This scenario requires double-hop authentication from Server1 to Server2 via PowerShell, then from Server2 to Backup1 for resource access. Resource-based Kerberos constrained delegation is the most appropriate solution as it follows the principle of least privilege by configuring delegation at the resource level (Backup1) and minimizes administrative effort without requiring domain admin rights.
Reference: https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos- constrained-delegation-overview