AZ-802 Practice Test 11 — 15 Questions

Question 1

You are securing a Windows Server 2022 instance against potential malware. Which THREE actions are recommended to minimize the attack surface?

Accepted Answer

Disable unnecessary services and features.. Reducing the attack surface is a proactive security strategy that involves disabling unnecessary features and services. By removing unused software, restricting network exposure, and managing administrative privileges, you limit the vectors available for a potential intruder to gain a foothold. This process is essential for maintaining the integrity of the server and ensuring that only required code runs, thereby reducing the risk of exploitation and unauthorized system access.

Answer

Install all available third-party toolbars and plugins.

Answer

Configure Windows Firewall to allow all inbound traffic.

Question 2

Refer to the exhibit. An administrator runs a PowerShell command to monitor a server. Based on the output provided, which conclusion regarding the server's state is most accurate?

Accepted Answer

The server has a sustained CPU bottleneck.. Analyzing performance counter output requires understanding both the metric and the duration of the sample. In this case, the CPU usage is consistently high over a ten-second period. While this might indicate a bottleneck, an administrator must determine if this is a transient spike or a sustained trend that requires further investigation into specific processes.

Answer

The server is experiencing a critical memory leak.

Answer

Disk I/O latency is causing the high CPU values.

Answer

The server is idling normally with background tasks.

Question 3

Refer to the exhibit. You are investigating why a secure connection is failing on your web server. Based on the output, what is the most likely reason?

Accepted Answer

The server cannot reach the CRL distribution point.. A failed revocation check indicates that the client or server cannot verify if the certificate has been prematurely invalidated by the issuing CA. This check is crucial for security because it ensures that compromised certificates are not being used. Connectivity failures here usually stem from the inability to reach the Certificate Revocation List (CRL) distribution point, often due to network blocking or incorrect DNS resolution for the URL defined in the certificate.

Answer

The certificate has expired.

Answer

The certificate chain is incomplete.

Answer

The private key is missing on the server.

Question 4

You are transitioning several Windows Server 2022 Azure Virtual Machines from the legacy Log Analytics Agent to the newer Azure Monitor Agent (AMA). You need to ensure that specific System and Application event logs are centralized in a Log Analytics workspace. What component must you create and associate with the virtual machines to facilitate this data collection?

Accepted Answer

Data Collection Rules. The Azure Monitor Agent relies on Data Collection Rules (DCR) to define which data should be collected and where it should be sent. Unlike the legacy agent which used workspace-wide settings, DCRs provide a more granular and flexible approach, allowing administrators to target specific servers with unique logging requirements while maintaining a centralized management structure in the Azure portal.

Answer

Diagnostic Settings

Answer

Log Analytics Gateway

Answer

Automation Accounts

Question 5

An administrator is troubleshooting a Storage Spaces Direct (S2D) cluster where one node shows a status of 'Retired'. The administrator needs to identify if a physical disk failure or a communication timeout caused this status. Which PowerShell cmdlet provides the most detailed health information regarding the operational status of the underlying physical disks in the storage pool?

Accepted Answer

Get-PhysicalDisk. In a Windows Server Failover Cluster utilizing Storage Spaces Direct, monitoring physical disk health is critical for maintaining data redundancy. The retired status often indicates a hardware failure or a disk that has exceeded error thresholds. Using the correct PowerShell cmdlet allows administrators to drill down into the health metadata and operational status codes for precise troubleshooting.

Answer

Get-StoragePool

Answer

Get-VirtualDisk

Answer

Debug-StorageSubsystem

Question 6

You suspect that a specific process on a Windows Server is consuming excessive disk bandwidth, causing other applications to slow down. Which built-in tool provides the quickest way to see a live list of processes and the specific files they are currently reading or writing to?

Accepted Answer

Resource Monitor. Windows provides several tools for performance monitoring, but they vary in granularity. Resource Monitor is specifically designed to bridge the gap between Task Manager and Performance Monitor by providing detailed, real-time information about hardware resource usage at the process and file level, which is critical for identifying I/O contention.

Answer

Task Manager

Answer

Performance Monitor

Answer

Event Viewer

Question 7

You are configuring Windows Event Forwarding (WEF) in a domain environment. You want the collector server to initiate the connection to the source computers to gather events. Which type of subscription should you implement to achieve this behavior?

Accepted Answer

Collector-initiated subscription. Windows Event Forwarding supports two main subscription models: source-initiated and collector-initiated. Choosing the correct model depends on network topology and management requirements. Collector-initiated subscriptions are useful when the administrator wants the central server to control the polling interval and manage the list of source computers explicitly within the subscription configuration itself.

Answer

Source-initiated subscription

Answer

WMI-based subscription

Answer

Push-based subscription

Question 8

An organization is migrating its on-premises Windows Server 2022 monitoring strategy to Azure Monitor. You need to collect specific event logs and performance counters from 500 servers using the most modern, secure, and centralized management method available. Which agent should you deploy to these servers to support Data Collection Rules (DCR)?

Accepted Answer

The Azure Monitor Agent (AMA). Monitoring strategies have evolved from the legacy Log Analytics agent to the Azure Monitor Agent (AMA). AMA provides a more secure, cost-effective, and simplified way to collect data using Data Collection Rules (DCRs). This transition is critical for administrators to ensure long-term support and leverage granular control over data collection from both Azure and on-premises Windows Server instances.

Answer

The legacy Log Analytics agent

Answer

The Azure Diagnostics extension (WAD)

Answer

The Dependency Agent

Question 9

Users report that they cannot access a shared folder on a Windows Server 2022 instance located in a different subnet. You suspect a firewall or routing issue. Which PowerShell cmdlet should you use to test both ICMP connectivity and the specific TCP port 445 availability simultaneously?

Accepted Answer

Test-NetConnection. Test-NetConnection is a versatile 'Swiss Army knife' for network troubleshooting in Windows. It replaces older tools like ping and telnet by allowing administrators to check basic connectivity and verify if specific service ports are open and responding, providing detailed information about the network path and success of the connection.

Answer

Ping -t

Answer

Resolve-DnsName

Answer

Get-NetFirewallRule

Question 10

An administrator reports that Active Directory changes made on DC01 are not appearing on DC02. You suspect a replication issue. Which tool and command provide the most comprehensive output regarding the status of all replication neighbors for a specific domain controller?

Accepted Answer

repadmin /showrepl DC02. Repadmin.exe is the primary command-line tool for monitoring and troubleshooting Active Directory replication. It provides deep visibility into the replication topology, last successful replication times, and specific error codes that occur when domain controllers fail to synchronize their databases, which is critical for maintaining forest-wide consistency.

Answer

Active Directory Sites and Services - 'Check Replication Topology'

Answer

dcdiag /test:Replication

Answer

Get-ADReplicationPartnerMetadata

Question 11

You are managing a Windows Server 2022 instance experiencing intermittent memory pressure. You need to configure Performance Monitor to log data continuously, ensuring the logs are overwritten when they reach a maximum size of 500 MB to prevent disk exhaustion. Which setting should you modify in the Data Collector Set properties?

Accepted Answer

Enable the Circular Logging option in the Data Collector Set properties.. To manage disk space effectively while capturing performance metrics, the 'Stop condition' settings within the Data Collector Set properties allow you to define size limits. Configuring the 'Maximum size' to 500 MB and selecting the 'Overwrite' option ensures the log file rotates, maintaining only the most recent data. This is critical in production environments to prevent system volume exhaustion from unbounded performance log growth.

Answer

Configure the Schedule tab to trigger a task at 500 MB.

Answer

Adjust the Sample Interval in the Data Collector properties.

Answer

Set the Data Manager tab to delete files older than one hour.

Question 12

You need to view all 'Error' level events from both the System and Application logs in a single view within Event Viewer. What is the most efficient way to maintain this view for daily use?

Accepted Answer

Create a Custom View filtered by 'Error' level and both 'System' and 'Application' logs.. Event Viewer allows for the creation of Custom Views, which act as saved filters. This enables administrators to aggregate specific event types from multiple logs into one interface, significantly reducing the time spent jumping between different logs to find related error messages during routine server health checks.

Answer

Export both logs to a CSV file and merge them in Microsoft Excel.

Answer

Use the 'Find' feature in the System log to search for the word 'Error'.

Answer

Enable 'Filter Current Log' on the System log and then repeat on the Application log.

Question 13

You are investigating a disk performance bottleneck on a Windows Server hosting a SQL database. You need to identify the physical disk latency. Which TWO counters should you monitor in Performance Monitor? (Choose two.)

Accepted Answer

PhysicalDisk\Avg. Disk sec/Transfer. Monitoring disk latency requires looking at both the time taken for requests to complete and the queue depth. 'Avg. Disk sec/Transfer' provides the average time for each disk transfer, while 'Avg. Disk Queue Length' indicates how many requests are waiting. Together, these metrics identify whether the storage subsystem is struggling to keep up with the I/O workload generated by the SQL server applications.

Answer

Memory\Pages/sec

Answer

Processor\% Processor Time

Answer

System\Context Switches/sec

Question 14

You have configured a Windows Server to forward events to a centralized collector. You notice that the collector is not receiving events from a specific source server. You verify that the 'Windows Event Collector' service is running on the collector and the 'Windows Remote Management' service is running on the source. What should you check next to troubleshoot the connectivity?

Accepted Answer

Check the WinRM listener status and configuration on both servers.. Event forwarding relies on WinRM for transport. If the services are running, the issue is often related to the WinRM listener configuration or the network path between the nodes. Verifying that the WinRM listener is active and listening on the correct port (default 5985/5986) is the logical next step to ensure the transport layer is capable of passing the subscription information between the source and the collector.

Answer

Verify the Event Log size configuration on the source server.

Answer

Restart the Task Scheduler service on the source server.

Answer

Reinstall the Windows Event Collector feature.

Question 15

You need to monitor the health of a Windows Server using System Monitor. You want to trigger an alert when the free space on the C: drive drops below 10%. You have already created a Data Collector Set. What do you need to add to the set to achieve this functionality?

Accepted Answer

Add a Performance Counter Alert to the Data Collector Set.. To trigger alerts based on specific thresholds, you must create a Performance Counter Alert in the Data Collector Set. This allows you to select the specific counter, such as '% Free Space', and set a trigger condition. Once configured, you can define an action, such as executing a script or logging an event, when the threshold is breached, enabling proactive server maintenance before disk space issues cause system instability.

Answer

Add a System Configuration information collector to the set.

Answer

Add a Trace collector to the current Data Collector Set.

Answer

Modify the Security Log audit policy for the drive.