AZ-802 Practice Test 2 — 25 Questions

Question 1

You are deploying a Windows Server 2022-based Gateway server for a hybrid network. The gateway must perform Network Address Translation (NAT) for a private subnet. Which feature should you enable?

Accepted Answer

Routing and Remote Access (RRAS). The Remote Access role in Windows Server 2022 includes the NAT functionality required to route traffic from a private network to a public one. By enabling NAT within the Routing and Remote Access Service (RRAS), the server masks the private IP addresses of the internal clients, allowing them to access the internet through a single public IP address assigned to the gateway's external interface.

Answer

DHCP Server role

Answer

Network Policy Server (NPS)

Answer

Hyper-V Network Virtualization

Question 2

You need to track the average CPU and memory usage for a specific virtual machine over a period of 30 days to assist with capacity planning. Which Hyper-V feature should you enable and use to collect this data?

Answer

Performance Monitor

Answer

Azure Monitor

Answer

Resource Metering

Answer

Task Manager

Question 3

You want to run a Hyper-V virtual machine inside another virtual machine for testing purposes. After creating the guest VM, you find that you cannot install the Hyper-V role within it. Which PowerShell command must you run on the physical host to enable this capability?

Answer

Enable-WindowsOptionalFeature -FeatureName Microsoft-Hyper-V

Answer

Set-VMNetworkAdapter -MacAddressSpoofing On

Answer

Set-VMMemory -DynamicMemoryEnabled $false

Answer

Set-VMProcessor -ExposeVirtualizationExtensions $true

Question 4

You are implementing Shielded Virtual Machines in an on-premises Hyper-V environment to protect sensitive workloads from fabric administrators. Which TWO infrastructure components are required to support the deployment and health validation of Shielded VMs? (Choose two.)

Accepted Answer

Host Guardian Service (HGS). Shielded VMs provide a high level of security by encrypting the VM's data and state, ensuring that only authorized hosts can run them. This requires a complex infrastructure including attestation and key management. Understanding these components is essential for administrators securing highly sensitive data against unauthorized access by high-privileged users.

Answer

Azure Key Vault

Answer

Windows Server Update Services (WSUS)

Answer

Network Controller

Question 5

You are tasked with securing network traffic in a Windows Server 2022 environment using Windows Firewall with Advanced Security. Which TWO actions are required to allow traffic only from a specific trusted application while blocking all other incoming connections?

Accepted Answer

Create an inbound rule that allows connections for the specific application executable.. Securing a server involves both positive and negative enforcement. By creating a specific inbound rule for the trusted application, you permit necessary traffic, while a default deny policy ensures that no other unsolicited traffic reaches the server. This combination effectively implements the principle of least privilege, reducing the attack surface by ensuring that only authorized communication flows are allowed through the firewall boundaries.

Answer

Configure the firewall to drop all outbound traffic by default.

Answer

Enable IPsec encryption for the specific application rule.

Answer

Disable the Windows Firewall and use a third-party appliance.

Question 6

You are configuring a Windows Server 2022 instance to act as a router between two subnets. You have enabled IP forwarding, but traffic is not passing between the subnets. Which PowerShell cmdlet should you use to verify if the routing table is correctly identifying the local interface routes?

Accepted Answer

Get-NetRoute. The Get-NetRoute cmdlet is essential for inspecting the IPv4 and IPv6 routing tables on Windows Server. It allows administrators to verify that the destination network is reachable via the correct interface and gateway. Misconfigured routes are a primary cause of packet loss in multi-homed server environments, and this tool provides the granular visibility needed to troubleshoot connectivity issues between internal subnets.

Answer

Get-NetIPAddress

Answer

Test-NetConnection

Answer

Get-NetAdapter

Question 7

You are managing a hybrid cloud environment and need to connect an on-premises Windows Server 2022 to an Azure Virtual Network. Which service should you implement to provide a secure, persistent, and encrypted tunnel over the public internet?

Accepted Answer

Azure Site-to-Site VPN. A Site-to-Site VPN is the standard solution for connecting on-premises infrastructure to Azure over the internet using an IPsec/IKE tunnel. It provides a secure, encrypted path for traffic, ensuring that data moving between the local data center and the cloud remains protected. This is the most common deployment scenario for hybrid connectivity where a dedicated line like ExpressRoute is not financially feasible.

Answer

Azure ExpressRoute

Answer

Remote Access Server (RAS) Gateway

Answer

Azure Point-to-Site VPN

Question 8

Refer to the exhibit. A Storage Spaces Direct cluster is configured with the resiliency settings shown. What is the maximum number of simultaneous drive failures this pool can sustain without losing data access?

Accepted Answer

Two drive failures. The exhibit shows a three-way mirror configuration, indicated by NumberOfDataCopies being set to three. In Storage Spaces Direct, a three-way mirror can tolerate the simultaneous failure of two disks or two entire nodes. This high level of redundancy is standard for mission-critical workloads requiring maximum uptime and data integrity.

Answer

One drive failure

Answer

Three drive failures

Answer

Zero drive failures

Question 9

You are monitoring network utilization on a Windows Server 2022 node. You notice consistently high CPU usage when transferring large amounts of data over the network. Which feature can you enable to offload this processing and improve performance?

Accepted Answer

Receive Side Scaling (RSS). Receive Side Scaling (RSS) is a technology that allows the network stack to distribute incoming network traffic processing across multiple CPU cores. By offloading this task, the server can handle higher network throughput without overloading a single core, which is critical for high-traffic servers. This reduces CPU bottlenecks and ensures that the server can scale its networking capabilities to meet increasing demand efficiently.

Answer

Virtual Machine Queue (VMQ)

Answer

IPsec Task Offloading

Answer

Network Load Balancing (NLB)

Question 10

You are configuring DHCP failover between two Windows Server 2022 nodes named Server1 and Server2 to ensure high availability for a critical subnet. Which TWO failover modes are available for selection during the configuration wizard?

Accepted Answer

Load Balance. Windows Server DHCP failover provides two distinct modes to ensure that IP address leasing remains operational if one server fails. Choosing the correct mode depends on whether the administrator wants both servers to actively lease addresses simultaneously or have one server remain idle until a failure event occurs within the network environment.

Answer

Active-Passive Cluster

Answer

Split-Scope

Answer

Distributed Relay

Question 11

A company has a two-node Windows Server 2022 cluster running Storage Spaces Direct (S2D). They need to ensure the highest possible availability for their storage pool, allowing it to survive both a disk failure and a simultaneous node failure. Which resiliency setting must be applied to the virtual disks?

Accepted Answer

Nested resiliency. Storage Spaces Direct requires specific resiliency configurations for small clusters to maintain availability. Nested resiliency is a feature introduced for two-node clusters that provides data redundancy both within a single node and across the two nodes. This ensures that even if one node is offline for maintenance and a drive fails in the remaining node, the data remains accessible.

Answer

Three-way mirroring

Answer

Two-way mirroring

Answer

Dual parity

Question 12

You are optimizing a Windows Server 2022 cluster for high-performance storage traffic. You want to enable SMB Direct to allow the network adapters to transfer data directly between application memory and the network. Which feature must the network adapters support?

Accepted Answer

Remote Direct Memory Access (RDMA). SMB Direct requires network adapters that support Remote Direct Memory Access (RDMA). RDMA allows the network adapter to transfer data with minimal CPU intervention and extremely low latency. This is a key technology for high-performance workloads like Storage Spaces Direct and SQL Server over SMB.

Answer

Receive Side Scaling (RSS)

Answer

Virtual Machine Queue (VMQ)

Answer

Network Teaming (LACP)

Question 13

You are configuring an iSCSI Target Server on Windows Server 2022 to provide block storage to a Linux-based application server. Which TWO components must be configured on the Windows Server to allow the Linux host to connect and mount a volume? (Select TWO)

Accepted Answer

iSCSI Virtual Disk. Setting up an iSCSI environment requires configuring both the storage provider (Target) and the client (Initiator). On the Windows Server side, you must define which disks are available and which hosts are permitted to connect. This involves creating virtual disks and mapping them to specific target objects that define the security boundaries and access protocols for the initiators.

Answer

iSCSI Initiator Name Service (iSNS)

Answer

Multipath I/O (MPIO)

Answer

Fibre Channel Zoning

Question 14

You are managing a Windows Server 2022 DNS server. You need to implement DNS policies to ensure that queries for 'www.contoso.com' are resolved to different IP addresses based on the client's subnet. Which DNS policy component should you create first to define the client groupings?

Accepted Answer

DNS Server Client Subnet. DNS policies in Windows Server allow for intelligent traffic management by tailoring responses based on various criteria. To achieve location-based or subnet-based resolution, the server must first be able to identify which subnet a client belongs to. This is the foundational step before any resolution logic or policies can be applied.

Answer

DNS Server Zone Scope

Answer

DNS Server Recursion Scope

Answer

DNS Server Query Resolution Policy

Question 15

You are troubleshooting a Windows Server DNS environment where stale resource records are not being removed, leading to name resolution errors. Which THREE conditions must be met for DNS scavenging to successfully delete a stale record?

Accepted Answer

Scavenging must be enabled at the DNS server level.. DNS scavenging is a multi-step process that requires specific configurations at both the server and zone levels. If any of these components are misconfigured, the scavenging engine will not process the records, leading to an accumulation of outdated data that can interfere with network operations and IP management.

Answer

The record must be a static record with a zero timestamp.

Answer

The DNS server must be a member of the Schema Admins group.

Question 16

You need to provide a secure method for on-premises administrators to manage Azure SQL databases without exposing the database to the public internet. You want to ensure that traffic from the on-premises network stays within the private network space. Which solution should you implement?

Accepted Answer

Azure Private Link with a Private Endpoint. Azure Private Link allows you to access Azure PaaS services over a private endpoint in your virtual network. When combined with a VPN or ExpressRoute, this extends the private connectivity to your on-premises environment. This setup ensures that traffic never traverses the public internet, satisfying strict security and compliance requirements.

Answer

Azure Service Endpoints

Answer

Azure Bastion

Answer

Azure Front Door

Question 17

You plan to implement Storage Replica between two Windows Server 2022 clusters in different cities. The network connection between the sites has a consistent round-trip latency of 20ms. Which replication mode should you implement to ensure application performance is not negatively impacted by storage writes?

Accepted Answer

Asynchronous replication. Storage Replica offers two modes: synchronous and asynchronous. Synchronous replication requires low latency (typically <5ms) because the application must wait for an acknowledgment from the destination before the write is completed. For high-latency connections, asynchronous replication is necessary to prevent storage I/O from becoming a performance bottleneck.

Answer

Synchronous replication

Answer

Block-level mirroring

Answer

DFS Replication

Question 18

An administrator is planning to enable Data Deduplication on a Windows Server 2022 file server. Which TWO of the following workloads are officially supported and typically see high savings from Data Deduplication? (Select TWO)

Accepted Answer

VDI deployment share (VHDs). Data Deduplication in Windows Server is designed for specific workloads where data redundancy is common. General-purpose file shares and Virtual Desktop Infrastructure (VDI) libraries are the primary targets for this technology. Understanding supported workloads prevents performance issues and ensures that the deduplication engine can effectively reduce storage footprints without impacting application stability or data integrity.

Answer

Live Microsoft SQL Server databases

Answer

Active Exchange Server databases

Answer

Encrypted volumes using BitLocker

Question 19

An organization uses Azure Files to store sensitive company data. They need to ensure that users can only access the files if they are authenticated via their on-premises Active Directory Domain Services (AD DS). Which technology should be implemented to support this?

Accepted Answer

AD DS Authentication for Azure Files. Azure Files supports several authentication methods for accessing file shares. For organizations with an existing on-premises footprint, integrating Azure Files with AD DS allows for a seamless user experience using standard Kerberos authentication. This allows the use of existing NTFS permissions (ACLs) to control access to files and folders within the cloud-hosted share.

Answer

Shared Access Signatures (SAS)

Answer

Azure AD DS Authentication

Answer

Storage Account Access Keys

Question 20

An administrator wants to provide secure file access to remote workers without requiring a traditional VPN. They decide to implement SMB over QUIC on a Windows Server 2022 Datacenter: Azure Edition file server. What is a requirement for the client side of this connection?

Accepted Answer

Windows 11 or Windows Server 2022. SMB over QUIC is a revolutionary feature that allows access to file shares over the internet using the QUIC protocol, which is inherently encrypted with TLS 1.3. This eliminates the need for a VPN for remote users. However, it has specific client-side requirements to ensure the security and protocol compatibility needed for this high-performance, secure tunneling technology.

Answer

Windows 10 Enterprise or Pro (Version 1809 or later)

Answer

A third-party VPN client

Answer

Active Directory Domain Join