AZ-802 Practice Questions

Question 1

You are preparing to raise the forest functional level of an existing Active Directory environment to Windows Server 2016. Which TWO requirements must be met before you can successfully perform this action? (Each correct answer presents part of the solution.)

Accepted Answer

All domain controllers in the forest must run Windows Server 2016 or later.. Raising the forest functional level is a significant administrative task that enables advanced features but requires strict adherence to versioning rules. All domain controllers in every domain within the forest must be running a version of Windows Server that is equal to or higher than the target functional level, and all individual domains must already be at that target level.

Answer

The Schema Master role must be held by a domain controller running Windows Server 2022.

Answer

You must disable the Active Directory Recycle Bin before raising the level.

Answer

The forest must be configured for DFSR replication for the SYSVOL share.

Question 2

The domain controller holding the RID Master FSMO role in your domain has suffered a catastrophic hardware failure and will be offline for several weeks. You notice that administrators can no longer create new user objects. What should you do to resolve this issue immediately?

Accepted Answer

Seize the RID Master role using the 'Move-ADDirectoryServerOperationMasterRole' cmdlet.. The Relative Identifier (RID) Master is responsible for allocating pools of RIDs to all domain controllers in a domain. When a DC exhausts its local pool and the RID Master is unavailable, it cannot create new security principals. In cases of permanent or long-term failure, the role must be seized to a healthy DC to restore functionality.

Answer

Wait for the Knowledge Consistency Checker (KCC) to automatically move the role.

Answer

Perform a graceful transfer of the RID Master role using ADUC.

Answer

Reinstall Active Directory on the failed server using the same name.

Question 3

You need to create a service account for a custom application that runs on a single Windows server. The account must support automatic password management and must not require manual SPN registration. Which type of account should you use?

Accepted Answer

Standalone Managed Service Account (sMSA). Standalone Managed Service Accounts (sMSAs) were introduced to simplify service account management by automating password rotations and SPN handling. Unlike traditional service accounts, sMSAs are tied to a single computer and do not require administrative intervention for password updates, significantly reducing the risk of service outages due to expired credentials or human error.

Answer

Group Managed Service Account (gMSA)

Answer

A standard Domain User account

Answer

A Local System account

Question 4

You need to automate the deployment of a new domain controller in an existing domain using PowerShell. Which cmdlet should you use to install the Active Directory Domain Services role and promote the server after the binaries are present?

Accepted Answer

Install-ADDSDomainController. Modern Windows Server administration emphasizes automation through PowerShell. To promote a server to a domain controller, the ADDSDeployment module provides specific cmdlets that replace the legacy dcpromo utility. These cmdlets handle the configuration of the database, logs, SYSVOL paths, and the necessary directory partition replicates from existing domain controllers in the environment.

Answer

Install-WindowsFeature AD-Domain-Services

Answer

Add-Computer -DomainName 'contoso.com'

Answer

Set-ADDomain -Identity 'contoso.com' -InfrastructureMaster

Question 5

You want to allow a specific help desk user to reset passwords for all users in a specific Organizational Unit (OU), but you do not want to grant them any other administrative rights. What is the most appropriate tool to use?

Accepted Answer

The Delegation of Control Wizard. The Delegation of Control Wizard in Active Directory Users and Computers (ADUC) is designed for granting specific, limited permissions to users or groups over specific portions of the directory. This follows the principle of least privilege by allowing tasks to be offloaded to non-administrators without granting full Domain Admin rights.

Answer

Active Directory Sites and Services

Answer

Group Policy Management Console (GPMC)

Answer

The 'Managed By' tab on the OU properties

Question 6

You are managing an Active Directory domain that includes several Fine-Grained Password Policies (FGPP). A user is a member of two global groups: 'Sales-Group' and 'Marketing-Group'. 'Sales-Group' is assigned a Password Settings Object (PSO) with a precedence of 50. 'Marketing-Group' is assigned a PSO with a precedence of 20. Which policy will be applied to the user?

Accepted Answer

The PSO assigned to the Marketing-Group.. Active Directory determines which Fine-Grained Password Policy to apply based on the precedence value of the Password Settings Objects. In this hierarchy, the PSO with the lower numeric value takes precedence. Therefore, a PSO with a precedence of 20 will override a PSO with a precedence of 50 when a user is a member of multiple groups.

Answer

The Default Domain Policy.

Answer

The PSO assigned to the Sales-Group.

Answer

Both policies will be merged, and the most restrictive settings will apply.

Question 7

You are implementing Azure Monitor for your hybrid servers. Which THREE steps are required to collect guest-level metrics and logs from an Arc-enabled Windows Server? (Choose three.)

Accepted Answer

Install the Azure Monitor Agent (AMA) extension. To enable comprehensive monitoring, you must install the Azure Monitor Agent, create a Data Collection Rule (DCR), and associate that rule with the specific Arc-enabled machines. This workflow ensures that the agent is present, configured with the correct scope, and targeted to collect the specific metrics and event logs required for operational visibility in the Azure Monitor workspace.

Answer

Enable the legacy Log Analytics agent

Answer

Assign the Log Analytics Contributor role to the machine

Question 8

You have three Active Directory sites: SiteA, SiteB, and SiteC. SiteA is connected to SiteB with a cost of 50. SiteB is connected to SiteC with a cost of 50. There is no direct link between SiteA and SiteC. If 'Bridge all site links' is enabled, what is the effective replication cost between SiteA and SiteC?

Accepted Answer

100. Active Directory uses site link costs to determine the most efficient path for replication. When 'Bridge all site links' is enabled (the default), Active Directory can calculate a transitive path between sites that are not directly connected. The total cost is the sum of the costs of the individual links that make up the path.

Answer

50

Answer

Replication is impossible without a direct link.

Answer

0

Question 9

An administrator accidentally deleted an Organizational Unit (OU) containing several hundred user accounts. You need to recover the OU and its contents with the least amount of administrative effort and without taking any domain controllers offline. What should you use?

Accepted Answer

The Active Directory Recycle Bin.. The Active Directory Recycle Bin is the most efficient way to recover deleted objects because it preserves all attributes and the original Distinguished Name. Unlike traditional backups, it does not require a reboot into Directory Services Restore Mode (DSRM), making it the ideal choice for rapid recovery in modern environments.

Answer

An authoritative restore using an existing System State backup.

Answer

A non-authoritative restore of the entire domain database.

Answer

The LDP.exe utility to manually reanimate the tombstone.

Question 10

Refer to the exhibit. You are troubleshooting an issue where several users are unable to change their passwords, and the help desk is seeing inconsistent results when resetting them. Based on the output provided, which domain controller should you investigate first for potential failures or connectivity issues?

Accepted Answer

DC1. The PDC Emulator is the authoritative server for password changes and the primary target for password resets within a domain. In the provided exhibit, DC1 holds the PDC Emulator role. If DC1 is offline or experiencing issues, password-related tasks will fail or show inconsistencies, making it the primary suspect for troubleshooting.

Answer

DC2

Answer

The Schema Master

Answer

The Domain Naming Master

Question 11

You plan to implement Group Managed Service Accounts (gMSAs) to improve the security of several web services. Which TWO prerequisites must be met before you can create and use gMSAs in your Active Directory environment?

Accepted Answer

A Windows Server 2012 or later domain functional level.. Group Managed Service Accounts (gMSAs) require a minimum domain functional level and a specific root key for the Key Distribution Service (KDS). The KDS root key is used by domain controllers to generate the passwords for gMSAs, and it must be created once per forest to enable the service.

Answer

A functional Certificate Authority (CA) in the forest.

Answer

The Windows Server 2016 forest functional level.

Answer

The installation of the Web Server (IIS) role on a DC.

Question 12

You are the administrator of a large multi-domain forest. You have a branch office with a slow WAN link that contains only one domain controller. Users in this office complain that they cannot log on when the WAN link is down, even though they belong to Universal Groups. How should you resolve this issue while minimizing WAN traffic?

Accepted Answer

Enable Universal Group Membership Caching (UGMC) for the branch office site.. In a multi-domain forest, a domain controller needs to contact a Global Catalog to determine Universal Group membership during logon. If a GC is not available locally and the WAN link is down, logons fail. Enabling Universal Group Membership Caching allows a standard DC to cache these memberships, enabling successful logons during outages without the overhead of hosting a full GC.

Answer

Configure the branch office domain controller as a Global Catalog server.

Answer

Convert all Universal Groups to Global Groups.

Answer

Increase the replication frequency of the Site Link to 15 minutes.

Question 13

Your company is merging with another firm. You need to allow users in the 'contoso.com' forest to access resources in the 'fabrikam.com' forest. The solution must ensure that users from Fabrikam cannot access any resources in Contoso unless specifically granted permission on each individual resource. What should you configure?

Accepted Answer

A one-way outgoing forest trust with selective authentication.. A one-way forest trust with selective authentication is the most secure way to connect two forests. The 'one-way' aspect limits the direction of trust, while 'selective authentication' prevents trusted users from automatically being part of the 'Authenticated Users' group on resources in the trusting domain.

Answer

A two-way forest trust with forest-wide authentication.

Answer

An external trust with SID filtering disabled.

Answer

A realm trust with a non-Windows Kerberos environment.

Question 14

You plan to deploy a new domain controller as an Azure Virtual Machine (VM) to provide authentication for cloud workloads. Which THREE actions should you take to ensure the stability and supportability of the domain controller? (Each correct answer presents part of the solution.)

Accepted Answer

Configure a static private IP address for the VM in the Azure portal.. Deploying domain controllers on Azure VMs requires specific configuration to prevent database corruption and ensure consistent identity services. This includes using a static private IP address to prevent DNS failures, placing the NTDS database on a non-caching data disk to ensure write integrity, and using a separate virtual disk rather than the OS drive.

Answer

Enable Azure Disk Encryption on the OS drive.

Answer

Configure the OS drive to use Read/Write host caching.

Question 15

You are adding a new Windows Server 2022 domain controller to an existing forest that currently has a functional level of Windows Server 2012 R2. What is the maximum functional level you can set for the new domain controller?

Accepted Answer

Windows Server 2012 R2. Domain controllers run the operating system version installed on them, but the domain and forest functional levels determine which features are available across the entire environment. A new Windows Server 2022 DC can join a 2012 R2 forest, but it will operate within the constraints of that lower functional level.

Answer

Windows Server 2022

Answer

Windows Server 2016

Answer

Windows Server 2019

Microsoft Windows Server Administrator Associate AZ-802 practice test

Three ways to study

Study AZ-802 by domain

Study AZ-802 by topic

Deploy and Manage AD DS practice questions

Manage Windows Server in a Hybrid Environment practice questions

Manage Virtual Machines practice questions

Manage Storage and File Services practice questions

Secure Windows Server Infrastructure practice questions

Monitor and Troubleshoot Windows Server Environments practice questions

Implement and Manage On-Prem and Hybrid Networking practice questions

AZ-802 fundamentals practice questions

AZ-802 scenario practice questions

AZ-802 troubleshooting practice questions

Microsoft Windows Server Administrator Associate practice questions