DRAG DROP (Drag and Drop is not supported)Your network contains an Active Directory domain named contoso.com. The domain contains group managed service accounts (gMSAs). You have a server named Server1 that runs Windows Server and is in a workgroup. Server1 hosts Windows containers.You need to ensure that the Windows containers can authenticate to contoso.com.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Answer(s): A
Step 1: In contoso.com, generate a Key Distribution Services (KDS) Root Key One-time preparation of Active Directory. If you have not already created a gMSA in your domain, you'll need to generate the Key Distribution Service (KDS) root key. The KDS is responsible for creating, rotating, and releasing the gMSA password to authorized hosts. When a container host needs to use the gMSA to run a container, it will contact the KDS to retrieve the current password.Step 2: On Server, run New-CredentialSpec Create a credential spec. A credential spec file is a JSON document that contains metadata about the gMSA account(s) you want a container to use. By keeping the identity configuration separate from the container image, you can change which gMSA the container uses by simply swapping the credential spec file, no code changes are necessary.Run the following cmdlet to create the new credential spec file:# Replace 'WebApp01' with your own gMSA New-CredentialSpec -AccountName WebApp01By default, the cmdlet will create a credential spec using the provided gMSA name as the computer account for the container. The file will be saved in the Docker CredentialSpecs directory using the gMSA domain and account name for the filename.Step 3: On Server1, install and run ccg.exe. View the diagram below to follow the steps of the Container Credential Guard process:1. Using a CredSpec file as input, the ccg.exe process is started on the node host.-2. ccg.exe uses information in the CredSpec file to launch a plug-in and then retrieve the account credentials in the secret store associated with the plug-in.3. ccg.exe uses the retrieved account credentials to retrieve the gMSA password from AD.4. ccg.exe makes the gMSA password available to a container that has requested credentials.5. The container authenticates to the domain controller using the gMSA password to get a Kerberos Ticket--Granting Ticket (TGT).-6. Applications running as Network Service or Local System in the container can now authenticate and access domain resources, such as the gMSA.Incorrect: * In contoso.com, create a gMSA and a standard user account.Note: gMSA architecture and improvements To address the limitations of the initial implementation of gMSA for Windows containers, new gMSA support for non-domain-joined container hosts uses a portable user identity instead of a host computer account to retrieve gMSA credentials. Therefore, manually joining Windows worker nodes to a domain is no longer necessary, although it's still supported. The user identity/credentials are stored in a secret store accessible to the container host (for example, as a Kubernetes secret) where authenticated users can retrieve it.gMSA support for non-domain-joined container hosts provides the flexibility of creating containers with gMSA without joining the host node to the domain. Starting in Windows Server 2019, ccg.exe is supported which enables a plug-in mechanism to retrieve gMSA credentials from Active Directory. You can use that identity to start the container.
https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts
Your on-premises network contains an Active Directory domain named contoso.com. You have a Microsoft Entra tenant.You plan to sync contoso.com with the Microsoft Entra tenant by using Microsoft Entra Connect cloud sync.You need to create an account that will be used by Microsoft Entra Connect cloud sync.Which type of account should you create?
Answer(s): B
Migrate to Microsoft Entra Connect cloud sync for an existing synced AD forestInstall the Microsoft Entra Connect provisioning agent1. In the Azure portal, select Microsoft Entra ID. 2. On the left, select Microsoft Entra Connect. 3. On the left, select Cloud sync.* Details omitted* 11. On the Configure Service Account screen, select a group Managed Service Account (gMSA). This account is used to run the agent service. If a managed service account is already configured in your domain, you might skip this screen. If prompted, choose either:Create gMSA which lets the agent create the provAgentgMSA$ managed service account for you. The group managed service account (for example, CONTOSO\provAgentgMSA$) will be created in the same Active Directory domain where the host server has joined. To use this option, enter the Active Directory domain administrator credentials.Use custom gMSA and provide the name of the managed service account.
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/tutorial-pilot-aadc-aadccp
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the domain controllers shown in the following table.You need to ensure that if an attacker compromises the computer account of RODC1, the attacker cannot view the Employee-Number AD DS attribute.Which partition should you modify?
Answer(s): D
Schema Master FSMO Role The Schema Master role manages the read-write copy of your Active Directory schema. The AD Schema defines all the attributes – things like employee ID, phone number, email address, and login name – that you can apply to an object in your AD database.
https://www.varonis.com/blog/fsmo-roles
HOTSPOT (Drag and Drop is not supported)Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with a Microsoft Entra tenant. The tenant contains a group named Group1 and the users shown in the following table.Domain/OU filtering in Microsoft Entra Connect is configured as shown in the Filtering exhibit. (Click the Filtering tab.)You review the Microsoft Entra Connect configurations as shown in the Configure exhibit. (Click the Configure tab.)For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: Yes User1 can use self-service password reset (SSPR) to reset his password.User1 is in OU1. Users and OU1 are synced. Password writeback is enabled.Note: Enable Azure Active Directory self-service password reset writeback to an on-premises environment Password writeback can be used to synchronize password changes in Azure AD back to your on-premises AD DS environment. Azure AD Connect provides a secure mechanism to send these password changes back to an existing on-premises directory from Azure AD.Box 2: Yes Password hash synchronization is disabled. Pass-through authentication is enabledAzure Active Directory (Azure AD) Pass-through Authentication allows your users to sign in to both on-premises and cloud-based applications by using the same passwords. Pass-through Authentication signs users in by validating their passwords directly against on-premises Active Directory.Box 3: Yes User2 is in OU2. Ou2 is not synched. However, users are synced.
https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-pta-quick-start https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-sync-configure-filtering
HOTSPOT (Drag and Drop is not supported)Your on-premises network contains an Active Directory Domain Services (AD DS) domain.You plan to sync the domain with a Microsoft Entra tenant by using Microsoft Entra Cloud sync.You need to meet the following requirements:-Install the software required to sync the domain to the Microsoft Entra tenant.-Enable password hash synchronization.What should you install, and what should you use to enable password hash synchronization? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Entra Connect Sync Implement password hash synchronization with Microsoft Entra Connect SyncWhen you install Microsoft Entra Connect Syncby using the Express Settings option, password hash synchronization is automatically enabled.Box 2: Azure Portal Express installation of Microsoft Entra Connect Sync 1. Sign in as Local Administrator on the server you want to install Microsoft Entra Connect Syncon.The server you sign in on will be the sync server.2. Go to AzureADConnect.msi and double-click to open the installation file.3. In Welcome, select the checkbox to agree to the licensing terms, and then select Continue.4. In Express settings, select Use express settings
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-password-hash-synchronization https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-install-express
HOTSPOT (Drag and Drop is not supported)Your network contains two Active Directory Domain Services (AD DS) forests as shown in the following exhibit.The forests contain the domain controllers shown in the following table.You perform the following actions on DC1:-Create a user named User1.-Extend the schema with a new attribute named Attribute1.To which domain controllers are User1 and Attribute1 replicated? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: DC3 and DC4. User1:DC2- No. DC2 is in the same domain as DC1, but DC2 is not Schema Master or Global Catalog. DC3- Yes. DC3 is Global Catalog. DC4 - Yes. DC4 is Global Catalog and Schema Master.Note: Schema Master FSMO Role The Schema Master role manages the read-write copy of your Active Directory schema. The AD Schema defines all the attributes – things like employee ID, phone number, email address, and login name – that you can apply to an object in your AD database.The global catalog is a feature of Active Directory (AD) that allows a domain controller (DC) to provide information on any object in the forest, regardless of whether the object is a member of its domain. Domain controllers with the global catalog feature enabled are referred to as global catalog servers.Box 2: DC4 only. Attribute1 DC2- No. DC2 is in the same domain as DC1, but DC2 is not Schema Master or Global Catalog. DC3- No. DC3 is Global Catalog, but not Schema Master. DC4 - Yes. DC4 is Global Catalog and Schema Master.
https://www.varonis.com/blog/fsmo-roles https://blog.netwrix.com/2021/11/30/what-is-a-global-catalog-server/
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the resources shown in the following table.You plan to replicate a volume from Server1 to Server2 by using Storage Replica.You need to configure Storage Replica.Where should you install Windows Admin Center?
Windows Admin Center requirements To use Storage Replica and Windows Admin Center together, you need the following:Note: Storage Replica is Windows Server technology that enables replication of volumes between servers or clusters for disaster recovery. It also enables you to create stretch failover clusters that span two sites, with all nodes staying in sync.
https://learn.microsoft.com/en-us/windows-server/storage/storage-replica/server-to-server-storage-replication
You have an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with Microsoft Entra tenant by using Microsoft Entra Connect sync.You enable password protection for contoso.com.You need to prevent users from including the word contoso as part of their password.What should you use?
Share your comments for Microsoft AZ-800 exam with other users:
i would give 5 stars to this website as i studied for az-800 exam from here. it has all the relevant material available for preparation. i got 890/1000 on the test.
Keeping this site free takes real effort. We constantly battle automated scraping and unauthorized content copying. A quick account helps us protect the community and keep the site free.
To continue studying for your AZ-800, please sign in or create a free account.