AZ-802 Practice Test 3 — 10 Questions

Question 1

You are configuring Azure Arc-enabled servers for a fleet of Windows Servers. You need to ensure that the servers can be managed via Azure Policy. What is the mandatory prerequisite before installing the Azure Connected Machine agent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Register the Microsoft.HybridCompute resource provider in the Azure subscription.. To enable Azure Arc management, the server must reach the internet to communicate with the Azure Resource Manager (ARM) endpoints. Registering the Microsoft.HybridCompute, Microsoft.GuestConfiguration, and Microsoft.HybridConnectivity resource providers in your subscription is required for the backend services to recognize and process the agent's heartbeat and policy compliance data, ensuring full integration with hybrid governance features.

Answer

Enable BitLocker drive encryption on the system drive.

Answer

Install the Azure CLI on the local Windows Server.

Answer

Configure a Site-to-Site VPN between the datacenter and Azure.

Question 2

When onboarding servers to Azure Arc, which type of identity is automatically created for the server?

Accepted Answer

System-assigned managed identity. Azure Arc-enabled servers are assigned a system-assigned managed identity. This identity is managed by the Azure platform and is tied to the lifecycle of the Arc resource. It allows the server to authenticate securely to other Azure services (like Key Vault or Log Analytics) without requiring hardcoded credentials, significantly enhancing the security posture of the hybrid environment by removing the need for secret management.

Answer

User-assigned managed identity

Answer

Active Directory service account

Answer

Azure AD guest identity

Question 3

Refer to the exhibit. An Arc-enabled server is reporting a 403 Forbidden error when trying to access an Azure key vault. What is the most likely cause?

Accepted Answer

The server's system-assigned identity lacks access to the Key Vault. A 403 Forbidden error indicates that the identity being used by the Arc-enabled server is authenticated but lacks the necessary permissions to access the specific resource. In this case, the server's managed identity has not been granted the required access policy or RBAC role on the target Key Vault. This is a common permission configuration error in hybrid environments.

Answer

The Azure Connected Machine agent is corrupted

Answer

The network firewall is blocking the connection

Answer

The subscription has reached its resource limit

Question 4

What is the primary function of the Azure Connected Machine agent in a hybrid environment?

Accepted Answer

To project the on-premises server as a resource in Azure.. The agent acts as a bridge, projecting the local server into the Azure Resource Manager. This allows the server to be represented as an object in Azure, enabling the use of Azure services like Policy, Monitoring, and Update Management. It handles identity, heartbeats, and metadata synchronization, effectively making the on-premises hardware a first-class citizen in the cloud-based management ecosystem.

Answer

To act as a secondary domain controller for Azure AD.

Answer

To provide high-speed file storage synchronization.

Answer

To manage the server's local user accounts.

Question 5

You need to capture the state of a virtual machine named VM-DEV before applying a series of software updates. You want to ensure that the capture process uses the Volume Shadow Copy Service (VSS) to provide a consistent state of the guest operating system. Which checkpoint type should you use?

Accepted Answer

Production Checkpoint. Understanding the difference between production and standard checkpoints is vital for Windows Server administrators. Production checkpoints use backup technology inside the guest to create a data-consistent state, whereas standard checkpoints capture the memory state. Choosing the right type prevents application errors and ensures data integrity during recovery operations.

Answer

Standard Checkpoint

Answer

Recovery Point

Answer

Differential Checkpoint

Question 6

You are deploying a Windows Server 2022-based Gateway server for a hybrid network. The gateway must perform Network Address Translation (NAT) for a private subnet. Which feature should you enable?

Accepted Answer

Routing and Remote Access (RRAS). The Remote Access role in Windows Server 2022 includes the NAT functionality required to route traffic from a private network to a public one. By enabling NAT within the Routing and Remote Access Service (RRAS), the server masks the private IP addresses of the internal clients, allowing them to access the internet through a single public IP address assigned to the gateway's external interface.

Answer

DHCP Server role

Answer

Network Policy Server (NPS)

Answer

Hyper-V Network Virtualization

Question 7

You need to track the average CPU and memory usage for a specific virtual machine over a period of 30 days to assist with capacity planning. Which Hyper-V feature should you enable and use to collect this data?

Answer

Performance Monitor

Answer

Azure Monitor

Answer

Resource Metering

Answer

Task Manager

Question 8

You want to run a Hyper-V virtual machine inside another virtual machine for testing purposes. After creating the guest VM, you find that you cannot install the Hyper-V role within it. Which PowerShell command must you run on the physical host to enable this capability?

Answer

Enable-WindowsOptionalFeature -FeatureName Microsoft-Hyper-V

Answer

Set-VMNetworkAdapter -MacAddressSpoofing On

Answer

Set-VMMemory -DynamicMemoryEnabled $false

Answer

Set-VMProcessor -ExposeVirtualizationExtensions $true

Question 9

You are implementing Shielded Virtual Machines in an on-premises Hyper-V environment to protect sensitive workloads from fabric administrators. Which TWO infrastructure components are required to support the deployment and health validation of Shielded VMs? (Choose two.)

Accepted Answer

Host Guardian Service (HGS). Shielded VMs provide a high level of security by encrypting the VM's data and state, ensuring that only authorized hosts can run them. This requires a complex infrastructure including attestation and key management. Understanding these components is essential for administrators securing highly sensitive data against unauthorized access by high-privileged users.

Answer

Azure Key Vault

Answer

Windows Server Update Services (WSUS)

Answer

Network Controller

Question 10

You are tasked with securing network traffic in a Windows Server 2022 environment using Windows Firewall with Advanced Security. Which TWO actions are required to allow traffic only from a specific trusted application while blocking all other incoming connections?

Accepted Answer

Create an inbound rule that allows connections for the specific application executable.. Securing a server involves both positive and negative enforcement. By creating a specific inbound rule for the trusted application, you permit necessary traffic, while a default deny policy ensures that no other unsolicited traffic reaches the server. This combination effectively implements the principle of least privilege, reducing the attack surface by ensuring that only authorized communication flows are allowed through the firewall boundaries.

Answer

Configure the firewall to drop all outbound traffic by default.

Answer

Enable IPsec encryption for the specific application rule.

Answer

Disable the Windows Firewall and use a third-party appliance.