n the Administering Windows Server Hybrid Core Infrastructure guidance for managing AD DS, Microsoft emphasizes using OU-level delegation to satisfy administrative needs while adhering to the principle of least privilege. The documentation explains that the Delegate Control wizard on an OU lets you grant a user or group only the specific permissions required for common tasks, including “Modify the membership of a group”. This grants the write permission to the member attribute on group objects contained in that OU, without giving broader account-management rights across the domain.

By contrast, placing a user in Account Operators or Server Operators provides elevated, domain-wide capabilities far beyond what is required. Account Operators can create, delete, and modify many account types across the domain (except for protected admin accounts), which violates least-privilege for a task that only needs to change group membership in one OU. Server Operators is unrelated to group membership and is intended for server administration tasks. Creating a delegation at the domain root would similarly be excessive because it applies broadly to all containers and OUs.

Therefore, to meet the requirement “Ensure that User1 can manage the membership of all the groups in Contoso\OU3,” you should delegate control on OU3 and assign the built-in task “Modify the membership of a group” to User1, achieving the minimal permissions necessary.

The Administering Windows Server Hybrid Core Infrastru cture materials explain that BranchCache reduces WAN utilization by caching content that clients request from a remote content server. There are two modes : Hosted Cache and Distributed Cache . Hosted Cache “requires a server in the branch office configured as a hosted cache server,” while Distributed Cache “uses a peer-to-peer cache among Windows clients and does not require any servers in the branch .” For SMB shares, the content server (the file server at the main site) must have the “BranchCache for Networ k Files” role service installed so that it can advertise hashes and support BranchCache for file content. Client computers in the branch are then configured to Enable BranchCache in Distributed Cache mode so they can cache and retrieve content from each ot her, minimizing repeated downloads across the WAN.

In this scenario, Montreal has no servers , so Hosted Cache is not suitable. Installing BranchCache for Network Files on Server1 (the Boston file server hosting \\Server1\Apps ) and enabling Distributed Cach e on the 20 Windows 10 clients in Montreal meets the requirement to reduce WAN saturation during the LOB app deployment and subsequent updates while requiring no additional branch infrastructure .

Group1 : Apply group policy and Read

Domain Computers : Read only

In Windows Server Hybrid Core Infrastructure, the application of Group Policy Objects (GPOs) is controlled through security filtering. When you link a GPO to a domain or OU, it applies to all users and computers in that container by default because the Authenticated Users group is granted Read and Apply group policy permissions.

To meet the requirement that GPO1 applies only to users in Group1 , you must first rem ove " Authenticated Users " from the security filter. To ensure the GPO actually applies to the target users, Group1 must be granted both Read and Apply group policy permissions. This allows the client-side extension (CSE) to read the policy settings and apply them to the user session.

Crucially, following security updates released by Microsoft (MS16-072), user-targeted GPOs are retrieved using the computer ' s security context rather than the user ' s. This change was implemented to prevent " man-in-the-middle " attacks. Therefore, for a user GPO to be processed, the computer from which the user is logging in must have Read access to the GPO. To adhere to the principle of least privilege , the Domain Computers group should be granted Read only access. Granting " A pply group policy " to Domain Computers is unnecessary and violates least privilege because the GPO only contains user settings and should not be processed in the computer ' s context beyond the initial retrieval.

The Administering Windows Server Hybrid Core Infrastructure materials describe the Backup Operators built-in group as follows: “In a domain, Backup Operators is a built-in domain local group on domain controllers; members can back up and restore files on the domain controllers in that domain.” The guide contrasts this with member servers: “Member servers and clients have their own local Backup Operators group; membership and user rights there are local and separate from the domain controller’s group.” Because User1 is created in contoso.com and added to the built-in Backup Operators in that domain , the granted privilege applies to domain controllers of contoso.com only—that is DC1. It does not extend to member servers (such as Server1) unless User1 is added to each server’s local Backup Operators group, and it does not cross domains (so DC2 and Server2 in east.contoso.com are unaffected). Consequently, the only server User1 can back up with the granted membership is DC1.

In the Administering Windows Server Hybrid Core Infrastructure guidance for Windows Admin Center (WAC) and Kerberos delegation, resource-based constrained delegation (RBCD) is configur ed on the resource’s computer account , not on the client/gateway. The documentation explains that “resource-based constrained delegation is applied to the target service account; the target’s msDS-AllowedToActOnBehalfOfOtherIdentity attribute contains the security principals (computers or service accounts) that are permitted to act on behalf of users.” It further clarifies that “this model supports cross-domain and cross-forest scenarios when a trust exists; you specify the front-end computer (for example, a WAC gateway) from the trusted forest as an allowed principal on the resource computer in its own domain.”

For WAC, the gateway (Server1 in contoso.com ) must be allowed to delegate to the managed node (Server2 in fabrikam.com ). The study materials show th e exact PowerShell interface: “Use Set-ADComputer with -PrincipalsAllowedToDelegateToAccount to populate the resource’s allowed-to-act list.” Therefore, the Identity parameter must reference the resource computer account (Server2 in fabrikam.com), and the PrincipalsAllowedToDelegateToAccount parameter must reference the gateway computer account (Server1 in contoso.com).

Hence the correct command is:

Set-ADComputer -Identity (Get-ADComputer server2.fabrikam.com) -PrincipalsAllowedToDelegateToAccount (Get-ADC omputer server1.contoso.com)

 Volume for the AD DS database: F

 Caching configuration for the volume that hosts the database: NONE

Explanation :

The Administering Windows Server Hybrid Core Infrastructure guidance for deploying AD DS on Azure IaaS VMs is explicit about storage placement and disk caching. The study materials state that you must not use the temporary disk and should place the AD DS database and logs on a persistent data disk:

“Do not place the Active Directory database, logs, or SYSVOL on the temporary disk (typically D: in Azure). Data on the temporary disk is not persistent and can be lost at any time.”

They also direct disabling host caching on the disk that holds the AD DS database and logs to maximize resiliency and avoid write-caching data loss:

“For disks that store NTDS.dit and the AD DS log files, configure Host caching = None to prevent stale or unflushed writes and to ensure directory integrity during failures.”

And, for drive layout:

“Install the operating system on C: and create a separate data disk/volume for AD DS database and logs to improve reliability and recoverability.”

Applying these verified practices:

Selecting F: (the new persistent data disk) meets the requirement to avoid the non-persistent D: drive and to separate AD DS from the OS volume (C:).

Setting host caching to NONE on that disk maximizes resiliency and prevents accidental data loss by disabling volatile write caching for critical AD DS data.

Process isolation: image1 only

Hyper-V isolation: image1, image2, image3, and image4

The Administering Windows Server Hybrid Core Infrastructure materials explain two Windows container isolation modes. For process isolation , the guide states that Windows Server containers share th e host’s kernel and therefore require kernel/OS-version compatibility : “ Process-isolated Windows containers run directly on the host and use the host’s kernel; the container image must match the host OS version/build .” Because Host1 is Windows Server 2022 , only a Windows Server 2022 container image can be run with process isolation. Thus, among the images shown, image1 (Windows Server 2022) is the only one eligible for process isolation; 2019 and 2016 images have kernel mismatches and cannot run in that mod e.

The same materials describe Hyper-V isolation as running each container inside a lightweight utility VM: “ Hyper-V–isolated containers get their own kernel inside a special VM, removing the kernel version dependency on the host .” This mode “ allows runnin g different Windows versions than the host ” and, when LCOW/WSL is present, it “ enables running Linux containers on Windows ” by supplying a Linux kernel within the utility VM. Since Host1 has the Subsystem for Linux installed, Hyper-V isolation can run Wind ows Server 2022, 2019, 2016 container images and also Linux containers. Therefore, to maximize isolation, you can run image1, image2, image3, and image4 with Hyper-V isolation , while process isolation is limited to image1 only .

In hybrid name-resolution designs covered in Administering Windows Server Hybrid Core Infrastructure , Azure Private DNS does not supp ort zone transfers and therefore you cannot host it on, or pull it into, on-premises DNS by using stub or secondary zones. The guidance states that when on-premises clients must resolve names that live in an Azure Private DNS zone , the recommended pattern is to place a DNS forwarder in Azure (typically a Windows Server VM running the DNS role) that can directly query the Azure resolver from inside the virtual network. Then, on-premises Windows DNS servers are configured with a conditional forwarder that for wards queries for the private zone’s suffix to the Azure DNS forwarder over the VPN/ExpressRoute connection.

This achieves the following:

Keeps the authoritative zone in Azure Private DNS while making it reachable from on-premises.

Avoids unsupported mechanisms (no AXFR/IXFR available from Azure Private DNS, so stub and secondary zones won’t work).

Uses least privilege and minimal change on both sides: add a DNS VM in Azure (E) and create a conditional forwarder on DC1 for fabrikam.com pointing to that VM’s private IP (A).

Options B and C require zone transfers, which are not available from Azure Private DNS, and D (changing VNet DNS servers) affects Azure VMs’ resolver settings but does not enable on-premises resolution of the Azure-hosted private zone .