Group Policy Preferences support Item-Level Targeting (ILT), allowing a preference item to apply only when the target computer meets specified criteria, such as operating system family and version. The AZ-800 study content notes that when a GPO is linked at the domain level, scope is all domain computers, but ILT on a specific preference item restricts that item to clients that match the ILT filter; non-matching clients still process the GPO but skip the filtered item. In the Targeting Editor shown, the condition is "the operating system is Windows Server 2022 Family." Among the listed machines: Computer1 (Windows 11), Server1 (Windows Server 2016), Server2 (Windows Server 2019), and Server3 (Windows Server 2022). Only Server3 satisfies the ILT. Therefore, the shortcut preference Shortcut1 is applied only to Server3.

In Azure IaaS networking, a single network interface (NIC) can be attached to one subnet only. The AZ-
800 "Administering Windows Server Hybrid Core Infrastructure" study guidance for managing Windows Server IaaS VMs explains that NICs define the VM's Layer-3 placement and that "a NIC is associated with exactly one subnet; multiple IP configurations on a NIC must use addresses from the same subnet." Consequently, simply modifying the IP configuration of Nic1 (Option A) or adding a secondary IP configuration to Nic1 (Option C) will not move that interface into a second subnet; it only allows additional private IPs from the same subnet as the NIC's primary configuration.
To place the VM on Vnet1/Subnet2 in addition to Vnet1/Subnet1, you must multihome the VM by adding a second NIC that is attached to Vnet1/Subnet2 (Option B). The AZ-800 materials note that multinic support depends on the VM size, and that after adding the NIC you may need to adjust Windows networking (routing, binding order, firewall rules) to ensure the network management application listens on the correct interface(s). Private endpoints (Option D) are for securely exposing PaaS resources into a subnet and do not connect a VM to another subnet. Therefore, the only correct method to connect Server1 to an additional subnet is to add another network interface and attach it to Subnet2.

Explanation:

The Administering Windows Server Hybrid Core Infrastructure guidance for AD DS promotion and forest operations states that adding a new domain controller to an existing domain requires credentials that "are a member of Domain Admins in the target domain (or equivalent delegated rights)." This is the minimum built-in role permitted to run AD DS installation and write to the domain's configuration containers for DC promotion. Therefore, to add an additional DC in east.contoso.com, the least-privilege group for User1 is EAST\Domain Admins.
For creating a new domain (child domain or new tree) in an existing forest, the exam materials specify that this is a forest-wide operation handled by the Domain Naming Master and requires enterprise-level permissions: "to create or remove domains in a forest, you must use an account that is a member of the Enterprise Admins group." Domain Admins in a single domain are insufficient because the task modifies forest-level naming contexts. Thus, to deploy the first DC for west.contoso.com, the least-privilege role that satisfies the requirement for User2 is CONTOSO\Enterprise Admins.
These selections follow the principle of least privilege: User1 is scoped to the child domain's administration only, while User2 receives the forest-level rights necessary to add a new domain.

To run a container on SRV1 using the mcrmicrosoft.com/windows/servercofe/iis image, publish port 80 on the container to port 5001 on SRV1, and ensure it runs in the background, you can follow these steps:
Step 1: Pull the IIS Image First, pull the correct IIS image from the Microsoft Container Registry:
docker pull mcr.microsoft.com/windows/servercore/iis
Step 2: Run the Container Next, run the container with the required port mapping and ensure it runs in the background using the -d flag:
docker run -d -p 5001:80 --name iis_container mcr.microsoft.com/windows/servercore/iis This command will start a container named iis_container using the IIS image, map port 80 inside the container to port 5001 on SRV1, and run the container in detached mode.
Step 3: Verify the Container is Running To verify that the container is running and the port is published, use the following command:
docker ps
This will list all running containers and show the port mappings.
Step
4: Access the IIS Server You can now access the IIS server running in the container by navigating to http://
<SRV1_IP>:5001 in a web browser, where <SRV1_IP> is the IP address of SRV1.
Note: Ensure that Docker is installed on SRV1 and that the port 5001 is open on the firewall to allow incoming connections1.
By following these steps, you should be able to run the IIS container on SRV1 with the specified port mapping and have it running in the background. Please replace mcrmicrosoft.com/windows/servercofe/iis with the correct image name mcr.microsoft.com/windows/servercore/iis as shown in the commands above.