Free 70-742 sample questions

Correct answer: Yes

Adding high-privilege user accounts to the Protected Users security group is the correct solution for blocking NTLM authentication and requiring Kerberos verification. The Protected Users group, available with Windows Server 2012 R2 domain functional level, automatically enforces several security restrictions including blocking NTLM authentication, preventing DES and RC4 encryption, disabling Kerberos delegation, and limiting credential caching. This group provides enhanced security for sensitive accounts without requiring complex Group Policy configurations. Reference: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-groups

Correct answer: Yes

Configuring a data recovery agent (DRA) or super user group for AD RMS is the correct approach to ensure content can be accessed even if the original encryption account is compromised or unavailable. AD RMS super users have unrestricted access to all RMS-protected content within the organization, bypassing normal usage rights restrictions. This provides a critical recovery mechanism for business continuity while maintaining the security integrity of the RMS infrastructure. The CA integration ensures proper certificate-based authentication for the recovery process.