Free AZ-802 Questions for Microsoft Administering Windows Server AZ-802 Exam as PDF & Practice Test Engine
You have a Windows Server 2022 Remote Desktop Services deployment that includes the servers shown in the following table. You need to upgrade the Remote Desktop Services deployment to Windows Server 2025.
Which server must you upgrade first? (Exhibit: RDS role servers table.)
RDS deployment role servers
Which server must you upgrade first? (Exhibit: RDS role servers table.)
RDS deployment role servers
Correct Answer: C
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
You implement the planned change for VM5.
From which IPv4 address space does VM5 receive its IP address?
From which IPv4 address space does VM5 receive its IP address?
Correct Answer: B
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that runs Windows Server. Server1 has volume C: (OperatingSystem, unencrypted) and volume D: (Data, fully encrypted with BitLocker, KeyProtector currently Password and RecoveryPassword).
You need to add the computer account of Server1 as a key protector for volume D so that Server1 can automatically unlock the volume without a signed-in user. How should you complete the command? To answer, select the appropriate options in the answer area.
BitLocker status for volumes C and D
You need to add the computer account of Server1 as a key protector for volume D so that Server1 can automatically unlock the volume without a signed-in user. How should you complete the command? To answer, select the appropriate options in the answer area.
BitLocker status for volumes C and D
Correct Answer:
Explanation:
Cmdlet: Add-BitLockerKeyProtector -MountPoint D: -ADAccountOrGroupProtector CONTOSO\Server1$ - Service.
The -ADAccountOrGroupProtector parameter of Add-BitLockerKeyProtector adds an Active Directory account or group as a key protector for a BitLocker-protected volume, and this protector type can only be applied to a data volume, not an operating system volume, which is consistent with the scenario targeting the D: data volume rather than the C: operating system volume shown as unencrypted in the exhibit. Pairing - ADAccountOrGroupProtector with the -Service switch specifically tells BitLocker that the AD object being added as a protector is the computer ' s own service, or machine, account, expressed in the form DOMAIN\ComputerName$, which is what lets Server1 automatically unlock the volume on its own using its computer account credentials without requiring any signed-in user to enter a password or PIN. The second dropdown correctly resolves to -Service rather than -TPMandPinProtector or - TPMandPinAndStartupKeyProtector, since neither of those protector types is meant to be combined with an AD account or group protector, and neither one authenticates using a computer account the way -Service does.
Technical requirements: Promote a new server named DC4 that runs Windows Server 2022 to a domain controller. Replicate the virtual machines from Cluster2 to an Azure Recovery Services vault. Centrally manage performance alerts in Azure for all the domain controllers. Ensure that User1 can recover objects from the Active Directory Recycle Bin. Migrate Share1 to Server2, including all the share and folder permissions. Back up Server4 and all data to an Azure Recovery Services vault. Use Hyper-V Replica to protect the virtual machines in Cluster3. Implement BitLocker Drive Encryption (BitLocker) on Server4.
Whenever possible, use the principle of least privilege. You need to back up Server4 to meet the technical requirements. What should you do first?
Whenever possible, use the principle of least privilege. You need to back up Server4 to meet the technical requirements. What should you do first?
Correct Answer: B
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains the servers shown in the following table.
You have an Azure subscription.
You plan to migrate the data on FS1 to Azure by using Azure Data Box Gateway.
You need to configure a Data Box Gateway virtual device.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Exhibit
You have an Azure subscription.
You plan to migrate the data on FS1 to Azure by using Azure Data Box Gateway.
You need to configure a Data Box Gateway virtual device.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Exhibit
Correct Answer:
Explanation:
Deploying an Azure Data Box Gateway virtual device follows a fixed sequence: you first create the Data Box Gateway resource in the Azure portal, which generates the virtual device image and an activation key; you then download that virtual device image; next you use the downloaded image to create a virtual machine on the on-premises Hyper-V host (HV1); and finally you power on that VM and activate it against the Azure resource using the activation key, which brings the Data Box Gateway share online so FS1 ' s data can start being copied to it. Creating a Storage Sync Service, installing the Azure File Sync agent, or configuring Hyper-V Replica are unrelated Azure File Sync/replication actions that do not belong in this Data Box Gateway deployment, since Data Box Gateway is deployed and activated entirely as its own virtual appliance rather than as an agent layered onto an existing role or VM.
You have an on-premises server that runs Windows Server and has the Web Server (IIS) server role installed.
The server hosts a web app that connects to an on-premises Microsoft SQL Server database. You plan to migrate the web app to an Azure App Services web app. The database will remain on-premises. You need to ensure that the migrated web app can access the database. What should you configure in Azure?
The server hosts a web app that connects to an on-premises Microsoft SQL Server database. You plan to migrate the web app to an Azure App Services web app. The database will remain on-premises. You need to ensure that the migrated web app can access the database. What should you configure in Azure?
Correct Answer: C
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
Your network contains an Active Directory Domain Services (AD DS) domain.
The domain contains two users named User1 and User2 who are members of the Domain Admins group.
You need to harden security for the domain.
The solution must meet the following requirements:
Minimize risks associated with the Domain Admins group and privilege escalation on the domain.
Ensure that the built-in administrator account can perform forest recovery operations.
Reduce the attack surface of the Domain Admins group.
Follow the principle of least privilege.
How should you modify the Domain Admins group, and which user rights should you assign to the Domain Admins group?
To answer, drag the appropriate options to the correct requirements. Each component may be used once, more than once, or not at all.
NOTE: Each correct selection is worth one point.
Drag-and-Drop Options:
The domain contains two users named User1 and User2 who are members of the Domain Admins group.
You need to harden security for the domain.
The solution must meet the following requirements:
Minimize risks associated with the Domain Admins group and privilege escalation on the domain.
Ensure that the built-in administrator account can perform forest recovery operations.
Reduce the attack surface of the Domain Admins group.
Follow the principle of least privilege.
How should you modify the Domain Admins group, and which user rights should you assign to the Domain Admins group?
To answer, drag the appropriate options to the correct requirements. Each component may be used once, more than once, or not at all.
NOTE: Each correct selection is worth one point.
Drag-and-Drop Options:
Correct Answer:
Explanation:
For the Domain Admins group: Remove all accounts except for the built-in administrator account.
User rights:
Deny access to this computer from the network
Deny log on as a batch job
Deny log on as a service
Deny log on locally
Deny log on through Remote Desktop Services
Domain Admins is a highly privileged Active Directory group whose members can control domain infrastructure. Excessive membership increases the potential impact of credential theft and privilege escalation.
Microsoft recommends minimizing standing Domain Admin membership and retaining only the secured built- in Administrator account when required for recovery.
Removing User1 and User2 reduces unnecessary permanent administrative privileges.
Additional protection is achieved by configuring Group Policy user rights assignments that deny Domain Admins network, batch, service, local, and Remote Desktop sign-ins on member servers and workstations.
These restrictions prevent privileged credentials from being exposed on lower-trust systems.
The restrictions must be scoped appropriately; applying the same deny policies to domain controllers could interfere with essential administration and disaster recovery.
Therefore, the selected membership and deny-rights configuration matches Microsoft ' s privileged-access hardening guidance.
DC1 fails.
You need to meet the technical requirements for the schema master.
Yourunntdsutil.exe.
Which five commands should you run in sequence? To answer, move the appropriate commands from the list of commands to the answer area and arrange them in the correct order?
You need to meet the technical requirements for the schema master.
Yourunntdsutil.exe.
Which five commands should you run in sequence? To answer, move the appropriate commands from the list of commands to the answer area and arrange them in the correct order?
Correct Answer:
Explanation:
1. roles 2. connections 3. connect to server dc2.adatum.com 4. quit 5. seize schema master Because DC1 has failed and cannot gracefully transfer the schema master role, DC2 must forcibly seize it using ntdsutil.exe. From the initial ntdsutil prompt, the first command is roles, which enters the Role Management submenu where FSMO role transfers and seizures are performed. From within that submenu, the command connections opens the Connections submenu, which is required before you can bind ntdsutil to a specific target domain controller. Inside the Connections submenu, connect to server dc2.adatum.com establishes the bind to DC2, the domain controller that will actually take over the schema master role. The quit command then exits the Connections submenu and returns to the Role Management submenu while keeping the established connection to DC2 active. Finally, seize schema master, executed from the Role Management submenu while bound to DC2, forces DC2 to take ownership of the schema master role even though DC1 (the previous holder) is offline and cannot be contacted to confirm the transfer. The unused command in the list, metadata cleanup, is a separate, later step used to remove the failed DC1 ' s leftover directory metadata once its roles have been reassigned; it is not part of seizing the schema master role itself, so it is correctly left out of this five-step sequence.
You need to meet the technical requirements for Cluster2.
Which four actions should you perform in sequence before you can enable replication? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Which four actions should you perform in sequence before you can enable replication? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation:
1. Create an Azure Recovery Services vault. 2. Create a Hyper-V site. 3. Install and register Azure Site Recovery Providers. 4. Create and associate replication policies.
Setting up Azure Site Recovery for a Hyper-V cluster that is not managed by Virtual Machine Manager follows a fixed infrastructure-preparation order. An Azure Recovery Services vault must exist first, since it is the container that every later step registers against. A Hyper-V site is then created in that vault to represent the on-premises Hyper-V environment, because a Hyper-V host or cluster must belong to a site before its hosts can be registered against Azure Site Recovery. The Azure Site Recovery Provider is then installed on the Hyper-V hosts (Cluster2 ' s nodes) and registered to that site/vault, which is what actually connects the cluster nodes to Azure Site Recovery. Only once the hosts are registered can a replication policy be created and associated with the Hyper-V site, since a policy has nothing to attach to until the site and its registered hosts already exist. Installing Azure Connected Machine agents is unrelated to Hyper-V VM replication -- that agent is used for onboarding servers to Azure Arc -- and is not part of this workflow. Therefore, the correct order is: create the vault, create the Hyper-V site, install and register the Providers, and create and associate the replication policy.
0
0
0
10