AZ-802 Deploy and Manage AD DS — 25 Questions

Question 1

Your company, Contoso, Ltd., has a branch office with poor physical security. You deploy a Read-Only Domain Controller (RODC) to the site. Users at the branch office report they cannot log in when the WAN link to the head office is down. You need to ensure branch users can authenticate locally during a WAN outage. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the branch office users to the Allowed RODC Password Replication Group.. Deploying Read-Only Domain Controllers (RODCs) in branch offices requires careful management of the Password Replication Policy (PRP) to balance security and functionality. By default, RODCs do not store user credentials. Administrators must explicitly permit accounts or groups to have their passwords cached locally to ensure that users can authenticate even if the WAN link to a writable domain controller is unavailable during a network outage.

Answer

Add the branch office users to the Enterprise Admins group.

Answer

Modify the Denied RODC Password Replication Group to include the branch users.

Answer

Enable the 'Store password using reversible encryption' policy for the users.

Question 2

Refer to the exhibit. You are troubleshooting Active Directory replication on DC01 and observe the error shown. What is the most likely cause of this specific error code in a production environment?

Accepted Answer

A replication link is being removed or the naming context is being moved.. Active Directory error code 8452 (hex 0x210C) is ERROR_DS_CANT_DEMAND_NC. This occurs when a replication operation is attempted, but the naming context is being removed from the destination or source server, or the naming context is not instanced on the specified server. Option A correctly identifies this scenario.

Answer

The source domain controller is currently offline for maintenance.

Answer

There is a significant time difference between the two domain controllers.

Answer

The KCC has not yet run to create the initial replication topology.

Question 3

You are configuring Group Policy for a set of kiosks. You apply a GPO to an Organizational Unit (OU) containing computer objects and enable 'Group Policy Loopback Processing Mode' in 'Merge' mode. Which THREE statements accurately describe how the settings will be applied when a user logs in? (Select three.)

Accepted Answer

The user's normal GPOs are processed first during the login sequence.. In Merge mode, the user's normal GPOs are processed first, followed by the GPOs linked to the computer's OU. The computer's OU GPOs take precedence if there are conflicts. Option C is technically correct regarding the order, but the explanation needs to clarify that Merge mode results in a combined set where computer-linked user settings override user-linked user settings in case of conflict.

Answer

User GPOs linked to the user's OU are ignored completely.

Answer

Computer settings from the user's OU are applied to the kiosk.

Question 4

Refer to the exhibit. You need to perform a schema extension for a new application. On which domain controller must you run the schema extension utility to ensure it succeeds?

Accepted Answer

DC02.fabrikam.com. The schema extension must be performed on the domain controller that holds the Schema Master FSMO role. The provided options (DC01, DC02, etc.) are ambiguous without the exhibit, but the correct answer must identify the Schema Master. If the exhibit shows DC02 holds the Schema Master role, then D is correct, but the explanation must explicitly state that the Schema Master role is the requirement.

Answer

DC01.fabrikam.com

Answer

Any domain controller in the forest root domain.

Answer

The Infrastructure Master for the forest root domain.

Question 5

You are implementing Azure AD Connect to synchronize your on-premises Active Directory to Azure AD. You want to enable 'Seamless Single Sign-On' (Seamless SSO). Which TWO authentication methods are compatible with this feature? (Select two.)

Accepted Answer

Password Hash Synchronization (PHS). Seamless SSO is designed to work alongside Password Hash Synchronization (PHS) or Pass-through Authentication (PTA). It provides a seamless experience by allowing the on-premises Kerberos ticket to be validated by Azure AD, which is only possible when the authentication flow is handled by Azure AD (via PHS or PTA), not when federated (AD FS).

Answer

Active Directory Federation Services (AD FS)

Answer

Certificate-based authentication

Answer

Cloud-only authentication

Question 6

You are planning to deploy Group Managed Service Accounts (gMSAs) for a web server farm. Which THREE actions are required to prepare the environment and create the first gMSA? (Select three.)

Accepted Answer

Create the KDS Root Key in the forest.. To create a gMSA, you must: 1. Create the KDS Root Key (Add-KdsRootKey). 2. Create the gMSA object in AD using New-ADServiceAccount (typically with -Name and -PrincipalsAllowedToRetrieveManagedPassword). 3. Install the gMSA on the target host using Install-ADServiceAccount. Option B is technically incorrect because New-ADServiceAccount does not use -DNSHostName to define the gMSA identity itself.

Answer

Run the New-ADServiceAccount cmdlet with the -DNSHostName parameter.

Answer

Install the Active Directory Certificate Services role on a domain controller.

Answer

Raise the domain functional level to Windows Server 2022.

Question 7

You have a user named User1 who is a member of two groups: GroupA and GroupB. You apply a Fine-Grained Password Policy (FGPP) to GroupA with a precedence of 50. You apply another FGPP to GroupB with a precedence of 10. Which policy will be applied to User1?

Accepted Answer

The policy applied to GroupB because 10 is a lower precedence value.. Fine-Grained Password Policies (FGPP) allow for multiple password policies within a single domain. When a user is subject to multiple Password Settings Objects (PSOs) through group memberships, Active Directory uses the 'msDS-PasswordSettingsPrecedence' attribute to resolve the conflict. The policy with the lowest numerical precedence value is considered the winner.

Answer

The policy applied to GroupA because 50 is a higher value.

Answer

Both policies will be merged, and the most restrictive settings will apply.

Answer

The Default Domain Policy will take precedence over both.

Question 8

You are administering an Active Directory Domain Services forest that contains Windows Server 2022 domain controllers. You need to deploy a new read-only domain controller (RODC) in a branch office. The branch office contains sensitive physical security risks, and you must ensure that user account passwords are not cached on the RODC by default, except for specific authorized helpdesk accounts. Which action should you configure?

Accepted Answer

Configure the Allowed Password Replication Group using Active Directory Users and Computers to explicitly define permitted accounts.. By default, the 'Allowed RODC Password Replication Group' is empty, and the 'Denied RODC Password Replication Group' contains sensitive accounts. To ensure no passwords are cached by default, you must ensure the Allowed group remains empty and add only the specific helpdesk accounts to it. Option B is the correct mechanism, but the explanation should clarify that the PRP is the feature being managed.

Answer

Modify the Default Domain Controllers Policy to disable credential caching globally for all domain controllers.

Answer

Set the registry key on the RODC to block all outbound replication traffic from the primary domain controller.

Answer

Deploy the RODC using an unattend XML file that specifies read-only authentication filtering parameters.

Question 9

You are preparing to decommission the final Windows Server 2012 R2 domain controller in your Active Directory forest. All domain controllers have been upgraded to Windows Server 2022. Before you can raise the functional levels, you must verify specific forest-wide and domain-wide prerequisites. Which TWO actions must you perform? Each correct answer represents part of the solution.

Accepted Answer

Ensure that the Active Directory Recycle Bin optional feature is enabled within the forest.. To raise the forest functional level to Windows Server 2016, all domain controllers in the forest must be running Windows Server 2016 or later. Option A is incorrect because the forest functional level does not need to be at 2016 *before* raising it; it is the target level. Option D is a correct requirement. The Active Directory Recycle Bin (Option C) is a prerequisite for raising the forest functional level to Windows Server 2008 R2 and above, making it a mandatory step in this scenario.

Answer

Verify that the forest functional level is currently set to at least Windows Server 2016.

Answer

Run the Dcpromo utility on all remaining domain controllers to purge residual replication metadata.

Answer

Modify the RID Master operations master role to reside exclusively on a read-only domain controller.

Question 10

You are preparing to decommission a domain controller named DC1 that currently holds several Operations Master roles. You need to ensure the environment remains stable after DC1 is removed. Which TWO roles must be moved to another domain controller to ensure new domains can be added and existing domain names remain unique within the forest?

Accepted Answer

Domain Naming Master. While the Domain Naming Master is required to add or remove domains from the forest, the Schema Master is responsible for forest-wide schema updates. The question specifically asks for roles required to ensure new domains can be added and existing domain names remain unique. The Schema Master is not required for adding domains; the Domain Naming Master is the only role required for that specific task. However, if the question implies forest-wide roles, the Schema Master is a forest-wide role, but it is not the correct answer for the specific functional requirement of adding domains.

Answer

PDC Emulator

Answer

RID Master

Answer

Schema Master

Answer

Infrastructure Master

Question 11

You are configuring a new Active Directory forest and need to ensure that the Global Catalog (GC) is highly available. Which TWO statements accurately describe the placement and function of Global Catalog servers?

Accepted Answer

Every domain controller in a forest can be a Global Catalog.. The Global Catalog contains a partial set of attributes for every object in the forest, not every attribute. Option A is correct as any DC can be a GC. Option C is correct as the GC is required for Universal Group membership resolution. Options B, D, and E are incorrect because the GC contains a partial attribute set, roles can coexist on the same server, and RODCs can indeed be GCs.

Answer

The Global Catalog contains every attribute of every object in the forest.

Answer

The Schema Master and Global Catalog roles must be on separate servers.

Answer

RODCs cannot be configured as Global Catalog servers.

Question 12

You are deploying a new domain controller in a remote office with a slow and unreliable internet connection. You want to minimize the amount of data sent over the wire during the initial promotion. Which TWO methods can you use to achieve this?

Accepted Answer

Use the 'Install from Media' (IFM) option in the promotion wizard.. To minimize the amount of data sent over the wire during the promotion of a domain controller in a remote or low-bandwidth location, you can use Install from Media (IFM) (Option A), which uses a pre-created backup database to seed the NTDS.dit file locally. Additionally, deploying the new DC as a Read-Only Domain Controller (RODC) (Option B) minimizes replication traffic by using a filtered attribute set and reducing outbound replication.

Answer

Select the 'Critical Replication Only' checkbox during promotion.

Answer

Set the replication schedule of the site link to 'Never'.

Answer

Manually copy the C:\Windows\NTDS folder from an existing DC.

Question 13

You need to automate the deployment of 50 new domain controllers across various branch offices. Which TWO tools or methods are best suited for large-scale, automated AD DS installation?

Accepted Answer

The ADDSDeployment PowerShell module.. While Answer Files (Unattend.xml) are used for automated AD DS installation, they are processed by the Windows Server installation process or the 'dcpromo' replacement mechanisms, not by DISM. DISM is used for image servicing, not for promoting a server to a domain controller.

Answer

The Active Directory Administrative Center (ADAC).

Answer

The dcpromo.exe command-line tool.

Answer

Group Policy Preferences.

Question 14

You are using the Active Directory Database Mounting Tool (dsamain.exe) to examine the contents of a three-month-old backup. What is the primary advantage of using this tool over performing a full system state restore in a lab environment?

Accepted Answer

It enables side-by-side comparison of data without extra hardware.. The dsamain.exe tool mounts the NTDS.DIT file as an LDAP server, allowing administrators to query the database using standard LDAP tools (like ADSI Edit or LDP.exe). It does not require a full system state restore, which is time-consuming and requires dedicated hardware/virtualization resources. The tool exposes the data as a read-only LDAP instance, making it ideal for object recovery or data comparison.

Answer

It allows you to modify and save changes back to the backup file.

Answer

It creates a temporary writeable domain controller for testing.

Answer

It automatically repairs corruption in the production database.

Question 15

The domain controller holding the Domain Naming Master role for your forest has suffered a catastrophic hardware failure and cannot be recovered. You need to transfer the role to a healthy domain controller. Which action must you take to resolve this issue?

Accepted Answer

Seize the Domain Naming Master role using the ntdsutil utility.. When a domain controller holding an FSMO role is permanently offline and cannot be recovered, a graceful transfer is impossible. You must perform a seizure of the role using the ntdsutil command-line tool or PowerShell (Move-ADDirectoryServerOperationMasterRole with the -Force parameter).

Answer

Perform a graceful transfer of the role using Active Directory Domains and Trusts.

Answer

Restore the failed domain controller from a system state backup to new hardware.

Answer

Raise the Forest Functional Level to Windows Server 2022 to automate role recovery.

Question 16

You are planning to implement Group Managed Service Accounts (gMSAs) for a new web cluster. You need to ensure the environment is prepared before you can create and use the gMSAs. Which TWO actions must you perform? (Each correct answer presents part of the solution.)

Accepted Answer

Create the KDS Root Key using the Add-KdsRootKey cmdlet.. To prepare the environment for gMSAs, you must create the KDS Root Key (Add-KdsRootKey) and ensure the Active Directory module for PowerShell is available. Creating the account (New-ADServiceAccount) is the implementation step, not an environment preparation step. A better second option would be installing the Active Directory PowerShell module or ensuring the domain functional level is at least Windows Server 2012.

Answer

Install the Active Directory Certificate Services role.

Answer

Raise the domain functional level to Windows Server 2019.

Answer

Enable the Active Directory Recycle Bin.

Answer

Run the New-ADServiceAccount cmdlet.

Question 17

Refer to the exhibit. You are using the provided PowerShell command to promote a new server to a domain controller. What will be the result of including the -NoGlobalCatalog $true parameter?

Accepted Answer

The domain controller will not host the Global Catalog partition.. The -NoGlobalCatalog parameter is a valid switch in the Install-ADDSDomainController cmdlet. Setting it to $true prevents the domain controller from hosting the Global Catalog. Option A is incorrect because a domain can exist with only one Global Catalog (usually the first DC), so adding a second DC without a GC does not cause a failure.

Answer

The promotion will fail because every domain must have at least one Global Catalog.

Answer

The domain controller will be promoted as a Read-Only Domain Controller.

Answer

The domain controller will not be able to replicate with other sites.

Question 18

You manage two Active Directory forests named fabrikam.com and contoso.com. A two-way forest trust exists between them. You want to allow users from fabrikam.com to access a specific file server in contoso.com, but you must ensure they cannot authenticate to any other resources in the contoso.com forest by default. Which authentication setting should you configure on the trust?

Accepted Answer

Selective authentication. Selective authentication is a security feature used in forest trusts to restrict the scope of authentication for users from a trusted forest. Unlike forest-wide authentication, which allows users to authenticate to any resource in the trusting forest, selective authentication requires administrators to manually grant the 'Allowed to Authenticate' permission on specific computer objects for the external users or groups.

Answer

Forest-wide authentication

Answer

Domain-wide authentication

Answer

SID Filtering

Question 19

You are preparing to raise the forest functional level of an existing Active Directory environment to Windows Server 2016. Which TWO requirements must be met before you can successfully perform this action? (Each correct answer presents part of the solution.)

Accepted Answer

All domain controllers in the forest must run Windows Server 2016 or later.. Raising the forest functional level is a significant administrative task that enables advanced features but requires strict adherence to versioning rules. All domain controllers in every domain within the forest must be running a version of Windows Server that is equal to or higher than the target functional level, and all individual domains must already be at that target level.

Answer

The Schema Master role must be held by a domain controller running Windows Server 2022.

Answer

You must disable the Active Directory Recycle Bin before raising the level.

Answer

The forest must be configured for DFSR replication for the SYSVOL share.

Question 20

You need to automate the deployment of a new domain controller in an existing domain using PowerShell. Which cmdlet should you use to install the Active Directory Domain Services role and promote the server after the binaries are present?

Accepted Answer

Install-ADDSDomainController. Modern Windows Server administration emphasizes automation through PowerShell. To promote a server to a domain controller, the ADDSDeployment module provides specific cmdlets that replace the legacy dcpromo utility. These cmdlets handle the configuration of the database, logs, SYSVOL paths, and the necessary directory partition replicates from existing domain controllers in the environment.

Answer

Install-WindowsFeature AD-Domain-Services

Answer

Add-Computer -DomainName 'contoso.com'

Answer

Set-ADDomain -Identity 'contoso.com' -InfrastructureMaster