AZ-802 Exam Simulation — 100 Questions

Question 1

You are preparing to raise the forest functional level of an existing Active Directory environment to Windows Server 2016. Which TWO requirements must be met before you can successfully perform this action? (Each correct answer presents part of the solution.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

All domain controllers in the forest must run Windows Server 2016 or later.. Raising the forest functional level is a significant administrative task that enables advanced features but requires strict adherence to versioning rules. All domain controllers in every domain within the forest must be running a version of Windows Server that is equal to or higher than the target functional level, and all individual domains must already be at that target level.

Answer

The Schema Master role must be held by a domain controller running Windows Server 2022.

Answer

You must disable the Active Directory Recycle Bin before raising the level.

Answer

The forest must be configured for DFSR replication for the SYSVOL share.

Question 2

The domain controller holding the RID Master FSMO role in your domain has suffered a catastrophic hardware failure and will be offline for several weeks. You notice that administrators can no longer create new user objects. What should you do to resolve this issue immediately?

Accepted Answer

Seize the RID Master role using the 'Move-ADDirectoryServerOperationMasterRole' cmdlet.. The Relative Identifier (RID) Master is responsible for allocating pools of RIDs to all domain controllers in a domain. When a DC exhausts its local pool and the RID Master is unavailable, it cannot create new security principals. In cases of permanent or long-term failure, the role must be seized to a healthy DC to restore functionality.

Answer

Wait for the Knowledge Consistency Checker (KCC) to automatically move the role.

Answer

Perform a graceful transfer of the RID Master role using ADUC.

Answer

Reinstall Active Directory on the failed server using the same name.

Question 3

You need to create a service account for a custom application that runs on a single Windows server. The account must support automatic password management and must not require manual SPN registration. Which type of account should you use?

Accepted Answer

Standalone Managed Service Account (sMSA). Standalone Managed Service Accounts (sMSAs) were introduced to simplify service account management by automating password rotations and SPN handling. Unlike traditional service accounts, sMSAs are tied to a single computer and do not require administrative intervention for password updates, significantly reducing the risk of service outages due to expired credentials or human error.

Answer

Group Managed Service Account (gMSA)

Answer

A standard Domain User account

Answer

A Local System account

Question 4

You need to automate the deployment of a new domain controller in an existing domain using PowerShell. Which cmdlet should you use to install the Active Directory Domain Services role and promote the server after the binaries are present?

Accepted Answer

Install-ADDSDomainController. Modern Windows Server administration emphasizes automation through PowerShell. To promote a server to a domain controller, the ADDSDeployment module provides specific cmdlets that replace the legacy dcpromo utility. These cmdlets handle the configuration of the database, logs, SYSVOL paths, and the necessary directory partition replicates from existing domain controllers in the environment.

Answer

Install-WindowsFeature AD-Domain-Services

Answer

Add-Computer -DomainName 'contoso.com'

Answer

Set-ADDomain -Identity 'contoso.com' -InfrastructureMaster

Question 5

You want to allow a specific help desk user to reset passwords for all users in a specific Organizational Unit (OU), but you do not want to grant them any other administrative rights. What is the most appropriate tool to use?

Accepted Answer

The Delegation of Control Wizard. The Delegation of Control Wizard in Active Directory Users and Computers (ADUC) is designed for granting specific, limited permissions to users or groups over specific portions of the directory. This follows the principle of least privilege by allowing tasks to be offloaded to non-administrators without granting full Domain Admin rights.

Answer

Active Directory Sites and Services

Answer

Group Policy Management Console (GPMC)

Answer

The 'Managed By' tab on the OU properties

Question 6

You are managing an Active Directory domain that includes several Fine-Grained Password Policies (FGPP). A user is a member of two global groups: 'Sales-Group' and 'Marketing-Group'. 'Sales-Group' is assigned a Password Settings Object (PSO) with a precedence of 50. 'Marketing-Group' is assigned a PSO with a precedence of 20. Which policy will be applied to the user?

Accepted Answer

The PSO assigned to the Marketing-Group.. Active Directory determines which Fine-Grained Password Policy to apply based on the precedence value of the Password Settings Objects. In this hierarchy, the PSO with the lower numeric value takes precedence. Therefore, a PSO with a precedence of 20 will override a PSO with a precedence of 50 when a user is a member of multiple groups.

Answer

The Default Domain Policy.

Answer

The PSO assigned to the Sales-Group.

Answer

Both policies will be merged, and the most restrictive settings will apply.

Question 7

You are implementing Azure Monitor for your hybrid servers. Which THREE steps are required to collect guest-level metrics and logs from an Arc-enabled Windows Server? (Choose three.)

Accepted Answer

Install the Azure Monitor Agent (AMA) extension. To enable comprehensive monitoring, you must install the Azure Monitor Agent, create a Data Collection Rule (DCR), and associate that rule with the specific Arc-enabled machines. This workflow ensures that the agent is present, configured with the correct scope, and targeted to collect the specific metrics and event logs required for operational visibility in the Azure Monitor workspace.

Answer

Enable the legacy Log Analytics agent

Answer

Assign the Log Analytics Contributor role to the machine

Question 8

You have three Active Directory sites: SiteA, SiteB, and SiteC. SiteA is connected to SiteB with a cost of 50. SiteB is connected to SiteC with a cost of 50. There is no direct link between SiteA and SiteC. If 'Bridge all site links' is enabled, what is the effective replication cost between SiteA and SiteC?

Accepted Answer

100. Active Directory uses site link costs to determine the most efficient path for replication. When 'Bridge all site links' is enabled (the default), Active Directory can calculate a transitive path between sites that are not directly connected. The total cost is the sum of the costs of the individual links that make up the path.

Answer

50

Answer

Replication is impossible without a direct link.

Answer

0

Question 9

An administrator accidentally deleted an Organizational Unit (OU) containing several hundred user accounts. You need to recover the OU and its contents with the least amount of administrative effort and without taking any domain controllers offline. What should you use?

Accepted Answer

The Active Directory Recycle Bin.. The Active Directory Recycle Bin is the most efficient way to recover deleted objects because it preserves all attributes and the original Distinguished Name. Unlike traditional backups, it does not require a reboot into Directory Services Restore Mode (DSRM), making it the ideal choice for rapid recovery in modern environments.

Answer

An authoritative restore using an existing System State backup.

Answer

A non-authoritative restore of the entire domain database.

Answer

The LDP.exe utility to manually reanimate the tombstone.

Question 10

Refer to the exhibit. You are troubleshooting an issue where several users are unable to change their passwords, and the help desk is seeing inconsistent results when resetting them. Based on the output provided, which domain controller should you investigate first for potential failures or connectivity issues?

Accepted Answer

DC1. The PDC Emulator is the authoritative server for password changes and the primary target for password resets within a domain. In the provided exhibit, DC1 holds the PDC Emulator role. If DC1 is offline or experiencing issues, password-related tasks will fail or show inconsistencies, making it the primary suspect for troubleshooting.

Answer

DC2

Answer

The Schema Master

Answer

The Domain Naming Master

Question 11

You plan to implement Group Managed Service Accounts (gMSAs) to improve the security of several web services. Which TWO prerequisites must be met before you can create and use gMSAs in your Active Directory environment?

Accepted Answer

A Windows Server 2012 or later domain functional level.. Group Managed Service Accounts (gMSAs) require a minimum domain functional level and a specific root key for the Key Distribution Service (KDS). The KDS root key is used by domain controllers to generate the passwords for gMSAs, and it must be created once per forest to enable the service.

Answer

A functional Certificate Authority (CA) in the forest.

Answer

The Windows Server 2016 forest functional level.

Answer

The installation of the Web Server (IIS) role on a DC.

Question 12

You are the administrator of a large multi-domain forest. You have a branch office with a slow WAN link that contains only one domain controller. Users in this office complain that they cannot log on when the WAN link is down, even though they belong to Universal Groups. How should you resolve this issue while minimizing WAN traffic?

Accepted Answer

Enable Universal Group Membership Caching (UGMC) for the branch office site.. In a multi-domain forest, a domain controller needs to contact a Global Catalog to determine Universal Group membership during logon. If a GC is not available locally and the WAN link is down, logons fail. Enabling Universal Group Membership Caching allows a standard DC to cache these memberships, enabling successful logons during outages without the overhead of hosting a full GC.

Answer

Configure the branch office domain controller as a Global Catalog server.

Answer

Convert all Universal Groups to Global Groups.

Answer

Increase the replication frequency of the Site Link to 15 minutes.

Question 13

Your company is merging with another firm. You need to allow users in the 'contoso.com' forest to access resources in the 'fabrikam.com' forest. The solution must ensure that users from Fabrikam cannot access any resources in Contoso unless specifically granted permission on each individual resource. What should you configure?

Accepted Answer

A one-way outgoing forest trust with selective authentication.. A one-way forest trust with selective authentication is the most secure way to connect two forests. The 'one-way' aspect limits the direction of trust, while 'selective authentication' prevents trusted users from automatically being part of the 'Authenticated Users' group on resources in the trusting domain.

Answer

A two-way forest trust with forest-wide authentication.

Answer

An external trust with SID filtering disabled.

Answer

A realm trust with a non-Windows Kerberos environment.

Question 14

You plan to deploy a new domain controller as an Azure Virtual Machine (VM) to provide authentication for cloud workloads. Which THREE actions should you take to ensure the stability and supportability of the domain controller? (Each correct answer presents part of the solution.)

Accepted Answer

Configure a static private IP address for the VM in the Azure portal.. Deploying domain controllers on Azure VMs requires specific configuration to prevent database corruption and ensure consistent identity services. This includes using a static private IP address to prevent DNS failures, placing the NTDS database on a non-caching data disk to ensure write integrity, and using a separate virtual disk rather than the OS drive.

Answer

Enable Azure Disk Encryption on the OS drive.

Answer

Configure the OS drive to use Read/Write host caching.

Question 15

You are adding a new Windows Server 2022 domain controller to an existing forest that currently has a functional level of Windows Server 2012 R2. What is the maximum functional level you can set for the new domain controller?

Accepted Answer

Windows Server 2012 R2. Domain controllers run the operating system version installed on them, but the domain and forest functional levels determine which features are available across the entire environment. A new Windows Server 2022 DC can join a 2012 R2 forest, but it will operate within the constraints of that lower functional level.

Answer

Windows Server 2022

Answer

Windows Server 2016

Answer

Windows Server 2019

Question 16

Refer to the exhibit. You are troubleshooting a replication issue between the Head Office (Site-HQ) and a Branch Office (Site-Branch-A). Based on the output, what is the most likely cause of the failure?

Accepted Answer

A firewall is blocking RPC traffic or the source DC is offline.. The error code 1722 (The RPC server is unavailable) typically indicates a network connectivity issue or a service failure on the source domain controller. In the context of Active Directory replication, this often points to a firewall blocking RPC traffic, a failure of the DNS to resolve the source DC's name, or the RPC service being stopped.

Answer

The KCC has not yet generated a replication topology for the site.

Answer

There is a mismatch in the Site Link costs between the two sites.

Answer

The destination domain controller lacks the Global Catalog role.

Question 17

You are configuring Azure Arc-enabled servers for an on-premises Windows Server 2022 instance. You need to ensure that the server can communicate with Azure services while adhering to strict outbound firewall rules. Which port must be opened to support the Azure Connected Machine agent?

Accepted Answer

TCP 443. The Azure Connected Machine agent communicates primarily over HTTPS. Specifically, the agent requires outbound connectivity to Azure endpoints on TCP port 443. This is essential for telemetry, policy enforcement, and configuration management in hybrid environments. Properly configuring firewall rules ensures the agent maintains a heartbeat with Azure Resource Manager, allowing the hybrid machine to appear in the Azure portal for monitoring and management tasks.

Answer

TCP 80

Answer

TCP 3389

Answer

TCP 5985

Question 18

You need to inspect the state of Active Directory objects as they existed three days ago to troubleshoot an issue. You have a system state backup from that time. Which TWO tools must you use to view the contents of the database from the backup without performing a full restore? (Each correct answer presents part of the solution.)

Accepted Answer

ntdsutil. To view the contents of a past Active Directory database, you first use ntdsutil to mount the snapshot or recovered database file. Then, you use dsamain to expose that database as an LDAP directory service on a custom port. Once dsamain is running, standard tools like Active Directory Users and Computers can connect to that specific port.

Answer

Active Directory Sites and Services

Answer

wbadmin

Answer

repadmin

Question 19

You are configuring Azure Arc to manage your on-premises servers. Which THREE of the following are benefits of using the Azure Arc resource bridge? (Choose three.)

Accepted Answer

Enables VM lifecycle management from the Azure portal. The Azure Arc resource bridge is a virtual appliance that simplifies the management of virtualized environments. It provides a unified way to manage virtual machines, scale resources, and integrate hybrid infrastructure with Azure management services like RBAC and policy. By abstracting the underlying virtualization, it enables a consistent cloud-like experience for managing on-premises virtualized workloads, improving administrative efficiency and oversight.

Answer

Provides an alternative to the Azure Connected Machine agent

Answer

Eliminates the need for local virtualization software

Question 20

You are managing hybrid servers and need to use Azure Policy to enforce security standards. What is the primary benefit of using Azure Policy with Azure Arc-enabled servers?

Accepted Answer

It allows you to apply consistent compliance and configuration settings across hybrid environments. Azure Policy allows you to audit and enforce settings on hybrid servers as if they were native Azure VMs. This provides a consistent management plane where you can track compliance, such as ensuring specific updates are installed or security settings are applied. This uniformity is crucial for hybrid environments, as it eliminates the need for maintaining separate compliance tools for cloud and on-premises infrastructure.

Answer

It automatically migrates on-premises databases to Azure SQL

Answer

It provides real-time antivirus protection without installing a local agent

Answer

It replaces the need for Active Directory Group Policy Objects