StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · AD DS · AD DS | Deploy and manage AD DS domain controllers · Security · Security | Secure AD DS

Practice question 468 of 506 · hard

A branch has an RODC, ordinary domain users and domain-member computers, and an unreliable WAN link. Users need domain sign-in during outages while privileged administrator credentials remain outside the branch cache. Which design is appropriate?

Choose the single best answer.

  1. A.Allow and prepopulate the approved branch user and computer credentials through password replication policy, while retaining privileged-account denial
  2. B.Grant Replicating Directory Changes All to the RODC account and rely only on the local allow list
  3. C.Allow the branch users in password replication policy but leave their computer credentials uncached and assume user passwords alone establish the whole offline domain sign-in path
  4. D.Configure a local user group on the RODC and assume its membership supplies uncached domain password verification while the WAN is down
Show the answer and explanation

✓ Correct answer

  • Allow and prepopulate the approved branch user and computer credentials through password replication policy, while retaining privileged-account denial

Approved user and computer credentials must be available for the intended outage authentication path, with privileged accounts kept denied. User-only preparation can leave the computer authentication path unavailable. Broad directory replication rights can undermine the caching policy; local group membership does not supply uncached domain secrets.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.