AZ-802 Multiple Select — 20 Questions

Question 1

You are preparing to raise the forest functional level of an existing Active Directory environment to Windows Server 2016. Which TWO requirements must be met before you can successfully perform this action? (Each correct answer presents part of the solution.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

All domain controllers in the forest must run Windows Server 2016 or later.. Raising the forest functional level is a significant administrative task that enables advanced features but requires strict adherence to versioning rules. All domain controllers in every domain within the forest must be running a version of Windows Server that is equal to or higher than the target functional level, and all individual domains must already be at that target level.

Answer

The Schema Master role must be held by a domain controller running Windows Server 2022.

Answer

You must disable the Active Directory Recycle Bin before raising the level.

Answer

The forest must be configured for DFSR replication for the SYSVOL share.

Question 2

You are implementing Azure Monitor for your hybrid servers. Which THREE steps are required to collect guest-level metrics and logs from an Arc-enabled Windows Server? (Choose three.)

Accepted Answer

Install the Azure Monitor Agent (AMA) extension. To enable comprehensive monitoring, you must install the Azure Monitor Agent, create a Data Collection Rule (DCR), and associate that rule with the specific Arc-enabled machines. This workflow ensures that the agent is present, configured with the correct scope, and targeted to collect the specific metrics and event logs required for operational visibility in the Azure Monitor workspace.

Answer

Enable the legacy Log Analytics agent

Answer

Assign the Log Analytics Contributor role to the machine

Question 3

You plan to implement Group Managed Service Accounts (gMSAs) to improve the security of several web services. Which TWO prerequisites must be met before you can create and use gMSAs in your Active Directory environment?

Accepted Answer

A Windows Server 2012 or later domain functional level.. Group Managed Service Accounts (gMSAs) require a minimum domain functional level and a specific root key for the Key Distribution Service (KDS). The KDS root key is used by domain controllers to generate the passwords for gMSAs, and it must be created once per forest to enable the service.

Answer

A functional Certificate Authority (CA) in the forest.

Answer

The Windows Server 2016 forest functional level.

Answer

The installation of the Web Server (IIS) role on a DC.

Question 4

You plan to deploy a new domain controller as an Azure Virtual Machine (VM) to provide authentication for cloud workloads. Which THREE actions should you take to ensure the stability and supportability of the domain controller? (Each correct answer presents part of the solution.)

Accepted Answer

Configure a static private IP address for the VM in the Azure portal.. Deploying domain controllers on Azure VMs requires specific configuration to prevent database corruption and ensure consistent identity services. This includes using a static private IP address to prevent DNS failures, placing the NTDS database on a non-caching data disk to ensure write integrity, and using a separate virtual disk rather than the OS drive.

Answer

Enable Azure Disk Encryption on the OS drive.

Answer

Configure the OS drive to use Read/Write host caching.

Question 5

You need to inspect the state of Active Directory objects as they existed three days ago to troubleshoot an issue. You have a system state backup from that time. Which TWO tools must you use to view the contents of the database from the backup without performing a full restore? (Each correct answer presents part of the solution.)

Accepted Answer

ntdsutil. To view the contents of a past Active Directory database, you first use ntdsutil to mount the snapshot or recovered database file. Then, you use dsamain to expose that database as an LDAP directory service on a custom port. Once dsamain is running, standard tools like Active Directory Users and Computers can connect to that specific port.

Answer

Active Directory Sites and Services

Answer

wbadmin

Answer

repadmin

Question 6

You are configuring Azure Arc to manage your on-premises servers. Which THREE of the following are benefits of using the Azure Arc resource bridge? (Choose three.)

Accepted Answer

Enables VM lifecycle management from the Azure portal. The Azure Arc resource bridge is a virtual appliance that simplifies the management of virtualized environments. It provides a unified way to manage virtual machines, scale resources, and integrate hybrid infrastructure with Azure management services like RBAC and policy. By abstracting the underlying virtualization, it enables a consistent cloud-like experience for managing on-premises virtualized workloads, improving administrative efficiency and oversight.

Answer

Provides an alternative to the Azure Connected Machine agent

Answer

Eliminates the need for local virtualization software

Question 7

You are implementing Shielded Virtual Machines in an on-premises Hyper-V environment to protect sensitive workloads from fabric administrators. Which TWO infrastructure components are required to support the deployment and health validation of Shielded VMs? (Choose two.)

Accepted Answer

Host Guardian Service (HGS). Shielded VMs provide a high level of security by encrypting the VM's data and state, ensuring that only authorized hosts can run them. This requires a complex infrastructure including attestation and key management. Understanding these components is essential for administrators securing highly sensitive data against unauthorized access by high-privileged users.

Answer

Azure Key Vault

Answer

Windows Server Update Services (WSUS)

Answer

Network Controller

Question 8

You are tasked with securing network traffic in a Windows Server 2022 environment using Windows Firewall with Advanced Security. Which TWO actions are required to allow traffic only from a specific trusted application while blocking all other incoming connections?

Accepted Answer

Create an inbound rule that allows connections for the specific application executable.. Securing a server involves both positive and negative enforcement. By creating a specific inbound rule for the trusted application, you permit necessary traffic, while a default deny policy ensures that no other unsolicited traffic reaches the server. This combination effectively implements the principle of least privilege, reducing the attack surface by ensuring that only authorized communication flows are allowed through the firewall boundaries.

Answer

Configure the firewall to drop all outbound traffic by default.

Answer

Enable IPsec encryption for the specific application rule.

Answer

Disable the Windows Firewall and use a third-party appliance.

Question 9

You are configuring DHCP failover between two Windows Server 2022 nodes named Server1 and Server2 to ensure high availability for a critical subnet. Which TWO failover modes are available for selection during the configuration wizard?

Accepted Answer

Load Balance. Windows Server DHCP failover provides two distinct modes to ensure that IP address leasing remains operational if one server fails. Choosing the correct mode depends on whether the administrator wants both servers to actively lease addresses simultaneously or have one server remain idle until a failure event occurs within the network environment.

Answer

Active-Passive Cluster

Answer

Split-Scope

Answer

Distributed Relay

Question 10

You are configuring an iSCSI Target Server on Windows Server 2022 to provide block storage to a Linux-based application server. Which TWO components must be configured on the Windows Server to allow the Linux host to connect and mount a volume? (Select TWO)

Accepted Answer

iSCSI Virtual Disk. Setting up an iSCSI environment requires configuring both the storage provider (Target) and the client (Initiator). On the Windows Server side, you must define which disks are available and which hosts are permitted to connect. This involves creating virtual disks and mapping them to specific target objects that define the security boundaries and access protocols for the initiators.

Answer

iSCSI Initiator Name Service (iSNS)

Answer

Multipath I/O (MPIO)

Answer

Fibre Channel Zoning

Question 11

You are troubleshooting a Windows Server DNS environment where stale resource records are not being removed, leading to name resolution errors. Which THREE conditions must be met for DNS scavenging to successfully delete a stale record?

Accepted Answer

Scavenging must be enabled at the DNS server level.. DNS scavenging is a multi-step process that requires specific configurations at both the server and zone levels. If any of these components are misconfigured, the scavenging engine will not process the records, leading to an accumulation of outdated data that can interfere with network operations and IP management.

Answer

The record must be a static record with a zero timestamp.

Answer

The DNS server must be a member of the Schema Admins group.

Question 12

An administrator is planning to enable Data Deduplication on a Windows Server 2022 file server. Which TWO of the following workloads are officially supported and typically see high savings from Data Deduplication? (Select TWO)

Accepted Answer

VDI deployment share (VHDs). Data Deduplication in Windows Server is designed for specific workloads where data redundancy is common. General-purpose file shares and Virtual Desktop Infrastructure (VDI) libraries are the primary targets for this technology. Understanding supported workloads prevents performance issues and ensures that the deduplication engine can effectively reduce storage footprints without impacting application stability or data integrity.

Answer

Live Microsoft SQL Server databases

Answer

Active Exchange Server databases

Answer

Encrypted volumes using BitLocker

Question 13

You are preparing to use the Storage Migration Service to migrate data from several Windows Server 2012 R2 servers. Which THREE components are essential parts of the Storage Migration Service architecture?

Accepted Answer

Orchestrator server. The Storage Migration Service consists of three main roles: the orchestrator that manages the process, the source servers where the data currently resides, and the destination servers that receive the data. Understanding these roles is critical for troubleshooting connectivity and permission issues during a large-scale migration project.

Answer

Azure Relay

Answer

iSCSI Target Server

Question 14

You are deploying a 4-node Azure Stack HCI cluster. You need to configure the networking to support Storage Spaces Direct (S2D) east-west traffic. Which TWO networking features are highly recommended by Microsoft to ensure low-latency and high-throughput storage communication? (Select TWO)

Accepted Answer

Remote Direct Memory Access (RDMA). Azure Stack HCI relies heavily on the network for storage traffic between nodes. To achieve the performance required for hyperconverged workloads, the network must support advanced features that offload processing and prevent congestion. RDMA and SET are the cornerstones of a modern, high-performance software-defined data center network on the Microsoft platform.

Answer

Network Address Translation (NAT)

Answer

Border Gateway Protocol (BGP)

Answer

802.11ax (Wi-Fi 6)

Question 15

You are configuring Azure File Sync to synchronize a local folder on FileServer1 with an Azure file share. Which TWO endpoint types must be added to a Sync Group to enable this functionality?

Accepted Answer

Cloud endpoint. A Sync Group defines the topology for Azure File Sync. It must contain exactly one cloud endpoint, which represents the Azure file share, and one or more server endpoints, which represent paths on registered Windows Servers. This structure allows data to flow between the cloud and on-premises locations.

Answer

Storage endpoint

Answer

Network endpoint

Answer

Management endpoint

Question 16

You are configuring Azure Bastion to provide secure RDP access to your Windows Server VMs in an Azure Virtual Network. Which THREE requirements must be met for a successful deployment? (Select THREE)

Accepted Answer

A subnet named 'AzureBastionSubnet' must exist in the Virtual Network.. Azure Bastion is a managed PaaS service that provides secure RDP and SSH access. It requires a dedicated subnet named 'AzureBastionSubnet' with a minimum mask of /26. Additionally, it requires a Public IP address for the Bastion resource itself. This setup ensures that your VMs do not need public IP addresses for administrative access.

Answer

All target Windows Servers must have the Remote Desktop Gateway role installed.

Answer

A Site-to-Site VPN must be established between Azure and on-premises.

Question 17

You are securing Windows Admin Center (WAC) to manage your Windows Server 2022 environment. You want to implement granular access control for different IT teams. Which TWO methods can be used to control who has access to Windows Admin Center and what they can do? (Select TWO)

Accepted Answer

Active Directory groups for gateway access control.. Windows Admin Center security is managed through two main layers: gateway access and tool access. Gateway access is controlled via local groups or Active Directory groups on the WAC server. For more granular control over specific server tasks, WAC integrates with Just Enough Administration (JEA) to limit the cmdlets and actions available to the user.

Answer

Azure Key Vault for storing the WAC login credentials.

Answer

NTFS permissions on the Windows Admin Center installation folder.

Answer

DHCP Reservations for the WAC gateway IP address.

Question 18

You are tasked with securing your Windows Server 2022 environment. Which TWO actions should you perform to implement Just Enough Administration (JEA)?

Accepted Answer

Define a Role Capability (.psrc) file.. JEA allows you to restrict administrator access to only the commands necessary for specific tasks, reducing the risk of privilege escalation. By creating a Role Capability file and a Session Configuration file, you define exactly which cmdlets and functions a user can execute. This minimizes the attack surface by ensuring that users do not have broad, unrestricted access to the entire PowerShell environment or the underlying server operating system.

Answer

Configure a Group Policy Object to enable NTLMv2 only.

Answer

Modify the local SAM database to include JEA roles.

Answer

Enable the Credential Guard feature.

Question 19

An administrator needs to capture and analyze network traffic on a Windows Server 2022 Core installation without installing third-party tools. Which TWO steps are necessary to capture traffic using the built-in 'pktmon' tool and prepare it for analysis in Wireshark on another machine?

Accepted Answer

Run 'pktmon start --etw' to begin.. Packet Monitor (Pktmon) is a powerful, built-in network diagnostic tool for Windows. It is particularly useful on Server Core where a GUI is unavailable. Understanding how to start a capture and then convert the proprietary ETL format into a cross-compatible format like PCAPNG is essential for advanced network troubleshooting and analysis.

Answer

Use 'netsh trace start' to capture data.

Answer

Enable 'Promiscuous Mode' in the NIC settings.

Answer

Run 'pktmon filter add -p 80' to start.

Question 20

You are troubleshooting a Windows Server application that occasionally hangs. You want to capture a dump file of the process when it stops responding. Which THREE tools or methods should you consider using? (Choose three.)

Accepted Answer

Task Manager. Capturing process dumps is essential for diagnosing application hangs. Task Manager is the quickest manual method, while ProcDump provides automation and trigger-based capturing. Debugging tools, specifically ADPlus or the Windows Error Reporting (WER) service, provide advanced mechanisms to monitor and capture state information. Using these tools allows administrators to analyze the thread state at the exact moment of failure, leading to a root cause analysis of the hang.

Answer

Performance Monitor

Answer

Resource Monitor