AZ-802 Practice Test 3 — 25 Questions

Question 1

You are configuring Azure File Sync to synchronize a local folder on FileServer1 with an Azure file share. Which TWO endpoint types must be added to a Sync Group to enable this functionality?

Accepted Answer

Cloud endpoint. A Sync Group defines the topology for Azure File Sync. It must contain exactly one cloud endpoint, which represents the Azure file share, and one or more server endpoints, which represent paths on registered Windows Servers. This structure allows data to flow between the cloud and on-premises locations.

Answer

Storage endpoint

Answer

Network endpoint

Answer

Management endpoint

Question 2

Refer to the exhibit. An administrator has configured a share with the FolderEnumerationMode shown. What is the result when a user without Read permissions to a specific subfolder browses the share?

Accepted Answer

The folder is hidden from the user's view entirely.. Access-based enumeration (ABE) is a feature that filters the list of files and folders displayed to users based on their individual permissions. When ABE is enabled, users only see the objects they have at least Read access to, which improves security and reduces confusion in large shared directories.

Answer

The user sees the folder but receives 'Access Denied' when opening it.

Answer

The user is prompted for credentials when clicking the folder.

Answer

The share becomes read-only for that user.

Question 3

You are configuring Azure Bastion to provide secure RDP access to your Windows Server VMs in an Azure Virtual Network. Which THREE requirements must be met for a successful deployment? (Select THREE)

Accepted Answer

A subnet named 'AzureBastionSubnet' must exist in the Virtual Network.. Azure Bastion is a managed PaaS service that provides secure RDP and SSH access. It requires a dedicated subnet named 'AzureBastionSubnet' with a minimum mask of /26. Additionally, it requires a Public IP address for the Bastion resource itself. This setup ensures that your VMs do not need public IP addresses for administrative access.

Answer

All target Windows Servers must have the Remote Desktop Gateway role installed.

Answer

A Site-to-Site VPN must be established between Azure and on-premises.

Question 4

Your company runs Windows Server 2022 and utilizes Storage Spaces Direct. You need to configure a new storage pool using available drives. Which Windows PowerShell cmdlet should you create and initialize this storage pool?

Accepted Answer

New-StoragePool. The New-StoragePool cmdlet is the primary tool in PowerShell to combine physical disks into a manageable storage pool within Storage Spaces. Proper initialization is foundational for configuring resiliency tiers and virtual disks, ensuring high availability and fault tolerance across your clustered hyper-converged infrastructure deployments.

Answer

New-Volume

Answer

Initialize-Disk

Answer

Add-PhysicalDisk

Question 5

Your organization implements Just Enough Administration (JEA) to manage Windows Servers. A junior administrator needs to restart the Print Spooler service on several print servers but should not have full administrative rights. You need to identify the specific file that defines which cmdlets and external commands the junior administrator can execute. Which file should you configure?

Accepted Answer

The Role Capability file (.psrc). The Role Capability file defines exactly which cmdlets, functions, and external commands a user is allowed to run when connecting to a JEA endpoint. By restricting access to only the necessary tools for a specific task, you minimize the potential for lateral movement or accidental misconfiguration. This principle of least privilege is a cornerstone of securing administrative access in modern Windows Server environments.

Answer

The Session Configuration file (.pssc)

Answer

The PowerShell Profile file (.ps1)

Answer

The Module Manifest file (.psd1)

Question 6

An administrator is concerned about man-in-the-middle attacks where an attacker intercepts and modifies SMB traffic between a Windows Server 2022 file server and its clients. Which security feature should be enforced to ensure the integrity and authenticity of the SMB traffic?

Accepted Answer

SMB Signing. SMB Signing is a security mechanism in the SMB protocol that allows for the digital signing of SMB packets. This prevents the modification of data in transit and protects against man-in-the-middle attacks. Enforcing this feature ensures that both the client and the server can verify the origin and integrity of every packet exchanged during a session.

Answer

NTFS Permissions

Answer

Access-Based Enumeration

Answer

Disk Quotas

Question 7

You are configuring Windows Defender Credential Guard on a fleet of Windows Server 2022 Hyper-V hosts. You want to protect the LSA process from being accessed by unauthorized users or malware. Which hardware-based security feature must be enabled in the BIOS/UEFI and supported by the CPU for Credential Guard to operate?

Accepted Answer

Virtualization Extensions (Intel VT-x or AMD-V) and SLAT. Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate secrets, such as NTLM password hashes and Kerberos Ticket Granting Tickets, in a protected environment. This requires hardware support for virtualization and Second Level Address Translation (SLAT) to create the secure memory enclave that the Local Security Authority (LSA) uses to shield credentials.

Answer

Direct Memory Access (DMA) Protection

Answer

Hyper-Threading Technology

Answer

Hardware-enforced Stack Protection

Question 8

You manage a Windows Server Update Services (WSUS) infrastructure with one upstream server and three downstream servers. You want the downstream servers to only download updates that have been approved on the upstream server. Which WSUS configuration mode should you use for the downstream servers?

Accepted Answer

Replica mode. WSUS supports two modes for downstream servers: Replica and Autonomous. In Replica mode, the downstream server mirrors the update approvals, settings, and classes of the upstream server. This centralizes management and ensures that only updates vetted and approved by the central administrator are distributed across the entire organization's branch offices or departments.

Answer

Autonomous mode

Answer

Distributed mode

Answer

Disconnected mode

Question 9

Your company is implementing a Tiered Administration Model to secure its Windows Server infrastructure. You need to deploy Privileged Access Workstations (PAWs) for all Domain Admins. What is the primary purpose of using a PAW in this environment?

Accepted Answer

To provide a dedicated environment that is isolated from the risks of email and web browsing.. A Privileged Access Workstation (PAW) provides a dedicated, hardened environment for sensitive administrative tasks. By isolating high-privilege credentials from common threats like email, web browsing, and general-purpose applications, PAWs significantly reduce the risk of credential theft. This isolation is a critical defense-in-depth strategy for protecting high-value accounts in an Active Directory forest.

Answer

To allow administrators to browse the internet safely while performing server updates.

Answer

To enable multiple users to share a single high-privilege account across the organization.

Answer

To automatically synchronize local administrator passwords across all domain controllers.

Question 10

You are securing Windows Admin Center (WAC) to manage your Windows Server 2022 environment. You want to implement granular access control for different IT teams. Which TWO methods can be used to control who has access to Windows Admin Center and what they can do? (Select TWO)

Accepted Answer

Active Directory groups for gateway access control.. Windows Admin Center security is managed through two main layers: gateway access and tool access. Gateway access is controlled via local groups or Active Directory groups on the WAC server. For more granular control over specific server tasks, WAC integrates with Just Enough Administration (JEA) to limit the cmdlets and actions available to the user.

Answer

Azure Key Vault for storing the WAC login credentials.

Answer

NTFS permissions on the Windows Admin Center installation folder.

Answer

DHCP Reservations for the WAC gateway IP address.

Question 11

Refer to the exhibit. You need to ensure that all data transmitted over SMB between your file server and domain-joined clients is encrypted. You set the configuration to True, but users report connectivity issues. What is the most likely cause?

Accepted Answer

Clients are using an SMB version lower than 3.0.. Enabling SMB encryption globally forces all connections to use encryption. Older clients or non-Windows systems that do not support SMB 3.0 or higher will fail to negotiate a connection, resulting in access errors. This transition requires careful planning, often involving auditing first or using per-share encryption instead of global settings to maintain backward compatibility while securing sensitive data transfers across the network infrastructure.

Answer

The SMB server service must be restarted for the change to take effect.

Answer

The server's certificate for SMB encryption has expired.

Answer

The firewall is blocking TCP port 445.

Question 12

You need to ensure that only authorized administrative users can access the server via PowerShell Remoting. Which security control should you implement?

Accepted Answer

Modify the Session Configuration security descriptor.. Restricting access to PowerShell Remoting is vital to prevent unauthorized remote management. By modifying the Security Descriptor of the WinRM session configuration, you can explicitly define which users or groups have the 'Access' and 'Execute' permissions. This is a critical step in maintaining a secure administrative surface, ensuring that only those with the necessary authorization can establish remote sessions, thereby mitigating the risk of lateral movement by attackers using PowerShell.

Answer

Configure the local Administrators group only.

Answer

Enable Credential Guard for PowerShell.

Answer

Disable the WinRM service entirely.

Question 13

You are tasked with securing your Windows Server 2022 environment. Which TWO actions should you perform to implement Just Enough Administration (JEA)?

Accepted Answer

Define a Role Capability (.psrc) file.. JEA allows you to restrict administrator access to only the commands necessary for specific tasks, reducing the risk of privilege escalation. By creating a Role Capability file and a Session Configuration file, you define exactly which cmdlets and functions a user can execute. This minimizes the attack surface by ensuring that users do not have broad, unrestricted access to the entire PowerShell environment or the underlying server operating system.

Answer

Configure a Group Policy Object to enable NTLMv2 only.

Answer

Modify the local SAM database to include JEA roles.

Answer

Enable the Credential Guard feature.

Question 14

You need to audit successful and failed attempts to modify user accounts in Active Directory. Which policy should you configure?

Accepted Answer

Audit Directory Service Changes.. To audit specific changes to Active Directory objects, you must enable Audit Directory Service Changes in the Advanced Audit Policy Configuration. This is part of a comprehensive auditing strategy to detect unauthorized modifications or administrative errors. By targeting the Directory Service category, you ensure that relevant events are logged to the Security log, which can then be forwarded to a SIEM for centralized monitoring and alerting on sensitive identity changes.

Answer

Audit Account Management.

Answer

Audit Object Access.

Answer

Audit Logon/Logoff.

Question 15

You need to collect performance data from a Windows Server for a period of 24 hours to establish a baseline. You want to ensure that the data collection starts automatically at 2:00 AM and stops exactly 24 hours later. Which feature of Performance Monitor should you use to automate this?

Accepted Answer

User Defined Data Collector Sets. Performance Monitor (perfmon) allows for more than just live viewing; it includes Data Collector Sets (DCS) for structured data gathering. DCS can be scheduled with specific start and stop times, and configured to collect specific counters, enabling administrators to gather consistent baseline data without manual intervention during off-peak hours.

Answer

Performance Counter Alerts

Answer

System Diagnostics

Answer

Resource View

Question 16

An administrator needs to capture and analyze network traffic on a Windows Server 2022 Core installation without installing third-party tools. Which TWO steps are necessary to capture traffic using the built-in 'pktmon' tool and prepare it for analysis in Wireshark on another machine?

Accepted Answer

Run 'pktmon start --etw' to begin.. Packet Monitor (Pktmon) is a powerful, built-in network diagnostic tool for Windows. It is particularly useful on Server Core where a GUI is unavailable. Understanding how to start a capture and then convert the proprietary ETL format into a cross-compatible format like PCAPNG is essential for advanced network troubleshooting and analysis.

Answer

Use 'netsh trace start' to capture data.

Answer

Enable 'Promiscuous Mode' in the NIC settings.

Answer

Run 'pktmon filter add -p 80' to start.

Question 17

You are using Azure Automation Update Management to monitor and manage updates for a group of Windows Servers. Several servers are reporting a status of 'Not assessed' for several days. What is the most likely cause of this monitoring gap?

Accepted Answer

The Log Analytics agent is not communicating with the workspace.. Azure Automation Update Management relies on the Log Analytics agent (or AMA) to report data back to the workspace. If a server is 'Not assessed,' it usually means the agent is unable to communicate, the workspace is missing data, or the required 'Update' solution has not been correctly deployed to the workspace.

Answer

The servers have not been restarted after the last update cycle.

Answer

The Windows Update service is set to 'Manual' instead of 'Automatic'.

Answer

The servers are running an unsupported version of Windows Server.

Question 18

You are investigating a replication issue between two Active Directory Domain Controllers (DCs) named DC1 and DC2. You suspect a network latency or firewall issue is preventing the replication of the 'Configuration' partition. Which tool should you use to check the current replication status and identify the specific error code associated with the failure?

Accepted Answer

repadmin /showrepl. Active Directory replication is vital for maintaining a consistent directory database. The 'repadmin' command-line tool is the industry standard for diagnosing replication topology, monitoring status, and forcing replication between partners. It provides detailed error codes that help distinguish between DNS failures, authentication issues, and physical network blocks.

Answer

Active Directory Sites and Services

Answer

dcdiag /test:DNS

Answer

Get-ADReplicationUpToDatenessVectorTable

Question 19

You are troubleshooting a Windows Server application that occasionally hangs. You want to capture a dump file of the process when it stops responding. Which THREE tools or methods should you consider using? (Choose three.)

Accepted Answer

Task Manager. Capturing process dumps is essential for diagnosing application hangs. Task Manager is the quickest manual method, while ProcDump provides automation and trigger-based capturing. Debugging tools, specifically ADPlus or the Windows Error Reporting (WER) service, provide advanced mechanisms to monitor and capture state information. Using these tools allows administrators to analyze the thread state at the exact moment of failure, leading to a root cause analysis of the hang.

Answer

Performance Monitor

Answer

Resource Monitor

Question 20

You manage two Active Directory forests named fabrikam.com and contoso.com. A two-way forest trust exists between them. You want to allow users from fabrikam.com to access a specific file server in contoso.com, but you must ensure they cannot authenticate to any other resources in the contoso.com forest by default. Which authentication setting should you configure on the trust?

Accepted Answer

Selective authentication. Selective authentication is a security feature used in forest trusts to restrict the scope of authentication for users from a trusted forest. Unlike forest-wide authentication, which allows users to authenticate to any resource in the trusting forest, selective authentication requires administrators to manually grant the 'Allowed to Authenticate' permission on specific computer objects for the external users or groups.

Answer

Forest-wide authentication

Answer

Domain-wide authentication

Answer

SID Filtering