AZ-802 Windows Server Administrator Practice Questions with Explanations
Free AZ-802 Windows Server Administrator practice questions with an explanation for every answer. Covers high availability, failover clustering, Hyper-V, storage, DFS, Group Policy, and server management.
Questions
Which two FSMO roles exist only once per forest?
- Schema master and domain naming master
- RID master and PDC emulator
- PDC emulator and infrastructure master
- RID master and infrastructure master
Which FSMO role is the authoritative time source for a domain and receives urgent password changes?
- PDC emulator
- RID master
- Infrastructure master
- Domain naming master
Admins suddenly can't create new users or groups on one DC, and errors mention the relative ID pool. Which role holder should you check?
- RID master
- Schema master
- PDC emulator
- Domain naming master
Which FSMO role must be available to add a new domain to the forest?
- Domain naming master
- RID master
- Infrastructure master
- PDC emulator
The DC holding the RID master role failed permanently and won't return. What should you do?
- Seize the role onto another DC
- Transfer the role normally from the failed DC
- Wait for the role to move by itself
- Restore the failed DC from an old backup and bring it online
A branch office has poor physical security and needs local logons. What should you deploy there?
- A read-only domain controller (RODC)
- A writable DC with BitLocker only
- A second PDC emulator for the branch
- A DHCP server with a long lease time
How do you control which user passwords are cached on an RODC?
- The Password Replication Policy
- A fine-grained password policy
- The Protected Users group
- A Group Policy loopback setting
A branch technician must manage an RODC's server locally but must not be a Domain Admin. What should you configure?
- Administrator role separation on the RODC
- Membership in Enterprise Admins
- A forest trust to the branch
- The Account Operators group in the domain
You deploy a DC on an Azure VM. Where should the NTDS database and SYSVOL be stored?
- A data disk with host caching set to None
- The temporary disk for best speed
- The OS disk with read/write caching
- An Azure Files share mounted over SMB from the DC
Two forests must share resources, and authentication should flow between every domain in both forests. Which trust fits?
- A forest trust
- An external trust
- A shortcut trust
- A realm trust
A Windows domain must trust a single domain in another forest, and the trust should not be transitive. Which trust fits?
- An external trust
- A forest trust
- A shortcut trust
- A parent-child trust
Users in two child domains of one large forest see slow authentication between them. What can shorten the path?
- A shortcut trust
- A realm trust
- An external trust
- Selective authentication
A forest trust should only let specific users access specific servers in your forest. What should you enable?
- Selective authentication
- SID history
- A shortcut trust
- Universal group caching
How does AD DS know which site a client computer belongs to?
- Its IP address matches a subnet linked to a site
- Its computer name prefix
- The DHCP server it used
- The OU the computer object is in, set by an administrator
What is the default replication interval on an AD DS site link?
- 180 minutes
- 15 minutes
- 60 minutes
- 24 hours
Which component automatically builds the AD replication topology between domain controllers?
- Knowledge Consistency Checker (KCC)
- Infrastructure master
- Global catalog
- DFS Namespaces
Which command gives a quick summary of replication health across all DCs?
- repadmin /replsummary
- gpresult /r
- ipconfig /all
- netsh int ip reset
In the AGDLP strategy, what are user accounts placed into first?
- Global groups
- Domain local groups
- Universal groups
- Local groups on each server
Which group scope can contain members from any domain in the forest and is listed in the global catalog?
- Universal
- Global
- Domain local
- Local
A service runs on four web servers and needs one account whose password AD changes automatically. Which account type fits?
- A group managed service account (gMSA)
- A standalone managed service account
- A normal user account with a long password
- The built-in Local System account on each
What must exist in the domain before you can create a gMSA?
- A KDS root key
- A fine-grained password policy
- An RODC in the site
- A forest trust
In what order are Group Policy Objects applied?
- Local, site, domain, then OU
- OU, domain, site, then local
- Domain, site, local, then OU
- Site, local, OU, then domain
A GPO at the domain level must apply even to OUs that block inheritance. What should you set on its link?
- Enforced
- Block inheritance
- Loopback processing
- Security filtering
A GPO should apply only to members of the Finance group within an OU. What should you configure?
- Security filtering
- Block inheritance
- WMI filtering by OS only
- Loopback processing
Kiosk computers must apply the same user settings no matter who signs in. What should you configure?
- Loopback processing in Replace mode
- Security filtering on users
- Block inheritance on the OU that holds the kiosk users
- An Enforced link at the domain
Which command shows which GPOs were applied to the current user and computer?
- gpresult /r
- gpupdate /force
- repadmin /showrepl
- dcdiag /test:dns
What is a key difference between Group Policy preferences and policy settings?
- Users can change preferences; policies are enforced
- Preferences only apply to domain controllers and member servers
- Policies can only target user settings
- Preferences can't map network drives
Where should you store ADMX templates so every admin uses the same versions?
- The central store in SYSVOL
- Each admin's local PolicyDefinitions folder
- The NETLOGON share on one server
- An Azure Files share
Which type of DNS record do clients use to locate domain controllers?
- SRV
- MX
- PTR
- TXT
Which group policy setting area configures mapping a drive letter to a department share?
- Group Policy Preferences, Drive Maps
- Security Settings, Account Policies, Password Policy
- Administrative Templates, System
- Software Restriction Policies
An RODC can replicate changes it receives from users back to writable domain controllers.
Which ports does PowerShell remoting (WinRM) use by default?
- 5985 for HTTP and 5986 for HTTPS
- 3389 for RDP and 22 for SSH
- 443 for HTTPS only
- 135 and 445
In a remote PowerShell session on Server A, a command can't access a share on Server B. What is this problem called?
- The double-hop problem
- DNS split-brain
- The RID pool problem
- Kerberos realm mismatch
What is the recommended secure fix for the PowerShell double-hop problem?
- Resource-based Kerberos constrained delegation
- Enabling CredSSP on every server
- Running all of the commands as a Domain Admin account
- Disabling Kerberos and using NTLM
Help desk staff should restart one service on servers through PowerShell without being admins. What should you use?
- Just Enough Administration (JEA)
- Membership in Domain Admins
- CredSSP delegation
- Remote Desktop with full admin
Which port does the OpenSSH server on Windows Server listen on by default?
- 22
- 3389
- 5985
- 445
Which agent must be installed to make an on-premises Windows Server an Azure Arc-enabled server?
- The Azure Connected Machine agent
- The MARS backup agent
- The Azure File Sync agent
- The Hyper-V integration services
You need to onboard 300 servers to Azure Arc with a script, without interactive sign-ins. What do you use?
- A service principal with onboarding rights
- A Domain Admin's personal account
- One interactive sign-in per server by a Global Administrator
- A storage account key
Once a server is Arc-enabled, which capability becomes available for it?
- Azure Policy and VM extensions
- Live migration into Azure VMs
- Automatic AD forest upgrades
- Free Azure VM compute hours
Patches for Azure and Arc-enabled servers should install on a schedule during maintenance windows. What should you use?
- Azure Update Manager maintenance configurations
- WSUS on every server individually
- A Group Policy loopback setting
- An RODC Password Replication Policy linked to each server's site
An Azure Automation runbook must run scripts against on-premises servers. What should you deploy?
- A Hybrid Runbook Worker
- A Bastion host
- An RODC
- A DHCP relay agent
Which Hyper-V feature enables clipboard sharing, drive redirection, and audio in a VM connection?
- Enhanced Session Mode
- Dynamic Memory
- Nested virtualization
- Hyper-V Replica
You need to run PowerShell inside a VM from the Hyper-V host, even though the VM has no network connection. What should you use?
- PowerShell Direct
- WinRM over HTTPS
- CredSSP delegation
- OpenSSH on port 22
You want to run Hyper-V inside a VM for a lab. What must you set while the VM is off?
- ExposeVirtualizationExtensions on the VM processor
- Dynamic Memory with a high buffer and a large maximum value
- Enhanced Session Mode on the host
- A private virtual switch
Which Hyper-V memory feature adjusts a VM's RAM between a minimum and maximum based on demand?
- Dynamic Memory
- NUMA spanning
- Smart paging only
- Memory weight
Which Hyper-V integration service lets you copy files into a VM with Copy-VMFile?
- Guest services
- Heartbeat
- Time synchronization
- Shutdown
A VM needs exclusive, direct access to a physical GPU or NVMe device. What should you use?
- Discrete Device Assignment (DDA)
- GPU partitioning
- Enhanced Session Mode
- A private virtual switch
Which checkpoint type uses VSS inside the guest and is the default in Hyper-V?
- Production checkpoints
- Standard checkpoints
- Differencing checkpoints
- Saved-state checkpoints
A VM must be copied asynchronously to another Hyper-V host for disaster recovery, without shared storage. What should you use?
- Hyper-V Replica
- Live migration
- Storage QoS
- Nested virtualization
What is a key advantage of VHDX over VHD?
- Support for disks up to 64 TB
- Compatibility with every older Hyper-V
- Smaller files for fixed disks
- No need for integration services