AZ-802 Manage Windows Server in a Hybrid Environment — Timed 15 Questions

Question 1

You are managing hybrid servers using Azure Automanage. Which TWO actions are required to successfully deploy the Best Practices configuration profile to your on-premises servers? (Choose two.)

Accepted Answer

Onboard the servers to Azure Arc. Azure Automanage for machines does not require a specific 'Automanage extension' to be manually installed. Instead, it requires the machine to be Azure Arc-enabled and for the Azure Policy 'Configure Azure Automanage' to be assigned to the scope. The Automanage service automatically handles the deployment of necessary extensions (like Azure Monitor Agent or Dependency Agent) based on the Best Practices profile.

Answer

Install the Microsoft Monitoring Agent

Answer

Assign a Global Administrator role

Answer

Configure a Site-to-Site VPN

Question 2

You are deploying Microsoft Defender for Cloud to protect your hybrid environment. What is the primary requirement for enabling vulnerability assessment on an Arc-enabled Windows Server?

Accepted Answer

Enable the Defender for Servers plan. To enable vulnerability assessment on an Arc-enabled server, you must enable the 'Microsoft Defender for Servers' plan. This plan triggers the automatic deployment of the necessary extensions (such as the Qualys agent or the Microsoft Defender Vulnerability Management extension) to the Arc-enabled server.

Answer

Configure an inbound rule on the local firewall for TCP 22

Answer

Install the Active Directory Domain Services role

Answer

Join the server to an Azure Virtual Network

Question 3

Refer to the exhibit. You created an Azure Policy definition to monitor your hybrid machines. What is the current effect of this policy?

Accepted Answer

It logs compliance events for Arc-enabled servers. The explanation correctly describes the 'audit' effect, but without the exhibit, the question cannot be verified. Assuming the exhibit shows an 'audit' effect, the explanation is sound. However, the 'EXAM TRAP' and 'COMMON TRAP' fields are empty, which is a quality issue for a certification question.

Answer

It blocks the onboarding of new Arc-enabled servers

Answer

It automatically remediates non-compliant machines

Answer

It triggers an email notification to the Global Administrator

Question 4

You are managing hybrid servers and want to use Azure Update Manager. What is the primary benefit of using this service for on-premises Windows Servers?

Accepted Answer

It provides a single control plane for managing updates across hybrid environments. Azure Update Manager provides a unified dashboard to view and manage patch compliance for both Azure VMs and Arc-enabled servers. By centralizing update management, you reduce the complexity of using multiple tools for different environments. This allows for scheduled patching, compliance reporting, and automated reboot cycles, ensuring that your entire server infrastructure remains secure and up-to-date with the latest security patches.

Answer

It automatically generates custom firewall rules for patches

Answer

It replaces the need for Windows Server Update Services (WSUS)

Answer

It automatically upgrades the Windows Server OS edition

Question 5

You are managing hybrid infrastructure and need to implement Azure Automation Runbooks. Which service is essential to execute these runbooks on on-premises Windows Servers?

Accepted Answer

Azure Arc extension for Hybrid Worker. The Hybrid Runbook Worker is not an 'Azure Arc extension' in the context of the AZ-802 exam. While it can be managed via Azure Arc, the component itself is the 'Hybrid Runbook Worker' role, which is enabled via the 'Azure Automation' extension or the legacy agent-based method. Referring to it as the 'Azure Arc extension for Hybrid Worker' is technically imprecise and misleading for certification purposes.

Answer

Azure Monitor Agent

Answer

System Center Orchestrator

Answer

Azure Site Recovery

Question 6

You want to automate the installation of the Azure Connected Machine agent across 500 existing Windows Servers in your on-premises datacenter. What is the most efficient way to deploy the agent at scale?

Accepted Answer

Use a Group Policy Object (GPO) to deploy the onboarding script.. While GPO can be used, it is not the most efficient or recommended method for deploying the Azure Connected Machine agent at scale because GPO lacks native support for passing the required service principal credentials securely and handling the agent's specific installation parameters effectively. The most efficient method is using a deployment script executed via PowerShell Remoting or an enterprise configuration management tool (like Microsoft Endpoint Configuration Manager).

Answer

Manually install the agent on each server via the Azure Portal.

Answer

Use the Azure Arc 'add server' wizard for each server.

Answer

Enable Windows Update to automatically download the agent.

Question 7

Which Azure service allows you to manage security policies for your on-premises Windows Servers as if they were Azure virtual machines?

Accepted Answer

Microsoft Defender for Cloud. While Azure Policy can be applied to Arc-enabled servers, the specific service designed to manage security policies and security posture for on-premises servers as if they were Azure VMs is Microsoft Defender for Cloud. Azure Policy is a governance tool, whereas Defender for Cloud is the security management service.

Answer

Azure Monitor

Answer

Azure Policy

Answer

Azure Automation

Question 8

Which command-line tool would you use on a Windows Server to verify that the Azure Connected Machine agent is currently communicating with the Azure service?

Accepted Answer

azcmagent check. The 'azcmagent check' command validates the local configuration and prerequisites of the agent. To verify actual network connectivity and communication with the Azure service endpoints, the correct command is 'azcmagent connect' (which performs a connectivity check during the process) or more specifically 'azcmagent show' to view status, but the actual connectivity test command is 'azcmagent check' is often confused with 'azcmagent connect --check' or simply 'azcmagent show'. However, the specific command to verify connectivity is 'azcmagent connect --check'.

Answer

test-connection -computername management.azure.com

Answer

systeminfo /s localhost

Answer

winrm quickconfig

Question 9

You are using Azure Arc to manage a Windows Server. You want to apply a tag to the server using the Azure CLI. Which command should you run?

Accepted Answer

az connectedmachine update --name --resource-group --tags Dept=IT. While 'az connectedmachine update' is the specific command for Arc-enabled servers, 'az resource tag' is a generic command that works on any Azure resource, including Arc-enabled servers. To ensure the question is valid, the distractor A should be modified to be syntactically incorrect or functionally invalid for this specific resource type.

Answer

az resource tag --id <id> --tags Dept=IT

Answer

Set-AzVM -Name <name> -Tags @{'Dept'='IT'}

Answer

az server update --name <name> --tags Dept=IT

Question 10

You are configuring Azure Arc-enabled servers for an on-premises Windows Server 2022 instance. You need to ensure that the server can communicate with Azure services while adhering to strict outbound firewall rules. Which port must be opened to support the Azure Connected Machine agent?

Accepted Answer

TCP 443. The Azure Connected Machine agent communicates primarily over HTTPS. Specifically, the agent requires outbound connectivity to Azure endpoints on TCP port 443. This is essential for telemetry, policy enforcement, and configuration management in hybrid environments. Properly configuring firewall rules ensures the agent maintains a heartbeat with Azure Resource Manager, allowing the hybrid machine to appear in the Azure portal for monitoring and management tasks.

Answer

TCP 80

Answer

TCP 3389

Answer

TCP 5985

Question 11

Refer to the exhibit. You are troubleshooting an Azure Arc onboarding failure. The server has an internet connection, but the registration script returns the provided error. What should you verify first?

Accepted Answer

Check the local DNS server forwarding settings. Error 0x80072ee7 indicates a DNS resolution failure, meaning the client cannot resolve the Azure service FQDNs. In hybrid scenarios, on-premises servers often rely on internal DNS servers that may not have access to public records or lack proper forwarding rules. Verifying the DNS configuration ensures the server can locate the necessary Azure endpoints, which is a prerequisite for the registration process to establish a secure handshake.

Answer

Verify the Azure Subscription Quotas

Answer

Validate the Azure Service Principal credentials

Answer

Restart the Azure Connected Machine service

Question 12

You need to automate the installation of the Azure Connected Machine agent across 500 on-premises Windows Servers using Group Policy. What is the most efficient way to deploy the onboarding script while ensuring secure handling of the service principal secret?

Accepted Answer

Use a Group Policy startup script that pulls secrets from a secure vault at runtime. Deploying at scale requires using a centralized mechanism like GPO to execute the installation script. To avoid storing credentials in plain text, you should use an Azure Key Vault or a temporary SAS token-based approach. This ensures that the installation process is repeatable, auditable, and secure, preventing the exposure of sensitive service principal credentials during the automated deployment of the agent across the corporate environment.

Answer

Embed the service principal secret directly into a PowerShell script file in the GPO

Answer

Manually run the installer on each server using an interactive session

Answer

Use an unauthenticated script to register the machines

Question 13

You are managing hybrid servers and need to use Azure Policy to enforce security standards. What is the primary benefit of using Azure Policy with Azure Arc-enabled servers?

Accepted Answer

It allows you to apply consistent compliance and configuration settings across hybrid environments. Azure Policy allows you to audit and enforce settings on hybrid servers as if they were native Azure VMs. This provides a consistent management plane where you can track compliance, such as ensuring specific updates are installed or security settings are applied. This uniformity is crucial for hybrid environments, as it eliminates the need for maintaining separate compliance tools for cloud and on-premises infrastructure.

Answer

It automatically migrates on-premises databases to Azure SQL

Answer

It provides real-time antivirus protection without installing a local agent

Answer

It replaces the need for Active Directory Group Policy Objects

Question 14

You are implementing Azure Monitor for your hybrid servers. Which THREE steps are required to collect guest-level metrics and logs from an Arc-enabled Windows Server? (Choose three.)

Accepted Answer

Install the Azure Monitor Agent (AMA) extension. To enable comprehensive monitoring, you must install the Azure Monitor Agent, create a Data Collection Rule (DCR), and associate that rule with the specific Arc-enabled machines. This workflow ensures that the agent is present, configured with the correct scope, and targeted to collect the specific metrics and event logs required for operational visibility in the Azure Monitor workspace.

Answer

Enable the legacy Log Analytics agent

Answer

Assign the Log Analytics Contributor role to the machine

Question 15

You are troubleshooting an issue where an Azure Arc-enabled server is showing as 'Offline' in the Azure portal, despite the server being powered on. Which local service should you check first to ensure the agent is running?

Accepted Answer

Azure Connected Machine Agent service (himds). The Azure Connected Machine agent relies on the 'himds' (Hybrid Instance Metadata Service) to function. If this service is stopped, the server loses its heartbeat to the Azure control plane, causing it to appear as offline. Checking this service status is the most direct way to identify if the agent software has crashed or been disabled, which is the most common cause of communication gaps.

Answer

Windows Update service

Answer

Server Manager

Answer

Network Location Awareness service