A web application on WEB1 (Windows Server 2022) runs under a gMSA named gmsaWeb and must access CIFS shares on FILE1 (Windows Server 2022) by delegating user credentials. Security requires the resource owner (FILE1) to control which services can act on its behalf and to avoid unconstrained delegation. What should you do? (Choose two)

To achieve resource-based constrained delegation, you must configure PrincipalsAllowedToDelegateToAccount on the resource server (FILE1) to specify which principals (gmsaWeb) can delegate to it. This allows FILE1 to control who can act on its behalf, meeting the security requirement. Additionally, for Kerberos authentication to work correctly from the client to the web application, the HTTP Service Principal Name (SPN) must be registered on the gmsaWeb account. This ensures clients can obtain a Kerberos service ticket for the web application running under gmsaWeb. Configuring constrained delegation on WEB1 using 'Trust this computer for delegation to specified services only' is traditional constrained delegation, which is configured on the delegating server, not the resource server, and doesn't meet the requirement for the resource owner (FILE1) to control delegation. Enabling unconstrained delegation is a security risk and explicitly violates the requirement to avoid it. Enabling protocol transition on WEB1 is not directly related to configuring resource-based constrained delegation or SPN registration for initial Kerberos authentication.