To collect specific events (Event ID 1035) from Windows Application logs while minimizing data volume, you must filter at the source. The Azure Monitor Agent (AMA) uses Data Collection Rules (DCRs) to define which data to ingest. Within a DCR, you can apply an XPath query to filter for specific Event IDs before the data is transmitted to the Log Analytics workspace. This prevents the ingestion of unnecessary logs, thereby reducing storage costs. KQL is used for querying data already in the workspace, and WQL is for WMI; only XPath provides the granular source-side filtering required for Windows event logs in a DCR.

Microsoft Learn: Data Collection Rules in Azure Monitor. Section: "Filter events using XPath queries". Documentation on configuring the Azure Monitor Agent for specific event collection.

Microsoft Learn: Collect Windows event logs with Azure Monitor Agent. Details the use of XPath expressions (e.g., Application!*[System[(EventID=1035)]]) to limit log ingestion.

Microsoft Docs: Azure Monitor Agent overview. Technical specifications confirming AMA replaces the legacy Log Analytics agent and utilizes DCRs for efficient data routing and filtering.

W3C Recommendation: XML Path Language (XPath) Version 1.0. The underlying standard used by Windows Event Viewer and Azure Monitor DCRs for log selection.

The solution meets the goal. Microsoft Sentinel is built on a Log Analytics workspace. To collect data from an on-premises Windows Server, an agent must be installed on the server to forward logs to the workspace. The Log Analytics agent (also known as the Microsoft Monitoring Agent or MMA) is a supported method for this connection. The Windows Firewall data connector in Microsoft Sentinel relies on this agent to collect and forward the relevant firewall logs from the server. Therefore, installing the Log Analytics agent on Server1 is a correct and necessary step to enable log collection.

B. No: This is incorrect. Installing the Log Analytics agent is a valid and standard procedure for connecting on-premises Windows Servers to Microsoft Sentinel for log collection, as required by the Windows Firewall data connector.

1. Microsoft Learn | Microsoft Sentinel documentation. "Connect Windows Firewall to Microsoft Sentinel." This document explicitly states the prerequisites for the connector: "You can connect Windows Firewall logs from any Windows machine (physical or virtual

on-premises or in any cloud) that has the Log Analytics agent (MMA) or the Azure Monitor agent (AMA) installed." This confirms that installing the Log Analytics agent (MMA) is a valid solution.

2. Microsoft Learn | Azure Monitor documentation. "Log Analytics agent overview." This article details the agent's function: "The Log Analytics agent collects telemetry from Windows and Linux virtual machines from any cloud

on-premises machines

and those monitored by System Center Operations Manager and sends it to a Log Analytics workspace in Azure Monitor." This establishes the agent's role in connecting on-premises machines to the underlying platform used by Sentinel.

Add a custom domain name: By default, an Azure Web App is only accessible via [appname].azurewebsites.net. To enable the application (WebApp1) to accept and validate requests for the production URL (www.fabrikam.com), you must configure a custom domain name within the App Service settings. This binds the hostname to the resource.

Modify a DNS record: To actually direct internet traffic for www.fabrikam.com to the new Azure resource, you must update the authoritative DNS records (typically a CNAME record pointing to webapp1.azurewebsites.net or an A record pointing to the App Service IP). This resolves the domain name to the new Azure location for client connections.

Microsoft Learn - Map an existing custom DNS name to Azure App Service:

Section: "Overview" - "To use a custom domain... you must map the custom domain name to your app."

Section: "Map a CNAME record" - "A CNAME record maps a DNS name to another DNS name... creating a CNAME record that maps your custom domain to your app's default domain name."

URL: https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain

Microsoft Learn - Migration checklist when moving to Azure App Service:

Step: "Update DNS records to point to your App Service app."

URL: https://learn.microsoft.com/en-us/azure/app-service/manage-custom-dns-buy-domain

To perform a rolling upgrade with zero downtime, you must upgrade one node at a time. First, pause and drain the node (Suspend-ClusterNode) to live-migrate virtual machines to other nodes. Second, explicitly place the node in storage maintenance mode (Enable-StorageMaintenanceMode); this is a critical step for Storage Spaces Direct to prevent it from triggering massive data synchronization or repair jobs while the node is offline for the OS upgrade. Third, perform the upgrade to Windows Server 2025. After the upgrade and reboot, remove the node from storage maintenance mode to allow storage data to resync. Finally, resume the cluster node to allow it to host VMs again.

Microsoft Learn - Maintain servers in Azure Stack HCI and Windows Server: This documentation outlines the specific procedure for taking a server offline for maintenance in a Storage Spaces Direct environment, confirming the order of suspending the node, enabling storage maintenance mode, doing the work, disabling maintenance mode, and resuming the node.

Source: "Taking a server offline for maintenance"

URL: https://learn.microsoft.com/en-us/azure-stack/hci/manage/maintain-servers

Microsoft Learn - Cluster Operating System Rolling Upgrade: Describes the general process of pausing and draining nodes to ensure workloads remain available during the upgrade process.

Source: "Cluster Operating System Rolling Upgrade"

URL: https://learn.microsoft.com/en-us/windows-server/failover-clustering/cluster-operating-system-rolling-upgrade

The Storage Migration Service is the purpose-built tool in Windows Server for migrating file servers, including their files, shares, and configurations, from a source server to a destination server. It inventories data on old servers, transfers the data and configuration to new servers, and then optionally takes over the identity of the old server. This makes it the ideal solution for migrating an existing file share like Share1 to a new platform with minimal user disruption.

B. File Server Resource Manager (FSRM): FSRM is used for managing and classifying data on file servers, such as setting quotas or implementing file screens, not for migrating shares.

D. Storage Replica: Storage Replica is a disaster recovery technology used for replicating entire volumes between servers, not for a one-time migration of a specific share.

C. Server Manager: Server Manager is a general management console for Windows Server roles and features; it lacks the specialized, end-to-end workflow for migrating file shares.

1. Microsoft Learn. (2023). Storage Migration Service overview. "Storage Migration Service makes it easier to migrate storage to Windows Server... It provides a graphical tool that inventories data on Windows

Linux

and NetApp CIFS servers and then transfers the data and configuration to newer servers."

2. Microsoft Learn. (2023). File Server Resource Manager (FSRM) overview. "File Server Resource Manager (FSRM) is a suite of tools for Windows Server that enable you to manage and classify data stored on file servers."

3. Microsoft Learn. (2023). Storage Replica overview. "Storage Replica is Windows Server technology that enables replication of volumes between servers or clusters for disaster recovery."

Server1 (Request Mode): The "Request Inbound and Outbound" rule is permissive. It prefers security but does not enforce it. Therefore, Server1 can establish an IPsec tunnel with Server3 (which requires it) and Server2, but can also downgrade to standard TCP/IP to communicate with Server4 (which has no rules).

Server3 (Require Mode): The "Require Inbound and Outbound" rule is restrictive. Server3 sends a negotiation request (Main Mode/Quick Mode). Server1 and Server2 respond and establish the secure session. Server4, lacking any IPsec policy, ignores the negotiation or fails the handshake. Consequently, Server3 blocks traffic to/from Server4.

Microsoft Learn - Connection Security Rules: Rules that specify "Request" allow fallback to clear text, enabling communication with non-IPsec hosts. Rules that specify "Require" strictly enforce IPsec.

Source: Create an Authentication Exemption Rule (See "Request" vs "Require" behavior logic).

Microsoft Learn - IPsec Isolation: When Server isolation is implemented, servers in the "Boundary Zone" (Request mode) can talk to both "Secure Zone" (Require mode) and generic clients.

Source: Introduction to Server and Domain Isolation

To raise the Forest Functional Level (FFL) to Windows Server 2016, all Domain Controllers (DCs) in the forest must be running Windows Server 2016 or later. DC2 (Server 2022) and DC3 (Server 2019) already meet this requirement, but DC1 (Server 2012 R2) does not and prevents the raise.

To satisfy the requirements:

1. Move FSMO roles: DC1 currently holds all FSMO roles. To minimize downtime and unavailability of these roles during the upgrade process (which takes the server offline), they must be moved to a running DC (DC2) before work begins.
2. Upgrade DC1: Performing an in-place upgrade on DC1 updates its OS to a compliant version while preserving the identity and existence of the DC, ensuring there are still three domain controllers after the process.
3. Raise Functional Level: Once all DCs are at the required OS level, the functional level can be successfully raised.

Microsoft Learn. (2024). Upgrade Domain Controllers to Windows Server 2016. Retrieved from https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers

Relevant Section: "Prerequisites" and general upgrade procedures advise ensuring functional level requirements are met and recommending role transfers to maintain availability.

Microsoft Learn. (2024). Forest and Domain Functional Levels. Retrieved from https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels

Relevant Section: "Windows Server 2016: All domain controllers in the domain must be running Windows Server 2016 or newer."

The volume is already encrypted, so you must use Add-BitLockerKeyProtector to append a new protector. The command specifies the -ADAccountOrGroupProtector parameter with a computer account (CONTOSO\Server1$). When configuring a BitLocker volume to be unlocked by a specific service account or the computer account itself (common for non-OS data volumes that need to mount automatically without user interaction but bound to the machine identity), the -Service parameter is required. Enable-BitLockerAutoUnlock is incorrect because it does not support AD account parameters.

Microsoft Learn (PowerShell): Add-BitLockerKeyProtector

Confirming the syntax: Add-BitLockerKeyProtector [-MountPoint] [-ADAccountOrGroup] [-ADAccountOrGroupProtector] [-Service] ...

URL: https://learn.microsoft.com/en-us/powershell/module/bitlocker/add-bitlockerkeyprotector

Microsoft Learn (Operations): BitLocker Operations Guide

Discusses "Service-based" protectors for unlocking volumes on servers.

URL: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/operations-guide

First, the storage must be managed by the cluster, so you add the disk resource and then promote it by creating a Cluster Shared Volume (CSV). According to Microsoft best practices for CSVs, you must put the disk in maintenance mode (Suspend-ClusterResource) before modifying the volume with encryption to ensure exclusive access. Next, you enable BitLocker on the volume to encrypt the data. Finally, you update the BitLockerProtectorInfo property (using Set-ClusterParameter) with the key protector ID; this step is crucial for ensuring the Cluster service can retrieve the key and unlock the volume automatically across all nodes.

Microsoft Learn - BitLocker on Cluster Shared Volumes (CSV):

"When using BitLocker with volumes designated for a cluster... Put the resource into maintenance mode before enabling BitLocker."

This source confirms the necessity of maintenance mode specifically for CSVs.

Source: BitLocker: How to deploy on Windows Server 2012 and later (Section: BitLocker on Cluster Shared Volumes).

Microsoft Learn - PowerShell Cmdlets for Clustering:

Documentation for Set-ClusterParameter often uses BitLockerProtectorInfo in examples for configuring CSV encryption, confirming this is a post-encryption configuration step to store the recovery key ID in the cluster database.

Microsoft Technical Documentation - Failover Clustering:

The workflow is described as: Add Disk -> Add to CSV -> Suspend Resource (Maintenance) -> Enable BitLocker -> Resume Resource -> (Optional/Required per version) Update Cluster Parameter.

The goal is to ensure that the application App1 continues to run on Server2 after Server1 restarts. This behavior is known as "failback." The setting that controls this is on the Failover tab, labeled "Allow failback." The exhibit shows this is already set to "Prevent failback," which means the cluster will not automatically move App1 back to Server1 when it comes online.

The proposed solution is to increase the "Maximum failures in the specified period." This setting determines how many times the cluster will attempt to restart a role within a given timeframe before leaving it in a failed state. It has no effect on the failback policy. Therefore, the proposed solution does not address the stated goal.

A. Yes: This is incorrect. Modifying the "Maximum failures" setting does not control the failback behavior of a clustered role; it only affects the role's tolerance to repeated failures.

1. Microsoft Learn

Configure failover and failback for a clustered role: This document explicitly distinguishes between failover settings and failback settings. It states

"Failback is the process of returning a clustered role to its preferred node after the node is back online." It then details the "Prevent failback" option

which is already configured in the scenario. It separately describes the "Maximum failures" setting as controlling restart attempts

confirming it is unrelated to failback. (See sections: "Configure failback" and "Configure failover").

2. Microsoft Learn

Set-ClusterGroup: The documentation for the PowerShell cmdlet used to manage cluster roles shows distinct parameters for these settings. The -FailbackType parameter controls failback behavior (PreventFailback

AllowFailback

etc.)

while the -FailoverThreshold parameter corresponds to "Maximum failures in the specified period." This separation in the management tool confirms they are independent configurations. (See parameter descriptions for -FailbackType and -FailoverThreshold).