How many Troubleshooting Scenario Questions questions are on this page?

This page has 13 Troubleshooting Scenario Questions scenario questions for the AZ-802 exam, each with detailed explanations and wrong-answer analysis.

How should I approach AZ-802 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft Windows Server Administrator Associate questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Microsoft Windows Server Administrator Associate practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

AZ-802

exam code

Microsoft

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

Refer to the exhibit. You are troubleshooting an issue where several users are unable to change their passwords, and the help desk is seeing inconsistent results when resetting them. Based on the output provided, which domain controller should you investigate first for potential failures or connectivity issues?

Exhibit

Get-ADDomain | Select-Object InfrastructureMaster, PDCEmulator, RIDMaster

InfrastructureMaster : DC2.contoso.com
PDCEmulator          : DC1.contoso.com
RIDMaster             : DC1.contoso.com

A
DC2
Why wrong: DC2 holds the Infrastructure Master role, which manages cross-domain object references. While important for multi-domain environments, it plays no direct role in the password change process or the immediate processing of account lockouts, which are tasks specifically assigned to the PDC Emulator role holder.
B
DC1
DC1 holds the PDC Emulator role, which is the primary domain controller for handling password updates and synchronization. When a user changes their password, the change is preferred to be processed by the PDC Emulator to ensure immediate consistency across the domain for authentication requests.
C
The Schema Master
Why wrong: The Schema Master is a forest-wide role not listed in the domain-level exhibit output provided. It is responsible for structural changes to the Active Directory database and has no involvement in daily user account operations like password resets or the enforcement of account lockout policies.
D
The Domain Naming Master
Why wrong: The Domain Naming Master manages the addition and removal of domains within the forest. It is not involved in user-level authentication or password management. Issues with this role would prevent architectural changes to the forest but would not cause the password reset symptoms described in the scenario.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. You are troubleshooting a replication issue between the Head Office (Site-HQ) and a Branch Office (Site-Branch-A). Based on the output, what is the most likely cause of the failure?

Exhibit

C:\> repadmin /showrepl

Site-Branch-A\DC-02
DSA Options: IS_GC
Site Options: (none)
DSA object GUID: 4a2b3c4d-5e6f...

==== INBOUND NEIGHBORS =====================================

DC=contoso,DC=com
    Site-HQ\DC-01 via RPC
        DSA object GUID: 1a2b3c4d-...
        Last attempt @ 2023-10-25 10:15:22 failed, result 1722 (0x6ba):
        The RPC server is unavailable.

A
The KCC has not yet generated a replication topology for the site.
Why wrong: If the Knowledge Consistency Checker (KCC) had not generated a topology, there would be no inbound neighbor listed in the repadmin output. The fact that DC-01 is listed as a neighbor indicates that the topology exists, but the actual attempt to synchronize data over that connection is failing due to communication errors.
B
There is a mismatch in the Site Link costs between the two sites.
Why wrong: Site Link costs determine the preferred path for replication but do not cause RPC server unavailable errors. A cost mismatch might lead to replication taking an inefficient route, but it would not prevent the RPC service from being reached if a valid network path and proper firewall rules were in place.
C
The destination domain controller lacks the Global Catalog role.
Why wrong: The exhibit explicitly shows 'DSA Options: IS_GC' for DC-02, confirming it is a Global Catalog. Even if it were not a GC, the absence of the role would not cause an RPC error during standard domain partition replication. RPC errors are strictly related to the underlying communication layer between the two servers.
D
A firewall is blocking RPC traffic or the source DC is offline.
The 'RPC server is unavailable' error is a classic indicator that the destination DC cannot establish a network connection to the RPC endpoint on the source DC. This is frequently caused by network firewalls, the source server being powered off, or critical services like the RPC Endpoint Mapper being blocked or stopped.

Full breakdown with real-world context →

Question 3mediummulti select

Full question →

You need to inspect the state of Active Directory objects as they existed three days ago to troubleshoot an issue. You have a system state backup from that time. Which TWO tools must you use to view the contents of the database from the backup without performing a full restore? (Each correct answer presents part of the solution.)

A
Active Directory Sites and Services
Why wrong: Active Directory Sites and Services is used to manage the physical topology of the network, including sites, subnets, and replication schedules. It does not provide the functionality to mount or view historical snapshots of the Active Directory database or to connect to alternative LDAP ports for database inspection purposes.
B
ntdsutil
The ntdsutil tool is essential for managing Active Directory snapshots. It allows an administrator to list available snapshots and mount them to the file system. Once mounted, the NTDS.dit file from the snapshot becomes accessible for the dsamain tool to use, providing the foundation for the offline database inspection process.
C
dsamain
The dsamain utility is used to expose the data from a mounted snapshot or a restored NTDS.dit file as a read-only LDAP instance. By specifying a unique port number, dsamain allows administrators to browse the historical state of the directory using standard LDAP tools without interfering with the live domain controller's operations.
D
wbadmin
Why wrong: The wbadmin command-line tool is used to create and manage system state and volume backups. While it is used to recover the files from the backup media to a disk location, it does not have the capability to mount those files as a searchable directory service or to browse the objects contained within the database.
E
repadmin
Why wrong: The repadmin tool is primarily used for monitoring and troubleshooting Active Directory replication between domain controllers. It provides detailed information about replication partners and metadata but cannot mount historical database snapshots or provide a mechanism for viewing the contents of an offline Active Directory database file from a backup.

Full breakdown with real-world context →

Question 4mediummultiple choice

Review the full subnetting walkthrough →

You are configuring a Windows Server 2022 instance to act as a router between two subnets. You have enabled IP forwarding, but traffic is not passing between the subnets. Which PowerShell cmdlet should you use to verify if the routing table is correctly identifying the local interface routes?

A
Get-NetIPAddress
Why wrong: This cmdlet displays IP address configuration including prefixes and interface indices, but it does not show the actual routing logic or path decisions taken by the Windows networking stack. It is useful for verifying interface assignments rather than validating the destination reachability or hop-by-hop packet forwarding behavior.
B
Test-NetConnection
Why wrong: While this tool is excellent for testing end-to-end connectivity and port availability, it simulates a connection attempt rather than providing a diagnostic view of the local server's routing table. It cannot confirm if the internal routing logic is configured to handle traffic between two locally attached interfaces.
C
Get-NetRoute
This cmdlet retrieves the current routing table entries. It is the primary tool for verifying that the operating system recognizes the destination subnets and maps them to the appropriate network interfaces. If a route is missing or pointing to the wrong interface, this cmdlet will clearly highlight the discrepancy.
D
Get-NetAdapter
Why wrong: This cmdlet provides information about physical or virtual network adapters such as status, speed, and hardware properties. It does not provide insight into Layer 3 routing configuration or the logic the kernel uses to decide which interface should handle traffic destined for a specific remote IP address.

Full breakdown with real-world context →

Question 5mediummulti select

Read the full DNS explanation →

You are troubleshooting a Windows Server DNS environment where stale resource records are not being removed, leading to name resolution errors. Which THREE conditions must be met for DNS scavenging to successfully delete a stale record?

A
Scavenging must be enabled at the DNS server level.
Even if individual zones are configured for scavenging, the master switch at the DNS server level must be turned on. This setting tells the DNS service to periodically run the scavenging algorithm and check all hosted zones for records that have exceeded their aging and refresh intervals.
B
Scavenging and aging must be enabled at the specific zone level.
Each DNS zone must be explicitly configured to allow aging and scavenging. This provides granular control, allowing administrators to protect static zones from accidental record deletion while ensuring that dynamic zones, which often contain temporary DHCP-assigned records, are regularly cleaned of obsolete entries that are no longer valid.
C
The record must be a static record with a zero timestamp.
Why wrong: Static records with a timestamp of zero are actually protected from scavenging. Scavenging only applies to dynamic records that have a non-zero timestamp, which indicates when the record was last refreshed. This prevents critical manually-created infrastructure records from being deleted by the automated cleanup process.
D
The record must have existed past the sum of the No-refresh and Refresh intervals.
A record is only considered stale after the No-refresh interval and the Refresh interval have both lapsed without the client updating its record. This combined duration ensures that the client has had ample opportunity to renew its lease and update its DNS information before the server deletes it.
E
The DNS server must be a member of the Schema Admins group.
Why wrong: DNS scavenging is a local service operation and does not require high-level Active Directory permissions like Schema Admins. The DNS service runs under the computer account or a service account which already has the necessary permissions to manage records within the Active Directory-integrated DNS zones it hosts.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

Refer to the exhibit. You need to ensure that all data transmitted over SMB between your file server and domain-joined clients is encrypted. You set the configuration to True, but users report connectivity issues. What is the most likely cause?

Exhibit

Get-SmbServerConfiguration | Select-Object -Property EnableSMBEncryption

EnableSMBEncryption : False

A
The SMB server service must be restarted for the change to take effect.
Why wrong: SMB configuration changes in Windows Server 2022 are applied dynamically by the kernel-mode SMB driver. Restarting the service is generally unnecessary for configuration properties like encryption. The connectivity issue points to a protocol mismatch or negotiation failure rather than a pending service restart requirement for the configuration update.
B
Clients are using an SMB version lower than 3.0.
SMB encryption was introduced in version 3.0. Clients attempting to connect using SMB 2.1 or earlier cannot perform the required cryptographic handshake when encryption is enforced globally. Consequently, the server terminates the connection attempt, preventing the client from accessing files, which explains the reported connectivity issues during the migration.
C
The server's certificate for SMB encryption has expired.
Why wrong: SMB encryption in Windows Server uses symmetric keys negotiated during the session setup, not X.509 certificates. Therefore, certificate expiration is irrelevant to SMB traffic. This is a common point of confusion with TLS-based protocols like HTTPS or LDAPS, which do rely on PKI infrastructure for session encryption.
D
The firewall is blocking TCP port 445.
Why wrong: The firewall blocking port 445 would prevent all SMB traffic regardless of whether encryption is enabled or disabled. Since users specifically reported issues after the configuration change to enable encryption, the connectivity problem is rooted in the protocol negotiation phase rather than a static network-level block by the firewall.

Full breakdown with real-world context →

Question 7mediummulti select

Full question →

You are troubleshooting a Windows Server application that occasionally hangs. You want to capture a dump file of the process when it stops responding. Which THREE tools or methods should you consider using? (Choose three.)

A
Task Manager
Task Manager allows for a simple right-click operation to 'Create dump file' for any running process. This is the most accessible method for an administrator to capture the current state of an unresponsive application without requiring additional software installation or complex command-line configuration for simple debugging needs.
B
ProcDump
ProcDump is a powerful command-line utility from the Sysinternals suite that can be configured to monitor a process and automatically generate a dump file based on specific triggers, such as CPU spikes or hang states. It is the industry standard for capturing complex application failures in production environments.
C
Performance Monitor
Why wrong: Performance Monitor is designed to track resource metrics and system counters over time. It lacks the functionality to inspect process memory or generate memory dump files. While it can identify that a process is consuming high resources, it cannot perform the memory capture necessary to debug application hangs.
D
Windows Error Reporting (WER) configuration
Windows Error Reporting can be configured via the registry or Group Policy to automatically create local dump files when an application crashes or hangs. This is a robust, system-wide approach to ensuring diagnostic data is available for analysis even if an administrator is not present during the hang.
E
Resource Monitor
Why wrong: Resource Monitor provides a real-time view of hardware and network usage by specific processes. While it is excellent for visualizing which processes are using the most memory or disk I/O, it does not provide the capability to create or export process memory dump files for debugging application freezes.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

Refer to the exhibit. You are running dcdiag to investigate synchronization issues between two domain controllers. Based on the error code 1256 and the output provided, which action is most likely to resolve the underlying problem?

Exhibit

Testing server: Default-First-Site-Name\DC1
Starting test: Connectivity
   ......................... DC1 passed test Connectivity
Starting test: Replications
   [Replications Check,DC1] A recent replication attempt failed:
   From DC2 to DC1
   Naming Context: DC=contoso,DC=com
   The replication generated an error (1256): The remote system is not available.

A
Force an immediate KCC topology update using repadmin /kcc.
Why wrong: While forcing a KCC update can sometimes fix logical topology issues, it will not resolve a 'remote system not available' error. This error indicates a communication failure at the network or service level, which the KCC cannot bypass until the underlying transport path is restored.
B
Check the network connectivity and power status of DC2.
The error code 1256 specifically suggests that the destination server (DC1) cannot reach the source server (DC2). The most logical first step is to verify that DC2 is powered on, connected to the network, and that no firewalls are blocking the RPC ports required for AD replication.
C
Reset the computer account password for DC1 in Active Directory.
Why wrong: Resetting a computer account password is used for 'Access Denied' errors or secure channel failures, typically indicated by error 5. It is not appropriate for error 1256, which is a connectivity-based failure rather than a credential or authentication-based failure between the domain controllers.
D
Seize the FSMO roles from DC2 using ntdsutil.
Why wrong: Seizing FSMO roles is a drastic measure taken only when a domain controller is permanently lost. It does not fix replication errors for the naming context. If the connectivity is temporarily broken, seizing roles would create more complexity and potential conflicts once the network issue is resolved.

Full breakdown with real-world context →

Question 9hardmultiple choice

Full question →

Refer to the exhibit. You are troubleshooting an Azure Arc onboarding failure. The server has an internet connection, but the registration script returns the provided error. What should you verify first?

Exhibit

Error: 0x80072ee7. The Connected Machine agent failed to register with Azure. Connectivity check indicates DNS resolution failure for hybridresource.azure.com.

A
Verify the Azure Subscription Quotas
Why wrong: Subscription quotas limit the number of resources in a tenant but do not cause DNS resolution errors. If a quota was reached, the error would manifest as an authorization or resource limit failure rather than a connectivity-related DNS lookup issue during the initial registration attempt for the agent.
B
Check the local DNS server forwarding settings
Since the server cannot resolve the Azure FQDN, the local DNS forwarders are likely misconfigured or restricted. Updating the forwarders to point to public DNS providers or correctly configuring conditional forwarders for Azure domains allows the server to resolve the necessary endpoints to complete the agent registration process.
C
Validate the Azure Service Principal credentials
Why wrong: Service Principal issues typically result in 'Access Denied' or authentication errors, not DNS resolution failures. Validating credentials is a valid troubleshooting step for identity-related problems, but it does not address the fundamental networking layer issue where the client cannot translate the Azure hostname into an IP address.
D
Restart the Azure Connected Machine service
Why wrong: Restarting the service might trigger a retry, but it will not fix an underlying DNS configuration issue. If the local resolver is unable to reach the Azure infrastructure, restarting the agent will simply result in the same error message because the root cause of the connectivity failure remains present.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

You are troubleshooting an issue where an Azure Arc-enabled server is showing as 'Offline' in the Azure portal, despite the server being powered on. Which local service should you check first to ensure the agent is running?

A
Windows Update service
Why wrong: The Windows Update service is responsible for managing OS patches and is not directly tied to the Azure Arc agent's connectivity status. While updates are important for security, the heartbeat of the Arc-enabled server is independent of the Windows Update service state during normal operation.
B
Azure Connected Machine Agent service (himds)
The 'himds' service is the core service for the Azure Connected Machine agent. If this service is not running, the server cannot communicate its status, configuration, or telemetry to Azure. Ensuring this service is in a 'Running' state is the primary step to resolving connectivity issues.
C
Server Manager
Why wrong: Server Manager is an administrative dashboard for local role management and is not a background service related to hybrid connectivity. Its state does not impact the ability of the Azure Arc agent to communicate with the cloud, and checking it provides no insight into the agent's connectivity status.
D
Network Location Awareness service
Why wrong: This service manages network connectivity states for the OS but is not responsible for the Arc agent's heartbeat. While network connectivity is required, this specific Windows service does not control the registration or agent-to-cloud communication flow for the Azure Connected Machine service itself.

Full breakdown with real-world context →

Question 11hardmultiple choice

Full question →

You are troubleshooting an issue where an Azure Arc-enabled server is showing a status of 'Offline' in the Azure portal. Which TWO logs or files should you inspect on the Windows Server? (Choose two.)

A
C:\ProgramData\AzureConnectedMachineAgent\Log\himds.log
This log file contains the primary output for the Hybrid Instance Metadata Service (HIMDS). It is the source of truth for the agent's internal operations, including token requests and connection attempts. Inspecting this file is the standard first step for diagnosing why a server is not reporting back to Azure.
B
Windows Application Event Log
The Windows Event Log acts as a secondary diagnostic source. If the agent fails due to environmental issues—such as a failure to access the system certificate store or a crash of a dependent Windows service—the error will often be captured here, providing context that the agent's own logs might lack.
C
C:\Windows\System32\drivers\etc\hosts
Why wrong: While this file controls name resolution, it is rarely the cause of a heartbeat failure unless the administrator has manually modified it to block communication. It is not a log file, and checking it is an advanced troubleshooting step, not a primary location for agent health diagnostics.
D
C:\Windows\System32\config\SAM
Why wrong: The SAM database stores local user account hashes and is a security-sensitive file. It contains no information regarding the operation, health, or connectivity of the Azure Connected Machine agent. Attempting to inspect this file is useless for troubleshooting and would typically require specialized tools that are not used for Arc.
E
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
Why wrong: This folder contains private keys for machine certificates. While a corruption here could prevent the agent from authenticating, it is not a human-readable log file. Directly inspecting these keys is highly risky and is not a valid way to debug the connectivity status of the Azure Arc agent.

Full breakdown with real-world context →

Question 12hardmultiple choice

Full question →

An administrator is troubleshooting a Storage Spaces Direct (S2D) cluster where one node shows a status of 'Retired'. The administrator needs to identify if a physical disk failure or a communication timeout caused this status. Which PowerShell cmdlet provides the most detailed health information regarding the operational status of the underlying physical disks in the storage pool?

A
Get-StoragePool
Why wrong: This cmdlet provides high-level information about the health and operational status of the entire storage pool rather than individual disks. While it can confirm if the pool is degraded, it lacks the granular detail required to identify specific physical disk failures or the reasons why a particular drive was retired.
B
Get-PhysicalDisk
This cmdlet retrieves the status of every physical disk visible to the storage subsystem. It displays critical properties such as HealthStatus, OperationalStatus, and Usage. This is the primary tool for identifying which specific drive has failed or been marked as retired within an S2D cluster or a standard storage pool.
C
Get-VirtualDisk
Why wrong: This command focuses on the health of the logical volumes created on top of the storage pool. Although it will show if a volume is 'Degraded' or 'Incomplete' due to disk issues, it does not provide the hardware-level telemetry needed to diagnose the root cause of an individual physical disk failure.
D
Debug-StorageSubsystem
Why wrong: This utility is used for broader troubleshooting of storage faults and can help identify why a cluster might be underperforming. While it is a powerful diagnostic tool, it is generally used after identifying a specific component failure rather than as the primary means of checking the basic status of physical hardware.

Full breakdown with real-world context →

Question 13mediummultiple choice

Full question →

You have configured a Windows Server to forward events to a centralized collector. You notice that the collector is not receiving events from a specific source server. You verify that the 'Windows Event Collector' service is running on the collector and the 'Windows Remote Management' service is running on the source. What should you check next to troubleshoot the connectivity?

A
Verify the Event Log size configuration on the source server.
Why wrong: Event log size settings only determine how many events are stored locally before being overwritten. They do not prevent the WinRM service from reading the events to forward them to the collector. Adjusting these settings will not resolve a communication failure between the collector and the source.
B
Check the WinRM listener status and configuration on both servers.
Event forwarding requires an active WinRM listener to transport event data. If the listener is not configured correctly or is restricted by a firewall, the collector will never receive the forwarded events. Validating this ensures the underlying transport protocol is ready to establish the connection for log transmission.
C
Restart the Task Scheduler service on the source server.
Why wrong: Task Scheduler is generally not involved in the real-time transmission of event logs via the Event Forwarding subscription model. While it manages scheduled tasks, restarting it will not address network-level communication issues or WinRM configuration errors that typically prevent events from reaching the collector server.
D
Reinstall the Windows Event Collector feature.
Why wrong: Reinstalling the feature is an overly invasive step that rarely resolves specific communication issues between a source and a collector. Troubleshooting should prioritize configuration checks and network connectivity validation, as these are far more common causes of failure in distributed event logging architectures than corrupted feature installations.

Full breakdown with real-world context →

These AZ-802 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style AZ-802 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related AZ-802 topic practice pages

Deploy and Manage AD DS practice questions

Manage Windows Server in a Hybrid Environment practice questions

Manage Virtual Machines practice questions

Manage Storage and File Services practice questions

Secure Windows Server Infrastructure practice questions

Monitor and Troubleshoot Windows Server Environments practice questions

Implement and Manage On-Prem and Hybrid Networking practice questions

AZ-802 fundamentals practice questions

AZ-802 scenario practice questions

AZ-802 troubleshooting practice questions

Practice scenarios

Exhibit

Refer to the exhibit. You are troubleshooting a replication issue between the Head Office (Site-HQ) and a Branch Office (Site-Branch-A). Based on the output, what is the most likely cause of the failure?

Exhibit

You are configuring a Windows Server 2022 instance to act as a router between two subnets. You have enabled IP forwarding, but traffic is not passing between the subnets. Which PowerShell cmdlet should you use to verify if the routing table is correctly identifying the local interface routes?

You are troubleshooting a Windows Server DNS environment where stale resource records are not being removed, leading to name resolution errors. Which THREE conditions must be met for DNS scavenging to successfully delete a stale record?

Refer to the exhibit. You need to ensure that all data transmitted over SMB between your file server and domain-joined clients is encrypted. You set the configuration to True, but users report connectivity issues. What is the most likely cause?

Exhibit

You are troubleshooting a Windows Server application that occasionally hangs. You want to capture a dump file of the process when it stops responding. Which THREE tools or methods should you consider using? (Choose three.)

Refer to the exhibit. You are running dcdiag to investigate synchronization issues between two domain controllers. Based on the error code 1256 and the output provided, which action is most likely to resolve the underlying problem?

Exhibit

Refer to the exhibit. You are troubleshooting an Azure Arc onboarding failure. The server has an internet connection, but the registration script returns the provided error. What should you verify first?

Exhibit

You are troubleshooting an issue where an Azure Arc-enabled server is showing as 'Offline' in the Azure portal, despite the server being powered on. Which local service should you check first to ensure the agent is running?

You are troubleshooting an issue where an Azure Arc-enabled server is showing a status of 'Offline' in the Azure portal. Which TWO logs or files should you inspect on the Windows Server? (Choose two.)