Microsoft
AZ-800 · Question #9
Case Study 1 - Fabrikam, Inc Overview Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle. Existing Environment On-premises Servers The…
The correct answer is An ExpressRoute gateway; An ExpressRoute circuit connection. The question requires selecting the correct steps to implement a Group Managed Service Account (gMSA) for an on-premises IIS application that runs on multiple servers, replacing individual domain user accounts.
Question
Case Study 1 - Fabrikam, Inc Overview Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle. Existing Environment On-premises Servers The on-premises network contains servers that run Windows Server as shown in the following table. DC1 hosts all the operation master roles. WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1. On-premises Network The New York and Seattle offices are connected by using redundant WAN links. The client computers in each office get IP addresses from their local DHCP server. DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses for the Seattle office. Identity Infrastructure The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service accounts use individual domain user accounts. All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com. The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant. Group Policy Objects (GPOs) The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table. Requirements Planned Changes Fabrikam identifies the following planned changes: Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1. Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be connected to Vnet1 by using ExpressRoute. Create three Azure file shares named newyorkhiles, seattlefiles, and companyfiles. Create a domain controller named dc3.corp.fabrikam.com in Vnet1. Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined. License all servers for Microsoft Defender for servers. Use Azure Policy to enforce configuration management policies on the servers in Azure and on- premises. Networking Requirements Fabrikam identifies the following networking requirements: Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over ExpressRoute. If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease. Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain. Security Requirements Fabrikam identifies the following security requirements: Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer. Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours. Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|. Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days. Prevent domain controllers from directly contacting hosts on the internet. File Sharing Requirements You need to configure the synchronization of Azure files to meet the following requirements: Ensure that seattlefiles syncs to FS2. Ensure that newyorkfiles syncs to FS1. Ensure that companyfiles syncs to both FS1 and FS2. Question Drag and Drop Question Which three actions should you perform in sequence to meet the security requirements for Webapp1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Answer:
Exhibit
Answer Area
Drag items
An ExpressRoute gatewayA virtual network gatewayAn ExpressRoute circuit connectionA Site-to-Site VPNAn Azure application gatewayAn on premises data gateway
Correct arrangement
- An ExpressRoute gateway
- An ExpressRoute circuit connection
Explanation
The question requires selecting the correct steps to implement a Group Managed Service Account (gMSA) for an on-premises IIS application that runs on multiple servers, replacing individual domain user accounts.
Approach. The scenario implies a need to modernize service account management for the on-premises IIS application 'Webapp1' running on multiple servers (WEB1 and WEB2), replacing existing individual domain user accounts. Group Managed Service Accounts (gMSAs) are the ideal solution for this multi-server scenario, providing automatic password management and simplified service principal name (SPN) management. The correct interaction involves dragging the following three actions into the 'Answer Area':
- 'Create the Key Distribution Services (KDS) root key in AD DS': This is a mandatory one-time prerequisite for enabling gMSAs in an Active Directory domain. Without the KDS root key, gMSAs cannot be created or used.
- 'Create a group managed service account (gMSA) in Active Directory': This step creates the actual gMSA object in Active Directory. When creating the gMSA, you specify which host servers (e.g., WEB1 and WEB2) are allowed to retrieve its password.
- 'Configure the IIS application pool to run as a specified user account': After the gMSA is created, the IIS application pool must be configured to use this gMSA as its identity. The gMSA is specified as a 'specified user account' in the format
Domain\gMSAName$(e.g.,corp\Webapp1GMSA$). This allows the application pool to leverage the benefits of the gMSA, including automatic password management and delegation.
Common mistakes.
- common_mistake. - 'Configure the IIS application pool to run as Network Service': While a valid option for IIS application pools, the Network Service account is a built-in local account with limited network access privileges and does not offer the benefits of a managed service account (like gMSA's automatic password management or multi-server support for network resource access). It does not fulfill the implied goal of migrating to a modern, secure managed identity for an application requiring network access across multiple servers. The second exhibit image shows this item incorrectly placed in the 'Answer Area'.
- 'Create a standalone managed service account (sMSA) in AD DS': sMSAs are designed for services running on a single server. Since Webapp1 runs on two servers (WEB1 and WEB2), a gMSA is the appropriate choice for a shared identity across multiple hosts.
- 'Create a system-assigned managed identity in Azure AD' / 'Create a user-assigned managed identity in Azure AD': These options are for managing identities for applications or services hosted in Azure. The scenario clearly describes an on-premises IIS application running on physical or virtual servers within Fabrikam's on-premises AD DS environment, making Azure AD managed identities irrelevant here.
- Not selecting all three required steps: Omitting the KDS root key creation or the final configuration of the application pool would lead to an incomplete or non-functional gMSA implementation.
Concept tested. This question primarily tests the understanding of Active Directory Group Managed Service Accounts (gMSAs) - their purpose, prerequisites (KDS root key), creation, and how to implement them for services like IIS in a multi-server on-premises environment. It also tests the ability to differentiate between various types of service identities (gMSA, sMSA, Network Service, traditional user accounts, Azure AD managed identities) and choose the most appropriate one for a given scenario.
Community Discussion
No community discussion yet for this question.