AZ-802 Monitor and Troubleshoot Windows Server Environments Practice Test 2 — 15 Questions

Question 1

You are configuring Windows Event Forwarding (WEF) in a domain environment. You want the collector server to initiate the connection to the source computers to gather events. Which type of subscription should you implement to achieve this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Collector-initiated subscription. Windows Event Forwarding supports two main subscription models: source-initiated and collector-initiated. Choosing the correct model depends on network topology and management requirements. Collector-initiated subscriptions are useful when the administrator wants the central server to control the polling interval and manage the list of source computers explicitly within the subscription configuration itself.

Answer

Source-initiated subscription

Answer

WMI-based subscription

Answer

Push-based subscription

Question 2

Refer to the exhibit. An administrator runs a PowerShell command to monitor a server. Based on the output provided, which conclusion regarding the server's state is most accurate?

Accepted Answer

The server has a sustained CPU bottleneck.. Analyzing performance counter output requires understanding both the metric and the duration of the sample. In this case, the CPU usage is consistently high over a ten-second period. While this might indicate a bottleneck, an administrator must determine if this is a transient spike or a sustained trend that requires further investigation into specific processes.

Answer

The server is experiencing a critical memory leak.

Answer

Disk I/O latency is causing the high CPU values.

Answer

The server is idling normally with background tasks.

Question 3

You suspect that a specific process on a Windows Server is consuming excessive disk bandwidth, causing other applications to slow down. Which built-in tool provides the quickest way to see a live list of processes and the specific files they are currently reading or writing to?

Accepted Answer

Resource Monitor. Windows provides several tools for performance monitoring, but they vary in granularity. Resource Monitor is specifically designed to bridge the gap between Task Manager and Performance Monitor by providing detailed, real-time information about hardware resource usage at the process and file level, which is critical for identifying I/O contention.

Answer

Task Manager

Answer

Performance Monitor

Answer

Event Viewer

Question 4

An administrator needs to capture and analyze network traffic on a Windows Server 2022 Core installation without installing third-party tools. Which TWO steps are necessary to capture traffic using the built-in 'pktmon' tool and prepare it for analysis in Wireshark on another machine?

Accepted Answer

Run 'pktmon start --etw' to begin.. Packet Monitor (Pktmon) is a powerful, built-in network diagnostic tool for Windows. It is particularly useful on Server Core where a GUI is unavailable. Understanding how to start a capture and then convert the proprietary ETL format into a cross-compatible format like PCAPNG is essential for advanced network troubleshooting and analysis.

Answer

Use 'netsh trace start' to capture data.

Answer

Enable 'Promiscuous Mode' in the NIC settings.

Answer

Run 'pktmon filter add -p 80' to start.

Question 5

You are investigating a replication issue between two Active Directory Domain Controllers (DCs) named DC1 and DC2. You suspect a network latency or firewall issue is preventing the replication of the 'Configuration' partition. Which tool should you use to check the current replication status and identify the specific error code associated with the failure?

Accepted Answer

repadmin /showrepl. Active Directory replication is vital for maintaining a consistent directory database. The 'repadmin' command-line tool is the industry standard for diagnosing replication topology, monitoring status, and forcing replication between partners. It provides detailed error codes that help distinguish between DNS failures, authentication issues, and physical network blocks.

Answer

Active Directory Sites and Services

Answer

dcdiag /test:DNS

Answer

Get-ADReplicationUpToDatenessVectorTable

Question 6

You need to collect performance data from a Windows Server for a period of 24 hours to establish a baseline. You want to ensure that the data collection starts automatically at 2:00 AM and stops exactly 24 hours later. Which feature of Performance Monitor should you use to automate this?

Accepted Answer

User Defined Data Collector Sets. Performance Monitor (perfmon) allows for more than just live viewing; it includes Data Collector Sets (DCS) for structured data gathering. DCS can be scheduled with specific start and stop times, and configured to collect specific counters, enabling administrators to gather consistent baseline data without manual intervention during off-peak hours.

Answer

Performance Counter Alerts

Answer

System Diagnostics

Answer

Resource View

Question 7

An organization is migrating its on-premises Windows Server 2022 monitoring strategy to Azure Monitor. You need to collect specific event logs and performance counters from 500 servers using the most modern, secure, and centralized management method available. Which agent should you deploy to these servers to support Data Collection Rules (DCR)?

Accepted Answer

The Azure Monitor Agent (AMA). Monitoring strategies have evolved from the legacy Log Analytics agent to the Azure Monitor Agent (AMA). AMA provides a more secure, cost-effective, and simplified way to collect data using Data Collection Rules (DCRs). This transition is critical for administrators to ensure long-term support and leverage granular control over data collection from both Azure and on-premises Windows Server instances.

Answer

The legacy Log Analytics agent

Answer

The Azure Diagnostics extension (WAD)

Answer

The Dependency Agent

Question 8

Users report that they cannot access a shared folder on a Windows Server 2022 instance located in a different subnet. You suspect a firewall or routing issue. Which PowerShell cmdlet should you use to test both ICMP connectivity and the specific TCP port 445 availability simultaneously?

Accepted Answer

Test-NetConnection. Test-NetConnection is a versatile 'Swiss Army knife' for network troubleshooting in Windows. It replaces older tools like ping and telnet by allowing administrators to check basic connectivity and verify if specific service ports are open and responding, providing detailed information about the network path and success of the connection.

Answer

Ping -t

Answer

Resolve-DnsName

Answer

Get-NetFirewallRule

Question 9

You are using Azure Automation Update Management to monitor and manage updates for a group of Windows Servers. Several servers are reporting a status of 'Not assessed' for several days. What is the most likely cause of this monitoring gap?

Accepted Answer

The Log Analytics agent is not communicating with the workspace.. Azure Automation Update Management relies on the Log Analytics agent (or AMA) to report data back to the workspace. If a server is 'Not assessed,' it usually means the agent is unable to communicate, the workspace is missing data, or the required 'Update' solution has not been correctly deployed to the workspace.

Answer

The servers have not been restarted after the last update cycle.

Answer

The Windows Update service is set to 'Manual' instead of 'Automatic'.

Answer

The servers are running an unsupported version of Windows Server.

Question 10

You need to view all 'Error' level events from both the System and Application logs in a single view within Event Viewer. What is the most efficient way to maintain this view for daily use?

Accepted Answer

Create a Custom View filtered by 'Error' level and both 'System' and 'Application' logs.. Event Viewer allows for the creation of Custom Views, which act as saved filters. This enables administrators to aggregate specific event types from multiple logs into one interface, significantly reducing the time spent jumping between different logs to find related error messages during routine server health checks.

Answer

Export both logs to a CSV file and merge them in Microsoft Excel.

Answer

Use the 'Find' feature in the System log to search for the word 'Error'.

Answer

Enable 'Filter Current Log' on the System log and then repeat on the Application log.

Question 11

An administrator reports that Active Directory changes made on DC01 are not appearing on DC02. You suspect a replication issue. Which tool and command provide the most comprehensive output regarding the status of all replication neighbors for a specific domain controller?

Accepted Answer

repadmin /showrepl DC02. Repadmin.exe is the primary command-line tool for monitoring and troubleshooting Active Directory replication. It provides deep visibility into the replication topology, last successful replication times, and specific error codes that occur when domain controllers fail to synchronize their databases, which is critical for maintaining forest-wide consistency.

Answer

Active Directory Sites and Services - 'Check Replication Topology'

Answer

dcdiag /test:Replication

Answer

Get-ADReplicationPartnerMetadata

Question 12

You are managing a Windows Server 2022 instance experiencing intermittent memory pressure. You need to configure Performance Monitor to log data continuously, ensuring the logs are overwritten when they reach a maximum size of 500 MB to prevent disk exhaustion. Which setting should you modify in the Data Collector Set properties?

Accepted Answer

Enable the Circular Logging option in the Data Collector Set properties.. To manage disk space effectively while capturing performance metrics, the 'Stop condition' settings within the Data Collector Set properties allow you to define size limits. Configuring the 'Maximum size' to 500 MB and selecting the 'Overwrite' option ensures the log file rotates, maintaining only the most recent data. This is critical in production environments to prevent system volume exhaustion from unbounded performance log growth.

Answer

Configure the Schedule tab to trigger a task at 500 MB.

Answer

Adjust the Sample Interval in the Data Collector properties.

Answer

Set the Data Manager tab to delete files older than one hour.

Question 13

You are investigating a disk performance bottleneck on a Windows Server hosting a SQL database. You need to identify the physical disk latency. Which TWO counters should you monitor in Performance Monitor? (Choose two.)

Accepted Answer

PhysicalDisk\Avg. Disk sec/Transfer. Monitoring disk latency requires looking at both the time taken for requests to complete and the queue depth. 'Avg. Disk sec/Transfer' provides the average time for each disk transfer, while 'Avg. Disk Queue Length' indicates how many requests are waiting. Together, these metrics identify whether the storage subsystem is struggling to keep up with the I/O workload generated by the SQL server applications.

Answer

Memory\Pages/sec

Answer

Processor\% Processor Time

Answer

System\Context Switches/sec

Question 14

You have configured a Windows Server to forward events to a centralized collector. You notice that the collector is not receiving events from a specific source server. You verify that the 'Windows Event Collector' service is running on the collector and the 'Windows Remote Management' service is running on the source. What should you check next to troubleshoot the connectivity?

Accepted Answer

Check the WinRM listener status and configuration on both servers.. Event forwarding relies on WinRM for transport. If the services are running, the issue is often related to the WinRM listener configuration or the network path between the nodes. Verifying that the WinRM listener is active and listening on the correct port (default 5985/5986) is the logical next step to ensure the transport layer is capable of passing the subscription information between the source and the collector.

Answer

Verify the Event Log size configuration on the source server.

Answer

Restart the Task Scheduler service on the source server.

Answer

Reinstall the Windows Event Collector feature.

Question 15

You need to monitor the health of a Windows Server using System Monitor. You want to trigger an alert when the free space on the C: drive drops below 10%. You have already created a Data Collector Set. What do you need to add to the set to achieve this functionality?

Accepted Answer

Add a Performance Counter Alert to the Data Collector Set.. To trigger alerts based on specific thresholds, you must create a Performance Counter Alert in the Data Collector Set. This allows you to select the specific counter, such as '% Free Space', and set a trigger condition. Once configured, you can define an action, such as executing a script or logging an event, when the threshold is breached, enabling proactive server maintenance before disk space issues cause system instability.

Answer

Add a System Configuration information collector to the set.

Answer

Add a Trace collector to the current Data Collector Set.

Answer

Modify the Security Log audit policy for the drive.