AZ-802 Deploy and Manage AD DS Practice Question
You need to apply a stricter password policy to a group of executives than the one defined in the Default Domain Policy. You want to achieve this without creating a separate domain. Which feature should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fine-Grained Password Policies (FGPP).
Fine-Grained Password Policies (FGPP) allow administrators to apply different password and account lockout settings to different sets of users or groups within a single domain. This eliminates the need for multiple domains just to enforce varying security requirements, which was a significant limitation in older versions of Windows Server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A new Group Policy Object (GPO) linked to an Organizational Unit.
Why it's wrong here
Standard Group Policy Objects can only define one password policy per domain, which must be linked at the domain level. Linking a GPO with password settings to an OU will not affect the local user accounts, as they only honor the policy defined in the Default Domain Policy.
- ✓
Fine-Grained Password Policies (FGPP).
Why this is correct
FGPP utilizes Password Settings Objects (PSOs) to override the domain-wide password policy for specific users or global security groups. This allows for higher complexity or shorter expiration periods for sensitive accounts, like executives, while maintaining a single domain structure for the rest of the organization.
- ✗
The 'Password never expires' attribute on user accounts.
Why it's wrong here
The 'Password never expires' attribute is an individual setting that bypasses expiration requirements entirely. It does not allow for the enforcement of stricter complexity or lockout rules, which are the primary requirements for increasing the security posture of high-profile executive accounts in this scenario.
- ✗
A selective trust relationship with a secure forest.
Why it's wrong here
Selective trust is a method of controlling access to resources between different forests and has nothing to do with internal password policy enforcement. Creating a whole new forest for a subset of users is an overly complex solution that introduces significant administrative and infrastructure overhead.
About these practice questions
Courseiva writes every AZ-802 question from scratch — 116 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.