Azure File Sync is the correct choice because it provides near real-time synchronization between on-premises Windows Servers and Azure Files. It meets the 15-minute RPO by continuously syncing changed files. In a disaster, the Azure file share becomes the primary access point with minimal data loss, offering a seamless failover experience compared to VM replication or manual/backup-based methods.

Remote Credential Guard is designed to protect against Pass-the-Hash and other credential theft attacks specifically for Remote Desktop Protocol (RDP) sessions. It redirects Kerberos requests back to the client device for processing, preventing credentials from being stored on the target server. Credential Guard (option A) is a stronger feature but is not available on Windows Server 2012 R2.

Azure Private DNS zones provide a managed, resilient DNS service for hybrid networks. Creating a private zone for ‘corp.contoso.com’ and linking it to the Azure VNet allows Azure VMs to resolve on-premises names. Configuring conditional forwarding from on-premises DNS servers to Azure DNS (via the virtual network’s DNS server IP) allows on-premises clients to resolve Azure VM names. This is more efficient and scalable than managing manual VM-based DNS servers.

Authentication Policy Silos are a feature designed for tiered administration models. They can be configured to require a second factor of authentication (like a smart card) for any logon attempt to computers assigned to the silo (e.g., domain controllers). This enforces strong authentication at the resource level, which is the requirement stated. The other options either block access entirely or protect credentials in transit but do not enforce multi-factor authentication at the DC logon.

In a failover cluster, when a clustered role (like SQL Server) starts, its dependent network name resource tries to create a corresponding Virtual Computer Object (VCO) in Active Directory. This creation is performed by the Cluster Name Object (CNO). If the CNO’s permissions were inadvertently modified or are insufficient, it cannot create the VCO, causing the network name and all dependent resources (like SQL Server) to fail. This is a common issue after maintenance that affects AD permissions. Verifying and correcting the CNO’s permissions in the appropriate OU is the critical first step.

Azure Automation Update Management provides a cloud-native solution for managing operating system updates for Windows and Linux machines across hybrid environments (via Azure Arc). It allows you to assess update status, schedule deployments, and set maintenance windows, all from the Azure portal. This significantly reduces the overhead of managing a full WSUS VM infrastructure while still giving you control over update approval and deployment scheduling, meeting the stated goal.

For Azure VMs, you can resize the OS disk without stopping the VM for data disks, but for the OS disk, the VM must be deallocated (stopped). This process is quick and non-destructive: stop the VM, increase the disk size in the Azure portal or via CLI/PowerShell, start the VM, and then use Disk Management or PowerShell within Windows to extend the volume into the new space. This is the most straightforward solution to solve an out-of-space issue on the OS drive.

The core of JEA is defining precise capabilities in a Role Capabilities File (.psrc). The correct method is to create a new file with New-PSRoleCapabilityFile and explicitly define the cmdlets users are allowed to run in the ‘VisibleCmdlets’ field. You can further restrict parameters using parameter filters. This creates a true least-privilege endpoint. Option A grants full admin rights, Option C is for more complex modules, and Option D provides no JEA restrictions.

By default, Azure AD Connect syncs every 30 minutes. The most direct way to accelerate the propagation of a disabling/deletion event to Azure AD is to reduce the synchronization cycle interval. Setting it to the minimum supported interval of 15 minutes ensures changes are reflected in Azure AD much faster, thereby revoking access to cloud resources more quickly. The other options relate to feature enablement or recovery but do not directly accelerate the sync frequency of delta changes.

Azure File Sync is the correct choice because it provides near real-time synchronization between on-premises Windows Servers and Azure Files. It meets the 15-minute RPO by continuously syncing changed files. In a disaster, the Azure file share becomes the primary access point with minimal data loss, offering a seamless failover experience compared to VM replication or manual/backup-based methods.0