Topology testing and proper volume/log preparation support the design. Writable independent destination use conflicts with block replication; harmful changes replicate; automatic application recovery requires an additional supported failover design.
Open this question’s page →274. A file share contains many similar document versions. Which feature can reduce repeated chunk storage while retaining normal file access?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Data Deduplication
Deduplication consolidates repeated chunks. Enumeration controls visibility; signing protects traffic integrity; a namespace routes users without consolidating storage.
Open this question’s page →275. A clustered volume can fail over among three nodes. Where should the deduplication role service be installed?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- On every node that may own the volume
Each possible owner needs deduplication support. Current-owner-only installation fails after ownership changes; client or namespace roles do not supply the owning node filesystem filter.
Open this question’s page →276. Deduplication was disabled, but files remain optimized and disk usage did not expand. What explains this?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Disabling stops future optimization; unoptimization is a separate job
Disabling does not expand existing optimized files; supported unoptimization does. Garbage collection reclaims unreferenced chunks, while scrubbing checks integrity rather than expanding all content.
Open this question’s page →277. For a deduplication-enabled volume, select two correct operational statements.
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answers
- Unoptimization needs sufficient physical free capacity
- Optimization can run as a background scheduled job
Optimization is background work and expansion needs capacity. Garbage collection reclaims unused chunks, not feature disablement; dedup does not extend FSRM filesystem support; storage savings do not verify backups.
Open this question’s page →278. A Hyper-V host accesses supported remote SMB storage over RDMA adapters. Which feature reduces CPU overhead for that transfer?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- SMB Direct
SMB Direct uses RDMA for efficient storage traffic. QUIC secures remote SMB transport; DFS-R copies files asynchronously; classification assigns file properties rather than changing data transport.
Open this question’s page →279. RDMA is enabled on both endpoints, but SMB Multichannel is disabled. What result is expected?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- SMB transfers use TCP instead of SMB Direct
Multichannel discovers RDMA paths; disabling it disables SMB Direct. RDMA is not negotiated independently; QUIC is a different configured transport; filesystem read-only state is unrelated.
Open this question’s page →280. Get-NetAdapterRdma confirms hardware capability. Which evidence best proves an active copy is using RDMA?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Nonzero SMB Direct RDMA read/write-byte counters
RDMA byte counters show actual Direct transfer. Capability alone does not prove use. Multichannel can also use TCP, and speed/CPU observations are suggestive rather than conclusive transport evidence.
Open this question’s page →281. For encrypted SMB Direct between suitable Server 2025 systems, select two required checks.
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answers
- Enabled RDMA and compatible network configuration at both ends
- SMB Multichannel enabled
Both RDMA endpoints and Multichannel are required. Modern Server versions support encrypted direct placement; UDP 443 belongs to QUIC; ordinary guest vNICs do not inherit RDMA automatically.
Open this question’s page →282. Three VMs must share one total 2,000 normalized-IOPS budget. Which policy type fits?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Aggregated
Aggregated shares one allocation across assigned flows. Dedicated provides independent VM/disk groupings; an NTFS quota limits bytes; PFC controls network flow behavior rather than VM disk IOPS.
Open this question’s page →283. At the default 8-KiB normalization, how is one 256-KiB storage request counted?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- 32 normalized operations
256 divided by 8 equals 32. One applies only to an I/O no larger than the normalization size; 8 confuses the unit size with count; 256 counts KiB rather than 8-KiB units.
Open this question’s page →284. A VM disk moved to another SOFS cluster and its QoS flow reports InvalidPolicy. What should be checked?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Whether its policy GUID exists on the destination cluster
The disk references a policy GUID in the relevant storage system. A matching display name with another GUID does not satisfy that reference. A byte quota governs capacity, and free bytes do not establish a valid QoS policy.
Open this question’s page →285. A flow reports InsufficientThroughput. Select two useful actions.
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answers
- Compare requested minimum with available storage performance
- Inspect volume and competing-flow latency and demand
Physical performance and competing demand explain unmet reservations. Raising a number cannot create capacity; share permissions govern access; free bytes do not prove available IOPS or latency.
Open this question’s page →286. A Windows Server 2025 data volume must host an Azure File Sync endpoint and FSRM folder quotas. Which filesystem fits?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- NTFS
Both File Sync and FSRM require NTFS. ReFS integrity and deduplication do not add those service requirements; FAT32 lacks the supported endpoint and quota environment.
Open this question’s page →287. A virtualization workload wants ReFS corruption repair using another good copy. Which storage design supports that goal?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- ReFS on suitable resilient Storage Spaces
Resilient Storage Spaces supplies alternate copies for ReFS repair. A single unprotected copy cannot guarantee reconstruction; a DFS root and a quota do not provide a verified good data copy.
Open this question’s page →288. An administrator cannot shrink a ReFS volume in Windows Server 2025. What explains this?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- ReFS does not support shrinking
Current ReFS does not support shrinking. Optimization and repair do not add that filesystem capability, and adjacent unallocated space does not remove the restriction; use a supported migration for a smaller layout.
Open this question’s page →289. For filesystem selection on Windows Server 2025, select two correct statements.
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answers
- ReFS can support BitLocker data-volume encryption
- NTFS is supported for the boot volume
NTFS can boot Windows and ReFS can use BitLocker. DFS-R and FSRM require NTFS; mirroring does not change FSRM support; checksums detect damage but need recoverable data to repair it.
Open this question’s page →290. A server must consume remote block storage and create its own Windows volume. Which protocol fits?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- iSCSI
iSCSI presents a LUN as a disk. SMB supplies file access; DFS Namespaces provides referrals; File Sync synchronizes files and does not present remote SCSI blocks.
Open this question’s page →291. An iSCSI data disk disappears after each server restart but can be connected manually. What should be checked?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Initiator service startup and persistent connection settings
Initiator startup and persistent sessions control restart reconnection. Successful manual authentication already establishes that the credentials can work. A portal entry alone is not a saved persistent connection, and a drive letter cannot create the absent block-storage session.
Open this question’s page →292. A LUN intermittently becomes unavailable on one path while another remains healthy. Which component should be reviewed for coordinated failover?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- MPIO and its path policy
MPIO coordinates supported independent paths to the same device. Extra uncoordinated sessions and NIC teaming alone do not implement storage multipath ownership/failover. A descriptive target name does not control path recovery.
Open this question’s page →293. A secure resilient iSCSI design is being prepared. Select two correct statements.
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answers
- CHAP authenticates but does not encrypt the data stream
- MPIO requires supported coordinated independent paths
CHAP and MPIO address authentication and path coordination respectively. IQNs are identifiers; ordinary NTFS cannot accept uncontrolled multi-host writes; target authorization is distinct from SMB share permissions.
Open this question’s page →294. A server data disk may be physically removed. Which control protects its contents while locked?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- BitLocker volume encryption
BitLocker protects locked data at rest. Signing protects network message integrity; enumeration and hidden names only affect access presentation and do not encrypt an offline disk.
Open this question’s page →295. A reused disk contained deleted confidential plaintext files. Which encryption choice better covers those remnants?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Full-volume encryption after appropriate preparation
Full-volume encryption covers existing free sectors. Used-space-only encryption can leave old plaintext remnants until overwritten. Suspension changes protector enforcement without performing free-sector encryption, and ACLs do not encrypt deleted offline sectors.
Open this question’s page →296. A planned firmware update changes boot measurements. What workflow avoids unnecessary recovery while restoring protection?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Suspend protectors for the approved change, then resume and verify
Temporary suspension with resumption handles an approved boot change. Permanent decryption removes at-rest protection; suspension does not prove escrow; filesystem choice does not resolve boot measurements.
Open this question’s page →297. Before enabling BitLocker on a server, select two useful preparations.
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answers
- Securely escrow recovery information and test authorized retrieval
- Choose suitable protectors and encryption policy
Protector/policy planning and verified escrow establish usable recovery. ACLs cannot substitute for decryption keys; conversion success is not escrow evidence; transport encryption protects a different layer.
Open this question’s page →298. A helpdesk finds three recovery records for one computer. Which value identifies the appropriate password for the current prompt?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- The displayed recovery key ID
The recovery ID links the prompt to the corresponding protector record. Hostname, user display name and share name do not distinguish historical protectors.
Open this question’s page →299. A severely damaged BitLocker volume cannot unlock normally, but the matching key package and password exist. Which recovery approach fits?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Use repair-bde with a separate reviewed output target
repair-bde can salvage data with matching package plus password/key to a separate safe target. A package alone is insufficient; ownership is not decryption; copying encrypted blocks alone does not reconstruct damaged BitLocker metadata.
Open this question’s page →300. An administrator takes ownership of EFS-encrypted files after the user profile was lost, but cannot read them. What is needed?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- The user or recovery-agent EFS private key
EFS needs the appropriate private key. BitLocker volume unlocking is a different layer, the public certificate alone cannot decrypt, and ownership or ACL administration does not provide decryption key material.
Open this question’s page →301. When responding to an encrypted-volume incident, select two correct actions.
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answers
- Identify whether the failing layer is BitLocker, EFS or underlying storage
- Use matching authorized recovery material and preserve source evidence
Classifying the layer and preserving matching key material support correct recovery. TPM clearing does not recreate lost keys; RAW can be storage/filesystem damage; permanent disablement does not investigate the trigger.
Open this question’s page →302. A mitigation should prevent execution from pages designated for data. Which setting targets this behavior?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Data Execution Prevention
DEP targets execution from data-marked memory. ASLR randomizes layout; CFG restricts indirect calls; App Control publisher rules select trusted software rather than enforcing memory-page behavior.
Open this question’s page →303. A server application needs a targeted exploit-protection pilot. Another unrelated executable has the same file name in a different folder. Which targeting best limits the pilot?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- A program setting for the full intended executable path
The full path scopes the program setting to its intended executable. A shared name or system-wide default broadens the affected programs. A firewall rule does not configure process mitigations.
Open this question’s page →304. A line-of-business plugin fails after a mitigation is enforced. Which next action provides a controlled response?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Review mitigation events, reproduce the failure, and test a narrow exception
Events and reproduction identify the specific compatibility issue and permit a narrow exception. Blanket disablement abandons unrelated protection; policy application does not establish workload compatibility. Audit support varies by mitigation.
Open this question’s page →305. Which two practices support a safe exploit-protection deployment? Select two answers.
Security · Security | Secure Windows Server operating system
✓ Correct answers
- Verify the target can read the GPO-deployed configuration XML
- Test representative application workflows and restart needs
Workflow testing and readable deployment XML support functional rollout. Audit availability is mitigation-specific, and publisher approval does not establish compatibility with process restrictions.
Open this question’s page →306. On production-signed Windows Server 2025, a team wants to identify software impact while allowing execution. Which OSConfig App Control mode should be used first?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Audit mode
Audit records would-block behavior without preventing code execution. Enforcement can disrupt unapproved software; a firewall rule controls traffic, and Credential Guard protects supported secrets rather than evaluating code trust.
Open this question’s page →307. A hash-approved executable stops running under App Control after a legitimate signed update. What explains the behavior?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- The updated file has a different hash and may need a suitable revised rule
Hash rules identify specific file content; updates change that content. A hash rule does not imply a publisher rule or approval of every future version. A signature identifies the signer but still must satisfy the effective policy's allowed trust rules.
Open this question’s page →308. An administrator manually removes an OSConfig-managed App Control policy with citool, but it returns later. What is the likely cause?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- OSConfig drift control reestablishes the desired policy
OSConfig maintains desired policy and can restore manual removals. Audit is an execution mode rather than policy-removal authorization. AppLocker rules are a separate policy model, and user tokens do not redeploy code-integrity policy files. Use the OSConfig removal scenario to change desired state.
Open this question’s page →309. Which two actions support an App Control enforcement rollout? Select two answers.
Security · Security | Secure Windows Server operating system
✓ Correct answers
- Review audit events for backup, management, security, and update tooling
- Verify the deployed code-integrity policy and test approved workflows
Audit review and policy/workflow verification identify functional allow-rule requirements. AppLocker approval is independent, and the documented OSConfig App Control workflow requires Windows Server 2025.
Open this question’s page →310. A domain-joined Windows Server 2025 member server meets platform requirements and has no explicit disable policy. Which default behavior is expected?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Credential Guard enabled without UEFI lock
Eligible domain-joined non-DC Server 2025 systems default to Credential Guard without UEFI lock. It does not protect the full AD database, and becoming a DC excludes the documented default.
Open this question’s page →311. An administrator must enable Credential Guard while retaining managed remote disablement for a server pilot. Which configuration fits?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Enable Credential Guard without UEFI lock
Without UEFI lock retains remote administrative disablement. With UEFI lock adds a physical-presence removal requirement; disabling VBS removes its isolation foundation. AD DS role installation is unrelated and DC use is not recommended.
Open this question’s page →312. A GPO shows Credential Guard configured, but the administrator needs proof it is running. Which evidence is strongest?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Win32_DeviceGuard.SecurityServicesRunning includes 1
SecurityServicesRunning reports actual operating state. An enabled editor setting, stored registry value, or executable file alone establishes configuration/presence rather than running isolation.
Open this question’s page →313. Which two limitations should influence a Credential Guard deployment? Select two answers.
Security · Security | Secure Windows Server operating system
✓ Correct answers
- It does not protect the full AD database or SAM
- Exchange Server support must be respected because enabling it there is unsupported
Database coverage and Exchange incompatibility are documented boundaries. Credential isolation does not replace DC hardening or protect every secret voluntarily handed to an untrusted application.
Open this question’s page →314. An organization requires application-reputation warnings to be nonbypassable on a supported Explorer workflow. Which selection meets the requirement?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Enable Configure Windows Defender SmartScreen with Warn and prevent bypass
Warn and prevent bypass enables the control and closes the warning override. A bypassable warning or user choice fails the mandatory requirement; disabling the feature provides no reputation protection.
Open this question’s page →315. Explorer SmartScreen policy applies successfully, but an installed supported Edge browser still permits website-warning overrides. What should be configured?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- The separate Edge SmartScreen site-bypass policy
Edge has a separate policy for preventing site-warning bypass. Explorer download warnings affect another surface; permitting the browser to run or to reach HTTPS does not configure its reputation-warning override behavior.
Open this question’s page →316. A team copies a Windows-client MDM SmartScreen setting into its Windows Server plan without checking support. What is the appropriate next step?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Verify Server/browser support and use the applicable policy templates
Support and matching templates must be verified for the target platform and browser. Client MDM scope and editor visibility do not establish universal Server runtime support. SmartScreen complements antivirus.
Open this question’s page →317. Which two controls should be verified separately when both Explorer downloads and Edge sites need nonbypassable warnings? Select two answers.
Security · Security | Secure Windows Server operating system
✓ Correct answers
- Explorer SmartScreen warning/bypass configuration
- Edge SmartScreen site-warning bypass configuration
Explorer and Edge warning surfaces require separate verification. App Control selects trusted code to execute, while HTTPS firewall permission controls connectivity; neither alone enforces these reputation-warning bypass settings.
Open this question’s page →318. A security team must harden only pilot member servers through domain Group Policy. Which scope best fits?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Link the GPO to the OU containing the pilot computer accounts
The intended computer OU provides the relevant scope. GPOs do not link directly to users; unrelated user placement does not scope computer policy. ADMX files supply editor definitions rather than deploy policy by themselves.
Open this question’s page →319. A proposed baseline changes service-logon rights and RDP restrictions across all servers. What should occur before broad enforcement?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Pilot representative servers and verify service, administration, and recovery workflows
Representative pilot and recovery testing identify operational impact of rights and access changes. Baselines do not guarantee compatibility; suppressing audits hides evidence, and broad service privilege is not a safe compatibility remedy.
Open this question’s page →320. A member server's security setting repeatedly alternates between GPO and OSConfig values. What addresses the configuration problem?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Align the desired values and configuration authority for the shared setting
Aligned authorities remove competing desired states. Faster refresh can intensify the conflict; blanket disablement abandons security. Moving a member server into the DC OU supplies inappropriate scope rather than resolving the setting ownership.
Open this question’s page →321. Which two checks support verification of an OS security GPO rollout? Select two answers.
Security · Security | Secure Windows Server operating system
✓ Correct answers
- Validate actual local security state and required workload behavior
- Inspect applied/denied GPOs and winning settings with gpresult
Resultant-policy evidence and operational state establish application and behavior. Editor template availability does not deploy policy; some extensions need a restart or foreground processing regardless of forced refresh.
Open this question’s page →322. A team wants to apply the documented OSConfig role baseline locally on Windows Server 2022. Which assessment is correct?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- This OSConfig workflow requires Windows Server 2025; choose a supported alternative or upgrade
OSConfig's documented Server baseline workflow does not support releases earlier than 2025. Module installation or more privilege cannot change OS support. WorkgroupMember distinguishes server role, not an older OS compatibility mode.
Open this question’s page →323. A production-signed Windows Server 2025 DC needs the correct role-aware baseline. Which scenario should be selected?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- SecurityBaseline/WindowsServer/2025/DomainController
DomainController matches the DC role. MemberServer and WorkgroupMember target different identities/roles; App Control audit is a code-control scenario rather than the full role security baseline.
Open this question’s page →324. An administrator changes an OSConfig-managed security value manually, and it later returns to the desired value. Which feature explains this?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Drift control maintains the configured scenario
Drift control maintains the configured desired state. Group tokens do not restore arbitrary local settings, and an editor entry alone does not prove enforcement on the host. Installing the module alone does not configure all baseline scenarios.
Open this question’s page →325. Which two actions complete a controlled OSConfig baseline exception? Select two answers.
Security · Security | Secure Windows Server operating system
✓ Correct answers
- Apply a documented override for the relevant setting within the scenario
- Query compliance and validate the dependent workflow
A scenario override changes desired state and subsequent compliance/workflow checks validate it. Repeated local edits fight drift control; installing a module alone does not apply a scenario.
Open this question’s page →326. A forest at DFL 2016 has Server 2016 and updated Server 2022 DCs. Which LAPS capability statement is correct?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- AD password encryption is possible, but Server 2016 DCs cannot use Windows LAPS DSRM management
DFL 2016 enables LAPS AD encryption, while Server 2016 DCs lack current Windows LAPS DSRM management. The presence of Server 2016 does not prohibit encryption, and raising DFL does not install OS-level DSRM support. The relevant encryption requirement is the domain functional level.
Open this question’s page →327. Helpdesk can read the LAPS encrypted attribute but cannot decrypt a password. Domain Admins can decrypt it. Which configuration should be examined?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- ADPasswordEncryptionPrincipal and the encryption authorization at backup time
ADPasswordEncryptionPrincipal defines authorized decryption when the password is stored. Reading unrelated attributes or resetting expiration does not grant decryption. Renaming the local account does not determine who can decrypt its backed-up secret.
Open this question’s page →328. An administrator sets an offline server's LAPS password expiration in AD and immediately expects the local password to change. Why can it remain unchanged?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- The server must reconnect and process the relevant state before rotating
AD expiration is a request/state change acted on by the device when it processes policy/state. It cannot instantly reach a disconnected guest. Schema ownership does not perform each local rotation, and expiration does not inherently disable the account.
Open this question’s page →329. Which two preparations are required for AD-backed Windows LAPS deployment? Select two answers.
Security · Security | Secure Windows Server operating system
✓ Correct answers
- Grant scoped computer self-write permission for its LAPS attributes
- Extend the forest schema with Windows LAPS attributes
Schema attributes and computer self-write rights establish storage and backup authorization. Shared preference passwords defeat unique secret management, and reading delegation does not supply computer write rights.
Open this question’s page →330. A team mainly needs server EDR through Defender for Endpoint integration. Which Defender for Servers plan is the entry-level match?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Plan 1
Plan 1 focuses on EDR via Defender for Endpoint. Plan 2 also includes it but is not the only plan. Antivirus presence and a workspace alone do not establish Defender for Servers plan protection.
Open this question’s page →331. An Azure subscription already uses Plan 2. An administrator wants to disable that plan for one server while keeping it for others. Which scope behavior is supported?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Resource-level Plan 2 disablement
Plan 2 can be disabled at resource scope even though it cannot be enabled there. Subscription-wide removal is unnecessary for this exception. Guest account passwords do not change Azure plan configuration.
Open this question’s page →332. An on-premises server is Arc-connected and runs Defender Antivirus, but is not onboarded to MDE. Which conclusion is justified?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Arc and antivirus alone do not prove the EDR integration is complete
Arc/antivirus status must be supplemented by MDE onboarding and connectivity evidence. Neither automatically confirms all protection; agentless scanning availability for cloud disks does not imply automatic physical on-premises disk scanning.
Open this question’s page →333. Which two facts should guide a current Defender for Servers architecture? Select two answers.
Security · Security | Secure Windows Server operating system
✓ Correct answers
- Direct MDE onboarding has limitations for some Plan 2 features
- Most plan features use MDE integration or agentless scanning
The current agent architecture and onboarding-specific feature limits are documented. AMA remains relevant to selected collection benefits rather than universal EDR; Plan 2 cannot be enabled at individual resource scope.
Open this question’s page →334. A normal inbound allow for TCP 443 and an explicit block both match the same connection. What is the expected result?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- The explicit block wins
Matching explicit blocks override normal allows. Creation date and display-name ordering do not establish precedence, and Windows Firewall does not expose administrator-weighted rule order for this purpose.
Open this question’s page →335. A server must accept HTTPS only from its management subnet on the Domain profile. Which rule best matches?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Inbound TCP 443 allow scoped to the management subnet and Domain profile
The inbound TCP 443 rule with source/profile scope matches the service access requirement. An unrestricted rule is too broad; an outbound rule does not permit inbound listening traffic. IPsec connection security does not itself authorize the application through the firewall.
Open this question’s page →336. Traffic works with ordinary firewall allows but fails after IPsec is set to Require. What should be inspected next?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Peer authentication, trusted certificates if used, compatible proposals, and active security associations
Required IPsec depends on compatible authentication and negotiation with active associations. Duplicate traffic allows or broader address/profile scopes do not satisfy a missing required security negotiation.
Open this question’s page →337. Which two checks are needed for a connection to an Azure Windows VM? Select two answers.
Security · Security | Secure Windows Server operating system
✓ Correct answers
- The guest listener and effective Windows Firewall policy permit it
- The applicable NSG permits the required traffic
Azure network controls and the guest's listener/firewall must both permit the path. Guest allows do not override NSG blocking, and IPsec negotiation rules do not create service listeners.
Open this question’s page →338. A department in one domain needs a stronger password and lockout policy for its users. Which mechanism directly supports that?
Security · Security | Secure AD DS
✓ Correct answer
- A PSO assigned to the department's global security group
FGPP assigns a PSO to users or global security groups. An OU-only password GPO does not provide a separate domain-user policy. Distribution ACL groups and subnet locality do not select password validation rules.
Open this question’s page →339. A user has a direct PSO with precedence 50 and a group PSO with precedence 10. Which applies?
Security · Security | Secure AD DS
✓ Correct answer
- The direct PSO with precedence 50
Direct assignment takes priority over group-associated PSOs. Lowest numerical precedence resolves competition at the relevant level; settings do not automatically merge, and creation date is not the selection rule.
Open this question’s page →340. A team assumes the PSO with the longest minimum password length applies, but user behavior differs. Which tool resolves the uncertainty?
Security · Security | Secure AD DS
✓ Correct answer
- Get-ADUserResultantPasswordPolicy for that user
The resultant-password-policy cmdlet reports the selected PSO. The domain default alone omits an overriding PSO, and a member server's local policy does not identify the domain user's FGPP. Policy names are not precedence rules.
Open this question’s page →341. Which two statements correctly describe fine-grained password policy targeting? Select two answers.
Security · Security | Secure AD DS
✓ Correct answers
- PSOs can apply directly to user objects
- PSOs can apply to global security groups
User objects and global security groups are supported subjects. PSOs are not OU-linked GPOs, and domain-local groups are not the supported group subject type.
Open this question’s page →342. An administrator wants banned-password enforcement without transmitting users' new passwords to a cloud service. Which architecture meets this?
Security · Security | Secure AD DS
✓ Correct answer
- DC agents validate locally using policy downloaded through proxies
DC agents evaluate locally using downloaded/cached policy. The password is not sent for live cloud validation; the proxy is a retrieval relay rather than LDAP interception/reset logic. The feature supports on-premises AD DS.
Open this question’s page →343. A pilot must measure likely user impact without rejecting password changes. Which mode should be selected?
Security · Security | Secure AD DS
✓ Correct answer
- Audit
Audit records would-reject outcomes while allowing changes. Enforced rejects validation failures. Disabled or undeployed agents do not provide the needed impact evidence from the password filter.
Open this question’s page →344. Agents are installed, but the domain still replicates SYSVOL with FRS. The installer succeeded. What should be done?
Security · Security | Secure AD DS
✓ Correct answer
- Migrate SYSVOL to DFSR before treating the deployment as functional
The documented requirement is DFSR, and agents do not work properly in an FRS domain despite installation. Adding a proxy or changing enforcement mode does not replace the required policy replication technology.
Open this question’s page →345. Which two choices support reliable on-premises Password Protection? Select two answers.
Security · Security | Secure AD DS
✓ Correct answers
- Deploy and validate agents on every writable DC handling changes
- Deploy redundant proxies registered with the forest's tenant
Redundant consistent registration and complete writable-DC coverage support policy availability and enforcement. An unfiltered DC creates a bypass, and local validation does not require sending passwords to the cloud.
Open this question’s page →346. A domain at DFL 2016 has a legacy application using NTLM. An employee can use it until added to Protected Users. What best explains the failure?
Security · Security | Secure AD DS
✓ Correct answer
- Protected Users DC-side restrictions prohibit NTLM
Protected Users prohibits NTLM at the supported DFL, exposing the application's dependency. Membership does not inherently disable the account or remove every ACL right, and it does not rewrite an NTLM-only application to use Kerberos.
Open this question’s page →347. A privileged account's old password was last changed on a DC that did not produce usable AES keys. What should be verified before Protected Users membership?
Security · Security | Secure AD DS
✓ Correct answer
- Change the password on a suitable DC and verify AES Kerberos authentication
AES key readiness supports permitted Kerberos authentication. DES-only or preauthentication removal weakens or conflicts with the required path; RODC caching does not create the required AES readiness.
Open this question’s page →348. A delegation-dependent application fails for a Protected Users member, although Account is sensitive and cannot be delegated is unchecked. What should the administrator conclude?
Security · Security | Secure AD DS
✓ Correct answer
- Protected Users membership itself can restrict delegation
Protected Users supplies delegation restrictions independently of the flag. The flag is not the sole control; a shared administrator service password does not make restricted delegation safe. Assess dependency and a scoped solution rather than removing protection everywhere.
Open this question’s page →349. Which two rollout practices are appropriate for Protected Users? Select two answers.
Security · Security | Secure AD DS
✓ Correct answers
- Verify supported clients, DFL, and AES readiness
- Pilot selected human accounts and test NTLM/delegation dependencies
Pilot and prerequisite checks identify compatibility before restriction. Service/computer accounts are not appropriate Protected Users members, and simultaneous untested enrollment can remove every recovery path.
Open this question’s page →350. A DC currently runs a general-purpose browser and unrelated application utilities. Which change best reduces its attack surface?
Security · Security | Secure AD DS
✓ Correct answer
- Remove unnecessary workloads and use a secured administrative endpoint
Removing unnecessary software and using secured administration reduces attack paths. Privileged-only browser use still exposes powerful credentials; inbound filtering does not remove risks from privileged browsing. A member-server baseline must not be assumed suitable for a DC's roles and dependencies.
Open this question’s page →351. A company encrypts a virtual DC's guest disks but allows general storage administrators unrestricted access to its VM configuration and host. What remains important?
Security · Security | Secure AD DS
✓ Correct answer
- Protect the host, storage, and management fabric as sensitive directory infrastructure
The supporting hypervisor, files, and management controls can undermine DC security. Guest encryption alone does not eliminate all fabric risks; OU relocation does not secure privileged host/storage access. In-guest membership review omits the surrounding infrastructure's authority.
Open this question’s page →352. A security baseline is applied to a DC, but administrators have not tested restoration or protected backup access. What should be completed?
Security · Security | Secure AD DS
✓ Correct answer
- Protect directory backups and validate a controlled AD recovery path
Backup protection and tested recovery preserve both secrecy and availability. Disabling backups removes recovery, configuration compliance does not establish restoration, and sole storage on the failed directory creates a recovery dependency.
Open this question’s page →353. Which two measures directly reduce a DC's operating-system attack surface? Select two answers.
Security · Security | Secure AD DS
✓ Correct answers
- Use a supported patched OS with only needed roles and software
- Use Server Core when suitable and secure remote administration
Minimal patched roles and a suitable Core/secure-administration design reduce exposure. Unrelated services and privileged browsing add attack opportunities on a directory authority.
Open this question’s page →354. Helpdesk needs to reset ordinary users in one OU, but does not need to operate the DC OS. Which access model fits?
Security · Security | Secure AD DS
✓ Correct answer
- Delegate the required OU permissions and use remote AD tools
Scoped OU delegation grants the required directory task without OS/DC access. Domain Admins, DC backup privileges, and broad local logon exceed the helpdesk requirement.
Open this question’s page →355. A DC should accept RDP only from authorized admins on secured jump hosts. Which combination meets both identity and network scope?
Security · Security | Secure AD DS
✓ Correct answer
- Appropriate RDP user-right assignments plus scoped firewall rules
User rights restrict identities and firewall scope restricts source systems. A firewall-only rule leaves identity authorization separate; local logon is not the same as RDP control. Trust authentication does not establish a restricted DC management path.
Open this question’s page →356. An authorized admin loses DC RDP after a deny right targets a group containing that admin through nesting. What should be investigated?
Security · Security | Secure AD DS
✓ Correct answer
- Effective deny membership and the required recovery/management access policy
The nested deny directly blocks the logon despite other allows. Listener status, trust transitivity, and password length alone do not resolve a user-right denial caused by group membership.
Open this question’s page →357. Which two access layers must be protected for a virtual DC? Select two answers.
Security · Security | Secure AD DS
✓ Correct answers
- Host, VM storage, and fabric management access
- Authorized guest OS and directory administration
Guest/directory access and privileged supporting fabric access can both affect DC integrity. Application file ACLs and ordinary employee OU delegation protect narrower resources and do not cover these DC administrative control layers.
Open this question’s page →358. A privileged user must never have their context delegated to another service. Which account option directly supports that?
Security · Security | Secure AD DS
✓ Correct answer
- Account is sensitive and cannot be delegated
The sensitive/nondelegable option directly restricts delegation. Removing preauthentication, using DES, or reversible storage weakens other authentication protections and does not express this nondelegation requirement.
Open this question’s page →359. A team plans smart-card-required interactive logon for selected admins. Which prerequisite set should be validated?
Security · Security | Secure AD DS
✓ Correct answer
- Compatible certificate/PKI trust, hardware, and recovery access
Smart-card interactive authentication depends on certificate trust and usable hardware with recovery planning. Password history, LDAP message signing, and nondelegation protect different concerns and do not establish the smart-card logon path.
Open this question’s page →360. A user is configured not to require Kerberos preauthentication. What security concern should be raised?
Security · Security | Secure AD DS
✓ Correct answer
- Unauthenticated AS requests can expose material for offline password attacks
Removing preauthentication exposes AS-response material to unauthenticated requests. It does not force AES, prevent all NTLM relay, or require smart-card interactive logon.
Open this question’s page →361. Which two account settings usually warrant removal unless a documented requirement exists? Select two answers.
Security · Security | Secure AD DS
✓ Correct answers
- Do not require Kerberos preauthentication
- Store password using reversible encryption
Preauthentication removal and reversible storage weaken credential protection. Nondelegation and an appropriately deployed smart-card requirement can strengthen selected accounts and are not the unsafe settings described.
Open this question’s page →362. An administrator needs temporary authority to extend the AD schema. Which group is directly relevant?
Security · Security | Secure AD DS
✓ Correct answer
- Schema Admins
Schema Admins provides schema-change authority. Backup Operators supplies backup/restore privileges, Account Operators manages permitted accounts, and Print Operators manages printing-related operations; these operator roles are not substitutes for schema administration.
Open this question’s page →363. Helpdesk requests Backup Operators membership solely to reset ordinary user passwords. Which response best follows least privilege?
Security · Security | Secure AD DS
✓ Correct answer
- Delegate password reset on the intended OU instead
Specific OU password-reset delegation matches the task. Backup rights can bypass data ACLs; Enterprise Admins and Schema Admins are far broader than ordinary account resets.
Open this question’s page →364. Helpdesk can reset ordinary users in an OU but not a protected administrator account moved into the same OU. Which mechanism should be investigated?
Security · Security | Secure AD DS
✓ Correct answer
- AdminSDHolder/SDProp and protected-object ACL inheritance
Protected administrative objects can have AdminSDHolder-derived ACLs and disabled inheritance. Workstation GPO order, password complexity, and universal membership caching do not explain the protected-object directory permission boundary.
Open this question’s page →365. Which two controls protect built-in administrative group authority? Select two answers.
Security · Security | Secure AD DS
✓ Correct answers
- Restrict and audit changes to privileged group membership
- Keep high-impact memberships justified and time-scoped where appropriate
Controlled membership and auditing limit privileged authority. Operator groups can grant excessive rights, and OU relocation alone does not remove protected-account ACL behavior.
Open this question’s page →366. Helpdesk should reset and unlock ordinary Staff users but cannot manage privileged groups. Which approach fits?
Security · Security | Secure AD DS
✓ Correct answer
- Delegate only the required operations on the Staff OU to a helpdesk security group
Scoped operation-specific delegation grants the requested directory tasks. Domain Admins and forest-wide writes exceed the scope. Kerberos delegation concerns forwarding user context to services, not granting password-reset administration.
Open this question’s page →367. A service must accept delegated user access only from approved front-end servers using RBCD. Where is that authorization configured?
Security · Security | Secure AD DS
✓ Correct answer
- On the resource-side object identifying allowed delegating principals
RBCD is authorized on the resource object. A traditional source-side constrained-delegation list is a different model; a user nondelegation flag restricts rather than grants delegation. An SPN identifies a service but does not alone authorize RBCD principals.
Open this question’s page →368. A technician has password-reset delegation but cannot add users to a role group. Which explanation fits?
Security · Security | Secure AD DS
✓ Correct answer
- Reset-password permission does not include group-membership modification
Delegated operations are distinct, so membership edits require appropriate separate rights on the intended groups. Enterprise Admins is unnecessary for routine scoped administration. Preauthentication controls authentication behavior rather than the object ACL, and password-reset rights do not imply domain-wide group modification.
Open this question’s page →369. Which two checks should follow new OU delegation? Select two answers.
Security · Security | Secure AD DS
✓ Correct answers
- Verify intended operations work for ordinary in-scope objects
- Verify privileged and out-of-scope objects remain protected
Positive and negative scope tests establish the intended boundary. Protected accounts can have special ACL behavior; sensitive replication rights do not repair routine delegated administration safely.
Open this question’s page →370. An LDAP client uses non-TLS SASL signing and must keep directory content confidential in transit. Which additional protection can meet that requirement?
Security · Security | Secure AD DS
✓ Correct answer
- Use SASL sealing or TLS
SASL sealing or TLS supplies confidentiality. Signing alone supplies integrity/authenticity without content encryption; a stronger password does not encrypt an unsigned session. Channel binding requires an applicable TLS session and is not a substitute for transport encryption.
Open this question’s page →371. A new Windows Server 2025 AD deployment rejects a legacy client's unencrypted simple bind. Which compatible client change addresses credential transport protection?
Security · Security | Secure AD DS
✓ Correct answer
- Use a correctly validated TLS LDAP session or a suitable secure SASL method
TLS protects simple-bind credentials, while an appropriate secure SASL method supplies its required protections. Opening an already reachable port cannot satisfy security requirements; schema privilege and blanket security removal do not provide protected authentication.
Open this question’s page →372. An application fails only when LDAP channel binding is set to Always. It uses SASL over TLS but does not provide a valid CBT. What explains the failure?
Security · Security | Secure AD DS
✓ Correct answer
- Always requires a valid CBT for this applicable session
TLS+SASL is the applicable CBT context, and Always rejects missing/invalid binding. TLS is not an exemption, unencrypted simple bind has no TLS binding context, and password length does not satisfy CBT.
Open this question’s page →373. Which two statements accurately distinguish LDAP protections? Select two answers.
Security · Security | Secure AD DS
✓ Correct answers
- Channel binding applies to SASL authentication over TLS
- Signing alone supplies integrity rather than confidentiality
Signing provides integrity and CBT binds TLS+SASL authentication. CBT is not simple-bind transport encryption, and TLS security still depends on correct server/certificate identity validation.
Open this question’s page →374. A service's DNS alias works with NTLM but fails when the application requires Kerberos. Which investigation best targets the name-dependent cause?
Security · Security | Secure AD DS
✓ Correct answer
- Check the alias's service SPN registration, uniqueness, and owning account
Kerberos requires a correct unique SPN tied to the service identity, so an alias can expose missing registration. Password length, replication scheduling, and backup privilege do not repair service-name ticket mapping.
Open this question’s page →375. A serial application is slow while total CPU is 20 percent on a many-core server. What should be examined?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Per-processor and process CPU counters
Per-core and process counters can reveal a saturated serial execution path. A longer aggregate average can hide it, processor count does not show allocation/use, and overall idle capacity does not prove a serial process has spare execution capacity.
Open this question’s page →376. A two-second stall occurs repeatedly, but CPU is sampled every five minutes. What change improves capture?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Use a shorter interval with relevant correlated counters
Shorter sampling can expose brief stalls and correlated bottlenecks. Longer intervals and daily averages hide them; a low average cannot rule out short severe events.
Open this question’s page →377. Pages/sec spikes during a large file workload. What is the best next interpretation step?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Correlate memory availability, commitment and process growth
Availability, commitment, and process allocation distinguish pressure or leaks from legitimate paging. Pages/sec alone is not a diagnosis; CPU average does not establish memory behavior; paging can include file-backed reads rather than only pagefile writes.
Open this question’s page →378. When analyzing slow storage with Performance Monitor, select two useful measurements.
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answers
- Disk read/write latency
- Disk throughput and IOPS in workload context
Latency and throughput/IOPS establish observed storage performance in workload context. Healthy status does not rule out throttling or latency. A universal queue threshold ignores storage parallelism, and free capacity does not prove low I/O latency.
Open this question’s page →379. A disk-latency incident occurs only at 02:00. Which approach best collects evidence?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Schedule a DCS with disk and workload counters
A scheduled DCS captures the overnight incident with relevant correlated counters. A noon chart and one later sample miss the incident period. A definition that never runs does not produce data.
Open this question’s page →380. A collector must sample every five seconds and write binary data. Which logman parameters fit?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- -si 00:00:05 and -f bin
Five-second sampling uses 00:00:05 and binary format uses bin. 00:05:00 selects five minutes, csv selects CSV output, and combining both wrong values changes both requested settings.
Open this question’s page →381. An overnight DCS starts successfully but its output fills the system disk. Which configuration was missing?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Appropriate output location and log/stop limits
A suitable location and bounded log/stop policy control diagnostic storage use. Changing counter categories alone does not establish a limit. More frequent sampling usually increases data volume, and a different set name does not bound output.
Open this question’s page →382. Before relying on an unattended Data Collector Set, select two validations.
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answers
- Confirm schedule, stop and retention behavior
- Confirm it starts and produces expected counter records
Actual records and tested scheduling/stop/retention establish a usable capture. Definition creation alone is not collection. CPU-only data can miss the relevant bottleneck, and unbounded system-volume output can fill critical storage.
Open this question’s page →383. A team uses WAC but wants persistent centralized monitoring and automated notifications. Which integration fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Azure Monitor with working guest collection and alerts
Azure Monitor supplies persistent data and alerting. A browser chart is not a retained alert service; DFS-R replicates files; Storage QoS controls I/O rather than notifications.
Open this question’s page →384. A new on-premises Windows Server monitoring deployment is being configured from WAC operations. Which guest architecture should be selected?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Azure Arc plus Azure Monitor Agent and DCR association
Arc, AMA and DCRs provide the supported hybrid guest collection path. Legacy-agent guidance is historical; Dependency Agent is not basic event collection and is deprecated; Reader does not collect guest data.
Open this question’s page →385. WAC cannot open a server, but users can access its application normally. What should be investigated first?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- The WAC gateway, remoting path and management credentials
The working application separates its data path from WAC gateway/remoting and management authentication. Application success does not establish management reachability. Restarting the working application is not indicated, and its public service port does not exercise the WAC management path.
Open this question’s page →386. A WAC operator configures a low-free-space notification through Azure Monitor. Select two checks.
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answers
- Verify the server and volume telemetry is actually arriving
- Test action-group delivery and alert resolution
Data arrival and alert/action testing establish end-to-end operation. Local charts do not prove ingestion; aggregation can hide the full volume; deployment rights do not automatically imply all log-read rights.
Open this question’s page →387. A volume is 70 percent full but growth predicts exhaustion in six days. Which default System Insights status fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Critical
Six-day predicted exhaustion meets Critical. Current 90-percent utilization is not the forecast criterion; spare space today does not imply OK; a valid adverse prediction is not an execution error.
Open this question’s page →388. An isolated Windows Server 2025 needs local predictive storage analysis without an Azure subscription. Which feature fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- System Insights
System Insights runs local forecasts. Azure alerts require their Azure monitoring context; Dependency Agent Map is deprecated dependency mapping; hard quotas enforce current limits rather than forecasting trends.
Open this question’s page →389. A capability has only two days of history and returns no forecast. What should be checked before treating this as failure?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Whether insufficient history explains the None result
The default model does not predict with zero to five days of input. None can therefore be expected, not an engine failure. Two days does not supply a 60-day forecast, and System Insights processing runs locally without requiring Azure.
Open this question’s page →390. When acting on a System Insights capacity forecast, select two useful steps.
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answers
- Read the status description and detailed capability output
- Compare the modeled trend with recent workload changes
Detailed output and workload context guide capacity planning. Forecasts summarize modeled capacity trends, not every burst or physical failure; operational fault monitoring remains necessary.
Open this question’s page →391. An incident report lists event 1000 without its provider or timestamp. What additional evidence is most useful?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Provider, full message, computer and occurrence time
Provider/message/computer/time identify the event and incident context. IDs are provider-scoped, a level alone matches many events, and an export filename does not contain the relevant event semantics by itself.
Open this question’s page →392. An administrator must preserve the System log for analysis. Which command fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- wevtutil epl System C:\Lab\System.evtx
epl exports the log. cl clears it; logman manages collectors rather than exporting this event log; Get-SmbSession reports SMB sessions.
Open this question’s page →393. Security failures are expected but absent from the queried log. What should be checked first?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Audit policy, log retention, access and the correct time range
Generation policy and retained accessible records must be checked in the correct log and period. No rows does not prove no event. System and Security are distinct logs, and increasing capacity alone does not enable an absent audit policy.
Open this question’s page →394. For reliable cross-server event analysis, select two practices.
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answers
- Preserve provider and full event details in exported evidence
- Align timestamps and time-zone context across systems
Provider detail and aligned time support correlation. IDs are not globally unique; clearing removes evidence; unbounded analytic logging can add overhead and excessive data.
Open this question’s page →395. AMA is installed on an Azure VM, but no requested Windows events arrive. Which missing resource relationship is most relevant?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- A DCR association specifying the event collection
The associated DCR supplies the requested guest event source and destination. An agent, workspace, or host-metric view alone does not define that Windows event collection path.
Open this question’s page →396. A standard AMA DCR collects Security events to Azure Monitor Logs. Which table should be queried first?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Event
Standard Windows event DCR collection writes Event. SecurityEvent is used by the relevant Sentinel connector route; InsightsMetrics stores classic predefined performance; AzureActivity records management operations.
Open this question’s page →397. Heartbeat rows exist, but a custom System error query has no data despite generated events. What should be checked next?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- The DCR filter, association, destination table and query time range
Heartbeat confirms communication but not matching event collection. Filter/source/association/table/time determine the data path; automatic legacy parallel installation is not a fix; partition style is unrelated.
Open this question’s page →398. An AMA deployment collects Windows events to a Log Analytics workspace through Azure Monitor Private Link. Select two relevant preparations.
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answers
- Ensure private DNS and routing reach the monitoring endpoints
- Configure the required DCE and private-link scope relationship
For logs-based private collection, DCE/AMPLS integration and coherent endpoint DNS/routing are required. AMA still needs the appropriate rule association. A public answer does not validate private collection, and standard Windows events follow the Event table route rather than InsightsMetrics.
Open this question’s page →399. A team wants notification when an Azure VM is deleted through the management plane. Which alert type fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Activity-log alert
Azure VM deletion is a management-plane activity. Guest System logs do not inherently capture that Azure operation. Missing heartbeat can have several causes, and CPU metrics do not identify the exact deletion operation.
Open this question’s page →400. An alert should detect when a VM's average CPU utilization across a 15-minute window exceeds 90 percent. Which evaluation matches the requirement?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Average over 15 minutes above 90 percent
The requested fifteen-minute average maps directly to that aggregation/window. A one-minute maximum and a single sample detect brief peaks, while a daily minimum below the threshold measures a different condition.
Open this question’s page →401. A log alert never fires, and its query returns no rows despite reported failures. What should be validated before changing the threshold?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Collection, table, scope, lookback and query result semantics
A valid data/query path is needed before threshold tuning. Missing rows can be missing telemetry; severity and action duplication do not fix collection or query selection.
Open this question’s page →402. To verify a newly configured alert, select two checks.
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answers
- Generate or observe a controlled matching condition
- Confirm action delivery and resolution behavior
Condition and end-to-end action/resolution testing prove the alert works. Creation alone is insufficient; management rights and data reads differ; aggregated disks can mask the affected volume.
Open this question’s page →403. An Azure VM shows host CPU charts, but an operator needs guest available-memory metrics. What is needed?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Configured guest monitoring with AMA and an appropriate DCR
Guest memory requires a guest data collection path. Activity logs record management operations; DNS endpoints affect reachability; QoS governs I/O and does not collect memory metrics.
Open this question’s page →404. A new Azure VM enhanced-monitoring deployment follows the recommended metrics experience. Which destination fits its OpenTelemetry metrics DCR?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- An Azure Monitor workspace
The selected OpenTelemetry metrics experience uses an Azure Monitor workspace. Log Analytics and InsightsMetrics belong to the classic logs-based route, while Event stores collected Windows events.
Open this question’s page →405. An existing classic VM Insights deployment queries Perf and sees no predefined guest metrics. Which table should be checked?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- InsightsMetrics
The predefined classic VM Insights performance records use InsightsMetrics. Additional standard counter rules can use Perf. Event holds Windows logs and AzureActivity holds control-plane operations.
Open this question’s page →406. For a new AMA-based VM monitoring design, select two correct choices.
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answers
- Use extra suitable rules for additional logs or counters
- Install AMA and associate the required DCRs
AMA/rules establish collection and separate suitable rules extend it. Dependency Agent Map is deprecated; host metrics do not include all guest events; the classic predefined metrics DCR should not be arbitrarily edited.
Open this question’s page →407. A server responds to ping but clients cannot connect to SMB. Which check is most relevant next?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Test TCP 445 and the SMB service path
SMB requires TCP 445 and a working listener/security path. Ping covers ICMP, not SMB; CPU and hostname changes do not directly test the failing transport.
Open this question’s page →408. Test-NetConnection shows TCP 3389 fails to an Azure VM. Which investigation fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Effective NSG/routes plus guest RDP listener and firewall
TCP RDP depends on Azure controls, routing, and guest listener/firewall. Ping checks ICMP, Running reports VM state, and DNS supplies an address; none alone proves the specific RDP flow is allowed and accepted.
Open this question’s page →409. A hybrid connection sends packets to a server, but replies follow a different route through a stateful firewall. What should be investigated?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Asymmetric return routing and firewall state
Stateful filtering can reject an asymmetric return path. Replacing DNS does not change the demonstrated routes. A port change does not resolve routing/state ownership, and forward delivery alone does not prove bidirectional connectivity.
Open this question’s page →410. To isolate a connectivity failure, select two useful tests.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answers
- Compare access by destination name and IP
- Check the intended service port and listener
Name/IP comparison separates resolution from routing and port/listener checks target the service. ICMP is independent; TCP does not prove UDP QUIC; simultaneous changes obscure the cause.
Open this question’s page →411. An application connects by IP but its hostname returns NXDOMAIN. What should be checked first?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- The hostname record and intended DNS zone/resolver
NXDOMAIN identifies a missing-name DNS answer. SMB encryption, IOPS and Recycle Bin settings do not create the requested hostname record.
Open this question’s page →412. An operator must query files.contoso.com against DNS server 10.0.0.10 without LLMNR fallback. Which command fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Resolve-DnsName files.contoso.com -Server 10.0.0.10 -DnsOnly
Resolve-DnsName with Server and DnsOnly selects the stated resolver and excludes LLMNR/NetBIOS resolution. The unqualified query does not enforce those choices. A TCP test does not isolate that DNS reply, and clearing cache does not query the specified resolver.
Open this question’s page →413. A private endpoint exists and routing works, but the storage hostname resolves publicly on branch clients. What is the likely missing configuration?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- The private-link DNS/forwarding path for those clients
The hostname must resolve privately through the correct DNS and forwarding design. Quotas and cluster sizes do not alter DNS; extra cloud endpoints are not a DNS fix and a group has one cloud endpoint.
Open this question’s page →414. For a domain name-resolution incident, select two useful checks.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answers
- Inspect client DNS server selection and AD SRV answers
- Compare relevant internal resolver responses and cached results
Correct resolver selection, service records and response/cache comparison identify the failure. Public DNS cannot normally resolve private AD records; IP ping bypasses DNS; evidence should identify the resolver before blanket cache changes.
Open this question’s page →415. A server detects an update but fails during installation. Which evidence is especially relevant?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- CBS servicing log and the failure code
CBS and the exact failure code expose servicing-stage problems. Namespace naming, storage reports and key IDs do not diagnose the update installer stage.
Open this question’s page →416. A Windows Server scan shows no update that was never approved in its configured WSUS group. What is the first correction?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Verify and correct WSUS approval and target policy
WSUS approval and targeting control whether the server is offered the update. Component repair, download cache cleanup, and restart deadlines do not approve or target the missing package.
Open this question’s page →417. A generated WindowsUpdate.log shows no events from a later retry. What explains this?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Get-WindowsUpdateLog generated a static snapshot requiring refresh
The readable generated log is static and must be regenerated for later ETL data. It is not automatically appended, absence from that snapshot does not disprove a retry, and deleting the generated text does not by itself delete all source ETL traces.
Open this question’s page →418. A downloaded update fails as not applicable. Select two useful checks.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answers
- Check prerequisites, supersedence and installed package state
- Confirm OS build and architecture requirements
Package compatibility and dependency/supersedence state determine applicability. Download and ping do not prove it; an unrelated approval category cannot change the package requirements.
Open this question’s page →419. A domain member should use its AD time hierarchy. Which client type fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- NT5DS
NT5DS follows the domain hierarchy. Independent manual peers depart from the stated requirement; NoSync disables synchronization; DNS forwarding is not a Windows Time client type.
Open this question’s page →420. An operator wants to know which source a server currently uses. Which command fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- w32tm /query /source
The source query shows current selection. Configuration lists settings rather than establishing the selected source; SMB connection and replication summary commands do not report NTP source.
Open this question’s page →421. A local time setting repeatedly returns to the old value after policy refresh. What should be checked?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Effective Group Policy and w32tm configuration
Group Policy can reapply effective settings, so inspect its influence and configuration. Repeating a local edit does not address the source, a peer list alone does not identify controlling policy, and stripchart reachability/offset does not prove configuration precedence.
Open this question’s page →422. A domain experiences clock drift and Kerberos failures. Select two relevant investigations.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answers
- Check the forest-root PDC emulator source and status
- Validate UDP 123 reachability and downstream synchronization
The hierarchy source and UDP NTP path determine synchronization. TCP is not NTP validation; password resets do not correct skew; disabling sync cannot guarantee agreement.
Open this question’s page →423. One process Private Bytes grows for hours while available memory falls under similar load. What hypothesis deserves investigation?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- A process memory leak or unbounded allocation
Persistent private allocation growth with pressure supports a leak/allocation investigation. DNS caching, encryption recovery and filename screening do not directly explain this memory trend.
Open this question’s page →424. An Azure VM disk shows high latency at its provisioned throughput limit with no disk health faults. What should be evaluated?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Disk and VM-size throughput caps versus demand
Provisioned disk and VM aggregate limits can throttle otherwise healthy storage. More capacity alone may not remove the VM ceiling. Healthy status and free bytes do not establish sufficient performance.
Open this question’s page →425. After adding CPUs, a slow single-threaded application is unchanged and one core remains saturated. What does this indicate?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- The serial bottleneck may need application or per-core performance work
Serial work can remain limited by one core even when total CPU is low. Aggregate averages hide that limitation, more cores do not automatically parallelize the thread, and memory is not the only possible bottleneck.
Open this question’s page →426. A performance fix was applied. Select two useful validations.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answers
- Repeat the original workload and measure application response
- Check correlated counters for improvement or a shifted bottleneck
Workload response and correlated resource evidence validate the repair. Reboot alone does not establish cause; idle/peak comparisons mislead; simultaneous changes obscure the effective intervention.
Open this question’s page →427. An Arc server is Connected, but an extension failed. Which statement is correct?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Connection health and extension provisioning must be checked separately
A connection does not prove handler or script success. Arc uses its own extension-management path; network, identity and script problems can also fail an extension.
Open this question’s page →428. A Windows Arc extension cannot download its package. Which local log is most directly relevant?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- C:\ProgramData\GuestConfig\ext_mgr_logs\gc_ext.log
Arc extension-service logs report package download/verification. CBS concerns servicing; a copy log and DFS referrals do not describe Arc handler provisioning.
Open this question’s page →429. A Custom Script extension installed but its output says access denied to a protected data path. What should be addressed before rerun?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- The script execution identity and required path permissions
The script reached execution and needs the appropriate guest identity and path rights. Download success does not establish those rights. The Azure caller's control-plane role is not automatically the script's guest identity, and unchanged permission denial will recur.
Open this question’s page →430. For a failed Windows Azure VM extension, select two useful checks.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answers
- Inspect VM Agent readiness and extension instance view
- Read handler logs and the actual script error output
Agent/instance status and handler/script output distinguish the failing stage. Resource creation is insufficient; unchanged errors recur on blind reinstall; himds belongs to Arc Connected Machine agent.
Open this question’s page →431. A data volume is BitLocker locked and a matching recovery password is available. What is the appropriate first recovery action?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Unlock it using the matching authorized recovery password
The matching password unlocks the encrypted volume. Ownership and naming do not decrypt; an unrelated protector record cannot unlock this volume.
Open this question’s page →432. BitLocker is unlocked, but only files encrypted by a retired user remain unreadable. Which key should be investigated?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- The user or Data Recovery Agent EFS private key
EFS retains a separate file-key requirement after BitLocker unlock. Partition identifiers, read roles and tiering policy do not provide the EFS private key.
Open this question’s page →433. A recovery password unlocked the boot volume, but the prompt returns every restart after firmware maintenance. What should be investigated?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Boot measurement changes and protection suspension/resumption state
Repeated prompts can reflect changed boot validation or incorrect protector workflow. Enumeration, free-space totals and display names do not reconcile TPM boot measurements.
Open this question’s page →434. For a damaged BitLocker source needing repair-bde, select two requirements.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answers
- Choose a separate output target whose overwrite is acceptable
- Use matching password/key and a matching key package if damaged metadata requires it
Salvage needs valid matching password/key material, plus a matching key package when required, and a separate output that can be overwritten. The package does not replace keys. Failed partial conversion is unsupported, and ownership does not prove decrypted data.
Open this question’s page →435. An iSCSI disk disappears intermittently. Which layer should be investigated before changing share ACLs?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Initiator/target paths, MPIO and disk events
Disk loss is a lower block-storage/path symptom. Namespace appearance, group names and template descriptions do not restore the presented LUN.
Open this question’s page →436. Writes fail to a thin volume although its filesystem reports free capacity. Which additional measurement is required?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Backing pool physical free space
Thin logical capacity can exceed available physical pool allocation. Virtual maximums, filesystem free space, and share quotas do not establish free backing storage.
Open this question’s page →437. A formerly healthy LUN appears as RAW after path errors. What is the appropriate first response?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Preserve data and diagnose path/filesystem state
Unexpected RAW can indicate damaged presentation or filesystem, so preserve and investigate. Initialization risks existing data; ownership and share naming do not reconstruct filesystem metadata.
Open this question’s page →438. Before taking another degraded S2D node offline, select two checks.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answers
- Current resiliency, fault placement and repair jobs
- Quorum and available repair capacity
Current protection and quorum/capacity determine safe maintenance. A drive letter, theoretical copy count or one login does not verify remaining cluster resilience.
Open this question’s page →439. A user was deleted yesterday after Recycle Bin was enabled and remains restorable. Which recovery method is usually appropriate?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Restore the object from AD Recycle Bin
Recycle Bin recovers the restorable object and preserved links without a whole database restore. Whole-DC recovery is broader than required. SYSVOL is policy-file content, while recreating a display name does not restore the old object's identity and links.
Open this question’s page →440. An OU and its users were deleted together. What restoration sequence is required?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Restore the missing parent OU before its children
The intended parent must exist before children can return there. A child restore does not automatically reconstruct all missing ancestors, and display-name matching is not a substitute for exact object and hierarchy restoration.
Open this question’s page →441. Recycle Bin is enabled only after a deletion. Why might full object restoration still be unavailable?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- The feature did not preserve full deleted-object data before that deletion
Recycle Bin is not retroactive for full preservation of earlier tombstones. It does not disable Kerberos; manual per-DC creation conflicts with replication; SMB roles do not alter AD retention.
Open this question’s page →442. Before restoring a deleted AD object, select two useful checks.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answers
- Confirm the intended parent exists or restore it first
- Confirm the exact object identity and restorable state
Identity/state and parent validation establish a valid object restore. Retention is configurable; enablement is irreversible; SYSVOL file content is a separate recovery layer.
Open this question’s page →443. One DC database is damaged while healthy partners retain correct data. What recovery type allows it to catch up from those partners?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- A supported nonauthoritative restore or rebuild
Nonauthoritative recovery or rebuild uses healthy partner data. Declaring the entire old forest authoritative can overwrite valid changes; Recycle Bin restores objects; BurFlags is a legacy FRS mechanism.
Open this question’s page →444. A deleted subtree replicated everywhere and Recycle Bin cannot recover it. A valid backup contains it. What sequence fits targeted authoritative recovery?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Restore the backup in DSRM, mark the subtree authoritative, then restart normally
Marking the restored subtree before normal replication makes it win. Premature restart can reapply deletion; live database copying is unsupported; SYSVOL does not contain the AD user database.
Open this question’s page →445. An operator knows a domain admin password but cannot sign in locally for DSRM recovery. What credential should be obtained?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- The DC local DSRM Administrator password
DSRM uses that DC's separate local recovery Administrator credential. It is not guaranteed to match the domain Administrator password. A domain user's cached password and another server's local credential do not authenticate this recovery account.
Open this question’s page →446. For a supported AD database restore, select two preparations.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answers
- Use a valid suitable system-state backup and check its age
- Know the DSRM credential and intended restore scope
A suitable backup/age and recovery credentials/scope support restoration. Checkpoints are not a universal backup strategy; AD DS Stopped is distinct from DSRM; indiscriminate authority can overwrite legitimate changes.
Open this question’s page →447. One DC has damaged SYSVOL, while a verified partner has correct files. Which synchronization direction fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Nonauthoritative synchronization of the damaged DC
Nonauthoritative synchronization takes the good partner copy. Making damaged content authoritative propagates it; a user restore does not recover policy files; SYSVOL recovery is protected from ordinary DFS-R group editing.
Open this question’s page →448. During the documented nonauthoritative SYSVOL procedure, msDFSR-Enabled was set FALSE and polled. Which event is expected?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- 4114
4114 is expected after disabling the SYSVOL subscription. 4602 confirms authoritative initialization, while 4614 and 4604 belong to the later nonauthoritative initialization sequence.
Open this question’s page →449. An operator proposes D4 BurFlags to recover DFS-R SYSVOL on Server 2025. What should be used instead?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- The documented msDFSR subscription-attribute and service sequence
DFS-R uses its specific subscription-attribute procedure. BurFlags is FRS-specific. AD GPO metadata restoration does not automatically restore corresponding SYSVOL files, and namespace priority does not repair replicated policy content.
Open this question’s page →450. Before a domain-wide authoritative SYSVOL recovery, select two requirements.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answers
- Coordinate all affected DCs using the documented ordering
- Verify the selected authoritative content is correct
A verified source and coordinated ordering seed a consistent domain copy. AD and SYSVOL replication differ; multiple conflicting authorities are inappropriate; AD object recovery does not automatically restore policy files.
Open this question’s page →451. A newly created user exists on one DC but not another. Which subsystem should be investigated first?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- AD replication between the relevant DCs
Different directory state on DCs suggests replication divergence. Screening, volume encryption and SMB compression do not propagate AD user objects.
Open this question’s page →452. An operator needs inbound partner and naming-context details for a failing DC. Which command fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- repadmin /showrepl
showrepl provides detailed inbound partner and naming-context status. replsummary is a broader summary. Time-source and client discovery commands supply different infrastructure evidence rather than the requested detailed replication partner report.
Open this question’s page →453. A DC has been offline beyond the forest tombstone lifetime and replication safeguards activate. What is appropriate?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Evaluate a supported stale-DC/lingering-object recovery or rebuild
A long-stale DC can reintroduce obsolete data and needs a supported recovery decision. Forced sync and ping do not resolve that risk; namespace caching is unrelated to AD database age.
Open this question’s page →454. For an AD replication failure, select two useful evidence sets.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answers
- DNS, RPC/network and authentication/time evidence
- Failing source, destination, naming context and last-success/error data
Partner/context status and infrastructure/security evidence isolate AD replication failures. Cached sign-in can bypass current DC reachability, DFS-R concerns SYSVOL rather than directory-object replication, and role ownership alone does not establish replication health.
Open this question’s page →455. Users in one branch cannot find a DC, while other sites work. Which investigation is most focused?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Branch DNS, routes and site/DC discovery
A site-scoped discovery failure points to branch infrastructure and DC selection. Whole-domain restore is not justified; IOPS and display names do not locate the branch DC.
Open this question’s page →456. A client needs a test of domain-controller discovery. Which command fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- nltest /dsgetdc:contoso.com
nltest dsgetdc tests suitable DC discovery. Replication summary examines DC replication, klist lists tickets, and Get-ADUser queries objects after a management connection; none is this focused client discovery command.
Open this question’s page →457. One service account repeatedly locks out immediately after its password changes. What should be investigated?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- A service or scheduled task still using the old stored password
A stale stored credential explains repeated attempts immediately after a password change. Unlocking does not update that credential, longer lockout does not remove the cause, and a display-name change does not change the stored secret.
Open this question’s page →458. For a reported AD access failure, select two useful distinctions.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answers
- Whether resource share/file authorization then permits the operation
- Whether DC discovery and authentication succeeded
Separating discovery/authentication from resource authorization identifies the failing step. Local admin and cached logons do not prove live domain health; policy failures need scoped diagnosis before database recovery.
Open this question’s page →459. A service ticket request reports KDC_ERR_PRINCIPAL_NOT_UNIQUE. What should be investigated?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Duplicate or ambiguous SPN registrations
The non-unique principal error points to ambiguous registrations. Ticket expiry and time skew cause different failures; a completely missing principal instead aligns with a principal-unknown error.
Open this question’s page →460. An administrator must register a reviewed SPN while checking for duplicates. Which command form fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- setspn -S <SPN> <account>
-S adds after duplicate verification. -A lacks that preferred check; ticket purging does not register SPNs; replication summary reports AD replication rather than modifying service identity.
Open this question’s page →461. SMB by the real server name works, but a new alias fails after NTLM blocking. Which check is most relevant?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Alias DNS and the appropriate cifs SPN on the intended account
The alias needs correct resolution and Kerberos service identity. Ping proves neither ticket issuance nor SPN ownership; shrinking and forecast status do not configure the alias authentication path.
Open this question’s page →462. For a Kerberos second-hop failure, select two useful checks.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answers
- The backend service SPN and actual service identity
- The supported delegation configuration and account restrictions
Service identity and constrained delegation/account policy govern backend access. First-hop success is insufficient; purging does not correct directory registrations; Kerberos time requirements remain despite DNS success.
Open this question’s page →463. A domain member was restored from an old snapshot and reports a trust failure. Which relationship may be mismatched?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Its local machine secret and AD computer account password
Netlogon trust depends on the member machine secret matching its AD computer account password. User sign-in credentials, share authorization, and DNS caching are separate relationships and do not define that machine-account secret match.
Open this question’s page →464. A reachable domain member needs a secure-channel test against DC01. Which command fits?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Test-ComputerSecureChannel -Server DC01 -Verbose
The cmdlet tests the member channel against the selected DC. SMB handles, deleted-object restoration and forecasts do not test its Netlogon relationship.
Open this question’s page →465. Test-ComputerSecureChannel reports a failure when run on a domain controller. What is the appropriate interpretation?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- The cmdlet is not valid for DC diagnosis; use documented DC tools
The reference limits this cmdlet to domain members and warns of false errors on DCs. It does not conclusively diagnose forest trusts, guarantee a DC repair, or prove failure of all member authentication.
Open this question’s page →466. Before repairing a member secure channel, select two checks.
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answers
- Compare results against appropriate DCs and investigate replication inconsistencies
- Verify domain DNS/DC reachability and time
Infrastructure and DC consistency distinguish reachability/replication from a machine-secret mismatch. A reset cannot be assumed propagated through broken replication. Guest-local administration does not establish AD update rights, and interforest trusts are different relationships.
Open this question’s page →467. You extend an on-premises AD DS domain into Azure with two Windows Server domain controllers. You must preserve AD database writes and provide domain DNS to Azure members. Which two design choices meet these requirements? Select two answers.
AD DS · AD DS | Deploy and manage AD DS domain controllers · Virtual machines · Virtual machines | Manage Windows Server VMs in Azure · Networking · Networking | Implement on-premises and hybrid name resolution
✓ Correct answers
- Use stable private IP assignments on the Azure NICs and configure members to use the domain DNS servers
- Place the AD database, logs and SYSVOL on a persistent data disk with host caching set to None
The AD DS Azure architecture uses persistent data disks with None host caching and stable private NIC addresses. Domain members need DNS that can locate AD service records. Temporary disks can lose data; public resolvers do not host the private AD zone; public IPs are unnecessary for private domain replication.
Open this question’s page →468. A branch has an RODC, ordinary domain users and domain-member computers, and an unreliable WAN link. Users need domain sign-in during outages while privileged administrator credentials remain outside the branch cache. Which design is appropriate?
AD DS · AD DS | Deploy and manage AD DS domain controllers · Security · Security | Secure AD DS
✓ Correct answer
- Allow and prepopulate the approved branch user and computer credentials through password replication policy, while retaining privileged-account denial
Approved user and computer credentials must be available for the intended outage authentication path, with privileged accounts kept denied. User-only preparation can leave the computer authentication path unavailable. Broad directory replication rights can undermine the caching policy; local group membership does not supply uncached domain secrets.
Open this question’s page →469. Forest A contains employee accounts; Forest B hosts a Windows file server. A trust is configured so B trusts A, with selective authentication. An A user has been added through approved group nesting to a B resource group that has share and NTFS access, but authentication to the server is still denied. What is the missing trust-specific authorization?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments · AD DS | Create and manage AD DS security principals · Storage and file services · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- Allowed to authenticate permission for the approved A principal on the B file-server computer object
Selective authentication requires Allowed to authenticate on the target computer in addition to existing share and NTFS access. A reverse trust supports the opposite access direction; granting the same resource ACL again does not pass the authentication gate; a DNS alias does not grant that right.
Open this question’s page →470. A supported service runs on three domain-member servers and accesses a domain file share. You need one automatically maintained service identity without manually distributing a password. Which two prerequisites belong in the gMSA design? Select two answers.
AD DS · AD DS | Create and manage AD DS security principals · Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment · Security · Security | Secure AD DS
✓ Correct answers
- An approved set of hosts authorized to retrieve the gMSA password, plus resource permissions for that identity
- A KDS root key that has completed the documented production convergence period
The KDS root key supports managed password generation, and authorized hosts must be permitted to retrieve the gMSA password. The service identity still needs access to the share. Local accounts create manual lifecycle work; an sMSA is tied to one host; allowing all computers weakens the requested scope.
Open this question’s page →471. After a new branch subnet is added, clients obtain correct DHCP addresses but frequently select a distant domain controller. The WAN is congested and branch DCs are healthy. What should you correct before changing replication schedules?
AD DS · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments · Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- Create or correct the AD DS subnet object and associate it with the branch site
AD subnet-to-site mapping helps clients locate an appropriate site and its domain controllers. DHCP lease duration does not establish AD site membership. Schema-master location does not direct routine client authentication. Public DNS alone cannot supply the domain locator records.
Open this question’s page →472. A GPO change appears in GPMC on both domain controllers, but clients using one DC receive old script files from SYSVOL. The environment uses DFS Replication for SYSVOL. Which diagnosis best fits the two parts of the evidence?
AD DS · AD DS | Manage Windows Server by using domain-based Group Policies · AD DS | Configure and manage multi-site, multi-domain, and multi-forest environments · Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- The AD portion may have replicated while the SYSVOL file portion has a DFSR problem that needs separate investigation
GPO metadata in AD and files in SYSVOL use separate replication mechanisms. Investigate DFSR content and events on the affected DC even if GPMC metadata is current. They are not one atomic transaction, clients can use different DCs, and faster client refresh does not repair a stale server-side file replica.
Open this question’s page →473. An Arc-enabled Windows server shows Connected in Azure. A policy initiative must inspect an in-guest security setting and report compliance. A separate team wants performance counters in Azure Monitor. Which statement correctly separates the two collection mechanisms?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment · Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Machine Configuration handles supported guest configuration assessment; Azure Monitor Agent and an associated DCR handle the chosen telemetry collection
Guest configuration assessment and telemetry collection have separate assignments and destinations. Arc connection alone is not evidence that either workload has been configured. A telemetry DCR does not by itself apply arbitrary configuration, and Machine Configuration does not replace AMA performance collection.
Open this question’s page →474. A JEA endpoint must allow a support group to invoke two approved commands that read a remote domain file share. The users must not receive a general administrative shell. Which two design choices fit? Select two answers.
Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment · AD DS · AD DS | Create and manage AD DS security principals · Security · Security | Secure AD DS
✓ Correct answers
- Expose only the required commands through a reviewed role capability and map the support group to that JEA role
- Use an appropriately authorized domain network identity, such as a supported gMSA endpoint identity, for the remote-resource access
Reviewed role capabilities restrict the exposed commands; an authorized gMSA can provide the required domain network identity. A virtual account does not automatically forward the connecting user credentials. Arbitrary external commands undermine the restricted endpoint, and permission to an unrestricted endpoint does not create a two-command boundary.
Open this question’s page →475. Azure Update Manager assesses an Arc server successfully but offers none of a newly approved update that administrators expect. The server is configured to use an internal WSUS service. Which investigation is most appropriate?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment · Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Check the server's effective update-source policy and whether the update is synchronized, applicable and approved in that WSUS path
Update Manager uses the configured Windows update source, so WSUS synchronization, approval targeting and applicability still matter. Changing the Arc resource region does not replace the guest source. A longer maintenance window cannot change package applicability or approval, and an unchanged repeated assessment does not correct the source configuration.
Open this question’s page →476. A Windows Arc Hybrid Runbook Worker can access local files under its configured Windows execution identity. An Automation account system-assigned managed identity is enabled. The runbook uses the documented managed-identity Azure login and is denied access to a storage resource, although the Arc machine identity has a role there. What should you check?
Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- The Automation account system-assigned identity's Azure permissions, because that enabled identity takes precedence in this documented authentication path
The enabled Automation account system-assigned identity takes precedence over the Arc worker identity in the stated documented managed-identity path and needs appropriate Azure permissions. Local NTFS rights govern local files, not Azure resources. The Arc role alone is insufficient for the selected principal, and schedule recreation does not select a different identity.
Open this question’s page →477. A business service needs automatic recovery from a single Hyper-V host failure at its primary site and an asynchronous copy at another site for disaster recovery. Which design matches both needs?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- A validated failover cluster for local VM availability plus Hyper-V Replica for the separate disaster-recovery copy
A validated failover cluster provides automatic local VM recovery, while Hyper-V Replica provides the asynchronous DR copy. Replica alone is not synchronous automatic local HA. Co-located checkpoints do not protect against storage loss, and a manual-failover-only design does not meet automatic primary-site recovery.
Open this question’s page →478. A supported Windows guest is running on your local Hyper-V host. A wrong VLAN setting prevents all guest network traffic, but you have Hyper-V administrator rights and valid guest credentials. Which management path can help repair the guest without first restoring its network?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM · Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- PowerShell Direct from the local Hyper-V host into the supported guest
PowerShell Direct uses the host-to-guest channel and does not depend on guest networking or configured WinRM. Normal network remoting and RDP need the network path. An unrelated Bastion deployment cannot reach the local VM without a supported route.
Open this question’s page →479. A data VHDX on a Hyper-V SCSI controller has been expanded. Windows inside the guest still shows the original data-volume size and now displays adjacent unallocated space. Which next operation completes the intended capacity change?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM · Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- Extend the appropriate guest partition and volume into the newly available space
VHDX expansion increases disk capacity, but the guest partition and supported filesystem must also extend into the adjacent space. Optimize-VHD compacts eligible files; another virtual-disk expansion still leaves old partition boundaries; a checkpoint does not extend the guest volume.
Open this question’s page →480. A Windows Server 2025 Datacenter Hyper-V cluster must share GPU capacity among VMs and live-migrate them. Which proposal should pass the initial capability review?
Virtual machines · Virtual machines | Manage Hyper-V and guest VM
✓ Correct answer
- Use supported GPU partitioning hardware and drivers with compatible partition settings and the documented homogeneous cluster requirements
Server 2025 GPU-P live migration requires supported GPUs/drivers, homogeneous partition configuration and suitable IOMMU DMA bit-tracking hardware. DDA assigns whole devices without this live-migration behavior. Unrelated GPU configurations are unsupported, and omitting the CPU/IOMMU prerequisite cannot establish live migration.
Open this question’s page →481. A stateless Windows web service needs more VM instances during demand peaks and must tolerate loss of one supported Azure availability zone. Which two elements belong in the design? Select two answers.
Virtual machines · Virtual machines | Manage Windows Server VMs in Azure
✓ Correct answers
- Instances distributed across supported availability zones, with application and traffic-routing dependencies designed for that failure
- A suitable VM scale set configuration with an autoscale policy and a tested application health path
Autoscale provides additional instances, while supported multi-zone placement and resilient traffic/application dependencies address zone loss. An availability set does not clone a VM across zones. Vertical resizing does not supply horizontal instances, and autoscale within one failed zone does not establish zone resilience.
Open this question’s page →482. On-premises clients reach an Azure Files private endpoint through a VPN, but the storage hostname resolves to its public address. The private DNS zone is linked to an Azure VNet. What should you add to the hybrid DNS design?
Networking · Networking | Implement on-premises and hybrid name resolution · Storage and file services · Storage and file services | Configure and manage Azure Files
✓ Correct answer
- Forward the appropriate Azure service namespace from on-premises DNS to a resolver path that can resolve the linked private zone, such as an Azure DNS Private Resolver inbound endpoint
A hybrid resolver path must connect on-premises queries to the Azure private-zone view. The Azure platform resolver address is not directly reachable as a general on-premises resolver. Hosts-file entries create manual lifecycle work. SMB authorization is independent of DNS resolution.
Open this question’s page →483. After a DHCP DNS-option change, domain-member servers can resolve internet names but fail domain-controller discovery. Their configured DNS servers are now public resolvers. Which correction addresses the cause?
Networking · Networking | Implement on-premises and hybrid name resolution · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- Restore domain DNS servers on the members and let those servers forward external queries as appropriate
Restore DNS servers that can resolve the AD zone and SRV locator records; domain DNS can forward external queries. Lease duration and reservations do not fix public-only DNS selection, and DNSSEC signing of a public zone does not publish private AD records.
Open this question’s page →484. A security requirement asks Windows clients to reject unvalidated responses for a signed internal DNS namespace. Another requirement asks for confidentiality of traffic between two Windows servers. Which statement correctly separates the controls?
Networking · Networking | Implement on-premises and hybrid name resolution · Security · Security | Secure Windows Server operating system
✓ Correct answer
- Use DNSSEC validation policy for the signed namespace; use a suitable encrypted transport such as configured IPsec for server-traffic confidentiality
DNSSEC validates DNS data authenticity and integrity when the chain and policy are correctly configured. It does not encrypt application traffic. IPsec encryption is a separate traffic control; an ordinary firewall allow rule does not validate DNSSEC signatures, and a DNS trust anchor does not create IPsec associations.
Open this question’s page →485. Two Windows DHCP servers have a healthy IPv4 failover relationship. An administrator changes a scope option and adds reservations on one partner. The change must be made consistent on the other partner without recreating the relationship. What should the administrator do?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- Replicate the failover scope configuration using the supported replication operation and verify the partner's settings
Failover configuration replication is the supported operation for scope properties, options and reservations. Lease synchronization is not a substitute for that explicit configuration workflow. Overlapping independent scopes risk conflicting leases; a shared-secret change does not replicate the intended settings.
Open this question’s page →486. A readdressed branch printer should receive a reserved address, but it obtains a dynamic address from the old subnet. The reservation's client identifier matches the printer. A relay serves the branch. Which evidence should you check next?
Networking · Networking | Manage IP addressing in on-premises and hybrid scenarios
✓ Correct answer
- The relay's interface information and the matching DHCP scope used for that request
Check relay GIADDR and any option 82 link-selection suboption, and identify the matching allocation scope. A correct client identifier in a different scope cannot override wrong subnet selection. Lease duration does not choose the subnet; option 003 is supplied after allocation, not used as the relay selector; free capacity in the new scope does not prove that requests select it.
Open this question’s page →487. A branch must keep familiar local SMB access and frequently used files on its Windows file server while moving the authoritative synchronized file set to Azure Files. Remote users will separately use a supported SMB-over-QUIC server. Which design satisfies the branch caching requirement?
Storage and file services · Storage and file services | Configure and manage Azure Files · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- Deploy Azure File Sync with an NTFS server endpoint, an Azure file-share cloud endpoint and appropriately chosen cloud-tiering policies
Azure File Sync supplies the NTFS server endpoint, cloud endpoint and cache policies. QUIC changes transport, not synchronization. Direct mounts do not make clients server endpoints, and client Offline Files is not the required server-side File Sync architecture.
Open this question’s page →488. A company uses DFS Namespaces and DFS Replication for branch data. It plans to replace DFSR data replication with Azure File Sync while retaining the user-facing namespace. Which two cutover principles are appropriate? Select two answers.
Storage and file services · Storage and file services | Configure and manage Azure Files · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answers
- Complete the initial upload from the first member with tiering disabled, then follow the documented DFSR disablement and additional File Sync endpoint sequence
- Retain or update DFS namespace referrals to the intended SMB targets while treating namespace routing separately from data synchronization
DFS Namespaces can retain the user path through suitable SMB targets. The documented migration begins with the complete initial upload without tiering, then coordinates DFSR disablement before adding the remaining endpoints. Controlled initial staging must not become indefinite competing replication. Replacing the namespace fails the preserved-path requirement, and enabling tiering prematurely does not establish placeholder compatibility.
Open this question’s page →489. An AD DS-authenticated user connects to an Azure SMB share using ordinary identity-based roles. The user has Storage File Data SMB Share Contributor at the share, but the target folder ACL grants the user read access only. The user can read but cannot create a file. What is the appropriate correction?
Storage and file services · Storage and file services | Configure and manage Azure Files · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- Grant the required write permission through the folder/file ACL after confirming the existing share-level assignment
Contributor already passes the share write gate; the target folder needs appropriate file-side write permission. Reader would further restrict access. The working read path is not evidence for recreating the private endpoint, and changes outside the target ACL/inheritance scope do not grant its write access.
Open this question’s page →490. Two sites need a disaster-recovery copy of a supported data volume, including writes inside open files. Tests show the WAN cannot meet the documented synchronous-replication latency requirement, and the business accepts some data loss after a site failure. Which technology and mode best match?
Storage and file services · Storage and file services | Configure Windows Server storage · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- Asynchronous Storage Replica in a supported topology, with monitored replication lag and a tested recovery plan
Storage Replica replicates volume blocks and its asynchronous mode is appropriate when the supported synchronous latency requirement cannot be met and the RPO permits lag. Synchronous mode would affect the write path. DFSR is file replication with open-file limitations; namespace referrals do not replicate data.
Open this question’s page →491. A Windows Server data volume must enforce FSRM quotas and file screening. A proposal chooses ReFS solely for integrity features. Which selection best satisfies the stated application requirement?
Storage and file services · Storage and file services | Configure Windows Server storage · Storage and file services | Configure and manage Windows Server file shares
✓ Correct answer
- Use NTFS for this FSRM-managed volume and evaluate integrity/resilience requirements within a supported storage design
FSRM requires NTFS for its folder quotas and file screens. ReFS integrity features do not add FSRM support. Per-user quotas are a different control and are not a ReFS workaround; enabling deduplication does not change FSRM filesystem support.
Open this question’s page →492. Several VM disks on a supported cluster have Storage QoS minimums configured. Monitoring shows the physical storage is saturated and reports insufficient throughput for a policy. What conclusion should guide the response?
Storage and file services · Storage and file services | Configure Windows Server storage · Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- QoS cannot create missing physical capacity; investigate contention and capacity, then tune policy allocations and workload placement
QoS distributes available performance and reports when storage cannot meet requested minima. Investigate physical contention/capacity and tune allocation or placement. A minimum cannot guarantee nonexistent capacity; raising every minimum or changing policy scope does not create more backend IOPS.
Open this question’s page →493. An administrator unlocks a recovered BitLocker-protected NTFS volume with the correct recovery password. An EFS-encrypted file still cannot be opened under the administrator account. Which additional recovery material is needed?
Storage and file services · Storage and file services | Configure Windows Server storage
✓ Correct answer
- The file owner's applicable EFS private key or a designated EFS recovery-agent private key
EFS file decryption requires the applicable owner or recovery-agent private key. BitLocker protectors unlock the volume and do not supply EFS private keys. A public certificate alone cannot decrypt the file key; taking ownership or changing ACLs does not supply decryption material.
Open this question’s page →494. A Windows Server 2025 member server receives an OSConfig security baseline. An existing GPO continually sets one of the same settings to a conflicting value, and compliance drifts repeatedly. What is the best management response?
Security · Security | Secure Windows Server operating system
✓ Correct answer
- Resolve the conflicting configuration sources: establish one intended value and remove the conflicting writer or use a supported aligned override
OSConfig drift control and a conflicting GPO can repeatedly write different values. Establish a consistent intended value and remove the conflicting source or apply a supported customization coherently. A one-time application does not neutralize other writers; a DC scenario does not match a member server; repeated reapplication leaves the underlying conflict.
Open this question’s page →495. Windows LAPS stores encrypted local-administrator passwords in AD DS. A delegated team can read the password attribute but cannot decrypt its value. What must the administrator review while preserving least privilege?
Security · Security | Secure Windows Server operating system · Security | Secure AD DS
✓ Correct answer
- Both the attribute-read delegation and the configured authorization to decrypt the encrypted password
Encrypted AD-backed LAPS separates permission to read the stored attribute from permission to decrypt its value. Review both delegations with least privilege. Read-only attribute access does not itself authorize decryption; local workstation administrators are not automatically authorized decryptors; password age changes do not grant decryption rights.
Open this question’s page →496. A security plan proposes enabling Credential Guard on every domain controller and adding service accounts to Protected Users to secure unattended services. Which assessment is correct?
Security · Security | Secure Windows Server operating system · Security | Secure AD DS
✓ Correct answer
- Revise the plan: Credential Guard is not recommended for domain controllers, and Protected Users is designed for suitable user accounts rather than service/computer accounts
Credential Guard is not recommended on DCs and does not protect the AD database. Protected Users should not contain service or computer accounts and restricts NTLM and other authentication behaviors for suitable users. These controls do not have identical scope; permitting NTLM fallback is incorrect; correcting the server target alone does not correct the service-account design.
Open this question’s page →497. Entra Password Protection is deployed on all writable domain controllers, which already hold a valid cached policy. During a temporary cloud connectivity outage, a user changes a domain password through a DC. Which behavior should the design expect?
Security · Security | Secure AD DS
✓ Correct answer
- The DC can evaluate the password against its cached protection policy in addition to applicable AD password policy
The DC agent evaluates the password locally using its valid cached protection policy, alongside normal AD password policy. It does not send plaintext passwords for live approval. Cloud loss does not disable all AD checks or invalidate an already available cached policy.
Open this question’s page →498. Two domain-member servers must communicate with authenticated and encrypted IPsec traffic on a specific application port. Connection security rules negotiate successfully, but the application remains blocked by Windows Firewall. What should you check next?
Security · Security | Secure Windows Server operating system · Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- The effective inbound/outbound firewall traffic rules for the application port and profiles, in addition to the IPsec requirements
IPsec connection security rules negotiate authentication/encryption, while firewall traffic rules still authorize the application port and profile. Successful negotiation does not open every port. Encryption is not inherently incompatible with filtering, and another connection security rule does not substitute for the required traffic allowance.
Open this question’s page →499. A non-Azure server appears as an Arc resource. Defender for Servers is enabled for the intended scope, but the security team sees no expected endpoint-protection evidence. What is the most appropriate next verification?
Security · Security | Secure Windows Server operating system · Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Verify the applicable plan, Defender for Endpoint integration/onboarding, required extensions and service connectivity instead of treating Arc registration as protection proof
Arc registration and a plan switch do not prove endpoint sensor onboarding or reporting. Verify the applicable plan integrations, required extensions and service connectivity. Connected status addresses Arc management; plan selection alone is incomplete; control-plane Activity Log alone does not establish endpoint-protection telemetry.
Open this question’s page →500. An Azure Windows VM responds slowly during workload peaks. Guest CPU utilization is modest, but storage latency rises while throughput approaches the VM size's disk limits. Which investigation is most useful before buying a faster disk tier?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Correlate guest disk latency/queue data with both disk-level and VM-level throughput/IOPS limits and workload demand
Storage performance can be capped by disk provisioning and VM aggregate limits, so correlate guest latency/queue with platform throughput/IOPS and demand. Low CPU does not rule out I/O pressure; a disk SKU alone omits VM caps; caching changes need workload and cache-path evidence and do not automatically remove all limits.
Open this question’s page →501. An Arc server is connected, and AMA is installed. A custom Windows performance-counter DCR exists in the subscription, but the server has no association to it and no expected samples arrive. What should be corrected first?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services · Hybrid server management · Hybrid server management | Manage Windows Server instances and workloads by using Azure services in a hybrid environment
✓ Correct answer
- Associate the intended DCR with the server and verify its data source, destination and agent connectivity
AMA needs the intended DCR associated with the machine before that rule supplies sources and destinations. A duplicate unassociated definition, a new interval on an unused rule or a different query table does not fix the missing resource association. After association, validate collection and the appropriate table.
Open this question’s page →502. An Azure Monitor alert shows Fired at the expected threshold, but its intended email receiver receives nothing. Which investigation isolates the notification stage?
Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services
✓ Correct answer
- Inspect the associated action group, receiver configuration, delivery/test results and applicable alert processing rules
Fired establishes that the detection condition ran; investigate the associated action group, receiver/delivery evidence, mailbox filtering and action suppression. Raising the threshold does not fix delivery. An unassociated replacement group cannot change this alert actions, and testing notification delivery need not wait for resolution.
Open this question’s page →503. A domain controller is being recovered from a valid system-state backup. The domain uses DFSR for SYSVOL. A recovery plan proposes applying FRS BurFlags after restoring the AD database in DSRM. Which correction is required?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Use the documented DFSR SYSVOL authoritative or nonauthoritative recovery procedure appropriate to the recovery plan; database restoration and SYSVOL synchronization must both be addressed
DFSR SYSVOL uses its documented authoritative/nonauthoritative synchronization procedure and does not use FRS BurFlags. AD database restoration does not establish SYSVOL readiness, and copying files alone does not verify DFSR initialization or the resulting SYSVOL/NETLOGON shares.
Open this question’s page →504. Members in several domains show increasing clock skew and Kerberos failures. The forest-root PDC emulator is configured to use an unreliable external source. Which design correction addresses the hierarchy?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Windows Server issues · AD DS · AD DS | Deploy and manage AD DS domain controllers
✓ Correct answer
- Configure the forest-root PDC emulator with a reliable external time source and verify that the rest of the domain hierarchy uses the intended domain synchronization path
The forest-root PDC emulator should use a reliable source, with downstream domain synchronization verified. Random independent sources can disagree; schema-master movement does not set time authority; a one-time member resync can recur against the unchanged unreliable source.
Open this question’s page →505. A Windows member server, not a domain controller, reports that its trust relationship failed after a restore. DNS and connectivity to a writable DC are working. Which next step is appropriate with authorized credentials?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory
✓ Correct answer
- Test and, if needed, repair the member server's secure channel using the supported member-server command and verify domain authentication
On a member server, the supported secure-channel test/repair can address the computer-account password mismatch after restore; verify actual domain authentication afterward. User password resets and ticket purges do not reconcile the machine secret, and Test-ComputerSecureChannel is not valid for DC secure-channel diagnosis.
Open this question’s page →506. Users access a service by its DNS name, and Kerberos fails after the service identity is changed. The same service SPN is present on both the old and new accounts. What should be corrected?
Monitoring and troubleshooting · Monitoring and troubleshooting | Troubleshoot Active Directory · Monitoring and troubleshooting | Troubleshoot Windows Server issues
✓ Correct answer
- Identify the duplicate SPN and register the intended service SPN uniquely on the correct account, then retest with appropriate tickets
The requested SPN must identify the correct account uniquely so the service can receive a ticket for its key. More duplicates increase ambiguity; IP access can alter Kerberos behavior; purging the cache without correcting SPN ownership leaves the cause for future requests.
Open this question’s page →Sources and content
Permission is granted to use, copy, modify, and redistribute the original flashcards, questions, explanations, and handoff files in StudyByteLearn and elsewhere, including commercial use. Linked Microsoft documentation retains its existing terms; this permission does not grant rights to Microsoft trademarks or third-party materials. · Updated 2026-10-20
Created by Codex with parallel domain-authoring agents from Microsoft Learn documentation and the official AZ-802 study guide, checked on 2026-10-20. Each item received author inspection and independent AI content review against supporting documentation, including answer keys, versions, prerequisites, ambiguity, and explanations. Review evidence and source manifests accompany the pack. No live server commands were executed. Structural/import validation does not by itself establish accuracy.