StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Hybrid server management · Hybrid server management | Configure remote management for Windows Server instances in a hybrid environment · AD DS · AD DS | Create and manage AD DS security principals · Security · Security | Secure AD DS

Practice question 474 of 506 · hard

A JEA endpoint must allow a support group to invoke two approved commands that read a remote domain file share. The users must not receive a general administrative shell. Which two design choices fit? Select two answers.

Select all that apply. Every correct option and no extras are required for credit in the app.

  1. A.Allow general external commands in the role capability so support users can retrieve files through any executable
  2. B.Expose only the required commands through a reviewed role capability and map the support group to that JEA role
  3. C.Use a local virtual account and assume it always sends the connecting user's credentials on every network hop
  4. D.Use the default PowerShell endpoint with remote-management permission and assume that permission creates a two-command restriction
  5. E.Use an appropriately authorized domain network identity, such as a supported gMSA endpoint identity, for the remote-resource access
Show the answer and explanation

✓ Correct answers

  • Expose only the required commands through a reviewed role capability and map the support group to that JEA role
  • Use an appropriately authorized domain network identity, such as a supported gMSA endpoint identity, for the remote-resource access

Reviewed role capabilities restrict the exposed commands; an authorized gMSA can provide the required domain network identity. A virtual account does not automatically forward the connecting user credentials. Arbitrary external commands undermine the restricted endpoint, and permission to an unrestricted endpoint does not create a two-command boundary.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.