Windows Admin Center provides a dedicated Storage, or Volumes, view for a Storage Spaces Direct cluster that shows total pool capacity, used capacity, and remaining available capacity at a glance, alongside the ability to drill down into individual volumes and the physical disks backing them, making it purpose-built for exactly this kind of at-a-glance capacity check on a clustered storage pool. Resource Monitor and System Configuration are both local, single-machine diagnostic tools with no awareness of a clustered, pooled storage resource spanning multiple nodes, so neither one can report on a Storage Spaces Direct pool ' s available capacity at all. There is also no cmdlet named exactly Get-StoragefileServer that reports pool capacity; the closest legitimate cmdlets, such as Get-StoragePool or Get-VirtualDisk, require additional scripting and calculation to derive a usable capacity figure rather than presenting it directly. Because Windows Admin Center is the only listed option that actually surfaces Storage Spaces Direct pool capacity information directly and without additional manual calculation, it is the correct tool to use here.

The Active Directory Replication Status Tool, commonly abbreviated ADREPLSTATUS, is purpose-built to poll every domain controller across an entire forest, summarize each one ' s inbound and outbound replication status, and surface any replication errors, giving a quick, consolidated view of whether a specific change -- such as the group membership update described in this scenario -- has actually propagated out to domain controllers across all 20 sites or is stuck somewhere in the topology. The File Replication Service Status Viewer is scoped specifically to legacy FRS-based replica sets rather than to general AD DS object replication, so it provides no useful information about this modern group-membership replication issue.
Microsoft Support and Recovery Assistant is aimed at diagnosing end-user connectivity and sign-in problems rather than domain-controller-to-domain-controller replication health. Active Directory Sites and Services can be used to manually force replication between two specific domain controllers, but it does not provide the kind of consolidated, forest-wide replication status and error view that would let an administrator efficiently confirm whether the change reached every remote site, which is exactly what the Replication Status Tool is designed to do.

Explanation:
Install the Microsoft Entra Password Protection DC agent on: DC1 and DC2 only; Install the Microsoft Entra Password Protection Proxy on: Server1 Microsoft ' s documentation for Microsoft Entra Password Protection explicitly states that the DC agent does not need to be installed on read-only domain controllers, because password set and change events are never processed or persisted locally on an RODC -- they are always forwarded to a writable domain controller for processing. Installing the DC agent only on the writable domain controllers, DC1 and DC2, is therefore sufficient to enforce password policy for every password operation in the domain, with no benefit (and unnecessary administrative effort) from also installing it on RODC1. Because the domain controllers lack internet connectivity, a Password Protection Proxy is required on an internet-connected, domain-joined member server to relay policy from Microsoft Entra ID down to the DC agents; Microsoft ' s FAQ confirms the Proxy service and Microsoft Entra Connect can coexist on the same server without conflict, so Server1 (already running Entra Connect sync) is a fully supported location. Server2, however, already hosts the Microsoft Entra Application Proxy connector, and Microsoft explicitly recommends against co-locating the Password Protection Proxy with Microsoft Entra Application Proxy, because their installers deploy conflicting versions of the Microsoft Entra Connect Agent Updater service -- the very component responsible for automatic agent updates, which this scenario requires. Placing the Proxy on Server1 therefore satisfies full policy enforcement, automatic updates, and minimal administrative effort, while Server2 is disqualified by the documented Application Proxy conflict.

Explanation:
File1 is deduplicated after the deduplication job runs: Yes. File3 is deduplicated after the deduplication job runs: No. File4 is deduplicated after the deduplication job runs: No.
Data Deduplication only ever processes files that currently reside on a volume where deduplication is enabled, and it also enforces a default minimum file size of 32 KB - files smaller than that are never deduplicated no matter how long they sit on an enabled volume. File1 was moved to volume D, which has deduplication enabled, and at 500 KB it is comfortably above the 32 KB minimum, so once the deduplication job runs, File1 is eligible and will be deduplicated. File3, originally on D, was moved to volume E, which does not have deduplication enabled at all; because File3 no longer resides on D by the time the job runs, it is not deduplicated, and its size (1 MB) is irrelevant since it isn ' t even on a deduplication-enabled volume anymore. File4 is a copy of File2 (10 KB) placed onto volume D under a new name, so it does reside on a deduplication-enabled volume, but at only 10 KB it falls below the mandatory 32 KB minimum file size threshold, so it is excluded from deduplication purely on size grounds regardless of which volume it is on.
Only File1 satisfies both conditions - residing on an enabled volume and meeting the minimum size - so only File1 is deduplicated.

Azure Relay ' s Hybrid Connections capability is built specifically to expose an on-premises TCP endpoint, such as a SQL Server instance, to a cloud application without opening any inbound port on the on-premises firewall: an on-premises Hybrid Connection Manager makes only an outbound connection to the relay, and the cloud application (App1) connects to the same relay, so traffic tunnels through a connection the on- premises network itself initiated. Both the WebSocket-based transport and the automatic connection management of Hybrid Connections satisfy the requirements to minimize open firewall ports and administrative effort far better than standing up a full site-to-site network path. However, a Hybrid Connection is a resource that must live inside an Azure Relay namespace, which is the container resource that has to exist first before any individual Hybrid Connection (or WCF relay) can be created within it; you cannot create a Hybrid Connection without first provisioning the namespace that will hold it. An Azure VPN gateway would establish full network-level connectivity between the networks, which is a heavier-weight solution requiring more firewall ports and more ongoing administrative overhead than is justified for reaching a single SQL endpoint. A WCF relay connection is an older, more complex Azure Relay capability aimed at SOAP/WCF scenarios and is not the modern minimal-effort choice for a WebSocket-based connection.
Because the Relay namespace is the prerequisite container, it must be created first.