AZ-802 Monitor and Troubleshoot Windows Server Environments — Timed 20 Questions

Question 1

A system administrator needs to monitor the real-time resource utilization of a remote Windows Server 2022 instance using Windows Admin Center. Which TWO tools within the Windows Admin Center interface provide specific insights into real-time CPU, memory, and disk IOPS metrics for the connected server?

20 minute time limit — choose an answer to begin.

Accepted Answer

Overview tab. In Windows Admin Center, the 'Overview' page provides real-time charts for CPU, Memory, Ethernet, and Disk. The 'Processes' tool provides real-time resource utilization (CPU, Memory, Disk I/O) per process. 'Performance Monitor' is not a standard extension included in the default WAC installation for server management.

Answer

Performance Monitor extension

Answer

Events extension

Answer

Azure Monitor extension

Question 2

You are using Azure Update Manager to oversee the patching of several Windows Server 2022 instances across a hybrid environment. Which TWO actions can you perform directly from the Azure Update Manager interface to manage compliance?

Accepted Answer

Schedule recurring update installations. Azure Update Manager provides a unified service to manage and govern update compliance for Windows and Linux machines. It allows for both manual intervention and automated scheduling. Understanding the scope of its capabilities is essential for maintaining a secure and patched server estate across both Azure and on-premises environments via Azure Arc.

Answer

Edit the server's local Registry keys

Answer

Uninstall third-party applications

Answer

Resize the virtual machine's disk

Question 3

You are troubleshooting a Hyper-V Replica environment where replication has entered a 'Critical' state. The error message indicates that the replica server is unable to apply the latest log files. What should be your first step in resolving this issue while minimizing data loss?

Accepted Answer

Resume replication after a manual resync.. While resynchronization is the correct recovery path for a 'Critical' state where logs cannot be applied, the first step in troubleshooting should always be to attempt to resume replication normally. If that fails, then a resynchronization is triggered. Furthermore, the explanation should clarify that 'Resume Replication' is the action, and the system automatically handles the resync process if required.

Answer

Delete the replica VM and start over.

Answer

Disable and re-enable the Hyper-V VSS writer.

Answer

Increase the replication frequency to 30 seconds.

Question 4

Refer to the exhibit. An administrator is running this Kusto Query Language (KQL) query in the Azure Monitor Logs interface. What is the administrator trying to identify?

Accepted Answer

Servers that are currently unresponsive or offline.. The question refers to an exhibit that is not provided. Without the KQL query (e.g., Heartbeat | summarize arg_max(TimeGenerated, *) by Computer | where TimeGenerated < ago(5m)), it is impossible to confirm if the query actually identifies unresponsive servers or if the options are valid.

Answer

Servers that have not been rebooted in 24 hours.

Answer

The average response time of all servers.

Answer

A list of all servers added in the last 15 minutes.

Question 5

You need to monitor the security health of your Windows Server 2022 fleet. Which TWO components or features should you use to centralize and view Microsoft Defender Antimalware detection events across multiple servers in a hybrid environment?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides the security posture management and threat protection for the servers, while Microsoft Sentinel acts as the SIEM/SOAR solution to aggregate and analyze the logs. Both are correct for centralizing and viewing detection events in a hybrid environment.

Answer

Windows Server Update Services (WSUS)

Answer

Group Policy Management Console (GPMC)

Answer

Performance Monitor (perfmon)

Question 6

A 4-node Windows Server 2022 Failover Cluster is configured with a File Share Witness. You observe that even when two nodes and the File Share Witness fail simultaneously, the remaining two nodes continue to provide services. Which feature of Windows Server Failover Clustering is primarily responsible for this behavior?

Accepted Answer

Dynamic Quorum. Windows Server Failover Clustering calculates quorum based on total votes. With 4 nodes and 1 File Share Witness, there are 5 votes total, requiring 3 votes for quorum. If 2 nodes and the File Share Witness fail, 3 votes are lost, leaving only 2 votes. This results in loss of quorum and the cluster would stop. For the remaining two nodes to survive, Dynamic Quorum management combined with modified node weights or specific multi-site configurations would be needed, or the question stem contains an impossible scenario for standard quorum math.

Answer

Cluster Shared Volumes (CSV)

Answer

Cloud Witness

Answer

Node Fairness

Question 7

A Windows Server 2022 volume is running out of space. You need to identify which folders are consuming the most disk space without installing any third-party software. Which feature of Windows Server can be used to generate a report on disk usage by file type and owner?

Accepted Answer

File Server Resource Manager (FSRM). File Server Resource Manager (FSRM) is a powerful role service that provides advanced storage management capabilities. One of its primary features is Storage Reports, which can be scheduled or run on-demand to provide detailed insights into disk usage, helping administrators identify large files, duplicate files, and folder sizes.

Answer

Disk Management

Answer

Storage Optimizer

Answer

Storage Sense

Question 8

You are configuring Windows Event Forwarding (WEF) in a domain environment. You have created a source-initiated subscription on a Collector server, but the events from the Source computers are not appearing in the 'Forwarded Events' log. You verify that the WinRM service is running on all machines. What should you check next to ensure the Source computers can push events?

Accepted Answer

Add the 'Network Service' account to the 'Event Log Readers' group on the source computers.. For source-initiated subscriptions, the 'Network Service' account on the source computers needs to be added to the 'Event Log Readers' group to read security logs, but this is only if the subscription includes the Security log. More importantly, the source computers must be able to communicate with the collector. The most common failure point for source-initiated subscriptions is the GPO configuration (Subscription Manager) or the WinRM listener configuration, not just the local group membership. Furthermore, the explanation mentions the Collector's address in GPO, but the option focuses on local group membership.

Answer

Disable the Windows Firewall on the Collector server to allow incoming TCP port 5985 traffic.

Answer

Configure the 'Event Log Readers' group on the Collector server to include the computer accounts.

Answer

Change the subscription type on the Collector server to 'Collector-initiated' and restart the service.

Question 9

You need to monitor the performance of a Windows Server 2022 file server that is experiencing intermittent slow disk I/O. You want to capture data over a 24-hour period to identify patterns without manually watching the screen. Which TWO components of Performance Monitor should you use to achieve this?

Accepted Answer

Data Collector Sets. Data Collector Sets are used to configure and schedule performance data logging over long periods. While Performance Counter Logs are a type of data collector within Data Collector Sets, Resource Monitor or Alerts are typically the other distinct built-in monitoring tools asked about in these contexts, but looking strictly at Data Collector Sets and configuring logs, let's verify standard Microsoft phrasing. Actually, Performance Counter Logs are configured *within* Data Collector Sets. Let's fix the options to reflect Performance Monitor and Data Collector Sets correctly, or use Data Collector Sets and another valid component like Alerts.

Answer

Performance Monitor Live View

Answer

Resource Monitor

Answer

Performance Counter Logs

Answer

Event Viewer Custom Views

Question 10

You are implementing Azure Monitor VM Insights for a fleet of hybrid Windows Servers. Which THREE components or configurations are required to enable the full Map and Health features of VM Insights?

Accepted Answer

The Dependency Agent installed on the servers.. To enable VM Insights for hybrid servers, the servers must be onboarded to Azure Arc. The three core components required for the full Map and Health features are the Azure Monitor Agent (AMA) with a Data Collection Rule (DCR), the Dependency Agent, and a Log Analytics workspace. The explanation should explicitly mention Azure Arc as the prerequisite for hybrid connectivity.

Answer

A Network Watcher flow log configuration.

Answer

A Managed Service Identity (MSI) on the server.

Question 11

You are using Windows Admin Center (WAC) to manage several Windows Server 2022 instances. You want to monitor disk performance and identify which processes are consuming the most memory. Which TWO tools within Windows Admin Center should you use?

Accepted Answer

Processes. In Windows Admin Center, the 'Processes' tool is used to identify memory-consuming processes, and the 'Storage' tool is used to monitor disk performance, volumes, and partitions. The explanation should clearly link these specific tools to the requirements in the stem.

Answer

Active Directory

Answer

Events

Answer

Certificates

Question 12

You need to configure a Windows Server to automatically send an email to the IT team whenever the 'Available MBytes' of memory falls below 500 MB for more than 5 minutes. What is the most appropriate feature to use for this requirement?

Accepted Answer

Performance Counter Alert in a Data Collector Set. Performance Counter Alerts in a Data Collector Set can trigger a task (via Task Scheduler) when a threshold is met. The task itself must be configured to send the email (e.g., via PowerShell script), as the Performance Monitor alert does not have a built-in 'send email' action. The explanation should clarify that the alert triggers a task, which then handles the notification.

Answer

Event Viewer 'Attach Task To This Event'

Answer

Resource Monitor 'Analyze Wait Chain'

Answer

Task Manager 'Efficiency Mode'

Question 13

Refer to the exhibit. You are troubleshooting unexpected server reboots on a critical Windows Server. You executed the provided PowerShell command to identify when the system started. Based on the output, what conclusion can you draw regarding the system stability?

Accepted Answer

The server was offline or powered off between October 5th and October 12th.. Event ID 6005 indicates the Event Log service started, signifying a system boot. A gap in these logs between October 5th and October 12th confirms the server was not running during that interval, as no boot events were recorded.

Answer

The server has been rebooting daily at approximately 08:30 AM.

Answer

The server experienced an unplanned power outage on October 6th.

Answer

The Event Log service failed to start on October 6th through 11th.

Question 14

You are transitioning several Windows Server 2022 Azure Virtual Machines from the legacy Log Analytics Agent to the newer Azure Monitor Agent (AMA). You need to ensure that specific System and Application event logs are centralized in a Log Analytics workspace. What component must you create and associate with the virtual machines to facilitate this data collection?

Accepted Answer

Data Collection Rules. The Azure Monitor Agent relies on Data Collection Rules (DCR) to define which data should be collected and where it should be sent. Unlike the legacy agent which used workspace-wide settings, DCRs provide a more granular and flexible approach, allowing administrators to target specific servers with unique logging requirements while maintaining a centralized management structure in the Azure portal.

Answer

Diagnostic Settings

Answer

Log Analytics Gateway

Answer

Automation Accounts

Question 15

An administrator is troubleshooting a Storage Spaces Direct (S2D) cluster where one node shows a status of 'Retired'. The administrator needs to identify if a physical disk failure or a communication timeout caused this status. Which PowerShell cmdlet provides the most detailed health information regarding the operational status of the underlying physical disks in the storage pool?

Accepted Answer

Get-PhysicalDisk. In a Windows Server Failover Cluster utilizing Storage Spaces Direct, monitoring physical disk health is critical for maintaining data redundancy. The retired status often indicates a hardware failure or a disk that has exceeded error thresholds. Using the correct PowerShell cmdlet allows administrators to drill down into the health metadata and operational status codes for precise troubleshooting.

Answer

Get-StoragePool

Answer

Get-VirtualDisk

Answer

Debug-StorageSubsystem

Question 16

You are configuring Windows Event Forwarding (WEF) in a domain environment. You want the collector server to initiate the connection to the source computers to gather events. Which type of subscription should you implement to achieve this behavior?

Accepted Answer

Collector-initiated subscription. Windows Event Forwarding supports two main subscription models: source-initiated and collector-initiated. Choosing the correct model depends on network topology and management requirements. Collector-initiated subscriptions are useful when the administrator wants the central server to control the polling interval and manage the list of source computers explicitly within the subscription configuration itself.

Answer

Source-initiated subscription

Answer

WMI-based subscription

Answer

Push-based subscription

Question 17

Refer to the exhibit. An administrator runs a PowerShell command to monitor a server. Based on the output provided, which conclusion regarding the server's state is most accurate?

Accepted Answer

The server has a sustained CPU bottleneck.. Analyzing performance counter output requires understanding both the metric and the duration of the sample. In this case, the CPU usage is consistently high over a ten-second period. While this might indicate a bottleneck, an administrator must determine if this is a transient spike or a sustained trend that requires further investigation into specific processes.

Answer

The server is experiencing a critical memory leak.

Answer

Disk I/O latency is causing the high CPU values.

Answer

The server is idling normally with background tasks.

Question 18

You suspect that a specific process on a Windows Server is consuming excessive disk bandwidth, causing other applications to slow down. Which built-in tool provides the quickest way to see a live list of processes and the specific files they are currently reading or writing to?

Accepted Answer

Resource Monitor. Windows provides several tools for performance monitoring, but they vary in granularity. Resource Monitor is specifically designed to bridge the gap between Task Manager and Performance Monitor by providing detailed, real-time information about hardware resource usage at the process and file level, which is critical for identifying I/O contention.

Answer

Task Manager

Answer

Performance Monitor

Answer

Event Viewer

Question 19

An administrator needs to capture and analyze network traffic on a Windows Server 2022 Core installation without installing third-party tools. Which TWO steps are necessary to capture traffic using the built-in 'pktmon' tool and prepare it for analysis in Wireshark on another machine?

Accepted Answer

Run 'pktmon start --etw' to begin.. Packet Monitor (Pktmon) is a powerful, built-in network diagnostic tool for Windows. It is particularly useful on Server Core where a GUI is unavailable. Understanding how to start a capture and then convert the proprietary ETL format into a cross-compatible format like PCAPNG is essential for advanced network troubleshooting and analysis.

Answer

Use 'netsh trace start' to capture data.

Answer

Enable 'Promiscuous Mode' in the NIC settings.

Answer

Run 'pktmon filter add -p 80' to start.

Question 20

You are investigating a replication issue between two Active Directory Domain Controllers (DCs) named DC1 and DC2. You suspect a network latency or firewall issue is preventing the replication of the 'Configuration' partition. Which tool should you use to check the current replication status and identify the specific error code associated with the failure?

Accepted Answer

repadmin /showrepl. Active Directory replication is vital for maintaining a consistent directory database. The 'repadmin' command-line tool is the industry standard for diagnosing replication topology, monitoring status, and forcing replication between partners. It provides detailed error codes that help distinguish between DNS failures, authentication issues, and physical network blocks.

Answer

Active Directory Sites and Services

Answer

dcdiag /test:DNS

Answer

Get-ADReplicationUpToDatenessVectorTable