Identity with Windows Server Free Sample Questions

Modifying the Group Policy object linked to the Domain Controllers OU is the correct approach to enable backup operations for domain controllers. The Backup Operators group requires specific user rights assignments including "Back up files and directories" and "Restore files and directories" to perform domain controller backups. These permissions must be applied at the Domain Controllers OU level since domain controllers have unique security requirements that differ from regular domain computers. Applying the GPO at the domain level would be insufficient as it would not override the default domain controller security policies.

Adding high-privilege user accounts to the Protected Users security group is the correct solution for blocking NTLM authentication and requiring Kerberos verification. The Protected Users group, available with Windows Server 2012 R2 domain functional level, automatically enforces several security restrictions including blocking NTLM authentication, preventing DES and RC4 encryption, disabling Kerberos delegation, and limiting credential caching. This group provides enhanced security for sensitive accounts without requiring complex Group Policy configurations. Reference: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-groups