Our AZ-802 test prep is renowned for free renewal in the whole year. As you have experienced various kinds of exams, you must have realized that renewal is invaluable to AZ-802 study materials, especially to such important AZ-802 exams. And there is no doubt that being acquainted with the latest trend of exams will, to a considerable extent, act as a driving force for you to pass the exams and realize your dream of living a totally different life. So if you do want to achieve your dream, buy our AZ-802 practice materials.
| Section | Objectives |
|---|---|
| Networking and high availability | - Networking infrastructure
|
| Hybrid infrastructure management | - Azure integration
|
| Secure and manage Windows Server environments | - Security and compliance
|
| Compute, storage, and virtualization | - Virtual machines and containers
|
Candidates may have different ways to practice the AZ-802 study materials, some may like to practice in paper, and some may like to practice it in the computer. We have three versions for you to meet your different needs. If you like to practice in the paper, AZ-802 PDF version will be your choice, which can be printed into the hard one. If you like to practice on your computer, AZ-802 Soft test engine will be your best, choice, besides it also stimulates the exam environment, you can experience the exam environment through this.
NEW QUESTION # 254
You have a server named Server1 that runs Windows Server. You install a custom app named App1 that is accessed by using TCP port 52310. Users report that they cannot access App1. You confirm that App1 is running on Server1. You need to ensure that the users can access App1. The solution must only provide access to App1 on Server1. What should you do in Windows Defender Firewall with Advanced Security?
Answer: B
Explanation:
App1 is being blocked because Windows Defender Firewall with Advanced Security denies unsolicited inbound connections by default. To let remote users reach App1 on TCP port 52310 while keeping the solution scoped to only this application on Server1, an administrator creates a new inbound rule restricted to that specific port (or program path). Allowing all inbound connections for the profile would open every port on Server1 and violate the requirement to scope access narrowly, an outbound rule has no bearing on inbound client requests since App1 is being accessed rather than initiating connections, and a connection security (isolation) rule only governs authentication requirements between peers rather than which ports or programs are permitted to receive traffic. A scoped inbound port or program rule is therefore the only option that opens exactly the access App1 needs. The rule can be created through the Windows Defender Firewall with Advanced Security console, PowerShell ' s New-NetFirewallRule cmdlet, or Group Policy if Server1 is domain-joined, and scoping it to the specific port (or the App1 executable path) ensures no other service on Server1 gains unintended inbound reachability.
NEW QUESTION # 255
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant. The on-premises network is connected to Azure by using a Site-to-Site VPN. You have the DNS zones shown in the following table: contoso.com is hosted on a domain controller named DC1 on the on- premises network and provides name resolution on-premises; fabrikam.com is an Azure private DNS zone that provides name resolution for all Azure virtual networks. You need to ensure that names from fabrikam.
com can be resolved from the on-premises network. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
DNS zones
Answer: B,C
Explanation:
An Azure private DNS zone can only be resolved through the Azure-provided DNS resolver (168.63.129.16) by resources inside a virtual network the zone is linked to; it does not expose a directly queryable DNS server IP address that an on-premises server could target across the Site-to-Site VPN, so on-premises DC1 cannot resolve fabrikam.com by itself no matter what zone type it creates locally (ruling out a stub zone or secondary zone, both of which would need a real, reachable authoritative source to transfer from or refer to). The standard solution is to deploy a Windows Server virtual machine inside the linked virtual network and configure it as a DNS forwarder that forwards fabrikam.com queries to the Azure-provided resolver, which it can reach locally within the VNet; that VM ' s own IP address is then reachable from on-premises across the Site-to-Site VPN. With that forwarder VM in place, DC1 on-premises is configured with a conditional forwarder for the fabrikam.com domain pointed at the forwarder VM ' s IP address, so any fabrikam.com query DC1 receives is relayed across the VPN to the forwarder VM, which resolves it against Azure ' s private DNS resolution path. Modifying the VNet ' s DNS Servers setting is unnecessary for this specific requirement, since it changes name resolution for Azure resources, not for on-premises clients.
NEW QUESTION # 256
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains a user named User1.
You deploy a read-only domain controller (RODC) named RODC1.
You need to ensure that User1 is a local administrator on RODC1. The solution must use the principle of least privilege.
What should you use?
Answer: C
Explanation:
Read-only domain controllers support Administrator Role Separation , which lets a non-domain administrator receive local administrative rights on a specific RODC without receiving administrative permissions elsewhere in the domain. The built-in dsmgmt.exe utility provides the local roles command for managing these delegated RODC administrative roles. An administrator can use the local roles context to add User1 to the Administrators role for RODC1 only. This satisfies least privilege because User1 does not need Domain Admins membership. Local Users and Groups is not used on a domain controller in the same way as on an ordinary member server because a DC does not maintain a conventional local SAM database. net user is likewise unsuitable for this RODC role-separation task. Microsoft documents dsmgmt and its local roles command specifically for RODC Administrator Role Separation.
NEW QUESTION # 257
Your network contains the segments shown in the following table.
You have servers that run Windows Server and are configured as shown in the following table.
You deploy a server named Server4 that runs Windows Server and has a static IP address of 172.16.1.1. You connect Server4 to Segment1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Server1 can successfully ping Server2 by using the name of Server2: No. Server2 can successfully ping Server3 by using the IP address of Server3: No. Running ipconfig /all on Server4 will display an IP address from the 169.254.0.0/16 IPv4 address space: No.
A host decides whether a destination is local by comparing the destination IP against its own subnet mask; if the destination falls outside its own subnet, the host forwards through its default gateway, and if within its own subnet, it uses ARP directly on the local segment. Server2 is physically cabled to Segment1 but has been configured with an IP address (172.16.2.2/24) that places it in the 172.16.2.0/24 network -- a subnet that is physically Segment2. When Server1 (172.16.1.10/24) resolves and pings Server2 ' s name, it gets back
172.16.2.2, which Server1 treats as a remote address (outside its own 172.16.1.0/24) and forwards to its gateway, 172.16.1.1; the router then forwards toward the 172.16.2.0/24 network (physically Segment2), where Server2 is not actually present, so the ping fails. Likewise, when Server2 (believing itself to be on
172.16.2.0/24) tries to reach Server3 (172.16.2.20), it thinks the destination is local and issues an ARP request on the wire it ' s actually attached to (Segment1); ARP requests never cross a router, so the request never reaches Server3 (physically on Segment2), and the ping fails. Server4 was given a static IP address (172.16.1.1); APIPA (169.254.0.0/16) is assigned only to interfaces configured for automatic (DHCP) addressing when no DHCP server responds -- a statically configured interface never receives an APIPA address regardless of any conflict, so ipconfig /all on Server4 will show its configured static address,
172.16.1.1 (which incidentally also collides with Segment1 ' s gateway address, a separate misconfiguration), not an APIPA address.
NEW QUESTION # 258
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. The subscription contains the storage accounts shown in the following table: storage1 (Standard, GRS), storage2 (Standard, ZRS), storage3 (Premium, Block blobs, LRS), storage4 (Premium, File shares, LRS). You plan to enable boot diagnostics for VM1. You need to configure storage for the boot diagnostics logs and snapshots. Which storage account should you use?
Storage accounts table
Answer: C
Explanation:
The storage account used for Azure virtual machine boot diagnostics must be a standard-performance-tier account, since Microsoft documents that attempting to use a premium storage account for boot diagnostics returns a StorageAccountTypeNotSupported error when the virtual machine is started, and it also cannot use zone-redundant storage, since ZRS is likewise unsupported for this specific resource and produces the same class of error. Looking at the four accounts in the table, storage3 and storage4 are both Premium-tier accounts, which immediately rules both of them out regardless of their redundancy setting, and storage2, despite being Standard tier, uses zone-redundant storage, which independently rules it out as well. That leaves storage1, which is both Standard performance tier and uses geo-redundant storage rather than zone-redundant storage, satisfying both documented requirements simultaneously. Because storage1 is the only one of the four accounts that avoids both the premium-tier restriction and the ZRS restriction at the same time, it is the only valid choice among the options offered for configuring VM1 ' s boot diagnostics storage.
NEW QUESTION # 259
......
With these adjustable Administering Windows Server (AZ-802) mock exams, you can focus on weaker concepts that need improvement. This approach identifies your mistakes so you can remove them to master the AZ-802 exam questions of Pass4Leader give you a comprehensive understanding of AZ-802 Real Exam format. Self-evaluation by taking practice exams makes your Microsoft AZ-802 exam preparation flawless and strengthens enough to crack the test in one go.
AZ-802 Valid Exam Book: https://www.pass4leader.com/Microsoft/AZ-802-exam.html