In the Administering Windows Server Hybrid Core Infrastructure materials under Hyper-V management, Microsoft specifies that Enhanced Session Mode changes VMConnect from a raw console attach to a connection that uses Remote Desktop Protocol (RDP) to the guest. The guide states that Enhanced Session Mode "uses RDP to establish the VMConnect session so the user must supply credentials for a logon to the guest operating system," and further that it "prevents a second administrator from inheriting an already signed-in console session" because the connection is treated as a new interactive sign-in. In contrast, the default basic console session "attaches directly to the active console without prompting for credentials
," which is exactly the current problem described for VM2.
The same objective area clarifies that other options do not meet the requirement: Guest Services integration only enables file copy and certain host-guest interactions; Credential Guard protects secrets inside Windows by isolating LSASS but does not affect Hyper-V console connection behavior; Shielded VMs provide fabric-level protections and encryption but are not required merely to force credential prompts for VMConnect.
Therefore, to force users to provide credentials when they connect to VM2 and to eliminate inherited console sessions, you should enable Enhanced Session Mode on the Hyper-V host (and ensure the guest supports RDP).

To ensure that all objects, specifically Computer1, can be used in Conditional Access (CA) policies, the environment must support device-based identity in the cloud. In a hybrid scenario, while user objects and security groups (like Group1 and Group2) can be synchronized through standard Azure AD Connect (Microsoft Entra Connect) synchronization cycles, computer objects require specific configuration to become
"identifiable" by Conditional Access.
According to the official study guides for the AZ-800 exam, simply syncing a computer object does not make it a "Hybrid Azure AD joined" device. To enable Computer1 to be used as a target or a condition (e.g.,
"Require Hybrid Azure AD joined device") in a CA policy, you must run the Azure AD Connect wizard and select the Configure Hybrid Azure AD join task. This process configures a Service Connection Point (SCP) in your on-premises Active Directory, which allows Windows 10/11 devices like Computer1 to discover the Azure AD tenant and complete the registration process.
Furthermore, while group scopes (Universal vs. Domain Local) are often discussed in sync scenarios, Azure AD Connect by default synchronizes security groups regardless of their scope if they are within the synchronized Organizational Units (OUs). Therefore, the critical step to satisfy the requirement for "all objects"-especially the computer account-is enabling the Hybrid Join feature to establish a cloud-side device identity. This provides the necessary "device signal" that Conditional Access evaluates to grant or deny access.

In Windows Server environments that use Switch Embedded Teaming (SET) with RDMA/SMB Direct, Microsoft's hybrid server administration guidance specifies validating Data Center Bridging (DCB) and RDMA prerequisites before you place the hosts into a cluster. The Validate-DCB PowerShell cmdlet (from the DataCenterBridging module) is the purpose-built tool to confirm that Priority-based Flow Control (PFC), ETS/QoS policies, and SMB Direct priorities are consistently configured and operational across adapters and vSwitch/SET configurations. The study content emphasizes that resilient RDMA requires correct DCB on every host NIC participating in SMB Direct, and that Validate-DCB "verifies RDMA readiness and flags misconfiguration," including priority mappings and host settings needed for failover clustering. By contrast, Server Manager and Failover Cluster Manager do not test DCB/RDMA health at the NIC policy level, and Get-NetAdapter only reports adapter state (for example, RDMA enabled/disabled) without end-to-end policy validation. Therefore, when you must "verify that RDMA and required Windows Server settings are configured properly on each server" prior to building the cluster, the documented and supported method is to run Validate-DCB on each Hyper-V host with SET. This aligns with the exam objectives for validating network offloads and SMB Direct for cluster deployments in hybrid infrastructures.

Explanation:

Infrastructure documents: =
In Just Enough Administration (JEA), you restrict what remote users can do by creating two artifacts: role capability files (*.psrc) and a session configuration file (*.pssc). The role capability file defines which commands are visible/usable (for example, specific Hyper-V cmdlets via VisibleCmdlets, VisibleFunctions, or VisibleExternalCommands). The session configuration file then maps users or groups to one or more role capabilities using RoleDefinitions.
The Administering Windows Server Hybrid Core Infrastructure material explains that once those files are authored, you must expose a JEA endpoint by registering the session configuration on the target server.
This is accomplished with Register-PSSessionConfiguration, pointing to the PS session configuration file (.
pssc). Registering the endpoint enforces the role capability restrictions when helpdesk users connect (for example, Enter-PSSession -ConfigurationName HyperVJeaHelpDesk -ComputerName Server1).
New-PSSessionConfigurationFile is used earlier to create the .pssc file, but the prompt states the files are already built. Enter-PSSession only starts a session and does not publish the configuration. Therefore, the correct command to limit which Hyper-V module cmdlets helpdesk users can use is:
Register-PSSessionConfiguration -Path .\HyperVJeaConfig.pssc -Name 'HyperVJeaHelpDesk' -Force.