Exam 70-740 topic 1 question 81 discussion

70-742

Box 1: Yes - As a member of the IPAM DNS Administrator Role of the ADatum zone, User1 can add DNS records to it. Box 2: Yes - As a member of the DNS Record Administrator Role of the Fabrikam zone, User1 can add DNS records to it. Box 3: No - DNS Record Administrators cannot delete zones, only administer DNS records. References: https://technet.microsoft.com/en-us/library/hh831353(v=ws.11).aspx

I Agree with YES-YES-NO

User1 can perform all the 3 tasks, as user1 is granting the role IPAM DNS Administrator Role on the Global scope.

Y - Y - Y IPAM DNS Administrator role with a Global access scope means the user can do anything on any DNS server managed by IPAM. Fabrikam zone is \global\scope1. The user is DNS Record Administrator on \global\scope2... But this is 741 question.

I have a question: In 70-741 there is the same question with only difference that on the table "Fabrikam.com" Zone has access scope "Global\Scope2". What is the answer in this situation?

YES YES NO *** Since Server 2016, the DNS can be managed through IPAM. And the DNS Administrator role does have permission to create DNS records. *** Box 1: Yes As a member of the IPAM DNS Administrator Role of the ADatum zone, User1 can add DNS records to it. Box 2: Yes As a member of the DNS Record Administrator Role of the Fabrikam zone, User1 can add DNS records to it. Box 3: No DNS Record Administrators cannot delete zones, only administer DNS records Source: https://docs.microsoft.com/en-us/windows-server/networking/technologies/ipam/view-roles-and-role-permissions

70-742 question.

Tested this on a single zone Moved zone to Global\Test access scope Made user DNS administrator at global Made user DNS record administrator at global\test Logged on as that user and deleted the zone. So Permissions do not appear to be most restrictive, but cumulative. Whether or not the zone is configured for dynamic updates is irrelevant - as we have not got dynamic updates coming from a computer.

The user1 is IPAM DNS Administrator on the Global level, so he/she can do anything...

User 1 has Admin permissions for ADATUM zone (secured but user1 is DNS ADMIN). You don't need permission for Fabrikam Zone (none)

I think the third option is No. User1 have "DNS Record Administrator" on Scope2 (zone Fabrikam.com). Although User1 has IPAM DNS Administer Role, the most restrictive permission is applied. The permission "DNS Record Administrator" can't permit delete zone. So, for me The correct answer is Yes, Yes, No.