Explanation:
Recovery Services vaults are the vault type used for Azure Backup scenarios involving Azure virtual machines as well as on-premises machines protected through the Microsoft Azure Recovery Services (MARS) agent or Azure Backup Server/DPM, which covers both VM1 and the on-premises Hyper-V host Server1 in this scenario. The newer Backup vault type is reserved for a different, narrower set of workloads such as Azure Database for PostgreSQL, Azure Blobs, managed disks, and Azure VMware Solution VMs, none of which apply here, and an Azure key vault stores secrets/keys and has no role in configuring Azure Backup. Both VM1 ' s snapshot-based Azure VM backup and Server1 ' s MARS-agent file/folder or system- state backup are managed and monitored from within the same Recovery Services vault, which simplifies administration when a hybrid environment mixes on-premises Hyper-V hosts with native Azure virtual machines under a single backup policy structure. Configuring backup for Server1 additionally requires downloading and registering the MARS agent ' s vault credentials on the on-premises host, whereas VM1 ' s protection is enabled directly from the vault or the VM ' s own Backup blade without installing any separate agent.

Windows Admin Center manages specific Windows Server roles and features through its own extension system, not through installing RSAT-style remote administration tools on either the gateway server or the managed target -- support for managing a given role (DHCP, Failover Clustering, Certificates, and so on) is delivered as a Windows Admin Center extension that must be installed and enabled within the Windows Admin Center gateway itself (on Server1) before that role ' s management tool becomes available for any connected server, including Server2. Installing the DHCP Server Tools feature (whether on Server1 or on Server2) is the classic RSAT/Server Manager approach and has no bearing on what Windows Admin Center ' s own extension framework can display or manage -- Windows Admin Center does not depend on RSAT feature installation for its tool surface. Modifying Server2 ' s PowerShell remoting settings is unnecessary, since Windows Admin Center already uses WinRM/remote management connectivity that is functional by default for standard scenarios once the target is reachable and credentials are supplied; the actual blocker here is simply that the DHCP management extension itself has not yet been installed in the gateway. Therefore, installing the Windows Admin Center extension for DHCP management is the necessary first step.

Explanation:
User1 can use self-service password reset (SSPR) to reset his password: Yes. If User1 connects to Microsoft Exchange Online, an on-premises domain controller provides authentication: Yes. You can add User2 to Group1 as a member: No.
User1 ' s account lives in OU1, which is included in the Microsoft Entra Connect sync scope, so User1 has a corresponding, synced object in the tenant; with password writeback enabled and no other blocking configuration indicated, a synced user like User1 can use self-service password reset, and the reset password is written back to on-premises AD DS as well. Because password hash synchronization is explicitly disabled and pass-through authentication is enabled instead, cloud sign-in for synced users is validated by the pass- through authentication agent relaying the credential check to an on-premises domain controller in real time, rather than against a cloud-stored hash; so when User1 signs in to a cloud service such as Exchange Online, authentication is indeed provided by an on-premises domain controller through the PTA agent. User2, however, belongs to OU2, which was not selected in the Domain/OU filtering configuration, so User2 has no corresponding object synced into the tenant at all. Group1 is a group in the tenant (a cloud-side security group), and because User2 has no synced cloud identity to reference, User2 cannot be added as a member of Group1 - there is simply no cloud object representing User2 to add.

Windows Defender Application Control (also branded App Control for Business) can restrict which COM objects are permitted to register and run on a system through dedicated COM object registration rules in the WDAC policy, blocking registration of any COM object not explicitly allowed. Exploit protection mitigates memory-corruption exploitation techniques and Smart App Control is a consumer-focused Windows client feature for filtering untrusted apps - neither one provides COM object registration control, making WDAC the only option that addresses this requirement. A COM object registration rule is added to the WDAC policy either through the App Control Policy Wizard or with New-CIPolicyRule -AllowFileNamePath scoped to the COM server ' s file, and once the policy is deployed and enforced on Server1, any COM object registration that is not explicitly allowed by the policy is blocked at the point of registration rather than merely audited.
This gives an administrator fine-grained control over exactly which COM servers may register on Server1, closing off a class of persistence and lateral-movement technique that relies on registering malicious or unauthorized COM objects.

No new domain or forest functional level has been introduced since Windows Server 2016, so an Active Directory domain whose domain controllers all run Windows Server 2025 can have its domain and forest functional levels raised to Windows Server 2016 at most, and a domain controller ' s operating system must be at least as new as that functional level to be promoted into the domain. Windows Server 2012 R2 falls below the Windows Server 2016 functional level and can no longer be introduced as a new domain controller in such a domain, so Windows Server 2016 is the oldest Windows Server version that can still be used for the additional domain controller. Even though contoso.com ' s existing domain controllers run Windows Server
2025, the domain does not have to raise its functional level beyond 2016 unless a specific feature requires it, which is exactly what keeps a Windows Server 2016 domain controller a legitimate option for the app ' s legacy requirement.