- (Exam Topic 3)
Your network contains an Active Directory Domain Services (AD DS) domain.
You have a Group Policy Object (GPO) named GPO1 that contains Group Policy preferences. You plan to link GPO1 to the domain.
You need to ensure that the preference in GPO1 apply only to domain member servers and NOT to domain controllers or client computers. All the other Group Policy settings in GPO1 must apply to all the computers. The solution must minimize administrative effort.
Which type of item level targeting should you use?

1. A. Domain
2. B. Operating System
3. C. Security Group
4. D. Environment Variable

Correct Answer: B
Reference:
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn78918

- (Exam Topic 3)
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are planning the deployment of DNS to a new network.
You have three internal DNS servers as shown in the following table.

The contoso.local zone contains zone delegations for east.contoso.local and west.contoso.local. All the DNS servers use root hints.
You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.
Solution: On Server2, you create a conditional forwarder for west.contoso.local. On Server3, you create a conditional forwarder for east.contoso.local.
Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: B

- (Exam Topic 3)
You have an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.
You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least privilege.
To which group should you add the administrator?

1. A. AAD DC Administrators
2. B. Domain Admins
3. C. Schema Admins
4. D. Enterprise Admins
5. E. Group Policy Creator Owners

Correct Answer: B
Only the Domain Admins group and the Enterprise Admins group can fully manage GPOs. Members of the Group Policy Creator Owners group can create new GPOs but they can’t link the GPOs to sites, the domain or OUs and they cannot manage existing GPOs.

- (Exam Topic 3)
You have a file server named Server1 that runs Windows Server and contains the volumes shown in the following table.

On which volumes can you use BitLocker Drive Encryption (BitLocker) and disk quotas? To answer select the appropriate options in the answer area. NOTE Each correct selection is worth one point.

Solution:
Table Description automatically generated
Reference:
https://docs.microsoft.com/en-us/windows-server/storage/refs/refs-overview

Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

- (Exam Topic 3)
You have an Azure virtual machine named VM1 that has a private IP address only. You configure the Windows Admin Center extension on VM1.
You have an on-premises computer that runs Windows 11. You use the computer for server management. You need to ensure that you can use Windows Admin Center from the Azure portal to manage VM1. What should you configure?

1. A. an Azure Bastion host on the virtual network that contains VM1.
2. B. a VPN connection to the virtual network that contains VM1.
3. C. a network security group 1NSG) rule that allows inbound traffic on port 443.
4. D. a private endpoint on the virtual network that contains VM1.

Correct Answer: B
Reference:
https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/manage-vm