AZ-802 Secure Windows Server Infrastructure — All Questions With Answers

Question 1

You are configuring BitLocker Network Unlock for a cluster of Windows Server 2022 nodes. The servers are equipped with TPM 2.0 and are connected to a wired network. You have already installed the BitLocker Network Unlock feature on a Windows Deployment Services (WDS) server. What is the next requirement to ensure that the servers automatically unlock their OS drives upon rebooting while connected to the internal network?

Accepted Answer

The client servers must be configured to use DHCP and have a UEFI firmware.. While UEFI and TPM are required, the critical missing piece for Network Unlock to function is that the client must be configured to use DHCP. The WDS server provides the unlock key via a DHCP-based protocol. Additionally, the explanation should clarify that the client must be connected to the same subnet as the WDS server or have a DHCP helper configured to forward the requests.

Answer

The client servers must have the BitLocker Drive Encryption feature disabled during the initial sync.

Answer

The WDS server must be running in 'Transport Server' mode only with no images.

Answer

The client servers must be joined to an Azure Active Directory domain specifically.

Question 2

To monitor for unauthorized access to sensitive files on a Windows Server 2022 file server, you decide to enable auditing. Which category of the Advanced Audit Policy must be configured to track when a user successfully opens a file on a monitored share?

Accepted Answer

Object Access. Object Access auditing is used to track access to specific objects on a Windows system, such as files, folders, and registry keys. To track file access, you must enable the 'Audit File System' subcategory under 'Object Access' and then configure the System Access Control List (SACL) on the specific files or folders.

Answer

Account Logon

Answer

Privilege Use

Answer

Policy Change

Question 3

You are hardening a Windows Server 2022 instance. You need to implement Credential Guard to protect NTLM and Kerberos credentials from memory-based attacks. Which prerequisite must be met on the server?

Accepted Answer

Ensure the hardware supports Second Level Address Translation (SLAT).. Credential Guard requires Virtualization-Based Security (VBS). The core hardware prerequisites are UEFI with Secure Boot, and CPU support for virtualization extensions (Intel VT-x or AMD-V) and Second Level Address Translation (SLAT). While SLAT is a correct prerequisite, the explanation should explicitly mention that VBS/Hyper-V hypervisor support is the underlying requirement.

Answer

Enable the Remote Desktop Protocol (RDP) Restricted Admin mode.

Answer

Install the Windows Defender Application Guard feature.

Answer

Disable the Windows Update service.

Question 4

You want to prevent the usage of weak encryption protocols, specifically SSL 3.0 and TLS 1.0, on your Windows Server. How should you proceed?

Accepted Answer

Modify the registry keys under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.. Modifying the registry under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols is the standard method for disabling legacy SSL/TLS versions in Windows Server. The explanation correctly identifies this but should explicitly mention that creating 'Enabled' and 'DisabledByDefault' DWORD values under the specific protocol subkeys is the required action.

Answer

Run the 'Set-SmbServerConfiguration' cmdlet with the -DisableOldProtocols switch.

Answer

Update the Windows Firewall rules to block port 443.

Answer

Use the Local Security Policy snap-in to change the 'Minimum Password Length' setting.

Question 5

You are hardening your server's disk security. You need to ensure that data at rest is encrypted. Which feature should you enable?

Accepted Answer

BitLocker Drive Encryption.. BitLocker Drive Encryption provides full-volume encryption, protecting data from unauthorized access if physical drives are stolen or if an attacker gains unauthorized access to the underlying storage. This is a foundational security control for protecting data at rest in Windows environments. By using a Trusted Platform Module (TPM) to manage keys, you ensure that the drive can only be decrypted when the server is in a known, trusted boot state.

Answer

Encrypted File System (EFS).

Answer

NTFS Permissions.

Answer

Windows Defender Antivirus.

Question 6

Your organization implements Just Enough Administration (JEA) to manage Windows Servers. A junior administrator needs to restart the Print Spooler service on several print servers but should not have full administrative rights. You need to identify the specific file that defines which cmdlets and external commands the junior administrator can execute. Which file should you configure?

Accepted Answer

The Role Capability file (.psrc). The Role Capability file defines exactly which cmdlets, functions, and external commands a user is allowed to run when connecting to a JEA endpoint. By restricting access to only the necessary tools for a specific task, you minimize the potential for lateral movement or accidental misconfiguration. This principle of least privilege is a cornerstone of securing administrative access in modern Windows Server environments.

Answer

The Session Configuration file (.pssc)

Answer

The PowerShell Profile file (.ps1)

Answer

The Module Manifest file (.psd1)

Question 7

An administrator is concerned about man-in-the-middle attacks where an attacker intercepts and modifies SMB traffic between a Windows Server 2022 file server and its clients. Which security feature should be enforced to ensure the integrity and authenticity of the SMB traffic?

Accepted Answer

SMB Signing. SMB Signing is a security mechanism in the SMB protocol that allows for the digital signing of SMB packets. This prevents the modification of data in transit and protects against man-in-the-middle attacks. Enforcing this feature ensures that both the client and the server can verify the origin and integrity of every packet exchanged during a session.

Answer

NTFS Permissions

Answer

Access-Based Enumeration

Answer

Disk Quotas

Question 8

Your company is implementing a Tiered Administration Model to secure its Windows Server infrastructure. You need to deploy Privileged Access Workstations (PAWs) for all Domain Admins. What is the primary purpose of using a PAW in this environment?

Accepted Answer

To provide a dedicated environment that is isolated from the risks of email and web browsing.. A Privileged Access Workstation (PAW) provides a dedicated, hardened environment for sensitive administrative tasks. By isolating high-privilege credentials from common threats like email, web browsing, and general-purpose applications, PAWs significantly reduce the risk of credential theft. This isolation is a critical defense-in-depth strategy for protecting high-value accounts in an Active Directory forest.

Answer

To allow administrators to browse the internet safely while performing server updates.

Answer

To enable multiple users to share a single high-privilege account across the organization.

Answer

To automatically synchronize local administrator passwords across all domain controllers.

Question 9

You are configuring Windows Defender Credential Guard on a fleet of Windows Server 2022 Hyper-V hosts. You want to protect the LSA process from being accessed by unauthorized users or malware. Which hardware-based security feature must be enabled in the BIOS/UEFI and supported by the CPU for Credential Guard to operate?

Accepted Answer

Virtualization Extensions (Intel VT-x or AMD-V) and SLAT. Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate secrets, such as NTLM password hashes and Kerberos Ticket Granting Tickets, in a protected environment. This requires hardware support for virtualization and Second Level Address Translation (SLAT) to create the secure memory enclave that the Local Security Authority (LSA) uses to shield credentials.

Answer

Direct Memory Access (DMA) Protection

Answer

Hyper-Threading Technology

Answer

Hardware-enforced Stack Protection

Question 10

You are planning the deployment of Shielded Virtual Machines in a Windows Server 2022 environment. You need to ensure that the Fabric Administrators cannot access the data within the VMs. Which component of the Host Guardian Service (HGS) is responsible for verifying that a Hyper-V host is authorized to run a Shielded VM?

Accepted Answer

The Attestation Service. The Host Guardian Service (HGS) is the central authority for Shielded VMs. The Attestation Service within HGS evaluates the health and identity of the Hyper-V host. If the host passes attestation, the HGS Key Protection Service then provides the keys necessary to start or migrate the Shielded VM, ensuring it only runs on trusted hardware.

Answer

The Key Protection Service

Answer

The Virtualization-based Security (VBS) engine

Answer

The TPM 2.0 Emulator

Question 11

You manage a Windows Server Update Services (WSUS) infrastructure with one upstream server and three downstream servers. You want the downstream servers to only download updates that have been approved on the upstream server. Which WSUS configuration mode should you use for the downstream servers?

Accepted Answer

Replica mode. WSUS supports two modes for downstream servers: Replica and Autonomous. In Replica mode, the downstream server mirrors the update approvals, settings, and classes of the upstream server. This centralizes management and ensures that only updates vetted and approved by the central administrator are distributed across the entire organization's branch offices or departments.

Answer

Autonomous mode

Answer

Distributed mode

Answer

Disconnected mode

Question 12

You are using Azure Update Management to manage updates for both on-premises Windows Servers and Azure VMs. You need to ensure that a specific group of on-premises servers never receives a particular update that is known to cause application compatibility issues. How should you configure this in Azure Update Management?

Accepted Answer

Create an 'Excluded updates' list in the Update Deployment configuration.. Azure Update Management allows for granular control over update deployments through deployment schedules. When creating a deployment, you can specify excluded updates by their Knowledge Base (KB) ID. This ensures that even if an update is critical or security-related, it will not be installed on the targeted machines, preventing known compatibility problems.

Answer

Modify the local Registry on each server to block the KB ID.

Answer

Use a Group Policy Object (GPO) to disable the Windows Update service.

Answer

Uninstall the Log Analytics agent from the affected servers.

Question 13

You need to create a Group Managed Service Account (gMSA) for a new web application cluster running on Windows Server 2022. Which TWO prerequisites must be met before you can successfully create and use the gMSA in your Active Directory domain? (Select TWO)

Accepted Answer

The Active Directory schema must be updated to at least Windows Server 2012.. Creating a gMSA requires a specific environment setup. First, the Active Directory schema must be at least Windows Server 2012. Second, the Key Distribution Service (KDS) Root Key must be created to allow domain controllers to generate the passwords. These steps ensure that the automated password management system has the necessary foundation to operate.

Answer

Every server in the cluster must be running the Windows Insider preview build.

Answer

The Domain Functional Level must be set to Windows Server 2022.

Answer

An Azure AD Connect instance must be active and syncing to the cloud.

Question 14

You are configuring Azure Bastion to provide secure RDP access to your Windows Server VMs in an Azure Virtual Network. Which THREE requirements must be met for a successful deployment? (Select THREE)

Accepted Answer

A subnet named 'AzureBastionSubnet' must exist in the Virtual Network.. Azure Bastion is a managed PaaS service that provides secure RDP and SSH access. It requires a dedicated subnet named 'AzureBastionSubnet' with a minimum mask of /26. Additionally, it requires a Public IP address for the Bastion resource itself. This setup ensures that your VMs do not need public IP addresses for administrative access.

Answer

All target Windows Servers must have the Remote Desktop Gateway role installed.

Answer

A Site-to-Site VPN must be established between Azure and on-premises.

Question 15

You are securing Windows Admin Center (WAC) to manage your Windows Server 2022 environment. You want to implement granular access control for different IT teams. Which TWO methods can be used to control who has access to Windows Admin Center and what they can do? (Select TWO)

Accepted Answer

Active Directory groups for gateway access control.. Windows Admin Center security is managed through two main layers: gateway access and tool access. Gateway access is controlled via local groups or Active Directory groups on the WAC server. For more granular control over specific server tasks, WAC integrates with Just Enough Administration (JEA) to limit the cmdlets and actions available to the user.

Answer

Azure Key Vault for storing the WAC login credentials.

Answer

NTFS permissions on the Windows Admin Center installation folder.

Answer

DHCP Reservations for the WAC gateway IP address.

Question 16

Refer to the exhibit. An administrator is attempting to run a locally created, unsigned PowerShell script named 'Update-Config.ps1' on a Windows Server 2022. Based on the output of 'Get-ExecutionPolicy -List', what will happen when the administrator attempts to run the script in the current session?

Accepted Answer

The script will run successfully without any prompts.. PowerShell execution policies follow a specific order of precedence. In this exhibit, the 'Process' scope is set to 'Bypass', which takes precedence over the 'LocalMachine' scope's 'AllSigned' setting. When an execution policy is set to 'Bypass', nothing is blocked and there are no warnings or prompts, allowing unsigned scripts to execute freely.

Answer

The script will fail to run because the LocalMachine policy is set to AllSigned.

Answer

The script will prompt the user for confirmation before executing.

Answer

The script will only run if the administrator executes it from an elevated prompt.

Question 17

Refer to the exhibit. You are reviewing a partial Windows Defender Application Control (WDAC) policy XML file. You need to identify the behavior of this policy regarding the file 'untrusted.exe'. What will occur if a user attempts to run 'untrusted.exe'?

Accepted Answer

The file will be blocked regardless of its signature or version.. In WDAC policies, 'Deny' rules take absolute precedence over 'Allow' rules. Even if a file might otherwise be permitted by a broad allow rule or a signer rule, an explicit deny rule targeting the filename or hash will prevent the application from executing. This ensures that known malicious or unauthorized files can be strictly blocked regardless of other policy settings.

Answer

The file will be allowed because the 'Allow Signed' rule uses a wildcard for the FileName.

Answer

The file will be allowed if it is digitally signed by a trusted Windows publisher.

Answer

The file will be allowed but an audit event will be generated in the event log.

Question 18

Refer to the exhibit. You need to ensure that all data transmitted over SMB between your file server and domain-joined clients is encrypted. You set the configuration to True, but users report connectivity issues. What is the most likely cause?

Accepted Answer

Clients are using an SMB version lower than 3.0.. Enabling SMB encryption globally forces all connections to use encryption. Older clients or non-Windows systems that do not support SMB 3.0 or higher will fail to negotiate a connection, resulting in access errors. This transition requires careful planning, often involving auditing first or using per-share encryption instead of global settings to maintain backward compatibility while securing sensitive data transfers across the network infrastructure.

Answer

The SMB server service must be restarted for the change to take effect.

Answer

The server's certificate for SMB encryption has expired.

Answer

The firewall is blocking TCP port 445.

Question 19

You are tasked with securing your Windows Server 2022 environment. Which TWO actions should you perform to implement Just Enough Administration (JEA)?

Accepted Answer

Define a Role Capability (.psrc) file.. JEA allows you to restrict administrator access to only the commands necessary for specific tasks, reducing the risk of privilege escalation. By creating a Role Capability file and a Session Configuration file, you define exactly which cmdlets and functions a user can execute. This minimizes the attack surface by ensuring that users do not have broad, unrestricted access to the entire PowerShell environment or the underlying server operating system.

Answer

Configure a Group Policy Object to enable NTLMv2 only.

Answer

Modify the local SAM database to include JEA roles.

Answer

Enable the Credential Guard feature.

Question 20

You need to audit successful and failed attempts to modify user accounts in Active Directory. Which policy should you configure?

Accepted Answer

Audit Directory Service Changes.. To audit specific changes to Active Directory objects, you must enable Audit Directory Service Changes in the Advanced Audit Policy Configuration. This is part of a comprehensive auditing strategy to detect unauthorized modifications or administrative errors. By targeting the Directory Service category, you ensure that relevant events are logged to the Security log, which can then be forwarded to a SIEM for centralized monitoring and alerting on sensitive identity changes.

Answer

Audit Account Management.

Answer

Audit Object Access.

Answer

Audit Logon/Logoff.

AZ-802 Secure Windows Server Infrastructure — All Questions With Answers

To monitor for unauthorized access to sensitive files on a Windows Server 2022 file server, you decide to enable auditing. Which category of the Advanced Audit Policy must be configured to track when a user successfully opens a file on a monitored share?

You are hardening a Windows Server 2022 instance. You need to implement Credential Guard to protect NTLM and Kerberos credentials from memory-based attacks. Which prerequisite must be met on the server?

You want to prevent the usage of weak encryption protocols, specifically SSL 3.0 and TLS 1.0, on your Windows Server. How should you proceed?

You are hardening your server's disk security. You need to ensure that data at rest is encrypted. Which feature should you enable?

An administrator is concerned about man-in-the-middle attacks where an attacker intercepts and modifies SMB traffic between a Windows Server 2022 file server and its clients. Which security feature should be enforced to ensure the integrity and authenticity of the SMB traffic?

Your company is implementing a Tiered Administration Model to secure its Windows Server infrastructure. You need to deploy Privileged Access Workstations (PAWs) for all Domain Admins. What is the primary purpose of using a PAW in this environment?

You manage a Windows Server Update Services (WSUS) infrastructure with one upstream server and three downstream servers. You want the downstream servers to only download updates that have been approved on the upstream server. Which WSUS configuration mode should you use for the downstream servers?

You need to create a Group Managed Service Account (gMSA) for a new web application cluster running on Windows Server 2022. Which TWO prerequisites must be met before you can successfully create and use the gMSA in your Active Directory domain? (Select TWO)

You are configuring Azure Bastion to provide secure RDP access to your Windows Server VMs in an Azure Virtual Network. Which THREE requirements must be met for a successful deployment? (Select THREE)

You are securing Windows Admin Center (WAC) to manage your Windows Server 2022 environment. You want to implement granular access control for different IT teams. Which TWO methods can be used to control who has access to Windows Admin Center and what they can do? (Select TWO)

Exhibit

Refer to the exhibit. You are reviewing a partial Windows Defender Application Control (WDAC) policy XML file. You need to identify the behavior of this policy regarding the file 'untrusted.exe'. What will occur if a user attempts to run 'untrusted.exe'?

Exhibit

Refer to the exhibit. You need to ensure that all data transmitted over SMB between your file server and domain-joined clients is encrypted. You set the configuration to True, but users report connectivity issues. What is the most likely cause?

Exhibit

You are tasked with securing your Windows Server 2022 environment. Which TWO actions should you perform to implement Just Enough Administration (JEA)?

You need to audit successful and failed attempts to modify user accounts in Active Directory. Which policy should you configure?

You are securing a Windows Server 2022 instance against potential malware. Which THREE actions are recommended to minimize the attack surface?

Refer to the exhibit. You are investigating why a secure connection is failing on your web server. Based on the output, what is the most likely reason?

Exhibit

You need to ensure that only authorized administrative users can access the server via PowerShell Remoting. Which security control should you implement?

AZ-802 Secure Windows Server Infrastructure — All Questions With Answers

To monitor for unauthorized access to sensitive files on a Windows Server 2022 file server, you decide to enable auditing. Which category of the Advanced Audit Policy must be configured to track when a user successfully opens a file on a monitored share?

You are hardening a Windows Server 2022 instance. You need to implement Credential Guard to protect NTLM and Kerberos credentials from memory-based attacks. Which prerequisite must be met on the server?

You want to prevent the usage of weak encryption protocols, specifically SSL 3.0 and TLS 1.0, on your Windows Server. How should you proceed?

You are hardening your server's disk security. You need to ensure that data at rest is encrypted. Which feature should you enable?

An administrator is concerned about man-in-the-middle attacks where an attacker intercepts and modifies SMB traffic between a Windows Server 2022 file server and its clients. Which security feature should be enforced to ensure the integrity and authenticity of the SMB traffic?

Your company is implementing a Tiered Administration Model to secure its Windows Server infrastructure. You need to deploy Privileged Access Workstations (PAWs) for all Domain Admins. What is the primary purpose of using a PAW in this environment?

You manage a Windows Server Update Services (WSUS) infrastructure with one upstream server and three downstream servers. You want the downstream servers to only download updates that have been approved on the upstream server. Which WSUS configuration mode should you use for the downstream servers?

You need to create a Group Managed Service Account (gMSA) for a new web application cluster running on Windows Server 2022. Which TWO prerequisites must be met before you can successfully create and use the gMSA in your Active Directory domain? (Select TWO)

You are configuring Azure Bastion to provide secure RDP access to your Windows Server VMs in an Azure Virtual Network. Which THREE requirements must be met for a successful deployment? (Select THREE)

You are securing Windows Admin Center (WAC) to manage your Windows Server 2022 environment. You want to implement granular access control for different IT teams. Which TWO methods can be used to control who has access to Windows Admin Center and what they can do? (Select TWO)

Exhibit

Refer to the exhibit. You are reviewing a partial Windows Defender Application Control (WDAC) policy XML file. You need to identify the behavior of this policy regarding the file 'untrusted.exe'. What will occur if a user attempts to run 'untrusted.exe'?

Exhibit

Refer to the exhibit. You need to ensure that all data transmitted over SMB between your file server and domain-joined clients is encrypted. You set the configuration to True, but users report connectivity issues. What is the most likely cause?

Exhibit

You are tasked with securing your Windows Server 2022 environment. Which TWO actions should you perform to implement Just Enough Administration (JEA)?

You need to audit successful and failed attempts to modify user accounts in Active Directory. Which policy should you configure?

You are securing a Windows Server 2022 instance against potential malware. Which THREE actions are recommended to minimize the attack surface?

Refer to the exhibit. You are investigating why a secure connection is failing on your web server. Based on the output, what is the most likely reason?

Exhibit

You need to ensure that only authorized administrative users can access the server via PowerShell Remoting. Which security control should you implement?