nerdexam
Microsoft

AZ-801 · Question #44

You have a server named Server1 that runs Windows Server and has the Hyper-V server role installed. You have a Hyper-V failover cluster named Cluster1. All servers are members of the same domain…

The correct answer is D. From Windows Defender Firewall with Advanced Security, enable the Hyper-V Replica HTTP Listener (TCP-In) rule. To enable Hyper-V Replica with Kerberos authentication on the default port for incoming replication to a standalone server, the Hyper-V Replica HTTP Listener (TCP-In) firewall rule must be enabled.

Implement disaster recovery

Question

You have a server named Server1 that runs Windows Server and has the Hyper-V server role installed. You have a Hyper-V failover cluster named Cluster1. All servers are members of the same domain. You need to ensure that you use Hyper-V Replica with Kerberos authentication on the default port to replicate virtual machines from Cluster1 to Server1. What should you do on Server1?

Options

  • AAdd primary servers to the Hyper-V Replica Broker configuration.
  • BFrom Hyper-V Settings, select Enable incoming and outgoing live migrations
  • CFrom Windows Defender Firewall with Advanced Security, enable the Hyper-V Replica HTTPS Listener (TCP-In) rule.
  • DFrom Windows Defender Firewall with Advanced Security, enable the Hyper-V Replica HTTP Listener (TCP-In) rule.

How the community answered

(32 responses)
  • A
    13% (4)
  • B
    3% (1)
  • C
    3% (1)
  • D
    81% (26)

Why each option

To enable Hyper-V Replica with Kerberos authentication on the default port for incoming replication to a standalone server, the Hyper-V Replica HTTP Listener (TCP-In) firewall rule must be enabled.

AAdd primary servers to the Hyper-V Replica Broker configuration.

Adding primary servers to the Hyper-V Replica Broker configuration is relevant for a replica cluster, not a standalone replica server, and does not configure the authentication method.

BFrom Hyper-V Settings, select Enable incoming and outgoing live migrations

Enabling incoming and outgoing live migrations is unrelated to Hyper-V Replica and its authentication mechanism, as live migration is for moving running VMs.

CFrom Windows Defender Firewall with Advanced Security, enable the Hyper-V Replica HTTPS Listener (TCP-In) rule.

The Hyper-V Replica HTTPS Listener (TCP-In) rule is used for certificate-based authentication (HTTPS, port 443), not Kerberos authentication which uses HTTP.

DFrom Windows Defender Firewall with Advanced Security, enable the Hyper-V Replica HTTP Listener (TCP-In) rule.Correct

Kerberos authentication for Hyper-V Replica uses the HTTP protocol, which by default operates on TCP port 80. Enabling the "Hyper-V Replica HTTP Listener (TCP-In)" rule in Windows Defender Firewall on the replica server opens this port and allows incoming Kerberos-authenticated replication traffic.

Concept tested: Hyper-V Replica Kerberos authentication configuration

Source: https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/manage/set-up-hyper-v-replica

Topics

#Hyper-V Replica#Kerberos authentication#Firewall configuration#Disaster Recovery

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-801 Practice