Exam 70-741 topic 1 question 53 discussion

I think the answer is correct: "IPAM IP Audit Administrators: Users who are in the IPAM Users IPAM security group and have the privileges to view IP address audit information." https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ipamm2/21b4a631-8f28-420f-822f-c5f879d5046e

IPAM Administrators: IPAM administrators can view all IPAM data and manage all IPAM features. IPAM ASM Administrators: IPAM address space management (ASM) administrators can manage IP address blocks, ranges, and addresses. IPAM IP Audit Administrators: IPAM IP audit administrators can view IP address tracking data. IPAM MSM Administrators: IPAM multi-server management (MSM) administrators can manage DNS and DHCP servers. IPAM Users: IPAM users can view information in IPAM, but cannot manage IPAM features or view IP address tracking data.

I think C (IPAM IP Audit Administrators) is correct. ASM,MAS, and Users can't view IP Address Tracking. Both IPAM Administrators and IPAM IP Audit Administrators can View it. Since minimize administrative privileges, correct answer is C.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj878348(v=ws.11)#:~:text=IPAM%20MSM%20Administrators%3A%20IPAM%20multi-server%20management%20%28MSM%29%20administrators,IPAM%20features%20or%20view%20IP%20address%20tracking%20data. The following table summarizes IPAM actions and functions that are permitted or denied with membership in the specified security group. Access rights are additive if a user or group is a member of multiple security groups. The table clearly explains the roles on what can be managed or denied

The question just states tracking IP addresses. Wouldn’t the IPAM user who has access to view be the least level of privilege to do this request?

C is the correct answer http://www.n1vacations.com/mcsa15/IPAM%20-%20DELEGATE%20IPAM%20ADMINISTRATION.pdf

@dritter Group IPAM IP Audit Administrators has been added to local groups on IPAM server after installed IPAM. And for me this is right answer.

IPAM IP Audit Administrators grants a user the minimal permission to view IPAM audit tracking data.

there is a list of IPAM termination here - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj878341(v%3Dws.11)

There are no more IPAM IP Audit Administrators. How do we control the access to IP address tracking now? https://docs.microsoft.com/en-us/windows-server/networking/technologies/ipam/create-a-user-role-for-access-control