Our company is responsible for our AZ-802 exam cram. Every product we have sold to customer will enjoy considerate after-sales service. If you have problems about our AZ-802 test guide such as installation, operation and so on, we will quickly reply to you after our online workers have received your emails. We are not afraid of troubles. We warmly welcome to your questions and suggestions. Now that you have spent money on our AZ-802 Exam Questions, we have the obligation to ensure your comfortable learning. We do not have hot lines. So you are advised to send your emails to our email address. In case you send it to others’ email inbox, please check the address carefully before. The after-sales service of our AZ-802 exam questions can stand the test of practice. Once you trust our products, you also can enjoy such good service.
| Section | Weight | Objectives |
|---|---|---|
| Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments | 20% | - Implement and manage Group Policy Objects - Install and configure domain controllers - Integrate AD DS with Azure AD and Azure Arc - Manage FSMO roles and replication |
| Manage virtual machines and containers | 15% | - Deploy and manage Hyper-V virtual machines - Configure Azure Arc-enabled servers and VMs - Deploy and manage containers and Kubernetes on Windows Server |
| Manage Windows Servers and workloads in a hybrid environment | 20% | - Deploy servers using Windows Admin Center and Azure Arc - Implement hybrid identity solutions - Manage updates and patches across hybrid servers - Configure remote management and secure administration |
| Secure Windows Server on-premises and hybrid infrastructures | 10% | - Configure Windows Defender and audit policies - Manage access control and permissions - Implement security baselines and hardening |
| Implement high availability and disaster recovery | 5% | - Configure failover clustering - Implement backup and recovery solutions - Use Azure Site Recovery for hybrid workloads - Monitor and troubleshoot Windows Server environments - Perform server and workload migrations |
| Implement and manage an on-premises and hybrid networking infrastructure | 15% | - Implement hybrid network connectivity - Configure IP addressing, DNS, and DHCP - Configure software-defined networking - Secure network traffic in hybrid environments |
| Manage storage and file services | 15% | - Integrate on-premises storage with Azure Storage - Implement Storage Spaces and Storage Spaces Direct - Configure file servers and shares - Configure data deduplication and replication |
It's time to take the Microsoft AZ-802 practice test for self-assessment once you have prepared with AZ-802 PDF questions. Taking PrepAwayTest's web-based Microsoft AZ-802 practice test is the best method to feel the real Microsoft AZ-802 Exam scenario. PrepAwayTest offers the customizable web-based Microsoft AZ-802 practice test that is compatible with all browsers like MS Edge, Chrome, Firefox, etc.
NEW QUESTION # 434
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. You enable Microsoft Defender for Servers Plan 2. You need to implement File Integrity Monitoring (FIM). What should you create first?
Answer: C
Explanation:
File Integrity Monitoring in Microsoft Defender for Cloud, even in its current implementation that is built on top of Microsoft Defender for Endpoint for subscriptions using Defender for Servers Plan 2, still stores the file and registry baseline data and the change events it detects inside a Log Analytics workspace, which an administrator selects or newly creates as part of the process of turning FIM on for a given set of resources.
That Log Analytics workspace must already exist before File Integrity Monitoring ' s monitoring rules and file or registry key entities can be enabled and configured for VM1, making it the essential first prerequisite artifact in this workflow. A data collection rule is a separate Azure Monitor construct used to route telemetry to a destination but is not itself the storage location FIM writes its baseline and change data into, a private endpoint is used to secure network access to a resource such as a storage account or key vault rather than to store FIM data, and a storage account is not the destination FIM ' s current architecture uses at all. Because the Log Analytics workspace is the specific prerequisite resource that File Integrity Monitoring ' s configuration step depends on existing first, creating it is the correct first action to take before implementing FIM on VM1.
NEW QUESTION # 435
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain controllers. You plan to store a DNS zone in a custom Active Directory partition. You need to create the Active Directory partition for the zone. The partition must replicate to only four of the domain controllers. What should you use?
Answer: B
Explanation:
A standard AD-integrated DNS zone stored in the built-in DomainDnsZones or ForestDnsZones application partitions replicates to every domain controller that hosts a DNS server in that scope (the domain, or the whole forest), with no way to hand-pick a subset of exactly four domain controllers. To get that fine-grained control over which specific domain controllers hold a copy of the partition ' s data, you must create a custom application directory partition yourself and then explicitly enlist only the desired domain controllers into it, and dnscmd.exe is the command-line tool documented for exactly this: its /createdirectorypartition option creates a new custom application partition, and its /enlistdirectorypartition option adds a specific domain controller into that partition ' s replication scope, giving you complete control over which four (and only which four) domain controllers receive the DNS zone ' s data. DNS Manager ' s graphical interface only offers the built-in replication scopes (this DC only, the whole domain, the whole forest, or a custom application directory partition already listed by another tool) and cannot itself create a brand-new custom partition with an arbitrary replication membership. New-ADObject is a generic Active Directory PowerShell cmdlet for creating arbitrary directory objects and is not the documented mechanism for provisioning a DNS-scoped application directory partition. Windows Admin Center ' s DNS tooling likewise does not expose custom application-partition creation and enlistment at this level of granularity.
NEW QUESTION # 436
You have an on-premises DNS server named Server1 that runs Windows Server. Server1 hosts a DNS zone named fabrikam.com. You have an Azure subscription that contains the resources shown in the following exhibit: Vnet1 (virtual network, connects to the on-premises network by using a Site-to-Site VPN), VM1 (virtual machine, runs Windows Server and has the DNS Server role installed), contoso.com private DNS zone (linked to Vnet1), and contoso.com public DNS zone (contains the DNS records of all the platform as a service [PaaS] resources). How should you complete the name resolution configuration? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Vnet1 (Site-to-Site VPN) / VM1 (DNS Server role) / contoso.com private zone (linked to Vnet1) / contoso.com public zone (PaaS records).
Answer:
Explanation:
Explanation:
On Vnet1 (VM1): configure VM1 to forward requests for the contoso.com zone to the Azure-provided DNS at 168.63.129.16. On the on-premises network: configure forwarding for the contoso.com zone to VM1.
The Azure-provided DNS resolver at 168.63.129.16 is what actually knows about the contoso.com private DNS zone, because that zone is linked to Vnet1 and platform DNS only answers private-zone queries for resources/clients located inside the linked virtual network; it cannot be queried directly by anything outside that VNet, including the on-premises network across the Site-to-Site VPN. VM1, however, sits inside Vnet1 and can reach 168.63.129.16 directly, so configuring VM1 ' s own DNS Server role to forward contoso.com queries to 168.63.129.16 lets VM1 successfully resolve private-zone records (and, transitively, records that depend on the public zone data for PaaS resources) on behalf of anyone who asks VM1. On the on-premises side, the on-premises DNS infrastructure has no direct path to the Azure platform resolver at all, so it must instead be configured to forward contoso.com queries to VM1 ' s IP address, which is reachable across the established Site-to-Site VPN. This produces a working chain: on-premises clients query their local DNS server, which forwards contoso.com queries across the VPN to VM1, which in turn forwards them to the Azure-provided DNS resolver that can actually see the linked private zone, and the resolved answer flows back along the same path. Configuring VM1 to forward to the public DNS zone directly, or configuring on- premises forwarding straight to 168.63.129.16 or to the public zone, would each skip a required hop and fail to resolve the private zone ' s records.
NEW QUESTION # 437
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. You build an app named App1. You need to configure continuous integration and continuous deployment (CI/CD) of App1 to VM1. What should you create first?
Answer: D
Explanation:
Answer-key correction: The source marked the answer as C (an Azure Automation account). Microsoft ' s documented CI/CD-to-VM workflow (Azure Pipelines deployment groups) has no role for an Automation account; every pipeline, deployment group, and release definition lives inside an Azure DevOps project, which in turn requires an Azure DevOps organization to exist first. Corrected answer: D.
Continuous integration and continuous deployment to an Azure VM running Windows Server is typically implemented using Azure Pipelines with a deployment group that targets the VM directly (for example, deploying a web app to IIS via a Deployment Group agent installed on VM1). Every object involved in that workflow - the build (CI) pipeline that produces artifacts from App1 ' s source, the release (CD) pipeline, and the deployment group registration for VM1 itself - is created and lives inside a project, and a project in turn exists only inside an Azure DevOps organization; none of those pieces can be created before an organization (and a project within it) exists. Creating the Azure DevOps organization is therefore the necessary first step, ahead of configuring the build pipeline, registering VM1 in a deployment group, or setting up the release pipeline that finally deploys App1 to it. A managed identity might later be relevant for VM1 to authenticate to some other Azure resource, but it is not a prerequisite for setting up CI/CD itself. An App Service Environment is a dedicated hosting environment for Azure App Service (a PaaS offering) and has no role in deploying to an existing IaaS virtual machine. An Azure Automation account is used for runbook automation, Desired State Configuration, and update management, and plays no documented part in the Azure Pipelines deployment-group workflow used to CI/CD an app onto a VM.
NEW QUESTION # 438
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a privileged user named Admin1.
You need to improve protection for Admin1. The solution must meet the following requirements:
* Require an issued certificate-based hardware credential for interactive logon.
* Prevent services from using delegated Admin1 credentials to access other services.
Which two account security options should you select? Each correct answer presents part of the solution.
Answer: C,E
Explanation:
Selecting Smart card is required for interactive logon forces Admin1 to authenticate interactively by using a smart card and its associated certificate and PIN rather than relying on an ordinary password for interactive authentication. Microsoft explicitly documents this account option as requiring a smart card for interactive network sign-in. Selecting Account is sensitive and cannot be delegated prevents Admin1 ' s credentials from being forwarded by trusted services for delegated authentication to other network services, which directly meets the second requirement. Password never expires does not strengthen interactive authentication, while disabling Kerberos preauthentication weakens Kerberos security. Restricting the account to DES encryption would also reduce rather than improve security because DES is obsolete and weak. The two security-oriented account options are therefore A and E. Microsoft Learn
NEW QUESTION # 439
......
Our AZ-802 study materials just need you to memorize all keypoints of the knowledge of the real exam. It is unnecessary to review all irrelevant knowledges. At present, our AZ-802 exam questions have helped thousands of people pass the exam and obtain the certificate. Also, the passing rate of our AZ-802 Training Materials is the highest according to our investigation. None of the other exam braindumps in the market has the pass rate high as 98% to 100% as our AZ-802 learning quiz.
New AZ-802 Real Exam: https://www.prepawaytest.com/Microsoft/AZ-802-practice-exam-dumps.html