Q: 28

DRAG DROP Which three actions should you perform in sequence to meet the security requirements for Webapp1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

Create a standalone managed service account (sMSA) in AD DS.
Confiqure the IIS application pool to run as Network Service.
Configure the IIS application pool to run as a specified user account.
Create a group managed service account (gMSA) in Active Directory.
Create a system-assigned managed identity in Azure AD.
Create a user-assigned managed identity in Azure AD.
Create the Key Distribution Services (KDS) root key in AD DS.

Correct Answer:

Answer Areas Target 1: G. Create the Key Distribution Services (KDS) root key in AD DS. Target 2: D. Create a group managed service account (gMSA) in Active Directory. Target 3: C. Configure the IIS application pool to run as a specified user account.

Explanation

To meet security requirements for an IIS application (Webapp1) utilizing automatic password management and domain security, a Group Managed Service Account (gMSA) is the standard solution. The configuration sequence follows strict technical dependencies:

Create the KDS Root Key: A Key Distribution Services (KDS) root key must be present in the Active Directory forest before any gMSA can be created. It allows the Domain Controllers to generate the gMSA passwords.
Create the gMSA: Once the key exists, the gMSA object is created in Active Directory using the New-ADServiceAccount cmdlet.
Configure IIS: Finally, the web application is secured by configuring its Application Pool identity. You must select "Custom Account" (specified user) and enter the gMSA credentials (domain\accountname$) with a blank password.

References

Microsoft Learn. (2023). Group Managed Service Accounts Overview. Retrieved from https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview

Relevance: Confirms gMSA architecture and use cases for server farms and IIS.

Microsoft Learn. (2023). Create the Key Distribution Services KDS Root Key. Retrieved from https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/create-the-key-distribution-services-kds-root-key

Relevance: "You must create the Key Distribution Services (KDS) root key... before you can create a group managed service account."

Microsoft Learn. (2023). Getting Started with Group Managed Service Accounts. Retrieved from https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/getting-started-with-group-managed-service-accounts

Relevance: details the step-by-step process: KDS key -> Create Account -> Install on Host -> Configure Service (IIS).

Microsoft Azure AZ-800 Real Exam Questions [October 2026 Update] Quiz

Premium Access Includes