Exam AZ-801 topic 1 question 6 discussion

Create an authentication policy silo: This groups accounts (such as Domain Admins) to which specific authentication policies will apply, helping to isolate and manage these policies effectively. Define the authentication policy: Once the silo is established, define the authentication policy specifying conditions and restrictions, such as TGT lifetime and sign-in restrictions to domain controllers. Assign the authentication policy silo: Link the defined policy to designated user and computer accounts, ensuring enforcement for those accounts, such as Domain Admins and domain controllers. By following this order, you establish the structure, define policies, and then apply them to the relevant accounts effectively.

Disregard my previous post. After reviewing URL https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/how-to-configure-protected-accounts My answer is 1) Configure the Kerberos Policy settings for the Default Domain Policy Group Policy Object (GPO). 2) Create an authentication policy. 3) Create an authentication policy silo.

Correction: you need the authentication policy first to be able to assign it during the creation of the silo. So the answer provided is correct. Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/how-to-configure-protected-accounts#to-create-an-authentication-policy-silo-by-using-active-directory-administrative-center