There are many merits of our product on many aspects and we can guarantee the quality of our AZ-802 practice engine. Firstly, our experienced expert team compile them elaborately based on the real exam. Secondly, both the language and the content of our AZ-802 study materials are simple. The content emphasizes the focus and seizes the key to use refined AZ-802 Questions and answers to let the learners master the most important information by using the least practic. Three, we provide varied functions to help the learners learn our study materials and prepare for the exam.
| Section | Objectives |
|---|---|
| Topic 1: Manage hybrid compute and virtualization | - Containers
|
| Topic 2: Secure Windows Server hybrid infrastructures | - Identity and access management
|
| Topic 3: Networking and storage infrastructure | - Storage management
|
| Topic 4: Disaster recovery and migration | - Backup and restore
|
| Topic 5: Implement and manage high availability | - Load balancing and redundancy
|
| Topic 6: Monitoring and troubleshooting | - Diagnostics
|
The Microsoft AZ-802 exam questions are being offered in three different formats. These formats are Microsoft AZ-802 PDF dumps files, desktop practice test software, and web-based practice test software. All these three Microsoft AZ-802 Exam Dumps formats contain the real Administering Windows Server (AZ-802) exam questions that assist you in your AZ-802 practice exam preparation and finally, you will be confident to pass the final AZ-802 exam easily.
NEW QUESTION # 516
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft Sentinel instance. You add the Windows Firewall data connector in Microsoft Sentinel. You need to ensure that Microsoft Sentinel can collect Windows Firewall logs from Server1. Solution: You onboard Server1 to Microsoft Defender for Endpoint. Does this meet the goal?
Answer: B
Explanation:
Onboarding Server1 to Microsoft Defender for Endpoint enables endpoint detection and response telemetry, threat protection, and security recommendations for that specific device, but Defender for Endpoint is a separate security product from Microsoft Sentinel and does not configure Server1 as a log source for the Windows Firewall data connector. Onboarding to Defender for Endpoint installs its own sensor and forwards its own telemetry to the Microsoft 365 Defender portal and, when connected, to Sentinel through the Defender for Endpoint connector, but it does not deploy the Azure Monitor Agent or the data collection rule that the Windows Firewall connector specifically depends on to collect Windows Firewall event log entries from Server1. Because these are two independent data pipelines with different underlying agents and different data collection rules, onboarding Server1 to Defender for Endpoint has no effect on whether Windows Firewall logs specifically reach Sentinel through the Windows Firewall connector, so this solution does not meet the stated goal.
NEW QUESTION # 517
Your network contains an Active Directory Domain Services (AD DS) domain. The functional level of the domain is Windows Server 2016. All domain controllers run Windows Server 2025. You need to prevent cached credentials and older authentication protocols, such as NTLM, from being used by highly privileged user accounts. What should you do?
Answer: D
Explanation:
The Protected Users security group in Active Directory is specifically designed to strengthen authentication protection for sensitive and highly privileged accounts by having Windows apply a fixed set of hardening restrictions the moment an account becomes a member, without needing any custom Group Policy authoring or additional infrastructure. Members of Protected Users cannot authenticate by using NTLM, Digest authentication, or CredSSP at all, and their credentials are not cached on the computers they sign into in the same persistent way that ordinary user credentials are, directly satisfying the requirement to prevent cached credentials and legacy protocols from being used by these accounts. Kerberos authentication for Protected Users members is also hardened at the same time by preventing the use of weaker encryption types such as DES and RC4 and by disabling the ability to use a long-lived Kerberos ticket-granting-ticket renewal, further reducing the account ' s exposure to credential theft techniques such as pass-the-hash and pass-the-ticket attacks. The existing Windows Server 2016 domain functional level in this environment is already fully sufficient to support Protected Users functionality, so raising the functional level would accomplish nothing toward this goal. Enabling reversible password encryption would weaken credential security rather than improve it, and while an authentication policy silo is useful for restricting where specific privileged accounts are permitted to authenticate, it does not by itself provide the complete set of credential-caching and legacy- protocol protections that Protected Users membership delivers directly.
NEW QUESTION # 518
You have a server that runs Windows Server 2022 and has the network adapters shown in the following table:
LAN1 (Vendor1, 1 Gbps, RDMA: No), LAN2 (Vendor2, 25 Gbps, RDMA: Yes), LAN3 (Vendor3, 25 Gbps, RDMA: Yes), LAN4 (Vendor4, 1 Gbps, RDMA: No). You need to configure NIC teaming for LAN2 and LAN3. The solution must support Dynamic Virtual Machine Multi-Queue (d.VMMQ). What should you use?
Network adapter table
Answer: D
Explanation:
Switch Embedded Teaming (SET) is the only Windows Server NIC teaming technology that preserves each member adapter ' s RDMA capability and supports Dynamic VMMQ, because SET is implemented as an integrated capability of the Hyper-V virtual switch itself rather than as a separate teaming driver layered underneath it; this integration lets SET-teamed adapters continue to expose RDMA and advanced offloads such as d.VMMQ to the virtual switch and its VMQ/VMMQ queue allocation logic. The legacy NIC Teaming feature -- also called load balancing and failover (LBFO), which includes both static teaming mode and LACP teaming mode as configuration options -- sits below the virtual switch as a separate intermediate driver and explicitly does not support RDMA passthrough or Dynamic VMMQ on its member adapters; teaming LAN2 and LAN3 (both RDMA-capable, 25 Gbps adapters) with classic LBFO would strip their RDMA capability entirely, defeating both the RDMA benefit and the d.VMMQ requirement. Since LAN2 and LAN3 are both RDMA-capable adapters and the requirement explicitly calls for Dynamic VMMQ support, Switch Embedded Teaming is the only option among those listed that meets the requirement; static teaming mode and LACP teaming mode are simply LBFO configuration variants and share the same RDMA/d.VMMQ incompatibility.
NEW QUESTION # 519
Your network contains an Active Directory Domain Services (AD DS) domain. The functional level of the domain is Windows Server 2012 R2. The domain contains an account named Admin1 that is used for only domain administration. You need to secure Admin1 against credential theft. The solution must prevent the domain accounts from using NTLM authentication, credential delegation, and cached offline sign-in. What should you do?
Answer: B
Explanation:
The Protected Users security group is a domain-level container, available starting at the Windows Server 2012 R2 domain functional level (which this domain already meets), whose members automatically have several credential-protection restrictions enforced on any Windows Server 2012 R2 or later, or Windows 8.1 or later, device they sign in to: NTLM authentication is blocked for the account (it can authenticate only with Kerberos), Kerberos long-term keys are not cached so offline/cached sign-in is not possible, and the account cannot be used as the source of any type of credential delegation (constrained or unconstrained), because its Kerberos TGT is issued without the flags delegation requires. Adding Admin1 to Protected Users therefore achieves all three stated requirements simultaneously with a single configuration change, and no additional GPO settings are required for these specific protections to take effect. An authentication policy that sets a custom TGT lifetime only changes how often the ticket must be renewed; it does nothing to block NTLM, delegation, or cached credentials. Marking the account as sensitive and cannot be delegated only blocks delegation, leaving NTLM use and cached offline sign-in fully possible. Disabling Allow Delegating Default Credentials for privileged workstations is a Credential Guard-related RDP/CredSSP setting scoped to specific client machines, not a domain account attribute, and does not address NTLM or offline caching for Admin1 account-wide.
NEW QUESTION # 520
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server and store BitLocker recovery keys in AD DS. A server named Server1 starts in BitLocker recovery mode. You need to identify the BitLocker recovery key for Server1. Solution: You run repair-bde.exe by using a BitLocker key package exported from AD DS. Does this meet the goal?
Answer: B
Explanation:
repair-bde.exe is a disk-repair utility, not a lookup or reporting tool: its purpose is to attempt to decrypt or repair a corrupted BitLocker-protected volume when normal unlock methods have failed, and it accepts either a recovery password or a previously exported BitLocker key package (a file containing the actual encryption keys needed to decrypt sectors directly) as the credential it uses to perform that repair; running it does not display, output, or otherwise identify the volume ' s 48-digit numerical recovery password value to the administrator at all, and a key package is a different artifact from the recovery password that would actually need to be entered at Server1 ' s BitLocker recovery screen to unlock it through the normal recovery workflow. The stated goal is specifically to identify the recovery key, meaning to determine and retrieve its value, not to repair or decrypt a damaged volume using key material that must already have been exported in advance; even successfully running repair-bde with an exported key package would leave the administrator no closer to knowing what Server1 ' s recovery password actually is, and it does nothing to address a server that is simply sitting at the BitLocker recovery prompt waiting for a password rather than suffering from actual volume corruption. Because this solution does not retrieve or display the recovery key, it does not meet the stated goal.
NEW QUESTION # 521
......
AZ-802 offers free demo for AZ-802 real test. You can check out the interface, question quality and usability of our AZ-802 practice exams before you decide to buy it. You can download our AZ-802 test engine and install it on your phone or other device, then if you are waiting for the bus or on the subway, you can take AZ-802 Exam Dumps out for study. The promotion is regular, so please hurry up to get the most cost-effective Microsoft prep exam dumps.
AZ-802 Formal Test: https://www.pdfbraindumps.com/AZ-802_valid-braindumps.html