AZ-802 Practice Exam 3 — 20 Questions

Question 1

You need to provide a secure method for on-premises administrators to manage Azure SQL databases without exposing the database to the public internet. You want to ensure that traffic from the on-premises network stays within the private network space. Which solution should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Private Link with a Private Endpoint. Azure Private Link allows you to access Azure PaaS services over a private endpoint in your virtual network. When combined with a VPN or ExpressRoute, this extends the private connectivity to your on-premises environment. This setup ensures that traffic never traverses the public internet, satisfying strict security and compliance requirements.

Answer

Azure Service Endpoints

Answer

Azure Bastion

Answer

Azure Front Door

Question 2

You plan to implement Storage Replica between two Windows Server 2022 clusters in different cities. The network connection between the sites has a consistent round-trip latency of 20ms. Which replication mode should you implement to ensure application performance is not negatively impacted by storage writes?

Accepted Answer

Asynchronous replication. Storage Replica offers two modes: synchronous and asynchronous. Synchronous replication requires low latency (typically <5ms) because the application must wait for an acknowledgment from the destination before the write is completed. For high-latency connections, asynchronous replication is necessary to prevent storage I/O from becoming a performance bottleneck.

Answer

Synchronous replication

Answer

Block-level mirroring

Answer

DFS Replication

Question 3

An administrator is planning to enable Data Deduplication on a Windows Server 2022 file server. Which TWO of the following workloads are officially supported and typically see high savings from Data Deduplication? (Select TWO)

Accepted Answer

VDI deployment share (VHDs). Data Deduplication in Windows Server is designed for specific workloads where data redundancy is common. General-purpose file shares and Virtual Desktop Infrastructure (VDI) libraries are the primary targets for this technology. Understanding supported workloads prevents performance issues and ensures that the deduplication engine can effectively reduce storage footprints without impacting application stability or data integrity.

Answer

Live Microsoft SQL Server databases

Answer

Active Exchange Server databases

Answer

Encrypted volumes using BitLocker

Question 4

An organization uses Azure Files to store sensitive company data. They need to ensure that users can only access the files if they are authenticated via their on-premises Active Directory Domain Services (AD DS). Which technology should be implemented to support this?

Accepted Answer

AD DS Authentication for Azure Files. Azure Files supports several authentication methods for accessing file shares. For organizations with an existing on-premises footprint, integrating Azure Files with AD DS allows for a seamless user experience using standard Kerberos authentication. This allows the use of existing NTFS permissions (ACLs) to control access to files and folders within the cloud-hosted share.

Answer

Shared Access Signatures (SAS)

Answer

Azure AD DS Authentication

Answer

Storage Account Access Keys

Question 5

An administrator wants to provide secure file access to remote workers without requiring a traditional VPN. They decide to implement SMB over QUIC on a Windows Server 2022 Datacenter: Azure Edition file server. What is a requirement for the client side of this connection?

Accepted Answer

Windows 11 or Windows Server 2022. SMB over QUIC is a revolutionary feature that allows access to file shares over the internet using the QUIC protocol, which is inherently encrypted with TLS 1.3. This eliminates the need for a VPN for remote users. However, it has specific client-side requirements to ensure the security and protocol compatibility needed for this high-performance, secure tunneling technology.

Answer

Windows 10 Enterprise or Pro (Version 1809 or later)

Answer

A third-party VPN client

Answer

Active Directory Domain Join

Question 6

You are preparing to use the Storage Migration Service to migrate data from several Windows Server 2012 R2 servers. Which THREE components are essential parts of the Storage Migration Service architecture?

Accepted Answer

Orchestrator server. The Storage Migration Service consists of three main roles: the orchestrator that manages the process, the source servers where the data currently resides, and the destination servers that receive the data. Understanding these roles is critical for troubleshooting connectivity and permission issues during a large-scale migration project.

Answer

Azure Relay

Answer

iSCSI Target Server

Question 7

You are deploying a 4-node Azure Stack HCI cluster. You need to configure the networking to support Storage Spaces Direct (S2D) east-west traffic. Which TWO networking features are highly recommended by Microsoft to ensure low-latency and high-throughput storage communication? (Select TWO)

Accepted Answer

Remote Direct Memory Access (RDMA). Azure Stack HCI relies heavily on the network for storage traffic between nodes. To achieve the performance required for hyperconverged workloads, the network must support advanced features that offload processing and prevent congestion. RDMA and SET are the cornerstones of a modern, high-performance software-defined data center network on the Microsoft platform.

Answer

Network Address Translation (NAT)

Answer

Border Gateway Protocol (BGP)

Answer

802.11ax (Wi-Fi 6)

Question 8

You are deploying a new file server that will host Hyper-V virtual machine files. You want to take advantage of block cloning to improve the performance of checkpoint merging and VM cloning operations. Which file system should you use?

Accepted Answer

ReFS. The Resilient File System (ReFS) includes a feature called block cloning, which allows the file system to copy ranges of file blocks on behalf of an application as a low-cost metadata operation. This significantly accelerates Hyper-V operations like merging checkpoints, as data blocks are remapped rather than physically copied.

Answer

NTFS

Answer

FAT32

Answer

exFAT

Question 9

Refer to the exhibit. An administrator executes the PowerShell command shown to configure an iSCSI target. What is the effect of the -InitiatorId parameter in this command?

Accepted Answer

It defines which client can connect to the target.. In iSCSI configurations, security is maintained by specifying which clients (initiators) are allowed to connect to a specific target. The -InitiatorId parameter restricts access to the target so that only the device with the matching iSCSI Qualified Name (IQN) can discover and connect to the storage resources.

Answer

It sets the IQN of the local server.

Answer

It specifies the IP address of the target portal.

Answer

It creates a new virtual hard disk.

Question 10

You use File Server Resource Manager (FSRM) to manage a folder shared by the marketing department. You want to prevent users from saving more than 10GB of data in the folder. If they reach this limit, they must be blocked from adding new files. What should you configure?

Accepted Answer

Hard quota. File Server Resource Manager (FSRM) quotas allow administrators to limit the space consumed by a folder or volume. A 'Hard' quota is used when you want to strictly enforce the limit and prevent further writes, whereas a 'Soft' quota is used only for monitoring and notification purposes.

Answer

Soft quota

Answer

File screen

Answer

Storage report

Question 11

You are configuring Azure File Sync to synchronize a local folder on FileServer1 with an Azure file share. Which TWO endpoint types must be added to a Sync Group to enable this functionality?

Accepted Answer

Cloud endpoint. A Sync Group defines the topology for Azure File Sync. It must contain exactly one cloud endpoint, which represents the Azure file share, and one or more server endpoints, which represent paths on registered Windows Servers. This structure allows data to flow between the cloud and on-premises locations.

Answer

Storage endpoint

Answer

Network endpoint

Answer

Management endpoint

Question 12

Refer to the exhibit. An administrator has configured a share with the FolderEnumerationMode shown. What is the result when a user without Read permissions to a specific subfolder browses the share?

Accepted Answer

The folder is hidden from the user's view entirely.. Access-based enumeration (ABE) is a feature that filters the list of files and folders displayed to users based on their individual permissions. When ABE is enabled, users only see the objects they have at least Read access to, which improves security and reduces confusion in large shared directories.

Answer

The user sees the folder but receives 'Access Denied' when opening it.

Answer

The user is prompted for credentials when clicking the folder.

Answer

The share becomes read-only for that user.

Question 13

You are configuring Azure Bastion to provide secure RDP access to your Windows Server VMs in an Azure Virtual Network. Which THREE requirements must be met for a successful deployment? (Select THREE)

Accepted Answer

A subnet named 'AzureBastionSubnet' must exist in the Virtual Network.. Azure Bastion is a managed PaaS service that provides secure RDP and SSH access. It requires a dedicated subnet named 'AzureBastionSubnet' with a minimum mask of /26. Additionally, it requires a Public IP address for the Bastion resource itself. This setup ensures that your VMs do not need public IP addresses for administrative access.

Answer

All target Windows Servers must have the Remote Desktop Gateway role installed.

Answer

A Site-to-Site VPN must be established between Azure and on-premises.

Question 14

Your company runs Windows Server 2022 and utilizes Storage Spaces Direct. You need to configure a new storage pool using available drives. Which Windows PowerShell cmdlet should you create and initialize this storage pool?

Accepted Answer

New-StoragePool. The New-StoragePool cmdlet is the primary tool in PowerShell to combine physical disks into a manageable storage pool within Storage Spaces. Proper initialization is foundational for configuring resiliency tiers and virtual disks, ensuring high availability and fault tolerance across your clustered hyper-converged infrastructure deployments.

Answer

New-Volume

Answer

Initialize-Disk

Answer

Add-PhysicalDisk

Question 15

Your organization implements Just Enough Administration (JEA) to manage Windows Servers. A junior administrator needs to restart the Print Spooler service on several print servers but should not have full administrative rights. You need to identify the specific file that defines which cmdlets and external commands the junior administrator can execute. Which file should you configure?

Accepted Answer

The Role Capability file (.psrc). The Role Capability file defines exactly which cmdlets, functions, and external commands a user is allowed to run when connecting to a JEA endpoint. By restricting access to only the necessary tools for a specific task, you minimize the potential for lateral movement or accidental misconfiguration. This principle of least privilege is a cornerstone of securing administrative access in modern Windows Server environments.

Answer

The Session Configuration file (.pssc)

Answer

The PowerShell Profile file (.ps1)

Answer

The Module Manifest file (.psd1)

Question 16

An administrator is concerned about man-in-the-middle attacks where an attacker intercepts and modifies SMB traffic between a Windows Server 2022 file server and its clients. Which security feature should be enforced to ensure the integrity and authenticity of the SMB traffic?

Accepted Answer

SMB Signing. SMB Signing is a security mechanism in the SMB protocol that allows for the digital signing of SMB packets. This prevents the modification of data in transit and protects against man-in-the-middle attacks. Enforcing this feature ensures that both the client and the server can verify the origin and integrity of every packet exchanged during a session.

Answer

NTFS Permissions

Answer

Access-Based Enumeration

Answer

Disk Quotas

Question 17

You are configuring Windows Defender Credential Guard on a fleet of Windows Server 2022 Hyper-V hosts. You want to protect the LSA process from being accessed by unauthorized users or malware. Which hardware-based security feature must be enabled in the BIOS/UEFI and supported by the CPU for Credential Guard to operate?

Accepted Answer

Virtualization Extensions (Intel VT-x or AMD-V) and SLAT. Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate secrets, such as NTLM password hashes and Kerberos Ticket Granting Tickets, in a protected environment. This requires hardware support for virtualization and Second Level Address Translation (SLAT) to create the secure memory enclave that the Local Security Authority (LSA) uses to shield credentials.

Answer

Direct Memory Access (DMA) Protection

Answer

Hyper-Threading Technology

Answer

Hardware-enforced Stack Protection

Question 18

You manage a Windows Server Update Services (WSUS) infrastructure with one upstream server and three downstream servers. You want the downstream servers to only download updates that have been approved on the upstream server. Which WSUS configuration mode should you use for the downstream servers?

Accepted Answer

Replica mode. WSUS supports two modes for downstream servers: Replica and Autonomous. In Replica mode, the downstream server mirrors the update approvals, settings, and classes of the upstream server. This centralizes management and ensures that only updates vetted and approved by the central administrator are distributed across the entire organization's branch offices or departments.

Answer

Autonomous mode

Answer

Distributed mode

Answer

Disconnected mode

Question 19

Your company is implementing a Tiered Administration Model to secure its Windows Server infrastructure. You need to deploy Privileged Access Workstations (PAWs) for all Domain Admins. What is the primary purpose of using a PAW in this environment?

Accepted Answer

To provide a dedicated environment that is isolated from the risks of email and web browsing.. A Privileged Access Workstation (PAW) provides a dedicated, hardened environment for sensitive administrative tasks. By isolating high-privilege credentials from common threats like email, web browsing, and general-purpose applications, PAWs significantly reduce the risk of credential theft. This isolation is a critical defense-in-depth strategy for protecting high-value accounts in an Active Directory forest.

Answer

To allow administrators to browse the internet safely while performing server updates.

Answer

To enable multiple users to share a single high-privilege account across the organization.

Answer

To automatically synchronize local administrator passwords across all domain controllers.

Question 20

You are securing Windows Admin Center (WAC) to manage your Windows Server 2022 environment. You want to implement granular access control for different IT teams. Which TWO methods can be used to control who has access to Windows Admin Center and what they can do? (Select TWO)

Accepted Answer

Active Directory groups for gateway access control.. Windows Admin Center security is managed through two main layers: gateway access and tool access. Gateway access is controlled via local groups or Active Directory groups on the WAC server. For more granular control over specific server tasks, WAC integrates with Just Enough Administration (JEA) to limit the cmdlets and actions available to the user.

Answer

Azure Key Vault for storing the WAC login credentials.

Answer

NTFS permissions on the Windows Admin Center installation folder.

Answer

DHCP Reservations for the WAC gateway IP address.