AZ-802 Deploy and Manage AD DS Practice Question
You want to allow a specific help desk user to reset passwords for all users in a specific Organizational Unit (OU), but you do not want to grant them any other administrative rights. What is the most appropriate tool to use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Delegation of Control Wizard
The Delegation of Control Wizard in Active Directory Users and Computers (ADUC) is designed for granting specific, limited permissions to users or groups over specific portions of the directory. This follows the principle of least privilege by allowing tasks to be offloaded to non-administrators without granting full Domain Admin rights.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Active Directory Sites and Services
Why it's wrong here
Active Directory Sites and Services is used for managing the physical topology of the network, including sites, subnets, and replication schedules. It is not the appropriate tool for managing object-level permissions or delegating administrative tasks like password resets, which are logical operations performed on user objects within OUs.
- ✓
The Delegation of Control Wizard
Why this is correct
The Delegation of Control Wizard provides a simple, guided interface to assign specific permissions, such as 'Reset user passwords and force password change at next logon,' to a user or group for a particular OU. This ensures the help desk can perform their duties without being members of highly privileged groups.
- ✗
Group Policy Management Console (GPMC)
Why it's wrong here
GPMC is used to manage and deploy Group Policy Objects across the domain to configure system and user environments. While you can use GPO to restrict what users can do on their machines, it is not the correct tool for delegating administrative permissions within the Active Directory database structure itself.
- ✗
The 'Managed By' tab on the OU properties
Why it's wrong here
The 'Managed By' tab is primarily used for documentation purposes and to identify the person responsible for an object. While it has an option to grant the manager some permissions, it does not provide the granular control or the specific 'Reset Password' task selection offered by the Delegation of Control Wizard.
About these practice questions
Courseiva writes every AZ-802 question from scratch — 116 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.