AZ-802 — Frequently Asked Questions

DHCP server authorization creates an object in the forest's Configuration naming context, which requires Enterprise Admin privileges. Domain Admins only have permissions within their own domain, not at the forest level.

Installing the DHCP role requires local administrator rights on the server. Authorizing it in AD DS prevents rogue DHCP servers by requiring Enterprise Admin privileges in a multi-domain forest.

The server must run a supported version of Windows Server, have TCP/IP configured, and be able to resolve DNS records for the domain.

Yes, but it is recommended to make it a Global Catalog for better login performance and authentication across domains in the forest.

A Global Catalog holds a partial replica of every domain's objects, so its Infrastructure Master sees phantom objects as 'real' and stops refreshing them. Keep the role on a non-GC DC unless every DC in the forest is a GC.

The failures are reported in contoso.com, and each Infrastructure Master updates only the phantom references stored in its own domain. Branch's role cannot repair contoso.com's stale references, so contoso.com's role must move instead.

Microsoft scoping rules can technically allow it in some cases, but distribution groups should not be added to security groups from an administration perspective, so only the global and universal security groups Group1 and Group2 qualify.

A global group can contain only global groups, and only groups from the same domain. Since Group4 is a global group in canada.contoso.com, it is the only valid member for Group5.