There are some loopholes or systemic problems in the use of a product, which is why a lot of online products are maintained for a very late period. The AZ-802 study materials are not exceptional also, in order to let the users to achieve the best product experience, if there is some learning platform system vulnerabilities or bugs, we will check the operation of the AZ-802 study materials in the first time, let the professional service personnel to help user to solve any problems. The AZ-802 Study Materials have many professionals, and they monitor the use of the user environment and the safety of the learning platform timely, for there are some problems with those still in the incubation period of strict control, thus to maintain the AZ-802 study materials timely, let the user comfortable working in a better environment. Believe it or not, we face the more intense society, and we should prompt our competitiveness to make our dreams come true.
| Section | Weight | Objectives |
|---|---|---|
| Secure Windows Server on-premises and hybrid infrastructures | 10% | - Configure Windows Defender and audit policies - Implement security baselines and hardening - Manage access control and permissions |
| Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments | 20% | - Implement and manage Group Policy Objects - Manage FSMO roles and replication - Install and configure domain controllers - Integrate AD DS with Azure AD and Azure Arc |
| Implement high availability and disaster recovery | 5% | - Perform server and workload migrations - Configure failover clustering - Use Azure Site Recovery for hybrid workloads - Implement backup and recovery solutions - Monitor and troubleshoot Windows Server environments |
| Implement and manage an on-premises and hybrid networking infrastructure | 15% | - Implement hybrid network connectivity - Configure IP addressing, DNS, and DHCP - Configure software-defined networking - Secure network traffic in hybrid environments |
| Manage Windows Servers and workloads in a hybrid environment | 20% | - Configure remote management and secure administration - Manage updates and patches across hybrid servers - Implement hybrid identity solutions - Deploy servers using Windows Admin Center and Azure Arc |
| Manage storage and file services | 15% | - Implement Storage Spaces and Storage Spaces Direct - Configure data deduplication and replication - Configure file servers and shares - Integrate on-premises storage with Azure Storage |
| Manage virtual machines and containers | 15% | - Deploy and manage containers and Kubernetes on Windows Server - Deploy and manage Hyper-V virtual machines - Configure Azure Arc-enabled servers and VMs |
Our AZ-802 practice engine is admired by all our customers for our experts' familiarity and dedication with the industry all these years. By their help, you can qualify yourself with high-quality AZ-802 exam materials. Our experts pass onto the exam candidate their know-how of coping with the exam by our AZ-802 Training Questions. And i can say that our AZ-802 study guide is the unique on the market for its high-effective.
NEW QUESTION # 220
Your network contains an Active Directory Domain Services (AD DS) domain.
The domain contains three servers named ServerA, ServerB, and ServerC.
From ServerA, you run remote PowerShell commands on ServerB by using Kerberos authentication.
You discover that the commands cannot access a share named Share1 on ServerC.
You need to ensure that the commands running on ServerB can access Share1 by using delegated user credentials.
How should you complete the script?
To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer Area:
Answer:
Explanation:
Explanation:
First selection: Set-ADComputer
Second selection: -PrincipalsAllowedToDelegateToAccount
Completed script:
$ServerB = Get-ADComputer -Identity ServerB
$ServerC = Get-ADComputer -Identity ServerC
Set-ADComputer -Identity $ServerC `
-PrincipalsAllowedToDelegateToAccount $ServerB
This scenario describes the Kerberos second-hop authentication problem. Credentials used to establish a remote PowerShell session from ServerA to ServerB are not automatically available when commands on ServerB attempt to access resources on ServerC.
Resource-based Kerberos constrained delegation allows the resource server to specify which computers may delegate authentication requests to its services.
The Set-ADComputer cmdlet configures the computer object of ServerC. The PrincipalsAllowedToDelegateToAccount parameter authorizes ServerB to act on behalf of users when requesting access to supported services on ServerC.
This configuration avoids unconstrained delegation and does not require storing user passwords on ServerB.
The target resource is an SMB share; this approach should not be interpreted as enabling delegation to another WinRM session.
NEW QUESTION # 221
Which two languages can you use for Task1? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Answer: B,C
Explanation:
Task1 is an Azure Automation runbook, and Azure Automation supports a specific, limited set of runbook types: PowerShell (and PowerShell Workflow), Python, and Graphical runbooks (which are authored visually rather than in a scripting language). Of the listed options, PowerShell and Python are the two genuine scripting languages Azure Automation lets you author a runbook in directly, making them the two correct answers. Java and JavaScript are not supported runbook languages in Azure Automation; JavaScript is used elsewhere in Azure (for example, in Azure Functions or Logic Apps custom code), but not for Automation runbooks. Bicep is a domain-specific language for declaratively defining Azure infrastructure as code (compiling down to ARM templates) and has no role as an executable runbook language; you would not write a Task1 runbook in Bicep, since runbooks execute imperative logic rather than declare resource deployments.
Therefore, Python and PowerShell are the two languages available for Task1.
Topic 4, Case Study 4: Fabrikam, Inc.
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
Overview: Fabrikam, Inc. is a manufacturing company that has a main office in Chicago and a branch office in Paris.
Existing Environment -- Identity Infrastructure: Fabrikam has an Active Directory Domain Services (AD DS) forest that syncs with a Microsoft Entra ID tenant. The AD DS forest contains two domains named corp.
fabrikam.com and europe.fabrikam.com.
Chicago Office On-Premises Servers: The office in Chicago contains on-premises servers that run Windows Server 2016 as shown in the following table.
Chicago office on-premises servers
All the servers in the Chicago office are in the corp.fabrikam.com domain.
All the virtual machines in the Chicago office are hosted on HV1 and HV2. HV1 and HV2 are nodes in a failover cluster named Cluster1.
WEB1 and WEB2 run an Internet Information Services (IIS) website. Internet users connect to the website by using a URL of https://www.fabrikam.com.
All the users in the Chicago office run an application that connects to a UNC path of \\Fileserver1\Data.
Paris On-Premises Servers: The office in Paris contains a physical server named dc2.europe.fabrikam.com that runs Windows Server 2016 and is a domain controller for the europe.fabrikam.com domain.
Network Infrastructure: The networks in both the Chicago and Paris offices have local internet connections.
The Chicago and Paris offices are connected by using VPN connections. The client computers in the Chicago office get IP addresses from DHCP1.
Security Risks: Fabrikam identifies the following security risks:
-- Some accounts connect to AD DS resources by using insecure protocols such as NTLMv1, SMB1, and unsigned LDAP.
-- Servers have Windows Defender Firewall enabled. Server administrators sometimes modify firewall rules and allow risky connections.
Requirements -- Security Requirements: Fabrikam identifies the following security requirements:
-- Prevent server administrators from configuring Windows Defender Firewall rules.
-- Encrypt all the data disks on the servers by using BitLocker Drive Encryption (BitLocker).
-- Ensure that only authorized applications can be installed or run on the servers in the forest.
-- Implement Microsoft Sentinel as a reporting solution to identify all connections to the domain controllers that use insecure protocols.
On-Premises Migration Plan: Fabrikam plans to migrate all the existing servers and identifies the following migration requirements:
-- Move the APP1 and APP2 virtual machines in the Chicago office to a new Hyper-V failover cluster named Cluster2 that will run Windows Server 2022. Cluster2 will contain two new nodes named HV3 and HV4. All virtual machine files will be stored on a Cluster Shared Volume (CSV).
-- Migrate Archive1 to a new failover cluster named Cluster3 that will run Windows Server 2022. Cluster3 will contain two physical nodes named Node1 and Node2. The file shares on Cluster3 will be a failover cluster role in active-passive mode.
-- Migrate all users, groups, and client computers from europe.fabrikam.com to corp.fabrikam.com. User accounts will retain their existing password.
-- Migrate the data share from Fileserver1 to a new server named Fileserver2 that will run Windows Server
2022. After the migration, the data share must be accessible by using the existing UNC path.
Azure Migration Plan: Fabrikam plans to migrate some resources to Azure and identifies the following migration requirements:
-- Create an Azure subscription named Sub1 and an Azure virtual network named Vnet1. Use ExpressRoute to connect the Paris and Chicago offices to Vnet1.
-- License all servers for Microsoft Defender for Servers.
-- Migrate APP3 and APP4 to Azure.
-- Migrate the www.fabrikam.com website to an Azure App Service web app named WebApp1, then decommission WEB1 and WEB2.
DHCP Migration Plan: Fabrikam plans to replace DHCP1 with a new server named DHCP2 and identifies the following migration requirements:
-- Ensure that DHCP2 provides the same IP addresses that are currently available from DHCP1.
-- Prevent DHCP1 from servicing clients once services are enabled on DHCP2.
-- Ensure that the existing leases and reservations are migrated.
NEW QUESTION # 222
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a group named Group1 and a server named Server1 that runs Windows Server.
Server1 has the File Server Resource Manager (FSRM) role service installed and contains a file share named Share1.
You need to configure Server1 to meet the following requirements:
* Prevent the members of Group1 from storing more than 10 GB of files on Share1.
* Ensure that the administrators of Server1 receive a regular email that lists duplicate files on Server1.
How should you configure Server1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Prevent storage beyond 10 GB: Configure a hard quota
Regular duplicate-file email: Configure a storage report task
FSRM quotas can enforce storage limits at the folder level. A hard quota prevents additional files from being saved when the configured limit is reached, whereas a soft quota only tracks usage and generates notifications. Therefore, a 10-GB hard quota is required for Share1. For the reporting requirement, FSRM Storage Reports Management includes a Duplicate Files report and supports scheduled storage report tasks.
The task can be configured to run regularly and deliver the resulting report to administrator email addresses.
Microsoft documents that FSRM quotas can restrict space on a folder and that storage reports can be delivered directly to administrators by email. These two FSRM capabilities independently satisfy the capacity- enforcement and scheduled-reporting requirements. Microsoft Learn
NEW QUESTION # 223
Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server. The domain contains a group named Group1. You have an Azure Storage account that contains an Azure Files share named share1. Identity-based authentication for Azure Files is enabled by using the domain. Group1 syncs with a Microsoft Entra tenant. The members of Group1 can authenticate from the servers but cannot access the files in share1. Group1 has Modify NTFS permissions for the required folders in share1. You need to grant Group1 share-level access to meet the following requirements: - Allow the members to read, write, and delete files over SMB. - Prevent the members from modifying the NTFS permissions. - Follow the principle of least privilege. Which role should you assign to Group1 at the scope of share1?
Answer: C
Explanation:
Azure Files identity-based authentication requires two independent layers of permission to actually grant SMB access: the underlying NTFS (file/directory) permissions, which Group1 already has correctly set as Modify on the required folders, and a separate Azure role-based access control (RBAC) permission assigned at the storage account, file share, directory, or file scope, which governs whether an authenticated identity is allowed onto the share over SMB at all; even correct NTFS permissions are enforced only after the RBAC layer has admitted the connection, which is why Group1 currently authenticates successfully but still cannot access any files, since no Azure Files data-plane RBAC role has been assigned yet. The Storage File Data SMB Share Contributor role grants exactly read, write, and delete access over SMB to files and directories in the share, matching the first requirement, while explicitly not including the permission to modify NTFS-level permissions on those files, which the built-in role reserves for the Elevated Contributor role, so Contributor also satisfies both the second requirement and the least-privilege requirement by granting no more access than is needed. Storage File Data SMB Share Elevated Contributor adds the ability to change NTFS permissions, which the scenario explicitly requires be prevented, and Storage File Data SMB Share Reader and Storage File Data Privileged Contributor either grant too little (read-only) or too much (elevated, privileged) access for this scenario.
NEW QUESTION # 224
You have an Active Directory Domain Services (AD DS) domain that contains the domain controllers shown in the following table: DC1 (Schema master), DC2 (Infrastructure master), DC3 (Domain naming master), DC4 (PDC emulator, RID master). The domain contains an app named App1 that uses a custom application partition to store configuration data. You decommission App1. When you attempt to remove the custom application partition, the process fails. Which domain controller is unavailable?
Domain controller FSMO role table
Answer: A
Explanation:
Adding or removing an application directory partition in AD DS -- including custom partitions such as the one App1 used to store its configuration data -- is an operation that must be performed against, and requires the availability of, the domain controller holding the Domain Naming Master FSMO role for the forest. This is the single operations master responsible for maintaining the list of domains and application partitions in the forest and for coordinating additions or removals of directory partitions; if that role holder is offline or unreachable, attempts to add or remove an application partition will fail, even though normal object read/write operations against other partitions (users, groups, and so on) may continue to function against any available domain controller. According to the exhibit ' s role assignments, DC3 holds the Domain Naming Master role.
The Schema master (DC1) governs schema extensions, the Infrastructure master (DC2) governs cross-domain object reference updates, and the PDC emulator/RID master (DC4) govern time synchronization, password
/authentication emulation, and relative ID pool allocation respectively -- none of these roles are involved in application partition add/remove operations. Because the removal of the custom application partition specifically failed, the unavailable domain controller must be the Domain Naming Master role holder, DC3.
NEW QUESTION # 225
......
Choosing our AZ-802 exam quiz will be a wise decision that you make, because this decision may have a great impact in your future development. Having the AZ-802 certificate may be something you have always dreamed of, because it can prove that you have certain strength. Our AZ-802 Exam Questions can provide you with services with pretty quality and help you obtain a certificate. The quality of our AZ-802 learning materials can withstand the test of practice.
AZ-802 Study Center: https://www.freecram.com/Microsoft-certification/AZ-802-exam-dumps.html