These are real questions from the guide, with the full explanation for every option. The guide has 245.
A question, exactly as it appears in the guide
Not a preview. This is question 1.14 with its full explanation, so you can judge the depth before paying.
Q 1.14 · Deploy and manage AD DSdifficulty 3 / 5
DC-EMEA02 holds the RID master role for emea.contoso.com. Its motherboard has failed and a replacement part is two days away; the server will be repaired and returned to service. Account creation across emea.contoso.com is unaffected so far. What should you do?
ASeize the RID master role onto DC-EMEA01 immediately, using ntdsutil to perform the move.
BRun Uninstall-ADDSDomainController -ForceRemoval so the role reassigns itself.
CSeize the role onto DC-EMEA01 and transfer it back once DC-EMEA02 is repaired.
DWait. Existing RID pools cover account creation, and it resumes the role on return.
DCorrect. Domain controllers continue to consume any outstanding RID pools already issued to them, so account creation is not blocked. DC-EMEA02 never loses the role either: when a domain controller that has been acting as a role holder starts to run again it waits until it has received inbound replication for its naming context, and if it is still the current holder it resumes typical operations. Microsoft reserves seizure for a holder that is not coming back.
AIncorrect. Microsoft recommends seizing only when the current role holder cannot be brought back into service, and seizing the RID master burns RIDs: when you use ntdsutil with the roles category commands it increases the next RID pool by 10,000.
BIncorrect. A force removal does not reassign roles gracefully; the force-demote command can leave operations master roles in an invalid state until an administrator reassigns them.
CIncorrect. After a seizure Microsoft's guidance is to rebuild the former holder from scratch or force-demote it and clean up its metadata, and specifically not to restore it from backup, because a restore rebuilds it as a role holder again.
Tests
Manage and troubleshoot FSMO roles: choosing between transfer, seizure and doing nothing
Not a preview. This is question 4.21 with its full explanation, so you can judge the depth before paying.
Q 4.21 · Implement and manage an on-premises and hybrid networking infrastructuredifficulty 3 / 5
Contoso's Sydney branch has a local DHCP server, DHCP-SYD1, that serves the branch clients over the branch LAN. DHCP01 sits in the head office datacenter, on the other side of a slow and occasionally unreliable WAN link. Contoso wants DHCP01 to serve the Sydney clients only while DHCP-SYD1 is unavailable, and never otherwise. Which failover configuration meets the requirement?
AA load balance relationship with the ratio set to 90 percent on DHCP-SYD1 and 10 percent on DHCP01.
BA hot standby relationship in which DHCP01 is the active server and DHCP-SYD1 is the standby.
CA hot standby relationship in which DHCP-SYD1 is the active server and DHCP01 is the standby.
DA split scope, with DHCP-SYD1 holding 80 percent of the range and DHCP01 holding 20 percent through exclusions.
CCorrect. In hot standby mode the active server is responsible for leasing addresses to all clients in the scope and the partner assumes a standby role, issuing leases only if the active server becomes unavailable. Microsoft describes this exact deployment: a central office or datacenter server acting as the standby backup for a local DHCP server at a remote site that directly serves the clients.
AIncorrect. Load balance mode has both servers simultaneously serving addresses to clients on the subnet, so one client in ten would still be served across the WAN in normal operation. Load balance mode is best suited to deployments where both servers are located at the same physical site.
BIncorrect. Wrong way round. That would make every Sydney lease request cross the slow WAN in normal operation, with the local server idle, which is the opposite of the requirement.
DIncorrect. Wrong for this requirement. Split scope keeps two independent scopes with no shared lease state, so DHCP01 would answer Sydney clients whenever it happened to respond first, and neither server would know about the other's leases. Microsoft positions split scope as the answer for DHCPv6, which cannot be failover-enabled.
Tests
Implement high availability for DHCP: choosing between hot standby and load balance mode
Contoso is deploying an Azure file share to hold FSLogix profile containers. The session hosts are Microsoft Entra joined virtual machines with no network path to any domain controller. The users are hybrid identities synchronised from the on-premises domain contoso.com. Which identity source should you enable on the storage account?
ANo identity source; mount the share with the storage account key and control access with Windows ACLs.
BMicrosoft Entra Domain Services.
CMicrosoft Entra Kerberos.
DOn-premises Active Directory Domain Services (AD DS).
CCorrect. Microsoft Entra Kerberos is documented as the best fit for cloud-first or mixed environments, Microsoft Entra joined clients and FSLogix profiles, and it is the one identity source where clients do not need domain-controller connectivity for authentication. Microsoft Entra ID issues the Kerberos ticket.
AIncorrect. Mounting with the storage account key is effectively an administrator operation that grants full access to every file and directory regardless of ACLs, and it authenticates with NTLMv2 rather than Kerberos. Microsoft recommends identity-based authentication instead.
BIncorrect. Kerberos authentication against a Microsoft Entra Domain Services managed domain requires the client to be joined to that managed domain and to be able to reach its domain controllers. These hosts are Microsoft Entra joined, not domain joined, and have no domain-controller connectivity.
DIncorrect. AD DS authentication requires the clients to have unimpeded network connectivity to a domain controller so they can obtain a Kerberos ticket. These session hosts have none.
Tests
Manage permissions for Azure file shares: choosing among the three identity sources
Not a preview. This is question 6.22 with its full explanation, so you can judge the depth before paying.
Q 6.22 · Secure Windows Server infrastructuredifficulty 3 / 5
SRV-WEB01 is a web front end in contoso.com. It must access a back-end service on SRV-APP03 in the trusted forest fabrikam.local, impersonating the user who signed in to the website. The Fabrikam administrators are willing to allow this but are not willing to hand out rights in their domain to Contoso staff. What do you configure, and where?
AHave the Fabrikam administrators set the Trusted-to-Authenticate-for-Delegation bit on the SRV-APP03 computer account so that protocol transition is permitted.
BUnconstrained delegation on SRV-WEB01, which is the only form that crosses a forest boundary.
CClassic Kerberos constrained delegation on the SRV-WEB01 computer account in contoso.com, listing the back-end service.
DResource-based constrained delegation, set by the Fabrikam administrators on the SRV-APP03 account using the PrincipalsAllowedToDelegateToAccount parameter.
DCorrect. Resource-based constrained delegation lets you delegate when the front-end service and the resource service are not in the same domain, and it shifts the decision from the delegating-from domain administrator to the resource owner. The service administrator configures it by specifying the domain accounts of the front-end services that can impersonate users, on the account object of the resource service, using Set-ADComputer, Set-ADServiceAccount or Set-ADUser with PrincipalsAllowedToDelegateToAccount. The cross-forest case is documented separately: Microsoft's comparison of the options for making the second hop lists resource-based Kerberos constrained delegation as working "across domains and forests" (https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/ps-remoting-second-hop).
AIncorrect. Resource-based constrained delegation cannot use the Trusted-to-Authenticate-for-Delegation bit that previously controlled protocol transition. The KDC always allows protocol transition when performing resource-based constrained delegation, as though the bit were set, which is why the two well-known SIDs S-1-18-1 and S-1-18-2 exist for the resource owner to tell how the client authenticated.
BIncorrect. Wrong, and it is the option the whole feature exists to avoid. Unconstrained delegation lets the front end act for the user against any service anywhere, which is the attack surface constrained delegation was designed to close — and Credential Guard, on by default from Windows Server 2025 on domain-joined member servers, breaks applications that require it.
CIncorrect. Wrong for a cross-domain scenario. Classic constrained delegation requires domain admin privileges to configure a domain account for a service and restricts the account to a single domain — which is precisely the limitation resource-based constrained delegation was introduced to remove. The same comparison page states of classic constrained delegation that it is "Limited to one domain" and "Can't cross domains or forests" (https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/ps-remoting-second-hop).
Tests
Manage AD delegation: resource-based constrained delegation across domains
Not a preview. This is question 7.06 with its full explanation, so you can judge the depth before paying.
Q 7.06 · Monitor and troubleshoot Windows Server environmentsdifficulty 3 / 5
You are onboarding SRV-DB03, an on-premises Windows Server 2025 machine, to Azure Arc. The azcmagent connect command is run from an elevated session with a service principal that has valid, unexpired credentials, and no Arc-enabled server of that name exists yet. The command fails and the output ends with AZCM0026. What should you investigate?
AWhether the Hybrid Instance Metadata Service is running on the machine, and whether the command was run from an elevated shell.
BWhether the service principal's client ID and secret are correct and unexpired, and whether it belongs to the right tenant.
CWhether the required endpoints are reachable, and whether a Private Link Scope resource ID has to be supplied for onboarding.
DWhether an Azure Arc-enabled server of the same name already exists, so that the connect attempt collides with it.
CCorrect. AZCM0026 is documented as an error in network configuration, or some critical services being temporarily unavailable. The suggested remediation is to check whether the required endpoints are reachable - hostnames resolvable, endpoints not blocked - and, if the network is configured for Private Link Scope, to supply a Private Link Scope resource ID using the --private-link-scope parameter.
AIncorrect. Wrong code, and the stem excludes the elevation half. A non-responsive agent service is AZCM0061 and its relatives, remediated by running the command elevated and ensuring HIMDS is running; a stopped Azure Arc proxy service is AZCM0004.
BIncorrect. Wrong code, and the stem excludes it. Invalid credentials are AZCM0041, whose remediation is to check the client ID and secret for correctness and a valid expiration date, and to confirm the service principal is from the same tenant where the server resource will be created.
DIncorrect. Wrong code, and the stem excludes it. A duplicate name is AZCM0044, whose remediation is to specify a different name for the --resource-name parameter or to delete the existing Azure Arc-enabled server in Azure and try again.
Tests
Troubleshoot VM and Azure Arc extension issues: reading an azcmagent onboarding error code and acting on the right one