nerdexam
Microsoft

AZ-800 · Question #224

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a user named User1. User1 is a member of a group named Group1 and is in an organizational unit (OU)…

The correct answer is A. 7. The effective minimum password length for User1 is 7, as password policies in Active Directory are typically enforced by the Default Domain Policy unless Fine-Grained Password Policies are configured.

Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments

Question

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a user named User1. User1 is a member of a group named Group1 and is in an organizational unit (OU) named OU1. The domain has minimum password lengths configured as shown in the following table. What is the minimum password length that User1 should use when changing to a new password?

Exhibit

AZ-800 question #224 exhibit

Options

  • A7
  • B8
  • C10
  • D12
  • E14

How the community answered

(59 responses)
  • A
    85% (50)
  • B
    2% (1)
  • C
    8% (5)
  • D
    2% (1)
  • E
    3% (2)

Why each option

The effective minimum password length for User1 is 7, as password policies in Active Directory are typically enforced by the Default Domain Policy unless Fine-Grained Password Policies are configured.

A7Correct

Password policies, including minimum password length, are applied at the domain level by the Default Domain Policy or a GPO linked directly to the domain root. GPOs linked to OUs or applied via security filtering to groups will not override the domain's password policy for domain user accounts unless Fine-Grained Password Policies are explicitly implemented, which is not indicated here.

B8

8 is not the minimum length specified by the Default Domain Policy or any applicable GPO for domain users.

C10

10 is the length from a GPO linked to OU1, but OU-linked GPOs do not override the domain-level password policy for domain accounts.

D12

12 is the length from a GPO linked to Group1, but group-filtered GPOs do not override the domain-level password policy for domain accounts.

E14

14 is not a specified password length from any of the given GPOs.

Concept tested: GPO password policy application precedence

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-policy

Topics

#Active Directory#Group Policy#Password Policy#GPO Precedence

Community Discussion

No community discussion yet for this question.

Full AZ-800 Practice