AZ-802 Practice Test 4 — 25 Questions

Question 1

Refer to the exhibit. You are reviewing the output of a command used to check the health of your domain controllers. Based on the first line of the output, which specific role or feature is currently enabled on this domain controller?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Global Catalog (GC). The 'IS_GC' flag in the DSA Options section of commands like 'repadmin /showrepl' indicates that the domain controller is functioning as a Global Catalog server. This is a critical piece of information for troubleshooting logon issues and ensuring that universal group memberships can be resolved locally.

Answer

Primary Domain Controller (PDC) Emulator

Answer

Read-Only Domain Controller (RODC)

Answer

Schema Master

Question 2

Your company, Contoso, Ltd., has a branch office with ten employees. The office has poor physical security, and you are concerned about the risks of a local domain controller being stolen. You need to deploy a domain controller to this site that minimizes the security risk of credential theft for the rest of the domain. Which solution should you implement?

Accepted Answer

A Read-Only Domain Controller (RODC) with a custom Password Replication Policy.. Deploying a Read-Only Domain Controller is the recommended strategy for branch offices where physical security cannot be guaranteed. This approach ensures that only a subset of user credentials is cached locally based on the Password Replication Policy, significantly reducing the impact of a physical server theft while still providing local authentication services for users at the site.

Answer

A standard writable Domain Controller with BitLocker enabled.

Answer

An Azure AD Domain Services managed domain instance.

Answer

A member server running the Active Directory Lightweight Directory Services role.

Question 3

Refer to the exhibit. You are troubleshooting an Azure Arc onboarding failure. The server has an internet connection, but the registration script returns the provided error. What should you verify first?

Accepted Answer

Check the local DNS server forwarding settings. Error 0x80072ee7 indicates a DNS resolution failure, meaning the client cannot resolve the Azure service FQDNs. In hybrid scenarios, on-premises servers often rely on internal DNS servers that may not have access to public records or lack proper forwarding rules. Verifying the DNS configuration ensures the server can locate the necessary Azure endpoints, which is a prerequisite for the registration process to establish a secure handshake.

Answer

Verify the Azure Subscription Quotas

Answer

Validate the Azure Service Principal credentials

Answer

Restart the Azure Connected Machine service

Question 4

You need to automate the installation of the Azure Connected Machine agent across 500 on-premises Windows Servers using Group Policy. What is the most efficient way to deploy the onboarding script while ensuring secure handling of the service principal secret?

Accepted Answer

Use a Group Policy startup script that pulls secrets from a secure vault at runtime. Deploying at scale requires using a centralized mechanism like GPO to execute the installation script. To avoid storing credentials in plain text, you should use an Azure Key Vault or a temporary SAS token-based approach. This ensures that the installation process is repeatable, auditable, and secure, preventing the exposure of sensitive service principal credentials during the automated deployment of the agent across the corporate environment.

Answer

Embed the service principal secret directly into a PowerShell script file in the GPO

Answer

Manually run the installer on each server using an interactive session

Answer

Use an unauthenticated script to register the machines

Question 5

You are managing Windows Server 2022 instances in a hybrid environment. You need to implement Azure Monitor VM Insights for these servers. Which TWO steps must you complete to accomplish this? (Choose two.)

Accepted Answer

Install the Azure Connected Machine agent on the servers.. Implementing VM Insights requires both the Azure Connected Machine agent for identity and the Azure Monitor agent (AMA) for data collection. By installing the Connected Machine agent, you project the server into Azure. Once projected, the AMA extension can be deployed via Azure Policy or manually to collect telemetry, performance metrics, and logs, providing unified monitoring across the hybrid infrastructure.

Answer

Install the System Center Operations Manager (SCOM) agent.

Answer

Configure an Azure ExpressRoute circuit.

Answer

Enable Windows Server Update Services (WSUS) integration.

Question 6

You are preparing to onboard a sensitive on-premises Windows Server to Azure Arc. You want to ensure the traffic is as secure as possible. Which THREE actions should you take? (Choose three.)

Accepted Answer

Configure an Azure Private Link Scope.. To maximize security for hybrid connectivity, you must minimize the attack surface by using a private endpoint, enforcing modern authentication, and restricting outbound access. Private Link ensures traffic never traverses the public internet, Managed Identities prevent static credential leakage, and limiting outbound access via a proxy or firewall ensures that the agent only communicates with known, required Azure service endpoints, reducing the risk of data exfiltration.

Answer

Disable the Windows Firewall on the server.

Answer

Store the agent's registration token in a local text file.

Question 7

You are troubleshooting an issue where an Azure Arc-enabled server is showing as 'Offline' in the Azure portal, despite the server being powered on. Which local service should you check first to ensure the agent is running?

Accepted Answer

Azure Connected Machine Agent service (himds). The Azure Connected Machine agent relies on the 'himds' (Hybrid Instance Metadata Service) to function. If this service is stopped, the server loses its heartbeat to the Azure control plane, causing it to appear as offline. Checking this service status is the most direct way to identify if the agent software has crashed or been disabled, which is the most common cause of communication gaps.

Answer

Windows Update service

Answer

Server Manager

Answer

Network Location Awareness service

Question 8

You are troubleshooting an issue where an Azure Arc-enabled server is showing a status of 'Offline' in the Azure portal. Which TWO logs or files should you inspect on the Windows Server? (Choose two.)

Accepted Answer

C:\ProgramData\AzureConnectedMachineAgent\Log\himds.log. The agent's health is documented in the agent's log file ('himds.log') and the Windows Event Viewer. The 'himds.log' provides the most granular details regarding the agent's handshake, heartbeat, and API connectivity to the Azure endpoints. The Application and System event logs in Windows are essential for identifying underlying OS-level issues, such as certificate store errors or network interface failures that prevent the agent from reaching the required endpoints.

Answer

C:\Windows\System32\drivers\etc\hosts

Answer

C:\Windows\System32\config\SAM

Answer

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

Question 9

You are creating a new virtual machine on a Hyper-V host. You decide to use the VHDX file format for the virtual hard disks. Which THREE advantages does VHDX provide over the older VHD format? (Choose three.)

Accepted Answer

Support for virtual disks up to 64 TB in size.. The VHDX format was introduced to overcome the limitations of the original VHD format. It offers significant improvements in capacity, performance, and data integrity. Understanding these benefits is crucial for designing modern virtualization storage that can support large enterprise workloads and ensure resilience against unexpected power failures or system crashes.

Answer

Support for virtual disks up to 2 TB in size.

Answer

Compatibility with Windows Server 2008 R2 hosts.

Question 10

You are managing a Windows Server 2022 server that needs to access a storage array on a different subnet. You notice the server is not reaching the storage controller. Which PowerShell command should you use to add a permanent persistent route to the storage network?

Accepted Answer

New-NetRoute. The New-NetRoute cmdlet is the standard PowerShell method to add routes to the Windows routing table. By specifying the -DestinationPrefix and the -NextHop, you instruct the OS on how to route traffic to the storage network. Using the -PolicyStore command ensures that the route is persistent across system reboots, which is critical for storage connectivity stability.

Answer

Add-NetNeighbor

Answer

Set-NetIPInterface

Answer

New-NetIPAddress

Question 11

An organization uses an on-premises Active Directory Domain Services (AD DS) environment and an Azure subscription. The IT team needs to ensure that on-premises clients can resolve names for resources hosted in an Azure Private DNS zone. Which component should be implemented to facilitate this specific name resolution path without deploying custom DNS servers in Azure?

Accepted Answer

Azure DNS Private Resolver Inbound Endpoint. Hybrid name resolution requires a bridge between on-premises DNS servers and Azure Private DNS zones. The Azure DNS Private Resolver provides a managed service that allows on-premises DNS queries to be forwarded to an inbound endpoint. This architecture eliminates the need for maintaining custom-built DNS forwarders on virtual machines, improving reliability and simplifying the administrative overhead for hybrid connectivity.

Answer

Azure Private Link

Answer

A standard Azure Public DNS Zone

Answer

Azure Application Gateway

Question 12

You are deploying IP Address Management (IPAM) on a Windows Server 2022 instance to manage your hybrid environment. You choose the Group Policy-based provisioning method. Which requirement must be met for the IPAM server to successfully manage the domain controllers and DHCP servers?

Accepted Answer

Invoke-IpamGpoProvisioning must be run with a unique GPO prefix.. IPAM requires specific permissions and firewall rules to collect data from managed servers. When using GPO-based provisioning, the IPAM server uses the GPOs to automate the configuration of these settings across the domain. Without the correct GPO prefix and security filtering, the managed servers will not allow the IPAM server to access their data.

Answer

The IPAM server must be a Domain Controller.

Answer

The GPOs must be manually linked to each individual server object.

Answer

The IPAM server must have the Web Server (IIS) role removed.

Question 13

Refer to the exhibit displaying the status of a DHCP failover relationship. A network administrator notices the 'CommunicationInterrupted' state. What is the immediate impact on DHCP clients that attempt to renew their leases while the server is in this state?

Accepted Answer

The server continues to renew leases for the duration of the MCLT.. In a DHCP failover configuration, the 'CommunicationInterrupted' state indicates that the two servers can no longer talk to each other. This state is designed to ensure continuity of service. Understanding how the Max Client Lead Time (MCLT) and server roles function during this interruption is critical for maintaining network availability.

Answer

Clients cannot renew leases and will lose connectivity immediately.

Answer

The server will grant new leases for the full scope duration.

Answer

The partner server automatically takes over all active leases.

Question 14

An administrator is managing a Hyper-V cluster with Scale-Out File Server (SOFS) storage. They want to prevent a single non-critical virtual machine from consuming all available storage bandwidth and affecting the performance of a production database VM. Which feature should be used?

Accepted Answer

Storage QoS Policy. Storage Quality of Service (QoS) provides a way to centrally monitor and manage storage performance for virtual machines. By creating and applying QoS policies, administrators can set minimum and maximum throughput and IOPS limits. This ensures that critical workloads receive the necessary resources while 'noisy neighbors' are restricted from impacting the overall health of the storage cluster.

Answer

Resource Pools

Answer

Storage Tiering

Answer

Virtual Fibre Channel

Question 15

An administrator is configuring a new storage pool on a Windows Server 2022 stand-alone server with four 4TB SATA drives. They need to create a virtual disk that can survive the failure of any single drive while providing the best possible write performance. Which resiliency type should they choose?

Accepted Answer

Two-way mirror. Selecting the right resiliency type involves balancing performance, capacity, and fault tolerance. For a four-drive system, mirroring and parity are the primary options. Mirroring is generally preferred for performance-sensitive workloads because it avoids the computational overhead of parity calculations, leading to faster write operations at the cost of reduced usable storage capacity compared to parity.

Answer

Simple

Answer

Parity

Answer

Three-way mirror

Question 16

You administer a Windows Server 2022 file server hosting critical engineering files. You need to configure File Server Resource Manager storage quotas to ensure that a specific engineering department folder cannot exceed 500 GB of capacity. When usage reaches 90 percent, you must ensure that users can still save files without immediate rejection, but administrative alerts are generated automatically. Which type of quota should you configure?

Accepted Answer

Soft quota with threshold notifications configured at the 90 percent level. A soft quota monitors capacity usage and generates administrative notifications when thresholds are reached without blocking users from writing new files. This contrasts with hard quotas, which actively deny write operations once the specified storage limit is breached, making soft quotas ideal for warning purposes.

Answer

Hard quota with event log logging and email notification triggers enabled

Answer

Dynamic Access Control storage threshold policy with automatic file purging

Answer

Distributed File System replication quota limiting background synchronization

Question 17

An administrator is implementing Azure File Sync to centralize file shares from several branch offices. The administrator notices that the local server's disk space is nearly full, despite enabling Cloud Tiering. Which setting should be adjusted to ensure the server maintains at least 20% free space at all times?

Accepted Answer

Volume Free Space policy. Cloud Tiering is a feature of Azure File Sync that caches frequently accessed files locally while tiering infrequent files to the cloud. The Volume Free Space policy is the primary mechanism to control local disk consumption. Correctly configuring this value ensures that the local server remains responsive and has enough capacity for new files before the next tiering cycle occurs.

Answer

Date policy

Answer

Bandwidth throttling

Answer

Sync group priority

Question 18

You are using the Storage Migration Service (SMS) to migrate data from an aging Windows Server 2012 R2 machine to a new Windows Server 2022 instance. During the cutover phase, what happens to the source server's identity and network configuration?

Accepted Answer

The destination server adopts the source's name and IP. The Storage Migration Service is designed to make migrations transparent to users and applications. The cutover phase is the most critical part of this process, as it handles the transition of the server's identity. Understanding how IP addresses and hostnames are transferred ensures that the administrator can plan for the brief downtime and successfully redirect all client traffic.

Answer

The source server is deleted from Active Directory

Answer

The destination server remains on its original IP address

Answer

A DFS Namespace is created to bridge the servers

Question 19

You are configuring Data Deduplication on a Windows Server 2022 file server that hosts various types of data. One volume is dedicated to storing virtual machine backup files. Which usage type should you select to maximize space savings for this specific data?

Accepted Answer

Virtualized Backup Server. Data Deduplication usage types apply specific settings tailored to the workload. The 'Virtualized Backup Server' type is optimized for backup applications and large files like VHDX. Using the correct type ensures the deduplication engine runs with the appropriate priority and uses the most effective chunking algorithms for the data.

Answer

General purpose file server

Answer

Virtual Desktop Infrastructure (VDI) server

Answer

Microsoft SQL Server

Question 20

You are using Azure Update Management to manage updates for both on-premises Windows Servers and Azure VMs. You need to ensure that a specific group of on-premises servers never receives a particular update that is known to cause application compatibility issues. How should you configure this in Azure Update Management?

Accepted Answer

Create an 'Excluded updates' list in the Update Deployment configuration.. Azure Update Management allows for granular control over update deployments through deployment schedules. When creating a deployment, you can specify excluded updates by their Knowledge Base (KB) ID. This ensures that even if an update is critical or security-related, it will not be installed on the targeted machines, preventing known compatibility problems.

Answer

Modify the local Registry on each server to block the KB ID.

Answer

Use a Group Policy Object (GPO) to disable the Windows Update service.

Answer

Uninstall the Log Analytics agent from the affected servers.