StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Security · Security | Secure Windows Server operating system · Security | Secure AD DS

Practice question 496 of 506 · hard

A security plan proposes enabling Credential Guard on every domain controller and adding service accounts to Protected Users to secure unattended services. Which assessment is correct?

Choose the single best answer.

  1. A.Accept the plan because both controls have identical support and authentication behavior on all account and server types
  2. B.Enable Credential Guard only on member servers, but keep unattended service accounts in Protected Users and assume the account restrictions become harmless
  3. C.Accept the plan because Protected Users ensures every service can fall back to NTLM when Kerberos is unavailable
  4. D.Revise the plan: Credential Guard is not recommended for domain controllers, and Protected Users is designed for suitable user accounts rather than service/computer accounts
Show the answer and explanation

✓ Correct answer

  • Revise the plan: Credential Guard is not recommended for domain controllers, and Protected Users is designed for suitable user accounts rather than service/computer accounts

Credential Guard is not recommended on DCs and does not protect the AD database. Protected Users should not contain service or computer accounts and restricts NTLM and other authentication behaviors for suitable users. These controls do not have identical scope; permitting NTLM fallback is incorrect; correcting the server target alone does not correct the service-account design.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.