Cluster-Aware Updating supports the -PreUpdateScript and -PostUpdateScript parameters on Invoke-CauRun, and these settings, along with every other CAU configuration option such as the maximum retries per node and the update categories to apply, can be saved together into a single reusable updating run profile, which is stored as an XML file. Once a run profile has been created and is referenced using the -CauPluginArguments or -RunProfile parameter on a subsequent CAU run, or configured as the default profile for self-updating mode, every future CAU run automatically applies the same pre- and post-update scripts without the administrator needing to re-specify them each time, which is precisely what minimizing administrative effort for this recurring maintenance task looks like. Scheduled tasks have no built-in awareness of cluster node draining, pausing, or update orchestration and would require substantial custom scripting to coordinate safely, WSUS only manages which updates are approved for distribution and has no scripting hook into CAU ' s node lifecycle at all, and Azure Functions is a cloud compute service entirely unrelated to on-premises CAU orchestration. Therefore, run profiles are the correct answer.

Explanation:

$var2 = Get-Credential. Cmdlet: Set-Item.
Because AdminPC is in a workgroup rather than domain-joined, connecting by IP address to a server that PowerShell remoting cannot Kerberos-authenticate requires the target to first be added to the local WSMan client ' s TrustedHosts list, which is exactly what the provided line, applied against WSMan:
\localhost\Client\TrustedHosts, is doing with the value $var1 (the target ' s IP address); the cmdlet that both reads and writes a WS-Management configuration setting such as TrustedHosts through the WSMan:
PowerShell drive is Set-Item, whereas Export-Csv and Out-File only write data to files and Set-ItemProperty targets registry or filesystem item properties rather than the WSMan provider ' s configuration values, so Set- Item is the only one of the four options that correctly updates TrustedHosts. Using the -Concatenate switch together with -Force appends the new IP address onto whatever entries already exist in TrustedHosts rather than replacing the list outright, which is exactly how the requirement to preserve the existing TrustedHosts entries on AdminPC is satisfied. The remote session itself, established by New-PSSession -ComputerName
$server -Credential $var2, needs an explicit credential because a workgroup-to-workgroup or workgroup-to- IP connection cannot rely on the caller ' s domain identity; Get-Credential is the cmdlet that interactively prompts for and returns a PSCredential object suitable for that -Credential parameter, unlike Get-ADUser, Get-AzUserAssignedIdentity, or Get-LocalUser, none of which return a usable credential object.

Explanation:
Backup location: A Recovery Services vault in Azure. Maximum number of scheduled backups per day: 3.
The MARS agent, short for Microsoft Azure Recovery Services agent, is the Azure Backup client used to protect files and folders directly on Windows machines such as Server1, and it always writes its backups to a Recovery Services vault in Azure. The newer Backup vault resource type is used for other Azure Backup workloads, such as blobs, Azure managed disks, and PostgreSQL databases, and is not a supported destination for MARS agent backups, so a Recovery Services vault is the only correct backup location for this scenario.
Within the MARS agent ' s Schedule Backup wizard, an administrator can configure a backup job to run up to three times per day at specified times, and three is the documented maximum backup frequency supported by the agent; attempting to schedule more than three daily backups is not possible through the wizard. Because the scenario asks specifically about the destination and the frequency limits of MARS agent backups, identifying a Recovery Services vault as the location and three as the maximum number of scheduled backups per day correctly answers both parts of the question.

Explanation:
On the domain controllers: Install the Azure Monitor agent. In Azure: Create an Azure Log Analytics workspace.
Centrally managing performance alerts in Azure for on-premises domain controllers is done by connecting those servers to Azure Monitor: the Azure Monitor agent is installed on each domain controller (onboarded to Azure Arc for non-Azure servers, or directly if they are Azure VMs) to collect performance counters and event data, and that telemetry is sent to an Azure Log Analytics workspace, which is the resource that stores the collected data and against which performance-based alert rules are then defined and centrally managed.
Creating a Data Collector Set in Performance Monitor and modifying the Performance Monitor Users group are both local, per-server administrative actions that never send any data to Azure and cannot support central, Azure-based alerting. An Azure SQL database, a Storage Sync Service, and an Azure Storage account are all Azure resources, but none of them is the telemetry store that Azure Monitor ' s alerting pipeline is built on -- only a Log Analytics workspace serves that role. Therefore, installing the Azure Monitor agent on the domain controllers and creating an Azure Log Analytics workspace are the two required actions.

Explanation:
Install: The Azure Monitor agent. Provide: The Azure Log Analytics workspace ID and the workspace key.
Collecting Windows Firewall events from an on-premises server into Microsoft Sentinel is done through the Windows Firewall Events via AMA data connector, which relies on the Azure Monitor agent together with an associated data collection rule to actually gather and forward the firewall event log entries; the Azure Log Analytics gateway is only a proxy relay used by the legacy Log Analytics agent, and the Microsoft Azure Recovery Services (MARS) agent is entirely unrelated to event forwarding, since it exists purely for Azure Backup scenarios. When enrolling a server that is neither Azure-hosted nor already Arc-onboarded, the Azure Monitor agent ' s setup process needs the destination Log Analytics workspace ' s ID and its workspace, or primary, key so the installer knows which specific workspace to report collected data to and can authenticate itself to that workspace, which is the same credential pairing Microsoft documents across both its Azure Monitor agent and legacy Microsoft Monitoring Agent onboarding flows for standalone, non-Azure servers.
A storage account name and access key, a subscription ID paired with the Sentinel workspace ' s name, or a set of Azure AD credentials play no role whatsoever in pointing an on-premises monitoring agent at a specific Log Analytics workspace during installation.