Infrastructure documents : =

In Just Enough Administration (JEA), you restrict what remote users can do by creating two artifacts: role capability files ( *.psrc ) and a session configu ration file ( *.pssc ). The role capability file defines which commands are visible/usable (for example, specific Hyper-V cmdlets via VisibleCmdlets , VisibleFunctions , or VisibleExternalCommands ). The session configuration file then maps users or groups to o ne or more role capabilities using RoleDefinitions .

The Administering Windows Server Hybrid Core Infrastructure material explains that once those files are authored, you must expose a JEA endpoint by registering the session configuration on the target serv er. This is accomplished with Register-PSSessionConfiguration , pointing to the PS session configuration file ( .pssc ) . Registering the endpoint enforces the role capability restrictions when helpdesk users connect (for example, Enter-PSSession -Configuratio nName HyperVJeaHelpDesk -ComputerName Server1 ).

New-PSSessionConfigurationFile is used earlier to create the .pssc file, but the prompt states the files are already built. Enter-PSSession only starts a session and does not publish the configuration. Theref ore, the correct command to limit which Hyper-V module cmdlets helpdesk users can use is:

Register-PSSessionConfiguration -Path .\HyperVJeaConfig.pssc -Name ' HyperVJeaHelpDesk ' -Force .

In Windows Server DHCP, scope options define configuration parameters (for example, default gateway, DNS servers, DNS domain suffix, WINS/NBNS) that are handed to clients as part of a lease, but they do not determine which IP address a client receives. The AZ-800/“Administering Windows Server Hybrid Core Infrastructure” content explains that DHCP scope options are used to “provide TCP/IP configuration values (router, DNS, and other option fields) to clients in a scope,” whereas address assignment control is handled by the lease process and reservations. The guide stresses that if you must ensure a device “always obtains the same IPv4 address from DHCP,” you must “create a reservation that binds a client identifier (usually the MAC address) to a specific IP in the scope.” Therefore, simply configuring or changing Scope1’s scope options will not pin the printers to fixed addresses; the printers will continue to draw any free address from the scope’s pool. Because the requirement is to always assign the same IPs, scope options alone cannot meet the goal; reservations are required for deterministic address assignment.

The course content distinguishes site management from FSMO role administration . Active Directory Sites and Services is used to manage sites, subnets, site links, replication topology, and server objects (NTDS Settings), not domain or forest operations master roles. The documentation explains that FSMO roles are either forest-wide (Schema, Domain Naming) or domain-wide (RID, PDC, Infrastr ucture) and are exposed via ADUC (domain roles), Active Directory Domains and Trusts (Domain Naming), and Active Directory Schema (Schema) , or by command-line tools like NETDOM and NTDSUTIL . Right-clicking Default-First-Site-Name and opening Properties shows site-level configuration (e.g., inter-site transports, licensing, location metadata) but does not display FSMO role holders . Consequently, the proposed action does not meet the goal of identifying the PDC Emulator . To meet the goal, use ADUC → Operation s Masters , netdom query fsmo , or ntdsutil roles as laid out in the administration guide.

 You can create a file named File2.docx in D:\Folder1 on Server1 . = No

 You can create a file named File1.docx in D:\Data1 on Server2 . = No

 File3.docx will sync to Server1 . = Yes

In the Administering Windows Server Hybrid Core Infrastructure content for Azure File Sync, Microsoft describes Azure File Sync as a multi-master synchronization service where a sync group contains one cloud endpoint (the Azure file share) and one or more server endpoints (paths on Windows Server). The documentation explains that “the namespace is kept consistent across all endpoints in the sync group; files and folders created on any endpoint are synced to the Azure file share and then to all other server endpoints.” It also states that “Azure File Sync is bidirectional and uses a last-writer-wins conflict model; the cloud endpoint is the hub that fan-outs changes to all registered server endpoints,” and that “existing items in the cloud share will be projected to each server endpoint (with cloud tiering optionally stubbing files) so the same names and paths appear on every endpoint.”

Applying this:

Because share1 already contains File2.docx, it will be synced down to D:\Folder1 on Server1, so you cannot create another File2.docx there without overwriting—No.

File1.docx exists on Server1 and will be uploaded to share1 and then projected to Server2 at D:\Data1, so creating a brand-new File1.docx there would conflict—No.

File3.docx exists in share1 (and also locally on Server2) and will be synchronized to Server1 at D:\Folder1—Yes.

In the Windows Server hybrid administration guidance for DNS, Microsoft describes that DNS zones stored in Active Directory can use application directory partitions to customize replication scope beyond the default domain- or forest-wide options. The study materials state that “custom application directory partitions allow DNS data to replicate only to the DNS servers that are explicitly enlisted in that partition.” They further emphasize that while DNS Manager lets you pick among built-in scopes or select an existing application parti tion, “creating a new application directory partition is performed with command-line tools (dnscmd) or Windows PowerShell.”

The documented procedure is: “Use dnscmd /CreateDirectoryPartition <</i> FQDN-of-partition > to create the custom partition, then dnscmd /EnlistDirectoryPartition on each DNS server that should host and replicate the data.” Because you must have the partition replicate to only four of the domain controllers, you first create the partition, and then enlist only those four DNS servers. Tools such as Active Directory Sites and Services or Active Directory Administrative Center do not create DNS application directory partitions, and DNS Manager cannot create a new custom partition; it can only use an existing one. Therefore, the correct tool to meet the requirement is dnscmd.exe , after which you enlist just the selected four DNS servers into that partition.