Explanation:
Group3: Group1, Group2, Group4, and Group5 only. Group5: Group4 only.
Group nesting in AD DS is governed strictly by group scope, independent of whether a group is security- or distribution-type. A Domain Local group can contain user accounts, Global groups from any domain, and Universal groups from any domain, plus other Domain Local groups from its own domain only. Group3 is a Domain Local group in contoso.com, so it can accept Group1 (Universal, contoso.com), Group2 (Global, contoso.com), and Group4 and Group5 (both Global, canada.contoso.com), since Global groups from any domain are valid Domain Local members. It cannot accept Group6, because Group6 is Domain Local in canada.contoso.com, a different domain, and Domain Local groups may only nest other Domain Local groups from their own domain. That gives Group3: Group1, Group2, Group4, and Group5 only. A Global group, by contrast, can contain only user accounts and other Global groups from the same domain. Group5 is Global in canada.contoso.com, so among the remaining groups only Group4 qualifies, since it is also Global and in the same domain; Group1 (Universal), Group2 (Global but a different domain), and Group6 (Domain Local) are all excluded by scope rules. That gives Group5: Group4 only.

Explanation:
The Balancer tab shows Enable Automatic Balancing of Virtual Machines checked with the Always load balance option left unselected, which corresponds to the cluster ' s AutoBalancerMode being set to 1, meaning node fairness rebalancing is triggered only when a node actually joins the cluster, rather than mode 2, which would also rebalance on a recurring timer. In this mode, adding a new Hyper-V node to Cluster1 constitutes a node-join event, so the cluster ' s node fairness feature does automatically live-migrate one or more virtual machines onto the newly joined node to level out CPU load across all nodes, making statement 1 true.
Because rebalancing is not time-triggered under this configuration, simply waiting an hour after running commands, with no node joining or leaving the cluster in between, does not by itself cause any automatic migration from Node1 to Node2, so statement 2 is false. VM6 in the scenario runs on the separate standalone host Host1, not as a clustered virtual machine on a node of Cluster1, and deploying it specifically to Node1 would make it a clustered VM sharing Node1 ' s existing load, but that placement action is not a node-join event either, so it does not trigger the automatic node-fairness rebalance, making statement 3 false as well.

Explanation:
1. Download the file recovery script for VM1. 2. Run the file recovery script on VM2. 3. Copy the file by using File Explorer. 4. Unmount the disks.
Azure Backup ' s file-level recovery for Azure virtual machines works by generating a script from a specific recovery point stored in the Recovery Services vault; once that script is downloaded and executed on a target machine, it mounts the recovery point ' s disks there as local volumes. To restore a single file from VM1 ' s backup onto VM2 with the least administrative effort, an administrator first downloads the file recovery script generated for the desired VM1 recovery point, then runs that script directly on VM2 -- the target machine where the file needs to end up -- which mounts the recovery point ' s volumes locally on VM2. Once the volumes are mounted and visible, the desired file is copied using ordinary File Explorer navigation, browsing to the mounted recovery point volume and copying Important.docx to its destination on VM2. Finally, the mounted disks are unmounted to clean up the temporary recovery point volumes once the file has been retrieved. This approach avoids restoring the entire virtual machine or provisioning any separate infrastructure just to retrieve one file, minimizing administrative effort as required.

Explanation:
On a Virtual WAN hub: An ExpressRoute gateway. In the offices: An ExpressRoute circuit connection.
Fabrikam ' s plan is to replace the existing WAN links between the New York and Seattle offices with Azure Virtual WAN and ExpressRoute, connecting both offices to Vnet1 through the Virtual WAN hub. Azure Virtual WAN uses its own hub-native ExpressRoute gateway object (distinct from the standalone virtual network gateway used when ExpressRoute is connected directly to a single VNet); this ExpressRoute gateway is deployed inside the Virtual WAN hub and is required before any ExpressRoute circuit can terminate into that hub. A standard virtual network gateway is used for VNet-to-VNet or VPN scenarios, not for Virtual WAN hub ExpressRoute termination, and an ExpressRoute circuit connection itself is the logical link resource, not something you deploy on the hub. At each office, connectivity into Microsoft ' s network is established through an ExpressRoute circuit connection provisioned with a connectivity provider, which then links, via Microsoft ' s backbone, into the ExpressRoute gateway in the Virtual WAN hub. A Site-to-Site VPN, an Azure application gateway (a web traffic load balancer), and an on-premises data gateway (used for Power Platform/Logic Apps connectors) are all unrelated to this ExpressRoute-based design.

Explanation:
Network configuration: Configure virtual network peering between Vnet1 and Vnet2. DNS configuration:
Add a custom DNS server to Vnet2.
Microsoft Entra Domain Services deploys its managed domain controllers into one specific virtual network -- Vnet1 in this scenario, where VM1 and VM2 already join successfully -- so a virtual machine in any other virtual network, such as Vnet2, first needs network-layer reachability to that VNet, which is established by configuring virtual network peering between Vnet1 and Vnet2. Peering alone does not fix name resolution, however, since Vnet2 by default still uses Azure-provided DNS, which has no knowledge of the managed domain; Microsoft ' s documented configuration for a peered VNet that needs to join the managed domain is to switch its DNS servers setting from Azure-provided DNS to custom DNS servers pointing at the managed domain ' s own domain controller IP addresses. That combination is exactly what lets VM3 both reach and correctly resolve aadds.contoso.com. Simply adding a subnet to Vnet1, or linking Vnet2 to an Azure private DNS zone, does not by itself give VM3 both a network path to the managed domain ' s virtual network and correct DNS resolution to its actual domain controllers, so neither of those alone would resolve the join failure VM3 is experiencing.