Question
Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains the servers shown in the following table.
The domain controllers do NOT have internet connectivity.
You plan to implement Azure AD Password Protection for the domain.
You need to deploy Azure AD Password Protection agents. The solution must meet the following requirements:
• All Azure AD Password Protection policies must be enforced.
• Agent updates must be applied automatically.
• Administrative effort must be minimized.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
| Name | Description |
| --- | --- |
| DC1 | Domain naming master, PDC emulator, and RID master |
| DC2 | Schema master and infrastructure master |
| RODC1 | Read-only domain controller (RODC) |
| Server1 | Azure AD Connect server |
| Server2 | Azure AD Application Proxy connector |
Explanation
Install the Azure AD Password Protection agent on: DC1 and DC2 only. Passwords are checked by whichever writable domain controller processes the change or reset, so every writable DC needs the DC agent for the policy to be enforced everywhere. RODCs do not process or store password changes; they forward them to a writable DC. Microsoft states that the DC agent does not have to be installed on RODCs, so leaving RODC1 out also keeps effort down.
Install the Azure AD Password Protection Proxy on: Server1. The proxy downloads the policy and banned-password lists from Azure AD, so it needs internet access. The domain controllers have none, and the proxy is not supported on an RODC (on a writable DC it is meant for testing only). The proxy upgrades itself automatically through the Azure AD Connect Agent Updater service. Azure AD Application Proxy installs a different, incompatible version of that updater, and Microsoft says never to install both on the same machine because the updater can then no longer get updates. That rules out Server2. Server1, a member server with internet access, meets every requirement.
