Microsoft AZ-800 Exam - Topic 1 Question 39 Discussion

Actual exam question for Microsoft's AZ-800 exam

Question #: 39
Topic #: 1

You have an Active Directory Domain Services (AD DS) domain. The domain contains three servers named Server 1, Server2, and Server3 that run Windows Server.

You sign in to Server1 by using a domain account and start a remote PowerShell session to Server2. From the remote PowerShell session, you attempt to access a resource on Server3. but access to the resource is denied.

You need to ensure that your credentials are passed from Server1 to Server3. The solution must minimize administrative effort. What should you do?

AConfigure Kerberos constrained delegation.

BConfigure Just Enough Administration (JEA).

CConfigure selective authentication for the domain.

DDisable the Enforce user logon restrictions policy setting for the domain.

Show Suggested Answer

Suggested Answer: A

by Annmarie at Feb 12, 2024, 04:26 PM

Limited Time Offer

25%

Off

Get Premium AZ-800 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Fatima

4 months ago

Selective authentication seems too complicated for this scenario.

upvoted 0 times

...

Bette

4 months ago

Wait, can you really just disable user logon restrictions? Sounds risky!

upvoted 0 times

...

Wenona

4 months ago

I thought JEA was the answer, but now I'm not so sure.

upvoted 0 times

...

Sheridan

4 months ago

Totally agree, A makes the most sense here.

upvoted 0 times

...

Kristel

5 months ago

A is the way to go for Kerberos delegation.

upvoted 0 times

...

Catrice

5 months ago

Disabling the user logon restrictions seems unrelated to this scenario. I don't think D would help us pass credentials effectively.

upvoted 0 times

...

Vanesa

5 months ago

Selective authentication sounds familiar, but I can't recall if it actually helps with credential delegation. I might lean towards A as well.

upvoted 0 times

...

Lyda

5 months ago

I'm not entirely sure, but I feel like Just Enough Administration is more about limiting permissions rather than passing credentials.

upvoted 0 times

...

Melina

5 months ago

I think I remember something about Kerberos delegation being used for passing credentials between servers, so maybe A is the right choice?

upvoted 0 times

...

Reed

5 months ago

I'm leaning towards option B, configuring Just Enough Administration (JEA). That seems like it could be a good way to limit the administrative effort while still solving the problem.

upvoted 0 times

...

Valentine

5 months ago

Okay, I think I've got this. Configuring Kerberos constrained delegation seems like the way to go here. It should allow the credentials to pass from Server1 to Server3 without too much extra work.

upvoted 0 times

...

Delila

5 months ago

Hmm, I'm a bit confused by the wording of the question. I'll need to re-read it a few times to make sure I understand the requirements before deciding on a solution.

upvoted 0 times

...

Marnie

6 months ago

This looks like a tricky one. I'm going to need to think through the different options carefully to determine the best approach that minimizes administrative effort.

upvoted 0 times

...

Frederick

6 months ago

Based on my understanding of the RAN architecture, the statement is True. The CU handles the real-time processing functions.

upvoted 0 times

...

Vincent

6 months ago

I remember a practice question where air was also the preferred option for light-weight cargo. It seems to fit the criteria here too.

upvoted 0 times

...

Mauricio

6 months ago

I've got a good feeling about C, roles. That's the option that makes the most sense to me based on the question.

upvoted 0 times

...

Cathrine

6 months ago

This question seems straightforward, I think I can identify the best usability testing technique based on the test objective.

upvoted 0 times

...

Jolanda

2 years ago

That's a good point, Nu. But I still think Kerberos constrained delegation is the best option.

upvoted 0 times

...

Nu

2 years ago

I believe option B) Configure Just Enough Administration (JEA) could also work. It restricts administrative rights.

upvoted 0 times

...

Glennis

2 years ago

I agree with Jolanda. Kerberos constrained delegation allows your credentials to be passed.

upvoted 0 times

...

Jolanda

2 years ago

I think the answer is A) Configure Kerberos constrained delegation.

upvoted 0 times

...

Vilma

2 years ago

I don't think so, Derick. Selective authentication restricts which users have the ability to authenticate to the domain, not the passing of credentials between servers.

upvoted 0 times

...

Derick

2 years ago

But wouldn't configuring selective authentication for the domain also work in this scenario?

upvoted 0 times

...

Margot

2 years ago

I agree with Derick. It allows a service to impersonate the clients and use their credentials to access resources on another server.

upvoted 0 times

...

Derick

2 years ago

I think we should configure Kerberos constrained delegation.

upvoted 0 times

...

Erick

2 years ago

Yeah, I agree. Kerberos constrained delegation is the way to go here. It's a bit more complicated to set up, but it's the most secure option and minimizes administrative effort.

upvoted 0 times

...

Lawrence

2 years ago

Ha! Yeah, that would be a classic exam question move. Trying to distract us with something that sounds reasonable but is actually a terrible idea. Good thing we're on the same page here.

upvoted 0 times

...

Dalene

2 years ago

You know, I was just thinking the same thing. JEA is more for fine-grained access control, and this seems like a simpler use case. Kerberos constrained delegation is probably the best bet here.

upvoted 0 times

...

Flo

2 years ago

Alright, I think I've got it now. Kerberos constrained delegation it is! Let's just hope the exam doesn't try to trick us with some random option like 'Disable the Enforce user logon restrictions policy setting for the domain.' That would be a real head-scratcher.

upvoted 0 times