Als ein Mitglied der IT-Branche, machen Sie sich noch Sorgen um die Microsoft AZ-802 IT-Zertifizierungsprüfungen? Es ist nicht so leicht, die Microsoft AZ-802 IT-Zertifizierungsprüfung, die Ihre relevanten Fachkenntnisse und Fähigkeiten überprüft, zu bestehen. Für die Kandidaten, die sich zum ersten Mal an der Microsoft AZ-802 IT-Zertifizierungsprüfung beteiligen, ist ein zielgerichtetes Schulungsprogramm von großer Notwendigkeit. ZertFragen stellt den Kandidaten die zielgerichteten Programme, die Simulationsprüfung, zielgerichtete Lernhilfe und die Prüfungsfragen und Antworten, die 95% der realen Prüfung ähnlich sind, zur Verfügung. Schicken Sie doch schnell ZertFragen in den Warenkorb.
| Section | Weight | Objectives |
|---|---|---|
| Implement and manage an on-premises and hybrid networking infrastructure | 15% | - Configure IP addressing, DNS, and DHCP - Secure network traffic in hybrid environments - Implement hybrid network connectivity - Configure software-defined networking |
| Manage storage and file services | 15% | - Configure file servers and shares - Integrate on-premises storage with Azure Storage - Implement Storage Spaces and Storage Spaces Direct - Configure data deduplication and replication |
| Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments | 20% | - Manage FSMO roles and replication - Install and configure domain controllers - Integrate AD DS with Azure AD and Azure Arc - Implement and manage Group Policy Objects |
| Manage Windows Servers and workloads in a hybrid environment | 20% | - Manage updates and patches across hybrid servers - Deploy servers using Windows Admin Center and Azure Arc - Implement hybrid identity solutions - Configure remote management and secure administration |
| Manage virtual machines and containers | 15% | - Configure Azure Arc-enabled servers and VMs - Deploy and manage Hyper-V virtual machines - Deploy and manage containers and Kubernetes on Windows Server |
| Implement high availability and disaster recovery | 5% | - Configure failover clustering - Monitor and troubleshoot Windows Server environments - Use Azure Site Recovery for hybrid workloads - Perform server and workload migrations - Implement backup and recovery solutions |
| Secure Windows Server on-premises and hybrid infrastructures | 10% | - Implement security baselines and hardening - Configure Windows Defender and audit policies - Manage access control and permissions |
>> AZ-802 Online Praxisprüfung <<
Wenn Sie unsere Lernmaterialien zur Microsoft AZ-802 Zertifizierungsprüfung benutzen wollen, werden sicher die Zeit und Wirtschaftskosten reduziert. Vorm Kauf unserer Microsoft AZ-802 Prüfungsfrage können Sie kostenlos unsere Fragen herunterladen. Sie sind in der Form von PDF und Software. Wenn Sie die Softwareversion brauchen, bitte setzen Sie sich inVerbindung mit unserem Kundenservice.
312. Frage
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two servers named Server1 and Server2 that run Windows Server. You need to ensure that you can use the Computer Management console to manage Server2. The solution must use the principle of least privilege.
Which two Windows Defender Firewall with Advanced Security rules should you enable on Server2? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Antwort: B,E
Begründung:
Establishing a remote Computer Management console session relies on DCOM to make the initial connection to the target computer, so the COM+ Network Access (DCOM-In) firewall rule must be enabled on Server2 to allow that initial DCOM connection through. Separately, enabling the full Remote Event Log Management rule group -- which opens the RPC endpoint mapper port, a fixed RPC port, and the associated named pipe -- is documented by Microsoft as sufficient to let most of the Computer Management console ' s sub-snap-ins (Shared Folders, Local Users and Groups, Device Manager, and others) connect successfully even though they lack a dedicated firewall rule group of their own. Enabling only these two rule groups therefore lets the console connect end-to-end while opening the fewest possible firewall rules, consistent with least privilege, rather than enabling broader rule groups such as the full Windows Management Instrumentation (WMI) group or the full COM+ Remote Administration group, both of which open considerably more surface area than is actually needed for this task. Therefore, the COM+ Network Access (DCOM-In) rule and the Remote Event Log Management rule group are the two correct answers.
313. Frage
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra ID tenant. You plan to implement self-service password reset (SSPR) in Microsoft Entra ID. You need to ensure that users who reset their passwords by using SSPR can use the new password immediately against resources in the on-premises AD DS domain. What should you do?
Antwort: B
Begründung:
Self-service password reset changes a hybrid user ' s password in the cloud directory first. For that new password to be usable against on-premises resources, the change must be written back to the on-premises AD DS domain, and the mechanism that performs this is password writeback, a feature enabled from within the Microsoft Entra Connect (formerly Azure AD Connect) configuration wizard. Once password writeback is turned on, a cloud-initiated password change - whether from SSPR or from an administrator resetting a user
' s password in the Microsoft Entra admin center - is securely relayed back through the existing Microsoft Entra Connect/provisioning agent infrastructure and applied to the user ' s on-premises account, so the new credential works immediately for on-premises authentication, not just cloud sign-in. The Microsoft Entra Password Protection proxy service is a different feature entirely: it distributes banned-password-list enforcement to on-premises domain controllers so that weak or breached passwords are rejected during on- premises password changes, but it has no role in synchronizing a cloud password change back to AD DS.
Granting the Change Password permission or the Impersonate a client after authentication user right to the Microsoft Entra Connect service account does not enable writeback either; writeback is a documented feature toggle in the sync tool that already provisions the service account with everything it needs once enabled, and simply granting ad hoc rights outside that configuration does not activate the capability. Therefore, enabling password writeback in Microsoft Entra Connect is the correct action.
314. Frage
You have an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with Microsoft Entra ID by using Microsoft Entra Connect. You enable password protection for contoso.com.
You need to prevent users from including the word Contoso as part of their password. What should you use?
Antwort: A
Begründung:
Microsoft Entra Password Protection lets an organization extend the global banned-password list with a custom banned-password list containing organization-specific terms, such as a company name, product names, or local landmarks. For an on-premises AD DS domain, the custom banned-password list itself is still authored and managed centrally in the cloud, in the Microsoft Entra admin center, under Protect & Secure > Authentication methods > Password protection. Once configured there, the list is downloaded and cached by the Microsoft Entra Password Protection DC agents running on the domain ' s writable domain controllers, which enforce the policy locally against password set and change operations, even though the domain itself is on-premises. Active Directory Users and Computers has no interface for managing banned-password lists; it only manages AD objects such as users, groups, and OUs. Synchronization Service Manager is the on- premises troubleshooting console for the Microsoft Entra Connect sync engine and has no role in password policy configuration. Windows Admin Center is a management gateway for Windows Server infrastructure (roles, features, storage, and so on) and likewise does not expose password-protection policy settings.
Therefore, to add " Contoso " to the custom banned-password list and have it enforced across the domain, an administrator must sign in to the Microsoft Entra admin center and configure the custom banned-password list there, letting the on-premises DC agents pick up and apply the updated list.
315. Frage
You have two Azure virtual machines that run Windows Server. You plan to create a failover cluster that will host the virtual machines. You need to configure an Azure Storage account that will be used by the cluster as a cloud witness. The solution must maximize resiliency. Which type of redundancy should you configure for the storage account?
Antwort: D
Begründung:
Microsoft ' s cloud witness guidance ties the recommended storage account redundancy directly to how the cluster itself is deployed: for a cluster hosted entirely on-premises, or one confined to a single Azure region and a single availability zone, locally redundant storage is considered sufficient, but when the cluster ' s nodes are spread across multiple availability zones within the same region -- the normal, recommended pattern for building an Azure IaaS failover cluster specifically for resiliency -- zone-redundant storage is the setting Microsoft documents as appropriate. Zone-redundant storage synchronously replicates the witness ' s data across physically separate availability zones, so the witness blob remains available even if an entire zone experiences an outage, which is the highest level of resiliency Microsoft actually documents for this particular resource. Geo-redundant options, including both plain geo-redundant storage and geo-zone-redundant storage, are not part of Microsoft ' s cloud witness guidance at all, since the added latency of asynchronous cross- region replication is neither needed nor supported for a quorum witness that must respond quickly during cluster arbitration. Locally-redundant storage would leave the witness dependent on a single zone, undermining the stated goal of maximizing resiliency for a multi-zone cluster.
316. Frage
Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that hosts an app named App1. App1 uses Active Directory authentication.
You have a Microsoft Entra tenant that contains a user named User1. You deploy Microsoft Entra Connect sync and configure password synchronization. User1 fails to authenticate to App1. You need to ensure that User1 can authenticate to App1. What should you do?
Antwort: C
Begründung:
Microsoft Entra Connect password hash synchronization is strictly a one-way flow that pushes password hashes from the on-premises AD DS domain up to Microsoft Entra ID; it never creates or populates an on- premises AD DS account for a user who currently exists only as a cloud-only object in the Microsoft Entra tenant. Because App1 authenticates against AD DS on Server1 rather than against Microsoft Entra ID, User1 needs a genuine on-premises AD DS account for that Active Directory authentication path to succeed at all, so the correct fix is to create a matching AD DS account for User1 directly in the domain. Microsoft Entra Connect ' s default soft-match logic then links that newly created on-premises account to User1 ' s existing cloud object on the very next synchronization cycle, based on matching attributes such as the primary SMTP address, rather than creating a duplicate, unlinked identity in the tenant. Enabling password writeback only pushes cloud-initiated password resets back down to an on-premises account that is already linked through synchronization, which does not help when no on-premises account exists yet, and disabling soft match or enabling BlockCloudObjectTakeoverThroughHardMatch would each make it harder, not easier, to link a newly created on-premises account back to User1 ' s existing cloud identity.
317. Frage
......
Die Microsoft AZ-802 Zertifizierungsprüfung gehört zu den beliebtesten IT-Zertifizierungen. Viele ambitionierte IT-Fachleute wollen auch Microsoft AZ-802 Prüfung bestehen. Viele Kandidaten sollen genügende Vorbereitungen treffen, um eine hohe Note zu bekommen und sich den Bedürfnissen des Marktes anzupassen.
AZ-802 Testengine: https://www.zertfragen.com/AZ-802_prufung.html