AZ-802 Practice Test 8 — 10 Questions

Question 1

You accidentally delete an Organizational Unit (OU) containing 500 users. You need to recover the OU and its contents with all attributes, including group memberships, intact. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Active Directory Recycle Bin to restore the objects.. The Active Directory Recycle Bin is the most efficient tool for recovering deleted objects because it preserves all physical and logical attributes of the object, including its distinguished name and group memberships. Once enabled, it eliminates the need for authoritative restores from backups, which require taking a domain controller offline into Directory Services Restore Mode.

Answer

Restore the OU from a System State backup using a non-authoritative restore.

Answer

Re-create the OU and users manually and add them back to their groups.

Answer

Perform an authoritative restore of the OU using the ntdsutil command.

Question 2

Your organization has two primary data centers in Seattle and New York, connected by a high-latency WAN link. You need to ensure that Active Directory replication occurs only during non-business hours to preserve bandwidth for critical applications. Which Active Directory object should you modify to control the timing of data synchronization between these locations?

Accepted Answer

The IP Site Link object in AD Sites and Services.. Active Directory site links are logical paths that represent the network connectivity between different sites. By configuring the schedule on a site link, administrators can precisely control when replication traffic is allowed to traverse the WAN. This is a fundamental skill for managing multi-site topologies where bandwidth is limited or expensive during specific times of day.

Answer

The properties of the Seattle Site object.

Answer

The NTDS Settings of the Seattle Domain Controller.

Answer

The Subnet object associated with the New York site.

Question 3

You are deploying a Read-Only Domain Controller (RODC) in a branch office with low physical security. You need to ensure that the branch manager, who is not a member of Domain Admins, can log on to the RODC even if the WAN link to the main office is down. What must you configure?

Accepted Answer

The Password Replication Policy (PRP) of the RODC.. By default, RODCs do not store user passwords. To allow a user to log on when the WAN link is unavailable, their credentials must be cached locally. This is achieved by adding the user or their group to the 'Allowed RODC Password Replication Group' or modifying the RODC's Password Replication Policy.

Answer

The Managed By tab in the RODC computer account properties.

Answer

The Default Domain Controllers Policy for the site.

Answer

The Global Catalog role on the branch office RODC.

Question 4

Refer to the exhibit. You are running dcdiag to investigate synchronization issues between two domain controllers. Based on the error code 1256 and the output provided, which action is most likely to resolve the underlying problem?

Accepted Answer

Check the network connectivity and power status of DC2.. Error 1256 indicates that the remote system is unavailable, which usually points to a network connectivity issue or a failure of the source domain controller (DC2). Troubleshooting should focus on physical connectivity, firewall rules, or the operational status of DC2 to ensure it can communicate with DC1 over the network.

Answer

Force an immediate KCC topology update using repadmin /kcc.

Answer

Reset the computer account password for DC1 in Active Directory.

Answer

Seize the FSMO roles from DC2 using ntdsutil.

Question 5

You need to apply a stricter password policy to a group of executives than the one defined in the Default Domain Policy. You want to achieve this without creating a separate domain. Which feature should you implement?

Accepted Answer

Fine-Grained Password Policies (FGPP).. Fine-Grained Password Policies (FGPP) allow administrators to apply different password and account lockout settings to different sets of users or groups within a single domain. This eliminates the need for multiple domains just to enforce varying security requirements, which was a significant limitation in older versions of Windows Server.

Answer

A new Group Policy Object (GPO) linked to an Organizational Unit.

Answer

The 'Password never expires' attribute on user accounts.

Answer

A selective trust relationship with a secure forest.

Question 6

Refer to the exhibit. You are reviewing the output of a command used to check the health of your domain controllers. Based on the first line of the output, which specific role or feature is currently enabled on this domain controller?

Accepted Answer

Global Catalog (GC). The 'IS_GC' flag in the DSA Options section of commands like 'repadmin /showrepl' indicates that the domain controller is functioning as a Global Catalog server. This is a critical piece of information for troubleshooting logon issues and ensuring that universal group memberships can be resolved locally.

Answer

Primary Domain Controller (PDC) Emulator

Answer

Read-Only Domain Controller (RODC)

Answer

Schema Master

Question 7

Your company, Contoso, Ltd., has a branch office with ten employees. The office has poor physical security, and you are concerned about the risks of a local domain controller being stolen. You need to deploy a domain controller to this site that minimizes the security risk of credential theft for the rest of the domain. Which solution should you implement?

Accepted Answer

A Read-Only Domain Controller (RODC) with a custom Password Replication Policy.. Deploying a Read-Only Domain Controller is the recommended strategy for branch offices where physical security cannot be guaranteed. This approach ensures that only a subset of user credentials is cached locally based on the Password Replication Policy, significantly reducing the impact of a physical server theft while still providing local authentication services for users at the site.

Answer

A standard writable Domain Controller with BitLocker enabled.

Answer

An Azure AD Domain Services managed domain instance.

Answer

A member server running the Active Directory Lightweight Directory Services role.

Question 8

Refer to the exhibit. You are troubleshooting an Azure Arc onboarding failure. The server has an internet connection, but the registration script returns the provided error. What should you verify first?

Accepted Answer

Check the local DNS server forwarding settings. Error 0x80072ee7 indicates a DNS resolution failure, meaning the client cannot resolve the Azure service FQDNs. In hybrid scenarios, on-premises servers often rely on internal DNS servers that may not have access to public records or lack proper forwarding rules. Verifying the DNS configuration ensures the server can locate the necessary Azure endpoints, which is a prerequisite for the registration process to establish a secure handshake.

Answer

Verify the Azure Subscription Quotas

Answer

Validate the Azure Service Principal credentials

Answer

Restart the Azure Connected Machine service

Question 9

You need to automate the installation of the Azure Connected Machine agent across 500 on-premises Windows Servers using Group Policy. What is the most efficient way to deploy the onboarding script while ensuring secure handling of the service principal secret?

Accepted Answer

Use a Group Policy startup script that pulls secrets from a secure vault at runtime. Deploying at scale requires using a centralized mechanism like GPO to execute the installation script. To avoid storing credentials in plain text, you should use an Azure Key Vault or a temporary SAS token-based approach. This ensures that the installation process is repeatable, auditable, and secure, preventing the exposure of sensitive service principal credentials during the automated deployment of the agent across the corporate environment.

Answer

Embed the service principal secret directly into a PowerShell script file in the GPO

Answer

Manually run the installer on each server using an interactive session

Answer

Use an unauthenticated script to register the machines

Question 10

You are managing Windows Server 2022 instances in a hybrid environment. You need to implement Azure Monitor VM Insights for these servers. Which TWO steps must you complete to accomplish this? (Choose two.)

Accepted Answer

Install the Azure Connected Machine agent on the servers.. Implementing VM Insights requires both the Azure Connected Machine agent for identity and the Azure Monitor agent (AMA) for data collection. By installing the Connected Machine agent, you project the server into Azure. Once projected, the AMA extension can be deployed via Azure Policy or manually to collect telemetry, performance metrics, and logs, providing unified monitoring across the hybrid infrastructure.

Answer

Install the System Center Operations Manager (SCOM) agent.

Answer

Configure an Azure ExpressRoute circuit.

Answer

Enable Windows Server Update Services (WSUS) integration.