Explanation:
1. Create a site and a subnet (RemoteSite1, associated with the datacenter ' s IP subnet). 2. Create a site link (connecting RemoteSite1 to the existing site, with the desired schedule/cost). 3. Pre-create an RODC account (delegating its installation to User1).
Because Server1 must end up in a brand-new site, the plan must begin by creating that site along with a subnet object mapped to the datacenter ' s IP range and associated with the new site, which is exactly what places Server1 in RemoteSite1 once it is promoted there. Next, to be able to control the replication schedule between RemoteSite1 and the rest of the forest, an administrator must create a dedicated site link, since replication timing, frequency, and cost between sites are properties of the site link object, not of the sites themselves; without an explicit site link (or by relying only on a shared default link), that granular scheduling control would not exist for this specific site pair. Finally, to satisfy least privilege while still letting User1 - a mere local administrator on Server1, not a domain administrator - complete the RODC promotion, the recommended practice is to pre-create (stage) the RODC computer account in advance and explicitly delegate the installation to User1 during that staging process. This lets User1 attach Server1 to the pre-created account and finish the promotion locally without ever needing domain-wide administrative rights. Running the AD DS installation wizard directly as a non-delegated local admin would fail without domain credentials, and adding User1 to the Contoso\Administrators (Domain Admins) group would grant far more access than necessary, violating least privilege. The correct order is: create the site and subnet, create the site link, then pre-create the RODC account.

Restoring deleted objects from the Active Directory Recycle Bin requires permission to view and restore objects inside the forest ' s Deleted Objects container, and by default that container ' s access control list denies access to everyone except the SYSTEM account and members of Domain Admins (and Enterprise Admins at the forest root) -- no delegation to any other built-in group exists out of the box. Among the four groups offered, only Domain Admins carries this permission by default, since Account Operators (which can manage most user, group, and computer objects but has no special access to the hidden Deleted Objects container), Schema Admins (which governs schema modifications, not object restoration), and Backup Operators (which can back up and restore files and the system state, but not perform an online Active Directory Recycle Bin object restore through the Active Directory Administrative Center) all lack the needed access. The case study ' s general instruction to use the principle of least privilege where possible does not change this outcome here, since none of the three lower-privileged alternatives actually has the required capability by default -- Domain Admins is not merely the most convenient choice but the only one of the four that functionally works. Therefore, User1 must be added to Domain Admins to be able to recover objects from the Active Directory Recycle Bin.

Site, subnet, and site-link objects are stored in the Configuration partition, which replicates to every domain controller in the forest but is administratively owned by the forest root domain. By default, only members of Enterprise Admins and members of the Domain Admins group of the forest root domain (contoso.com in this forest) have permissions to modify objects in the Configuration container, including editing a site link ' s replication schedule. Admin1 is a member of Contoso\Enterprise Admins and therefore has forest-wide rights over the Configuration partition. Admin2 is a member of Contoso\Domain Admins; because contoso.com is the forest root domain, this group also carries default rights over the Configuration and Schema partitions.
Admin3, however, is a member of Canada\Domain Admins, the Domain Admins group of the canada.contoso.
com child domain, which has no inherent rights over the Configuration partition. Consequently, to change the replication schedule on all site links to 30 minutes, only Admin1 and Admin2 currently have the necessary permissions, making option C the correct answer.
Topic 1, Case Study 1: Contoso, Ltd.
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
AD DS Environment: The network contains an on-premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the exhibit below. All the domain controllers are global catalog servers.

Domain controllers
Server Infrastructure: The network contains the servers shown in the exhibit below. A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile. Server2 hosts three virtual machines named VM1, VM2, and VM3. VM3 is a file server that stores data in the volumes shown in the exhibit below.

Servers

VM3 volumes
Group Policies: The contoso.com domain has the Group Policy Objects (GPOs) shown in the exhibit below.

GPOs
Existing Identities: The forest contains the users shown in the exhibit below. The forest also contains the groups shown in the exhibit below.

Users

Groups
Current Problems: When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without signing out, another administrator can connect to the console session as the currently signed-in user.
Requirements: Contoso identifies the following technical requirements:
- Change the replication schedule for all site links to 30 minutes.
- Promote Server1 to a domain controller in canada.contoso.com.
- Install and authorize Server3 as a DHCP server.
- Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
- Ensure that you can manage Server4 from Server1 by using PowerShell remoting.
- Ensure that you can run virtual machines on VM1.
- Force users to provide credentials when they connect to VM2.
- On VM3, ensure that Data Deduplication on all eligible volumes is possible.

Explanation:
Failover Clustering ' s virtual machine monitoring feature (available from Failover Cluster Manager or the Add-ClusterVMMonitoredItem cmdlet) lets a cluster watch a specific Windows service running inside a guest VM and take VM-level recovery action, such as restarting or live migrating the VM, once the service is deemed to have failed. This mechanism escalates only after the service ' s own local recovery attempts have been exhausted, so the monitored service inside VM1 should keep its standard Service Control Manager Recovery tab set to Restart the Service; this lets the guest OS attempt its own recovery first, and only when the service keeps failing does the cluster step in and perform its configured VM recovery action. This two-tier design avoids unnecessarily restarting or migrating the whole VM for a transient service failure that the guest OS can resolve on its own, while still giving the cluster a safety net for a service that never recovers on its own.

Explanation:
Automating a Storage Spaces Direct firmware or driver rollout is done by pointing the clustered storage subsystem at a components manifest file that describes the supported firmware/driver versions, then letting Storage Spaces Direct orchestrate the update across nodes with the workload kept online. Get- StorageSubSystem retrieves the clustered storage subsystem object for Cluster1, and piping it to Set- StorageSetting with the System.Storage.SupportedComponents.Document parameter registers File1.xml as that manifest, which is the documented mechanism for automating a rolling, low-downtime firmware update.
The other cmdlets shown (Get-StorageFirmwareInformation, Get-StorageEnclosureVendorData, Set- StorageProvider, Set-StorageHealthSetting) either only report information or configure unrelated settings and would not register the manifest or trigger the orchestrated rollout that keeps virtual machines and other workloads running while each node ' s disks are updated in turn. Once the manifest is registered, Storage Spaces Direct automatically sequences the firmware update node by node, draining and updating one node ' s drives at a time so cluster resources continue to run on the remaining nodes throughout the rollout.