Correct:
* dsmgmt.exe
Domain Controllers (including Read-Only Domain Controllers) do not have a local Security Accounts Manager (SAM) database. Because of this, traditional local group management tools (like net user or Computer Management) cannot be used to manage local administrators.
To safely delegate administrative rights on a specific RODC without granting broad domain-wide permissions, Microsoft implements a feature called Administrator Role Separation (ARS). The dsmgmt.exe command-line utility provides the local roles subcommand interface explicitly designed to manage these delegated administrative roles directly on the RODC, perfectly adhering to the principle of least privilege.
* Ntdsutil.exe
Ntdsutil.exe can be used.
Domain Controller Architecture: When a Windows server is promoted to a Domain Controller (including an RODC), it disables the SAM database. Because the local security database is gone, standard local management utilities like the Local Users and Groups snap-in (lusrmgr.msc) become completely unavailable and cannot be used to manage permissions on that machine.
Administrator Role Separation (ARS): Microsoft created the Administrator Role Separation feature specifically for RODCs. This allows domain administrators to delegate local administrative privileges on a physical RODC to a standard user (like a local branch technician) without granting them any elevated permissions over the rest of the Active Directory domain.
How it works: You use ntdsutil.exe (specifically running the local roles subcommand) or the command-line tool dsmgmt.exe to bind a domain user or group to the local administrators role on that specific RODC.
Incorrect:
* Active Directory Sites and Services
This administrative GUI tool manages replication topology, subnets, and sites across the forest. It does not have functions to manage local security roles or machine-specific administrative rights for an RODC.
* Computer Management
The Computer Management tool cannot be used to assign local administrator privileges on a Read-Only Domain Controller (RODC). Domain controllers do not have a local Security Accounts Manager (SAM) database, which means traditional local users and groups do not exist on them, making the "Local Users and Groups" section in Computer Management unavailable.
* dsamain.exe
This tool is used to expose Active Directory data stored in backup snapshots or copies as a Lightweight Directory Access Protocol (LDAP) server. It cannot modify server roles or local administrative permissions.
* net user
This command manages user accounts within a local SAM database or a writable Active Directory database. It cannot be used to inject a user into an RODC's special isolated local administrator role.
* Local Users and Groups
The Local Users and Groups tool strictly relies on a machine's local SAM database. Attempting to open lusrmgr.msc on any Domain Controller will return an error stating that the snap-in cannot be used on a domain controller.
* System Configuration
Reference:
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731885(v=ws.11)
https://community.spiceworks.com/t/read-only-domain-controller-rodc-question/522418

Explanation:
https://docs.microsoft.com/en-us/azure/site-recovery/hyper-v-azure-tutorial

Cluster-Aware Updating advanced options and updating run profiles.
You can set the PreUpdateScript or PostUpdateScript the option.
Reference:
https://docs.microsoft.com/en-us/windows-server/failover-clustering/cluster-aware-updating-options

Explanation:
Box 1: Add-BitLockerKeyProtector
From the exhibit we see for volume D that AutoUnlockEnabled is False, and AutoUnlockKeyStored is empty.
The Add-BitLockerKeyProtector cmdlet adds a protector for the volume key of the volume protected with BitLocker Drive Encryption.
Example: The following example adds an ADAccountOrGroup protector to the previously encrypted operating system volume using the SID of the account:
Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup S-1-5-21-
3651336348-8937238915-291003330-500
Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes.
Box 2: Service
The -Service parameter indicates that the system account for this computer unlocks the encrypted volume.
Add-BitLockerKeyProtector syntax with use of the ADAccountOrGroupProtector parameter:
Add-BitLockerKeyProtector -
[-MountPoint] <String[]>
[-ADAccountOrGroupProtector]
[-ADAccountOrGroup] <String>
[-Service]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
Incorrect:
* Enable-BitLockerAutoUnlock
The Enable-BitLockerAutoUnlock cmdlet enables automatic unlocking for a volume protected by BitLocker Disk Encryption.
The command has no -ADAccountOrGroupProtector parameter.
Syntax:
Enable-BitLockerAutoUnlock -
[-MountPoint] <String[]>
[-WhatIf]
[-Confirm]
[<CommonParameters>]
* The Clear-BitLockerAutoUnlock cmdlet removes all automatic unlocking keys used by BitLocker Drive Encryption. BitLocker stores these keys for the fixed data drives of a system on a volume that hosts a BitLocker-enabled operating system volume so that it can automatically unlock the fixed and removable data volumes in a system. This makes it easier for users to access data volumes.
Syntax: Clear-BitLockerAutoUnlock []
Reference:
https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker
https://docs.microsoft.com/en-us/powershell/module/bitlocker/add-bitlockerkeyprotector

An Azure Virtual Machine "Server serial log" refers to the kernel messages and boot status information collected by Boot Diagnostics, which provides a snapshot of the VM's state during boot-up. It includes kernel messages and periodic screenshots to help troubleshoot issues when a VM is inaccessible over the network or through standard remote connections. Accessing these logs is possible via the Azure Serial Console, a text-based interface that connects to the VM's COM1 port, enabling administrators to perform emergency actions and troubleshoot problems without network connectivity.
Reference:
https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/serial-console-overview