Explanation:
Volume for the AD DS database: F. Caching configuration for the volume that hosts the database: NONE.
Microsoft ' s guidance for running AD DS domain controllers on Azure virtual machines is explicit that the NTDS database and logs should be placed on a dedicated data disk rather than the OS disk (C:) or the VM ' s temporary disk (D:). The OS disk mixes the database with the operating system and is not sized or managed for this purpose, and the temporary disk is local, ephemeral storage on the physical host that provides no durability at all - its contents can be lost during routine platform maintenance, a host failure, or a resize
/reallocation, which is completely incompatible with maximizing resiliency for a domain controller ' s database. A separate managed data disk, mounted as F:, is backed by durable, replicated Azure Storage and is the disk that should host the AD DS database, giving the required resiliency. Separately, Azure lets you configure host caching (None, Read, or Read/write) on a managed data disk; for a disk hosting a transactional, write-sensitive database like the AD DS Extensible Storage Engine database, Microsoft explicitly documents that host caching must be set to None. Read or Read/write caching risks acknowledging writes to the VM before they are guaranteed to be durably committed to the underlying storage, which for a database like NTDS.dit can result in inconsistency or accidental data loss if a cache flush is interrupted. Setting caching to None ensures every write is fully committed, directly satisfying the requirement to prevent accidental data loss.

Application Control policies (Windows Defender Application Control / App Control for Business) log every policy-load, allow, and block decision to the CodeIntegrity/Operational event log, including the event that confirms a policy has been successfully refreshed and is being enforced on the local computer. AppLocker ' s MSI and Script log only records AppLocker rule evaluations, which is a separate feature from Application Control policies, and the DeviceManagement-Enterprise-Diagnostic-Provider log relates to MDM enrollment diagnostics, not application control enforcement. Reviewing CodeIntegrity/Operational on Server1 is therefore the correct way to confirm Policy1 has taken effect, since the event log records the policy ' s GUID and version each time it is loaded, letting an administrator match the deployed policy to the one actually running on Server1 ' s code integrity subsystem. Event ID 3099 in that log specifically indicates a policy was refreshed successfully, while block events such as 3077 or 3089 would appear there too if an executable outside the allowed rules were later denied.

Explanation:
Set-VMProcessor VM1 -ExposeVirtualizationExtensions $true
Installing the Hyper-V role inside a virtual machine -- running Hyper-V as a nested hypervisor on top of another Hyper-V host -- requires nested virtualization to be explicitly enabled for that specific VM, because a virtual processor does not, by default, expose the hardware virtualization extensions (Intel VT-x/EPT or AMD-V) that a guest hypervisor needs to create and run its own virtual machines. This is enabled on the Hyper-V host (Server1), targeting the guest VM, with Set-VMProcessor -VMName VM1 - ExposeVirtualizationExtensions $true, run before Hyper-V is installed inside VM1; only after virtualization extensions are exposed to VM1 can the Hyper-V role be installed and function correctly inside that guest. Set- VMHost configures host-wide Hyper-V settings such as default storage/VM paths or NUMA spanning and has an -EnableEnhancedSessionMode-equivalent policy setting for the VMConnect enhanced session experience, but it has no role in enabling nested virtualization. Set-VM, Set-VMFirmware, and Set- VMSecurity configure other unrelated VM properties (general VM settings, boot firmware/Secure Boot, and security features such as Shielded VM/vTPM, respectively) and do not control virtualization extension exposure. Therefore, the required first command is Set-VMProcessor VM1 -ExposeVirtualizationExtensions
$true, run on Server1.

Explanation:
A connection security rule only adds an authentication (IPsec) requirement to traffic that a firewall rule already permits; it does not, by itself, open or expand what a firewall rule allows. Because each server ' s Windows Defender Firewall is configured to allow communication only between servers on the same network segment, Server1 and Server2 (both on 192.168.1.0/24) are already permitted to communicate, so Server1 ' s Isolation rule, which only requests (not requires) outbound authentication, does not block that traffic even without a matching rule on Server2. Server3 sits on a different segment (192.168.5.0/24) from both Server1 and Server2, and because the firewall ' s same-segment scope restriction governs whether traffic is allowed at all, neither Server2 ' s attempt to reach Server3 nor Server3 ' s attempt to reach Server1 succeeds, regardless of the Server-to-server connection security rule configured on Server3, since that rule can only add authentication to already-permitted traffic and cannot bypass the firewall ' s segment-based scope restriction.

Explanation:
To keep virtual machines available while performing an in-place OS upgrade of a Storage Spaces Direct node, the node is first paused and drained (Suspend-ClusterNode -Drain) so its cluster roles, including running VMs, move to other nodes. The node ' s storage is then placed into storage maintenance mode, which stops it from participating in the storage pool ' s redundancy operations while its physical disks are offline for the upgrade. With the node drained and its storage quiesced, the in-place Windows Server 2025 upgrade is performed, and afterward storage maintenance mode is removed so the node ' s disks rejoin the pool and Storage Spaces Direct resynchronizes data before the node resumes cluster roles. This drain-upgrade-resync cycle is then repeated node by node across the four-node cluster, and because only one node at a time is unavailable while the others continue serving storage and hosting migrated VMs, the workload stays online throughout the entire rolling upgrade.