AZ-802 Practice Test 7 — 10 Questions

Question 1

Refer to the exhibit. You need to ensure that all data transmitted over SMB between your file server and domain-joined clients is encrypted. You set the configuration to True, but users report connectivity issues. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Clients are using an SMB version lower than 3.0.. Enabling SMB encryption globally forces all connections to use encryption. Older clients or non-Windows systems that do not support SMB 3.0 or higher will fail to negotiate a connection, resulting in access errors. This transition requires careful planning, often involving auditing first or using per-share encryption instead of global settings to maintain backward compatibility while securing sensitive data transfers across the network infrastructure.

Answer

The SMB server service must be restarted for the change to take effect.

Answer

The server's certificate for SMB encryption has expired.

Answer

The firewall is blocking TCP port 445.

Question 2

You need to ensure that only authorized administrative users can access the server via PowerShell Remoting. Which security control should you implement?

Accepted Answer

Modify the Session Configuration security descriptor.. Restricting access to PowerShell Remoting is vital to prevent unauthorized remote management. By modifying the Security Descriptor of the WinRM session configuration, you can explicitly define which users or groups have the 'Access' and 'Execute' permissions. This is a critical step in maintaining a secure administrative surface, ensuring that only those with the necessary authorization can establish remote sessions, thereby mitigating the risk of lateral movement by attackers using PowerShell.

Answer

Configure the local Administrators group only.

Answer

Enable Credential Guard for PowerShell.

Answer

Disable the WinRM service entirely.

Question 3

You are tasked with securing your Windows Server 2022 environment. Which TWO actions should you perform to implement Just Enough Administration (JEA)?

Accepted Answer

Define a Role Capability (.psrc) file.. JEA allows you to restrict administrator access to only the commands necessary for specific tasks, reducing the risk of privilege escalation. By creating a Role Capability file and a Session Configuration file, you define exactly which cmdlets and functions a user can execute. This minimizes the attack surface by ensuring that users do not have broad, unrestricted access to the entire PowerShell environment or the underlying server operating system.

Answer

Configure a Group Policy Object to enable NTLMv2 only.

Answer

Modify the local SAM database to include JEA roles.

Answer

Enable the Credential Guard feature.

Question 4

You need to audit successful and failed attempts to modify user accounts in Active Directory. Which policy should you configure?

Accepted Answer

Audit Directory Service Changes.. To audit specific changes to Active Directory objects, you must enable Audit Directory Service Changes in the Advanced Audit Policy Configuration. This is part of a comprehensive auditing strategy to detect unauthorized modifications or administrative errors. By targeting the Directory Service category, you ensure that relevant events are logged to the Security log, which can then be forwarded to a SIEM for centralized monitoring and alerting on sensitive identity changes.

Answer

Audit Account Management.

Answer

Audit Object Access.

Answer

Audit Logon/Logoff.

Question 5

You need to collect performance data from a Windows Server for a period of 24 hours to establish a baseline. You want to ensure that the data collection starts automatically at 2:00 AM and stops exactly 24 hours later. Which feature of Performance Monitor should you use to automate this?

Accepted Answer

User Defined Data Collector Sets. Performance Monitor (perfmon) allows for more than just live viewing; it includes Data Collector Sets (DCS) for structured data gathering. DCS can be scheduled with specific start and stop times, and configured to collect specific counters, enabling administrators to gather consistent baseline data without manual intervention during off-peak hours.

Answer

Performance Counter Alerts

Answer

System Diagnostics

Answer

Resource View

Question 6

An administrator needs to capture and analyze network traffic on a Windows Server 2022 Core installation without installing third-party tools. Which TWO steps are necessary to capture traffic using the built-in 'pktmon' tool and prepare it for analysis in Wireshark on another machine?

Accepted Answer

Run 'pktmon start --etw' to begin.. Packet Monitor (Pktmon) is a powerful, built-in network diagnostic tool for Windows. It is particularly useful on Server Core where a GUI is unavailable. Understanding how to start a capture and then convert the proprietary ETL format into a cross-compatible format like PCAPNG is essential for advanced network troubleshooting and analysis.

Answer

Use 'netsh trace start' to capture data.

Answer

Enable 'Promiscuous Mode' in the NIC settings.

Answer

Run 'pktmon filter add -p 80' to start.

Question 7

You are using Azure Automation Update Management to monitor and manage updates for a group of Windows Servers. Several servers are reporting a status of 'Not assessed' for several days. What is the most likely cause of this monitoring gap?

Accepted Answer

The Log Analytics agent is not communicating with the workspace.. Azure Automation Update Management relies on the Log Analytics agent (or AMA) to report data back to the workspace. If a server is 'Not assessed,' it usually means the agent is unable to communicate, the workspace is missing data, or the required 'Update' solution has not been correctly deployed to the workspace.

Answer

The servers have not been restarted after the last update cycle.

Answer

The Windows Update service is set to 'Manual' instead of 'Automatic'.

Answer

The servers are running an unsupported version of Windows Server.

Question 8

You are investigating a replication issue between two Active Directory Domain Controllers (DCs) named DC1 and DC2. You suspect a network latency or firewall issue is preventing the replication of the 'Configuration' partition. Which tool should you use to check the current replication status and identify the specific error code associated with the failure?

Accepted Answer

repadmin /showrepl. Active Directory replication is vital for maintaining a consistent directory database. The 'repadmin' command-line tool is the industry standard for diagnosing replication topology, monitoring status, and forcing replication between partners. It provides detailed error codes that help distinguish between DNS failures, authentication issues, and physical network blocks.

Answer

Active Directory Sites and Services

Answer

dcdiag /test:DNS

Answer

Get-ADReplicationUpToDatenessVectorTable

Question 9

You are troubleshooting a Windows Server application that occasionally hangs. You want to capture a dump file of the process when it stops responding. Which THREE tools or methods should you consider using? (Choose three.)

Accepted Answer

Task Manager. Capturing process dumps is essential for diagnosing application hangs. Task Manager is the quickest manual method, while ProcDump provides automation and trigger-based capturing. Debugging tools, specifically ADPlus or the Windows Error Reporting (WER) service, provide advanced mechanisms to monitor and capture state information. Using these tools allows administrators to analyze the thread state at the exact moment of failure, leading to a root cause analysis of the hang.

Answer

Performance Monitor

Answer

Resource Monitor

Question 10

You manage two Active Directory forests named fabrikam.com and contoso.com. A two-way forest trust exists between them. You want to allow users from fabrikam.com to access a specific file server in contoso.com, but you must ensure they cannot authenticate to any other resources in the contoso.com forest by default. Which authentication setting should you configure on the trust?

Accepted Answer

Selective authentication. Selective authentication is a security feature used in forest trusts to restrict the scope of authentication for users from a trusted forest. Unlike forest-wide authentication, which allows users to authenticate to any resource in the trusting forest, selective authentication requires administrators to manually grant the 'Allowed to Authenticate' permission on specific computer objects for the external users or groups.

Answer

Forest-wide authentication

Answer

Domain-wide authentication

Answer

SID Filtering