Correct Answer:

Explanation:
Pktmon, the built-in Windows packet monitor, lets you build a capture filter that narrows collection to a specific remote IP address with -i, a specific transport protocol with -t, and, for TCP, a specific set of TCP flags such as syn, ack, fin, rst, psh, or urg appended after the protocol. Combining -i 192.168.0.100 with -t tcp and the syn flag restricts the capture to just the SYN packets exchanged with that address, which is exactly what the scenario requires, and matches the documented pktmon filter add syntax. Message Analyzer is a discontinued Microsoft tool and netmon (Network Monitor) is likewise retired in favor of pktmon, so neither is the correct or currently supported choice for building this capture filter on a modern Windows Server installation. After the filter is added, running pktmon start --etw begins the capture, and the resulting .etl trace can be converted to text or a pcapng file for inspection in a packet analyzer, showing only the matching SYN packets exchanged with 192.168.0.100.

Correct Answer:

Explanation:
< Name: PolicyDefinitions ; Server: DC1 and DC2 only
The Group Policy Central Store is a specifically named folder, PolicyDefinitions, that must be created inside the SYSVOL share of a domain, at the path \\ < domain > \SYSVOL\ < domain > \Policies\PolicyDefinitions; Microsoft ' s Group Policy tooling looks for that exact folder name and will not recognize a differently named folder such as CentralDefinitions or TemplateDefinitions as a Central Store. Because SYSVOL only exists on domain controllers (it is replicated between DCs of a domain via DFS Replication), the folder can only be created on a machine that is a domain controller; Server1 is a plain member server hosting the File Server, DFS Namespaces, and DFS Replication roles, and has no SYSVOL share at all, so it cannot host the Central Store regardless of what other roles it runs. Critically, the Central Store is a per-domain construct: creating it inside contoso.com ' s SYSVOL (which DC1 hosts and which replicates to every DC in that domain) only benefits GPO editing sessions connected to contoso.com, and it has no effect on GPO editing in the separate child domain, east.contoso.com. To have Central Store coverage across the entire forest - meaning correctly working ADMX template resolution when administrators edit GPOs in either domain - a PolicyDefinitions folder must be created in the SYSVOL of both contoso.com (via DC1) and east.contoso.com (via DC2), which is why DC1 and DC2 together, not Server1 and not either domain controller alone, is the correct answer.

Correct Answer:

Explanation:
Group3: Group1, Group2, Group4, and Group5 only. Group5: Group4 only.
Group nesting in AD DS is governed strictly by group scope, independent of whether a group is security- or distribution-type. A Domain Local group can contain user accounts, Global groups from any domain, and Universal groups from any domain, plus other Domain Local groups from its own domain only. Group3 is a Domain Local group in contoso.com, so it can accept Group1 (Universal, contoso.com), Group2 (Global, contoso.com), and Group4 and Group5 (both Global, canada.contoso.com), since Global groups from any domain are valid Domain Local members. It cannot accept Group6, because Group6 is Domain Local in canada.contoso.com, a different domain, and Domain Local groups may only nest other Domain Local groups from their own domain. That gives Group3: Group1, Group2, Group4, and Group5 only. A Global group, by contrast, can contain only user accounts and other Global groups from the same domain. Group5 is Global in canada.contoso.com, so among the remaining groups only Group4 qualifies, since it is also Global and in the same domain; Group1 (Universal), Group2 (Global but a different domain), and Group6 (Domain Local) are all excluded by scope rules. That gives Group5: Group4 only.

Correct Answer:

Explanation:
User1 can read the files in Share1: Yes. User3 can delete files in Share1: No. If User2 connects to \\Server1.
adatum.com from File Explorer, Share1 will be listed: Yes.
When a folder is accessed across the network through its share, the effective permission is always the more restrictive of the NTFS permission and the share permission evaluated together. User1 belongs to Group1, which has NTFS Read and share-level Change; the combined effective permission is Read, so User1 can indeed read the files in Share1. User3 belongs to Group3, which has no NTFS permission entry at all on D:
\Folder1 (only Administrators, Group1, and Group2 appear in the NTFS ACL, with no inheritance from a parent granting Group3 access), even though Group3 holds Full Control at the share level; because NTFS grants nothing to Group3, the combined effective permission is no access whatsoever, so User3 cannot delete, read, or otherwise touch the files, regardless of the generous share permission. The third statement concerns Access-Based Enumeration (ABE), which Windows exposes on a share through its folder enumeration mode:
Share1 ' s FolderEnumerationMode is set to Unrestricted, meaning ABE is disabled for this share. With ABE disabled, every share is listed to every user browsing \\Server1.adatum.com regardless of that user ' s actual access rights, so Share1 will appear in the listing when User2 (Group2, which has no share permission entry and effectively no access to the share ' s contents at all) browses to the server, even though User2 could not open the share ' s contents once inside. ABE only hides shares from users with zero effective access when it is explicitly enabled (AccessBased mode), which is not the case here.

Correct Answer:

Explanation:
In a Windows Defender Firewall connection security rule, ' request ' authentication is opportunistic: the computer attempts IPsec authentication but falls back to unauthenticated communication if the peer cannot negotiate it, so a host whose outbound setting is ' request ' (Server1) can always reach any peer, authenticated or not, including Server4, which has no connection security rule at all. ' Require ' authentication, by contrast, only succeeds when the peer is capable of responding to the IKE negotiation at all, regardless of whether that peer ' s own policy is set to request or require; it fails outright against a peer with no IPsec policy configured.
Server1 ' s rule requests authentication both ways, so it can reach Server2, Server3, and Server4 without restriction. Server2 requires authentication for outbound connections, so its outbound traffic succeeds against Server1 and Server3 (both of which support IPsec negotiation) but is blocked toward Server4, which has no rule to negotiate with, making ' Server1 and Server3 only ' the correct outcome for Server2.