AZ-802 Exam Questions and Answers

Selective authentication

Selective authentication provides the highest level of control over cross-forest access by preventing remote users from authenticating to any resource until they are explicitly granted permission on a per-object basis. This ensures that users from the fabrikam.com forest can only access the designated file server once the appropriate security permissions are applied.

All domain controllers in the forest must run Windows Server 2016 or later.

A forest cannot be raised to a functional level that exceeds the operating system version of any domain controller currently active in the forest. If a legacy domain controller remains, the forest-wide features associated with the newer version cannot be safely enabled without risking replication failures and administrative inconsistencies across the environment.

All domains in the forest must be at the Windows Server 2016 domain functional level.

The forest functional level is dependent on the status of the domains it contains. You cannot raise the forest functional level until every single domain within that forest has been raised to the corresponding domain functional level first, ensuring that domain-level features are fully compatible with the proposed forest-wide changes and enhancements.

Install-ADDSDomainController

The Install-ADDSDomainController cmdlet is the primary tool for adding a new domain controller to an existing domain. It triggers the promotion process, configures the server as a replica, and ensures all necessary Active Directory components are initialized correctly, providing a streamlined and scriptable method for scaling out domain infrastructure efficiently.

Seize the RID Master role using the 'Move-ADDirectoryServerOperationMasterRole' cmdlet.

Seizing the role is the correct action when the original holder is permanently unavailable. Using the -Force parameter with the PowerShell cmdlet allows a healthy domain controller to take ownership of the RID Master role immediately, enabling the allocation of new RID pools and restoring the ability to create user accounts.

Standalone Managed Service Account (sMSA)

An sMSA is the ideal choice for a single-server application because it provides automated password management and handles Service Principal Name (SPN) registration automatically. This eliminates the manual overhead associated with traditional service accounts while improving security by ensuring complex passwords are rotated frequently by the operating system itself.

Use the Active Directory Recycle Bin to restore the objects.

The Recycle Bin allows for the immediate restoration of deleted objects through the Active Directory Administrative Center or PowerShell. It is the only method that fully preserves all object attributes and linkages without requiring a reboot into DSRM, making it the fastest and most reliable recovery option for modern Active Directory environments.

TCP 443

TCP port 443 is the standard port for HTTPS traffic required by the Azure Connected Machine agent. This port allows the agent to establish a secure, encrypted connection to the Azure Resource Manager endpoints, ensuring that management commands and telemetry data are transmitted securely across the internet or private link.

Check the local DNS server forwarding settings

Since the server cannot resolve the Azure FQDN, the local DNS forwarders are likely misconfigured or restricted. Updating the forwarders to point to public DNS providers or correctly configuring conditional forwarders for Azure domains allows the server to resolve the necessary endpoints to complete the agent registration process.

Use a Group Policy startup script that pulls secrets from a secure vault at runtime

Using a startup script allows for automated deployment, and by retrieving secrets from a secure, managed vault at runtime, you minimize credential exposure. This approach satisfies both the need for scale through GPO and the security requirement to protect sensitive authentication material during the automated onboarding process.

It allows you to apply consistent compliance and configuration settings across hybrid environments

Azure Policy provides a single control plane to define, assign, and manage compliance across Azure and Arc-enabled on-premises resources. By using the same policy definitions, you ensure that security benchmarks like ISO or NIST are consistently applied, regardless of whether the server is located in the cloud or on-premises.

Install the Azure Monitor Agent (AMA) extension

The Azure Monitor Agent is the prerequisite for collecting data from hybrid servers. Installing the extension via Azure Arc allows the machine to process DCRs and stream telemetry back to the Azure Monitor workspace, which is the foundational step for all monitoring activities in the hybrid cloud.

Create a Data Collection Rule (DCR)

DCRs define exactly what data is collected, such as specific Windows Event Logs or performance counters, and where that data is sent. Without a DCR, the Azure Monitor Agent does not know what information to gather, effectively leaving the monitoring service dormant on the target server.

Associate the DCR with the Arc-enabled server

Association acts as the final link in the configuration. By associating the DCR with the specific Arc-enabled machine, you instruct the Azure Monitor Agent running on that local server to begin the collection and transmission of the metrics defined within that specific rule, enabling full observability.

Azure Connected Machine Agent service (himds)

The 'himds' service is the core service for the Azure Connected Machine agent. If this service is not running, the server cannot communicate its status, configuration, or telemetry to Azure. Ensuring this service is in a 'Running' state is the primary step to resolving connectivity issues.

Production Checkpoint

Production checkpoints use the Volume Shadow Copy Service (VSS) within Windows guests to create a data-consistent image of the VM. This ensures that applications are in a proper state for backup and recovery, making it the recommended choice for production environments where application consistency is a requirement.

Host Guardian Service (HGS)

The Host Guardian Service is a central component that provides attestation and key protection services for Shielded VMs. It validates that a Hyper-V host is healthy and authorized before releasing the keys needed to start or migrate a Shielded VM, effectively acting as the security authority for the fabric.

Guarded Hosts

Guarded Hosts are physical Hyper-V hosts that have been configured to run Shielded VMs. These hosts must pass an attestation check with the Host Guardian Service to prove they are running authorized software and have a secure configuration before they are permitted to host protected virtual workloads.

Support for virtual disks up to 64 TB in size.

VHDX supports a massive increase in maximum storage capacity, allowing for virtual hard disks up to 64 TB. This capacity is essential for hosting large data volumes, big data applications, and extensive file shares that were previously impossible to manage with the older VHD format's limitations.

Protection against data corruption during power failures using a log.

VHDX includes a metadata logging feature that tracks changes to the file's structure. In the event of a power failure or system crash, the log can be used to recover the disk to a consistent state, significantly reducing the risk of data corruption compared to the VHD format.

Improved alignment for large sector disks.

Larger logical sector sizes are supported by the VHDX format, which improves performance when used with modern physical disks that have 4KB sectors. This alignment reduces the overhead associated with read-modify-write operations, leading to more efficient disk I/O and better overall performance for virtualized server workloads.

Soft quota with threshold notifications configured at the 90 percent level

A soft quota tracks storage consumption and triggers alerts when thresholds are met without restricting write operations. This configuration satisfies the requirement to warn administrators at 90 percent while permitting users to continue saving files past 500 GB.

Nested resiliency

Nested resiliency is specifically engineered for two-node clusters to provide local and remote parity or mirroring. By combining RAID-1 across nodes with an additional layer of RAID-1 or RAID-5 within each node, the system survives a node failure and a drive failure. This provides the highest level of uptime for small-scale hyperconverged infrastructure deployments.

Volume Free Space policy

Volume Free Space policy defines a threshold of free space that must be maintained on the volume containing the server endpoint. When the specified percentage is reached, Azure File Sync automatically tiers the least recently used files to Azure. This is the most effective way to prevent local storage from becoming full in a tiering scenario.

VDI deployment share (VHDs)

Virtual Desktop Infrastructure (VDI) environments contain many virtual machine disks that are nearly identical. This high level of redundancy makes VDI a perfect candidate for Data Deduplication, often resulting in storage savings of up to 90 percent. Windows Server includes a specific optimization mode designed to handle the unique I/O patterns of VDI workloads.

General-purpose file shares

General-purpose file shares often host many versions of the same documents, installers, and office files. This workload is the primary use case for Data Deduplication. It provides a balanced approach to storage savings and performance, allowing the server to reclaim significant space while maintaining fast access times for end users through intelligent caching.

iSCSI Virtual Disk

The iSCSI Virtual Disk is a VHDX file that acts as the backing storage for the iSCSI target. Without creating a virtual disk, there is no block storage to present to the initiator. These disks can be grown dynamically and are managed through the File and Storage Services section of Server Manager or via PowerShell.

iSCSI Target

An iSCSI Target is a logical object on the server that groups virtual disks and defines which initiators can access them. You must create a target and associate it with the initiator's IQN or IP address. This ensures that only authorized servers can see and mount the specific volumes intended for their use.

AD DS Authentication for Azure Files

By domain-joining the Azure Storage account to the on-premises AD DS environment, users can access Azure file shares using their existing domain credentials. This method supports the enforcement of share-level permissions via Azure RBAC and directory/file-level permissions via standard NTFS ACLs, providing a familiar management model for Windows administrators.

The Role Capability file (.psrc)

The Role Capability file is a PowerShell data file that specifies what a user can do once they connect to a session. It explicitly lists cmdlets, functions, and provider capabilities permitted for the role. This allows administrators to grant specific permissions, like restarting a service, without granting full local administrative permissions on the server.

SMB Signing

SMB Signing provides a digital signature for every SMB packet. If an attacker modifies a packet in transit, the signature will no longer match, and the receiving system will discard the tampered data. This effectively mitigates man-in-the-middle attacks by ensuring the authenticity and integrity of the communication channel between endpoints.

To provide a dedicated environment that is isolated from the risks of email and web browsing.

The core objective of a PAW is to isolate administrative functions from the most common attack vectors, such as phishing and drive-by downloads. By using a hardened, dedicated machine for administrative tasks, the likelihood of a Domain Admin's credentials being compromised by malware residing on a standard workstation is greatly reduced.

Virtualization Extensions (Intel VT-x or AMD-V) and SLAT

Credential Guard requires hardware virtualization extensions and Second Level Address Translation (SLAT) to run the LSA in a virtualized container. This isolation prevents even a compromised kernel from accessing the stored credentials. Without these CPU features, the system cannot create the secure 'Virtual Secure Mode' needed to protect the LSA secrets.

The Attestation Service

The Attestation Service is the component that validates the Hyper-V host's identity and configuration. It ensures that the host is running approved code and has not been tampered with. Only after a host successfully completes this attestation process is it considered 'healthy' and allowed to receive the keys to run Shielded VMs.

Replica mode

Replica mode ensures that the downstream server is a mirror of the upstream server regarding update approvals and deadlines. When an update is approved on the upstream server, it is automatically approved on the replica downstream server. This simplifies administration by allowing all update decisions to be made from a single central console.

Data Collection Rules

These rules define the data sources and destinations for the Azure Monitor Agent. By creating a rule, you specify exactly which event logs to capture and link it to the target virtual machines. This is the mandatory mechanism for configuring the AMA to stream Windows Server logs to a workspace.

Get-PhysicalDisk

This cmdlet retrieves the status of every physical disk visible to the storage subsystem. It displays critical properties such as HealthStatus, OperationalStatus, and Usage. This is the primary tool for identifying which specific drive has failed or been marked as retired within an S2D cluster or a standard storage pool.

Collector-initiated subscription

This model requires the collector server to have a list of all source computers. The collector then connects to each source computer using WinRM to pull the events. This satisfies the requirement where the central server is the initiator of the communication channel for event log harvesting.

The server has a sustained CPU bottleneck.

The output shows the total processor time consistently exceeding 85% and reaching up to 95% across all samples. While five samples is a short duration, the lack of variation below the 80% threshold suggests the processor is under heavy load and may be unable to handle additional requests efficiently.

Resource Monitor

Resource Monitor includes a Disk tab that lists all active processes, their current disk transfer rates, and a 'Disk Activities' section. This section explicitly shows which files are being accessed by each process, making it the ideal tool for pinpointing the exact source of disk contention.

Run 'pktmon start --etw' to begin.

This command initiates the packet capture process. The '--etw' flag ensures that the traffic is logged using Event Tracing for Windows, which is the underlying framework Pktmon uses to record network events. This is the standard first step for capturing live traffic data on the server.

Run 'pktmon pcapng' to convert the log.

By default, Pktmon saves captures in an .etl format, which is not natively readable by most network analysis tools. The 'pcapng' sub-command converts these logs into the PCAPNG format, allowing the administrator to export the data and analyze it using standard tools like Wireshark on a workstation.

Get-NetRoute

This cmdlet retrieves the current routing table entries. It is the primary tool for verifying that the operating system recognizes the destination subnets and maps them to the appropriate network interfaces. If a route is missing or pointing to the wrong interface, this cmdlet will clearly highlight the discrepancy.

Azure Site-to-Site VPN

This service creates an IPsec/IKE VPN tunnel between your on-premises VPN gateway and an Azure Virtual Network gateway. It is designed specifically for persistent, secure connectivity over the public internet, making it the ideal choice for hybrid networking when a private fiber connection is not required or available.

Create an inbound rule that allows connections for the specific application executable.

Creating an inbound rule tied to the application executable allows the firewall to whitelist traffic only for that specific process. This provides granular control, ensuring that only the intended service can listen for and receive incoming network requests, effectively shielding the system from unauthorized connection attempts on other ports.

Modify the default inbound policy to block all connections.

Changing the default inbound behavior to 'Block' is the foundational step in a 'deny by default' security posture. This ensures that any incoming traffic not explicitly permitted by a specific firewall rule is automatically dropped, which is essential for protecting the server against unauthorized access and reconnaissance attempts.

New-NetRoute

New-NetRoute is the correct cmdlet for creating new entries in the routing table. It allows administrators to define the destination subnet and the gateway (next hop) for the traffic. Using the appropriate flags, it ensures the route remains active even after the server is restarted or the network stack resets.

Routing and Remote Access (RRAS)

RRAS is the Windows Server service that provides NAT, VPN, and traditional routing capabilities. It allows the server to act as a gateway that performs address translation for internal private networks, translating private IP addresses to a public address for outbound traffic, thus providing the required internet access and security.

Receive Side Scaling (RSS)

RSS enables the parallel processing of incoming network traffic across multiple CPU cores. By spreading the load, it prevents a single core from becoming a bottleneck during high-volume transfers, effectively improving overall system performance and throughput for data-intensive applications running on the Windows Server host.