With AZ-802 test training materials of BraindumpsPass, you will own the key to pass AZ-802 exam, which will make you develop better in IT. All of this just need you trust us, trust in BraindumpsPass, and trust in AZ-802 test training materials. Our training material of AZ-802 exam is absolutely real and reliable. What's more, the passing rate of AZ-802 test is as high as 100%.
| Section | Objectives |
|---|---|
| Networking and high availability | - Networking infrastructure
|
| Hybrid infrastructure management | - Azure integration
|
| Compute, storage, and virtualization | - Storage and file services
|
| Secure and manage Windows Server environments | - Identity and access management
|
>> AZ-802 Reliable Test Questions <<
As we all know, famous companies use certificates as an important criterion for evaluating a person when recruiting. The number of certificates you have means the level of your ability. AZ-802 practice materials are an effective tool to help you reflect your abilities. We also hire a team of experts, and the content of AZ-802 question torrent is all high-quality test guidance materials that have been accepted by experienced professionals. AZ-802 practice materials will be the most professional and dedicated tutor you have ever met.
NEW QUESTION # 100
You have an Azure virtual machine named VM1 that runs Windows Server. You need to perform the following tasks on VM1:
* Configure Windows Defender Firewall to allow Remote Desktop connections.
* Configure where to store the logs of the virtual machine console.
Which two settings should you use? To answer, select the settings in the answer area. NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
On an Azure VM, Remote Desktop connectivity problems caused by a Windows Defender Firewall rule that no longer allows inbound RDP traffic are repaired from the VM ' s Help > Reset password blade. Selecting Reset configuration only runs the VM Access Agent extension, which re-enables the Remote Desktop service and creates (or restores) the Windows Defender Firewall rule permitting inbound connections on TCP port
3389, without requiring an existing RDP session or direct console access to the VM. The Serial console blade, by contrast, only provides out-of-band access to the Windows Special Administration Console (SAC) over the hypervisor channel; it does not itself modify any firewall rule, and while an administrator could type netsh commands there manually, Serial console is not the setting that configures the firewall. The location where the serial console ' s text output and the VM ' s boot screenshots are persisted to a storage account is configured separately, on the Boot diagnostics blade, not on the general Diagnostic settings blade, which instead routes platform metrics and Activity Log entries to destinations such as Log Analytics or Event Hubs and plays no role in storing VM console output. Boot diagnostics must be enabled with a linked storage account before the Serial console feature becomes usable, since both the console output stream and the periodic boot screenshots are written through that same storage configuration.
NEW QUESTION # 101
You have an on-premises DNS server named Server1 that runs Windows Server. Server1 hosts a DNS zone named fabrikam.com. You have an Azure subscription that contains the resources shown in the following exhibit: Vnet1 (virtual network, connects to the on-premises network by using a Site-to-Site VPN), VM1 (virtual machine, runs Windows Server and has the DNS Server role installed), contoso.com private DNS zone (linked to Vnet1), and contoso.com public DNS zone (contains the DNS records of all the platform as a service [PaaS] resources). How should you complete the name resolution configuration? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Vnet1 (Site-to-Site VPN) / VM1 (DNS Server role) / contoso.com private zone (linked to Vnet1) / contoso.com public zone (PaaS records).
Answer:
Explanation:
Explanation:
On Vnet1 (VM1): configure VM1 to forward requests for the contoso.com zone to the Azure-provided DNS at 168.63.129.16. On the on-premises network: configure forwarding for the contoso.com zone to VM1.
The Azure-provided DNS resolver at 168.63.129.16 is what actually knows about the contoso.com private DNS zone, because that zone is linked to Vnet1 and platform DNS only answers private-zone queries for resources/clients located inside the linked virtual network; it cannot be queried directly by anything outside that VNet, including the on-premises network across the Site-to-Site VPN. VM1, however, sits inside Vnet1 and can reach 168.63.129.16 directly, so configuring VM1 ' s own DNS Server role to forward contoso.com queries to 168.63.129.16 lets VM1 successfully resolve private-zone records (and, transitively, records that depend on the public zone data for PaaS resources) on behalf of anyone who asks VM1. On the on-premises side, the on-premises DNS infrastructure has no direct path to the Azure platform resolver at all, so it must instead be configured to forward contoso.com queries to VM1 ' s IP address, which is reachable across the established Site-to-Site VPN. This produces a working chain: on-premises clients query their local DNS server, which forwards contoso.com queries across the VPN to VM1, which in turn forwards them to the Azure-provided DNS resolver that can actually see the linked private zone, and the resolved answer flows back along the same path. Configuring VM1 to forward to the public DNS zone directly, or configuring on- premises forwarding straight to 168.63.129.16 or to the public zone, would each skip a required hop and fail to resolve the private zone ' s records.
NEW QUESTION # 102
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The functional level of the forest and the domain is Windows Server 2012 R2. The domain contains the domain controllers shown in the following table.
You need to raise the forest functional level to Windows Server 2016. The solution must meet the following requirements:
* Ensure that there are three domain controllers after you raises the level.
* Minimize how long the FSMO roles are unavailable.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Exhibit
Answer:
Explanation:
Explanation:
1. Move the FSMO roles to DC2. 2. Upgrade DC1. 3. Raise the domain and forest functional level.
Raising the forest functional level to Windows Server 2016 requires every domain controller in the forest to be running Windows Server 2016 or later. DC3 already runs Windows Server 2019, which already qualifies, so DC1, running Windows Server 2012 R2, is the only domain controller that actually blocks the level raise.
Because DC1 currently holds all the FSMO roles and the requirement is to minimize how long those roles are unavailable while still ending up with three domain controllers, the correct approach is to first transfer the FSMO roles to DC2, which already runs a qualifying operating system and requires no downtime-inducing upgrade to receive them. Only after the roles have moved off DC1 is DC1 upgraded in place to a version meeting the Windows Server 2016 minimum, and once all three domain controllers qualify, the domain and forest functional level can finally be raised. This sequence keeps all three existing domain controllers in place
-- avoiding the need to deploy and later decommission an additional DC -- while the FSMO roles are unavailable only for the brief transfer itself rather than for the entire OS upgrade window on DC1.
NEW QUESTION # 103
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a domain controller named DC1. The domain uses Microsoft Entra Connect sync with a Microsoft Entra tenant and uses Microsoft Entra Password Protection to enforce a custom banned password list. You deploy a new domain controller named DC2 to the domain. You discover that the custom banned password list is applied inconsistently and often allows banned passwords to be used. You need to ensure that the custom banned password list is always enforced. What should you do on DC2?
Answer: B
Explanation:
Microsoft Entra Password Protection enforces the custom banned password list on-premises through a DC agent service that must be installed on every domain controller in the domain; any domain controller that lacks the agent will not evaluate password change or reset attempts against the policy at all, which produces exactly the inconsistent enforcement described in the scenario, where some password changes get validated on DCs that already have the agent while others processed on DC2 slip through unchecked. Installing the Microsoft Entra Password Protection DC agent on DC2 closes this gap by making DC2 itself evaluate every password change against the downloaded banned-password policy, the same way DC1 and any other agent- equipped domain controllers already do, restoring consistent enforcement domain-wide. The Password Protection proxy service only relays policy download requests from domain controllers to Microsoft Entra ID and is typically installed on just one or two servers rather than on every DC, so it plays no direct role in evaluating password attempts on DC2. The provisioning agent and Azure Monitor Agent serve entirely unrelated purposes, namely identity provisioning workflows and telemetry collection, and installing either would do nothing to make DC2 enforce the banned password list.
NEW QUESTION # 104
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a privileged user named Admin1.
You need to improve protection for Admin1. The solution must meet the following requirements:
* Require an issued certificate-based hardware credential for interactive logon.
* Prevent services from using delegated Admin1 credentials to access other services.
Which two account security options should you select? Each correct answer presents part of the solution.
Answer: A,D
Explanation:
Selecting Smart card is required for interactive logon forces Admin1 to authenticate interactively by using a smart card and its associated certificate and PIN rather than relying on an ordinary password for interactive authentication. Microsoft explicitly documents this account option as requiring a smart card for interactive network sign-in. Selecting Account is sensitive and cannot be delegated prevents Admin1 ' s credentials from being forwarded by trusted services for delegated authentication to other network services, which directly meets the second requirement. Password never expires does not strengthen interactive authentication, while disabling Kerberos preauthentication weakens Kerberos security. Restricting the account to DES encryption would also reduce rather than improve security because DES is obsolete and weak. The two security-oriented account options are therefore A and E. Microsoft Learn
NEW QUESTION # 105
......
What you can get from the AZ-802 certification? Of course, you can get a lot of opportunities to enter to the bigger companies. After you get more opportunities, you can make full use of your talents. You will also get more salary, and then you can provide a better life for yourself and your family. AZ-802 Exam Preparation is really good helper on your life path. Quickly purchase AZ-802 study guide and go to the top of your life!
AZ-802 Interactive Questions: https://www.braindumpspass.com/Microsoft/AZ-802-practice-exam-dumps.html