AZ-802 Secure Windows Server Infrastructure Practice Question
You need to create a Group Managed Service Account (gMSA) for a new web application cluster running on Windows Server 2022. Which TWO prerequisites must be met before you can successfully create and use the gMSA in your Active Directory domain? (Select TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Active Directory schema must be updated to at least Windows Server 2012.
Creating a gMSA requires a specific environment setup. First, the Active Directory schema must be at least Windows Server 2012. Second, the Key Distribution Service (KDS) Root Key must be created to allow domain controllers to generate the passwords. These steps ensure that the automated password management system has the necessary foundation to operate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Active Directory schema must be updated to at least Windows Server 2012.
Why this is correct
The gMSA feature was introduced with Windows Server 2012. Therefore, the Active Directory schema must be updated to a version that supports the necessary object classes and attributes for gMSAs. Without this schema version, the domain controllers will not recognize the gMSA object type or be able to manage its properties.
- ✓
A KDS Root Key must be created in the Active Directory forest.
Why this is correct
The Microsoft Key Distribution Service (KDS) uses a root key to generate the passwords for gMSAs. This key must be created once per forest. After creation, there is a default 10-hour wait time for replication before gMSAs can be created, ensuring all domain controllers can provide the necessary password services safely.
- ✗
Every server in the cluster must be running the Windows Insider preview build.
Why it's wrong here
gMSAs are a stable, production-ready feature available in all supported versions of Windows Server since 2012. Using Insider preview builds is not a requirement and is generally discouraged for production workloads. Standard retail or volume licensed versions of Windows Server 2022 fully support gMSAs for all application and service types.
- ✗
The Domain Functional Level must be set to Windows Server 2022.
Why it's wrong here
While the schema must be updated, the Domain Functional Level does not need to be Windows Server 2022. gMSAs only require a schema version from Windows Server 2012 or later. This allows organizations with older domain controllers to still benefit from the security and management advantages of gMSAs without upgrading every controller.
- ✗
An Azure AD Connect instance must be active and syncing to the cloud.
Why it's wrong here
gMSAs are a local Active Directory Domain Services feature and do not require any cloud connectivity or Azure AD Connect synchronization. They are designed to manage service identities within an on-premises or hybrid environment independently of cloud-based identity synchronization tools, focusing on the security of the local Windows Server infrastructure.
About these practice questions
This AZ-802 question is part of Courseiva's 116-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.