Correct Answer:

Explanation:
An RODC only caches (replicates) the password of a security principal that is explicitly permitted by its Password Replication Policy - in the exhibit, only members of the built-in Allowed RODC Password Replication Group and the custom Group1 are set to Allow, while Administrators, Account Operators, Backup Operators, Server Operators, and the Denied RODC Password Replication Group are all set to Deny.
A user who is not covered by an Allow entry authenticates through pass-through validation to a writable DC and never has credentials cached on the RODC, so User1 ' s credentials are not stored on RODC1, making statement 1 No. Because Server3 sits in Site2 alongside RODC1 and is a member of Group1 (an Allow entry), a user whose credentials are already cached there can still authenticate locally through RODC1 even if WAN connectivity to Site1 ' s writable domain controllers is lost, which is why User2 can sign in successfully during the outage, making statement 2 Yes. Interactive local sign-in to the RODC console itself is governed separately by the RODC ' s Administrator Role Separation (local Administrators group), not by the Password Replication Policy, and nothing in the scenario grants User3 that local logon right, so statement 3 is No.

Correct Answer:

Explanation:
Command: wecutil qc /q. Server: Server1 only.
wecutil qc, the quick-config option of the Windows Event Collector utility, is the command that enables and starts the Windows Event Collector service on a machine, and it must be run on whichever computer is going to act as the event collector for the subscription. In this scenario, Server1 is the intended destination that will receive the forwarded events from DC1, meaning Server1 is the collector and DC1 is only the event source, so the command must be run on Server1, not on DC1. wevtutil is a related but different utility that manages individual event logs and their configuration, such as querying, exporting, or clearing logs, rather than enabling the collector service itself, so it does not accomplish this task. winrm qc only configures and quick- starts the Windows Remote Management service, which is a separate prerequisite that may need to be enabled on both the source and the collector for subscriptions to function, but running it alone does not enable event collection. Running wecutil qc /q on Server1 alone is therefore the correct command and target to enable the event subscription infrastructure needed to forward events from DC1.

Correct Answer:

Explanation:
Authentication policies, created and managed from the Active Directory Administrative Center ' s Authentication node, let an administrator set a maximum Kerberos ticket-granting-ticket lifetime for user, computer, or service accounts and define access-control conditions (device group membership or device claims) that a client must satisfy before a TGT is issued to it. This is distinct from an authentication policy silo, which groups accounts together to apply a shared policy rather than defining the TGT lifetime and device conditions itself. Because the requirement is specifically to set a TGT lifetime and device request conditions for high-privilege accounts, an authentication policy authored in ADAC is the object that implements both settings. Once the authentication policy is created, it is applied to the target high-privilege accounts (often through a policy silo membership for organizational grouping), and the domain controllers evaluate the policy
' s TGT lifetime and device claims during Kerberos authentication before issuing or renewing a ticket for those accounts.

Correct Answer: A  🗳️

Explanation: Only visible for PrepAwayETE members. You can sign-up / login (it's free).