Exam 70-742 topic 1 question 244 discussion

Actual exam question from Microsoft's 70-742

Question #: 244
Topic #: 1

Your network contains an Active Directory domain named contoso.com.
You plan to deploy a new Active Directory Rights Management Services (AD RMS) cluster on a server named Server1.
You need to create the AD RMS service account. The solution must use the principle of least privilege.
What should you do?

A. Create a local user account on Server1 and add the account to the Administrators group on Server1.
B. Create a domain user account and add the account to the Administrators group on Server1.
C. Create a domain user account and add the account to the Domain Users group in the domain.
D. Create a domain user account and add the account to the Account Operators group in the domain.

Show Suggested Answer

Suggested Answer: C 🗳️

by ArchBishop at Aug. 3, 2019, 8:41 p.m.

Comments

Submit Cancel

Paz

Highly Voted 5 years, 9 months ago

C is correct: https://social.technet.microsoft.com/wiki/contents/articles/1001.ad-rms-infrastructure-requirements.aspx The account that the AD RMS service runs under is a standard domain user account with no additional permissions. When AD RMS is installed, this account is added to the domain AD RMS Service group.

upvoted 13 times

...

coleman

Highly Voted 5 years, 6 months ago

answer C is correct. AD RMS requires that the service account be a domain user account, and the question mentioned to use the principal of least privilege, answer B provides the least privileges for running AD RMS services.

upvoted 6 times

Robbie

4 years, 6 months ago

You mean answer C provides least privilege for running AD RMS

upvoted 1 times

...

lofzee

Most Recent 4 years, 5 months ago

correctomundo

upvoted 1 times

...

yesboet

4 years, 7 months ago

c is correct

upvoted 1 times

...

TMW

5 years, 8 months ago

It appears the service account is a domain user account that is created prior to installation of the Role, and specified during the setup/configuration of the role.

upvoted 2 times

...

ArchBishop

5 years, 11 months ago

Microsoft recommends that the Service Account for AD RMS be a Domain User Account with "Special Permissions." Can someone help us determine what the necessary "Special Permissions" are?

upvoted 2 times

...