StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · AD DS · AD DS | Create and manage AD DS security principals · Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment · Security · Security | Secure AD DS

Practice question 470 of 506 · hard

A supported service runs on three domain-member servers and accesses a domain file share. You need one automatically maintained service identity without manually distributing a password. Which two prerequisites belong in the gMSA design? Select two answers.

Select all that apply. Every correct option and no extras are required for credit in the app.

  1. A.An approved set of hosts authorized to retrieve the gMSA password, plus resource permissions for that identity
  2. B.One separately managed local account on each server with identical manual passwords
  3. C.Permission for every domain computer to retrieve the password to eliminate host authorization checks
  4. D.A standalone managed service account assigned concurrently to every server
  5. E.A KDS root key that has completed the documented production convergence period
Show the answer and explanation

✓ Correct answers

  • An approved set of hosts authorized to retrieve the gMSA password, plus resource permissions for that identity
  • A KDS root key that has completed the documented production convergence period

The KDS root key supports managed password generation, and authorized hosts must be permitted to retrieve the gMSA password. The service identity still needs access to the share. Local accounts create manual lifecycle work; an sMSA is tied to one host; allowing all computers weakens the requested scope.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.