It is of great importance to consolidate all key knowledge points of the AZ-802 exam. It is difficult for you to summarize by yourself. It is a complicated and boring process. We will collect all relevant reference books of the AZ-802 exam written by famous authors from the official website. And it is not easy and will cost a lot of time and efforts. At the same time, it is difficult to follow and trace the changes of the AZ-802 Exam, but our professional experts are good at this for you. Just buy our AZ-802 study materials, you will succeed easily!
| Section | Objectives |
|---|---|
| Topic 1: Disaster recovery and migration | - Migration scenarios
|
| Topic 2: Networking and storage infrastructure | - Storage management
|
| Topic 3: Manage hybrid compute and virtualization | - Containers
|
| Topic 4: Implement and manage high availability | - Load balancing and redundancy
|
| Topic 5: Monitoring and troubleshooting | - Diagnostics
|
| Topic 6: Secure Windows Server hybrid infrastructures | - Security configuration
|
>> AZ-802 Valid Exam Tutorial <<
Many people don't get success because of using Administering Windows Server (AZ-802) invalid practice material. Usage of an expired Administering Windows Server (AZ-802) material leads to failure and loss of time and money. To save you from these losses, BraindumpsIT has a collection of actual and updated AZ-802 Exam Questions. These Microsoft AZ-802 practice questions will aid you in acing the test on the first attempt within a few days. This Administering Windows Server (AZ-802) exam dumps has been made under the expert guidance of thousands of professionals from various countries.
NEW QUESTION # 247
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the users shown in the following table: User1 (Enterprise Admins group), User2 (Domain Users group). You have a workgroup server named Server1 that runs Windows Server and contains the local users shown in the following table: User3 (Administrators group), User4 (Users group). You promote Server1 to the first domain controller in a new child domain named east.contoso.com. Which users can sign in to Server1 locally?
Forest user group membership table
Server1 local user group membership table
Answer: D
Explanation:
When a standalone (workgroup) server is promoted to become the FIRST domain controller of a brand-new domain, its existing local SAM accounts are not simply discarded as they would be if the server instead joined an already-existing domain; with no pre-existing domain database to join, the local SAM becomes the seed for the new domain ' s Active Directory database, and local user accounts are converted into domain accounts, carrying forward their prior local group memberships in equivalent form. Because User3 was a member of the local Administrators group before promotion, User3 becomes administrator-equivalent in the new east.
contoso.com domain, granting the default " Allow log on locally " right on that domain ' s own domain controllers. User4, previously only in the local Users group, becomes an ordinary domain user with no special local-logon right on a DC. Domain controllers, by default, grant " Allow log on locally " only to privileged groups such as Administrators, Account Operators, Backup Operators, Print Operators, and Server Operators
-- not to ordinary Domain Users. User1, a member of the forest-wide Enterprise Admins group, is administrator-equivalent everywhere in the forest, including the new DC, so User1 can log on locally. User2, a plain Domain Users member, has no such right. Therefore, only User1 and User3 can sign in to Server1 locally.
NEW QUESTION # 248
You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains the resources shown in the following table. Sub1 has Microsoft Defender for Servers enabled. You are assigned the Contributor role for Sub1. You need to implement just-in-time (JIT) VM access for VM1. What should you do first? (Exhibit: resources table.)
Resources in RG1
Answer: D
Explanation:
Just-in-time VM access works by dynamically tightening and loosening inbound rules on a network security group, or on Azure Firewall, that protects the target virtual machine, so Microsoft Defender for Cloud requires an NSG to already be associated with the VM ' s network interface or with its subnet before a JIT access policy can be created for it at all; without an NSG in place, the JIT configuration blade has nothing to apply its dynamically scoped allow rules to and the feature cannot be enabled. Microsoft Defender for Servers is already enabled on the subscription per the scenario, so there is no need to enable enhanced security again before configuring JIT, and the Contributor role already held on Sub1 is sufficient to configure JIT policies, since it includes the necessary Microsoft.Security/locations/jitNetworkAccessPolicies/write and Microsoft.
Compute/virtualMachines/write permissions, making a request for the Owner role unnecessary overhead. An application security group serves a different purpose, namely grouping virtual machines together as a single unit for NSG rule targeting, and it does not substitute for the underlying NSG itself, so creating one would not unblock enabling JIT access for VM1. Creating and associating an NSG with VM1 is therefore the required first step.
NEW QUESTION # 249
You have an Azure subscription that contains an Azure key vault named Vault1.
You plan to deploy a virtual machine named VM1 that will run Windows Server.
You need to enable encryption at host for VM1. The solution must use customer-managed keys.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
Explanation:
1. Create a disk encryption set and generate RSA keys. 2. Grant Vault1 the managed identity permission for the disk encryption set. 3. Create VM1 and associate the disks of the virtual machine with the disk encryption set.
To enable encryption at host on a new Windows Server virtual machine using a customer-managed key rather than a platform-managed one, the first step is to create a disk encryption set that references, or generates, an RSA key stored in Vault1; creating the disk encryption set automatically provisions its own system-assigned managed identity as part of that creation, so no identity needs to be separately enabled on VM1 itself for this purpose. The administrator then grants that disk encryption set ' s own managed identity the necessary key permissions on Vault1, specifically get, wrap key, and unwrap key, which is what actually authorizes the encryption set to use the customer-managed key stored there for encrypting and decrypting data. Only after the encryption set has been created and properly authorized against Vault1 does the administrator create VM1 itself, enable encryption at host on it, and associate its OS and data disks with the already-configured disk encryption set, which is the step that actually applies customer-managed-key encryption to the virtual machine ' s disks and its host cache and temporary storage. Assigning the Virtual Machine Contributor role to a managed identity plays no part in this particular key-management workflow at all.
NEW QUESTION # 250
You have an on-premises server named Server1 and Microsoft Sentinel instance.
You plan to collect windows Defender Firewall events from Sever1 and analyze the event data by using Microsoft Sentinel.
What should you install on Server1, and which information should you provide during the instance? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Install: The Azure Monitor agent. Provide: The Azure Log Analytics workspace ID and the workspace key.
Collecting Windows Firewall events from an on-premises server into Microsoft Sentinel is done through the Windows Firewall Events via AMA data connector, which relies on the Azure Monitor agent together with an associated data collection rule to actually gather and forward the firewall event log entries; the Azure Log Analytics gateway is only a proxy relay used by the legacy Log Analytics agent, and the Microsoft Azure Recovery Services (MARS) agent is entirely unrelated to event forwarding, since it exists purely for Azure Backup scenarios. When enrolling a server that is neither Azure-hosted nor already Arc-onboarded, the Azure Monitor agent ' s setup process needs the destination Log Analytics workspace ' s ID and its workspace, or primary, key so the installer knows which specific workspace to report collected data to and can authenticate itself to that workspace, which is the same credential pairing Microsoft documents across both its Azure Monitor agent and legacy Microsoft Monitoring Agent onboarding flows for standalone, non-Azure servers.
A storage account name and access key, a subscription ID paired with the Sentinel workspace ' s name, or a set of Azure AD credentials play no role whatsoever in pointing an on-premises monitoring agent at a specific Log Analytics workspace during installation.
NEW QUESTION # 251
You need to ensure that Automanage meets the technical requirements. On which Azure virtual machines should you enable Automanage?
Answer: C
Explanation:
Azure Automanage currently does not support virtual machines that use the Trusted launch security type; this is an explicit, documented limitation of the service, independent of which Windows Server version or edition the VM is running. Looking at the four virtual machines ' security types, Server1 (Windows Server 2022 Datacenter: Azure Edition) and Server4 (Windows Server 2019 Datacenter) are both configured with Trusted launch, which makes both of them ineligible for Automanage onboarding regardless of their OS version.
Server2 (Windows Server 2022 Datacenter: Azure Edition) and Server3 (Windows Server 2022 Datacenter) both use the Standard security type and run OS versions on Automanage ' s supported list, so both qualify and Automanage should be enabled on them to satisfy the requirement that it be used on " all supported " virtual machines, which by definition excludes the ones the service cannot onboard. It is a common misreading of this scenario to assume the Azure Edition label is the deciding factor, since Server1 and Server2 share that edition; the actual determining attribute the requirement hinges on is the VM ' s security type, not its Windows Server edition. Therefore Server2 and Server3 are the correct machines on which to enable Automanage.
NEW QUESTION # 252
......
Experts at BraindumpsIT have also prepared Microsoft AZ-802 practice exam software for your self-assessment. This is especially handy for preparation and revision. You will be provided with an examination environment and you will be presented with actual exam Microsoft AZ-802 Exam Questions. This sort of preparation method enhances your knowledge which is crucial to excelling in the actual certification exam.
Exam AZ-802 Exercise: https://www.braindumpsit.com/AZ-802_real-exam.html