Question 40An internal payroll application launches only when protection features are disabled globally, although only one supported executable needs an exception. How can administrators make this correction durable through future changes? Require an expiration date and vendor remediation plan for each security mitigation compatibility exception. Require platform firmware attestation and hardware security capability checks during server acquisition and servicing. Include supported firmware, VBS prerequisites, and Credential Guard status in the Windows Server security baseline. Keep application-specific exploit mitigation settings under change control and regression test them after software updates. ExplanationCorrect Answer A:Require an expiration date and vendor remediation plan for each security mitigation compatibility exception. This preventive control maintains the intended protection because per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. The initial action remains: Create a narrow documented application mitigation exception after identifying the failed protection instead of weakening Exploit Protection system-wide. Other Answers B:Secured-core protections use hardware-backed trust and virtualization-based isolation to strengthen the platform boot and runtime boundary. The lasting safeguard is to require an expiration date and vendor remediation plan for each security mitigation compatibility exception. C:Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. The stronger recurring control is to require an expiration date and vendor remediation plan for each security mitigation compatibility exception. D:Exploit Protection provides process-level exploit mitigations such as memory and control-flow defenses, but compatibility must be validated per application. Reducing this risk requires a practice to require an expiration date and vendor remediation plan for each security mitigation compatibility exception.
Question 41A hybrid domain rejects common leaked passwords in the cloud, but on-premises password resets continue accepting them without any Azure agents deployed. What should the administrator change first to resolve the stated issue? Delegate only the required password-reset permission on the departmental OU instead of granting domain-wide administrative membership. Install and validate the supported Defender for Identity sensor on the domain controller with required permissions and connectivity. Add privileged accounts to the RODC password-replication deny policy and review already cached credentials for necessary reset. Deploy supported Microsoft Entra Password Protection proxy and DC agents, then enforce the policy after reviewing audit-mode rejections. ExplanationCorrect Answer D:Deploy supported Microsoft Entra Password Protection proxy and DC agents, then enforce the policy after reviewing audit-mode rejections. This resolves the observed failure because the on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. A suitable acceptance check is: Attempt controlled prohibited passwords at an on-premises domain controller and inspect agent and proxy health events. Other Answers A:AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. The corrective action for this requirement is to deploy supported Microsoft Entra Password Protection proxy and DC agents, then enforce the policy after reviewing audit-mode rejections. B:Defender for Identity relies on correctly configured identity sensors and connected telemetry to detect suspicious AD-related behavior. This failure calls for a decision to deploy supported Microsoft Entra Password Protection proxy and DC agents, then enforce the policy after reviewing audit-mode rejections. C:RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. The corrective action for this requirement is to deploy supported Microsoft Entra Password Protection proxy and DC agents, then enforce the policy after reviewing audit-mode rejections.
Question 42A hybrid domain rejects common leaked passwords in the cloud, but on-premises password resets continue accepting them without any Azure agents deployed. Which cause-and-effect mechanism best fits this evidence? The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. Defender for Identity relies on correctly configured identity sensors and connected telemetry to detect suspicious AD-related behavior. ExplanationCorrect Answer A:The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. The mechanism explains the corrective action: Deploy supported Microsoft Entra Password Protection proxy and DC agents, then enforce the policy after reviewing audit-mode rejections. The associated validation is: Attempt controlled prohibited passwords at an on-premises domain controller and inspect agent and proxy health events. Other Answers B:AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. By contrast, the on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. C:RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. By contrast, the on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. D:Defender for Identity relies on correctly configured identity sensors and connected telemetry to detect suspicious AD-related behavior. By contrast, the on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them.
Question 43A hybrid domain rejects common leaked passwords in the cloud, but on-premises password resets continue accepting them without any Azure agents deployed. What should the engineer check to distinguish success from a superficial fix? Generate an authorized test reconnaissance signal and confirm the sensor health and resulting security telemetry appear in the service. Attempt controlled prohibited passwords at an on-premises domain controller and inspect agent and proxy health events. Test password resets on a user in the target OU and confirm attempts against a peer OU are denied. Run the allowed and denied password-replication checks and confirm the privileged account secret cannot be newly cached. ExplanationCorrect Answer B:Attempt controlled prohibited passwords at an on-premises domain controller and inspect agent and proxy health events. This evidence tests whether the team actually completed: Deploy supported Microsoft Entra Password Protection proxy and DC agents, then enforce the policy after reviewing audit-mode rejections. It addresses the risk because the on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. Other Answers A:Defender for Identity relies on correctly configured identity sensors and connected telemetry to detect suspicious AD-related behavior. A more meaningful verification is to attempt controlled prohibited passwords at an on-premises domain controller and inspect agent and proxy health events. C:AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. Proving this correction calls for a check to attempt controlled prohibited passwords at an on-premises domain controller and inspect agent and proxy health events. D:RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. Proving this correction calls for a check to attempt controlled prohibited passwords at an on-premises domain controller and inspect agent and proxy health events.
Question 44A hybrid domain rejects common leaked passwords in the cloud, but on-premises password resets continue accepting them without any Azure agents deployed. What should be added to the permanent maintenance checklist? Audit RODC cache membership and denial lists whenever branch administrative roles change. Include Defender for Identity sensor readiness in the domain controller build and replacement checklist. Monitor agent coverage and update the banned-password policy when new password attack patterns appear. Review OU permissions and privileged group membership when departmental support responsibilities change. ExplanationCorrect Answer C:Monitor agent coverage and update the banned-password policy when new password attack patterns appear. This preventive control maintains the intended protection because the on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. The initial action remains: Deploy supported Microsoft Entra Password Protection proxy and DC agents, then enforce the policy after reviewing audit-mode rejections. Other Answers A:RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. The lasting safeguard is to monitor agent coverage and update the banned-password policy when new password attack patterns appear. B:Defender for Identity relies on correctly configured identity sensors and connected telemetry to detect suspicious AD-related behavior. The stronger recurring control is to monitor agent coverage and update the banned-password policy when new password attack patterns appear. D:AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. The lasting safeguard is to monitor agent coverage and update the banned-password policy when new password attack patterns appear.
Question 45A branch RODC caches a privileged support account's password, exposing the administrator if the branch server is physically stolen. What is the most appropriate action given the observed constraints? Delegate only the required password-reset permission on the departmental OU instead of granting domain-wide administrative membership. Deploy supported Microsoft Entra Password Protection proxy and DC agents, then enforce the policy after reviewing audit-mode rejections. Add privileged accounts to the RODC password-replication deny policy and review already cached credentials for necessary reset. Validate the application's modern Kerberos authentication path or scope protected-account usage instead of weakening the user's credentials. ExplanationCorrect Answer C:Add privileged accounts to the RODC password-replication deny policy and review already cached credentials for necessary reset. This resolves the observed failure because rODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. A suitable acceptance check is: Run the allowed and denied password-replication checks and confirm the privileged account secret cannot be newly cached. Other Answers A:AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. A more relevant action is to add privileged accounts to the RODC password-replication deny policy and review already cached credentials for necessary reset. B:The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. A more relevant action is to add privileged accounts to the RODC password-replication deny policy and review already cached credentials for necessary reset. D:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. This failure calls for a decision to add privileged accounts to the RODC password-replication deny policy and review already cached credentials for necessary reset.
Question 46A branch RODC caches a privileged support account's password, exposing the administrator if the branch server is physically stolen. What principle explains why the correct response works? AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. ExplanationCorrect Answer B:RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. The mechanism explains the corrective action: Add privileged accounts to the RODC password-replication deny policy and review already cached credentials for necessary reset. The associated validation is: Run the allowed and denied password-replication checks and confirm the privileged account secret cannot be newly cached. Other Answers A:AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. By contrast, RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. C:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. In the stated system, RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. D:The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. By contrast, RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location.
Question 47A branch RODC caches a privileged support account's password, exposing the administrator if the branch server is physically stolen. What observable evidence would verify that the fix succeeded? Run the allowed and denied password-replication checks and confirm the privileged account secret cannot be newly cached. Test password resets on a user in the target OU and confirm attempts against a peer OU are denied. Inspect authentication events and confirm the service succeeds with an authorized Kerberos ticket while NTLM remains rejected. Attempt controlled prohibited passwords at an on-premises domain controller and inspect agent and proxy health events. ExplanationCorrect Answer A:Run the allowed and denied password-replication checks and confirm the privileged account secret cannot be newly cached. This evidence tests whether the team actually completed: Add privileged accounts to the RODC password-replication deny policy and review already cached credentials for necessary reset. It addresses the risk because rODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. Other Answers B:AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. The failure is checked more directly by a test to run the allowed and denied password-replication checks and confirm the privileged account secret cannot be newly cached. C:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. A more meaningful verification is to run the allowed and denied password-replication checks and confirm the privileged account secret cannot be newly cached. D:The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. The failure is checked more directly by a test to run the allowed and denied password-replication checks and confirm the privileged account secret cannot be newly cached.
Question 48A branch RODC caches a privileged support account's password, exposing the administrator if the branch server is physically stolen. What control should be sustained after the immediate fix? Audit RODC cache membership and denial lists whenever branch administrative roles change. Maintain privileged-account application compatibility tests before adding accounts to protection groups. Monitor agent coverage and update the banned-password policy when new password attack patterns appear. Review OU permissions and privileged group membership when departmental support responsibilities change. ExplanationCorrect Answer A:Audit RODC cache membership and denial lists whenever branch administrative roles change. This preventive control maintains the intended protection because rODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. The initial action remains: Add privileged accounts to the RODC password-replication deny policy and review already cached credentials for necessary reset. Other Answers B:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. The lasting safeguard is to audit RODC cache membership and denial lists whenever branch administrative roles change. C:The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. Reducing this risk requires a practice to audit RODC cache membership and denial lists whenever branch administrative roles change. D:AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. Reducing this risk requires a practice to audit RODC cache membership and denial lists whenever branch administrative roles change.
Question 49A service desk reports a privileged domain user's application cannot use NTLM after membership in the Protected Users security group. Which next corrective action best addresses this failure? Enable NTLM auditing first, identify remaining dependencies, and migrate them to supported authentication before enforcing restrictions. Validate the application's modern Kerberos authentication path or scope protected-account usage instead of weakening the user's credentials. Apply an AD authentication policy and authentication policy silo to restrict the sensitive account's permitted authentication locations. Use a dedicated privileged access workstation and restrict domain administrator interactive logons to approved administration systems. ExplanationCorrect Answer B:Validate the application's modern Kerberos authentication path or scope protected-account usage instead of weakening the user's credentials. This resolves the observed failure because protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. A suitable acceptance check is: Inspect authentication events and confirm the service succeeds with an authorized Kerberos ticket while NTLM remains rejected. Other Answers A:Audit-before-block reveals services still using NTLM so that hardening does not unexpectedly interrupt legitimate authentication. This failure calls for a decision to validate the application's modern Kerberos authentication path or scope protected-account usage instead of weakening the user's credentials. C:Authentication policy silos constrain where selected accounts are allowed to authenticate, reducing credential reuse outside approved hosts. The required change instead is to validate the application's modern Kerberos authentication path or scope protected-account usage instead of weakening the user's credentials. D:Limiting where highly privileged identities log on reduces exposure of reusable authentication material to compromised member servers. The required change instead is to validate the application's modern Kerberos authentication path or scope protected-account usage instead of weakening the user's credentials.
Question 50A service desk reports a privileged domain user's application cannot use NTLM after membership in the Protected Users security group. Why does the proposed solution address the underlying problem? Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. Limiting where highly privileged identities log on reduces exposure of reusable authentication material to compromised member servers. Authentication policy silos constrain where selected accounts are allowed to authenticate, reducing credential reuse outside approved hosts. Audit-before-block reveals services still using NTLM so that hardening does not unexpectedly interrupt legitimate authentication. ExplanationCorrect Answer A:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. The mechanism explains the corrective action: Validate the application's modern Kerberos authentication path or scope protected-account usage instead of weakening the user's credentials. The associated validation is: Inspect authentication events and confirm the service succeeds with an authorized Kerberos ticket while NTLM remains rejected. Other Answers B:Limiting where highly privileged identities log on reduces exposure of reusable authentication material to compromised member servers. By contrast, protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. C:Authentication policy silos constrain where selected accounts are allowed to authenticate, reducing credential reuse outside approved hosts. By contrast, protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. D:Audit-before-block reveals services still using NTLM so that hardening does not unexpectedly interrupt legitimate authentication. In the stated system, protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts.
