nerdexam

70-158 · Question #85

Your company network uses Forefront Identity Manager (FIM) 2010 to synchronize user accounts in an Active Directory Domain Services (AD DS) domain. The contoso.com domain contains a FIM server named…

The correct answer is B. Run the following command on LON-DC1. To configure SPN records for PCNS, register an SPN using the setspn -A command with the FQDN of the FIM server and the FIM service account on a domain controller.

Submitted by valeria.br· Mar 4, 2026Configure Password Management

Question

Your company network uses Forefront Identity Manager (FIM) 2010 to synchronize user accounts in an Active Directory Domain Services (AD DS) domain. The contoso.com domain contains a FIM server named FIM-SRV-1 and a domain controller named LON-DC1. The FIM service account is named FIMSvcAcct. You need to configure Service Principal Name (SPN) records in AD DS for Password Change Notification Service (PCNS). What should you do?

Options

  • ARun the following command on FIM-SRV-1:
  • BRun the following command on LON-DC1:
  • CRun the following command on LON-DC1:
  • DRun the following command on FIM-SRV-1:

How the community answered

(34 responses)
  • A
    3% (1)
  • B
    82% (28)
  • C
    3% (1)
  • D
    12% (4)

Why each option

To configure SPN records for PCNS, register an SPN using the `setspn -A` command with the FQDN of the FIM server and the FIM service account on a domain controller.

ARun the following command on FIM-SRV-1:

This command incorrectly specifies only the hostname `FIM-SRV-1` instead of the Fully Qualified Domain Name `FIM-SRV-1.contoso.com` in the SPN, which can lead to Kerberos authentication failures.

BRun the following command on LON-DC1:Correct

The `setspn -A` command registers an SPN in Active Directory, associating the FIM Password Change Notification Service (FIM-PCNS) running on the FIM server (FIM-SRV-1.contoso.com) with its service account (FIMSvcAcct). Using the Fully Qualified Domain Name (FQDN) for the host component of the SPN is critical for reliable Kerberos authentication, ensuring that clients can correctly resolve and authenticate to the service regardless of how they refer to the server.

CRun the following command on LON-DC1:

This command incorrectly specifies only the hostname `FIM-SRV-1` instead of the Fully Qualified Domain Name `FIM-SRV-1.contoso.com` in the SPN, which can lead to Kerberos authentication failures.

DRun the following command on FIM-SRV-1:

This command incorrectly specifies only the hostname `FIM-SRV-1` instead of the Fully Qualified Domain Name `FIM-SRV-1.contoso.com` in the SPN, which can lead to Kerberos authentication failures.

Concept tested: Kerberos Service Principal Name (SPN) configuration for FIM PCNS

Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/setspn

Topics

#PCNS#SPN configuration#Active Directory#FIM 2010

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 70-158 Practice