AZ-802 Manage Windows Server in a Hybrid Environment Practice Question
You need to automate the installation of the Azure Connected Machine agent across 500 on-premises Windows Servers using Group Policy. What is the most efficient way to deploy the onboarding script while ensuring secure handling of the service principal secret?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Group Policy startup script that pulls secrets from a secure vault at runtime
Deploying at scale requires using a centralized mechanism like GPO to execute the installation script. To avoid storing credentials in plain text, you should use an Azure Key Vault or a temporary SAS token-based approach. This ensures that the installation process is repeatable, auditable, and secure, preventing the exposure of sensitive service principal credentials during the automated deployment of the agent across the corporate environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Embed the service principal secret directly into a PowerShell script file in the GPO
Why it's wrong here
Embedding clear-text secrets in scripts stored in GPOs is a severe security vulnerability. Any user with read access to the GPO repository could compromise the credentials, potentially gaining unauthorized control over your Azure subscription. Secrets must always be managed using secure storage solutions like Azure Key Vault.
- ✓
Use a Group Policy startup script that pulls secrets from a secure vault at runtime
Why this is correct
Using a startup script allows for automated deployment, and by retrieving secrets from a secure, managed vault at runtime, you minimize credential exposure. This approach satisfies both the need for scale through GPO and the security requirement to protect sensitive authentication material during the automated onboarding process.
- ✗
Manually run the installer on each server using an interactive session
Why it's wrong here
Manual installation on 500 servers is inefficient, error-prone, and difficult to audit. It does not meet the requirements for automated deployment. Infrastructure-as-Code and centralized management tools are preferred for large-scale operations to ensure consistency, reduce administrative overhead, and maintain proper versioning of the agent software across the fleet.
- ✗
Use an unauthenticated script to register the machines
Why it's wrong here
An unauthenticated onboarding process is not supported for Azure Arc. All machines must authenticate to Azure during the registration process to ensure that the resource is correctly mapped to your specific tenant and subscription, preventing unauthorized machines from being added to your environment and potentially leaking data.
About these practice questions
One of 116 original AZ-802 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.