Your network contains an Active Directory forest. The forest contains one domain named contoso.com. The
domain contains three domain controllers. The domain controllers are configured as shown in the following
table.
DC1 has all of the operations master roles installed.
You transfer all of the operations master roles to DC2, and then you uninstall Active Directory from DC1.
You need to ensure that you can use Password Settings objects (PSOs) in the domain.
What should you do?
A.
Change the domain functional level.
B.
Upgrade DC2.
C.
Run the dcgpofix.exe command.
D.
Transfer the schema master role.
Explanation:
The domain functional level must be Windows Server 2008 to use PSO’s
Requirements and special considerations for fine-grained password and account lockout policies:
* Domain functional level: The domain functional level must be set to Windows Server 2008 or higher.
Etc.
Incorrect:
Not B. DC2 is also Windows Server 2008.
Not C. Recreates the default Group Policy Objects (GPOs) for a domain
Not D. Schema isn’t up to right level
AD DS: Fine-Grained Password Policies
http://technet.microsoft.com/en-us/library/cc770394(v=ws.10).aspx