Establishing a remote Computer Management console session relies on DCOM to make the initial connection to the target computer, so the COM+ Network Access (DCOM-In) firewall rule must be enabled on Server2 to allow that initial DCOM connection through. Separately, enabling the full Remote Event Log Management rule group -- which opens the RPC endpoint mapper port, a fixed RPC port, and the associated named pipe -- is documented by Microsoft as sufficient to let most of the Computer Management console ' s sub-snap-ins (Shared Folders, Local Users and Groups, Device Manager, and others) connect successfully even though they lack a dedicated firewall rule group of their own. Enabling only these two rule groups therefore lets the console connect end-to-end while opening the fewest possible firewall rules, consistent with least privilege, rather than enabling broader rule groups such as the full Windows Management Instrumentation (WMI) group or the full COM+ Remote Administration group, both of which open considerably more surface area than is actually needed for this task. Therefore, the COM+ Network Access (DCOM-In) rule and the Remote Event Log Management rule group are the two correct answers.

Azure Disk Encryption requires the key vault storing the encryption key to reside in the same Azure region and the same subscription/tenant as the virtual machine being encrypted; the key vault does not need to be in the same resource group as the VM. VM1 is deployed in the East US region, so any key vault located in East US within the subscription qualifies regardless of which resource group it belongs to. Of the four vaults, Vault1 and Vault3 are both in East US (in RG1 and RG2 respectively), while Vault2 and Vault4 are in Central US and therefore cannot be used, making Vault1 or Vault3 the correct set of usable key vaults rather than Vault1 alone. An administrator can select either Vault1 or Vault3 when running Set- AzVMDiskEncryptionExtension, and the choice between RG1 and RG2 for the vault ' s own resource group has no bearing on whether Azure Disk Encryption succeeds for VM1.

Explanation:
To keep the highly available virtual machines running while a single Storage Spaces Direct node undergoes an in-place operating system upgrade, the node must first be drained of its clustered roles and its storage placed into maintenance mode using Suspend-ClusterNode with the -Drain parameter together with the storage maintenance mode setting, which together live-migrate the running virtual machines off Node1 onto Node2 and stop Node1 from participating in storage I/O for the duration of the upgrade. Only once Node1 has been fully drained of its clustered workloads and isolated from storage traffic should the in-place upgrade to Windows Server 2025 actually be performed on that node, since attempting the OS upgrade while the node is still actively hosting VMs or participating in storage I/O would risk both workload disruption and storage inconsistency. After the operating system upgrade completes successfully, the node is taken back out of storage maintenance mode so it can resume participating in the Storage Spaces Direct pool ' s I/O operations, and finally Resume-ClusterNode is run to return Node1 to active participation in the cluster so it can once again host clustered roles and receive virtual machines back through live migration. This four-step sequence, drain and enter storage maintenance mode, upgrade, exit storage maintenance mode, resume, mirrors Microsoft ' s documented procedure for safely updating an individual node in a Storage Spaces Direct cluster without workload downtime.

The Azure Policy guest configuration feature audits and remediates settings inside the operating system of a VM, such as local security policies, registry keys, and installed roles/features. To do this, the guest configuration extension running inside the VM must be able to authenticate to Azure without storing any credential inside the VM, and it does this using the VM ' s own system-assigned managed identity: Azure Policy uses that identity to communicate securely between the guest configuration extension and the guest configuration service. Enabling a system-assigned managed identity on VM1 is therefore the prerequisite that allows the guest configuration extension to be deployed and to report compliance back to Azure Policy. A user-assigned managed identity is not what the guest configuration extension is documented to use for this purpose; the feature specifically relies on the VM ' s system-assigned identity being present. The PowerShell Desired State Configuration (DSC) extension and the Custom Script Extension are unrelated extensions used for different configuration-management and scripting scenarios; neither one enables or is required by the Azure Policy guest configuration capability. Because the requirement is specifically to use guest configuration for policy auditing/remediation on VM1, enabling a system-assigned managed identity on the VM is the necessary and sufficient configuration change.

Explanation:

In the Administering Windows Server Hybrid Core Infrastructure guidance for Windows Admin Center (WAC) and Kerberos delegation, resource-based constrained delegation (RBCD) is configured on the resource's computer account , not on the client/gateway. The documentation explains that "resource-based constrained delegation is applied to the target service account; the target's msDS- AllowedToActOnBehalfOfOtherIdentity attribute contains the security principals (computers or service accounts) that are permitted to act on behalf of users." It further clarifies that "this model supports cross- domain and cross-forest scenarios when a trust exists; you specify the front-end computer (for example, a WAC gateway) from the trusted forest as an allowed principal on the resource computer in its own domain." For WAC, the gateway (Server1 in contoso.com ) must be allowed to delegate to the managed node (Server2 in fabrikam.com ). The study materials show the exact PowerShell interface: "Use Set-ADComputer with - PrincipalsAllowedToDelegateToAccount to populate the resource's allowed-to-act list." Therefore, the Identity parameter must reference the resource computer account (Server2 in fabrikam.com), and the PrincipalsAllowedToDelegateToAccount parameter must reference the gateway computer account (Server1 in contoso.com).
Hence the correct command is:
Set-ADComputer -Identity (Get-ADComputer server2.fabrikam.com) -
PrincipalsAllowedToDelegateToAccount (Get-ADComputer server1.contoso.com)