Configuring Windows Server Hybrid Advanced Services Exam (AZ-800) - Microsoft

In the AZ-800 “Administering Windows Server Hybrid Core Infrastructure” objectives for Active Directory, server promotion is governed by forest/domain administrative roles. The materials state that promoting a member server to a domain controller in a given domain requires membership in either the Enterprise Admins group or the Domain Admins group of the target domain. The Configuration and Domain naming contexts that DCPromo touches (NTDS settings, SYSVOL/DFS-R readiness, DC computer account, and associated service SPNs) are protected so that “Enterprise Admins have full rights forest-wide, and Domain Admins have full rights within their respective domain.” In this case, the requirement is to promote Server1 to a domain controller in canada.contoso.com.<br />
<br />
From the identities table:<br />
Contoso\Admin1 is a member of Enterprise Admins (forest-wide authority). Canada\Admin3 is a member of Canada\Domain Admins (authority within canada.contoso.com). Contoso\Admin2 is Domain Admins (contoso.com) only, which does not grant administrative authority in the canada.contoso.com child domain. Therefore, the users who can currently perform the required task for Server1 are Admin1 and Admin3.

The AZ-800 content covering Active Directory Sites and Services clarifies that site, subnet, and site- link objects live in the Configuration partition. The guides emphasize that administration of the Configuration naming context is restricted to Enterprise Admins and to Domain Admins of the forest- root domain. In the context of changing replication topology parameters—such as editing the replication schedule on site links—the documentation notes: “Only Enterprise Admins or administrators in the forest-root Domain Admins group have default permissions to modify site and site-link objects,” because these objects affect replication forest-wide.<br />
<br />
Applying this to the scenario: Contoso\Admin1 (Enterprise Admins) has forest-wide rights to modify site links. Contoso\Admin2 (Domain Admins in contoso.com, the forest-root domain) also has the required rights to change site-link schedules. Canada\Admin3 (Domain Admins in canada.contoso.com) does not have default permissions in the Configuration partition for forest-wide site-link administration. Thus, to meet the technical requirement to change all site links to a 30-minute schedule, the users<br />
<br />
who can perform the task are Admin1 and Admin2.

In the Windows Server exam materials for Administering Windows Server Hybrid Core Infrastructure (AZ-800), Microsoft documents that Data Deduplication is supported only on data volumes and specifically on NTFS-formatted volumes, and it cannot be enabled on the system or boot volume. The study text states: “Data Deduplication is applied at the volume level and supports NTFS data volumes. You cannot enable deduplication on the system or boot volume.” It further clarifies unsupported targets: “ReFS volumes and FAT/exFAT volumes are not supported for Data Deduplication in general-purpose server scenarios,” and emphasizes that deduplication is “not available for the operating system volume.”<br />
<br />
Applying these rules to VM3: C: NTFS but it is the OS/system volume → not eligible. D: NTFS data volume → eligible. E: ReFS → not supported for general-purpose dedup in this context. F: exFAT → not supported. Therefore, the only volume on which you can enable Data Deduplication to meet the requirement is volume D.

<img src="https://examsqa.com/storage/question-images/configuring-windows-server-hybrid-advanced-services-exam-az-800_page_10_Im10.jpg" alt="Exhibit" style="max-width: 100%; height: auto;" /><br />
<br />
<img src="https://examsqa.com/storage/question-images/configuring-windows-server-hybrid-advanced-services-exam-az-800_page_10_Im11.jpg" alt="Exhibit" style="max-width: 100%; height: auto;" /><br />
<br />
In the Windows Server Hybrid Core Infrastructure objectives for Active Directory group design, group scope and type determine valid membership and usage. The study guidance for group scopes states that a Domain Local group is used to assign permissions in its own domain and “can contain accounts, computer objects, global groups from any domain, and universal groups; it can also contain other domain local groups from the same domain only.” Security-type restrictions also apply: “Security groups can contain only security principals; distribution groups cannot be nested into security groups for access control.” ⇒ Applying these rules to Group3 (contoso.com Domain Local Security): it can accept security groups of compatible scopes. From the lists, Group1 (contoso.com Universal Security) and Group2 (contoso.com Global Security) are valid. Distribution groups (Group4, Group5, Group6) are not valid members of a security group used for authorization. Therefore, Group3 Group1 and Group2 only.<br />
For Group5 (canada.contoso.com Global Distribution), the scope rule for Global groups is: “Global<br />
groups can include user accounts and other global groups from the same domain only; they cannot include universal or domain local groups.” Hence, the only eligible group from the same domain and scope is Group4 (canada.contoso.com Global Distribution). Group6 is domain local (invalid), and cross-domain globals (Group2) are not permitted. Therefore, Group5 Group4 only. ⇒