AZ-802 Deploy and Manage AD DS Practice Question
You plan to implement Group Managed Service Accounts (gMSAs) to improve the security of several web services. Which TWO prerequisites must be met before you can create and use gMSAs in your Active Directory environment?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Windows Server 2012 or later domain functional level.
Group Managed Service Accounts (gMSAs) require a minimum domain functional level and a specific root key for the Key Distribution Service (KDS). The KDS root key is used by domain controllers to generate the passwords for gMSAs, and it must be created once per forest to enable the service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Windows Server 2012 or later domain functional level.
Why this is correct
gMSAs were introduced with Windows Server 2012. Therefore, the domain must be at a functional level of at least Windows Server 2012 to support the underlying schema and service logic required to manage these accounts and handle the automatic password rotation across multiple host servers.
- ✓
A Microsoft Key Distribution Service (KDS) root key.
Why this is correct
The KDS root key is essential for the KDS service on domain controllers to generate the passwords for gMSAs. This key must be created using PowerShell and, by default, takes 10 hours to replicate throughout the forest before gMSAs can be successfully deployed and utilized by member servers.
- ✗
A functional Certificate Authority (CA) in the forest.
Why it's wrong here
While gMSAs provide enhanced security, they do not rely on a Public Key Infrastructure (PKI) or certificates for their core functionality. They use the Kerberos protocol and the KDS root key to manage passwords, making a Certificate Authority unnecessary for the deployment of gMSAs themselves.
- ✗
The Windows Server 2016 forest functional level.
Why it's wrong here
Although newer functional levels offer additional security features, the Windows Server 2016 forest level is not a requirement for gMSAs. The feature became available at the 2012 level, and forcing a 2016 level would be an unnecessary restriction for environments still running older, supported domain controllers.
- ✗
The installation of the Web Server (IIS) role on a DC.
Why it's wrong here
Managed Service Accounts are used by services like IIS, but the IIS role should never be installed on a domain controller for security reasons. The gMSA is created in Active Directory and then assigned to services running on member servers, not on the domain controllers themselves.
About these practice questions
Courseiva writes every AZ-802 question from scratch — 116 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.