准备AZ-800微软认证考试的资源

版权申诉

5星 · 超过95%的资源 153 浏览量更新于2024-06-13 收藏 21.93MB PDF 举报

"AZ-800微软MCP考试备考指南，包含430页的PDF学习资料和150个视频课程，由专家验证，提供在线和免费资源，帮助考生准备AZ-800考试。" 这篇摘要涉及到的是微软认证专业(MCP)的一项考试，具体是AZ-800考试的复习资源。AZ-800通常关联于微软的“Microsoft Certified: Azure Administrator Associate”认证，这是一个针对Azure管理的认证，旨在验证考生在管理Azure资源、实现Azure计算、存储、网络、身份和安全等方面的能力。提供的资源包括一份430页的PDF学习指南和一个包含150个讲座的视频课程，两者都是为了帮助考生深入理解和掌握考试所需的知识点。这些资源被标记为“ExpertVerified”，意味着它们经过了专业人士的验证，确保内容的质量和准确性。此外，还提到这些资源是在线的，并且有部分免费内容，为考生提供了灵活的学习途径。考试中的问题类型以实际场景为基础，如题目所示，考生可能需要识别在Active Directory Domain Services (AD DS)域环境下哪个服务器是主域控制器(PDC Emulator)。在AD DS环境中，PDC Emulator是五种 Flexible Single Master Operation (FSMO) 角色之一，它负责某些全局操作，如密码重置。然而，根据提供的解决方案，通过在“ActiveDirectoryDomainsandTrusts”中选择“Operations Master”并不直接显示PDC Emulator，因此该方法无法达到目标，正确答案是B（不）。通过这些资源，考生可以学习到如何管理Azure环境，包括创建和配置Azure服务，管理用户和组的身份验证，以及实施安全性策略等关键技能。准备充分的考生将能够成功通过AZ-800考试，从而提升其在Azure平台管理方面的专业认证。

Topic 1

Question #19

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that

might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.

You need to identify which server is the PDC emulator for the domain.

Solution: From Active Directory Sites and Services, you right-click Default-First-Site-Name in the console tree, and then select Properties.

Does this meet the goal?

A. Yes

B. No

Correct Answer:

Community vote distribution

B (100%)

Topic 1

Question #20

Your network contains a single-domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the servers

shown in the following exhibit table.

You plan to install a line-of-business (LOB) application on Server1. The application will install a custom Windows service.

A new corporate security policy states that all custom Windows services must run under the context of a group managed service account (gMSA).

You deploy a root key.

You need to create, congure, and install the gMSA that will be used by the new application.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point

A. On Server1, run the setspn command.

B. On DC1, run the New-ADServiceAccount cmdlet.

C. On Server1, run the Install-ADServiceAccount cmdlet.

D. On Server1, run the Get-ADServiceAccount cmdlet.

E. On DC1, run the Set-ADComputer cmdlet.

F. On DC1, run the Install-ADServiceAccount cmdlet.

Correct Answer:

Step 1: Provisioning group Managed Service Accounts

(B) Create a gMSA using the New-ADServiceAccount cmdlet.

Step 2: Conguring service identity application service

If using security groups for managing member hosts, add the computer account for the new member host to the security group (that the gMSA's

member hosts are a member of).

To add member hosts using the Set-ADServiceAccount cmdlet

1. On the Windows Server 2012 domain controller (DC1, not Server1), run Windows PowerShell from the Taskbar.

2. At the command prompt for the Windows PowerShell Active Directory module, type the following commands, and then press ENTER:

3. Get-ADServiceAccount [-Identity] <string> -Properties PrincipalsAllowedToRetrieveManagedPassword

4. (E) At the command prompt for the Windows PowerShell Active Directory module, type the following commands, and then press ENTER:

5. Set-ADServiceAccount [-Identity] <string> -PrincipalsAllowedToRetrieveManagedPassword <ADPrincipal[]>

6. Etc.

Reference:

https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/getting-started-with-group-managed-service-

accounts

Community vote distribution

BC (95%) 5%

Box 2: No -

User2 is in the fabrikam.com domain.

Group3 is a Universal group in east.contso.com.

Only accounts from any domain in the same forest can be added as members.

Box 3: Yes -

Group2 is a Universal group in contoso.com.

Group2 can grant permissions On any domain in the same forest or trusting forests.

Active Directory Domain Services add to Domain Local group.

Reference:

https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-groups

Topic 1

Question #22

Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest root domain contains a server named

server1.contoso.com.

A two-way forest trust exists between the contoso.com forest and an AD DS forest named fabrikam.com. The fabrikam.com forest contains 10

child domains.

You need to ensure that only the members of a group named fabrikam\Group1 can authenticate to server1.contoso.com.

What should you do rst?

A. Add fabrikam\Group1 to the local Users group on server1.contoso.com.

B. Enable SID ltering for the trust.

C. Enable Selective authentication for the trust.

D. Change the trust to a one-way external trust.

Correct Answer:

Selective authentication restricts access over an external or forest trust to only those users in a trusted domain or forest who have been

explicitly given authentication permissions to computer objects (resource computers) residing in the trusting domain or forest. This

authentication setting must be manually enabled.

Note: When a two way Forest Trust is created between Forest A and Forest B, all domains in Forest A will trust all domains in Forest B and vice

versa.

Incorrect:

Not B: When SID Filtering is enabled, all the foreign SIDs will be removed (quarantined) from user's access token while accessing any resource

through Forest

Trust. The most common impact of this is, a migrated user account which is still using any resource using old SID will not be able to access

that resource anymore. This is because when SID Filtering is enabled, it will block (lter) SID History through a Forest Trust.

When we create a forest Trust, SID Filtering is enabled by default. In some cases, we need to disable SID Filtering.

Not D: When a two way Forest Trust is created between Forest A and Forest B, all domains in Forest A will trust all domains in Forest B and vice

versa.

If a one way Forest Trust is created, where Forest A is Trusting Domain and Forest B is Trusted Domain, then Forest B can access resources

within Forest A, however Forest A cannot access resources within Forest B.

Reference:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc755321(v=ws.10)

Community vote distribution

C (100%)

剩余245页未读，继续阅读

xueyunshengling

粉丝: 582
资源: 3378

准备AZ-800微软认证考试的资源

微软-AZ-800学习文档手册.pdf

AZ-120微软MCP ET.pdf

AZ-400微软MCP ET.pdf

AZ-104微软MCP ET.pdf

AZ-700微软MCP ET.pdf

AZ-204微软MCP ET.pdf

AZ-140微软MCP ET.pdf

AZ-801微软MCP ET.pdf

AZ-900微软MCP ET.pdf

AZ-305微软MCP ET.pdf

最新资源