Exam AZ-800 topic 1 question 40 discussion

The domain partition contains user accounts, groups, and their attributes, including Employee-Number. You would mark the Employee-Number attribute as part of the Filtered Attribute Set (FAS), which applies to the domain partition, so it will not be replicated to the RODC.

Answer is D The RODC filtered attribute set is a dynamic set of attributes that is not replicated to any RODCs in the forest. You can configure the RODC filtered attribute set on a schema master that runs Windows Server 2008. When the attributes are prevented from replicating to RODCs, that data cannot be exposed unnecessarily if an RODC is stolen or compromised. https://learn.microsoft.com/en-us/windows/win32/ad/rodc-and-active-directory-schema#marking-attributes-as-confidential

Schema is correct

The employee number attribute is typically associated with the **User** objects in Active Directory. In the context of FSMO (Flexible Single Master Operation) roles, this attribute is not specifically tied to a single FSMO role. However, the **Schema Master** role is responsible for managing the schema of Active Directory, which includes the definition of attributes like employee number. So, if you're looking to modify or understand the employee number attribute, you would be interacting with the Schema Master role.

Answer is C

Answer is C. Domain because actual data is stored in domain partition not in schema. schema just defines the structure how the data is stored in Database

To ensure that if an attacker compromises RODC1's computer account, he cannot view the AD DS Employee-Number attribute, you must modify the partition in the "C.domain" partition. The domain split is where Active Directory domain-specific data is stored. By modifying the permissions in these sections, you can restrict access to certain attributes, such as Employee Number, to ensure data security. Therefore, the correct answer is "C. domain".

valid 27.11.23

D is the answer.

Acording to this link https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adls/0afba1a7-ff6b-4878-97d0-f099de319dfb the modifications needs to be done at schema partition. If you scroll up on the left navigation menu and click on 2 Attributes its tells The following sections specify the attributes in the Active Directory Lightweight Directory Services schema.