AZ-802 Secure Windows Server Infrastructure Practice Question
You are tasked with securing your Windows Server 2022 environment. Which TWO actions should you perform to implement Just Enough Administration (JEA)?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define a Role Capability (.psrc) file.
JEA allows you to restrict administrator access to only the commands necessary for specific tasks, reducing the risk of privilege escalation. By creating a Role Capability file and a Session Configuration file, you define exactly which cmdlets and functions a user can execute. This minimizes the attack surface by ensuring that users do not have broad, unrestricted access to the entire PowerShell environment or the underlying server operating system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Define a Role Capability (.psrc) file.
Why this is correct
The Role Capability file is the heart of JEA, specifying which PowerShell modules, cmdlets, and external executables are available to the user. Defining this file allows administrators to granularly control the commands allowed, ensuring that the user can only perform the specific tasks required for their designated role.
- ✗
Configure a Group Policy Object to enable NTLMv2 only.
Why it's wrong here
Group Policy settings for NTLM authentication restrict the authentication protocol used by the domain but have no impact on JEA configurations. JEA is a PowerShell-specific security feature focused on limiting command execution; it does not control authentication protocols used for network-level access to the server or domain resources.
- ✓
Create a Session Configuration (.pssc) file.
Why this is correct
The Session Configuration file defines the environment in which the JEA session runs, including which users can access it and which Role Capability files are assigned to them. It acts as the container or policy wrapper that dictates the security constraints applied when the JEA session is initiated.
- ✗
Modify the local SAM database to include JEA roles.
Why it's wrong here
The SAM database stores local user and group information but is not used for defining PowerShell JEA roles. JEA roles are defined through configuration files in the file system and registered via PowerShell. Modifying the SAM database does not provide the functionality required to implement restricted PowerShell administrative access.
- ✗
Enable the Credential Guard feature.
Why it's wrong here
Credential Guard is a security feature that uses VBS to protect credentials from memory attacks. While it is an excellent security measure for any Windows Server, it is not a step in the process of implementing JEA. JEA and Credential Guard serve different purposes in the overall server hardening strategy.
About these practice questions
This AZ-802 question is part of Courseiva's 116-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.