Authentic Microsoft Certification Exam AZ-802 Questions Answers

Register-PSSessionConfiguration -Path .\HyperVJeaConfig.pssc -Name ' HyperVJeaHelpDesk ' -Force

Just Enough Administration constrains what a remote user can do in a PowerShell session by combining a role capabilities file (.psrc, which lists exactly which cmdlets, functions, and parameters a given role is allowed to use -- for example, a curated subset of the Hyper-V module ' s cmdlets) with a session configuration file (.pssc, generated by New-PSSessionConfigurationFile, which ties one or more role capabilities to security principals and session-wide restrictions). Once the .pssc file has been authored, it must be registered as an actual, connectable PowerShell endpoint on Server1 using Register-PSSessionConfiguration, specifying the .pssc file ' s path and a name for the resulting endpoint; -Force allows the registration to proceed even if a session configuration by that name already exists or the WinRM service needs restarting. Enter-PSSession simply starts an interactive remoting session against an existing endpoint and plays no role in creating or registering one. New-PSSessionConfigurationFile only creates the .pssc content -- it does not make the file usable as an actual session endpoint that remote users can connect to. Registering the wrong file type, such as a .ps1 script or .psm1 module, would fail, since Register-PSSessionConfiguration ' s -Path parameter specifically expects a .pssc session configuration file. Therefore, the command must be Register-PSSessionConfiguration -Path .\HyperVJeaConfig.pssc -Name ' HyperVJeaHelpDesk ' -Force.

User1 can use self-service password reset (SSPR) to reset his password: Yes. If User1 connects to Microsoft Exchange Online, an on-premises domain controller provides authentication: Yes. You can add User2 to Group1 as a member: No.

User1 ' s account lives in OU1, which is included in the Microsoft Entra Connect sync scope, so User1 has a corresponding, synced object in the tenant; with password writeback enabled and no other blocking configuration indicated, a synced user like User1 can use self-service password reset, and the reset password is written back to on-premises AD DS as well. Because password hash synchronization is explicitly disabled and pass-through authentication is enabled instead, cloud sign-in for synced users is validated by the pass-through authentication agent relaying the credential check to an on-premises domain controller in real time, rather than against a cloud-stored hash; so when User1 signs in to a cloud service such as Exchange Online, authentication is indeed provided by an on-premises domain controller through the PTA agent. User2, however, belongs to OU2, which was not selected in the Domain/OU filtering configuration, so User2 has no corresponding object synced into the tenant at all. Group1 is a group in the tenant (a cloud-side security group), and because User2 has no synced cloud identity to reference, User2 cannot be added as a member of Group1 — there is simply no cloud object representing User2 to add.

Because a domain-wide Group Policy Object already enforces Credential Guard with UEFI lock across all domain members, that policy setting is authoritative and will simply reapply the enabled, UEFI-locked Credential Guard configuration to Server1 the moment Group Policy next refreshes, entirely regardless of whatever one-time local change was just made to disable it. For the currently disabled state on Server1 to actually persist rather than being silently overwritten at the next policy refresh, the governing Group Policy Object itself has to be updated so that its Turn On Virtualization Based Security setting is no longer configured to enforce Credential Guard for the organizational unit or scope that Server1 falls under; only changing the policy that controls this setting stops Group Policy from re-asserting Credential Guard on Server1. Running the Device Guard and Credential Guard hardware readiness tool only assesses hardware compatibility and makes no configuration changes at all, and running dism with the /Disable-Feature and /FeatureName:IsolatedUserMode parameters only changes local machine state, which, exactly like the earlier local disable action, would simply be reverted the next time the domain-wide Group Policy setting reapplies to Server1.