我々のGoShikenサイトは一番高質量のAZ-802試験資料と行き届いたアフタサービスを提供して協力します。Microsoft AZ-802問題集は試験の範囲を広くカバーして、試験の通過率は高いです。他のサイトと比較して、我が社のAZ-802試験問題集を購買すると決定します。商品の税金について、この問題を心配できません。顧客の利益を保証するために、税金は弊社の方で支払います。
| Section | Objectives |
|---|---|
| Disaster recovery and migration | - Migration scenarios
|
| Networking and storage infrastructure | - Storage management
|
| Secure Windows Server hybrid infrastructures | - Identity and access management
|
| Monitoring and troubleshooting | - System monitoring
|
| Manage hybrid compute and virtualization | - Virtual machines
|
| Implement and manage high availability | - Failover clustering
|
尊敬され、高い社会的地位を獲得することは、おそらくあなたが常に望んでいることです。しかし、それを達成したい場合は、特定の分野で優れた能力と深い知識を所有する必要があります。 AZ-802認定に合格すると、それが証明され、目標を実現するのに役立ちます。AZ-802クイズ準備を購入すると、AZ-802試験に合格できます。当社の製品は専門家によって編集され、長年の経験を持つ専門家によって承認されています。GoShiken購入前に、最新のAZ-802クイズトレントを無料でダウンロードして試用できます。
質問 # 371
Your network contains an Active Directory Domain Services (AD DS) domain. The functional level of the domain is Windows Server 2012 R2. The domain contains an account named Admin1 that is used for only domain administration. You need to secure Admin1 against credential theft. The solution must prevent the domain accounts from using NTLM authentication, credential delegation, and cached offline sign-in. What should you do?
正解：A
解説：
The Protected Users security group is a domain-level container, available starting at the Windows Server 2012 R2 domain functional level (which this domain already meets), whose members automatically have several credential-protection restrictions enforced on any Windows Server 2012 R2 or later, or Windows 8.1 or later, device they sign in to: NTLM authentication is blocked for the account (it can authenticate only with Kerberos), Kerberos long-term keys are not cached so offline/cached sign-in is not possible, and the account cannot be used as the source of any type of credential delegation (constrained or unconstrained), because its Kerberos TGT is issued without the flags delegation requires. Adding Admin1 to Protected Users therefore achieves all three stated requirements simultaneously with a single configuration change, and no additional GPO settings are required for these specific protections to take effect. An authentication policy that sets a custom TGT lifetime only changes how often the ticket must be renewed; it does nothing to block NTLM, delegation, or cached credentials. Marking the account as sensitive and cannot be delegated only blocks delegation, leaving NTLM use and cached offline sign-in fully possible. Disabling Allow Delegating Default Credentials for privileged workstations is a Credential Guard-related RDP/CredSSP setting scoped to specific client machines, not a domain account attribute, and does not address NTLM or offline caching for Admin1 account-wide.
質問 # 372
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains the domains shown in the following table.
You are implementing Microsoft Defender for Identity sensors.
You need to install the sensors on the minimum number of domain controllers. The solution must ensure that Defender for Identity will detect all the security risks in both the domains.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Exhibit
Exhibit
Exhibit
正解：
解説：
Explanation:
Microsoft Defender for Identity sensors capture and analyze authentication and directory traffic locally on each domain controller they are installed on, so detecting all security risks that touch either domain -- including risks involving the read-only domain controllers DC3 and DC6, which also process authentication traffic for their respective domains -- requires a sensor on every domain controller in the forest, DC1 through DC6, rather than only the PDC emulators or infrastructure masters; installing sensors on a subset would leave authentication traffic on the uncovered domain controllers unmonitored, creating a detection gap. Therefore the minimum number of domain controllers that still achieves full coverage of both domains is, in fact, all six
-- there is no smaller subset that captures every domain controller ' s local traffic. During each sensor ' s initial installation, it must be registered to the Defender for Identity workspace using the one-time access key that is generated and copied from the Microsoft Defender portal; after this initial registration, subsequent sensor-to- cloud communication is secured using certificates rather than requiring the access key, a gMSA, or a cloud- only Azure AD/Microsoft Entra user account again.
質問 # 373
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.
The functional level of the forest is Windows Server 2012 R2. All domain controllers run Windows Server
2012 R2. Sysvol replicates by using the File Replication Service (FRS). You plan to replace the existing domain controllers with new domain controllers that will run Windows Server 2022. You need to ensure that you can add the first domain controller that runs Windows Server 2022. Solution: You migrate sysvol from FRS to Distributed File System (DFS) Replication. Does this meet the goal?
正解：B
解説：
Beginning with Windows Server 2016, the File Replication Service binaries are no longer included in the operating system at all, so a domain controller running Windows Server 2016 or later -- including Windows Server 2022 -- cannot be promoted into a domain whose SYSVOL is still replicated using FRS; the promotion process itself checks for and blocks on this condition. Migrating SYSVOL replication from FRS to DFS Replication removes this exact blocker and is the documented, required prerequisite before introducing any Windows Server 2016, 2019, 2022, or 2025 domain controller into an environment that originally started on FRS-based SYSVOL replication. The migration itself progresses through a defined set of states -- Start, Prepared, Redirected, and finally Eliminated -- and once it reaches the Eliminated state, SYSVOL is fully served by DFS Replication and the FRS dependency is gone. At that point, the first Windows Server 2022 domain controller can be added to the forest successfully, so migrating SYSVOL to DFS Replication does meet the stated goal.
質問 # 374
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. You implement a central store. You create a new Group Policy Object (GPO) named GPO1. When you attempt to edit GPO1, you see that the " Administrative Templates: Policy definitions (ADMX files) retrieved from the central store " node shows only two settings (far fewer than the normal full set of Administrative Template settings). You need to ensure that all settings are available. Solution: You delete the \\contoso.
com\SYSVOL\contoso.com\Policies\PolicyDefinitions folder. Does this meet the goal?
Group Policy Management Editor showing limited Administrative Templates settings
正解：A
解説：
Windows does not automatically populate the Group Policy Central Store; an administrator creates the empty PolicyDefinitions folder in SYSVOL and must manually copy the full set of ADMX/ADML administrative template files into it. Once a Central Store exists, the Group Policy Management Editor exclusively displays the ADMX files that physically exist inside that Central Store -- it never falls back to using a workstation ' s local C:\Windows\PolicyDefinitions folder as long as the Central Store is present. The fact that only two settings appear means someone created the Central Store and copied in just a couple of custom ADMX
/ADML files (evidently ActiveX-related ones) but never copied in the full default Windows ADMX/ADML set, so this is fundamentally a content problem with the store, not a problem with GPO1 itself. Deleting the PolicyDefinitions folder entirely would cause the Group Policy Management Editor to fall back to whatever ADMX files exist locally on each individual administrator ' s own workstation -- which may vary in completeness from machine to machine and defeats the entire purpose of having a centralized, consistent store
-- rather than actually restoring the complete, intended set of settings in a centralized way. Therefore, deleting the Central Store ' s PolicyDefinitions folder does not meet the goal.
質問 # 375
Your network contains an Active Director/ Domain Services {AD DS) domain named contoso.com. The domain contains two sites named Site1 and Site2 and servers that run Windows Server and are configured as shown in the following table.
The domain contains a group named Group1 that contains Server3.
RODC1 has the Password Replication Policy shown in the following exhibit.
Exhibit
Exhibit
Exhibit
Exhibit
正解：
解説：
Explanation:
An RODC only caches (replicates) the password of a security principal that is explicitly permitted by its Password Replication Policy - in the exhibit, only members of the built-in Allowed RODC Password Replication Group and the custom Group1 are set to Allow, while Administrators, Account Operators, Backup Operators, Server Operators, and the Denied RODC Password Replication Group are all set to Deny.
A user who is not covered by an Allow entry authenticates through pass-through validation to a writable DC and never has credentials cached on the RODC, so User1 ' s credentials are not stored on RODC1, making statement 1 No. Because Server3 sits in Site2 alongside RODC1 and is a member of Group1 (an Allow entry), a user whose credentials are already cached there can still authenticate locally through RODC1 even if WAN connectivity to Site1 ' s writable domain controllers is lost, which is why User2 can sign in successfully during the outage, making statement 2 Yes. Interactive local sign-in to the RODC console itself is governed separately by the RODC ' s Administrator Role Separation (local Administrators group), not by the Password Replication Policy, and nothing in the scenario grants User3 that local logon right, so statement 3 is No.
質問 # 376
......
私たちの会社GoShikenは、10年以上にわたり、AZ-802テスト準備の開発と改善に重点を置いてきました。そのため、AZ-802試験の同様のコンテンツ資料のステレオタイプを勇敢に打ち破りつつ、AZ-802試験ガイドに試験の真の内容を追加しています。ですから、私たちは、おざなりな態度よりも助けを提供するという強い態度を持っています。最短時間でAZ-802試験に合格するのに役立ちます。
AZ-802基礎訓練: https://www.goshiken.com/Microsoft/AZ-802-mondaishu.html