Explanation:
An RODC only caches (replicates) the password of a security principal that is explicitly permitted by its Password Replication Policy - in the exhibit, only members of the built-in Allowed RODC Password Replication Group and the custom Group1 are set to Allow, while Administrators, Account Operators, Backup Operators, Server Operators, and the Denied RODC Password Replication Group are all set to Deny.
A user who is not covered by an Allow entry authenticates through pass-through validation to a writable DC and never has credentials cached on the RODC, so User1 ' s credentials are not stored on RODC1, making statement 1 No. Because Server3 sits in Site2 alongside RODC1 and is a member of Group1 (an Allow entry), a user whose credentials are already cached there can still authenticate locally through RODC1 even if WAN connectivity to Site1 ' s writable domain controllers is lost, which is why User2 can sign in successfully during the outage, making statement 2 Yes. Interactive local sign-in to the RODC console itself is governed separately by the RODC ' s Administrator Role Separation (local Administrators group), not by the Password Replication Policy, and nothing in the scenario grants User3 that local logon right, so statement 3 is No.

Explanation:
1. Stop VM1. 2. Resize the operating system disk. 3. Start VM1. 4. Resize volume C.
Resizing an existing Azure managed disk ' s provisioned capacity, unlike attaching or detaching an additional data disk, requires the virtual machine using that disk to be stopped (deallocated) first; Azure does not permit a disk resize operation against a disk that is currently attached to a running VM. The first step is therefore to stop VM1. With the VM deallocated, the operating system disk can be resized (increased from 128 GB up to
250 GB) through the Azure portal, CLI, or PowerShell. Once the resize completes, VM1 must be started again so that Windows can see and use the newly enlarged disk. Growing the underlying managed disk only makes additional unallocated space available at the disk level; it does not automatically grow the NTFS volume sitting on that disk, so the final step is to resize volume C from within the guest operating system (using Disk Management ' s Extend Volume wizard or diskpart ' s extend command) to actually claim that unallocated space into the C: volume. Resizing VM1 (changing its compute size/SKU) and redeploying VM1 (moving it to different underlying hardware) are unrelated operations that do not participate in a disk-capacity-increase workflow at all. The correct order is: stop VM1, resize the operating system disk, start VM1, then resize volume C.

The BitLocker Recovery Password Viewer is an optional snap-in for Active Directory Users and Computers, installed as part of the Remote Server Administration Tools BitLocker Drive Encryption Administration Utilities feature, that adds a dedicated BitLocker Recovery tab directly to a computer object ' s Properties dialog; once installed, opening Server1 ' s computer object and selecting that tab lists every BitLocker recovery password backed up to AD DS for that computer, each entry showing its password ID (matching the ms-FVE-RecoveryGuid) alongside the full 48-digit numerical recovery password (the ms-FVE- RecoveryPassword value) needed to unlock the drive at the recovery screen. This is Microsoft ' s own documented, purpose-built, and most administrator-friendly method for retrieving an AD DS-stored BitLocker recovery password, specifically because it presents the correct password value directly in a readable interface without requiring the administrator to manually navigate LDAP attributes or child objects the way a lower-level tool such as ADSI Edit would require. Because using this snap-in directly and correctly surfaces Server1 ' s actual recovery password value, exactly what is needed to unlock the server at its BitLocker recovery prompt, this solution fully meets the stated goal of identifying the BitLocker recovery key for Server1.

Explanation:
1. Start DC1 in Directory Services Restore Mode. 2. Perform an authoritative restore on DC1. 3. Start DC1 normally.
Because DC1 was shut down at 08:00 -- before the 09:00 deletion of the manager attribute -- its on-disk Active Directory database still holds the correct, pre-incident values for every affected user, making it what Microsoft calls a latent domain controller that never replicated in the bad change. Rather than restoring from the prior night ' s 23:00 backup, which would discard legitimate changes made between 23:00 and DC1 ' s 08:
00 shutdown and increase data loss, the fastest and least lossy path is to boot DC1 into Directory Services Restore Mode so it is isolated from inbound replication, then perform an authoritative restore on it using ntdsutil, which raises the version numbers on the affected objects so they win when they replicate outward.
Restarting DC1 normally afterward pushes its authoritative, correct manager attribute values out to DC2 and any other domain controllers, completing the recovery. The Active Directory Recycle Bin does not help here, since it restores deleted objects rather than attribute values cleared on objects that still exist.

Explanation:
Rule Type: Isolation. Requirements: Require authentication for inbound and outbound connections.
Authentication Method: Computer (Kerberos V5).
Restricting a set of servers so that they only accept inbound connections from, and only initiate outbound connections to, other domain-joined computers describes the classic domain or server isolation scenario in Windows Defender Firewall with Advanced Security, so the rule type must be Isolation rather than Tunnel, which is used to secure gateway-to-gateway traffic, or Authentication exemption, which excludes specific hosts from having to authenticate at all. Because both stated requirements use the word only, with no allowance for a fallback to unauthenticated traffic in either direction, the Requirements setting must be set to Require authentication for inbound and outbound connections rather than the softer default of requiring authentication only for inbound connections while merely requesting it for outbound connections. Since every server in OU1 and every legitimate client that needs to reach them is already joined to the contoso.com domain, Computer (Kerberos V5) is the appropriate authentication method, because it uses the existing Active Directory infrastructure for authentication and avoids the certificate enrollment and public key infrastructure overhead that would only be necessary if non-domain-joined devices needed to be included in the trust boundary.