Microsoft Exam AZ-801 Topic 7 Question 43 Discussion

Actual exam question for Microsoft's AZ-801 exam

Question #: 43
Topic #: 7

Your network contains an Active Directory Domain Services (AD DS) forest. The forest functional level is Windows Server 2012 R2. The forest contains the domains shown in the following table.

You create a user named Admin1.

You need to ensure that Admin1 can add a new domain controller that runs Windows Server 2022 to the east.contoso.com domain. The solution must follow the principle of least privilege.

To which groups should you add Admin1?

AEAST\Domain Admins only

BCONTOSO\Enterprise Admins only

CCONTOSO/Schema Admins and EAST\Domain Admins

DCONTOSO\Enterprise Admins and CONTOSO/Schema Admins

Show Suggested Answer

Suggested Answer: C

by Zona at Nov 28, 2023, 12:51 AM

Limited Time Offer

25%

Off

Get Premium AZ-801 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Orville

8 months ago

I'm torn between options C and D. On one hand, C seems to follow the principle of least privilege a bit better. But D would give Admin1 a bit more flexibility and potentially make it easier to manage the domain controllers. Decisions, decisions...

upvoted 0 times

...

Novella

8 months ago

Hmm, interesting. I was also considering option D, which gives Admin1 membership in the CONTOSO\Enterprise Admins and CONTOSO\Schema Admins groups. That would give them the necessary permissions, but you're right, it might be overkill and a bit too much power.

upvoted 0 times

...

8 months ago

Hmm, this is a tricky one. We need to ensure Admin1 can add a new domain controller to the east.contoso.com domain, but we also need to follow the principle of least privilege. I'm not sure if adding them to the EAST\Domain Admins group is the best option, as that would give them too much power across the entire domain.

upvoted 0 times

...