AZ-802 Deploy and Manage AD DS Practice Test 2 — 15 Questions

Question 1

You are planning to implement Group Managed Service Accounts (gMSAs) for a new web cluster. You need to ensure the environment is prepared before you can create and use the gMSAs. Which TWO actions must you perform? (Each correct answer presents part of the solution.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create the KDS Root Key using the Add-KdsRootKey cmdlet.. To prepare the environment for gMSAs, you must create the KDS Root Key (Add-KdsRootKey) and ensure the Active Directory module for PowerShell is available. Creating the account (New-ADServiceAccount) is the implementation step, not an environment preparation step. A better second option would be installing the Active Directory PowerShell module or ensuring the domain functional level is at least Windows Server 2012.

Answer

Install the Active Directory Certificate Services role.

Answer

Raise the domain functional level to Windows Server 2019.

Answer

Enable the Active Directory Recycle Bin.

Answer

Run the New-ADServiceAccount cmdlet.

Question 2

Refer to the exhibit. You are using the provided PowerShell command to promote a new server to a domain controller. What will be the result of including the -NoGlobalCatalog $true parameter?

Accepted Answer

The domain controller will not host the Global Catalog partition.. The -NoGlobalCatalog parameter is a valid switch in the Install-ADDSDomainController cmdlet. Setting it to $true prevents the domain controller from hosting the Global Catalog. Option A is incorrect because a domain can exist with only one Global Catalog (usually the first DC), so adding a second DC without a GC does not cause a failure.

Answer

The promotion will fail because every domain must have at least one Global Catalog.

Answer

The domain controller will be promoted as a Read-Only Domain Controller.

Answer

The domain controller will not be able to replicate with other sites.

Question 3

You manage two Active Directory forests named fabrikam.com and contoso.com. A two-way forest trust exists between them. You want to allow users from fabrikam.com to access a specific file server in contoso.com, but you must ensure they cannot authenticate to any other resources in the contoso.com forest by default. Which authentication setting should you configure on the trust?

Accepted Answer

Selective authentication. Selective authentication is a security feature used in forest trusts to restrict the scope of authentication for users from a trusted forest. Unlike forest-wide authentication, which allows users to authenticate to any resource in the trusting forest, selective authentication requires administrators to manually grant the 'Allowed to Authenticate' permission on specific computer objects for the external users or groups.

Answer

Forest-wide authentication

Answer

Domain-wide authentication

Answer

SID Filtering

Question 4

You are preparing to raise the forest functional level of an existing Active Directory environment to Windows Server 2016. Which TWO requirements must be met before you can successfully perform this action? (Each correct answer presents part of the solution.)

Accepted Answer

All domain controllers in the forest must run Windows Server 2016 or later.. Raising the forest functional level is a significant administrative task that enables advanced features but requires strict adherence to versioning rules. All domain controllers in every domain within the forest must be running a version of Windows Server that is equal to or higher than the target functional level, and all individual domains must already be at that target level.

Answer

The Schema Master role must be held by a domain controller running Windows Server 2022.

Answer

You must disable the Active Directory Recycle Bin before raising the level.

Answer

The forest must be configured for DFSR replication for the SYSVOL share.

Question 5

You need to automate the deployment of a new domain controller in an existing domain using PowerShell. Which cmdlet should you use to install the Active Directory Domain Services role and promote the server after the binaries are present?

Accepted Answer

Install-ADDSDomainController. Modern Windows Server administration emphasizes automation through PowerShell. To promote a server to a domain controller, the ADDSDeployment module provides specific cmdlets that replace the legacy dcpromo utility. These cmdlets handle the configuration of the database, logs, SYSVOL paths, and the necessary directory partition replicates from existing domain controllers in the environment.

Answer

Install-WindowsFeature AD-Domain-Services

Answer

Add-Computer -DomainName 'contoso.com'

Answer

Set-ADDomain -Identity 'contoso.com' -InfrastructureMaster

Question 6

The domain controller holding the RID Master FSMO role in your domain has suffered a catastrophic hardware failure and will be offline for several weeks. You notice that administrators can no longer create new user objects. What should you do to resolve this issue immediately?

Accepted Answer

Seize the RID Master role using the 'Move-ADDirectoryServerOperationMasterRole' cmdlet.. The Relative Identifier (RID) Master is responsible for allocating pools of RIDs to all domain controllers in a domain. When a DC exhausts its local pool and the RID Master is unavailable, it cannot create new security principals. In cases of permanent or long-term failure, the role must be seized to a healthy DC to restore functionality.

Answer

Wait for the Knowledge Consistency Checker (KCC) to automatically move the role.

Answer

Perform a graceful transfer of the RID Master role using ADUC.

Answer

Reinstall Active Directory on the failed server using the same name.

Question 7

You need to create a service account for a custom application that runs on a single Windows server. The account must support automatic password management and must not require manual SPN registration. Which type of account should you use?

Accepted Answer

Standalone Managed Service Account (sMSA). Standalone Managed Service Accounts (sMSAs) were introduced to simplify service account management by automating password rotations and SPN handling. Unlike traditional service accounts, sMSAs are tied to a single computer and do not require administrative intervention for password updates, significantly reducing the risk of service outages due to expired credentials or human error.

Answer

Group Managed Service Account (gMSA)

Answer

A standard Domain User account

Answer

A Local System account

Question 8

You accidentally delete an Organizational Unit (OU) containing 500 users. You need to recover the OU and its contents with all attributes, including group memberships, intact. What is the most efficient way to achieve this?

Accepted Answer

Use the Active Directory Recycle Bin to restore the objects.. The Active Directory Recycle Bin is the most efficient tool for recovering deleted objects because it preserves all physical and logical attributes of the object, including its distinguished name and group memberships. Once enabled, it eliminates the need for authoritative restores from backups, which require taking a domain controller offline into Directory Services Restore Mode.

Answer

Restore the OU from a System State backup using a non-authoritative restore.

Answer

Re-create the OU and users manually and add them back to their groups.

Answer

Perform an authoritative restore of the OU using the ntdsutil command.

Question 9

You have three Active Directory sites: SiteA, SiteB, and SiteC. SiteA is connected to SiteB with a cost of 50. SiteB is connected to SiteC with a cost of 50. There is no direct link between SiteA and SiteC. If 'Bridge all site links' is enabled, what is the effective replication cost between SiteA and SiteC?

Accepted Answer

100. Active Directory uses site link costs to determine the most efficient path for replication. When 'Bridge all site links' is enabled (the default), Active Directory can calculate a transitive path between sites that are not directly connected. The total cost is the sum of the costs of the individual links that make up the path.

Answer

50

Answer

Replication is impossible without a direct link.

Answer

0

Question 10

You want to allow a specific help desk user to reset passwords for all users in a specific Organizational Unit (OU), but you do not want to grant them any other administrative rights. What is the most appropriate tool to use?

Accepted Answer

The Delegation of Control Wizard. The Delegation of Control Wizard in Active Directory Users and Computers (ADUC) is designed for granting specific, limited permissions to users or groups over specific portions of the directory. This follows the principle of least privilege by allowing tasks to be offloaded to non-administrators without granting full Domain Admin rights.

Answer

Active Directory Sites and Services

Answer

Group Policy Management Console (GPMC)

Answer

The 'Managed By' tab on the OU properties

Question 11

Your organization has two primary data centers in Seattle and New York, connected by a high-latency WAN link. You need to ensure that Active Directory replication occurs only during non-business hours to preserve bandwidth for critical applications. Which Active Directory object should you modify to control the timing of data synchronization between these locations?

Accepted Answer

The IP Site Link object in AD Sites and Services.. Active Directory site links are logical paths that represent the network connectivity between different sites. By configuring the schedule on a site link, administrators can precisely control when replication traffic is allowed to traverse the WAN. This is a fundamental skill for managing multi-site topologies where bandwidth is limited or expensive during specific times of day.

Answer

The properties of the Seattle Site object.

Answer

The NTDS Settings of the Seattle Domain Controller.

Answer

The Subnet object associated with the New York site.

Question 12

Refer to the exhibit. You are troubleshooting an issue where several users are unable to change their passwords, and the help desk is seeing inconsistent results when resetting them. Based on the output provided, which domain controller should you investigate first for potential failures or connectivity issues?

Accepted Answer

DC1. The PDC Emulator is the authoritative server for password changes and the primary target for password resets within a domain. In the provided exhibit, DC1 holds the PDC Emulator role. If DC1 is offline or experiencing issues, password-related tasks will fail or show inconsistencies, making it the primary suspect for troubleshooting.

Answer

DC2

Answer

The Schema Master

Answer

The Domain Naming Master

Question 13

You are deploying a Read-Only Domain Controller (RODC) in a branch office with low physical security. You need to ensure that the branch manager, who is not a member of Domain Admins, can log on to the RODC even if the WAN link to the main office is down. What must you configure?

Accepted Answer

The Password Replication Policy (PRP) of the RODC.. By default, RODCs do not store user passwords. To allow a user to log on when the WAN link is unavailable, their credentials must be cached locally. This is achieved by adding the user or their group to the 'Allowed RODC Password Replication Group' or modifying the RODC's Password Replication Policy.

Answer

The Managed By tab in the RODC computer account properties.

Answer

The Default Domain Controllers Policy for the site.

Answer

The Global Catalog role on the branch office RODC.

Question 14

You plan to implement Group Managed Service Accounts (gMSAs) to improve the security of several web services. Which TWO prerequisites must be met before you can create and use gMSAs in your Active Directory environment?

Accepted Answer

A Windows Server 2012 or later domain functional level.. Group Managed Service Accounts (gMSAs) require a minimum domain functional level and a specific root key for the Key Distribution Service (KDS). The KDS root key is used by domain controllers to generate the passwords for gMSAs, and it must be created once per forest to enable the service.

Answer

A functional Certificate Authority (CA) in the forest.

Answer

The Windows Server 2016 forest functional level.

Answer

The installation of the Web Server (IIS) role on a DC.

Question 15

An administrator accidentally deleted an Organizational Unit (OU) containing several hundred user accounts. You need to recover the OU and its contents with the least amount of administrative effort and without taking any domain controllers offline. What should you use?

Accepted Answer

The Active Directory Recycle Bin.. The Active Directory Recycle Bin is the most efficient way to recover deleted objects because it preserves all attributes and the original Distinguished Name. Unlike traditional backups, it does not require a reboot into Directory Services Restore Mode (DSRM), making it the ideal choice for rapid recovery in modern environments.

Answer

An authoritative restore using an existing System State backup.

Answer

A non-authoritative restore of the entire domain database.

Answer

The LDP.exe utility to manually reanimate the tombstone.