AZ-802 Practice Test 6 — 10 Questions

Question 1

You are configuring Azure File Sync to synchronize a local folder on FileServer1 with an Azure file share. Which TWO endpoint types must be added to a Sync Group to enable this functionality?

Accepted Answer

Cloud endpoint. A Sync Group defines the topology for Azure File Sync. It must contain exactly one cloud endpoint, which represents the Azure file share, and one or more server endpoints, which represent paths on registered Windows Servers. This structure allows data to flow between the cloud and on-premises locations.

Answer

Storage endpoint

Answer

Network endpoint

Answer

Management endpoint

Question 2

Refer to the exhibit. An administrator has configured a share with the FolderEnumerationMode shown. What is the result when a user without Read permissions to a specific subfolder browses the share?

Accepted Answer

The folder is hidden from the user's view entirely.. Access-based enumeration (ABE) is a feature that filters the list of files and folders displayed to users based on their individual permissions. When ABE is enabled, users only see the objects they have at least Read access to, which improves security and reduces confusion in large shared directories.

Answer

The user sees the folder but receives 'Access Denied' when opening it.

Answer

The user is prompted for credentials when clicking the folder.

Answer

The share becomes read-only for that user.

Question 3

You are configuring Azure Bastion to provide secure RDP access to your Windows Server VMs in an Azure Virtual Network. Which THREE requirements must be met for a successful deployment? (Select THREE)

Accepted Answer

A subnet named 'AzureBastionSubnet' must exist in the Virtual Network.. Azure Bastion is a managed PaaS service that provides secure RDP and SSH access. It requires a dedicated subnet named 'AzureBastionSubnet' with a minimum mask of /26. Additionally, it requires a Public IP address for the Bastion resource itself. This setup ensures that your VMs do not need public IP addresses for administrative access.

Answer

All target Windows Servers must have the Remote Desktop Gateway role installed.

Answer

A Site-to-Site VPN must be established between Azure and on-premises.

Question 4

Your company runs Windows Server 2022 and utilizes Storage Spaces Direct. You need to configure a new storage pool using available drives. Which Windows PowerShell cmdlet should you create and initialize this storage pool?

Accepted Answer

New-StoragePool. The New-StoragePool cmdlet is the primary tool in PowerShell to combine physical disks into a manageable storage pool within Storage Spaces. Proper initialization is foundational for configuring resiliency tiers and virtual disks, ensuring high availability and fault tolerance across your clustered hyper-converged infrastructure deployments.

Answer

New-Volume

Answer

Initialize-Disk

Answer

Add-PhysicalDisk

Question 5

Your organization implements Just Enough Administration (JEA) to manage Windows Servers. A junior administrator needs to restart the Print Spooler service on several print servers but should not have full administrative rights. You need to identify the specific file that defines which cmdlets and external commands the junior administrator can execute. Which file should you configure?

Accepted Answer

The Role Capability file (.psrc). The Role Capability file defines exactly which cmdlets, functions, and external commands a user is allowed to run when connecting to a JEA endpoint. By restricting access to only the necessary tools for a specific task, you minimize the potential for lateral movement or accidental misconfiguration. This principle of least privilege is a cornerstone of securing administrative access in modern Windows Server environments.

Answer

The Session Configuration file (.pssc)

Answer

The PowerShell Profile file (.ps1)

Answer

The Module Manifest file (.psd1)

Question 6

An administrator is concerned about man-in-the-middle attacks where an attacker intercepts and modifies SMB traffic between a Windows Server 2022 file server and its clients. Which security feature should be enforced to ensure the integrity and authenticity of the SMB traffic?

Accepted Answer

SMB Signing. SMB Signing is a security mechanism in the SMB protocol that allows for the digital signing of SMB packets. This prevents the modification of data in transit and protects against man-in-the-middle attacks. Enforcing this feature ensures that both the client and the server can verify the origin and integrity of every packet exchanged during a session.

Answer

NTFS Permissions

Answer

Access-Based Enumeration

Answer

Disk Quotas

Question 7

You are configuring Windows Defender Credential Guard on a fleet of Windows Server 2022 Hyper-V hosts. You want to protect the LSA process from being accessed by unauthorized users or malware. Which hardware-based security feature must be enabled in the BIOS/UEFI and supported by the CPU for Credential Guard to operate?

Accepted Answer

Virtualization Extensions (Intel VT-x or AMD-V) and SLAT. Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate secrets, such as NTLM password hashes and Kerberos Ticket Granting Tickets, in a protected environment. This requires hardware support for virtualization and Second Level Address Translation (SLAT) to create the secure memory enclave that the Local Security Authority (LSA) uses to shield credentials.

Answer

Direct Memory Access (DMA) Protection

Answer

Hyper-Threading Technology

Answer

Hardware-enforced Stack Protection

Question 8

You manage a Windows Server Update Services (WSUS) infrastructure with one upstream server and three downstream servers. You want the downstream servers to only download updates that have been approved on the upstream server. Which WSUS configuration mode should you use for the downstream servers?

Accepted Answer

Replica mode. WSUS supports two modes for downstream servers: Replica and Autonomous. In Replica mode, the downstream server mirrors the update approvals, settings, and classes of the upstream server. This centralizes management and ensures that only updates vetted and approved by the central administrator are distributed across the entire organization's branch offices or departments.

Answer

Autonomous mode

Answer

Distributed mode

Answer

Disconnected mode

Question 9

Your company is implementing a Tiered Administration Model to secure its Windows Server infrastructure. You need to deploy Privileged Access Workstations (PAWs) for all Domain Admins. What is the primary purpose of using a PAW in this environment?

Accepted Answer

To provide a dedicated environment that is isolated from the risks of email and web browsing.. A Privileged Access Workstation (PAW) provides a dedicated, hardened environment for sensitive administrative tasks. By isolating high-privilege credentials from common threats like email, web browsing, and general-purpose applications, PAWs significantly reduce the risk of credential theft. This isolation is a critical defense-in-depth strategy for protecting high-value accounts in an Active Directory forest.

Answer

To allow administrators to browse the internet safely while performing server updates.

Answer

To enable multiple users to share a single high-privilege account across the organization.

Answer

To automatically synchronize local administrator passwords across all domain controllers.

Question 10

You are securing Windows Admin Center (WAC) to manage your Windows Server 2022 environment. You want to implement granular access control for different IT teams. Which TWO methods can be used to control who has access to Windows Admin Center and what they can do? (Select TWO)

Accepted Answer

Active Directory groups for gateway access control.. Windows Admin Center security is managed through two main layers: gateway access and tool access. Gateway access is controlled via local groups or Active Directory groups on the WAC server. For more granular control over specific server tasks, WAC integrates with Just Enough Administration (JEA) to limit the cmdlets and actions available to the user.

Answer

Azure Key Vault for storing the WAC login credentials.

Answer

NTFS permissions on the Windows Admin Center installation folder.

Answer

DHCP Reservations for the WAC gateway IP address.