Storage Migration Service is purpose-built to inventory the data, security descriptors, and both share-level and NTFS-level permissions on a source file server such as Fileserver1, transfer that data to a destination server such as Fileserver2, and then perform a cutover that reassigns the source server ' s network identity -- its computer name and IP address -- to the destination server. That cutover step is precisely what allows the existing \\Fileserver1\Data UNC path, already relied upon by the Chicago office application, to continue working unchanged after the migration, since client requests to that path transparently resolve to Fileserver2 once it has taken on Fileserver1 ' s identity. The Microsoft File Server Migration Toolkit and Windows Server Migration Tools are older, largely superseded utilities that can move some file server settings but do not provide this automated inventory-transfer-and-cutover workflow, and neither preserves the source server ' s identity on the destination the way Storage Migration Service does, meaning the UNC path would need to be manually updated or redirected. File Server Resource Manager (FSRM) is a quota, file-screening, and storage- reporting feature entirely unrelated to migrating data between servers. Therefore, Storage Migration Service is the correct tool to perform this migration while preserving the existing UNC path.
Topic 5, Case Study 5: Contoso, Ltd. (New)This is a case study. Case
studies are not timed separately. You can use as much exam time as
you would like to complete each case. However, there may be
additional case studies and sections on this exam. You must manage
your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
Overview: Contoso, Ltd. is a manufacturing company that has a main office in Seattle and branch offices in Los Angeles and Montreal.
Existing Environment -- Active Directory Environment: Contoso has an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with a Microsoft Entra ID tenant. The AD DS domain contains the domain controllers shown in the following table.

Domain controllers
Contoso recently purchased an Azure subscription.
The functional level of the forest is Windows Server 2012 R2. The functional level of the domain is Windows Server 2012. The forest has the Active Directory Recycle Bin enabled.
The contoso.com domain contains the users shown in the following table.

Users
The contoso.com domain has the Group Policy Objects (GPOs) shown in the following table.

Group Policy Objects
The contoso.com domain has the Password Settings Objects (PSOs) shown in the following table.

Password Settings Objects
Server Infrastructure: The contoso.com domain contains servers that run Windows Server 2022 as shown in the following table.

Servers
By using Windows Firewall with Advanced Security, the servers have isolation connection security rules configured as shown in the following table.

Isolation connection security rules
Server4 has no connection security rules.
Server4 Configurations: Server4 has the effective Group Policy settings for user rights as shown in the following table.

Server4 effective user rights
Server4 has the disk configurations shown in the following exhibit.
-- Disk 0 (127.00 GB, Basic, Online): System Reserved (100 MB, NTFS, Healthy System partition); C:
(126.39 GB, NTFS, Healthy Boot/Page File/Crash Dump/Primary partition); a 523 MB Healthy Recovery partition.
-- Disk 1 (127.00 GB, Basic, Online): D: Data (127.00 GB, NTFS, Healthy Primary partition).
-- Disk 2 (127.00 GB, Basic, Online): E: Data (127.00 GB, ReFS, Healthy Primary partition).
-- Disk 3 (127.00 GB, Basic, Online): F: Data (127.00 GB, ReFS, Healthy Primary partition).
Virtualization Infrastructure: The contoso.com domain has the Hyper-V failover clusters shown in the following table.

Server4 disk configuration (Disk Management)

Hyper-V failover clusters

Explanation:
On an Azure VM, Remote Desktop connectivity problems caused by a Windows Defender Firewall rule that no longer allows inbound RDP traffic are repaired from the VM ' s Help > Reset password blade. Selecting Reset configuration only runs the VM Access Agent extension, which re-enables the Remote Desktop service and creates (or restores) the Windows Defender Firewall rule permitting inbound connections on TCP port
3389, without requiring an existing RDP session or direct console access to the VM. The Serial console blade, by contrast, only provides out-of-band access to the Windows Special Administration Console (SAC) over the hypervisor channel; it does not itself modify any firewall rule, and while an administrator could type netsh commands there manually, Serial console is not the setting that configures the firewall. The location where the serial console ' s text output and the VM ' s boot screenshots are persisted to a storage account is configured separately, on the Boot diagnostics blade, not on the general Diagnostic settings blade, which instead routes platform metrics and Activity Log entries to destinations such as Log Analytics or Event Hubs and plays no role in storing VM console output. Boot diagnostics must be enabled with a linked storage account before the Serial console feature becomes usable, since both the console output stream and the periodic boot screenshots are written through that same storage configuration.

DNSSEC validation can happen at two different layers: on a DNS server that is itself resolving/forwarding queries on behalf of clients, or directly on a Windows client/member server acting as its own DNS resolver.
Add-DnsServerTrustAnchor configures a DNS server role to trust and validate a signed zone hosted elsewhere; it is a server-side setting that applies to whichever machine runs the cmdlet, and running it on every member server would require the DNSSEC-Server feature/role and repeated per-machine configuration, which does not match how member servers normally resolve names (they are typically DNS clients, not authoritative or validating DNS servers themselves). The mechanism built specifically for Windows client- side DNSSEC validation is the Name Resolution Policy Table (NRPT), which is distributed centrally through Group Policy: an NRPT rule can be scoped to a specific namespace, such as fabrikam.com, and configured to require DNSSEC validation for any query the client ' s DNS Client service resolves for names in that namespace, rejecting responses that fail validation. Because the requirement is for all member servers domain- wide to perform this validation, and Group Policy is the standard way to apply a setting to many machines centrally and consistently, adding an NRPT rule via GPO is the correct approach; it also avoids the per- machine cmdlet execution that Add-DnsServerTrustAnchor would require. Network List Manager policies control how machines classify and respond to different network location types (domain, private, public) and have no relationship to DNSSEC at all.

When Defender for Servers Plan 2 is configured to monitor Windows file and registry changes, the file integrity monitoring detections are written to the Log Analytics workspace in the MDCDetectionFimEvents table, which records create, modify, rename, and delete events for both files and registry keys along with the process that made the change. The ASim* tables are Advanced Security Information Model normalization tables used for cross-product parsing in Sentinel, not the raw ingestion table for this feature, and DeviceRegistryEvents is a Microsoft Defender for Endpoint advanced hunting table in the Microsoft 365 Defender schema, not a Log Analytics workspace table reachable from Workspace1. Querying MDCDetectionFimEvents directly in Workspace1 is therefore the correct way to review the detected changes.
A KQL query such as MDCDetectionFimEvents | where ComputerName == ' VM name ' can be used to scope the results to a specific virtual machine, and the table also captures the before/after values of monitored registry keys for auditing configuration drift across the 100 monitored servers.

Active Directory client site membership is determined entirely by matching the client ' s IP address to a subnet object defined in Active Directory Sites and Services, and each subnet object is associated with exactly one site. Domain controller location (DC Locator) uses this mapping when a client authenticates or queries a global catalog, so a client whose subnet is associated with Site1 will identify Site1 as its own site and will, by default, target the domain controllers physically located in Site1 for logon authentication, Kerberos ticket requests, and LDAP/GC lookups. Creating a subnet object that represents the branch office ' s IP range and associating that subnet with Site1 is precisely the supported and documented mechanism for making a location ' s clients treat a specific site as their own, even when there are no domain controllers physically present at that location. Traffic between the branch clients and Site1 ' s domain controllers would then be routed according to whatever site links exist (here, DEFAULTIPSITELINK), and the clients would only fail over to a domain controller in another site if none in Site1 were reachable. This directly satisfies the requirement that branch clients be primarily authenticated by Site1 ' s domain controllers, without requiring any GPO changes or new domain controllers, so the solution meets the stated goal.