Exam 70-744 topic 1 question 101 discussion

Actual exam question from Microsoft's 70-744

Question #: 101
Topic #: 1

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 that runs Windows Server 2016.
You need to allow network administrators to use Just Enough Administration (JEA) to change the TCP/IP settings on Server1. The solution must use the principle of least privilege.
How should you configure the session configuration file?

A. Set RunAsVirtualAccount to $false and set RunAsVirtualAccountGroups to Contoso\Network Configuration Operators.
B. Set RunAsVirtualAccount to $true and set RunAsVirtualAccountGroups to Contoso\Network Configuration Operators.
C. Set RunAsVirtualAccount to $false and set RunAsVirtualAccountGroups to Network Configuration Operators.
D. Set RunAsVirtualAccount to $true and set RunAsVirtualAccountGroups to Network Configuration Operators.

Show Suggested Answer

Suggested Answer: D 🗳️
References:
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/new-pssessionconfigurationfile?view=powershell-6

by Skasuba123 at Aug. 2, 2020, 4:49 a.m.

Comments

Submit Cancel

Yebubbleman

4 years, 5 months ago

Just to explain it a little better for anyone confused on it, RunAsVirtualAccount specifies whether or not you are granting the permissions of a virtual account. This would appear to be the point of JEA to begin with. You don't want it to be Contoso\Network Administrators as that is Domain Wide (and thusly overkill when you only need to manipulate that one server locally) and therefore not adhering to the principle of least privilege.

upvoted 2 times

...

SamsOtro

4 years, 6 months ago

Correct - use Network Configuration Operators built-in local group.

upvoted 4 times

...

allanp3na

4 years, 7 months ago

correct

upvoted 4 times

...