AZ-802 Quick Quiz — 10 Questions

Question 1

You are preparing to raise the forest functional level of an existing Active Directory environment to Windows Server 2016. Which TWO requirements must be met before you can successfully perform this action? (Each correct answer presents part of the solution.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

All domain controllers in the forest must run Windows Server 2016 or later.. Raising the forest functional level is a significant administrative task that enables advanced features but requires strict adherence to versioning rules. All domain controllers in every domain within the forest must be running a version of Windows Server that is equal to or higher than the target functional level, and all individual domains must already be at that target level.

Answer

The Schema Master role must be held by a domain controller running Windows Server 2022.

Answer

You must disable the Active Directory Recycle Bin before raising the level.

Answer

The forest must be configured for DFSR replication for the SYSVOL share.

Question 2

The domain controller holding the RID Master FSMO role in your domain has suffered a catastrophic hardware failure and will be offline for several weeks. You notice that administrators can no longer create new user objects. What should you do to resolve this issue immediately?

Accepted Answer

Seize the RID Master role using the 'Move-ADDirectoryServerOperationMasterRole' cmdlet.. The Relative Identifier (RID) Master is responsible for allocating pools of RIDs to all domain controllers in a domain. When a DC exhausts its local pool and the RID Master is unavailable, it cannot create new security principals. In cases of permanent or long-term failure, the role must be seized to a healthy DC to restore functionality.

Answer

Wait for the Knowledge Consistency Checker (KCC) to automatically move the role.

Answer

Perform a graceful transfer of the RID Master role using ADUC.

Answer

Reinstall Active Directory on the failed server using the same name.

Question 3

You need to create a service account for a custom application that runs on a single Windows server. The account must support automatic password management and must not require manual SPN registration. Which type of account should you use?

Accepted Answer

Standalone Managed Service Account (sMSA). Standalone Managed Service Accounts (sMSAs) were introduced to simplify service account management by automating password rotations and SPN handling. Unlike traditional service accounts, sMSAs are tied to a single computer and do not require administrative intervention for password updates, significantly reducing the risk of service outages due to expired credentials or human error.

Answer

Group Managed Service Account (gMSA)

Answer

A standard Domain User account

Answer

A Local System account

Question 4

You need to automate the deployment of a new domain controller in an existing domain using PowerShell. Which cmdlet should you use to install the Active Directory Domain Services role and promote the server after the binaries are present?

Accepted Answer

Install-ADDSDomainController. Modern Windows Server administration emphasizes automation through PowerShell. To promote a server to a domain controller, the ADDSDeployment module provides specific cmdlets that replace the legacy dcpromo utility. These cmdlets handle the configuration of the database, logs, SYSVOL paths, and the necessary directory partition replicates from existing domain controllers in the environment.

Answer

Install-WindowsFeature AD-Domain-Services

Answer

Add-Computer -DomainName 'contoso.com'

Answer

Set-ADDomain -Identity 'contoso.com' -InfrastructureMaster

Question 5

You want to allow a specific help desk user to reset passwords for all users in a specific Organizational Unit (OU), but you do not want to grant them any other administrative rights. What is the most appropriate tool to use?

Accepted Answer

The Delegation of Control Wizard. The Delegation of Control Wizard in Active Directory Users and Computers (ADUC) is designed for granting specific, limited permissions to users or groups over specific portions of the directory. This follows the principle of least privilege by allowing tasks to be offloaded to non-administrators without granting full Domain Admin rights.

Answer

Active Directory Sites and Services

Answer

Group Policy Management Console (GPMC)

Answer

The 'Managed By' tab on the OU properties

Question 6

You are managing an Active Directory domain that includes several Fine-Grained Password Policies (FGPP). A user is a member of two global groups: 'Sales-Group' and 'Marketing-Group'. 'Sales-Group' is assigned a Password Settings Object (PSO) with a precedence of 50. 'Marketing-Group' is assigned a PSO with a precedence of 20. Which policy will be applied to the user?

Accepted Answer

The PSO assigned to the Marketing-Group.. Active Directory determines which Fine-Grained Password Policy to apply based on the precedence value of the Password Settings Objects. In this hierarchy, the PSO with the lower numeric value takes precedence. Therefore, a PSO with a precedence of 20 will override a PSO with a precedence of 50 when a user is a member of multiple groups.

Answer

The Default Domain Policy.

Answer

The PSO assigned to the Sales-Group.

Answer

Both policies will be merged, and the most restrictive settings will apply.

Question 7

You are implementing Azure Monitor for your hybrid servers. Which THREE steps are required to collect guest-level metrics and logs from an Arc-enabled Windows Server? (Choose three.)

Accepted Answer

Install the Azure Monitor Agent (AMA) extension. To enable comprehensive monitoring, you must install the Azure Monitor Agent, create a Data Collection Rule (DCR), and associate that rule with the specific Arc-enabled machines. This workflow ensures that the agent is present, configured with the correct scope, and targeted to collect the specific metrics and event logs required for operational visibility in the Azure Monitor workspace.

Answer

Enable the legacy Log Analytics agent

Answer

Assign the Log Analytics Contributor role to the machine

Question 8

You have three Active Directory sites: SiteA, SiteB, and SiteC. SiteA is connected to SiteB with a cost of 50. SiteB is connected to SiteC with a cost of 50. There is no direct link between SiteA and SiteC. If 'Bridge all site links' is enabled, what is the effective replication cost between SiteA and SiteC?

Accepted Answer

100. Active Directory uses site link costs to determine the most efficient path for replication. When 'Bridge all site links' is enabled (the default), Active Directory can calculate a transitive path between sites that are not directly connected. The total cost is the sum of the costs of the individual links that make up the path.

Answer

50

Answer

Replication is impossible without a direct link.

Answer

0

Question 9

An administrator accidentally deleted an Organizational Unit (OU) containing several hundred user accounts. You need to recover the OU and its contents with the least amount of administrative effort and without taking any domain controllers offline. What should you use?

Accepted Answer

The Active Directory Recycle Bin.. The Active Directory Recycle Bin is the most efficient way to recover deleted objects because it preserves all attributes and the original Distinguished Name. Unlike traditional backups, it does not require a reboot into Directory Services Restore Mode (DSRM), making it the ideal choice for rapid recovery in modern environments.

Answer

An authoritative restore using an existing System State backup.

Answer

A non-authoritative restore of the entire domain database.

Answer

The LDP.exe utility to manually reanimate the tombstone.

Question 10

Refer to the exhibit. You are troubleshooting an issue where several users are unable to change their passwords, and the help desk is seeing inconsistent results when resetting them. Based on the output provided, which domain controller should you investigate first for potential failures or connectivity issues?

Accepted Answer

DC1. The PDC Emulator is the authoritative server for password changes and the primary target for password resets within a domain. In the provided exhibit, DC1 holds the PDC Emulator role. If DC1 is offline or experiencing issues, password-related tasks will fail or show inconsistencies, making it the primary suspect for troubleshooting.

Answer

DC2

Answer

The Schema Master

Answer

The Domain Naming Master