AZ-802 Manage Windows Server in a Hybrid Environment — 10 Questions

Question 1

You are managing hybrid servers using Azure Automanage. Which TWO actions are required to successfully deploy the Best Practices configuration profile to your on-premises servers? (Choose two.)

Accepted Answer

Onboard the servers to Azure Arc. Azure Automanage for machines does not require a specific 'Automanage extension' to be manually installed. Instead, it requires the machine to be Azure Arc-enabled and for the Azure Policy 'Configure Azure Automanage' to be assigned to the scope. The Automanage service automatically handles the deployment of necessary extensions (like Azure Monitor Agent or Dependency Agent) based on the Best Practices profile.

Answer

Install the Microsoft Monitoring Agent

Answer

Assign a Global Administrator role

Answer

Configure a Site-to-Site VPN

Question 2

You are deploying Microsoft Defender for Cloud to protect your hybrid environment. What is the primary requirement for enabling vulnerability assessment on an Arc-enabled Windows Server?

Accepted Answer

Enable the Defender for Servers plan. To enable vulnerability assessment on an Arc-enabled server, you must enable the 'Microsoft Defender for Servers' plan. This plan triggers the automatic deployment of the necessary extensions (such as the Qualys agent or the Microsoft Defender Vulnerability Management extension) to the Arc-enabled server.

Answer

Configure an inbound rule on the local firewall for TCP 22

Answer

Install the Active Directory Domain Services role

Answer

Join the server to an Azure Virtual Network

Question 3

Refer to the exhibit. You created an Azure Policy definition to monitor your hybrid machines. What is the current effect of this policy?

Accepted Answer

It logs compliance events for Arc-enabled servers. The explanation correctly describes the 'audit' effect, but without the exhibit, the question cannot be verified. Assuming the exhibit shows an 'audit' effect, the explanation is sound. However, the 'EXAM TRAP' and 'COMMON TRAP' fields are empty, which is a quality issue for a certification question.

Answer

It blocks the onboarding of new Arc-enabled servers

Answer

It automatically remediates non-compliant machines

Answer

It triggers an email notification to the Global Administrator

Question 4

You are managing hybrid servers and want to use Azure Update Manager. What is the primary benefit of using this service for on-premises Windows Servers?

Accepted Answer

It provides a single control plane for managing updates across hybrid environments. Azure Update Manager provides a unified dashboard to view and manage patch compliance for both Azure VMs and Arc-enabled servers. By centralizing update management, you reduce the complexity of using multiple tools for different environments. This allows for scheduled patching, compliance reporting, and automated reboot cycles, ensuring that your entire server infrastructure remains secure and up-to-date with the latest security patches.

Answer

It automatically generates custom firewall rules for patches

Answer

It replaces the need for Windows Server Update Services (WSUS)

Answer

It automatically upgrades the Windows Server OS edition

Question 5

You are managing hybrid infrastructure and need to implement Azure Automation Runbooks. Which service is essential to execute these runbooks on on-premises Windows Servers?

Accepted Answer

Azure Arc extension for Hybrid Worker. The Hybrid Runbook Worker is not an 'Azure Arc extension' in the context of the AZ-802 exam. While it can be managed via Azure Arc, the component itself is the 'Hybrid Runbook Worker' role, which is enabled via the 'Azure Automation' extension or the legacy agent-based method. Referring to it as the 'Azure Arc extension for Hybrid Worker' is technically imprecise and misleading for certification purposes.

Answer

Azure Monitor Agent

Answer

System Center Orchestrator

Answer

Azure Site Recovery

Question 6

You want to automate the installation of the Azure Connected Machine agent across 500 existing Windows Servers in your on-premises datacenter. What is the most efficient way to deploy the agent at scale?

Accepted Answer

Use a Group Policy Object (GPO) to deploy the onboarding script.. While GPO can be used, it is not the most efficient or recommended method for deploying the Azure Connected Machine agent at scale because GPO lacks native support for passing the required service principal credentials securely and handling the agent's specific installation parameters effectively. The most efficient method is using a deployment script executed via PowerShell Remoting or an enterprise configuration management tool (like Microsoft Endpoint Configuration Manager).

Answer

Manually install the agent on each server via the Azure Portal.

Answer

Use the Azure Arc 'add server' wizard for each server.

Answer

Enable Windows Update to automatically download the agent.

Question 7

Which Azure service allows you to manage security policies for your on-premises Windows Servers as if they were Azure virtual machines?

Accepted Answer

Microsoft Defender for Cloud. While Azure Policy can be applied to Arc-enabled servers, the specific service designed to manage security policies and security posture for on-premises servers as if they were Azure VMs is Microsoft Defender for Cloud. Azure Policy is a governance tool, whereas Defender for Cloud is the security management service.

Answer

Azure Monitor

Answer

Azure Policy

Answer

Azure Automation

Question 8

Which command-line tool would you use on a Windows Server to verify that the Azure Connected Machine agent is currently communicating with the Azure service?

Accepted Answer

azcmagent check. The 'azcmagent check' command validates the local configuration and prerequisites of the agent. To verify actual network connectivity and communication with the Azure service endpoints, the correct command is 'azcmagent connect' (which performs a connectivity check during the process) or more specifically 'azcmagent show' to view status, but the actual connectivity test command is 'azcmagent check' is often confused with 'azcmagent connect --check' or simply 'azcmagent show'. However, the specific command to verify connectivity is 'azcmagent connect --check'.

Answer

test-connection -computername management.azure.com

Answer

systeminfo /s localhost

Answer

winrm quickconfig

Question 9

You are using Azure Arc to manage a Windows Server. You want to apply a tag to the server using the Azure CLI. Which command should you run?

Accepted Answer

az connectedmachine update --name --resource-group --tags Dept=IT. While 'az connectedmachine update' is the specific command for Arc-enabled servers, 'az resource tag' is a generic command that works on any Azure resource, including Arc-enabled servers. To ensure the question is valid, the distractor A should be modified to be syntactically incorrect or functionally invalid for this specific resource type.

Answer

az resource tag --id <id> --tags Dept=IT

Answer

Set-AzVM -Name <name> -Tags @{'Dept'='IT'}

Answer

az server update --name <name> --tags Dept=IT

Question 10

You are configuring Azure Arc-enabled servers for an on-premises Windows Server 2022 instance. You need to ensure that the server can communicate with Azure services while adhering to strict outbound firewall rules. Which port must be opened to support the Azure Connected Machine agent?

Accepted Answer

TCP 443. The Azure Connected Machine agent communicates primarily over HTTPS. Specifically, the agent requires outbound connectivity to Azure endpoints on TCP port 443. This is essential for telemetry, policy enforcement, and configuration management in hybrid environments. Properly configuring firewall rules ensures the agent maintains a heartbeat with Azure Resource Manager, allowing the hybrid machine to appear in the Azure portal for monitoring and management tasks.

Answer

TCP 80

Answer

TCP 3389

Answer

TCP 5985