Question 1

SIMULATION - (Topic 4)
Task2
You need to ensure that the Azure file share named share1 can sync to on-premises servers.
The required source files are located in a folder named \dc1.contoso.com\install. You do NOT need to specify the on-premises servers at this time.

Accepted Answer

One possible solution to ensure that the Azure file share named share1 can sync to on- premises servers is to use Azure File Sync. Azure File Sync allows you to
centralize your file shares in Azure Files without giving up the flexibility, performance, and compatibility of an on-premises file server. It does this by transforming
your Windows Servers into a quick cache of your Azure file share. You can use any protocol available on Windows Server to access your data locally (including
SMB, NFS, and FTPS) and you can have as many caches as you need across the world1.
Here are the steps to configure Azure File Sync for the Azure file share named share1 and the source files located in a folder named \dc1.contoso.com\install:
? On the Azure portal, create a Storage Sync Service in the same region as your storage account that contains the Azure file share named share1. For more
information on how to create a Storage Sync Service, see How to deploy Azure File Sync.
? On the on-premises server that hosts the folder named \dc1.contoso.com\install, install the Azure File Sync agent. For more information on how to install the
Azure File Sync agent, see Install the Azure File Sync agent.
? On the on-premises server, register the server with the Storage Sync Service that you created in the first step. For more information on how to register a server
with a Storage Sync Service, see Register/unregister a server with Storage Sync Service.
? On the Azure portal, create a sync group that defines the sync topology for a set of files. In the sync group, select the Azure file share named share1 as the cloud
endpoint and the folder named \dc1.contoso.com\install as the server endpoint.
For more information on how to create a sync group, see Create a sync group and
a cloud endpoint and Create a server endpoint.
? Wait for the initial sync to complete. You can monitor the sync progress on the Azure portal or on the on-premises server. For more information on how to
monitor sync progress, see [Monitor sync progress].
Once the initial sync is complete, you can add more on-premises servers to the same sync group to sync and cache the content locally. You can also enable cloud
tiering to optimize the storage space on the on-premises servers by tiering infrequently accessed or older files to Azure Files.

Question 2

SIMULATION - (Topic 4)
Task 10
You need to configure Hyper-V to ensure that running virtual machines can be moved between SRV1 and SRV2 without downtime.
You do NOT need to move any virtual machines at this time.

Accepted Answer

One possible solution to configure Hyper-V to ensure that running virtual machines can be moved between SRV1 and SRV2 without
downtime is to use Live Migration. Live Migration is a feature of Hyper-V that allows you to move a running virtual machine from one host to another without any
noticeable interruption of service. To set up Live Migration between SRV1 and SRV2, you need to perform the following steps:
? On both SRV1 and SRV2, open Hyper-V Manager from the Administrative
Tools menu or by typing virtmgmt.msc in the Run box.
? In the left pane, right-click on the name of the server and select Hyper-V Settings.
? In the Hyper-V Settings dialog box, select Live Migrations in the navigation pane.
? Check the box Enable incoming and outgoing live migrations.
? Under Authentication protocol, select the method that you want to use to authenticate the live migration traffic between the servers. You can choose either
Kerberos or CredSSP. Kerberos does not require you to sign in to the source server before starting a live migration, but it requires you to configure
constrained delegation on the domain controller. CredSSP does not require you to configure constrained delegation, but it requires you to sign in to the source
server through a local console session, a Remote Desktop session, or a remote Windows PowerShell session. For more information on how to configure
constrained delegation, see Configure constrained delegation.
? Under Performance options, select the option that best suits your network configuration and performance requirements. You can choose either TCP/IP or
Compression or SMB. TCP/IP uses a single TCP connection for the live migration traffic. Compression uses multiple TCP connections and compresses the live
migration traffic to reduce the migration time and network bandwidth usage. SMB uses the Server Message Block (SMB) 3.0 protocol and can leverage SMB
features such as SMB Multichannel and SMB Direct. For more information on how to choose the best performance option, see Choose a live migration
performance option.
? Under Advanced Features, you can optionally enable the Use any available network for live migration option, which allows Hyper-V to use any available network
adapter on the source and destination servers for live migration. If you do not enable this option, you need to specify one or more network adapters to be used for
live migration by clicking on the Add button and selecting the network adapter from the list. You can also change the order of preference by using the Move Up and
Move Down buttons.
? Click OK to apply the settings.
Now, you have configured Hyper-V to enable live migration between SRV1 and SRV2. You can use Hyper-V Manager or Windows PowerShell to initiate a live
migration of a running virtual machine from one server to another.

Question 3

SIMULATION - (Topic 4)
Task 7
You need to monitor the security configuration of DC1 by using Microsoft Defender for Cloud.
The required source files are located in a folder named \dc1.contoso.com\install.

Accepted Answer

One possible solution to monitor the security configuration of DC1 by using Microsoft Defender for Cloud is to use the Guest Configuration feature. Guest
Configuration is a service that audits settings inside Linux and Windows virtual machines (VMs) to assess their compliance with your organization’s security
policies. You can use Guest Configuration to monitor the security baseline settings for Windows Server in the Microsoft Defender for Cloud portal by following
these steps:
? On DC1, open a web browser and go to the folder named \dc1.contoso.com\install.
Download the Guest Configuration extension file (GuestConfiguration.msi) and save it to a local folder, such as C:\Temp.
? Run the Guest Configuration extension file and follow the installation wizard. You
can choose to install the extension for all users or
only for the current user. For more information on how to install the Guest Configuration extension, see Install the Guest Configuration extension.
? After the installation is complete, sign in to the Microsoft Defender for Cloud portal (2).
? In the left pane, select Security Center and then Recommendations.
? In the recommendations list, find and select Vulnerabilities in security configuration on your Windows machines should be remediated (powered by Guest
Configuration).
? In the Remediate Security Configurations page, you can see the compliance status of your Windows VMs, including DC1, based on the Azure Compute
Benchmark.
The Azure Compute Benchmark is a set of rules that define the desired configuration state of your VMs. You can also see the number of failed, passed, and
skipped rules for each VM. For more information on the Azure Compute Benchmark, see Microsoft cloud security benchmark: Azure compute benchmark is now
available.
? To view the details of the security configuration of DC1, click on the VM name and then select View details. You can see the list of rules that apply to DC1 and
their compliance status. You can also see the severity, description, and remediation steps for each rule. For example, you can see if DC1 has the latest security
updates installed, if the firewall is enabled, if the password policy is enforced, and so on.
? To monitor the security configuration of DC1 over time, you can use the Compliance over time chart, which shows the trend of compliance status for DC1 in the
past 30 days. You can also use the Compliance breakdown chart, which shows the distribution of compliance status for DC1 by rule severity.
By using Guest Configuration, you can monitor the security configuration of DC1 by using Microsoft Defender for Cloud and ensure that it meets your
organization’s security standards. You can also use Guest Configuration to monitor the security configuration of other Windows and Linux VMs in your Azure
environment.

Question 4

SIMULATION - (Topic 4)
Task 1
You need to prevent domain users from saving executable files in a share named
\SRVl\Data. The users must be able to save other files to the share.

Accepted Answer

One possible solution to prevent domain users from saving executable files in a share named \SRVl\Data is to use file screening on the file server. File screening
allows you to block certain files from being saved based on their file name extension. Here are the steps to configure file screening:
? On the file server, open File Server Resource Manager from the Administrative Tools menu.
? In the left pane, expand File Screening Management and click on File Groups.
? Right-click on File Groups and select Create File Group.
? In the File Group Properties dialog box, enter a name for the file group, such as Executable Files.
? In the Files to include box, enter the file name extensions that you want to block, such as .exe, .bat, .cmd, .com, .msi, .scr. You can use wildcards to specify
multiple extensions, such as *.exe.
? Click OK to create the file group.
? In the left pane, click on File Screen Templates.
? Right-click on File Screen Templates and select Create File Screen Template.
? In the File Screen Template Properties dialog box, enter a name for the template,
such as Block Executable Files.
? On the Settings tab, select the option Active screening: Do not allow users to save unauthorized files.
? On the File Groups tab, check the box next to the file group that you created, such as Executable Files.
? On the Notification tab, you can configure how to notify users and administrators when a file screening event occurs, such as sending an email, logging an event,
or running a command or script. You can also customize the message that users see when they try to save a blocked file.
? Click OK to create the file screen template.
? In the left pane, click on File Screens.
? Right-click on File Screens and select Create File Screen.
? In the Create File Screen dialog box, enter the path of the folder that you want to apply the file screening to, such as \SRVl\Data.
? Select the option Derive properties from this file screen template (recommended) and choose the template that you created, such as Block Executable Files.
? Click Create to create the file screen.
Now, domain users will not be able to save executable files in the share named
\SRVl\Data. They will be able to save other files to the share.

Question 5

SIMULATION - (Topic 4)
Task 11
You need to ensure that all DHCP clients that get an IP address from SRV1 will be configured to use DC1 as a DNS server.

Accepted Answer

One possible solution to ensure that all DHCP clients that get an IP address from SRV1 will be configured to use DC1 as a DNS server is to use the DHCP scope
options. DHCP scope options are settings that apply to all DHCP clients that obtain an IP address from a specific scope. You can use the DHCP scope options to
specify the DNS server IP address, as well as other parameters such as the default gateway, the domain name, and the DNS suffix. Here are the steps to
configure the DHCP scope options on SRV1:
? On SRV1, open DNS Manager from the Administrative Tools menu or by
typing dnsmgmt.msc in the Run box.

(140 New Questions)
? In the left pane, expand your DHCP server and click on IPv4.
? In the right pane, right-click on the scope that you want to configure and select Properties.
? In the Scope Properties dialog box, click on the DNS tab.
? Check the box Enable DNS dynamic updates according to the settings below. This option allows the DHCP server to register and update the DNS records for the
DHCP clients.
? Select the option Always dynamically update DNS records. This option ensures that the DHCP server updates both the A and PTR records for the DHCP clients,
regardless of whether they request or support dynamic updates.
? Check the box Discard A and PTR records when lease is deleted. This option
allows the DHCP server to delete the DNS records for the DHCP clients when their leases expire or are released.
? Check the box Dynamically update DNS records for DHCP clients that do not
request updates. This option allows the DHCP server to update the DNS records for the DHCP clients that do not support dynamic updates, such as legacy or nonWindows clients.
? In the DNS servers section, click on the Add button to add a new DNS server IP address.
? In the Add Server dialog box, enter the IP address of DC1, which is the DNS server that you want to use for the DHCP clients, and click Add.
? Click OK to close the Add Server dialog box and return to the Scope Properties dialog box.
? Click OK to apply the changes and close the Scope Properties dialog box.
Now, all DHCP clients that get an IP address from SRV1 will be configured to use DC1 as a DNS server. You can verify the DNS configuration by using the
ipconfig /all command on a DHCP client computer and checking the DNS Servers entry. You can also check the DNS records for the DHCP clients by using the
DNS Manager console on DC1.

Question 6

SIMULATION - (Topic 4)
Task 5
You need to ensure that a DHCP scope named scope! on SRV1 can service client requests.

Accepted Answer

One possible solution to ensure that a DHCP scope named scope1 on SRV1 can service client requests is to activate the scope on the DHCP server. A scope
must be activated before it can assign IP addresses to DHCP clients. To activate a DHCP scope on SRV1, perform the following steps:
? On SRV1, open DNS Manager from the Administrative Tools menu or by
typing dnsmgmt.msc in the Run box.
? In the left pane, expand your DHCP server and click on IPv4.
? In the right pane, right-click on the scope that you want to activate, such as scope1, and select Activate.
? Wait for the scope to be activated. You can verify the activation status by checking the icon next to the scope name. A green arrow indicates that the scope is
active, while a red arrow indicates that the scope is inactive.
Now, the DHCP scope named scope1 on SRV1 can service client requests and lease IP addresses to DHCP clients. You can test the DHCP service by using the
ipconfig
/renew command on a DHCP client computer that is connected to the same subnet as the scope.

Question 7

SIMULATION - (Topic 4)
Task 6
You need to ensure that you can manage DC1 by using Windows Admin Center on SRV1. The required source files are located in a folder named
\dc1.contoso.com\install.

Accepted Answer

One possible solution to ensure that you can manage DC1 by using Windows Admin Center on SRV1 is to install Windows Admin Center on SRV1 and add DC1 as a managed server. Windows Admin Center is a web-based management tool that allows you to manage servers, clusters, Windows PCs, and Azure virtual machines (VMs) from a single interface. Here are the steps to install Windows Admin Center on SRV1 and add DC1 as a managed server: ? On SRV1, open a web browser and go to the folder named \dc1.contoso.com\install. Download the Windows Admin Center installer file (WindowsAdminCenter.msi) and save it to a local folder, such as C:\Temp. ? Run the Windows Admin Center installer file and follow the installation wizard. You can choose to install Windows Admin Center as a desktop app or as a service. For more information on how to install Windows Admin Center, see Install Windows Admin Center. ? After the installation is complete, launch Windows Admin Center from the Start menu or the desktop shortcut. If you installed Windows Admin Center as a service, you can access it from a web browser by using the URL https://localhost:6516 or https://:6516, where is the name or IP address of SRV1. ? On the Windows Admin Center dashboard, click Add to add a new connection. Select Server as the connection type and enter the name or IP address of DC1 in the Server name field. Optionally, you can specify the display name, description, and tags for the connection. Click Submit to add DC1 as a managed server. ? On the Windows Admin Center dashboard, you should see DC1 listed under the Servers section. Click on DC1 to open the server overview page. From here, you can manage various aspects of DC1, such as roles and features, certificates, devices, events, files, firewall, processes, registry, services, and more. For more information on how to use Windows Admin Center to manage servers, see Manage servers with Windows Admin Center. Now, you can manage DC1 by using Windows Admin Center on SRV1. You can also add more servers or other types of connections to Windows Admin Center and manage them from the same interface

Question 8

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a DNS server named Server1. Server1

(140 New Questions)
hosts a DNS zone named fabrikam.com that was signed by DNSSEC.
You need to ensure that all the member servers in the domain perform DNSSEC validation for the fabrikam.com namespace.
What should you do?

Accepted Answer

Correct answer: C

Question 9

HOTSPOT - (Topic 3)
Your on-premises network contains an Active Directory Domain Services (AD DS) domain.
The domain contains the servers shown in the following table.
The domain controllers do NOT have internet connectivity.
You plan to implement Azure AD Password Protection for the domain.
You need to deploy Azure AD Password Protection agents. The solution must meet the following requirements:
• All Azure AD Password Protection policies must be enforced.
• Agent updates must be applied automatically.
• Administrative effort must be minimized.
What should you do? To answer select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Accepted Answer

Correct answer: A

Question 10

HOTSPOT - (Topic 3)
You have an Active Directory Domain Services (AD DS) domain that contains a group named Group1.
You need to create a group managed service account (gMSA) named Account1. The solution must ensure that Group1 can use Account1.
How should you complete the script? To answer, select the appropriate options in the answer area,
NOTE: Each correct selection is worth one point.

Accepted Answer

Correct answer: A