Using Hyper-V Replica within a clustered Hyper-V environment such as Cluster3 requires deploying the Hyper-V Replica Broker, which itself runs as a clustered role on the failover cluster; without the Broker, replication cannot follow a protected virtual machine if it live-migrates between Cluster3 ' s nodes, since there would be no single, cluster-aware endpoint tracking which node currently owns each VM ' s replication state. Adding a failover cluster role is exactly how the Hyper-V Replica Broker is deployed onto Cluster3, satisfying the requirement to use Hyper-V Replica to protect Cluster3 ' s virtual machines. Enabling integration services on the virtual machines addresses guest-OS-to-host integration (time synchronization, heartbeat, and similar) rather than providing any replication capability. Adding a generic Windows Server server role does not, by itself, install or configure the Hyper-V Replica Broker -- the Broker must specifically be added as a clustered role through Failover Cluster Manager. Configuring a fault domain for the cluster is not a real Windows Server failover clustering concept and does not provide Hyper-V Replica capability. Therefore, adding a failover cluster role (the Hyper-V Replica Broker) is the correct solution for Cluster3.

Restoring deleted objects from the Active Directory Recycle Bin requires permission to view and restore objects inside the forest ' s Deleted Objects container, and by default that container ' s access control list denies access to everyone except the SYSTEM account and members of Domain Admins (and Enterprise Admins at the forest root) -- no delegation to any other built-in group exists out of the box. Among the four groups offered, only Domain Admins carries this permission by default, since Account Operators (which can manage most user, group, and computer objects but has no special access to the hidden Deleted Objects container), Schema Admins (which governs schema modifications, not object restoration), and Backup Operators (which can back up and restore files and the system state, but not perform an online Active Directory Recycle Bin object restore through the Active Directory Administrative Center) all lack the needed access. The case study ' s general instruction to use the principle of least privilege where possible does not change this outcome here, since none of the three lower-privileged alternatives actually has the required capability by default -- Domain Admins is not merely the most convenient choice but the only one of the four that functionally works. Therefore, User1 must be added to Domain Admins to be able to recover objects from the Active Directory Recycle Bin.

1. Add a disk resource to the cluster. 2. Create a Cluster Shared Volume (CSV). 3. Put the disk in maintenance mode. 4. Enable BitLocker on the volume. 5. Update the BitLockerProtectorInfo property of the volume.

BitLocker can only be enabled on a Cluster Shared Volume disk while that disk is taken offline to cluster I/O, so the CSV must exist and be placed into maintenance mode before encryption can be applied. The supported sequence begins by adding the disk resource to the cluster and converting it into a Cluster Shared Volume, since BitLocker-on-CSV support requires the disk to already be a CSV rather than a plain cluster disk. The disk is then put into maintenance mode, which takes it offline to the other cluster nodes so it can be safely encrypted without a node attempting to access it mid-operation. With the CSV disk offline in maintenance mode, BitLocker is enabled on the volume. Finally, the volume ' s BitLockerProtectorInfo property is updated so that Failover Clustering registers the unlock protector, allowing the volume to automatically unlock on every cluster node once maintenance mode ends and the CSV is brought back online. Performing these steps out of order either fails outright -- BitLocker cannot be enabled on a CSV disk that is still online and actively used by the cluster -- or leaves the other cluster nodes unable to bring the encrypted volume back online afterward, since they would lack the registered unlock protector. Therefore, the correct order is: add the disk resource, create the CSV, put the disk in maintenance mode, enable BitLocker, and update BitLockerProtectorInfo.

A Windows Server failover cluster requires a distinct IP address for each individual cluster node ' s network adapter, plus one additional IP address for the cluster ' s own network name resource -- the cluster access point that clients and management tools use to address the cluster as a single logical entity rather than any one specific node. Cluster3 will contain two physical nodes, Node1 and Node2, so at minimum one IP address is required for Node1 ' s network adapter and one for Node2 ' s network adapter. Beyond those two node-level addresses, the cluster core resource itself (the cluster name object and its associated IP address resource) requires one more address so that the cluster can be addressed and managed as a whole and so that any highly available roles hosted on the cluster (such as the file share role planned for Cluster3) can obtain the network identity they need to fail over between nodes. Adding these together -- one for Node1, one for Node2, and one for the cluster ' s own network name -- yields a minimum of three IP addresses required for Cluster3 ' s node and cluster roles. Fewer than three would leave either a node or the cluster itself without a usable network identity, and while additional IP addresses may be consumed by highly available roles later added to the cluster, three is the baseline minimum for the node and cluster roles themselves.

Microsoft Defender for Identity is the Microsoft Sentinel data connector purpose-built to monitor on-premises Active Directory domain controllers and surface exactly the insecure-protocol activity described in the requirement, including authentication attempts and sign-ins that rely on legacy or unsigned protocols such as NTLMv1, SMBv1, and unsigned LDAP binds. It does this by analyzing domain controller network traffic and Windows Events directly on the DCs, which is exactly where this insecure-protocol usage originates. The Threat Intelligence - TAXII connector ingests external threat-intelligence indicator feeds (IP addresses, file hashes, domains) from TAXII-compliant sources and has nothing to do with monitoring authentication protocol usage on domain controllers. The Azure Active Directory (Microsoft Entra ID) connector reports on cloud sign-in and audit log events for the Entra tenant, not on legacy protocol usage against on-premises AD DS domain controllers. Microsoft Defender for Cloud focuses on cloud resource security posture management and workload protection rather than detecting legacy authentication protocol usage against on-premises domain controllers. Therefore, connecting Microsoft Defender for Identity to Microsoft Sentinel is the correct connector to identify connections to the domain controllers that use insecure protocols.

DHCP1: Export-DhcpServer, Remove-DhcpServerInDC. DHCP2: Add-DhcpServerInDC, Import-DhcpServer.

Migrating a DHCP server ' s configuration together with its existing leases and reservations by PowerShell follows an export/unauthorize-then-authorize/import pattern across the two servers. On the source server, DHCP1, Export-DhcpServer captures the existing scopes, options, leases, and reservations into a migration file, which is what allows the existing leases and reservations to actually carry over to the replacement server. Remove-DhcpServerInDC is then run on DHCP1 to unauthorize it in Active Directory, which is what prevents DHCP1 from continuing to service client requests once DHCP2 is brought online, satisfying that specific migration requirement. On the target server, DHCP2, Add-DhcpServerInDC authorizes the new server in AD DS so it is permitted to lease addresses on the network, and Import-DhcpServer then applies the configuration file exported from DHCP1, causing DHCP2 to hand out the same address ranges as DHCP1 along with the existing leases and reservations that were captured during export. Add-DhcpServerv4Scope and Remove-DhcpServerv4Scope only create or delete an individual scope ' s address range and do not export, import, or preserve any existing lease or reservation data, so neither is part of this migration sequence. Therefore, DHCP1 requires Export-DhcpServer and Remove-DhcpServerInDC, while DHCP2 requires Add-DhcpServerInDC and Import-DhcpServer.

Running Get-AzVMDiskEncryptionStatus against VM1 returns the current Azure Disk Encryption status for both its operating system disk and its data disks in a single call, and that returned status includes the key vault URL or resource ID where the encryption secrets for VM1 are actually stored, so this one cmdlet directly answers the question with no additional lookup steps required. Get-AzKeyVaultKey and Get-AzDiskEncryptionSet both require the administrator to already know which specific key vault or disk encryption set resource to query before they can return anything useful, which does not minimize effort when the goal is precisely to discover which key vault is associated with VM1 in the first place. Get-AzKeyVault, similarly, only enumerates the key vaults that exist within the subscription without tying any particular vault to VM1 ' s encryption configuration, so it would require the administrator to manually check each vault ' s contents to find the right one. Because Get-AzVMDiskEncryptionStatus ties the VM directly to its encryption key vault in a single, minimal-effort cmdlet call, it is the correct choice for identifying which key vault stores VM1 ' s encryption keys.

repair-bde.exe is a disk-repair utility, not a lookup or reporting tool: its purpose is to attempt to decrypt or repair a corrupted BitLocker-protected volume when normal unlock methods have failed, and it accepts either a recovery password or a previously exported BitLocker key package (a file containing the actual encryption keys needed to decrypt sectors directly) as the credential it uses to perform that repair; running it does not display, output, or otherwise identify the volume ' s 48-digit numerical recovery password value to the administrator at all, and a key package is a different artifact from the recovery password that would actually need to be entered at Server1 ' s BitLocker recovery screen to unlock it through the normal recovery workflow. The stated goal is specifically to identify the recovery key, meaning to determine and retrieve its value, not to repair or decrypt a damaged volume using key material that must already have been exported in advance; even successfully running repair-bde with an exported key package would leave the administrator no closer to knowing what Server1 ' s recovery password actually is, and it does nothing to address a server that is simply sitting at the BitLocker recovery prompt waiting for a password rather than suffering from actual volume corruption. Because this solution does not retrieve or display the recovery key, it does not meet the stated goal.

When Server1 establishes a network connection with Server2, the connection is encrypted: No. Server2 can establish a network connection with Server3: Yes. When Server3 establishes a network connection with Server1, the connection is encrypted: No.

Rule1 exists only on Server1 and is configured to require authentication for inbound connections while only requesting authentication for outbound connections, using Computer (Kerberos V5) as its authentication method, but it does not specify Require encryption anywhere in its settings. Requiring or requesting authentication in a connection security rule only causes IPsec to negotiate and verify the identity of the two endpoints; it does not turn on encryption for the resulting connection unless the rule, or the IPsec settings backing it, explicitly specifies that encryption itself is required. Because Rule1 authenticates but does not encrypt, both a connection Server1 establishes outbound to Server2 and a connection Server3 establishes inbound to Server1 are authenticated using Kerberos V5 but are still sent in clear text, making both of those encryption-related statements false. Server2 and Server3 have no connection security rule of their own configured at all, so nothing on either of those two servers restricts, requires, or even attempts to authenticate traffic directly between them, meaning Server2 is able to freely establish a network connection with Server3 without any authentication or encryption involved, making that statement true.

App1 ' s requirement to update objects in AD DS as part of its Kerberos-authenticated operation rules out any deployment built solely on read-only domain controllers (RODCs), because an RODC holds a read-only copy of the AD DS database and cannot accept or process write operations, such as the object updates App1 performs or password changes tied to Kerberos ticket processing; only a writable domain controller can service those requests, immediately eliminating both RODC-based options regardless of how they are made redundant. Between the two writable-DC options, deploying the two writable domain controller virtual machines across availability zones provides genuine redundancy within the same Azure region and VNet, keeping both DCs on the same low-latency virtual network VM1 already reaches through the Azure Firewall, so a zone failure still leaves a writable, reachable DC online for App1; placing the two writable DCs in physically distinct Azure regions instead would require extending VNet1 ' s connectivity (and the Azure Firewall ' s filtering) across regions and introduces materially higher replication latency between the two DCs, which the scenario ' s single-VNet, single-firewall design does not call for or support. Deploying two writable domain controller virtual machines across availability zones therefore both satisfies VM1 ' s write requirement and provides the requested redundancy with the least architectural disruption.