Your network contains an Active Directory domain named contoso.com. The domain contains two
servers named Server1 and Server2 that run Windows Server 2012 R2. Server1 has the IP Address
Management (IPAM) Server feature installed. Server2 has the DHCP Server server role installed. A
user named User1 is a member of the IPAM Users group on Server1. You need to ensure that User1
can use IPAM to modify the DHCP scopes on Server2. The solution must minimize the number of
permissions assigned to User1.
To which group should you add User1?
A.
IPAM ASM Administrators on Server1
B.
IPAMUG in Active Directory
C.
DHCP Administrators on Server2
D.
IPAM MSM Administrators on Server1
Explanation:
Sever2 “DHCP Users” group membership is required to modify scopes on Server2 of course DHCP
Administrators can proceed these tasks too. From the MSPress book “Upgrading your skills to MCSA
Windows Server 2012 R2″ IPAM Provisioning IPAM installation sets up various periodic data
collection tasks to collect relevant data from managed DNS, DHCP, DC and NPS servers to enable
address space management, multiserver management and monitoring and event catalog scenarios.
All IPAM tasks launch under the Network Service account, which presents the local computer’s
credentials to remote servers. To accomplish this, administrators must enable read access and
security permissions for the required resources over managed servers for the IPAM server’s
computer account. Further the relevant firewall ports need to be configured on
these managed servers. IPAM Access Settings The following table provides a mapping of the IPAM
functionality and managed server role type to access setting and FW rule required by IPAM periodic
tasksIPAM Access Monitoring
IPAM access monitoring tracks the provisioning state of the following statuses on the server roles,
which are displayed in the details pane of the IPAM server inventory view
DHCP Users cannot modify anything in DHCP. Only DHCP Administrators can modify DHCP scopes, settings, etc. and only on the local server. They cannot authorize or unauthorize the DHCP server itself, nor can they modify DHCP settings on other DHCP servers unless they are explicit or inherited members. Answer is C, but the “explanation” starts off incorrect.
No way, the ipam users won’t be able to modify the dhcp scopes in another server, they need to be both dhcp administrators and IPAM MSM administrators, so the correct answer would be C and D, but if in the exam only appears IPAM MSM administrators, I would go for that one.
I just double checked this in my lab, you don’t need to be dhcp administrator at all, therefore correct answer is D
IPAM MSM Administrators: IPAM multi-server management (MSM) administrators can manage DNS and DHCP servers.
https://technet.microsoft.com/en-ca/library/jj878348.aspx
So correct answer is D
Don’t know about that, doesn’t say user needs to modify scope from both servers. Two key points in the question:
1. You need to ensure that User1 can use IPAM to modify the DHCP scopes on Server2.
2. The solution must minimize the number of permissions assigned to User1.
Vote is for C