Microsoft Updated AZ-800 Exam Questions and Answers by alannah

 User1 can establish a PowerShell remoting session from Server1 to Server2. Yes

 User2 can establish a PowerShell remoting session from Server2 to DC1. No

 User3 can establish a PowerShell remoting session from Server1 to Server2. No

PowerShell Remoting (WinRM) security and connectivity are central themes in the Administering Windows Server Hybrid Core Infrastructure curriculum. The ability to establish a remote session is determined by three factors: the service state on the target, the network path, and the user ' s effective permissions.

User1 (Serv er1 to Server2) : On Server2 , the Enable-PSRemoting cmdlet has been executed. By default, this configures the WinRM service to allow connections from members of the local Administrators group. Since User1 is a member of the Contoso\Administrators group, and this domain group is a member of the local Administrators group on all member servers by default, User1 has the necessary rights to establish a session to Server2.

User2 (Server2 to DC1) : While User2 is a member of the Contoso\Remote Management Users grou p—a group specifically designed to provide non-administrative users with remoting access—the scenario explicitly states that Enable-PSRemoting was run only on Server2 . For any user to establish a remoting session to DC1 , the WinRM listener must first be en abled and configured on that specific target. Because the prompt does not indicate that remoting was enabled on DC1, the connection will fail regardless of User2 ' s group membership.

User3 (Server1 to Server2) : User3 is a member of the local Server2\Power U sers group. According to official documentation, the Power Users group does not possess the default permissions required to access the WinRM endpoints (Microsoft.PowerShell or Microsoft.Windows.ServerManager). Only members of the local Administrators or Re mote Management Users groups are granted these rights when Enable-PSRemoting is executed. Therefore, User3 cannot establish the session.

< From the Azure portal: Enable IP forwarding for NIC1.

On VM1: Install and configure Routing and Remote Access

In Azure VNets, layer-3 routing between subnets is provided by the platform, but if you want a VM to act as a router (NVA) and forward traffic between subnets, two things are required: the NIC must be allowed to pass traffic not destined to itself, and the guest OS must be configured to perform IP forwarding/routing. The Administering Windows Server Hybrid Core Infrastructure guidance for “Manage and maintain Windows Server IaaS virtual machines” and “Implement on-premises and hybrid networking” explains that Azure requires IP forwarding to be enabled on the NIC for any VM acting as a router or load balancer so that the fabric will deliver transit packets to the VM instead of dropping them. The Windows Server role that provides routing is Routing and Remote Access (RRAS); enabling the LAN routing feature configures the TCP/IP stack to forward packets between interfaces (including forwarding back out the same interface when used with Azure’s virtual switch). The same material notes that adding extra NICs is not mandatory for simple transit scenarios, and that user-defined routes can be used when you need to steer traffic through the router; however, to enable the VM itself to route, the minimal administrative steps are: turn on IP forwarding for the NIC in Azure and install/configure RRAS in the guest. This combination allows VM1 to route traffic between Subnet1 and Subnet3 with the least effort.

[Answer choice] can have production checkpoints. = VM1, VM2, and VM3

 [Answer choice] can be hibernated. = Only VM1 and VM2

The Windows Server Hybrid Core Infrastructure curriculum explains that AD DS clients and DCs are site-aware and their placement is governed by site and subnet objects. To place a new RODC in a specific datacenter and ensure it belongs to a new site, you must first create the site and associate the correct IP subnet. The guide states that “subnet-to-site mapping determines the site membership of domain controllers and clients,” ensuring Server1 is in RemoteSite1 after promotion. Next, to control replication, the guidance under “Configure sites, subnets, and site links” specifies that inter-site replication schedules and costs are configured on site links; adjusting the site link gives you granular control over when the hub site (your existing site) replicates with RemoteSite1. Finally, to meet the principle of least privilege and allow a non-Domain Admin to install an RODC, the module “Deploy and manage RODCs” describes pre-staging (pre-creating) an RODC account and delegating installation to a designated user. It notes that “an RODC can be pre-created and an installer account assigned so that a local administrator at the branch can run the AD DS installation wizard without requiring domain-wide administrative rights.” With these three steps—site/subnet, site link, and pre-created RODC with delegated installer—User1 can promote Server1 to an RODC in RemoteSite1 while you retain control of replication and adhere to least privilege.