Explanation:
File1: 1. File2: 3.
A File Server for general use cluster role runs in an active-passive configuration: only the single node that currently owns the role can service client connections at any given time, so File1 is limited to one active node at most, regardless of how many total nodes Cluster1 has. A Scale-Out File Server for application data role, by contrast, is purpose-built for continuous availability and allows every node in the cluster to simultaneously own and serve the same shares concurrently over SMB Transparent Failover, so File2 can use all three nodes in Cluster1 at once to serve client connections. This distinction is fundamental to selecting the correct file server role for a given workload: general-use file shares favor the simplicity of standard active-passive failover, while application workloads such as Hyper-V over SMB or SQL Server database files benefit from the scale-out role ' s concurrent, multi-node access pattern and higher aggregate throughput. Therefore, File1 tops out at 1 node while File2 can use all 3 nodes concurrently.

Explanation:
User1: EAST\Domain Admins. User2: CONTOSO\Enterprise Admins.
Promoting an additional domain controller into a domain that already exists requires rights scoped only to that specific domain -- membership in that domain ' s own Domain Admins group (or an account explicitly delegated the equivalent rights) is sufficient and is the least-privileged group that accomplishes it. Since User1 needs to add an additional DC to the already-existing east.contoso.com domain, adding User1 to EAST\Domain Admins grants exactly the rights needed, without requiring any broader, forest-wide privilege.
Creating an entirely new domain within an existing forest (here, standing up a brand-new west.contoso.com domain) is a forest-wide structural change -- it adds a new partition and a new entry to the forest ' s domain- naming data that all domains and DCs in the forest must become aware of -- and this operation requires Enterprise Admins rights (or equivalent forest-level delegation), since no single domain ' s Domain Admins group has sufficient scope to add a new domain to the forest. Since User2 needs to deploy a DC that will host a brand-new domain, User2 must be added to CONTOSO\Enterprise Admins (Enterprise Admins exists only in the forest root domain, contoso.com, and confers forest-wide rights). Adding either user to a broader group than necessary (for example, adding User1 to Enterprise Admins, or granting Schema Admins to either) would violate least privilege, since each user ' s actual task only requires the narrower, task-appropriate group.

Explanation:

Scope1: DHCP failover in hot standby mode. Scope2: A split scope that uses delayed responses.
DHCP failover in hot standby mode designates one partner as active, normally answering all client requests for a scope, while the second partner remains passive and only begins leasing addresses once it detects the active partner is unavailable, which exactly matches Scope1 ' s requirement that DHCP3 (in the disaster- recovery site) leases addresses only when a main-datacenter server is down; hot standby is also the mode Microsoft recommends specifically for main-site-to-DR-site failover pairings, as opposed to load-balance mode, which splits live traffic between both partners simultaneously and is intended for two servers on the same local, low-latency network segment. Scope2 ' s requirement, that DHCP1 and DHCP2 each lease from separate parts of the address range with DHCP2 waiting before responding, describes the classic split-scope configuration, in which the address range is divided (commonly 80/20) between two independent, non- partnered DHCP servers, and a delay is configured on one server ' s scope options so it only replies to a DHCPDISCOVER broadcast if the other, undelayed server fails to respond first; this delayed-response split scope predates the failover feature and is still used when two DHCP servers should operate independently rather than as a coordinated failover pair. Neither scope ' s requirement matches a DHCP Server role in a failover cluster (which addresses a single server ' s own availability, not multi-server address partitioning) or a single server with exclusion ranges (only one server involved).

Promoting a new domain controller that runs a newer operating system version than any existing domain controller in the forest -- here, DC4 running Windows Server 2022 into a forest whose functional level is still Windows Server 2012 R2 -- requires the Active Directory schema to first be extended to support that OS version ' s schema additions (the adprep /forestprep and /domainprep operations, which modern promotion tools such as Install-ADDSDomainController run automatically when needed). Extending the schema requires connectivity to the domain controller holding the Schema Master FSMO role, since schema changes can only be made by contacting that specific role holder; if the Schema Master is offline, the schema extension step fails and the promotion cannot proceed. According to the domain controllers table, DC1 holds both the RID master and the schema master roles. DC2 holds the PDC emulator and infrastructure master roles, and DC3 holds the domain naming master role -- neither of those role sets is relevant to a schema extension. Therefore, DC1, as the Schema Master, must be online for DC4 ' s promotion (and its associated schema extension) to succeed.

Azure Files identity-based authentication requires two independent layers of permission to actually grant SMB access: the underlying NTFS (file/directory) permissions, which Group1 already has correctly set as Modify on the required folders, and a separate Azure role-based access control (RBAC) permission assigned at the storage account, file share, directory, or file scope, which governs whether an authenticated identity is allowed onto the share over SMB at all; even correct NTFS permissions are enforced only after the RBAC layer has admitted the connection, which is why Group1 currently authenticates successfully but still cannot access any files, since no Azure Files data-plane RBAC role has been assigned yet. The Storage File Data SMB Share Contributor role grants exactly read, write, and delete access over SMB to files and directories in the share, matching the first requirement, while explicitly not including the permission to modify NTFS-level permissions on those files, which the built-in role reserves for the Elevated Contributor role, so Contributor also satisfies both the second requirement and the least-privilege requirement by granting no more access than is needed. Storage File Data SMB Share Elevated Contributor adds the ability to change NTFS permissions, which the scenario explicitly requires be prevented, and Storage File Data SMB Share Reader and Storage File Data Privileged Contributor either grant too little (read-only) or too much (elevated, privileged) access for this scenario.