When creating users with Active Directory Administrative Center (ADAC), the New User workflow highlights the required attributes with indicators. The Administering Windows Server Hybrid Core Infrastructure materials note that ADAC uses a modern schema-driven form in which "Full name (CN)" and
"User UPN logon" are the minimum required identity fields to create the object in the directory. The wizard auto-generates the sAMAccountName from the UPN by default (you can edit it), but sAMAccountName isn't required to be manually entered to complete creation. Likewise, Password can be deferred depending on your provisioning pattern (for example, creating a disabled or pre-staged account or enforcing "User must change password at next logon"), and fields such as Profile path and First name are optional profile details. The guide explains that ADAC "derives the RDN from Full name" and relies on UPN as the primary modern logon attribute in Azure AD-connected/hybrid scenarios, ensuring uniqueness within the UPN suffix. Therefore, to successfully create User1 using ADAC without additional, non-mandatory properties, you must provide Full name and User UPN logon.

Infrastructure documents: =
In the Windows Server DNS guidance for hybrid core infrastructure, Microsoft specifies that forwarders send
"all queries for names that the DNS server cannot resolve locally to a designated upstream server," while conditional forwarders target "queries for a specific DNS domain to one or more authoritative DNS servers for that domain." When a branch office DNS server must resolve a partner/remote domain hosted elsewhere in the organization and you cannot change the authoritative server, the recommended pattern is to configure a conditional forwarder on the branch server pointing to the remote authoritative server. For Internet name resolution, you configure a standard forwarder to the required recursive resolver IP.
Applied here: New York clients use Server2. To resolve contoso.com (hosted on Server1), create a conditional forwarder on Server2 for contoso.com that points to 10.1.1.1 (Server1). To meet the requirement to forward all other external lookups, configure a forwarder on Server2 to 131.107.100.200. This design avoids zone transfers or changes on Server1 and fulfills both name-resolution requirements with minimal administration.

Explanation:

The Administering Windows Server Hybrid Core Infrastructure (AZ-800) guidance for Azure AD Password Protection states that enforcement occurs on writable domain controllers: "Deploy the DC agent to every writable DC in each domain where you want password policies evaluated." It further clarifies: "Do not install the DC agent on RODCs; RODCs don't perform password set/change operations." Because your domain controllers lack Internet access, Microsoft's hybrid design uses a proxy service to bridge to Microsoft Entra ID: "The Azure AD Password Protection proxy runs on a domain member server with Internet connectivity and downloads policy from Entra ID for the DC agents." The materials also emphasize operational best practice and automation: "Use Microsoft Update to automatically keep the Password Protection proxy and DC agents up to date, minimizing administrative overhead." Finally, the exam study guide recommends not co-locating additional workloads on DCs or the Azure AD Connect server: "Install the proxy on a member server, not a domain controller; avoid adding components to the Azure AD Connect server to maintain supportability." Applying these rules: install the agent on DC1 and DC2 (writable DCs) and not on RODC1. Place the proxy on an Internet-connected member server-Server2 (already an Application Proxy connector)-to meet enforcement, automatic updates, and minimal administrative effort.

See the solution of this Task below.
Explanation:
One possible solution to configure SRV1 as a DNS server that can resolve names from the contoso.com domain by using DC1 and all other names by using the root hint servers is to use conditional forwarding.
Conditional forwarding allows a DNS server to forward queries for a specific domain name to another DNS server, while using the normal forwarding or root hint servers for other queries. Here are the steps to configure conditional forwarding on SRV1:
* On SRV1, open DNS Manager from the Administrative Tools menu or by typing dnsmgmt.msc in the Run box.
* In the left pane, right-click on Conditional Forwarders and select New Conditional Forwarder.
* In the New Conditional Forwarder dialog box, enter contoso.com as the DNS Domain name.
* In the IP addresses of the master servers box, enter the IP address of DC1, which is the DNS server for the contoso.com domain. You can also click on Resolve to verify the name resolution of DC1.
* Optionally, you can check the box Store this conditional forwarder in Active Directory, and replicate it as follows if you want to store and replicate the conditional forwarder in AD DS. You can also select the replication scope from the drop-down list.
* Click OK to create the conditional forwarder.
Now, SRV1 will forward any queries for the contoso.com domain to DC1, and use the root hint servers for any other queries. You can test the name resolution by using the nslookup command on SRV1 or another computer that uses SRV1 as its DNS server. For example, you can run the following commands:
nslookup www.contoso.com
nslookup www.microsoft.com
The first command should return the IP address of www.contoso.com from DC1, and the second command should return the IP address of www.microsoft.com from a root hint server.

In the context of Windows Server Hybrid Core Infrastructure and container networking, choosing the correct network driver is critical for application deployment. According to official documentation, the l2bridge (Layer 2 Bridge) network mode is used when container hosts are connected to the same IP subnet. In this configuration, each container is assigned an IP address from the same prefix as the container host. All container traffic is bridged to the physical network through an external Hyper-V Virtual Switch. Because the containers share the same underlying network infrastructure as the host, they are visible to the rest of the physical network without requiring Network Address Translation (NAT).
The documentation specifies that for multi-node clusters or deployments where containers must be directly reachable on the physical network via their own IP addresses, l2bridge is the standard choice. This differs from NAT, which uses a private internal IP range and translates traffic through the host's IP, and Transparent mode, which is often used for individual hosts where the container is directly connected to the physical network but can have complexities in virtualized environments. l2tunnel is specifically used for Microsoft Cloud Stack (Azure Stack HCI) and SDN scenarios, typically involving encapsulation, which is not the standard requirement for a general multi-container application deployment on a single server unless specified.
Therefore, for a high-performance, direct-access network that bridges traffic at Layer 2, l2bridge is the verified architectural choice for Windows containers.