With the Active Directory Recycle Bin enabled, deleted objects retain their attributes and can be restored, and Active Directory Administrative Center is the graphical tool that exposes the Deleted Objects container and a Restore (or Restore To) action for recovering them, including User1. Active Directory Users and Computers does not expose the Deleted Objects container by default and has no restore functionality, and Sites and Services or Domains and Trusts are unrelated to object recovery. ADAC is therefore the tool to use for a straightforward Recycle Bin restore of a deleted user. From ADAC, an administrator navigates to the Deleted Objects container in the domain, selects User1, and chooses Restore to return the account to its original location with its original attributes and group memberships intact, avoiding the more involved authoritative- restore or tombstone-reanimation procedures required when the Recycle Bin is not enabled. The same restore operation can also be performed with the Restore-ADObject PowerShell cmdlet once the object ' s deleted- object GUID is identified, which is a useful alternative when scripting bulk recoveries rather than restoring a single account interactively through ADAC.

Explanation:
Using a key encryption key with Azure Disk Encryption requires the supporting key vault infrastructure to exist before the disk encryption VM extension is ever enabled, so the documented sequence begins with creating the Azure key vault that will store the KEK, using New-AzKeyVault, optionally with - EnabledForDiskEncryption set for the Microsoft Entra application-based access model that some Azure Disk Encryption configurations still use. Add-AzKeyVaultKey is then run against that newly created vault to generate the actual key encryption key inside it, producing the key ' s versioned key identifier URL, which is what Azure Disk Encryption will later use to wrap, or encrypt, the BitLocker or DM-Crypt encryption secret rather than storing that secret in the clear. Finally, Set-AzVMDiskEncryptionExtension is run against VM1, passing in the key vault ' s resource information along with the KEK ' s key URL and key encryption algorithm, so the extension both encrypts the disks and stores the resulting encryption secret in the vault protected by that key, completing the full KEK-based encryption workflow in the correct dependency order:
vault first, then key, then the extension that consumes both.

Backing up a standalone Windows Server ' s files, folders, and system state directly to an Azure Recovery Services vault -- exactly what the requirement calls for on Server4 -- is done using the Microsoft Azure Recovery Services (MARS) agent, so installing that agent on Server4 is the necessary first step. Microsoft Azure Backup Server (MABS) is used for application-aware and Hyper-V virtual machine backups rather than direct file/system-state backup of a single standalone server, and while it can also protect servers, it is not the lightweight, direct-to-vault mechanism appropriate for a single standalone server like Server4 and represents unnecessary additional infrastructure. Native Windows Server Backup does not target an Azure Recovery Services vault on its own without additional agent installation, and Storage Replica provides block- level volume replication between servers rather than the point-in-time backup and long-term retention the requirement calls for. Therefore, installing the MARS agent on Server4 is the correct first step to meet this technical requirement.

Collecting performance metrics from a Windows Server virtual machine through Azure Monitor now uses the Azure Monitor Agent, and the agent only starts sending data once it is associated with a data collection rule that specifies which performance counters to collect and which Log Analytics workspace to send them to.
Simply creating the workspace does not begin collection on its own, and options such as regenerating a workspace key, installing the Azure Connected Machine agent (used for Arc-enabling non-Azure servers), or configuring Windows Event Forwarding are unrelated to enabling AMA-based performance monitoring for an Azure VM, which already has the Azure Monitor Agent available as a VM extension without needing Arc onboarding. Creating and associating a DCR with Server1, specifying the performance counter set and the destination workspace, is the next required step, and once the DCR is linked the agent begins streaming the selected counters into Workspace1 for querying with KQL and for use in workbooks or alert rules.

Explanation:
Scopes: 2. Relays: 2.
A DHCP scope corresponds to a single IP subnet, and the DHCP server must have one scope defined for each distinct client subnet it will service; since there are two separate client VLANs, each with its own IPv4 subnet, the server needs two scopes; the datacenter ' s own subnet does not need a scope because no client computers are located there. DHCP relies on broadcast traffic (DHCPDISCOVER) that routers do not forward between subnets by default, and the DHCP server itself sits in a third subnet (the datacenter VLAN), separate from both client VLANs. For each client VLAN ' s broadcast traffic to reach that remote DHCP server, a DHCP relay agent (or IP helper configuration) must be enabled on the router interface for that VLAN; because there are two client VLANs, each needing its own relay pointed at the DHCP server ' s address, two relay agents are required. The datacenter VLAN needs no relay of its own, since the DHCP server lives there directly and can hear local broadcasts natively (though there are no clients there to generate any). Therefore the minimum is two scopes and two relays.