PassTIP는 여러 it인증에 관심 있고 또 응시하고 싶으신 분들에게 편리를 드립니다. 그리고 많은 분들이 이미 PassTIP제공하는 덤프로 it인증시험을 한번에 패스를 하였습니다. 즉 우리 PassTIP 덤프들은 아주 믿음이 가는 보장되는 덤프들이란 말이죠. PassTIP에는 베터랑의전문가들로 이루어진 연구팀이 잇습니다, 그들은 it지식과 풍부한 경험으로 여러 가지 여러분이Microsoft인증AZ-802시험을 패스할 수 있을 자료 등을 만들었습니다 여러분이Microsoft인증AZ-802시험에 많은 도움이AZ-802될 것입니다. PassTIP 가 제공하는AZ-802테스트버전과 문제집은 모두AZ-802인증시험에 대하여 충분한 연구 끝에 만든 것이기에 무조건 한번에AZ-802시험을 패스하실 수 있습니다.
| Section | Objectives |
|---|---|
| Secure and manage Windows Server environments | - Identity and access management
|
| Networking and high availability | - Networking infrastructure
|
| Hybrid infrastructure management | - Azure integration
|
| Compute, storage, and virtualization | - Virtual machines and containers
|
우리 PassTIP에서는 여러분을 위하여 정확하고 우수한 서비스를 제공하였습니다. 여러분의 고민도 덜어드릴 수 있습니다. 빨리 성공하고 빨리Microsoft AZ-802인증시험을 패스하고 싶으시다면 우리 PassTIP를 장바구니에 넣으시죠 . PassTIP는 여러분의 아주 좋은 합습가이드가 될것입니다. PassTIP로 여러분은 같고 싶은 인증서를 빠른시일내에 얻게될것입니다.
질문 # 401
You are planning the migration of Archive1 to support the on-premises migration plan. What is the minimum number of IP addresses required for the node and cluster roles on Cluster3?
정답：A
설명：
A Windows Server failover cluster requires a distinct IP address for each individual cluster node ' s network adapter, plus one additional IP address for the cluster ' s own network name resource -- the cluster access point that clients and management tools use to address the cluster as a single logical entity rather than any one specific node. Cluster3 will contain two physical nodes, Node1 and Node2, so at minimum one IP address is required for Node1 ' s network adapter and one for Node2 ' s network adapter. Beyond those two node-level addresses, the cluster core resource itself (the cluster name object and its associated IP address resource) requires one more address so that the cluster can be addressed and managed as a whole and so that any highly available roles hosted on the cluster (such as the file share role planned for Cluster3) can obtain the network identity they need to fail over between nodes. Adding these together -- one for Node1, one for Node2, and one for the cluster ' s own network name -- yields a minimum of three IP addresses required for Cluster3 ' s node and cluster roles. Fewer than three would leave either a node or the cluster itself without a usable network identity, and while additional IP addresses may be consumed by highly available roles later added to the cluster, three is the baseline minimum for the node and cluster roles themselves.
질문 # 402
You have an Azure subscription. The subscription contains a Microsoft Sentinel workspace named Workspace1 and 100 virtual machines that run Windows Server. You configure Workspace1 to collect logs from the virtual machines. You need to query the collected logs for failed logon events. Which table should you query?
정답：B
설명：
When Windows Server virtual machines send Windows Security event log data into a Log Analytics
/Microsoft Sentinel workspace, those events (including failed logon Event ID 4625) land in the SecurityEvent table. SigninLogs and AuditLogs hold Microsoft Entra ID sign-in and directory audit data rather than Windows OS security log events, and SecurityIncident stores Sentinel incidents created from analytics rules rather than raw event data, so querying failed logons directly requires the SecurityEvent table. A query such as SecurityEvent | where EventID == 4625 against Workspace1 would return the failed logon attempts recorded on the monitored virtual machines. This table is populated when the Log Analytics agent or Azure Monitor Agent is configured, via a data collection rule, to collect Windows Security events, and it is also the table that Microsoft Sentinel analytics rules typically reference when building failed-logon or brute-force detection logic. The SecurityEvent schema also carries the account name, source workstation, and logon type for each event, letting an analyst pivot from raw failed-logon counts to identifying which accounts or source hosts are the target of a credential-guessing attempt across the 100 monitored servers.
질문 # 403
Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and adatum.com. A two-way external trust exists between contoso.com and adatum.com. The forests contain the servers shown in the following table: DC1 (contoso.com, hosts all FSMO roles), DC2 (adatum.com, hosts all FSMO roles), SRV1 (adatum.com, file server), SRV2 (adatum.com, file server). You need to ensure that users from contoso.com can access only shared resources hosted on SRV1. The solution must meet the following requirements: * Ensure that users from adatum.com can access the resources hosted in contoso.com (unrestricted, as today). * Prevent the contoso.com users from accessing any other resources in adatum.com.
What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
정답：
설명：
Explanation:
Modify the trust on: DC2. Modify the permissions for the: Computer object of SRV1.
By default, an external trust grants every authenticated user in the trusted domain (contoso.com, from adatum.
com ' s perspective) the implicit right to attempt authentication against any computer in the trusting domain (adatum.com), with actual access then governed only by each resource ' s own ACLs -- there is no built-in restriction limiting which specific computers users can even attempt to authenticate against. Selective Authentication is the trust setting that changes this: once enabled on the trust from the perspective of the domain being accessed, authenticating users from the other side must be explicitly granted the " Allowed to Authenticate " permission on the specific computer object(s) they should be allowed to reach; without that permission, authentication is denied outright, regardless of any file/share-level permissions. Because the goal is to restrict contoso.com users specifically -- without restricting the reverse direction (adatum.com users accessing contoso.com resources, which must remain unrestricted) -- Selective Authentication must be enabled only on the adatum.com side of the trust, which is configured on DC2, the domain controller hosting the FSMO roles (and by extension the trust configuration) for adatum.com; enabling it on DC1 or on both would risk also restricting the other direction. Once Selective Authentication is enabled on that side, the " Allowed to Authenticate " permission must then be granted specifically on SRV1 ' s own computer object (not on DC1 ' s, and not merely on SRV1 ' s file shares, since Selective Authentication is enforced at the computer- object authentication level, before any share-level permission is even evaluated) for the relevant contoso.com users or groups.
질문 # 404
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server and store BitLocker recovery keys in AD DS. A server named Server1 starts in BitLocker recovery mode. You need to identify the BitLocker recovery key for Server1. Solution: You run ntdsutil.exe on a domain controller. Does this meet the goal?
정답：A
설명：
ntdsutil.exe is a command-line management utility for the AD DS database itself, used for tasks such as performing authoritative restores, seizing or transferring FSMO roles, database integrity checks and defragmentation, managing application directory partitions, and Directory Services Restore Mode password resets; it has no built-in command, menu, or capability for browsing individual object attributes such as the ms-FVE-RecoveryPassword value stored on a msFVE-RecoveryInformation child object, and it provides no interface at all for reading or exporting BitLocker recovery data. Retrieving a BitLocker recovery password stored in AD DS requires either the BitLocker Recovery Password Viewer snap-in for Active Directory Users and Computers, which adds a dedicated tab to a computer object ' s properties specifically to display associated recovery passwords, or direct inspection of the msFVE-RecoveryInformation child objects through a general-purpose LDAP tool such as ADSI Edit or an equivalent PowerShell query against the directory; ntdsutil operates at the database/role-management level and simply has no code path that surfaces this attribute value to an administrator. Because running ntdsutil.exe on a domain controller does not read, display, or export any BitLocker recovery password, and no combination of its available commands can be used to obtain one, this solution does not meet the stated goal of identifying Server1 ' s recovery key.
질문 # 405
You have a server named Server1 that runs Windows Server and has the Hyper-V server role installed. You have a Hyper-V failover cluster named Cluster1. All servers are members of the same domain. You need to ensure that you use Hyper-V Replica with Kerberos authentication on the default port to replicate virtual machines from Cluster1 to Server1. What should you do on Server1?
정답：A
설명：
Hyper-V Replica supports two authentication-and-transport combinations: Kerberos authentication carried over HTTP on TCP port 80, and certificate-based authentication carried over HTTPS on TCP port 443.
Enabling Hyper-V Replica on a host creates both corresponding inbound firewall rules but leaves them disabled by default, so to actually receive replication traffic authenticated with Kerberos on its default port, an administrator must explicitly enable the Hyper-V Replica HTTP Listener (TCP-In) rule in Windows Defender Firewall with Advanced Security on Server1. Enabling the HTTPS Listener rule instead would only be correct if certificate-based authentication were being used, which is not the case here since Kerberos is specifically required. Adding primary servers to a Hyper-V Replica Broker configuration applies only to a clustered replica destination, but Server1 is a standalone Hyper-V host, not a cluster, so no broker role exists to configure. Enabling incoming and outgoing live migrations addresses live migration functionality entirely separate from Hyper-V Replica traffic. Therefore, enabling the Hyper-V Replica HTTP Listener (TCP-In) rule on Server1 is the correct action.
질문 # 406
......
제일 빠른 시일내에 제일 간단한 방법으로Microsoft인증 AZ-802시험을 패스하는 방법이 없냐구요? PassTIP의Microsoft인증 AZ-802덤프를 공부하시면 가능합니다. PassTIP의Microsoft인증 AZ-802덤프는 많은 분들이 검증한 가장 유력한Microsoft인증 AZ-802시험공부자료입니다. 덤프의 문제만 기억하시면 패스는 문제없기에 제일 빠른 시일내에 시험을 패스하여 자격증 취득이 가능합니다.
AZ-802최고품질 덤프문제: https://www.passtip.net/AZ-802-pass-exam.html