Question
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a user named User1 and the servers shown in the following table.
| Name | Server role | DHCP scope |
|---|---|---|
| Server1 | DHCP Server | Scope1, Scope2 |
| Server2 | DHCP Server | Scope3, Scope4 |
You need to ensure that User1 can manage only Scope1 and Scope3.
What should you do?
- A. Add User1 to the DHCP Administrators group on Server1 and Server2.
- B. Implement IP Address Management (IPAM). Correct
- C. Add User1 to the DHCP Administrators domain local group.
- D. Implement Windows Admin Center and add connections to Server1 and Server2.
Explanation
IP Address Management (IPAM) role-based access control lets you delegate DHCP administration below the server level. You assign User1 the IPAM DHCP Scope Administrator role through an access policy, with an access scope that contains only Scope1 and Scope3, so User1 can manage those two scopes and nothing else. Adding User1 to the DHCP Administrators group on Server1 and Server2, or to a domain DHCP Administrators group, gives full control of every scope on the servers, including Scope2 and Scope4. Windows Admin Center connects with the user's own server permissions and has no scope-level delegation.
