AZ-802 Manage Windows Server in a Hybrid Environment Practice Question
You are configuring Azure Arc-enabled servers for an on-premises Windows Server 2022 instance. You need to ensure that the server can communicate with Azure services while adhering to strict outbound firewall rules. Which port must be opened to support the Azure Connected Machine agent?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP 443
The Azure Connected Machine agent communicates primarily over HTTPS. Specifically, the agent requires outbound connectivity to Azure endpoints on TCP port 443. This is essential for telemetry, policy enforcement, and configuration management in hybrid environments. Properly configuring firewall rules ensures the agent maintains a heartbeat with Azure Resource Manager, allowing the hybrid machine to appear in the Azure portal for monitoring and management tasks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
TCP 80
Why it's wrong here
TCP port 80 is used for unencrypted HTTP traffic, which is not supported for agent communication. Azure Arc requires encrypted communication via TLS/SSL to protect sensitive configuration data and identity tokens transmitted between the local server and the Azure cloud service endpoints during registration and operations.
- ✗
TCP 3389
Why it's wrong here
TCP port 3389 is dedicated to Remote Desktop Protocol (RDP) sessions for administrative access. It is not involved in the Azure Arc agent's operational traffic. Using this port for agent communication would be a security misconfiguration and would fail to establish the necessary connection to Azure management services.
- ✓
TCP 443
Why this is correct
TCP port 443 is the standard port for HTTPS traffic required by the Azure Connected Machine agent. This port allows the agent to establish a secure, encrypted connection to the Azure Resource Manager endpoints, ensuring that management commands and telemetry data are transmitted securely across the internet or private link.
- ✗
TCP 5985
Why it's wrong here
TCP port 5985 is used for Windows Remote Management (WinRM) over HTTP. While useful for internal automation, it is not utilized by the Azure Connected Machine agent for communicating with Azure cloud services. Relying on this port would prevent the server from successfully onboarding or reporting status to Azure.
About these practice questions
One of 116 original AZ-802 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.