Question 60A domain administrator regularly signs into a public-facing application server, leaving privileged logon material on a lower-trust host. How can administrators make this correction durable through future changes? Maintain privileged-account application compatibility tests before adding accounts to protection groups. Maintain a tier-zero access inventory and verify new management tools do not silently broaden domain controller reachability. Audit privileged logon rights and separate ordinary-user from administrative identities for all tier-zero operators. Periodically review silo membership and permitted host assignments after administrative workstation replacements. ExplanationCorrect Answer C:Audit privileged logon rights and separate ordinary-user from administrative identities for all tier-zero operators. This preventive control maintains the intended protection because limiting where highly privileged identities log on reduces exposure of reusable authentication material to compromised member servers. The initial action remains: Use a dedicated privileged access workstation and restrict domain administrator interactive logons to approved administration systems. Other Answers A:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. Reducing this risk requires a practice to audit privileged logon rights and separate ordinary-user from administrative identities for all tier-zero operators. B:Domain controller access control limits attack paths to tier-zero services independently of ordinary workstation network reachability. The stronger recurring control is to audit privileged logon rights and separate ordinary-user from administrative identities for all tier-zero operators. D:Authentication policy silos constrain where selected accounts are allowed to authenticate, reducing credential reuse outside approved hosts. The lasting safeguard is to audit privileged logon rights and separate ordinary-user from administrative identities for all tier-zero operators.
Question 61A departmental administrator has broad rights to reset passwords for the entire domain although the team manages only a single OU. What should the administrator change first to resolve the stated issue? Delegate only the required password-reset permission on the departmental OU instead of granting domain-wide administrative membership. Create named privileged identities with role-appropriate delegation and separately controlled break-glass access rather than a shared everyday admin account. Validate the application's modern Kerberos authentication path or scope protected-account usage instead of weakening the user's credentials. Add privileged accounts to the RODC password-replication deny policy and review already cached credentials for necessary reset. ExplanationCorrect Answer A:Delegate only the required password-reset permission on the departmental OU instead of granting domain-wide administrative membership. This resolves the observed failure because aD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. A suitable acceptance check is: Test password resets on a user in the target OU and confirm attempts against a peer OU are denied. Other Answers B:Accountability and least privilege require individual attribution and controlled elevation; shared high-privilege logons obscure audit trails. The required change instead is to delegate only the required password-reset permission on the departmental OU instead of granting domain-wide administrative membership. C:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. A more relevant action is to delegate only the required password-reset permission on the departmental OU instead of granting domain-wide administrative membership. D:RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. This failure calls for a decision to delegate only the required password-reset permission on the departmental OU instead of granting domain-wide administrative membership.
Question 62A departmental administrator has broad rights to reset passwords for the entire domain although the team manages only a single OU. Which cause-and-effect mechanism best fits this evidence? AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. Accountability and least privilege require individual attribution and controlled elevation; shared high-privilege logons obscure audit trails. ExplanationCorrect Answer A:AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. The mechanism explains the corrective action: Delegate only the required password-reset permission on the departmental OU instead of granting domain-wide administrative membership. The associated validation is: Test password resets on a user in the target OU and confirm attempts against a peer OU are denied. Other Answers B:RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. By contrast, AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. C:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. In the stated system, AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. D:Accountability and least privilege require individual attribution and controlled elevation; shared high-privilege logons obscure audit trails. By contrast, AD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups.
Question 63A departmental administrator has broad rights to reset passwords for the entire domain although the team manages only a single OU. What should the engineer check to distinguish success from a superficial fix? Inspect authentication events and confirm the service succeeds with an authorized Kerberos ticket while NTLM remains rejected. Run the allowed and denied password-replication checks and confirm the privileged account secret cannot be newly cached. Test password resets on a user in the target OU and confirm attempts against a peer OU are denied. Perform a test directory change and confirm the log records the named administrator and approved delegated scope. ExplanationCorrect Answer C:Test password resets on a user in the target OU and confirm attempts against a peer OU are denied. This evidence tests whether the team actually completed: Delegate only the required password-reset permission on the departmental OU instead of granting domain-wide administrative membership. It addresses the risk because aD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. Other Answers A:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. The failure is checked more directly by a test to test password resets on a user in the target OU and confirm attempts against a peer OU are denied. B:RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. A more meaningful verification is to test password resets on a user in the target OU and confirm attempts against a peer OU are denied. D:Accountability and least privilege require individual attribution and controlled elevation; shared high-privilege logons obscure audit trails. The relevant acceptance check is to test password resets on a user in the target OU and confirm attempts against a peer OU are denied.
Question 64A departmental administrator has broad rights to reset passwords for the entire domain although the team manages only a single OU. What should be added to the permanent maintenance checklist? Maintain privileged-account application compatibility tests before adding accounts to protection groups. Audit RODC cache membership and denial lists whenever branch administrative roles change. Review OU permissions and privileged group membership when departmental support responsibilities change. Review built-in administrator membership regularly and protect emergency access with dual control and audit logging. ExplanationCorrect Answer C:Review OU permissions and privileged group membership when departmental support responsibilities change. This preventive control maintains the intended protection because aD object-level delegation grants task-scoped permissions without the broader authority of membership in built-in privileged groups. The initial action remains: Delegate only the required password-reset permission on the departmental OU instead of granting domain-wide administrative membership. Other Answers A:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. Reducing this risk requires a practice to review OU permissions and privileged group membership when departmental support responsibilities change. B:RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. The lasting safeguard is to review OU permissions and privileged group membership when departmental support responsibilities change. D:Accountability and least privilege require individual attribution and controlled elevation; shared high-privilege logons obscure audit trails. The stronger recurring control is to review OU permissions and privileged group membership when departmental support responsibilities change.
Question 65A security team wants to disable NTLM immediately, but a legacy printer service and a non-Windows application still depend on it. What is the most appropriate action given the observed constraints? Apply an AD authentication policy and authentication policy silo to restrict the sensitive account's permitted authentication locations. Deploy supported Microsoft Entra Password Protection proxy and DC agents, then enforce the policy after reviewing audit-mode rejections. Enable NTLM auditing first, identify remaining dependencies, and migrate them to supported authentication before enforcing restrictions. Validate the application's modern Kerberos authentication path or scope protected-account usage instead of weakening the user's credentials. ExplanationCorrect Answer C:Enable NTLM auditing first, identify remaining dependencies, and migrate them to supported authentication before enforcing restrictions. This resolves the observed failure because audit-before-block reveals services still using NTLM so that hardening does not unexpectedly interrupt legitimate authentication. A suitable acceptance check is: Inspect NTLM audit events during representative business operations and verify identified workloads use approved alternatives after migration. Other Answers A:Authentication policy silos constrain where selected accounts are allowed to authenticate, reducing credential reuse outside approved hosts. A more relevant action is to enable NTLM auditing first, identify remaining dependencies, and migrate them to supported authentication before enforcing restrictions. B:The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. A more relevant action is to enable NTLM auditing first, identify remaining dependencies, and migrate them to supported authentication before enforcing restrictions. D:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. This failure calls for a decision to enable NTLM auditing first, identify remaining dependencies, and migrate them to supported authentication before enforcing restrictions.
Question 66A security team wants to disable NTLM immediately, but a legacy printer service and a non-Windows application still depend on it. What principle explains why the correct response works? Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. Audit-before-block reveals services still using NTLM so that hardening does not unexpectedly interrupt legitimate authentication. The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. Authentication policy silos constrain where selected accounts are allowed to authenticate, reducing credential reuse outside approved hosts. ExplanationCorrect Answer B:Audit-before-block reveals services still using NTLM so that hardening does not unexpectedly interrupt legitimate authentication. The mechanism explains the corrective action: Enable NTLM auditing first, identify remaining dependencies, and migrate them to supported authentication before enforcing restrictions. The associated validation is: Inspect NTLM audit events during representative business operations and verify identified workloads use approved alternatives after migration. Other Answers A:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. In the stated system, audit-before-block reveals services still using NTLM so that hardening does not unexpectedly interrupt legitimate authentication. C:The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. By contrast, audit-before-block reveals services still using NTLM so that hardening does not unexpectedly interrupt legitimate authentication. D:Authentication policy silos constrain where selected accounts are allowed to authenticate, reducing credential reuse outside approved hosts. By contrast, audit-before-block reveals services still using NTLM so that hardening does not unexpectedly interrupt legitimate authentication.
Question 67A security team wants to disable NTLM immediately, but a legacy printer service and a non-Windows application still depend on it. What observable evidence would verify that the fix succeeded? Inspect NTLM audit events during representative business operations and verify identified workloads use approved alternatives after migration. Attempt logons from approved management hosts and unapproved workstations and inspect ticket and policy-related failures. Attempt controlled prohibited passwords at an on-premises domain controller and inspect agent and proxy health events. Inspect authentication events and confirm the service succeeds with an authorized Kerberos ticket while NTLM remains rejected. ExplanationCorrect Answer A:Inspect NTLM audit events during representative business operations and verify identified workloads use approved alternatives after migration. This evidence tests whether the team actually completed: Enable NTLM auditing first, identify remaining dependencies, and migrate them to supported authentication before enforcing restrictions. It addresses the risk because audit-before-block reveals services still using NTLM so that hardening does not unexpectedly interrupt legitimate authentication. Other Answers B:Authentication policy silos constrain where selected accounts are allowed to authenticate, reducing credential reuse outside approved hosts. The failure is checked more directly by a test to inspect NTLM audit events during representative business operations and verify identified workloads use approved alternatives after migration. C:The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. The failure is checked more directly by a test to inspect NTLM audit events during representative business operations and verify identified workloads use approved alternatives after migration. D:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. A more meaningful verification is to inspect NTLM audit events during representative business operations and verify identified workloads use approved alternatives after migration.
Question 68A security team wants to disable NTLM immediately, but a legacy printer service and a non-Windows application still depend on it. What control should be sustained after the immediate fix? Monitor agent coverage and update the banned-password policy when new password attack patterns appear. Periodically review silo membership and permitted host assignments after administrative workstation replacements. Publish a phased NTLM elimination plan with exception owners and monitor for renewed legacy usage. Maintain privileged-account application compatibility tests before adding accounts to protection groups. ExplanationCorrect Answer C:Publish a phased NTLM elimination plan with exception owners and monitor for renewed legacy usage. This preventive control maintains the intended protection because audit-before-block reveals services still using NTLM so that hardening does not unexpectedly interrupt legitimate authentication. The initial action remains: Enable NTLM auditing first, identify remaining dependencies, and migrate them to supported authentication before enforcing restrictions. Other Answers A:The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. The lasting safeguard is to publish a phased NTLM elimination plan with exception owners and monitor for renewed legacy usage. B:Authentication policy silos constrain where selected accounts are allowed to authenticate, reducing credential reuse outside approved hosts. The lasting safeguard is to publish a phased NTLM elimination plan with exception owners and monitor for renewed legacy usage. D:Protected Users membership restricts legacy credential exposure mechanisms, including NTLM-based authentication for supported domain accounts. Reducing this risk requires a practice to publish a phased NTLM elimination plan with exception owners and monitor for renewed legacy usage.
Question 69A newly promoted domain controller has no Microsoft Defender for Identity sensor and suspicious account reconnaissance is invisible in the cloud console. Which next corrective action best addresses this failure? Restrict logon and network access to domain controllers with scoped security policies and authorized management endpoints. Add privileged accounts to the RODC password-replication deny policy and review already cached credentials for necessary reset. Install and validate the supported Defender for Identity sensor on the domain controller with required permissions and connectivity. Deploy supported Microsoft Entra Password Protection proxy and DC agents, then enforce the policy after reviewing audit-mode rejections. ExplanationCorrect Answer C:Install and validate the supported Defender for Identity sensor on the domain controller with required permissions and connectivity. This resolves the observed failure because defender for Identity relies on correctly configured identity sensors and connected telemetry to detect suspicious AD-related behavior. A suitable acceptance check is: Generate an authorized test reconnaissance signal and confirm the sensor health and resulting security telemetry appear in the service. Other Answers A:Domain controller access control limits attack paths to tier-zero services independently of ordinary workstation network reachability. The corrective action for this requirement is to install and validate the supported Defender for Identity sensor on the domain controller with required permissions and connectivity. B:RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. A more relevant action is to install and validate the supported Defender for Identity sensor on the domain controller with required permissions and connectivity. D:The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. A more relevant action is to install and validate the supported Defender for Identity sensor on the domain controller with required permissions and connectivity.
Question 70A newly promoted domain controller has no Microsoft Defender for Identity sensor and suspicious account reconnaissance is invisible in the cloud console. Why does the proposed solution address the underlying problem? RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. Defender for Identity relies on correctly configured identity sensors and connected telemetry to detect suspicious AD-related behavior. The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. Domain controller access control limits attack paths to tier-zero services independently of ordinary workstation network reachability. ExplanationCorrect Answer B:Defender for Identity relies on correctly configured identity sensors and connected telemetry to detect suspicious AD-related behavior. The mechanism explains the corrective action: Install and validate the supported Defender for Identity sensor on the domain controller with required permissions and connectivity. The associated validation is: Generate an authorized test reconnaissance signal and confirm the sensor health and resulting security telemetry appear in the service. Other Answers A:RODC password replication policy controls which credential secrets a read-only domain controller may cache at a less trusted location. By contrast, defender for Identity relies on correctly configured identity sensors and connected telemetry to detect suspicious AD-related behavior. C:The on-premises Password Protection agents extend banned-password evaluation to AD DS password operations; cloud-only policy does not automatically enforce them. By contrast, defender for Identity relies on correctly configured identity sensors and connected telemetry to detect suspicious AD-related behavior. D:Domain controller access control limits attack paths to tier-zero services independently of ordinary workstation network reachability. In the stated system, defender for Identity relies on correctly configured identity sensors and connected telemetry to detect suspicious AD-related behavior.
