Question
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a child domain named east.contoso.com.
In the contoso.com domain, you create two users named Admin1 and Admin2.
You need to ensure that the users can perform the following tasks:
✑ Admin1 can create and manage Active Directory sites.
✑ Admin2 can deploy domain controllers to the east.contoso.com domain.
The solution must use the principle of least privilege.
To which group should you add each user? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation
Admin1: Contoso\Domain Admins — Active Directory sites, subnets, and site links live in the Configuration naming context, which is mastered in the forest root domain (contoso.com), and the root domain's Domain Admins hold the rights over that partition needed to create and manage the site topology. Contoso\Enterprise Admins would also work but violates least privilege, since it grants full control over every domain in the forest; the East groups have no authority over the forest-wide Configuration partition.
Admin2: East\Domain Admins — promoting an additional domain controller into an existing domain requires membership in the Domain Admins group of that specific domain, so Admin2 needs Domain Admins in east.contoso.com and nothing broader. Contoso\Enterprise Admins would permit the promotion as well but hands Admin2 forest-wide control, and East\Administrators (the domain's built-in group) is not the membership domain controller promotion validates when adding a DC to an existing domain.
