Microsoft Windows Server Administrator Associate (AZ-802) — Questions 1–75

Deploying domain controllers on Azure VMs requires specific configuration to prevent database corruption and ensure consistent identity services. This includes using a static private IP address to prevent DNS failures, placing the NTDS database on a non-caching data disk to ensure write integrity, and using a separate virtual disk rather than the OS drive.

Domain controllers run the operating system version installed on them, but the domain and forest functional levels determine which features are available across the entire environment. A new Windows Server 2022 DC can join a 2012 R2 forest, but it will operate within the constraints of that lower functional level.

Packet Monitor (Pktmon) is a powerful, built-in network diagnostic tool for Windows. It is particularly useful on Server Core where a GUI is unavailable. Understanding how to start a capture and then convert the proprietary ETL format into a cross-compatible format like PCAPNG is essential for advanced network troubleshooting and analysis.

Shielded VMs provide a high level of security by encrypting the VM's data and state, ensuring that only authorized hosts can run them. This requires a complex infrastructure including attestation and key management. Understanding these components is essential for administrators securing highly sensitive data against unauthorized access by high-privileged users.

To enable Azure Arc management, the server must reach the internet to communicate with the Azure Resource Manager (ARM) endpoints. Registering the Microsoft.HybridCompute, Microsoft.GuestConfiguration, and Microsoft.HybridConnectivity resource providers in your subscription is required for the backend services to recognize and process the agent's heartbeat and policy compliance data, ensuring full integration with hybrid governance features.

Deploying at scale requires using a centralized mechanism like GPO to execute the installation script. To avoid storing credentials in plain text, you should use an Azure Key Vault or a temporary SAS token-based approach. This ensures that the installation process is repeatable, auditable, and secure, preventing the exposure of sensitive service principal credentials during the automated deployment of the agent across the corporate environment.

The error code 1722 (The RPC server is unavailable) typically indicates a network connectivity issue or a service failure on the source domain controller. In the context of Active Directory replication, this often points to a firewall blocking RPC traffic, a failure of the DNS to resolve the source DC's name, or the RPC service being stopped.

The PDC Emulator is the authoritative server for password changes and the primary target for password resets within a domain. In the provided exhibit, DC1 holds the PDC Emulator role. If DC1 is offline or experiencing issues, password-related tasks will fail or show inconsistencies, making it the primary suspect for troubleshooting.

Active Directory replication is vital for maintaining a consistent directory database. The 'repadmin' command-line tool is the industry standard for diagnosing replication topology, monitoring status, and forcing replication between partners. It provides detailed error codes that help distinguish between DNS failures, authentication issues, and physical network blocks.

Azure Arc-enabled servers are assigned a system-assigned managed identity. This identity is managed by the Azure platform and is tied to the lifecycle of the Arc resource. It allows the server to authenticate securely to other Azure services (like Key Vault or Log Analytics) without requiring hardcoded credentials, significantly enhancing the security posture of the hybrid environment by removing the need for secret management.

The Storage Migration Service is designed to make migrations transparent to users and applications. The cutover phase is the most critical part of this process, as it handles the transition of the server's identity. Understanding how IP addresses and hostnames are transferred ensures that the administrator can plan for the brief downtime and successfully redirect all client traffic.

In a multi-domain forest, a domain controller needs to contact a Global Catalog to determine Universal Group membership during logon. If a GC is not available locally and the WAN link is down, logons fail. Enabling Universal Group Membership Caching allows a standard DC to cache these memberships, enabling successful logons during outages without the overhead of hosting a full GC.

Cloud Tiering is a feature of Azure File Sync that caches frequently accessed files locally while tiering infrequent files to the cloud. The Volume Free Space policy is the primary mechanism to control local disk consumption. Correctly configuring this value ensures that the local server remains responsive and has enough capacity for new files before the next tiering cycle occurs.

The agent's health is documented in the agent's log file ('himds.log') and the Windows Event Viewer. The 'himds.log' provides the most granular details regarding the agent's handshake, heartbeat, and API connectivity to the Azure endpoints. The Application and System event logs in Windows are essential for identifying underlying OS-level issues, such as certificate store errors or network interface failures that prevent the agent from reaching the required endpoints.

A Sync Group defines the topology for Azure File Sync. It must contain exactly one cloud endpoint, which represents the Azure file share, and one or more server endpoints, which represent paths on registered Windows Servers. This structure allows data to flow between the cloud and on-premises locations.

In WDAC policies, 'Deny' rules take absolute precedence over 'Allow' rules. Even if a file might otherwise be permitted by a broad allow rule or a signer rule, an explicit deny rule targeting the filename or hash will prevent the application from executing. This ensures that known malicious or unauthorized files can be strictly blocked regardless of other policy settings.

Azure Policy allows you to audit and enforce settings on hybrid servers as if they were native Azure VMs. This provides a consistent management plane where you can track compliance, such as ensuring specific updates are installed or security settings are applied. This uniformity is crucial for hybrid environments, as it eliminates the need for maintaining separate compliance tools for cloud and on-premises infrastructure.

PowerShell execution policies follow a specific order of precedence. In this exhibit, the 'Process' scope is set to 'Bypass', which takes precedence over the 'LocalMachine' scope's 'AllSigned' setting. When an execution policy is set to 'Bypass', nothing is blocked and there are no warnings or prompts, allowing unsigned scripts to execute freely.

The Active Directory Recycle Bin is the most efficient tool for recovering deleted objects because it preserves all physical and logical attributes of the object, including its distinguished name and group memberships. Once enabled, it eliminates the need for authoritative restores from backups, which require taking a domain controller offline into Directory Services Restore Mode.

Standalone Managed Service Accounts (sMSAs) were introduced to simplify service account management by automating password rotations and SPN handling. Unlike traditional service accounts, sMSAs are tied to a single computer and do not require administrative intervention for password updates, significantly reducing the risk of service outages due to expired credentials or human error.

SMB over QUIC is a revolutionary feature that allows access to file shares over the internet using the QUIC protocol, which is inherently encrypted with TLS 1.3. This eliminates the need for a VPN for remote users. However, it has specific client-side requirements to ensure the security and protocol compatibility needed for this high-performance, secure tunneling technology.

DNS scavenging is a multi-step process that requires specific configurations at both the server and zone levels. If any of these components are misconfigured, the scavenging engine will not process the records, leading to an accumulation of outdated data that can interfere with network operations and IP management.

A Privileged Access Workstation (PAW) provides a dedicated, hardened environment for sensitive administrative tasks. By isolating high-privilege credentials from common threats like email, web browsing, and general-purpose applications, PAWs significantly reduce the risk of credential theft. This isolation is a critical defense-in-depth strategy for protecting high-value accounts in an Active Directory forest.

The New-StoragePool cmdlet is the primary tool in PowerShell to combine physical disks into a manageable storage pool within Storage Spaces. Proper initialization is foundational for configuring resiliency tiers and virtual disks, ensuring high availability and fault tolerance across your clustered hyper-converged infrastructure deployments.

The Host Guardian Service (HGS) is the central authority for Shielded VMs. The Attestation Service within HGS evaluates the health and identity of the Hyper-V host. If the host passes attestation, the HGS Key Protection Service then provides the keys necessary to start or migrate the Shielded VM, ensuring it only runs on trusted hardware.

The Active Directory Recycle Bin is the most efficient way to recover deleted objects because it preserves all attributes and the original Distinguished Name. Unlike traditional backups, it does not require a reboot into Directory Services Restore Mode (DSRM), making it the ideal choice for rapid recovery in modern environments.

Azure Private Link allows you to access Azure PaaS services over a private endpoint in your virtual network. When combined with a VPN or ExpressRoute, this extends the private connectivity to your on-premises environment. This setup ensures that traffic never traverses the public internet, satisfying strict security and compliance requirements.

The Role Capability file defines exactly which cmdlets, functions, and external commands a user is allowed to run when connecting to a JEA endpoint. By restricting access to only the necessary tools for a specific task, you minimize the potential for lateral movement or accidental misconfiguration. This principle of least privilege is a cornerstone of securing administrative access in modern Windows Server environments.

The VHDX format was introduced to overcome the limitations of the original VHD format. It offers significant improvements in capacity, performance, and data integrity. Understanding these benefits is crucial for designing modern virtualization storage that can support large enterprise workloads and ensure resilience against unexpected power failures or system crashes.

In a DHCP failover configuration, the 'CommunicationInterrupted' state indicates that the two servers can no longer talk to each other. This state is designed to ensure continuity of service. Understanding how the Max Client Lead Time (MCLT) and server roles function during this interruption is critical for maintaining network availability.

Storage Replica offers two modes: synchronous and asynchronous. Synchronous replication requires low latency (typically <5ms) because the application must wait for an acknowledgment from the destination before the write is completed. For high-latency connections, asynchronous replication is necessary to prevent storage I/O from becoming a performance bottleneck.

BranchCache can operate in two modes: Distributed Cache mode and Hosted Cache mode. In Distributed Cache mode, the cached content is distributed among the client computers themselves, eliminating the need for a local server. This is the ideal solution for small offices without dedicated infrastructure.

Storage Quality of Service (QoS) provides a way to centrally monitor and manage storage performance for virtual machines. By creating and applying QoS policies, administrators can set minimum and maximum throughput and IOPS limits. This ensures that critical workloads receive the necessary resources while 'noisy neighbors' are restricted from impacting the overall health of the storage cluster.

Storage Spaces Direct requires specific resiliency configurations for small clusters to maintain availability. Nested resiliency is a feature introduced for two-node clusters that provides data redundancy both within a single node and across the two nodes. This ensures that even if one node is offline for maintenance and a drive fails in the remaining node, the data remains accessible.

Error 0x80072ee7 indicates a DNS resolution failure, meaning the client cannot resolve the Azure service FQDNs. In hybrid scenarios, on-premises servers often rely on internal DNS servers that may not have access to public records or lack proper forwarding rules. Verifying the DNS configuration ensures the server can locate the necessary Azure endpoints, which is a prerequisite for the registration process to establish a secure handshake.

File Server Resource Manager (FSRM) quotas allow administrators to limit the space consumed by a folder or volume. A 'Hard' quota is used when you want to strictly enforce the limit and prevent further writes, whereas a 'Soft' quota is used only for monitoring and notification purposes.

Group Managed Service Accounts (gMSAs) require a minimum domain functional level and a specific root key for the Key Distribution Service (KDS). The KDS root key is used by domain controllers to generate the passwords for gMSAs, and it must be created once per forest to enable the service.

The Remote Access role in Windows Server 2022 includes the NAT functionality required to route traffic from a private network to a public one. By enabling NAT within the Routing and Remote Access Service (RRAS), the server masks the private IP addresses of the internal clients, allowing them to access the internet through a single public IP address assigned to the gateway's external interface.

A 403 Forbidden error indicates that the identity being used by the Arc-enabled server is authenticated but lacks the necessary permissions to access the specific resource. In this case, the server's managed identity has not been granted the required access policy or RBAC role on the target Key Vault. This is a common permission configuration error in hybrid environments.

Event forwarding relies on WinRM for transport. If the services are running, the issue is often related to the WinRM listener configuration or the network path between the nodes. Verifying that the WinRM listener is active and listening on the correct port (default 5985/5986) is the logical next step to ensure the transport layer is capable of passing the subscription information between the source and the collector.

Azure Automation Update Management relies on the Log Analytics agent (or AMA) to report data back to the workspace. If a server is 'Not assessed,' it usually means the agent is unable to communicate, the workspace is missing data, or the required 'Update' solution has not been correctly deployed to the workspace.

Data Deduplication usage types apply specific settings tailored to the workload. The 'Virtualized Backup Server' type is optimized for backup applications and large files like VHDX. Using the correct type ensures the deduplication engine runs with the appropriate priority and uses the most effective chunking algorithms for the data.

To enable comprehensive monitoring, you must install the Azure Monitor Agent, create a Data Collection Rule (DCR), and associate that rule with the specific Arc-enabled machines. This workflow ensures that the agent is present, configured with the correct scope, and targeted to collect the specific metrics and event logs required for operational visibility in the Azure Monitor workspace.

Setting up an iSCSI environment requires configuring both the storage provider (Target) and the client (Initiator). On the Windows Server side, you must define which disks are available and which hosts are permitted to connect. This involves creating virtual disks and mapping them to specific target objects that define the security boundaries and access protocols for the initiators.

IPAM requires specific permissions and firewall rules to collect data from managed servers. When using GPO-based provisioning, the IPAM server uses the GPOs to automate the configuration of these settings across the domain. Without the correct GPO prefix and security filtering, the managed servers will not allow the IPAM server to access their data.

The 'IS_GC' flag in the DSA Options section of commands like 'repadmin /showrepl' indicates that the domain controller is functioning as a Global Catalog server. This is a critical piece of information for troubleshooting logon issues and ensuring that universal group memberships can be resolved locally.

To audit specific changes to Active Directory objects, you must enable Audit Directory Service Changes in the Advanced Audit Policy Configuration. This is part of a comprehensive auditing strategy to detect unauthorized modifications or administrative errors. By targeting the Directory Service category, you ensure that relevant events are logged to the Security log, which can then be forwarded to a SIEM for centralized monitoring and alerting on sensitive identity changes.

Access-based enumeration (ABE) is a feature that filters the list of files and folders displayed to users based on their individual permissions. When ABE is enabled, users only see the objects they have at least Read access to, which improves security and reduces confusion in large shared directories.

The Storage Migration Service consists of three main roles: the orchestrator that manages the process, the source servers where the data currently resides, and the destination servers that receive the data. Understanding these roles is critical for troubleshooting connectivity and permission issues during a large-scale migration project.

Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate secrets, such as NTLM password hashes and Kerberos Ticket Granting Tickets, in a protected environment. This requires hardware support for virtualization and Second Level Address Translation (SLAT) to create the secure memory enclave that the Local Security Authority (LSA) uses to shield credentials.

Event Viewer allows for the creation of Custom Views, which act as saved filters. This enables administrators to aggregate specific event types from multiple logs into one interface, significantly reducing the time spent jumping between different logs to find related error messages during routine server health checks.

In a Windows Server Failover Cluster utilizing Storage Spaces Direct, monitoring physical disk health is critical for maintaining data redundancy. The retired status often indicates a hardware failure or a disk that has exceeded error thresholds. Using the correct PowerShell cmdlet allows administrators to drill down into the health metadata and operational status codes for precise troubleshooting.

Reliability Monitor, accessed through the Performance Monitor interface or by searching for 'Reliability History', provides a graphical view of system stability. It aggregates error data, including application crashes and unresponsiveness, making it an ideal tool for observing trends over time. This helps administrators distinguish between one-off application issues and systemic problems requiring deeper investigation or patching.

Hybrid name resolution requires a bridge between on-premises DNS servers and Azure Private DNS zones. The Azure DNS Private Resolver provides a managed service that allows on-premises DNS queries to be forwarded to an inbound endpoint. This architecture eliminates the need for maintaining custom-built DNS forwarders on virtual machines, improving reliability and simplifying the administrative overhead for hybrid connectivity.

The Azure Monitor Agent relies on Data Collection Rules (DCR) to define which data should be collected and where it should be sent. Unlike the legacy agent which used workspace-wide settings, DCRs provide a more granular and flexible approach, allowing administrators to target specific servers with unique logging requirements while maintaining a centralized management structure in the Azure portal.

JEA allows you to restrict administrator access to only the commands necessary for specific tasks, reducing the risk of privilege escalation. By creating a Role Capability file and a Session Configuration file, you define exactly which cmdlets and functions a user can execute. This minimizes the attack surface by ensuring that users do not have broad, unrestricted access to the entire PowerShell environment or the underlying server operating system.

Azure Update Management allows for granular control over update deployments through deployment schedules. When creating a deployment, you can specify excluded updates by their Knowledge Base (KB) ID. This ensures that even if an update is critical or security-related, it will not be installed on the targeted machines, preventing known compatibility problems.

Active Directory determines which Fine-Grained Password Policy to apply based on the precedence value of the Password Settings Objects. In this hierarchy, the PSO with the lower numeric value takes precedence. Therefore, a PSO with a precedence of 20 will override a PSO with a precedence of 50 when a user is a member of multiple groups.

Raising the forest functional level is a significant administrative task that enables advanced features but requires strict adherence to versioning rules. All domain controllers in every domain within the forest must be running a version of Windows Server that is equal to or higher than the target functional level, and all individual domains must already be at that target level.

The Resilient File System (ReFS) includes a feature called block cloning, which allows the file system to copy ranges of file blocks on behalf of an application as a low-cost metadata operation. This significantly accelerates Hyper-V operations like merging checkpoints, as data blocks are remapped rather than physically copied.

Selective authentication is a security feature used in forest trusts to restrict the scope of authentication for users from a trusted forest. Unlike forest-wide authentication, which allows users to authenticate to any resource in the trusting forest, selective authentication requires administrators to manually grant the 'Allowed to Authenticate' permission on specific computer objects for the external users or groups.

Restricting access to PowerShell Remoting is vital to prevent unauthorized remote management. By modifying the Security Descriptor of the WinRM session configuration, you can explicitly define which users or groups have the 'Access' and 'Execute' permissions. This is a critical step in maintaining a secure administrative surface, ensuring that only those with the necessary authorization can establish remote sessions, thereby mitigating the risk of lateral movement by attackers using PowerShell.

A one-way forest trust with selective authentication is the most secure way to connect two forests. The 'one-way' aspect limits the direction of trust, while 'selective authentication' prevents trusted users from automatically being part of the 'Authenticated Users' group on resources in the trusting domain.

Active Directory site links are logical paths that represent the network connectivity between different sites. By configuring the schedule on a site link, administrators can precisely control when replication traffic is allowed to traverse the WAN. This is a fundamental skill for managing multi-site topologies where bandwidth is limited or expensive during specific times of day.

The agent acts as a bridge, projecting the local server into the Azure Resource Manager. This allows the server to be represented as an object in Azure, enabling the use of Azure services like Policy, Monitoring, and Update Management. It handles identity, heartbeats, and metadata synchronization, effectively making the on-premises hardware a first-class citizen in the cloud-based management ecosystem.

The Get-NetRoute cmdlet is essential for inspecting the IPv4 and IPv6 routing tables on Windows Server. It allows administrators to verify that the destination network is reachable via the correct interface and gateway. Misconfigured routes are a primary cause of packet loss in multi-homed server environments, and this tool provides the granular visibility needed to troubleshoot connectivity issues between internal subnets.

The exhibit shows a three-way mirror configuration, indicated by NumberOfDataCopies being set to three. In Storage Spaces Direct, a three-way mirror can tolerate the simultaneous failure of two disks or two entire nodes. This high level of redundancy is standard for mission-critical workloads requiring maximum uptime and data integrity.

DNS policies in Windows Server allow for intelligent traffic management by tailoring responses based on various criteria. To achieve location-based or subnet-based resolution, the server must first be able to identify which subnet a client belongs to. This is the foundational step before any resolution logic or policies can be applied.

To trigger alerts based on specific thresholds, you must create a Performance Counter Alert in the Data Collector Set. This allows you to select the specific counter, such as '% Free Space', and set a trigger condition. Once configured, you can define an action, such as executing a script or logging an event, when the threshold is breached, enabling proactive server maintenance before disk space issues cause system instability.

Understanding the difference between production and standard checkpoints is vital for Windows Server administrators. Production checkpoints use backup technology inside the guest to create a data-consistent state, whereas standard checkpoints capture the memory state. Choosing the right type prevents application errors and ensures data integrity during recovery operations.

Nested virtualization allows you to run Hyper-V inside a guest VM, which is invaluable for lab environments and training. This requires exposing the hardware virtualization extensions of the physical CPU to the guest OS. Administrators must know the specific PowerShell cmdlet and parameter required to enable this advanced virtualization feature.