You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure
Active Directory (Azure AD) tenant The on-premises network is connected to Azure by using a Site-to-
Site VPN. You have the DNS zones shown in the following table.
You need to ensure that names from fabrikam.com can be resolved from the on-premises network
Which two actions should you perform? Each correct answer presents part of the solution, NOTE:
Each correct selection Is worth one point
You need to ensure that names from fabrikam.com can be resolved from the on-premises network
Which two actions should you perform? Each correct answer presents part of the solution, NOTE:
Each correct selection Is worth one pointI actually thought B and E were enough since a stub zone can help with forwarding requests too. Pretty common to think stub zones do the trick, but maybe I'm missing something about the conditional forwarder requirement here. Trap for sure if you mix up stub vs forwarder.
A imo. Had something like this in a mock and the double-hop problem was exactly the scenario. Kerberos constrained delegation lets your creds pass from Server1 to Server3 through Server2, with less risk than unconstrained delegation. The other options don't really fix that hop issue. Pretty sure that's what they want here, but open to other takes.
I get why some might pick C, but that's more for cross-forest or when restricting which servers users can authenticate to. Here the double-hop issue is classic for remote PowerShell, so pretty sure A (Kerberos constrained delegation) is what solves it with minimal config. D's not relevant here since it's not about just relaxing restrictions overall. Let me know if I'm missing some nuance!