AZ-802 Deploy and Manage AD DS Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Standalone Managed Service Account (sMSA)

  Why this is correct

  An sMSA is the ideal choice for a single-server application because it provides automated password management and handles Service Principal Name (SPN) registration automatically. This eliminates the manual overhead associated with traditional service accounts while improving security by ensuring complex passwords are rotated frequently by the operating system itself.

• ✗

  Group Managed Service Account (gMSA)

  Why it's wrong here

  While a gMSA also provides automated password management, it is designed for services that run across multiple servers in a cluster or load-balanced farm. For a single server, a gMSA adds unnecessary complexity, such as the requirement for a Key Distribution Service (KDS) root key and additional configuration steps.

• ✗

  A standard Domain User account

  Why it's wrong here

  Standard domain user accounts require manual password management and manual SPN registration using the setspn tool. Using these accounts increases administrative burden and security risks, as passwords are often set to never expire or are managed poorly, making them a less desirable option for modern Windows Server environments.

• ✗

  A Local System account

  Why it's wrong here

  The Local System account has extensive privileges on the local machine but acts as the computer's identity on the network. Using it for a custom application violates the principle of least privilege and can create security vulnerabilities if the application is compromised, as it has full access to the local operating system.