Question 1(Implement Identity Federation and Access Solutions)
DRAG DROP
Your network contains an Active Directory domain named contoso.com. All servers run Windows Server 2016.
You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com.
You deploy Active Directory Federation Services (AD FS) and a Web Application Proxy to the Active Directory domain.
You need to configure the AD FS deployment to support Azure Multi-Factor Authentication (MFA) as the primary authentication method.
Which three actions should you perform in sequence on the AD FS server? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
Answer is in the explanation below.
Reference / correct answer:
Box 1: New-AdfsAzureMfaTenantCertificate
First step of the configuration is to generate a certificate for Azure MFA using the New-AdfsAzureMfaTenantCertificate –TenantId cmdlet.
Box 2: New-MsolServicePrincipalCredential
Connect to the Azure AD and use New-MsolServicePrincipalCredential to configure Azure MFA Clients to use it as a credential to connect with AD FS
Box 3 Set-AdfsAzureMfaTenant
Configure ADFS to use Azure AD by using the Set-AdfsAzureMfaTenant –TenantId cmdlet.
Question 2(Install and Configure Active Directory Domain Services (AD DS))
DRAG DROP
Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2 that run Windows Server 2016.
Server1 has IP Address Management (IPAM) installed. Server2 has Microsoft System Center 2016 Virtual Machine Manager (VMM) installed.
You need to integrate IPAM and VMM.
Which types of objects should you create on each server? To answer, drag the appropriate object types to the correct servers. Each object type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Select and Place:
Answer is in the explanation below.
Reference / correct answer:
Server 1 (IPAM): Access Policy
VMM must be granted permission to view and modify IP address space in IPAM, and to perform remote management of the IPAM server. VMM uses a "Run As" account to provide these permissions to the IPAM network service plugin. The "Run As" account must be configured with appropriate permission on the IPAM server.
To assign permissions to the VMM user account
In the IPAM server console, in the upper navigation pane, click ACCESS CONTROL, right- click Access Policies in the lower navigation pane, and then click Add AccessPolicy. Etc.
Server 2 (VMM) #1: Network Service
Server 2 (VMM) #2: Run As Account
Perform the following procedure using the System Center VMM console.