AZ-802 Practice Exam 4 — 20 Questions

Question 1

Refer to the exhibit. You need to ensure that all data transmitted over SMB between your file server and domain-joined clients is encrypted. You set the configuration to True, but users report connectivity issues. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Clients are using an SMB version lower than 3.0.. Enabling SMB encryption globally forces all connections to use encryption. Older clients or non-Windows systems that do not support SMB 3.0 or higher will fail to negotiate a connection, resulting in access errors. This transition requires careful planning, often involving auditing first or using per-share encryption instead of global settings to maintain backward compatibility while securing sensitive data transfers across the network infrastructure.

Answer

The SMB server service must be restarted for the change to take effect.

Answer

The server's certificate for SMB encryption has expired.

Answer

The firewall is blocking TCP port 445.

Question 2

You need to ensure that only authorized administrative users can access the server via PowerShell Remoting. Which security control should you implement?

Accepted Answer

Modify the Session Configuration security descriptor.. Restricting access to PowerShell Remoting is vital to prevent unauthorized remote management. By modifying the Security Descriptor of the WinRM session configuration, you can explicitly define which users or groups have the 'Access' and 'Execute' permissions. This is a critical step in maintaining a secure administrative surface, ensuring that only those with the necessary authorization can establish remote sessions, thereby mitigating the risk of lateral movement by attackers using PowerShell.

Answer

Configure the local Administrators group only.

Answer

Enable Credential Guard for PowerShell.

Answer

Disable the WinRM service entirely.

Question 3

You are tasked with securing your Windows Server 2022 environment. Which TWO actions should you perform to implement Just Enough Administration (JEA)?

Accepted Answer

Define a Role Capability (.psrc) file.. JEA allows you to restrict administrator access to only the commands necessary for specific tasks, reducing the risk of privilege escalation. By creating a Role Capability file and a Session Configuration file, you define exactly which cmdlets and functions a user can execute. This minimizes the attack surface by ensuring that users do not have broad, unrestricted access to the entire PowerShell environment or the underlying server operating system.

Answer

Configure a Group Policy Object to enable NTLMv2 only.

Answer

Modify the local SAM database to include JEA roles.

Answer

Enable the Credential Guard feature.

Question 4

You need to audit successful and failed attempts to modify user accounts in Active Directory. Which policy should you configure?

Accepted Answer

Audit Directory Service Changes.. To audit specific changes to Active Directory objects, you must enable Audit Directory Service Changes in the Advanced Audit Policy Configuration. This is part of a comprehensive auditing strategy to detect unauthorized modifications or administrative errors. By targeting the Directory Service category, you ensure that relevant events are logged to the Security log, which can then be forwarded to a SIEM for centralized monitoring and alerting on sensitive identity changes.

Answer

Audit Account Management.

Answer

Audit Object Access.

Answer

Audit Logon/Logoff.

Question 5

You need to collect performance data from a Windows Server for a period of 24 hours to establish a baseline. You want to ensure that the data collection starts automatically at 2:00 AM and stops exactly 24 hours later. Which feature of Performance Monitor should you use to automate this?

Accepted Answer

User Defined Data Collector Sets. Performance Monitor (perfmon) allows for more than just live viewing; it includes Data Collector Sets (DCS) for structured data gathering. DCS can be scheduled with specific start and stop times, and configured to collect specific counters, enabling administrators to gather consistent baseline data without manual intervention during off-peak hours.

Answer

Performance Counter Alerts

Answer

System Diagnostics

Answer

Resource View

Question 6

An administrator needs to capture and analyze network traffic on a Windows Server 2022 Core installation without installing third-party tools. Which TWO steps are necessary to capture traffic using the built-in 'pktmon' tool and prepare it for analysis in Wireshark on another machine?

Accepted Answer

Run 'pktmon start --etw' to begin.. Packet Monitor (Pktmon) is a powerful, built-in network diagnostic tool for Windows. It is particularly useful on Server Core where a GUI is unavailable. Understanding how to start a capture and then convert the proprietary ETL format into a cross-compatible format like PCAPNG is essential for advanced network troubleshooting and analysis.

Answer

Use 'netsh trace start' to capture data.

Answer

Enable 'Promiscuous Mode' in the NIC settings.

Answer

Run 'pktmon filter add -p 80' to start.

Question 7

You are using Azure Automation Update Management to monitor and manage updates for a group of Windows Servers. Several servers are reporting a status of 'Not assessed' for several days. What is the most likely cause of this monitoring gap?

Accepted Answer

The Log Analytics agent is not communicating with the workspace.. Azure Automation Update Management relies on the Log Analytics agent (or AMA) to report data back to the workspace. If a server is 'Not assessed,' it usually means the agent is unable to communicate, the workspace is missing data, or the required 'Update' solution has not been correctly deployed to the workspace.

Answer

The servers have not been restarted after the last update cycle.

Answer

The Windows Update service is set to 'Manual' instead of 'Automatic'.

Answer

The servers are running an unsupported version of Windows Server.

Question 8

You are investigating a replication issue between two Active Directory Domain Controllers (DCs) named DC1 and DC2. You suspect a network latency or firewall issue is preventing the replication of the 'Configuration' partition. Which tool should you use to check the current replication status and identify the specific error code associated with the failure?

Accepted Answer

repadmin /showrepl. Active Directory replication is vital for maintaining a consistent directory database. The 'repadmin' command-line tool is the industry standard for diagnosing replication topology, monitoring status, and forcing replication between partners. It provides detailed error codes that help distinguish between DNS failures, authentication issues, and physical network blocks.

Answer

Active Directory Sites and Services

Answer

dcdiag /test:DNS

Answer

Get-ADReplicationUpToDatenessVectorTable

Question 9

You are troubleshooting a Windows Server application that occasionally hangs. You want to capture a dump file of the process when it stops responding. Which THREE tools or methods should you consider using? (Choose three.)

Accepted Answer

Task Manager. Capturing process dumps is essential for diagnosing application hangs. Task Manager is the quickest manual method, while ProcDump provides automation and trigger-based capturing. Debugging tools, specifically ADPlus or the Windows Error Reporting (WER) service, provide advanced mechanisms to monitor and capture state information. Using these tools allows administrators to analyze the thread state at the exact moment of failure, leading to a root cause analysis of the hang.

Answer

Performance Monitor

Answer

Resource Monitor

Question 10

You manage two Active Directory forests named fabrikam.com and contoso.com. A two-way forest trust exists between them. You want to allow users from fabrikam.com to access a specific file server in contoso.com, but you must ensure they cannot authenticate to any other resources in the contoso.com forest by default. Which authentication setting should you configure on the trust?

Accepted Answer

Selective authentication. Selective authentication is a security feature used in forest trusts to restrict the scope of authentication for users from a trusted forest. Unlike forest-wide authentication, which allows users to authenticate to any resource in the trusting forest, selective authentication requires administrators to manually grant the 'Allowed to Authenticate' permission on specific computer objects for the external users or groups.

Answer

Forest-wide authentication

Answer

Domain-wide authentication

Answer

SID Filtering

Question 11

You accidentally delete an Organizational Unit (OU) containing 500 users. You need to recover the OU and its contents with all attributes, including group memberships, intact. What is the most efficient way to achieve this?

Accepted Answer

Use the Active Directory Recycle Bin to restore the objects.. The Active Directory Recycle Bin is the most efficient tool for recovering deleted objects because it preserves all physical and logical attributes of the object, including its distinguished name and group memberships. Once enabled, it eliminates the need for authoritative restores from backups, which require taking a domain controller offline into Directory Services Restore Mode.

Answer

Restore the OU from a System State backup using a non-authoritative restore.

Answer

Re-create the OU and users manually and add them back to their groups.

Answer

Perform an authoritative restore of the OU using the ntdsutil command.

Question 12

Your organization has two primary data centers in Seattle and New York, connected by a high-latency WAN link. You need to ensure that Active Directory replication occurs only during non-business hours to preserve bandwidth for critical applications. Which Active Directory object should you modify to control the timing of data synchronization between these locations?

Accepted Answer

The IP Site Link object in AD Sites and Services.. Active Directory site links are logical paths that represent the network connectivity between different sites. By configuring the schedule on a site link, administrators can precisely control when replication traffic is allowed to traverse the WAN. This is a fundamental skill for managing multi-site topologies where bandwidth is limited or expensive during specific times of day.

Answer

The properties of the Seattle Site object.

Answer

The NTDS Settings of the Seattle Domain Controller.

Answer

The Subnet object associated with the New York site.

Question 13

You are deploying a Read-Only Domain Controller (RODC) in a branch office with low physical security. You need to ensure that the branch manager, who is not a member of Domain Admins, can log on to the RODC even if the WAN link to the main office is down. What must you configure?

Accepted Answer

The Password Replication Policy (PRP) of the RODC.. By default, RODCs do not store user passwords. To allow a user to log on when the WAN link is unavailable, their credentials must be cached locally. This is achieved by adding the user or their group to the 'Allowed RODC Password Replication Group' or modifying the RODC's Password Replication Policy.

Answer

The Managed By tab in the RODC computer account properties.

Answer

The Default Domain Controllers Policy for the site.

Answer

The Global Catalog role on the branch office RODC.

Question 14

Refer to the exhibit. You are running dcdiag to investigate synchronization issues between two domain controllers. Based on the error code 1256 and the output provided, which action is most likely to resolve the underlying problem?

Accepted Answer

Check the network connectivity and power status of DC2.. Error 1256 indicates that the remote system is unavailable, which usually points to a network connectivity issue or a failure of the source domain controller (DC2). Troubleshooting should focus on physical connectivity, firewall rules, or the operational status of DC2 to ensure it can communicate with DC1 over the network.

Answer

Force an immediate KCC topology update using repadmin /kcc.

Answer

Reset the computer account password for DC1 in Active Directory.

Answer

Seize the FSMO roles from DC2 using ntdsutil.

Question 15

You need to apply a stricter password policy to a group of executives than the one defined in the Default Domain Policy. You want to achieve this without creating a separate domain. Which feature should you implement?

Accepted Answer

Fine-Grained Password Policies (FGPP).. Fine-Grained Password Policies (FGPP) allow administrators to apply different password and account lockout settings to different sets of users or groups within a single domain. This eliminates the need for multiple domains just to enforce varying security requirements, which was a significant limitation in older versions of Windows Server.

Answer

A new Group Policy Object (GPO) linked to an Organizational Unit.

Answer

The 'Password never expires' attribute on user accounts.

Answer

A selective trust relationship with a secure forest.

Question 16

Refer to the exhibit. You are reviewing the output of a command used to check the health of your domain controllers. Based on the first line of the output, which specific role or feature is currently enabled on this domain controller?

Accepted Answer

Global Catalog (GC). The 'IS_GC' flag in the DSA Options section of commands like 'repadmin /showrepl' indicates that the domain controller is functioning as a Global Catalog server. This is a critical piece of information for troubleshooting logon issues and ensuring that universal group memberships can be resolved locally.

Answer

Primary Domain Controller (PDC) Emulator

Answer

Read-Only Domain Controller (RODC)

Answer

Schema Master

Question 17

Your company, Contoso, Ltd., has a branch office with ten employees. The office has poor physical security, and you are concerned about the risks of a local domain controller being stolen. You need to deploy a domain controller to this site that minimizes the security risk of credential theft for the rest of the domain. Which solution should you implement?

Accepted Answer

A Read-Only Domain Controller (RODC) with a custom Password Replication Policy.. Deploying a Read-Only Domain Controller is the recommended strategy for branch offices where physical security cannot be guaranteed. This approach ensures that only a subset of user credentials is cached locally based on the Password Replication Policy, significantly reducing the impact of a physical server theft while still providing local authentication services for users at the site.

Answer

A standard writable Domain Controller with BitLocker enabled.

Answer

An Azure AD Domain Services managed domain instance.

Answer

A member server running the Active Directory Lightweight Directory Services role.

Question 18

Refer to the exhibit. You are troubleshooting an Azure Arc onboarding failure. The server has an internet connection, but the registration script returns the provided error. What should you verify first?

Accepted Answer

Check the local DNS server forwarding settings. Error 0x80072ee7 indicates a DNS resolution failure, meaning the client cannot resolve the Azure service FQDNs. In hybrid scenarios, on-premises servers often rely on internal DNS servers that may not have access to public records or lack proper forwarding rules. Verifying the DNS configuration ensures the server can locate the necessary Azure endpoints, which is a prerequisite for the registration process to establish a secure handshake.

Answer

Verify the Azure Subscription Quotas

Answer

Validate the Azure Service Principal credentials

Answer

Restart the Azure Connected Machine service

Question 19

You need to automate the installation of the Azure Connected Machine agent across 500 on-premises Windows Servers using Group Policy. What is the most efficient way to deploy the onboarding script while ensuring secure handling of the service principal secret?

Accepted Answer

Use a Group Policy startup script that pulls secrets from a secure vault at runtime. Deploying at scale requires using a centralized mechanism like GPO to execute the installation script. To avoid storing credentials in plain text, you should use an Azure Key Vault or a temporary SAS token-based approach. This ensures that the installation process is repeatable, auditable, and secure, preventing the exposure of sensitive service principal credentials during the automated deployment of the agent across the corporate environment.

Answer

Embed the service principal secret directly into a PowerShell script file in the GPO

Answer

Manually run the installer on each server using an interactive session

Answer

Use an unauthenticated script to register the machines

Question 20

You are managing Windows Server 2022 instances in a hybrid environment. You need to implement Azure Monitor VM Insights for these servers. Which TWO steps must you complete to accomplish this? (Choose two.)

Accepted Answer

Install the Azure Connected Machine agent on the servers.. Implementing VM Insights requires both the Azure Connected Machine agent for identity and the Azure Monitor agent (AMA) for data collection. By installing the Connected Machine agent, you project the server into Azure. Once projected, the AMA extension can be deployed via Azure Policy or manually to collect telemetry, performance metrics, and logs, providing unified monitoring across the hybrid infrastructure.

Answer

Install the System Center Operations Manager (SCOM) agent.

Answer

Configure an Azure ExpressRoute circuit.

Answer

Enable Windows Server Update Services (WSUS) integration.