The Microsoft Azure Site Recovery Provider is installed once per Hyper-V host (or, if the hosts are System Center Virtual Machine Manager-managed, once on the VMM server) rather than per virtual machine.
Because Server1 and Server2 are two independent, standalone Hyper-V hosts that each need to be registered with the Recovery Services vault to replicate their respective VMs, the Provider must be installed on each host individually, so the minimum number of Provider installations required is two, regardless of the fact that Server1 hosts two VMs and Server2 hosts three. After the Provider and the accompanying Recovery Services agent are installed and registered on both hosts, all five virtual machines across Server1 and Server2 become visible in the vault and can be enabled for replication individually, without any additional per-VM provider deployment. If Server1 and Server2 had instead been managed by a single VMM server, only one Provider installation on the VMM server itself would have been required, since VMM centralizes host registration with the vault on behalf of every Hyper-V host it manages.

Explanation:

Startup mode for DC1: Directory Services Restore Mode (DSRM). Recovery method: Authoritative subtree restore.
With the Recycle Bin disabled, deleted objects cannot be restored by simply reanimating tombstones, so recovering the Finance OU and its child objects requires restoring them from the pre-deletion system state backup and then forcing that restored data to overwrite the (now-deleted) copies on every other domain controller, which is precisely what an authoritative restore does. Performing any restore of the AD DS database, whether authoritative or non-authoritative, requires the domain controller to be started in Directory Services Restore Mode (DSRM), a special boot mode in which the AD DS database service is offline and can be safely restored from backup instead of running as an active, replicating directory service; Safe Mode with Networking and WinRE do not provide the isolated, non-replicating access to the NTDS database that a restore operation needs. After booting DC1 into DSRM and restoring the system state backup, running an authoritative subtree restore scoped specifically to the Finance OU (using ntdsutil ' s authoritative restore command against that subtree) increments the version numbers only on the objects under Finance so that DC1
' s restored copies are treated as more current and replicate out to DC2, overwriting the deleted state there, while every other object in the directory retains its current, already-replicated version numbers and is left untouched, preserving the unrelated changes made after the backup. A full non-authoritative restore or an AD DS snapshot export would either overwrite unrelated data or fail to force replication of the recovered objects outward.

Explanation:
1. Export the printers on Server1. 2. Import the printers on Server2. 3. Modify GPO1. 4. Decommission Server1.
The Printer Migration Wizard workflow begins by exporting the printer configuration -- queues, drivers, and ports -- from the source print server, Server1, into a migration file, then importing that file onto the new print server, Server2, which recreates the shared printers there. Because users receive their printer connections through GPO1 rather than by connecting to Server1 directly, GPO1 must next be updated to point at the printers now hosted on Server2, so that users automatically receive connections to the migrated printers, typically at their next Group Policy refresh, without needing any individual manual reconfiguration on their own machines. Only after the printers are live and functioning on Server2 and GPO1 has been repointed should Server1 actually be decommissioned, since decommissioning it any earlier would leave users without functioning printer connections in the gap and increase, rather than minimize, downtime. Performing these four steps in this order -- export, import, modify the GPO, then decommission -- satisfies all three stated requirements together.

Azure Monitor diagnostic settings require the destination storage account to be a Standard-tier account, since Premium-tier storage accounts are explicitly unsupported as diagnostic settings destinations regardless of their storage kind, and for a regional resource like VM1 the storage account must also be located in the same Azure region as the resource being monitored. Storage2, of kind BlockBlobStorage, and storage3, of kind FileStorage, are both Premium-tier storage kinds and are therefore ineligible destinations no matter what region they sit in, since Premium performance tiers for those kinds are inherently Premium-only offerings.
Storage4 is a general-purpose v2 account, which is Standard-tier and would otherwise be eligible, but it is located in Central US, a different Azure region from VM1 ' s East US, so the regional-match requirement rules it out for this specific VM. Storage1 is the only account in the table that is simultaneously a Standard- tier general-purpose v2 kind and co-located with VM1 in East US, satisfying both the tier and region requirements at once, which makes it the only valid selection for VM1 ' s diagnostic settings destination.

Explanation:
Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true
The requirement is to run virtual machines on VM1 itself, which means enabling nested virtualization so that VM1 (a guest VM hosted on Server2) can install Hyper-V and host its own virtual machines. Nested virtualization on Hyper-V requires the parent VM ' s virtual processor to expose the host ' s hardware virtualization extensions (Intel VT-x or AMD-V) through to the guest. This is done with the Set-VMProcessor cmdlet using the -ExposeVirtualizationExtensions parameter set to $true, run against VM1 from the Hyper-V host (Server2): Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true. VM1 must be turned off before this setting can be applied, and after it is applied, VM1 needs the Hyper-V role installed inside the guest before it can run its own VMs. Set-VM, Set-VMBios, Set-VMHost, and Set-VMFirmware do not control virtualization extension exposure: Set-VM manages general VM configuration such as memory and name, Set-VMHost configures host-wide settings, and Set-VMFirmware/Set-VMBios control boot and firmware settings for generation 2 and generation 1 VMs respectively. Only Set-VMProcessor with - ExposeVirtualizationExtensions satisfies the stated requirement, making it the correct first step.
Topic 2, Case Study 2: Fabrikam, Inc.
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
Overview: Fabrikam, Inc. is a manufacturing company that has a main office in New York and a branch office in Seattle.
On-Premises Servers: The on-premises network contains the servers shown in the exhibit below. DC1 hosts all the operations master roles. WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.

On-premises servers
On-Premises Network: The New York and Seattle offices are connected by using redundant WAN links. The client computers in each office get IP addresses from their local DHCP server. DHCP1 contains a scope named Scope1 that has addresses for the New York office. DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.
Group Policy Objects (GPOs): The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the exhibit below.

OUs and GPOs
Planned Changes: Fabrikam identifies the following planned changes:
- Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
- Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and ExpressRoute. Both on-premises offices will be connected to Vnet1 by using ExpressRoute.
- Create three Azure file shares named newyorkfiles, seattlefiles, and companyfiles.
- Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
- Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Microsoft Entra joined.
- License all servers for Microsoft Defender for Servers.
- Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.
Security Requirements: Fabrikam identifies the following security requirements:
- Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer.
- Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours.
- Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, fabrikam, or fabr1k.
- Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days.
- Prevent domain controllers from directly contacting hosts on the internet.
File Sharing Requirements: You need to configure the synchronization of Azure files to meet the following requirements:
- Ensure that seattlefiles syncs to FS2.
- Ensure that newyorkfiles syncs to FS1.
- Ensure that companyfiles syncs to both FS1 and FS2.