AZ-802 Manage Windows Server in a Hybrid Environment Practice Question
You are troubleshooting an issue where an Azure Arc-enabled server is showing a status of 'Offline' in the Azure portal. Which TWO logs or files should you inspect on the Windows Server? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
C:\ProgramData\AzureConnectedMachineAgent\Log\himds.log
The agent's health is documented in the agent's log file ('himds.log') and the Windows Event Viewer. The 'himds.log' provides the most granular details regarding the agent's handshake, heartbeat, and API connectivity to the Azure endpoints. The Application and System event logs in Windows are essential for identifying underlying OS-level issues, such as certificate store errors or network interface failures that prevent the agent from reaching the required endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
C:\ProgramData\AzureConnectedMachineAgent\Log\himds.log
Why this is correct
This log file contains the primary output for the Hybrid Instance Metadata Service (HIMDS). It is the source of truth for the agent's internal operations, including token requests and connection attempts. Inspecting this file is the standard first step for diagnosing why a server is not reporting back to Azure.
- ✓
Windows Application Event Log
Why this is correct
The Windows Event Log acts as a secondary diagnostic source. If the agent fails due to environmental issues—such as a failure to access the system certificate store or a crash of a dependent Windows service—the error will often be captured here, providing context that the agent's own logs might lack.
- ✗
C:\Windows\System32\drivers\etc\hosts
Why it's wrong here
While this file controls name resolution, it is rarely the cause of a heartbeat failure unless the administrator has manually modified it to block communication. It is not a log file, and checking it is an advanced troubleshooting step, not a primary location for agent health diagnostics.
- ✗
C:\Windows\System32\config\SAM
Why it's wrong here
The SAM database stores local user account hashes and is a security-sensitive file. It contains no information regarding the operation, health, or connectivity of the Azure Connected Machine agent. Attempting to inspect this file is useless for troubleshooting and would typically require specialized tools that are not used for Arc.
- ✗
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
Why it's wrong here
This folder contains private keys for machine certificates. While a corruption here could prevent the agent from authenticating, it is not a human-readable log file. Directly inspecting these keys is highly risky and is not a valid way to debug the connectivity status of the Azure Arc agent.
About these practice questions
One of 116 original AZ-802 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.