AZ-802 Deploy and Manage AD DS Practice Question
Your company, Contoso, Ltd., has a branch office with ten employees. The office has poor physical security, and you are concerned about the risks of a local domain controller being stolen. You need to deploy a domain controller to this site that minimizes the security risk of credential theft for the rest of the domain. Which solution should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Read-Only Domain Controller (RODC) with a custom Password Replication Policy.
Deploying a Read-Only Domain Controller is the recommended strategy for branch offices where physical security cannot be guaranteed. This approach ensures that only a subset of user credentials is cached locally based on the Password Replication Policy, significantly reducing the impact of a physical server theft while still providing local authentication services for users at the site.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A standard writable Domain Controller with BitLocker enabled.
Why it's wrong here
Standard writable domain controllers store the entire domain database, including all sensitive user credentials. While BitLocker provides encryption for data at rest, it does not prevent an attacker from potentially extracting sensitive material if the operating system is compromised once booted, making it less secure than a read-only alternative.
- ✗
An Azure AD Domain Services managed domain instance.
Why it's wrong here
Azure AD Domain Services is a managed service designed for cloud-based workloads and does not provide a local on-premises presence for a branch office without complex networking. It is not intended as a direct replacement for local branch office domain controllers in an existing on-premises Active Directory forest environment.
- ✓
A Read-Only Domain Controller (RODC) with a custom Password Replication Policy.
Why this is correct
Read-Only Domain Controllers do not store secrets for all users by default and prevent changes from being written locally. By using a custom Password Replication Policy, you can ensure only the branch office users have their credentials cached, protecting the administrative accounts and the broader domain if the hardware is stolen.
- ✗
A member server running the Active Directory Lightweight Directory Services role.
Why it's wrong here
Active Directory Lightweight Directory Services is a standalone directory service for application-specific data and does not provide domain authentication for Windows users or computers. It lacks the infrastructure needed to support domain logons, Group Policy, and other core Active Directory Domain Services functions required for standard office operations.
About these practice questions
Courseiva writes every AZ-802 question from scratch — 116 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.