AZ-802 practice questions

Question 1

Litware is deploying two Windows Server 2025 virtual machines in Azure as additional domain controllers for its on-premises domain, which it reaches over a site-to-site VPN. Before promotion, the administrator must decide where each virtual machine will hold the AD DS database (NTDS.dit), its log files and SYSVOL. Which storage configuration should the administrator use?

Accepted Answer

A separate persistent data disk with its host caching set to None The Azure reference architecture for AD DS says to store NTDS.dit, the logs and SYSVOL on a separate persistent data disk, not on the operating system disk, and to set Host Cache Preference on that data disk to None. The ESE database engine behind AD DS manages its own write ordering, and host caching could interfere with database consistency. The same guidance calls for persistent managed OS disks and rules out ephemeral OS disks for domain controllers.

Question 2

Inside Contoso's HQ site, an identity provisioning tool writes changes to DC1 and then reads them from other HQ domain controllers. Testers see each change arrive about 15 seconds or more after it was written. The architect wants to view, and possibly shorten, how long DC1 waits before it notifies its same-site partners about changes to the domain partition. Which tool should you use?

Accepted Answer

repadmin /notifyopt against DC1 for the domain directory partition Learn's article on modifying the intra-site replication interval: after a domain controller writes a change, it waits 15 seconds by default before notifying its first intra-site partner, then pauses 3 seconds between further partners. The delays are the msDS-Replication-Notify-First-DSA-Delay and msDS-Replication-Notify-Subsequent-DSA-Delay attributes on the partition's crossRef object, and repadmin /notifyopt shows them and sets them with /first and /sub.

Question 3

In contoso.com, a domain in a forest that also contains eu.contoso.com, the global group Auditors contains contoso.com user accounts and the Internal-Audit global group. Auditors is a member of the Compliance-Staff global group and is granted Read on several contoso.com file shares. An administrator tries to change Auditors to universal scope so it can include eu.contoso.com users, and the change is refused. What blocks it?

Accepted Answer

Auditors is a member of Compliance-Staff, which is another global group. The scope conversion rule in the Active Directory security groups article is that a global group can be converted to universal scope only if it isn't a member of any other global group. Auditors belongs to Compliance-Staff, so the change is refused. Its own members don't block it, because a universal group can contain accounts and global groups from any domain in the same forest.

Question 4

Contoso and Fabrikam have a two-way forest trust. The contoso.com domain local group Proj-Readers contains several Fabrikam users. Last month Fabrikam deleted one of those user accounts. Now, on a contoso.com domain controller, Get-ADGroupMember -Identity Proj-Readers fails with "An unspecified error has occurred." What should the administrator do?

Accepted Answer

Delete the deleted account's foreign security principal from the ForeignSecurityPrincipals container in contoso.com. A member from another forest is represented in the local domain by a foreign security principal. The Get-ADGroupMember troubleshooting article explains that when the source account is deleted, the foreign security principal isn't updated or removed, and the SID that no longer resolves makes the cmdlet fail on the domain local group. Because the original account no longer exists, you can safely delete that foreign security principal, which also removes it from every group it belongs to.

Question 5

Contoso has a two-way forest trust with Fabrikam. After Fabrikam acquired Tailspin Toys, Fabrikam also created a two-way forest trust with the Tailspin Toys forest. Contoso engineers now need to open file shares on servers in the Tailspin Toys forest, but authentication from Contoso accounts to those servers fails. What should you do?

Accepted Answer

Create a forest trust between the Contoso and Tailspin Toys forest root domains Learn's How trust relationships work for forests in Active Directory states that forest trusts can only be created between two forests and can't be implicitly extended to a third: with trusts between Forest 1 and Forest 2 and between Forest 2 and Forest 3, Forest 1 has no trust with Forest 3, and those two forests need a trust of their own. Create a forest trust between the Contoso and Tailspin Toys root domains, at least one-way with Tailspin Toys trusting Contoso, in Active Directory Domains and Trusts, since netdom trust can't create a forest trust.

Question 6

Adatum links a GPO named Baseline-Security to the adatum.com domain. Administrators of the Research OU enabled Block Inheritance on that OU so that domain-linked GPOs stop reaching their computers. The security team now requires Baseline-Security to apply to every computer in the domain, including Research, while Research keeps blocking the other domain-linked GPOs. What should you do?

Accepted Answer

Set the Baseline-Security link on the domain to Enforced. The Group Policy processing article calls Enforced a link property and Block Inheritance a container property, and it says the enforced link takes precedence. An enforced link on the domain therefore still reaches computers in the Research OU, while the OU's Block Inheritance keeps stopping every domain-linked GPO that isn't enforced. Nothing about the Research OU has to change, which is what the requirement asks for.

Question 7

Someone stole RNO-RODC1 from Woodgrove Bank's Reno branch. Its Allowed list held the Reno-Staff group. Last month the administrator prepopulated passwords for three new hires who haven't signed in yet, and two employees who later moved to Seattle were removed from Reno-Staff after their passwords had been cached. Which accounts must have their passwords reset?

Accepted Answer

Every user and computer account on the Revealed list of RNO-RODC1, the accounts whose passwords it stores. Learn's Password Replication Policy guidance says that if an RODC is stolen you must reset the passwords of all users and computers whose passwords are cached on it, and that nothing erases a cached password; only a reset makes the stolen copy useless. The Revealed list records exactly those accounts, including prepopulated new hires who never signed in and staff removed from the Allowed group after caching. Get-ADDomainControllerPasswordReplicationPolicyUsage -RevealedAccounts lists them.

Question 8

Woodgrove Bank created a site named Branch7 and its subnet object, but the branch domain controller won't ship for a month. Branch7 belongs to two site links: Branch7-HQ with cost 100 and Branch7-East with cost 300. HQ and East both host writable domain controllers for the domain, and no DC Locator settings have been changed. Until the branch domain controller arrives, how will Branch7 clients find a domain controller?

Accepted Answer

A domain controller in HQ registers site-specific SRV records for Branch7, because HQ has the lowest-cost connection to it Learn's Site functions page describes client affinity: a domain controller works out the client's site from its IP address, and the client then queries site-specific SRV records. If no domain controller is located in the client's site, a domain controller with the lowest-cost connection relative to the other connected sites registers site-specific SRV records in that site, so every site has a preferred domain controller. The subnet places clients in Branch7, and HQ, at cost 100 against East's 300, covers Branch7.

Question 9

Contoso runs a gMSA named WebFarm whose PrincipalsAllowedToRetrieveManagedPassword lists the WebHosts group. An administrator adds the computer account of a new server, WEB04, to WebHosts and confirms the change has replicated to every domain controller. On WEB04, Test-ADServiceAccount -Identity WebFarm returns False. The three existing servers return True and must keep working. What should the administrator do next?

Accepted Answer

Restart WEB04 so that it gets a Kerberos ticket that reflects its new group membership. A Kerberos ticket lists the groups a computer belonged to when the ticket was issued, so a host added to an authorized group can't retrieve the gMSA password until it gets a new ticket. The gMSA troubleshooting guidance for domain-joined hosts says that if the host belongs to an authorized group but Test-ADServiceAccount still fails, restart it to obtain a ticket that reflects its current group memberships. Purging the computer's tickets with klist purge -li 0x3e7 has the same effect.

Question 10

In Fabrikam's single-domain forest, AUS-RODC1 is the Austin branch's RODC, global catalog and DNS server. Its Allowed list holds the Austin-Staff group, which contains every Austin user and workstation account, and those passwords were prepopulated. During a WAN outage, Austin users signed in but couldn't open shares on the branch file server AUS-FS1, whose computer account isn't on the Allowed list. What should the administrator do?

Accepted Answer

Add the AUS-FS1 computer account to the Austin-Staff group, then prepopulate its password on AUS-RODC1. Learn's Password Replication Policy guidance says the policy must include the appropriate user, computer and service accounts for an RODC to satisfy authentication and service ticket requests locally; when only users are allowed, the RODC relies on a writable domain controller for service tickets, which leads to an outage while the WAN is down. AUS-FS1's password isn't cached, so the RODC can't serve requests for it offline until its account is allowed and its password cached.

Question 11

Contoso's single-domain forest has four Windows Server 2025 domain controllers. DC1 and DC2 were upgraded in place from Windows Server 2022; DC3 and DC4 were newly installed and promoted over the network. Both functional levels are Windows Server 2016. Replication is healthy, and the backup software passed a lab test with 32k-page databases. Before enabling the Database 32k pages optional feature, what else must the administrator do?

Accepted Answer

Replace DC1 and DC2 with newly promoted Windows Server 2025 domain controllers, then raise the domain and forest functional levels to Windows Server 2025. The Database 32k pages article lists two requirements this forest doesn't meet yet: every domain controller must run Windows Server 2025 with a 32k page capable database, and both the domain and forest functional levels must be Windows Server 2025. Domain controllers upgraded in place keep their 8k page database, while one promoted over the network gets a 32k page capable database, so DC1 and DC2 must be replaced by fresh promotions, and both levels raised, before the feature can be enabled. Enabling the feature can't be undone.

Question 12

Adatum's single-domain forest has two domain controllers on Windows Server 2012 R2 and two on Windows Server 2019. Both functional levels are Windows Server 2012 R2, and SYSVOL already replicates with DFS Replication. The administrator must add Windows Server 2025 domain controllers, keep the 2019 ones and retire the 2012 R2 ones. What should the administrator do before promoting the first Windows Server 2025 domain controller?

Accepted Answer

Demote the two Windows Server 2012 R2 domain controllers, then raise the domain and forest functional levels to Windows Server 2016. Learn's functional level matrix supports a Windows Server 2025 domain controller at the Windows Server 2016 and 2025 levels but not at the Windows Server 2012 R2 level, and the 2016 level supports domain controllers from Windows Server 2016 through 2025. The levels can't move to 2016 while 2012 R2 domain controllers remain, so demote those first and then raise both levels. The 2016 level's other requirement, DFS Replication for SYSVOL, is already met.

Question 13

Fabrikam's single-domain forest has writable hub domain controllers that run Windows Server 2025 and are global catalog and DNS servers. A new Windows Server 2025 member server in a branch office must become an additional writable domain controller, but the branch reaches the hub over a slow, busy WAN link and the directory database is large. How should the administrator promote the server to keep replication over the link as low as possible?

Accepted Answer

On a hub domain controller, use ntdsutil's ifm menu to create media that includes SYSVOL, copy it to the branch, and promote with -InstallationMediaPath. Install from media seeds the new domain controller's database from local media, so only the objects changed since the media was created replicate over the network; Learn's IFM guidance presents this as the way to avoid replicating the entire directory over a WAN link. Build the media with ntdsutil's ifm menu or Windows Server Backup on a domain controller running the same operating system version, because IFM doesn't work across versions and can't create a domain's first domain controller.

Question 14

Adatum's forest has three domains: adatum.com, na.adatum.com and eu.adatum.com. Six account administrators, four with accounts in na.adatum.com and two in eu.adatum.com, must manage user objects in the Sales OU of all three domains. You want one group that contains all six administrators and is granted the delegated permissions in every domain. Which group should you create?

Accepted Answer

A universal security group The guidance on delegating administration of account OUs says that when the data administrators who receive control come from multiple domains, you must use a universal group, because universal groups can contain users from different domains and can be used to delegate control in multiple domains. A universal security group holds accounts from any domain in the forest and can be granted permissions in any domain of the forest, which covers all three Sales OUs.

Question 15

Tailspin Toys has a forest with two domains. A branch office with 60 users has one writable domain controller that isn't a global catalog, and a slow, busy WAN link to the hub site, which hosts global catalog servers. The branch runs no applications that need a global catalog. Users there report slow sign-ins, and management won't let the branch domain controller replicate a partial copy of every domain in the forest. What should you configure?

Accepted Answer

Enable universal group membership caching for the branch site. In a multi-domain forest, sign-ins need universal group membership from a global catalog. The global catalog placement guidance says that for a remote site with a limited WAN link, fewer than 100 users and no applications that require a global catalog, you can enable universal group membership caching in that site. The branch domain controller then caches users' universal group memberships, so sign-ins don't always cross the WAN to a hub global catalog.

Question 16

Woodgrove Bank administrators use Remote Desktop Connection on domain-joined admin workstations to connect directly to APP12, a member server in the same domain, and during each session they open \FS03\Reports as their own accounts. A new rule says their credentials must never be sent to APP12. APP12 already allows delegation of nonexportable credentials, and Kerberos works end to end. What should they use?

Accepted Answer

Remote Credential Guard, by connecting with mstsc /remoteGuard Remote Credential Guard redirects Kerberos requests back to the connecting device, so credentials and their derivatives are never passed to APP12, and the session keeps single sign-on to other systems such as FS03 as the signed-in user. It needs Kerberos, a direct connection and a remote host that allows delegation of nonexportable credentials, all of which the scenario meets.

Question 17

At Adatum, three administrators sometimes need Remote Desktop sessions open on MGMT02, a Windows Server 2025 member server, at the same time. Whenever two are already connected, the third can't get a session. No Remote Desktop Services role services are installed. What should you do so that all three can stay connected at once?

Accepted Answer

Install the Remote Desktop Session Host role service and license it with RDS CALs Without Remote Desktop Services role services, Windows Server allows two concurrent remote connections for administration, and those need no RDS CALs. Microsoft's article on troubleshooting Remote Desktop disconnected errors says that to allow more than two administrative connections, you must install the RD Session Host role and have appropriate RDS CALs, so the third concurrent administrator needs a licensed Session Host.

Question 18

Contoso wants Azure Update Manager to check every Arc-enabled Windows server in subscription Sub1, including servers onboarded later, for missing updates every 24 hours. Contoso doesn't want Update Manager to install anything yet. What should you do?

Accepted Answer

Assign the policy Configure periodic checking for missing system updates on Azure Arc-enabled servers to Sub1 for Windows, with a remediation task. Periodic assessment makes Update Manager check a machine for missing updates every 24 hours without installing anything. For Arc-enabled servers, the built-in policy Configure periodic checking for missing system updates on Azure Arc-enabled servers turns the setting on; Windows and Linux need separate assignments, the Create a remediation task option covers servers that already exist, and the assignment keeps applying to servers that join the scope later.

Question 19

Woodgrove Bank's payment servers are Arc-enabled. Security requires that only the Azure Monitor Agent and Microsoft Defender for Endpoint extensions can ever be installed on them, that extensions Microsoft publishes later are blocked automatically, and that no one in Azure, including subscription Owners, can install any other extension. What should you do?

Accepted Answer

On each server, run azcmagent config set extensions.allowlist with the publisher and type of the two extensions. Allow lists and block lists are set locally on each server with azcmagent config, so nobody in Azure, not even an Owner or Global Administrator, can get past them by installing an unauthorized extension. An allow list is exclusive: only the listed publisher and type pairs install, and anything else, including extensions released later, is blocked. The extensions security article also advises turning off guest configuration on such locked-down servers, because a custom machine configuration policy could change the agent settings.

Question 20

Adatum needs an Azure Automation runbook that runs on a Hybrid Runbook Worker group to check an import folder every 15 minutes, around the clock. Adatum wants to use only Azure Automation features, with no other Azure service. What should you do?

Accepted Answer

Create four hourly schedules whose start times are 15 minutes apart, and link all four to the runbook. The Azure Automation schedules article puts the most frequent interval a schedule can be configured for at one hour, and the portal's recurrence choices start at hours. The schedule API also lists a Minute frequency with a 15-minute minimum, but no option here uses it. The article gives two ways to run more often: create four hourly schedules that start within 15 minutes of each other, or call a webhook from Azure Logic Apps. Because Adatum rules out other Azure services, four staggered hourly schedules linked to the same runbook start it every 15 minutes, and each link can still send the job to the worker group.

Question 21

A Woodgrove Bank administrator's script runs Invoke-Command -ComputerName SRV22 with a script block that assigns recent System log events to $events, then runs a second Invoke-Command -ComputerName SRV22 whose script block filters $events. The second script block always finds $events empty. The administrator wants both script blocks to work with the same data on SRV22. What should the script do?

Accepted Answer

Create one session with New-PSSession and pass it to both calls with -Session With -ComputerName, Invoke-Command creates a temporary session for each call and closes it as soon as the command completes, so $events vanishes with the first session. The about_PSSessions topic says to use a PSSession when commands need to share data such as variable values: create it once with New-PSSession, then run both script blocks in it with -Session.

Question 22

Litware assigns a built-in machine configuration audit policy to a resource group that holds 30 Arc-enabled servers and 20 Azure VMs, all running Windows Server 2022 in one subscription. A day later, Azure Policy shows machine configuration results for every Arc-enabled server but none for the Azure VMs. What should you do so that the Azure VMs report?

Accepted Answer

Assign the Deploy prerequisites to enable Guest Configuration policies on virtual machines initiative to the group, with a remediation task. Azure VMs need the machine configuration extension and a system-assigned managed identity before any assignment can run. Arc-enabled servers need no extension, because the client ships inside the Connected Machine agent, and every Arc server already has a system-assigned identity, which is why only the Arc servers report. The Deploy prerequisites to enable Guest Configuration policies on virtual machines initiative adds the extension and a system-assigned identity, and a remediation task applies it to the VMs that already exist.

Question 23

Tailspin Toys needs an Azure Automation runbook that clears a staging folder and restarts a service on FS01 every night. FS01 is an Arc-enabled Windows Server 2022 file server in the company datacenter, and it accepts no inbound connections from the internet. What should you do?

Accepted Answer

Add FS01 to a Hybrid Runbook Worker group, which deploys the Hybrid Worker extension, and run the runbook on that group. A runbook in the Azure sandbox runs on the Azure platform and may not reach resources in an on-premises datacenter. The extension-based Hybrid Runbook Worker runs jobs directly on the machine that hosts it, against local resources, and on a non-Azure server it needs the Connected Machine agent and a system-assigned identity. Adding FS01 to a worker group installs the extension, and the Run on setting sends the job to that group.

Question 24

Contoso's new Azure Automation account runs a cloud runbook that stops development VMs every evening. The runbook must sign in to Azure without any stored secret or certificate, and its identity must be deleted automatically if the Automation account is deleted. What should you do?

Accepted Answer

Use the account's system-assigned managed identity: grant it a role on the VMs and call Connect-AzAccount -Identity. Run As accounts retired on September 30, 2023, and a new Automation account gets a system-assigned managed identity enabled. Once that identity holds a role on the target VMs, the runbook signs in with Connect-AzAccount -Identity, with no credential to store or rotate. A system-assigned identity shares the account's lifecycle, so Azure deletes it along with the account, which doesn't happen to a user-assigned identity.

Question 25

Adatum runs PRINT01, a clustered VM on a three-node Windows Server 2025 Hyper-V failover cluster. Twice this month the Print Spooler service inside PRINT01 stopped while the guest operating system kept running, and the cluster took no action. You need the cluster to watch that service and respond according to the VM resource's failover settings, for example by restarting the VM. What should you run?

Accepted Answer

Add-ClusterVMMonitoredItem -VirtualMachine PRINT01 -Service Spooler Add-ClusterVMMonitoredItem configures monitoring for a service, or for an Event Tracing for Windows event, on a virtual machine. When the monitored service fails, the cluster responds with the action set in the failover configuration for the VM resource, such as restarting the VM. Clustering PRINT01 already protects it against a node failure; monitoring the Spooler service adds a response to a failure inside the guest, which is the gap in this scenario.

Question 26

Tailspin Toys is setting up GPU partitioning on a two-node Windows Server 2025 Datacenter failover cluster. Both nodes have identical NVIDIA L4 GPUs with the vendor's GPU partitioning driver installed. In Windows Admin Center, the GPUs extension shows Paravirtualization in the Assigned status column for every GPU, and none shows Partitioned. What should the administrator do next?

Accepted Answer

Enable SR-IOV and virtualization support in each node's BIOS In Windows Admin Center's GPUs extension, Learn defines Paravirtualization as a GPU that has the partitioning driver capability installed while SR-IOV on the server isn't enabled, and says to continue the GPU partitioning workflow only when every GPU shows Partitioned. The host prerequisites in Partition and assign GPUs to a virtual machine include enabling virtualization support and SR-IOV in each server's BIOS, so that is the next step on both nodes.

Question 27

Contoso's VM SQL05 runs on a Windows Server 2025 Hyper-V host with dynamic memory set to startup RAM 8 GB, minimum RAM 4 GB and maximum RAM 16 GB. During month-end processing, SQL05's memory demand reaches the 16 GB ceiling while the host still has spare memory. SQL05 can't be restarted until next week. Which change should the administrator make now?

Accepted Answer

Raise SQL05's maximum RAM to 24 GB while it runs The Hyper-V Dynamic Memory overview lists the dynamic memory changes Hyper-V accepts while a VM is running: increase the maximum memory and decrease the minimum memory. SQL05 is pinned at its 16 GB maximum and the host has spare memory, so raising maximum RAM lets Hyper-V assign more as demand grows, with no restart. Startup RAM only sets the memory the VM needs to start, so it matters at the next boot, not during month-end.

Question 28

Tailspin Toys delegates Hyper-V work on HV03, a Windows Server 2025 host, without granting local Administrators rights. Operator Kai signs in to HV03 and runs Enter-PSSession -VMName WEB03 with valid credentials for WEB03, a running Windows Server 2025 VM on HV03. It fails with "The input VMName parameter doesn't resolve to any virtual machine." On HV03, Kai is a standard user and a member of Remote Management Users. What should a senior administrator do?

Accepted Answer

Add Kai's account to the Hyper-V Administrators group on HV03 PowerShell Direct requires the user to be signed in to the host as a Hyper-V administrator and to supply valid credentials for the guest. Learn's troubleshooting lists two causes for this VMName error: the user isn't a Hyper-V Administrator, or the VM doesn't exist. WEB03 is running on HV03 and Kai holds working guest credentials, so the missing piece is host-side Hyper-V rights. The Hyper-V Administrators group grants complete access to Hyper-V features without making Kai a local administrator.

Question 29

Contoso's training team needs 20 lab VMs on one Windows Server 2025 Hyper-V host. Every VM must start from the same sysprepped image, BASE.vhdx, the image must stay unchanged whatever students do in their VMs, and the lab must use as little host storage as possible. What should you create for each VM?

Accepted Answer

A differencing disk whose parent is BASE.vhdx A differencing disk is created from an existing parent disk, and changes made to it don't affect the parent, so BASE.vhdx stays a clean base image whatever students do. The Hyper-V storage I/O performance guide adds that a differencing file allocates space only for blocks written to it and reads every other block from the parent, so 20 children store far less than 20 full copies of the image would. New-VHD creates one with the -Differencing switch and -ParentPath naming the parent.

Question 30

Woodgrove Bank wants VM RENDER01 on standalone host HV06, which runs Windows Server 2025, to own an entire NVIDIA GPU through Discrete Device Assignment. The GPU vendor supplies no security mitigation driver. RENDER01 is shut down, uses static memory and already has enough MMIO space. $loc holds the GPU's PCIe location path and $id its PnP instance ID. Which sequence should the administrator run on HV06?

Accepted Answer

Set-VM -Name RENDER01 -AutomaticStopAction TurnOff, then Disable-PnpDevice -InstanceId $id, then Dismount-VMHostAssignableDevice -Force -LocationPath $loc, then Add-VMAssignableDevice -LocationPath $loc -VMName RENDER01 Learn's article on deploying graphics devices with DDA sets the order: configure the VM's automatic stop action to TurnOff, because a VM with an assigned device loses save and restore; disable the device in the host; dismount it with Dismount-VMHostAssignableDevice; then assign it with Add-VMAssignableDevice, naming the location path and the VM. With no vendor security mitigation driver, the dismount must include -Force to bypass the security warning, which changes the host's security profile, so DDA belongs with trusted tenants.

Question 31

Tailspin Toys deploys four Windows Server 2025 VMs with no public IP addresses into a subnet whose Default outbound access setting is disabled. The VMs reach each other but fail Windows activation and Windows Update. All outbound internet traffic from the subnet must leave from a single public IP address resource in Tailspin's subscription so a partner can allow-list it. What should you do?

Accepted Answer

Create a NAT gateway that uses one public IP address, and then associate the NAT gateway with the subnet. Learn's article on default outbound access says VMs in a private subnet need an explicit outbound method to reach public endpoints, and names Windows activation and Windows Update among the services that fail without one. Associating a NAT gateway with the subnet is the method Learn recommends for most scenarios. With one public IP address resource on the gateway, the subnet's outbound flows leave from that address, which Tailspin controls and the partner can allow-list.

Question 32

An administrator at Fabrikam turned on the Guest Service Interface integration service for VM FILE09 in Hyper-V Manager, then ran Copy-VMFile on the host to push a configuration file into FILE09, but the copy still fails. Inside FILE09, a hardening baseline had set the Hyper-V Guest Service Interface service's startup type to Disabled. What should the administrator do?

Accepted Answer

Inside FILE09, change the Guest Service Interface service from Disabled and start it Learn's Manage Hyper-V Integration Services page says each service must be enabled in both the host and the guest to work. Turning a service on in Hyper-V normally starts its guest service, and Hyper-V restarts one that's merely stopped, but if the service is disabled in the guest, Hyper-V is unable to start it. The host side is already on, so the fix is inside FILE09: clear the Disabled startup type on vmicguestinterface and start it, and Copy-VMFile can then deliver the file.

Question 33

PKI02, Contoso's offline root certification authority, is a Generation 2 Windows Server 2025 VM on Hyper-V host HV01, which also runs Windows Server 2025. PKI02 is disconnected from every network, and Remote Desktop is enabled inside it. Signed in at HV01, an administrator must sign in to PKI02 with a smart card in a USB reader attached to HV01, but VMConnect opens only a basic session and offers no local resources. What should the administrator do first?

Accepted Answer

Turn on Enhanced Session Mode Policy and Enhanced Session Mode in HV01's Hyper-V Settings Enhanced Session Mode reconnects VMConnect to the VM over RDP through the Hyper-V host, so a smart card, drive or USB device on the VMConnect computer can be used inside a VM that has no network path. Learn's requirements for using local resources: the host must have the Enhanced Session Mode Policy (under Server) and Enhanced Session Mode (under User) settings turned on, and the VM must run a recent Windows version with Remote Desktop Services enabled. PKI02, on Windows Server 2025 with Remote Desktop on, already meets the guest side, so the host settings come first; then Show Options, Local Resources and More expose smart cards.

Question 34

Six weeks ago, an Adatum administrator selected Scavenge stale resource records in the Aging properties of the Active Directory-integrated zone corp.adatum.com, keeping the default 7-day intervals. DC1 (10.0.0.10) hosts the zone, and no other aging or scavenging setting has changed on any DNS server. Records for laptops retired two months ago are still in the zone. What should the administrator do so that stale records are removed automatically?

Accepted Answer

Run Set-DnsServerScavenging -ScavengingState $true -ScavengingInterval 7.00:00:00 on DC1 Learn's DNS aging and scavenging article says both features are disabled by default and must both be enabled: scavenging deletes a record only when scavenging is on at the DNS server, aging is on for the zone, the record has a nonzero timestamp, and its timestamp plus the no-refresh and refresh intervals is earlier than the server time. The zone half is done, but no server runs scavenging passes. A ScavengingInterval above zero turns on server-level scavenging on DC1, one server per zone as Learn recommends, and completes the pair.

Question 35

Fabrikam is moving six Windows Server 2025 VMs from an on-premises /29 network, where they used host addresses .1 through .6, to a dedicated subnet in an Azure virtual network. Each VM gets one NIC with a static private IP address, and the network team wants the smallest subnet that holds all six. Which subnet size and host addresses should the administrator use?

Accepted Answer

A /28 subnet, assigning the VMs host addresses .4 through .9 The Azure Virtual Network FAQ says Azure reserves five addresses in every subnet: the network address, the next address for the default gateway, two more to map Azure DNS, and the last address for broadcast. The smallest supported IPv4 subnet, a /29, therefore leaves only three usable addresses. A /28 has 16 addresses and 11 usable ones, starting at .4, so .4 through .9 holds all six VMs in the smallest subnet that fits.

Question 36

Woodgrove Bank's DHCP scope for 10.10.2.0/24 leases 10.10.2.1 through 10.10.2.254. The network team keeps 10.10.2.1 through 10.10.2.30 for servers and printers whose static addresses are typed into each device, and it assigns new static devices from that block. Users now see duplicate address warnings. The devices must keep their static settings. What should the administrator do?

Accepted Answer

Add an exclusion range for 10.10.2.1 through 10.10.2.30 to the existing scope Learn's DHCP scopes article describes this conflict: when devices are configured by hand with addresses from a scope's range, you and the DHCP server can assign the same address to different devices. An exclusion range is a contiguous range within the scope that the server isn't allowed to use, and Learn says to use exclusions for all devices configured with a static IP address and to leave placeholder addresses for growth. Excluding 10.10.2.1 through 10.10.2.30 ends the overlap for today's static devices and the ones added later, while they keep their settings.

Question 37

Contoso's virtual network VNet-Prod uses 10.1.0.0/16 and has a route-based VpnGw2AZ gateway. Contoso acquired Litware, whose datacenter also uses 10.1.0.0/16, and needs a site-to-site VPN over which Litware servers and Azure VMs can each start connections to the other. Neither network can be re-addressed this year. What should the administrator configure on the VPN gateway?

Accepted Answer

Static IngressSNAT and EgressSNAT rules, both linked to the Litware connection Learn's NAT overview for Azure VPN Gateway says NAT connects on-premises networks to a virtual network with overlapping addresses, on VpnGw2 to VpnGw5 and VpnGw2AZ to VpnGw5AZ, and for IPsec site-to-site connections only. Its FAQ says a connection needs both ingress and egress rules when the on-premises space overlaps the virtual network's space. Dynamic NAT traffic must start from the internal mapping side, so letting both sides start connections calls for static 1:1 rules.

Question 38

Contoso moved DHCP for its branch clients to DHCP-AZ1, a Windows Server VM in an Azure virtual network reached over VPN. Following Microsoft's documented design, a Microsoft Loopback Adapter on DHCP-AZ1 has the static address 10.0.0.100, weak host send and receive and forwarding are enabled, and DHCP listens on 10.0.0.100. Branch relay agents forward to 10.0.0.100, but clients still get 169.254.x.x addresses. What should the administrator do?

Accepted Answer

Add 10.0.0.100 as a static secondary IP configuration on DHCP-AZ1's Azure network interface Learn's article on deploying a DHCP server in an Azure VM says that after you set the loopback adapter's address in Windows, you must add the same address as a secondary IP configuration on the VM's Azure network interface, a critical step that lets Azure route the unicast DHCP requests from the relay to the server. Every other step of that design is in place, so the missing NIC configuration is why relayed requests never arrive and clients fall back to APIPA.

Question 39

DC1 and DC2 host the Active Directory-integrated zone contoso.com. The research department now runs research.contoso.com on its own DNS servers, 10.5.0.10 and 10.5.0.11, and manages that zone itself. An administrator created a conditional forwarder for research.contoso.com on DC1 and DC2 that targets those servers, but clients that use DC1 and DC2 get NXDOMAIN for every research.contoso.com name. What should the administrator do?

Accepted Answer

Create a delegation for research in contoso.com that lists both research DNS servers Learn's DNS forwarding article explains that when a query name falls inside a zone the server hosts and no delegation applies, the server stays authoritative and returns an authoritative NXDOMAIN; it doesn't send that query to a conditional forwarder, a server-level forwarder or root hints. DC1 and DC2 host contoso.com, so the research.contoso.com forwarder is never consulted. A delegation for research in the parent zone creates the zone cut that refers those queries to the research servers.

Question 40

At Contoso, DHCP runs on DC1 and DC2, two domain controllers in a DHCP failover relationship. They register A and PTR records for clients in the Active Directory-integrated zone contoso.com, which allows only secure dynamic updates, and no DNS credentials are configured on either server. A security review flags that the DHCP service can update or delete any record in the zone. What should the administrator do?

Accepted Answer

Create a dedicated standard user account and configure both DHCP servers to use it for DNS dynamic updates Learn's Dynamic update article says a DHCP Server service installed on a domain controller inherits the domain controller's permissions, so it can update or delete any record in a secure Active Directory-integrated zone. Its fix is a dedicated standard user account whose credentials the DHCP servers use for dynamic updates, set in the DHCP console, with netsh dhcp server set dnscredentials or with Set-DhcpServerDnsCredential. The failover overview adds that both partners must use the same credentials.

Question 41

Litware's new network printer, PRN-04, is a DHCP client with MAC address F0-DE-F1-7A-00-5E. It must always receive 172.16.8.40 from scope 172.16.8.0, and administrators must be able to change that address later from the DHCP server without signing in to the printer. No reservation exists for it yet. Which command should the administrator run?

Accepted Answer

Add-DhcpServerv4Reservation -ScopeId 172.16.8.0 -IPAddress 172.16.8.40 -ClientId F0-DE-F1-7A-00-5E The Add-DhcpServerv4Reservation reference says the cmdlet reserves the specified address in the scope for a client, and once reserved, the address is leased only to the client with that client ID; for Windows clients the MAC address is the client ID. Learn's DHCP scopes article adds that reservations let you change a device's address without signing in to it, as long as the device uses DHCP. No reservation exists yet, so one has to be added.

Question 42

Malware on some Woodgrove Bank workstations queries names under contosomalicious.com. The Windows Server 2025 DNS servers must drop every query for names under that domain without sending any response, so the clients time out, and must keep answering all other queries normally. Which command should the administrator run on each DNS server?

Accepted Answer

Add-DnsServerQueryResolutionPolicy -Name 'BlockBad' -Action IGNORE -FQDN 'EQ,*.contosomalicious.com' The Add-DnsServerQueryResolutionPolicy reference says that when a server-level policy matches, IGNORE drops the query while DENY still returns an error response, and Learn's query filter article adds that IGNORE sends no response at all, so the client times out. EQ,*.contosomalicious.com matches the names under that domain suffix, while Learn's allow-list examples use NE to act on every name that doesn't match. Server-level policies are evaluated before zone-level ones.

Question 43

Fabrikam is creating a new SMB Azure file share for an engineering archive. The share must run on HDD media, keep a copy in a secondary region through geo-zone-redundant storage (GZRS), and let the storage administrator set IOPS and throughput separately from capacity. Which storage account should the administrator create to hold the share?

Accepted Answer

A FileStorage account with the StandardV2_GZRS SKU Setting IOPS and throughput apart from capacity is the provisioned v2 billing model, and the Understand Azure Files billing page lists HDD provisioned v2 classic file shares as a FileStorage account with a StandardV2 SKU. HDD provisioned v2 supports local, zone, geo and geo-zone redundancy for SMB, so StandardV2_GZRS meets every requirement. Learn also recommends provisioned v2 for all new Azure Files deployments.

Question 44

Contoso's file server FS2 runs Windows Server 2025. A 4 TB data disk on it was initialized with the MBR partition style and holds one 1.5 TB NTFS volume with 900 GB of data. Disk Management shows the rest of the disk as two separate unallocated sections, and the section past the 2 TB mark can't be used. Management wants all 4 TB available as one volume. What should you do?

Accepted Answer

Back up the data, delete the volume, convert the disk to GPT, then create one volume and restore Microsoft's page on converting a disk to GPT or MBR says MBR is limited to disks of 2 TB or smaller and that a disk's partition style can change only when the disk holds no partitions or volumes. The support article on disks larger than 2 TB adds that on an MBR disk Windows can partition only the first 2 TB. So the data comes off, the volume is deleted, the disk becomes GPT, and one new volume spans all 4 TB.

Question 45

FS6, a Windows Server 2025 file server at Fabrikam, hosts 40 shares, and no share or client requires SMB encryption today. Data on the Payroll share crosses a carrier-managed WAN and must be protected from eavesdropping in transit. The other shares serve large engineering files, and their CPU overhead must not rise. Every client supports SMB 3.1.1. What should the administrator run on FS6?

Accepted Answer

Set-SmbShare -Name Payroll -EncryptData $true Learn's SMB security enhancements page says SMB Encryption protects data from eavesdropping on untrusted networks and can be enabled per share, for the entire file server or when mapping drives. Set-SmbShare -Name Payroll -EncryptData $true encrypts only that share's traffic, so the engineering shares avoid the performance cost Learn says comes with any end-to-end encryption. Every client runs SMB 3.1.1, so none is rejected for lacking encryption support.

Question 46

Tailspin Toys hosts three SQL Server VMs for one customer on a Hyper-V cluster that keeps VHDX files on a Scale-Out File Server running Windows Server 2025. Each VM has one data VHDX, and all three use a Dedicated Storage QoS policy named Gold with a 2,000 IOPS maximum. The new contract caps the three disks together at 6,000 IOPS, and one busy disk may use all 6,000 while the other two are idle. What should you do?

Accepted Answer

Create an Aggregated policy with a 6,000 IOPS maximum and assign it to all three VHDX files The Storage QoS overview defines an Aggregated policy as one whose minimum and maximum are shared by every VHDX assigned to it, while a Dedicated policy applies its limits to each VHDX separately. It also states that a policy's type can't be changed after it's created. A new Aggregated policy from New-StorageQosPolicy, assigned with Set-VMHardDiskDrive -QoSPolicyID, caps the three disks at 6,000 IOPS combined and lets one disk use the whole allocation.

Question 47

Contoso's domain-based namespace uses lowest cost ordering, and from every branch site HQ is the lowest-cost site. The folder \contoso.com\Apps\Tools has targets on HQ-FS1 and HQ-FS2 in the HQ site and on BR1-FS in the Branch1 site. Branch1 clients must keep using BR1-FS first. All other clients must go to HQ-FS1 and reach HQ-FS2 only when HQ-FS1 is unavailable. What should the administrator configure?

Accepted Answer

Set the priority of the HQ-FS1 folder target to First among targets of equal cost Learn's page on overriding referral ordering says First among targets of equal cost refers users to that target before other targets of equal cost, which usually means other targets in the same site. HQ-FS1 and HQ-FS2 share the HQ site, so any client sent to HQ gets HQ-FS1 first and HQ-FS2 next. Branch1 clients are unaffected, because referrals always list targets in the client's own site first, and lowest cost ordering then puts HQ ahead of Branch1 for every other branch.

Question 48

Woodgrove Bank runs a two-node Storage Spaces Direct cluster on Windows Server 2025 Datacenter with a file share witness. Each node has two NVMe cache drives and six SSD capacity drives, and the current volumes use two-way mirror. Because failed drives take days to replace, volumes must stay online while one node is down for patching and a capacity drive fails in the other node, with as much usable capacity as possible. What should you do?

Accepted Answer

Create new nested mirror-accelerated parity volumes, move the data, then delete the old volumes The nested resiliency article says it fits clusters of exactly two servers on Windows Server 2019 or later and keeps volumes online when a server is down and a drive fails. Nested two-way mirror writes four copies for 25 percent efficiency, while nested mirror-accelerated parity reaches about 35 to 40 percent, so it keeps more usable space. The article's FAQ adds that volumes can't be converted between resiliency types, so new volumes are created and the data moved.

Question 49

Litware stores the VHDX files of its pooled VDI desktops on an NTFS-formatted Cluster Shared Volume of FSC1, a two-node Scale-Out File Server cluster running Windows Server 2025. Separate Hyper-V hosts run the desktops, and the VHDX files stay open while users work. You must enable Data Deduplication for that volume. What should you do?

Accepted Answer

Install Data Deduplication on both nodes, then enable the volume with the Hyper-V usage type The Data Deduplication install page requires the feature on every node of a failover cluster that runs deduplication and tunes the Hyper-V usage type for VDI servers. That usage type optimizes in-use and partial files, while Default skips in-use files and would leave open desktop disks unoptimized. Enable-DedupVolume -UsageType HyperV applies it.

Question 50

Fabrikam replicates a CAD folder between FS-HQ and FS-PLANT with DFS Replication. The 32 largest drawings in the folder total about 60 GB, and both memberships still use a staging quota of 4,096 MB. FS-PLANT logs event 4208 several times a day, and large drawings reach it hours late. What should the administrator do?

Accepted Answer

Raise the staging quota on both memberships to at least 61,440 MB with Set-DfsrMembership Learn's article on the minimum staging area DFSR needs says the staging quota must be as large as the 32 largest files in the replicated folder, and that event 4208 means staging use is still above the quota after cleanup ran, an abnormal state that needs intervention. A 4,096 MB quota against about 60 GB of large drawings forces constant purging and restaging. Set-DfsrMembership -StagingPathQuotaInMB sets the new size, which applies without a service restart once AD replication and DFSR polling pick it up.

Question 51

Adatum's iSCSI Target Server SAN1 runs Windows Server 2025 and presents a LUN to the iSCSI initiator on SQL4 through the target SQLT. Security requires two controls: SAN1 must accept a login only from an initiator that proves it knows a shared secret, and SQL4 must confirm it is connected to the genuine SAN1 before it uses the LUN. What should you configure?

Accepted Answer

Enable CHAP and reverse CHAP on SQLT, then configure SQL4's initiator with the matching secrets The Diskraid command reference describes both directions: the target's secret is used for CHAP authentication when the target authenticates the initiator, and the initiator's secret is used for mutual CHAP when the initiator authenticates the target. Meeting both controls takes both, which on iSCSI Target Server means Set-IscsiServerTarget with -EnableChap and -Chap plus -EnableReverseChap and -ReverseChap, and matching secrets on SQL4.

Question 52

Adatum replicates the Projects folder between FS-NYC and FS-LON with DFS Replication, and both memberships use default settings. At 09:00 a user on FS-LON deleted the Bids subfolder, and the deletion replicated to FS-NYC within minutes. At 10:00 the manager asks for Bids back. No recent backup exists, and neither member's ConflictAndDeleted folder has reached its quota. What should the administrator do?

Accepted Answer

On FS-NYC, run Restore-DfsrPreservedFiles with the ConflictAndDeletedManifest.xml file The Set-DfsrMembership reference says that when RemoveDeletedFiles is left at its default, a member moves deleted files and folders to its ConflictAndDeleted folder as the deletion replicates inbound, and that the originating server always deletes files without preservation. FS-LON originated the delete, so only FS-NYC kept Bids. Restore-DfsrPreservedFiles restores conflicted and deleted items from ConflictAndDeletedManifest.xml; PreExistingManifest.xml covers files set aside during initial sync.

Question 53

Woodgrove Bank's branch staff sign in to Microsoft Entra joined Windows 11 laptops as hybrid users that Microsoft Entra Connect Sync syncs from AD DS. The branches reach a storage account's private endpoint but have no network path to any domain controller. Staff must mount SMB Azure file shares with their own identities by using Kerberos. Which identity source should the administrator enable on the storage account?

Accepted Answer

Microsoft Entra Kerberos authentication for the hybrid identities With Microsoft Entra Kerberos, Microsoft Entra ID issues the Kerberos tickets, so Microsoft Entra joined or hybrid joined clients can authenticate to Azure Files without reaching a domain controller. The identity-based authentication overview lists it for hybrid or cloud-only identities and for clients without domain controller connectivity, which fits branches that can reach only the storage account's private endpoint.

Question 54

Adatum upgraded APP2 from Windows Server 2022 to Windows Server 2025. A scheduled job on APP2 copies files with a service account to a share on a third-party NAS that supports SMB 3 but has its signing setting turned off. Since the upgrade every copy fails with STATUS_INVALID_SIGNATURE, while servers still on Windows Server 2022 reach the share. Security policy forbids weakening APP2's SMB client defaults. What should the administrator do?

Accepted Answer

Turn on SMB signing in the NAS's own SMB settings and leave APP2 unchanged Learn's Control SMB signing behavior page says Windows Server 2025 requires outbound SMB signing, and that connecting to a third-party server that doesn't allow signing fails with STATUS_INVALID_SIGNATURE. Its resolution is to adjust the third-party server to allow signing, and it doesn't recommend disabling signing on Windows as a workaround. APP2 is the client here, and before Windows Server 2025 signing was required only toward SYSVOL and NETLOGON on domain controllers, which is why the older servers still connect.

Question 55

Fabrikam built a new forest whose domain controllers all run Windows Server 2025. A badge appliance's simple LDAP binds over TCP 389 without TLS fail. Security approves accepting unsigned binds for 30 days until the vendor ships a fix. An administrator set Domain controller: LDAP server signing requirements to None in the Default Domain Controllers Policy and ran gpupdate /force on every DC, but the binds still fail. What should you do next?

Accepted Answer

Set Domain controller: LDAP server signing requirements enforcement to Disabled in the same GPO. The LDAP signing Group Policy article says new Windows Server 2025 deployments require signing through a separate policy, Domain controller: LDAP server signing requirements enforcement. Not Configured has the same effect as Enabled, and the enforcement policy takes precedence over Domain controller: LDAP server signing requirements, so None changes nothing while enforcement is on. Disabled hands the decision back to the signing requirements policy, which then accepts unsigned binds. Turn enforcement back on once the appliance is fixed.

Question 56

Fabrikam's forest has a root domain, fabrikam.com, and a child domain, sales.fabrikam.com. An application installed in sales.fabrikam.com needs a one-time schema extension next week, run by an engineer whose admin account is in fabrikam.com. The Schema Admins group has no members today. What should you do?

Accepted Answer

Add the engineer's admin account to Schema Admins in fabrikam.com for the change window, then remove it. Only members of Schema Admins can modify the schema, and the group exists only in the forest root domain. Because schema changes are rare, the Schema Admins remediation guidance says to keep the group empty, add an account only when a schema change is required, and remove it afterward; the Active Directory attack surface guidance likewise calls for populating it only temporarily. Time-boxed membership in fabrikam.com's Schema Admins gives the engineer exactly what the change needs.

Question 57

Litware's HR sync account has delegated permission to write the telephoneNumber attribute on user objects in the Staff OU. It updates every account there except the six that are members of Domain Admins. An administrator added the same permission directly to those six accounts, but within an hour it was gone. The sync must keep updating all six accounts. What should the administrator do?

Accepted Answer

Add the permission to the ACL of the AdminSDHolder object in the domain's System container. Members of protected groups such as Domain Admins take their security descriptor from the AdminSDHolder object. SDProp runs every 60 minutes by default on the PDC emulator, resets any protected account whose permissions differ from that template, and keeps inheritance off on protected objects. The Active Directory security groups reference says that to change permissions on a protected group or its members, you modify the security descriptor on AdminSDHolder, knowing the change reaches every protected account and group in the domain.

Question 58

Fabrikam is moving fully updated Windows Server 2022 member servers from legacy Microsoft LAPS to Windows LAPS and has uninstalled the legacy client-side extension from them. The legacy LAPS GPO, still linked to their OU, sets a 20-character password and a 14-day maximum age. A new Windows LAPS GPO on the same OU configures only the backup directory, set to Active Directory. Which password settings will Windows LAPS apply?

Accepted Answer

A 14-character password with a 30-day maximum age Windows LAPS checks its policy roots in order (CSP, Group Policy, local configuration, then legacy Microsoft LAPS) and uses the first root that holds at least one setting. The Windows LAPS GPO sets the backup directory, so the Group Policy root wins and the legacy root is ignored. Settings are never shared or inherited across roots, so every setting the GPO omits takes its default: PasswordLength 14 and PasswordAgeDays 30, per Configure policy settings for Windows LAPS.

Question 59

On a Windows Server 2025 application server, an administrator applied Microsoft's default App Control policies in enforcement mode with Set-OSConfigDesiredConfiguration. A vendor agent was blocked, so the administrator removed both policies with CiTool, and the agent started. Hours later the agent is blocked again. The policies must stay off until a supplemental policy is ready. What should the administrator do?

Accepted Answer

Run Remove-OSConfigDesiredConfiguration for both AppControl\WS2025 scenarios, DefaultPolicy\Enforce and AppBlockList\Enforce OSConfig keeps the App Control policies it applies under drift control. Removing them manually or with citool.exe makes drift control reestablish them after its refresh period, four hours by default, which is why the agent is blocked again. Configure App Control for Business by using OSConfig recommends removing OSConfig-set policies with OSConfig: Remove-OSConfigDesiredConfiguration with the two AppControl\WS2025 Enforce scenarios, after which citool -lp lists no WS2025 policies.

Question 60

The woodgrove.com and fabrikam.com forests share a two-way trust and one Microsoft Entra tenant. Two woodgrove.com member servers run the Microsoft Entra Password Protection proxy service, registered along with the woodgrove.com forest. All writable DCs in both forests run the DC agent and have restarted; fabrikam.com also has two RODCs. Banned passwords fail in woodgrove.com but succeed in fabrikam.com. What should you do?

Accepted Answer

Install the proxy service on two member servers in fabrikam.com, register both proxies, and then register the fabrikam.com forest. The Password Protection deployment guide says each proxy can support only the domain controllers of the forest it's joined to, and the software in one forest is unaware of any other forest's deployment, whatever trusts exist. Each forest is set up on its own: install the proxy service on member servers in fabrikam.com (two for redundancy), register each with Register-AzureADPasswordProtectionProxy, and run Register-AzureADPasswordProtectionForest once for fabrikam.com, which needs Enterprise Admins rights in that forest. The agents on its writable DCs can then get the tenant's policy.

Question 61

Woodgrove Bank's Azure subscription hosts 200 Windows Server VMs. The security team needs just-in-time VM access on 12 of them and doesn't want to pay for Defender for Servers on the other 188. How should the administrator configure Defender for Servers?

Accepted Answer

Enable Plan 2 on the subscription, and then disable Defender for Servers on the 188 VMs that don't need it Just-in-time VM access is a Plan 2 feature. Plan 2 can be enabled only for a whole subscription, but either plan can be disabled for an individual resource, so covering just the 12 VMs means enabling Plan 2 on the subscription and turning Defender for Servers off on the VMs that don't need it. The deployment scope table in the Defender for Servers overview sets out these limits.

Question 62

An administrator at Contoso tuned exploit protection on a reference Windows Server 2025 server and must apply the same system and program settings to 120 domain-joined servers through Group Policy. Every server can read a file share on FS01. What should the administrator do?

Accepted Answer

Export the settings with Get-ProcessMitigation -RegistryConfigFilePath to the FS01 share, then enable Use a common set of exploit protection settings with that UNC path Exploit protection exports one device's configuration, system and program settings together, from Windows Security (Export settings) or with Get-ProcessMitigation -RegistryConfigFilePath. Group Policy then deploys it through Use a common set of exploit protection settings, under Windows Components, Microsoft Defender Exploit Guard, Exploit protection, which takes a local, UNC or URL path. The Import, export, and deploy exploit protection configurations article requires the file to sit where every target device can reach it, hence the FS01 share.

Question 63

Tailspin Toys, whose domain runs at the Windows Server 2016 functional level, ran Update-LapsADSchema in its forest and linked a GPO to the Servers OU that sets the Windows LAPS backup directory to Active Directory. The Windows Server 2025 member servers in that OU process the policy, but none of them manages to store its managed password in AD DS. Which command should the administrator run?

Accepted Answer

Set-LapsADComputerSelfPermission -Identity Servers A device that Windows LAPS manages writes its own password to its computer object, so it needs permission to update those attributes. Set-LapsADComputerSelfPermission grants that permission as inheritable permissions on the OU that holds the devices, here the Servers OU. The schema update, a one-time step per forest, is already done, the 2016 functional level supports password encryption, and the read and expiration permissions serve people who retrieve or expire passwords, not the devices, per Get started with Windows LAPS and Windows Server Active Directory.

Question 64

On SRV-WEB2, a member server running Windows Server 2025, an application keeps connecting to the old address of app01.contoso.com after the DNS record was updated. On SRV-WEB2, Resolve-DnsName app01.contoso.com returns the old address 10.1.9.14, while Resolve-DnsName app01.contoso.com -NoHostsFile returns the new address 10.1.5.20. What should the administrator do to fix name resolution on SRV-WEB2?

Accepted Answer

Remove the app01 entry from the Hosts file on SRV-WEB2 The Windows DNS client resolves a name by checking its cache, then the Hosts file in C:\Windows\System32\drivers\etc, and only then sending the query to a DNS server; the DNS queries and lookups article adds that Hosts file mappings are loaded into the resolver cache when the DNS Client service starts. -NoHostsFile skips the Hosts file, so its correct result proves the DNS path is healthy and the stale mapping lives in the Hosts file. Removing that entry is the fix.

AZ-802 practice questions, with full explanations

The AZ-802 bookshelf

Work the 75 questions, one topic at a time

Deploy and manage AD DS (15 questions)

Manage Windows Server instances and workloads in a hybrid environment (9 questions)

Contoso wants Azure Update Manager to check every Arc-enabled Windows server in subscription Sub1, including servers onboarded later, for missing updates every 24 hours. Contoso doesn't want Update Manager to install anything yet. What should you do?

Adatum needs an Azure Automation runbook that runs on a Hybrid Runbook Worker group to check an import folder every 15 minutes, around the clock. Adatum wants to use only Azure Automation features, with no other Azure service. What should you do?

Tailspin Toys needs an Azure Automation runbook that clears a staging folder and restarts a service on FS01 every night. FS01 is an Arc-enabled Windows Server 2022 file server in the company datacenter, and it accepts no inbound connections from the internet. What should you do?

Contoso's new Azure Automation account runs a cloud runbook that stops development VMs every evening. The runbook must sign in to Azure without any stored secret or certificate, and its identity must be deleted automatically if the Automation account is deleted. What should you do?

Manage virtual machines (9 questions)

Implement and manage an on-premises and hybrid networking infrastructure (9 questions)

Manage storage and file services (12 questions)

Secure Windows Server infrastructure (9 questions)

Woodgrove Bank's Azure subscription hosts 200 Windows Server VMs. The security team needs just-in-time VM access on 12 of them and doesn't want to pay for Defender for Servers on the other 188. How should the administrator configure Defender for Servers?

An administrator at Contoso tuned exploit protection on a reference Windows Server 2025 server and must apply the same system and program settings to 120 domain-joined servers through Group Policy. Every server can read a file share on FS01. What should the administrator do?

Monitor and troubleshoot Windows Server environments (12 questions)

On a Windows Server 2025 file server, an administrator wants System Insights to run C:\Scripts\Expand-DataVolume.ps1 automatically, but only when a forecast predicts that one of the server's volumes will exceed its capacity within the next 7 days. What should the administrator configure?

Other certification question sets