In a forest trust, the default setting "Forest-wide authentication" allows all authenticated users from the trusted forest to be authenticated to any resource in the trusting forest. The AZ-800 materials explain that to limit who can authenticate across a forest trust, you must switch the trust to Selective authentication and then grant the Allowed to authenticate permission on the specific computer objects to the groups you choose.
The guide states that with selective authentication, "accounts from the trusted forest are not permitted to authenticate to computers in the trusting forest unless they have been explicitly granted the Allowed to authenticate permission on those computers." This approach is designed for scenarios with multiple domains
/large forests where you must restrict access to a subset of servers. By contrast, SID filtering mitigates SID- history misuse and does not control who may authenticate. Changing to an external trust would remove transitivity and is unnecessary. Adding the group to the local Users group would not prevent other fabrikam users from authenticating as long as forest-wide authentication is enabled. Therefore, the first step is to enable Selective authentication on the contoso#fabrikam forest trust; next, you would grant Allowed to authenticate on Server1 to fabrikam\Group1.

The Azure Active Directory Domain Services (Azure AD DS) section of the AZ-800 materials clarifies the administrative model in a managed domain: "Azure AD DS does not expose Enterprise Admins or Schema Admins. Instead, members of the AAD DC Administrators group are granted delegated privileges to manage the managed domain, including DNS and Group Policy." It explicitly notes: "To create, edit, and link Group Policy Objects in an Azure AD DS managed domain, the user must be a member of the AAD DC Administrators group." While Group Policy Creator Owners is used in traditional AD to allow GPO creation, in Azure AD DS least-privilege administration for GPOs is delegated through AAD DC Administrators. The built-in Domain Admins, Enterprise Admins, and Schema Admins roles are not applicable/available in the Azure AD DS managed domain context. Therefore, to follow the principle of least privilege and enable GPO management in Azure AD DS, add the administrator to AAD DC Administrators.

In the Administering Windows Server Hybrid Core Infrastructure materials for file services, Microsoft emphasizes using File Server Resource Manager (FSRM) to control which file types users can store on shares.
FSRM provides File Screening Management that "controls the types of files that users can save" on a path by matching file groups (extensions) and applying either active screening (block) or passive screening (allow but report). The guides further note that you can "create file screen templates to standardize settings and apply them to multiple folders or servers," minimizing repeated administration across many file servers.
To meet the requirement "block users from uploading video files that have the .mov extension... All other types of files must be allowed," you create a File Screen with Active screening on the shared folders (or their parent paths) using a File Group that contains *.mov. This directly prevents writes of the specified extension while permitting other files.
By contrast, Dynamic Access Control (DAC) central access policies/rules govern authorization based on claims and resource properties, not file extensions. A DLP policy targets Microsoft 365 workloads and sensitive information types rather than enforcing extension-based blocking on Windows Server SMB shares.
Therefore, the least-effort and purpose-built solution is an FSRM file screen.

In the Administering Windows Server Hybrid Core Infrastructure content for identity synchronization and password management, Microsoft specifies that self-service password reset (SSPR) for hybrid users requires password writeback through Azure AD Connect. The materials state: "Password writeback enables Azure AD to write password changes made in the cloud back to your on-premises Active Directory. This feature is required to allow users who reset their passwords using SSPR to use those new passwords when authenticating to on-premises resources." The configuration steps emphasize: "Run the Azure AD Connect wizard and enable Password writeback." By contrast, the Azure AD Password Protection proxy pertains to banned password enforcement and does not perform writeback, and granting extra rights to the sync account does not replace enabling the writeback capability in the connector. Therefore, enabling Password writeback in Azure AD Connect is the correct and required action to ensure SSPR changes are reflected in the on-premises AD DS domain.

Explanation:

The Administering Windows Server Hybrid Core Infrastructure materials explain that Azure AD Password Protection for on-premises AD uses two components: the DC agent and the proxy service. The DC agent is installed on every domain controller because it "intercepts password set/change operations locally on the DC and evaluates them against the forbidden-password policy." The guidance further states that to ensure consistent enforcement "the DC agent should be deployed to all DCs in the forest, since password changes may occur on any DC." The proxy service is installed on member servers (not necessarily DCs) and "relays policy downloads and telemetry to Azure AD on behalf of DCs," which satisfies environments where "domain controllers must not directly contact Internet endpoints." Finally, configuration of the global and custom banned password lists is performed in Azure AD, where administrators "define tenant- wide custom banned terms; DCs obtain the policy via the proxy and cache it for local enforcement." Given Fabrikam's requirement to prevent DCs from accessing the Internet, the proxy must run on non-DC servers (VM1 and VM2). To guarantee enforcement wherever a password is changed, the DC agent must be on all domain controllers. The custom banned password list is configured in the Azure AD tenant and then distributed to on-premises DCs via the proxy.