AZ-802 Practice Test 2 — 10 Questions

Question 1

You plan to implement Group Managed Service Accounts (gMSAs) to improve the security of several web services. Which TWO prerequisites must be met before you can create and use gMSAs in your Active Directory environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Windows Server 2012 or later domain functional level.. Group Managed Service Accounts (gMSAs) require a minimum domain functional level and a specific root key for the Key Distribution Service (KDS). The KDS root key is used by domain controllers to generate the passwords for gMSAs, and it must be created once per forest to enable the service.

Answer

A functional Certificate Authority (CA) in the forest.

Answer

The Windows Server 2016 forest functional level.

Answer

The installation of the Web Server (IIS) role on a DC.

Question 2

You are the administrator of a large multi-domain forest. You have a branch office with a slow WAN link that contains only one domain controller. Users in this office complain that they cannot log on when the WAN link is down, even though they belong to Universal Groups. How should you resolve this issue while minimizing WAN traffic?

Accepted Answer

Enable Universal Group Membership Caching (UGMC) for the branch office site.. In a multi-domain forest, a domain controller needs to contact a Global Catalog to determine Universal Group membership during logon. If a GC is not available locally and the WAN link is down, logons fail. Enabling Universal Group Membership Caching allows a standard DC to cache these memberships, enabling successful logons during outages without the overhead of hosting a full GC.

Answer

Configure the branch office domain controller as a Global Catalog server.

Answer

Convert all Universal Groups to Global Groups.

Answer

Increase the replication frequency of the Site Link to 15 minutes.

Question 3

Your company is merging with another firm. You need to allow users in the 'contoso.com' forest to access resources in the 'fabrikam.com' forest. The solution must ensure that users from Fabrikam cannot access any resources in Contoso unless specifically granted permission on each individual resource. What should you configure?

Accepted Answer

A one-way outgoing forest trust with selective authentication.. A one-way forest trust with selective authentication is the most secure way to connect two forests. The 'one-way' aspect limits the direction of trust, while 'selective authentication' prevents trusted users from automatically being part of the 'Authenticated Users' group on resources in the trusting domain.

Answer

A two-way forest trust with forest-wide authentication.

Answer

An external trust with SID filtering disabled.

Answer

A realm trust with a non-Windows Kerberos environment.

Question 4

You plan to deploy a new domain controller as an Azure Virtual Machine (VM) to provide authentication for cloud workloads. Which THREE actions should you take to ensure the stability and supportability of the domain controller? (Each correct answer presents part of the solution.)

Accepted Answer

Configure a static private IP address for the VM in the Azure portal.. Deploying domain controllers on Azure VMs requires specific configuration to prevent database corruption and ensure consistent identity services. This includes using a static private IP address to prevent DNS failures, placing the NTDS database on a non-caching data disk to ensure write integrity, and using a separate virtual disk rather than the OS drive.

Answer

Enable Azure Disk Encryption on the OS drive.

Answer

Configure the OS drive to use Read/Write host caching.

Question 5

You are adding a new Windows Server 2022 domain controller to an existing forest that currently has a functional level of Windows Server 2012 R2. What is the maximum functional level you can set for the new domain controller?

Accepted Answer

Windows Server 2012 R2. Domain controllers run the operating system version installed on them, but the domain and forest functional levels determine which features are available across the entire environment. A new Windows Server 2022 DC can join a 2012 R2 forest, but it will operate within the constraints of that lower functional level.

Answer

Windows Server 2022

Answer

Windows Server 2016

Answer

Windows Server 2019

Question 6

Refer to the exhibit. You are troubleshooting a replication issue between the Head Office (Site-HQ) and a Branch Office (Site-Branch-A). Based on the output, what is the most likely cause of the failure?

Accepted Answer

A firewall is blocking RPC traffic or the source DC is offline.. The error code 1722 (The RPC server is unavailable) typically indicates a network connectivity issue or a service failure on the source domain controller. In the context of Active Directory replication, this often points to a firewall blocking RPC traffic, a failure of the DNS to resolve the source DC's name, or the RPC service being stopped.

Answer

The KCC has not yet generated a replication topology for the site.

Answer

There is a mismatch in the Site Link costs between the two sites.

Answer

The destination domain controller lacks the Global Catalog role.

Question 7

You are configuring Azure Arc-enabled servers for an on-premises Windows Server 2022 instance. You need to ensure that the server can communicate with Azure services while adhering to strict outbound firewall rules. Which port must be opened to support the Azure Connected Machine agent?

Accepted Answer

TCP 443. The Azure Connected Machine agent communicates primarily over HTTPS. Specifically, the agent requires outbound connectivity to Azure endpoints on TCP port 443. This is essential for telemetry, policy enforcement, and configuration management in hybrid environments. Properly configuring firewall rules ensures the agent maintains a heartbeat with Azure Resource Manager, allowing the hybrid machine to appear in the Azure portal for monitoring and management tasks.

Answer

TCP 80

Answer

TCP 3389

Answer

TCP 5985

Question 8

You need to inspect the state of Active Directory objects as they existed three days ago to troubleshoot an issue. You have a system state backup from that time. Which TWO tools must you use to view the contents of the database from the backup without performing a full restore? (Each correct answer presents part of the solution.)

Accepted Answer

ntdsutil. To view the contents of a past Active Directory database, you first use ntdsutil to mount the snapshot or recovered database file. Then, you use dsamain to expose that database as an LDAP directory service on a custom port. Once dsamain is running, standard tools like Active Directory Users and Computers can connect to that specific port.

Answer

Active Directory Sites and Services

Answer

wbadmin

Answer

repadmin

Question 9

You are configuring Azure Arc to manage your on-premises servers. Which THREE of the following are benefits of using the Azure Arc resource bridge? (Choose three.)

Accepted Answer

Enables VM lifecycle management from the Azure portal. The Azure Arc resource bridge is a virtual appliance that simplifies the management of virtualized environments. It provides a unified way to manage virtual machines, scale resources, and integrate hybrid infrastructure with Azure management services like RBAC and policy. By abstracting the underlying virtualization, it enables a consistent cloud-like experience for managing on-premises virtualized workloads, improving administrative efficiency and oversight.

Answer

Provides an alternative to the Azure Connected Machine agent

Answer

Eliminates the need for local virtualization software

Question 10

You are managing hybrid servers and need to use Azure Policy to enforce security standards. What is the primary benefit of using Azure Policy with Azure Arc-enabled servers?

Accepted Answer

It allows you to apply consistent compliance and configuration settings across hybrid environments. Azure Policy allows you to audit and enforce settings on hybrid servers as if they were native Azure VMs. This provides a consistent management plane where you can track compliance, such as ensuring specific updates are installed or security settings are applied. This uniformity is crucial for hybrid environments, as it eliminates the need for maintaining separate compliance tools for cloud and on-premises infrastructure.

Answer

It automatically migrates on-premises databases to Azure SQL

Answer

It provides real-time antivirus protection without installing a local agent

Answer

It replaces the need for Active Directory Group Policy Objects