Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains a user named User1 and the servers shown in the following table.
User1 is a member of the Protected Users security group.
User1 performs the following actions:
* From Server1, establishes a remote PowerShell session on Server2
* From the PowerShell session on Server2, attempts to access a resource on Backup1
The request to access the resource on 8ackup1 is denied.
You need to ensure that User1 can access the resources on Backup1 by using the PowerShell session on Server2. The solution must follow the principle of least privilege and minimize administrative effort.
What should you configure?
SIMULATION
Task 5
You have an application that is copied to a folder named C:\app on SRV1. C:\app also contains also a Dockerfile for the app.
On SRV1. you need to create a container image for the application by using the Dockerfile. The container image mutt be named app1.
Explore
To create a container image named app1 for your application using the Dockerfile in the C:\app directory on SRV1, follow these steps:
Step 1: Open PowerShell or Command Prompt First, open PowerShell or Command Prompt on SRV1.
Step 2: Navigate to the Application Directory Change to the directory where your application and Dockerfile are located:
cd C:\app
Step 3: Build the Container Image Use the docker build command to create the container image. The -t flag tags the image with the name app1:
docker build -t app1 .
The period . at the end of the command tells Docker to use the Dockerfile in the current directory.
Step 4: Verify the Image Creation After the build process completes, verify that the image app1 has been created successfully by listing all images:
docker images
You should see app1 in the list of images.
Step 5: Use the Image Now, you can use the image app1 to run containers or push it to a container registry if needed.
SIMULATION
Task 7
You need to monitor the security configuration of DC1 by using Microsoft Defender for Cloud.
The required source files are located in a folder named \\dc1.contoso.com\install.
One possible solution to monitor the security configuration of DC1 by using Microsoft Defender for Cloud is to use the Guest Configuration feature. Guest Configuration is a service that audits settings inside Linux and Windows virtual machines (VMs) to assess their compliance with your organization's security policies. You can use Guest Configuration to monitor the security baseline settings for Windows Server in the Microsoft Defender for Cloud portal by following these steps:
On DC1, open a web browser and go to the folder named \dc1.contoso.com\install. Download the Guest Configuration extension file (GuestConfiguration.msi) and save it to a local folder, such as C:\Temp.
After the installation is complete, sign in to the Microsoft Defender for Cloud portal (2).
In the left pane, selectSecurity Centerand thenRecommendations.
In the recommendations list, find and selectVulnerabilities in security configuration on your Windows machines should be remediated (powered by Guest Configuration).
To view the details of the security configuration of DC1, click on the VM name and then selectView details. You can see the list of rules that apply to DC1 and their compliance status. You can also see the severity, description, and remediation steps for each rule. For example, you can see if DC1 has the latest security updates installed, if the firewall is enabled, if the password policy is enforced, and so on.
To monitor the security configuration of DC1 over time, you can use theCompliance over timechart, which shows the trend of compliance status for DC1 in the past 30 days. You can also use theCompliance breakdownchart, which shows the distribution of compliance status for DC1 by rule severity.
By using Guest Configuration, you can monitor the security configuration of DC1 by using Microsoft Defender for Cloud and ensure that it meets your organization's security standards. You can also use Guest Configuration to monitor the security configuration of other Windows and Linux VMs in your Azure environment.
SIMULATION
Task 8
You need to create an Active Directory Domain Services (AD DS) site named Site2 that is associated to an IP address range of 192.168.2.0 to 192.168.2.255.
To create an AD DS site named Site2 that is associated to an IP address range of 192.168.2.0 to 192.168.2.255, you can follow these steps:
On a domain controller or a computer that has the Remote Server Administration Tools (RSAT) installed, openActive Directory Sites and Servicesfrom theAdministrative Toolsmenu or by typingdssite.mscin the Run box.
In the left pane, right-click onSitesand selectNew Site.
In the left pane, right-click onSubnetsand selectNew Subnet.
In theNew Object - Subnetdialog box, enter192.168.2.0/24as thePrefixof the subnet. This notation represents the IP address range of 192.168.2.0 to 192.168.2.255 with a subnet mask of 255.255.255.0. SelectSite2as theSite objectto associate the subnet with, and clickOK.
Wait for the changes to replicate to other domain controllers. You can verify the site and subnet creation by checking theSitesandSubnetscontainers in Active Directory Sites and Services.
Now, you have created an AD DS site named Site2 that is associated to an IP address range of 192.168.2.0 to 192.168.2.255. You can add domain controllers to the new site and configure the site links and site link bridges to optimize the replication topology.
SIMULATION
Task 9
You plan to create group managed service accounts (gMSAs).
You need to configure the domain to support the creation of gMSAs.
To configure the domain to support the creation of gMSAs, you need to perform the following steps:
On a domain controller or a computer that has the Remote Server Administration Tools (RSAT) installed, open PowerShell as an administrator and run the following command to install the Active Directory module:
Install-WindowsFeature -Name RSAT-AD-PowerShell
Run the following command to create a Key Distribution Service (KDS) root key, which is required for generating passwords for gMSAs. You only need to do this once per domain:
Add-KdsRootKey -EffectiveImmediately
Weldon
1 days agoSelma
6 days agoBuddy
17 days agoAlfred
21 days agoJesusita
23 days agoAnnabelle
1 months agoNell
1 months agoCammy
2 months agoZona
2 months agoPaulina
2 months agoBrock
2 months agoNohemi
2 months agoGlory
3 months agoRoselle
3 months agoStevie
3 months agoClaudia
3 months agoAlecia
4 months agoCecilia
5 months agoXochitl
5 months agoKenny
6 months ago