With AZ-802 study materials, you will have more flexible learning time. With AZ-802 study materials, you can flexibly arrange your study time according to your own life. You don't need to be in a hurry to go to classes after work as the students who take part in a face-to-face class, and you also never have to disrupt your schedule for learning. AZ-802 Study Materials help you not only to avoid all the troubles of learning but also to provide you with higher learning quality than other students'.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Implement and manage an on-premises and hybrid networking infrastructure | 15% | - Configure software-defined networking - Implement hybrid network connectivity - Configure IP addressing, DNS, and DHCP - Secure network traffic in hybrid environments |
| Topic 2: Manage virtual machines and containers | 15% | - Configure Azure Arc-enabled servers and VMs - Deploy and manage containers and Kubernetes on Windows Server - Deploy and manage Hyper-V virtual machines |
| Topic 3: Secure Windows Server on-premises and hybrid infrastructures | 10% | - Implement security baselines and hardening - Manage access control and permissions - Configure Windows Defender and audit policies |
| Topic 4: Manage Windows Servers and workloads in a hybrid environment | 20% | - Manage updates and patches across hybrid servers - Deploy servers using Windows Admin Center and Azure Arc - Configure remote management and secure administration - Implement hybrid identity solutions |
| Topic 5: Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments | 20% | - Integrate AD DS with Azure AD and Azure Arc - Install and configure domain controllers - Manage FSMO roles and replication - Implement and manage Group Policy Objects |
| Topic 6: Implement high availability and disaster recovery | 5% | - Configure failover clustering - Perform server and workload migrations - Implement backup and recovery solutions - Monitor and troubleshoot Windows Server environments - Use Azure Site Recovery for hybrid workloads |
| Topic 7: Manage storage and file services | 15% | - Configure file servers and shares - Implement Storage Spaces and Storage Spaces Direct - Integrate on-premises storage with Azure Storage - Configure data deduplication and replication |
>> Pass Leader AZ-802 Dumps <<
In recent years, our AZ-802 test torrent has been well received and have reached 99% pass rate with all our dedication. As a powerful tool for a lot of workers to walk forward a higher self-improvement, our AZ-802 certification training continue to pursue our passion for advanced performance and human-centric technology. A good deal of researches has been made to figure out how to help different kinds of candidates to get AZ-802 Certification. We revise and update the Administering Windows Server guide torrent according to the changes of the syllabus and the latest developments in theory and practice.
NEW QUESTION # 82
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a server named Server1 that runs Windows Server. You need to ensure that only specific applications can modify the data in protected folders on Server1. Solution: From Virus & threat protection, you configure Tamper Protection. Does this meet the goal?
Answer: A
Explanation:
Tamper Protection, also configured under Virus & threat protection settings, is designed to prevent malicious or unauthorized changes to Microsoft Defender Antivirus ' s own configuration -- for example, blocking attempts to disable real-time protection, cloud-delivered protection, automatic sample submission, or the antivirus engine itself, whether the attempt comes from a local process, a script, or a registry edit. It has no function related to restricting which applications are permitted to write to or modify data in designated protected folders on the file system; that capability belongs to a different feature entirely and Tamper Protection performs no allow-listing or folder-level access control of any kind. Because Tamper Protection governs Defender ' s own settings rather than application-level write access to arbitrary folders, configuring it does not address the stated requirement, and no combination of Tamper Protection options can be adjusted to achieve that outcome. The feature that actually restricts folder-level write access to an allow-listed set of applications is Controlled folder access, configured from the same Virus & threat protection area but under Manage ransomware protection, not Tamper Protection. Therefore, configuring Tamper Protection does not meet the goal.
NEW QUESTION # 83
You have an Active Directory Domain Services (AD DS) domain. The domain contains three servers named Server1, Server2, and Server3 that run Windows Server. You sign in to Server1 by using a domain account and start a remote PowerShell session to Server2. From the remote PowerShell session, you attempt to access a resource on Server3, but access to the resource is denied. You need to ensure that your credentials are passed from Server1 to Server3. The solution must minimize administrative effort. What should you do?
Answer: B
Explanation:
This scenario is the classic Kerberos " double-hop " problem: when you sign in to Server1 and use PowerShell remoting to reach Server2, your credentials are used to authenticate that first hop, but by default Server2 does not receive a copy of your credentials that it can pass onward to a third machine (Server3) on your behalf, so the connection to Server3 falls back to the anonymous/network identity of Server2 itself and access is denied.
Kerberos constrained delegation solves exactly this problem: it explicitly authorizes Server2 to obtain and present Kerberos service tickets on the user ' s behalf to specified services on Server3 (or to any service, with resource-based constrained delegation configured on Server3), letting the user ' s original credentials flow through the second hop, and requires only a one-time delegation configuration rather than any change to how users connect. Just Enough Administration (JEA) restricts what commands a remote user can run in a constrained PowerShell endpoint; it does not solve credential delegation across hops. Selective authentication is a forest/domain trust setting controlling which security principals from a trusting domain can authenticate to resources in another domain across a trust; it is unrelated to the double-hop problem within a single domain. Disabling " Enforce user logon restrictions " only removes a KDC ticket-validation check performed at logon and does not enable multi-hop credential delegation. Therefore, configuring Kerberos constrained delegation on Server2 (to delegate to the target service on Server3) is the solution that minimizes administrative effort while fixing the credential pass-through problem.
NEW QUESTION # 84
Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server. The domain contains a group named Group1. You have an Azure Storage account that contains an Azure Files share named share1. Identity-based authentication for Azure Files is enabled by using the domain. Group1 syncs with a Microsoft Entra tenant. The members of Group1 can authenticate from the servers but cannot access the files in share1. Group1 has Modify NTFS permissions for the required folders in share1. You need to grant Group1 share-level access to meet the following requirements: - Allow the members to read, write, and delete files over SMB. - Prevent the members from modifying the NTFS permissions. - Follow the principle of least privilege. Which role should you assign to Group1 at the scope of share1?
Answer: B
Explanation:
Azure Files identity-based authentication requires two independent layers of permission to actually grant SMB access: the underlying NTFS (file/directory) permissions, which Group1 already has correctly set as Modify on the required folders, and a separate Azure role-based access control (RBAC) permission assigned at the storage account, file share, directory, or file scope, which governs whether an authenticated identity is allowed onto the share over SMB at all; even correct NTFS permissions are enforced only after the RBAC layer has admitted the connection, which is why Group1 currently authenticates successfully but still cannot access any files, since no Azure Files data-plane RBAC role has been assigned yet. The Storage File Data SMB Share Contributor role grants exactly read, write, and delete access over SMB to files and directories in the share, matching the first requirement, while explicitly not including the permission to modify NTFS-level permissions on those files, which the built-in role reserves for the Elevated Contributor role, so Contributor also satisfies both the second requirement and the least-privilege requirement by granting no more access than is needed. Storage File Data SMB Share Elevated Contributor adds the ability to change NTFS permissions, which the scenario explicitly requires be prevented, and Storage File Data SMB Share Reader and Storage File Data Privileged Contributor either grant too little (read-only) or too much (elevated, privileged) access for this scenario.
NEW QUESTION # 85
You need to meet the technical requirements for Cluster2.
Which four actions should you perform in sequence before you can enable replication? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
Explanation:
1. Create an Azure Recovery Services vault. 2. Create a Hyper-V site. 3. Install and register Azure Site Recovery Providers. 4. Create and associate replication policies.
Setting up Azure Site Recovery for a Hyper-V cluster that is not managed by Virtual Machine Manager follows a fixed infrastructure-preparation order. An Azure Recovery Services vault must exist first, since it is the container that every later step registers against. A Hyper-V site is then created in that vault to represent the on-premises Hyper-V environment, because a Hyper-V host or cluster must belong to a site before its hosts can be registered against Azure Site Recovery. The Azure Site Recovery Provider is then installed on the Hyper-V hosts (Cluster2 ' s nodes) and registered to that site/vault, which is what actually connects the cluster nodes to Azure Site Recovery. Only once the hosts are registered can a replication policy be created and associated with the Hyper-V site, since a policy has nothing to attach to until the site and its registered hosts already exist. Installing Azure Connected Machine agents is unrelated to Hyper-V VM replication -- that agent is used for onboarding servers to Azure Arc -- and is not part of this workflow. Therefore, the correct order is: create the vault, create the Hyper-V site, install and register the Providers, and create and associate the replication policy.
NEW QUESTION # 86
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft Sentinel instance. You add the Windows Firewall data connector in Microsoft Sentinel. You need to ensure that Microsoft Sentinel can collect Windows Firewall logs from Server1. Solution: You onboard Server1 to Microsoft Defender for Endpoint. Does this meet the goal?
Answer: A
Explanation:
Onboarding Server1 to Microsoft Defender for Endpoint enables endpoint detection and response telemetry, threat protection, and security recommendations for that specific device, but Defender for Endpoint is a separate security product from Microsoft Sentinel and does not configure Server1 as a log source for the Windows Firewall data connector. Onboarding to Defender for Endpoint installs its own sensor and forwards its own telemetry to the Microsoft 365 Defender portal and, when connected, to Sentinel through the Defender for Endpoint connector, but it does not deploy the Azure Monitor Agent or the data collection rule that the Windows Firewall connector specifically depends on to collect Windows Firewall event log entries from Server1. Because these are two independent data pipelines with different underlying agents and different data collection rules, onboarding Server1 to Defender for Endpoint has no effect on whether Windows Firewall logs specifically reach Sentinel through the Windows Firewall connector, so this solution does not meet the stated goal.
NEW QUESTION # 87
......
Do you want to use your spare time to get AZ-802 exam certification? The PDF version of our AZ-802 exam materials provided by us can let you can read anytime and anywhere. We also provide online version and the software version. The content of different version is diverse, and every of them have their own advantages. You can download the version of the AZ-802 Exam Materials to try and find the version that satisfies you.
Test AZ-802 Registration: https://www.actualpdf.com/AZ-802_exam-dumps.html