AZ-802 Practice Question: Monitor and Troubleshoot Windows Server Environments
An administrator needs to capture and analyze network traffic on a Windows Server 2022 Core installation without installing third-party tools. Which TWO steps are necessary to capture traffic using the built-in 'pktmon' tool and prepare it for analysis in Wireshark on another machine?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run 'pktmon start --etw' to begin.
Packet Monitor (Pktmon) is a powerful, built-in network diagnostic tool for Windows. It is particularly useful on Server Core where a GUI is unavailable. Understanding how to start a capture and then convert the proprietary ETL format into a cross-compatible format like PCAPNG is essential for advanced network troubleshooting and analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run 'pktmon start --etw' to begin.
Why this is correct
This command initiates the packet capture process. The '--etw' flag ensures that the traffic is logged using Event Tracing for Windows, which is the underlying framework Pktmon uses to record network events. This is the standard first step for capturing live traffic data on the server.
- ✓
Run 'pktmon pcapng' to convert the log.
Why this is correct
By default, Pktmon saves captures in an .etl format, which is not natively readable by most network analysis tools. The 'pcapng' sub-command converts these logs into the PCAPNG format, allowing the administrator to export the data and analyze it using standard tools like Wireshark on a workstation.
- ✗
Use 'netsh trace start' to capture data.
Why it's wrong here
While 'netsh trace' is another built-in method for capturing network data, it is a separate utility from Pktmon. The question specifically asks for the steps related to the Pktmon tool. Mixing these utilities is incorrect as they use different command structures and produce different output formats that require different handling.
- ✗
Enable 'Promiscuous Mode' in the NIC settings.
Why it's wrong here
Pktmon does not require the physical or virtual network interface to be manually placed in promiscuous mode to capture traffic destined for or originating from the host. It operates at the driver level within the networking stack, capturing packets as they pass through various layers without needing NIC configuration changes.
- ✗
Run 'pktmon filter add -p 80' to start.
Why it's wrong here
This command adds a filter for port 80 traffic, which is useful for narrowing down the capture, but it does not actually start the capture process. A filter must be followed by the 'start' command to begin recording data. On its own, this step produces no capture file for analysis.
About these practice questions
One of 116 original AZ-802 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.