AZ-802 Deploy and Manage AD DS Practice Question
You accidentally delete an Organizational Unit (OU) containing 500 users. You need to recover the OU and its contents with all attributes, including group memberships, intact. What is the most efficient way to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Active Directory Recycle Bin to restore the objects.
The Active Directory Recycle Bin is the most efficient tool for recovering deleted objects because it preserves all physical and logical attributes of the object, including its distinguished name and group memberships. Once enabled, it eliminates the need for authoritative restores from backups, which require taking a domain controller offline into Directory Services Restore Mode.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restore the OU from a System State backup using a non-authoritative restore.
Why it's wrong here
A non-authoritative restore will bring the objects back on one domain controller, but they will be immediately overwritten by the deletion update from other domain controllers during the next replication cycle. This method is ineffective for recovering deleted objects unless followed by an authoritative restore process to increment the version number.
- ✓
Use the Active Directory Recycle Bin to restore the objects.
Why this is correct
The Recycle Bin allows for the immediate restoration of deleted objects through the Active Directory Administrative Center or PowerShell. It is the only method that fully preserves all object attributes and linkages without requiring a reboot into DSRM, making it the fastest and most reliable recovery option for modern Active Directory environments.
- ✗
Re-create the OU and users manually and add them back to their groups.
Why it's wrong here
Manual recreation is highly inefficient and results in new Security Identifiers (SIDs) for every object. Because the SIDs change, the users will lose access to all previously assigned resources, such as file shares and permissions, and their original group memberships and profile associations will be permanently lost unless manually reconstructed.
- ✗
Perform an authoritative restore of the OU using the ntdsutil command.
Why it's wrong here
While an authoritative restore would work, it is a complex and time-consuming process that requires restarting a domain controller in Directory Services Restore Mode (DSRM). Compared to the Active Directory Recycle Bin, it causes more downtime and carries a higher risk of administrative error during the manual marking of objects for restoration.
About these practice questions
One of 116 original AZ-802 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.