Exam 70-744 topic 1 question 105 discussion

I think the answer is B: https://www.itprotoday.com/security/what-you-need-know-about-dynamic-access-control-windows-server In the image you have this: "kerberos support for dynamic access control on this device has been disabled"

C. From Active Directory Administrative Center, add a claim type. parameter.

Yes, you do need to enable KDC via GP for claims to work. However this question does not focus on claims actually working. It asks 'You need to ensure that the security token of User1 has a claim for Job Title' - this is about the security token having a claim for Job Title. To ensure that the security token has a claim you need to add the Claim Type in AD Administrative Center. KDC is needed but it is not the answer here.

Why C? For me B is right. B. From a Group Policy object(GPO), configure KDC support for claims, compound authentication, and Kerberos armoring

A. From Active Directory Users and Computers, modify the properties of the User1 account. B. From a Group Policy object(GPO), configure KDC support for claims, compound authentication, and Kerberos armoring C. From Active Directory Administrative Center, add a claim type. D. From Windows PowerShell, run the New-ADCIaimTransformPolicy cmdlet and specify the -Name parameter. Answer: C

C. From Active Directory Administrative Center, add a claim type. parameter.

c . the right answer

Step 7. Enabling Kerberos Support for claim-based Access Control Used GPO We use Group Policy to make the CAP available to our domain file server(s). Whether you create a new GPO or edit an existing one is completely up to you. In a nutshell, we need to configure the following Group Policy elements

The correct answer is B