You are deploying a new Active Directory Domain Controller to a branch office. The physical security of the branch office is poor, and you are concerned the server could be stolen. How should you deploy the domain controller to minimize the risk of credential theft?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Deploy a Read-Only Domain Controller (RODC).

A Read-Only Domain Controller (RODC) hosts a read-only partition of the AD DS database. By default, it does not store user passwords (unless explicitly cached via the Password Repl...

📋Part of Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ-800 & AZ-801) · Azure Certification Practice

Real Exam ScenarioActive Directory Domain Services

You are deploying a new Active Directory Domain Controller to a branch office. The physical security of the branch office is poor, and you are concerned the server could be stolen. How should you deploy the domain controller to minimize the risk of credential theft?

✓ Correct Answer & ExplanationActive Directory Domain Services

Correct Answer

Deploy a Read-Only Domain Controller (RODC).

Why This Answer Is Correct

A Read-Only Domain Controller (RODC) hosts a read-only partition of the AD DS database. By default, it does not store user passwords (unless explicitly cached via the Password Replication Policy), making it ideal for locations with poor physical security.

📚 What This Question Tests

This question evaluates your knowledge of Active Directory Domain Services — a core concept tested in Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ-800 & AZ-801). Understanding Active Directory Domain Services is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.

All Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ-800 & AZ-801) Questions →Browse All Azure Exams →

You are deploying a new Active Directory Domain Controller to a branch office. The physical security of the branch office is poor, and you are concerned the server could be stolen. How should you deploy the domain controller to minimize the risk of credential theft?

You are deploying a new Active Directory Domain Controller to a branch office. The physical security of the branch office is poor, and you are concerned the server could be stolen. How should you deploy the domain controller to minimize the risk of credential theft?

📚 What This Question Tests

More Active Directory Domain Services Practice Questions