AZ-802 Monitor and Troubleshoot Windows Server Environments — 10 Questions

Question 1

A system administrator needs to monitor the real-time resource utilization of a remote Windows Server 2022 instance using Windows Admin Center. Which TWO tools within the Windows Admin Center interface provide specific insights into real-time CPU, memory, and disk IOPS metrics for the connected server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Overview tab. In Windows Admin Center, the 'Overview' page provides real-time charts for CPU, Memory, Ethernet, and Disk. The 'Processes' tool provides real-time resource utilization (CPU, Memory, Disk I/O) per process. 'Performance Monitor' is not a standard extension included in the default WAC installation for server management.

Answer

Performance Monitor extension

Answer

Events extension

Answer

Azure Monitor extension

Question 2

You are using Azure Update Manager to oversee the patching of several Windows Server 2022 instances across a hybrid environment. Which TWO actions can you perform directly from the Azure Update Manager interface to manage compliance?

Accepted Answer

Schedule recurring update installations. Azure Update Manager provides a unified service to manage and govern update compliance for Windows and Linux machines. It allows for both manual intervention and automated scheduling. Understanding the scope of its capabilities is essential for maintaining a secure and patched server estate across both Azure and on-premises environments via Azure Arc.

Answer

Edit the server's local Registry keys

Answer

Uninstall third-party applications

Answer

Resize the virtual machine's disk

Question 3

You are troubleshooting a Hyper-V Replica environment where replication has entered a 'Critical' state. The error message indicates that the replica server is unable to apply the latest log files. What should be your first step in resolving this issue while minimizing data loss?

Accepted Answer

Resume replication after a manual resync.. While resynchronization is the correct recovery path for a 'Critical' state where logs cannot be applied, the first step in troubleshooting should always be to attempt to resume replication normally. If that fails, then a resynchronization is triggered. Furthermore, the explanation should clarify that 'Resume Replication' is the action, and the system automatically handles the resync process if required.

Answer

Delete the replica VM and start over.

Answer

Disable and re-enable the Hyper-V VSS writer.

Answer

Increase the replication frequency to 30 seconds.

Question 4

Refer to the exhibit. An administrator is running this Kusto Query Language (KQL) query in the Azure Monitor Logs interface. What is the administrator trying to identify?

Accepted Answer

Servers that are currently unresponsive or offline.. The question refers to an exhibit that is not provided. Without the KQL query (e.g., Heartbeat | summarize arg_max(TimeGenerated, *) by Computer | where TimeGenerated < ago(5m)), it is impossible to confirm if the query actually identifies unresponsive servers or if the options are valid.

Answer

Servers that have not been rebooted in 24 hours.

Answer

The average response time of all servers.

Answer

A list of all servers added in the last 15 minutes.

Question 5

You need to monitor the security health of your Windows Server 2022 fleet. Which TWO components or features should you use to centralize and view Microsoft Defender Antimalware detection events across multiple servers in a hybrid environment?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides the security posture management and threat protection for the servers, while Microsoft Sentinel acts as the SIEM/SOAR solution to aggregate and analyze the logs. Both are correct for centralizing and viewing detection events in a hybrid environment.

Answer

Windows Server Update Services (WSUS)

Answer

Group Policy Management Console (GPMC)

Answer

Performance Monitor (perfmon)

Question 6

A 4-node Windows Server 2022 Failover Cluster is configured with a File Share Witness. You observe that even when two nodes and the File Share Witness fail simultaneously, the remaining two nodes continue to provide services. Which feature of Windows Server Failover Clustering is primarily responsible for this behavior?

Accepted Answer

Dynamic Quorum. Windows Server Failover Clustering calculates quorum based on total votes. With 4 nodes and 1 File Share Witness, there are 5 votes total, requiring 3 votes for quorum. If 2 nodes and the File Share Witness fail, 3 votes are lost, leaving only 2 votes. This results in loss of quorum and the cluster would stop. For the remaining two nodes to survive, Dynamic Quorum management combined with modified node weights or specific multi-site configurations would be needed, or the question stem contains an impossible scenario for standard quorum math.

Answer

Cluster Shared Volumes (CSV)

Answer

Cloud Witness

Answer

Node Fairness

Question 7

A Windows Server 2022 volume is running out of space. You need to identify which folders are consuming the most disk space without installing any third-party software. Which feature of Windows Server can be used to generate a report on disk usage by file type and owner?

Accepted Answer

File Server Resource Manager (FSRM). File Server Resource Manager (FSRM) is a powerful role service that provides advanced storage management capabilities. One of its primary features is Storage Reports, which can be scheduled or run on-demand to provide detailed insights into disk usage, helping administrators identify large files, duplicate files, and folder sizes.

Answer

Disk Management

Answer

Storage Optimizer

Answer

Storage Sense

Question 8

You are configuring Windows Event Forwarding (WEF) in a domain environment. You have created a source-initiated subscription on a Collector server, but the events from the Source computers are not appearing in the 'Forwarded Events' log. You verify that the WinRM service is running on all machines. What should you check next to ensure the Source computers can push events?

Accepted Answer

Add the 'Network Service' account to the 'Event Log Readers' group on the source computers.. For source-initiated subscriptions, the 'Network Service' account on the source computers needs to be added to the 'Event Log Readers' group to read security logs, but this is only if the subscription includes the Security log. More importantly, the source computers must be able to communicate with the collector. The most common failure point for source-initiated subscriptions is the GPO configuration (Subscription Manager) or the WinRM listener configuration, not just the local group membership. Furthermore, the explanation mentions the Collector's address in GPO, but the option focuses on local group membership.

Answer

Disable the Windows Firewall on the Collector server to allow incoming TCP port 5985 traffic.

Answer

Configure the 'Event Log Readers' group on the Collector server to include the computer accounts.

Answer

Change the subscription type on the Collector server to 'Collector-initiated' and restart the service.

Question 9

You need to monitor the performance of a Windows Server 2022 file server that is experiencing intermittent slow disk I/O. You want to capture data over a 24-hour period to identify patterns without manually watching the screen. Which TWO components of Performance Monitor should you use to achieve this?

Accepted Answer

Data Collector Sets. Data Collector Sets are used to configure and schedule performance data logging over long periods. While Performance Counter Logs are a type of data collector within Data Collector Sets, Resource Monitor or Alerts are typically the other distinct built-in monitoring tools asked about in these contexts, but looking strictly at Data Collector Sets and configuring logs, let's verify standard Microsoft phrasing. Actually, Performance Counter Logs are configured *within* Data Collector Sets. Let's fix the options to reflect Performance Monitor and Data Collector Sets correctly, or use Data Collector Sets and another valid component like Alerts.

Answer

Performance Monitor Live View

Answer

Resource Monitor

Answer

Performance Counter Logs

Answer

Event Viewer Custom Views

Question 10

You are implementing Azure Monitor VM Insights for a fleet of hybrid Windows Servers. Which THREE components or configurations are required to enable the full Map and Health features of VM Insights?

Accepted Answer

The Dependency Agent installed on the servers.. To enable VM Insights for hybrid servers, the servers must be onboarded to Azure Arc. The three core components required for the full Map and Health features are the Azure Monitor Agent (AMA) with a Data Collection Rule (DCR), the Dependency Agent, and a Log Analytics workspace. The explanation should explicitly mention Azure Arc as the prerequisite for hybrid connectivity.

Answer

A Network Watcher flow log configuration.

Answer

A Managed Service Identity (MSI) on the server.