Drag and Drop Question Your network contains an Active Directory domain named contoso.com. The domain contains group managed service accounts (gMSAs). You have a server named Server1 that runs…

Question

Exhibit

Answer Area

Explanation

This question tests the sequential steps required to enable Windows containers on a workgroup server to authenticate to an Active Directory domain using group managed service accounts (gMSAs).

Approach. The correct interaction involves dragging three specific actions into the answer area and arranging them in the following sequence:

1. In contoso.com, create a gMSA and a standard user account.

   • Reasoning: The first logical step is to create the Group Managed Service Account (gMSA) in Active Directory that the Windows containers will use for authentication. Even though the question states gMSAs already exist, a specific gMSA for these containers might be needed, or the action serves as the foundational step for enabling gMSA use. The KDS root key is a prerequisite for any gMSA, and if gMSAs already exist, the KDS root key is already present, so creating it again is not necessary.

2. From a domain-joined computer, create a credential spec file and copy the file to Server1.

   • Reasoning: Since Server1 is in a workgroup (non-domain-joined), containers on it cannot directly retrieve gMSA credentials from Active Directory. A credential spec file acts as a proxy, containing the necessary gMSA information. This file must be created on a domain-joined computer because it needs to query Active Directory to generate the specification. Once created, it is then copied to the workgroup Server1.

3. On Server1, install and run ccg.exe.

   • Reasoning: After the credential spec file is copied to the workgroup Server1, it needs to be installed or registered on the host machine. The ccg.exe utility (Credential Guard utility for containers) is used to import the credential spec file, making it available for the container runtime to use for authentication.

Common mistakes.

• common_mistake. Selecting 'On Server1, run New-CredentialSpec.' is incorrect because the New-CredentialSpec cmdlet is used to create the credential spec file, which requires querying Active Directory and thus must be run on a domain-joined computer, not the workgroup Server1.

Including 'In contoso.com, generate a Key Distribution Service (KDS) root key.' as a required step (especially as the first step) is incorrect in this scenario because the question states 'The domain contains group managed service accounts (gMSAs).' If gMSAs already exist, it implies the KDS root key has already been generated in the domain, as it's a prerequisite for gMSAs to function. Therefore, this action is redundant and not part of the necessary sequence for this specific problem.

Incorrect sequencing, such as trying to run ccg.exe before the credential spec file is copied to Server1 or before the gMSA is created in AD, would also fail because of fundamental dependencies.

Concept tested. This question tests the understanding of Group Managed Service Accounts (gMSAs) for Windows containers, specifically the steps involved in configuring them for containers running on a non-domain-joined (workgroup) host. Key concepts include gMSA creation, the role and creation of credential spec files for workgroup hosts, and the use of the ccg.exe utility for importing credential specs.

No community discussion yet for this question.