May be there are many study materials for Microsoft certification exam, but latest dumps provided by our website can ensure you pass exam with 100% guaranteed. The pass rate of AZ-802 Exam Cram is up to 99%. If you decided to choose us as your training tool, you just need to use your spare time preparing Microsoft test answers, and you will be surprised by yourself to clear exam.
| Section | Objectives |
|---|---|
| Manage hybrid compute and virtualization | - Containers
|
| Implement and manage high availability | - Failover clustering
|
| Networking and storage infrastructure | - Storage management
|
| Secure Windows Server hybrid infrastructures | - Identity and access management
|
| Disaster recovery and migration | - Backup and restore
|
| Monitoring and troubleshooting | - System monitoring
|
Our AZ-802 questions pdf is up to date, and we provide user-friendly AZ-802 practice test software for the Administering Windows Server exam. Moreover, we are also providing money back guarantee on all of Administering Windows Server test products. If the AZ-802 braindumps products fail to deliver as promised, then you can get your money back. The AZ-802 Sample Questions include all the files you need to prepare for the Microsoft AZ-802 exam. With the help of the AZ-802 practice exam questions and test software, you will be able to feel the real AZ-802 exam scenario, and it will allow you to assess your skills.
NEW QUESTION # 158
Which three actions should you perform in sequence to meet the security requirements for Webapp1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
Explanation:
1. Create the KDS root key in AD DS. 2. Create a group managed service account (gMSA) in Active Directory. 3. Configure the IIS application pool (on WEB1 and WEB2) to run as the gMSA via a specified user account.
The requirement is that every instance of Webapp1 (running on both WEB1 and WEB2) uses the same identity, and that identity ' s password rotates automatically every 30 days, without any administrator manually resetting it. A standalone managed service account (sMSA) is tied to a single computer and cannot be shared across WEB1 and WEB2, so it does not meet the requirement. A group managed service account (gMSA) is designed exactly for this scenario: one AD-managed identity that multiple servers can use simultaneously, with the Key Distribution Service automatically rotating its password (by default every 30 days) without needing manual intervention or downtime. Before any gMSA can be created in the forest, a one- time prerequisite must exist: the KDS root key, which the Key Distribution Service uses to generate and later recompute the gMSA ' s password material. So the correct order is to first create the KDS root key, then create the gMSA object in Active Directory, and finally configure the IIS application pool on each web server to run as that gMSA using the " specified user account " identity option (entered as domain\gMSA$ with no password required, since the password is centrally managed). Creating a system- or user-assigned managed identity in Microsoft Entra ID does not apply here, since Webapp1 runs on IIS on domain-joined VMs, not as an Azure PaaS resource.
Topic 3, Case Study 3: A Datum CorporationThis is a case study.
Case studies are not timed separately. You can use as much exam
time as you would like to complete each case. However, there may be
additional case studies and sections on this exam. You must manage
your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
Overview: A Datum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal. A. Datum recently partnered with a company named Fabrikam, Inc. Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
The on-premises network of A Datum contains an Active Directory Domain Services (AD DS) forest named adatum.com. The forest contains two domains named adatum.com and east.adatum.com, and the domain controllers shown in the exhibit below.
Domain controllers
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com. The forest contains two domains named fabrikam.com and south.fabrikam.com. The fabrikam.com domain contains an organizational unit (OU) named Marketing.
The adatum.com domain contains the servers shown in the exhibit below.
Servers
HyperV1 contains the virtual machines shown in the exhibit below. All the virtual machines on HyperV1 have only the default management tools installed.
HyperV1 virtual machines
SSPace1 contains the Storage Spaces virtual disks shown in the exhibit below.
SSPace1 virtual disks
A Datum has an Azure subscription that contains a Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Microsoft Entra ID. The subscription contains the virtual networks shown in the exhibit below.
Virtual networks
The subscription contains the Azure private DNS zones shown in the exhibit below.
Private DNS zones
The subscription contains the virtual machines shown in the exhibit below. All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Azure virtual machines
Planned Changes: A Datum plans to implement the following changes:
- Sync Data1 to share1.
- Configure an Azure runbook named Task1.
- Enable Microsoft Entra users to sign in to Server1.
- Create an Azure DNS Private Resolver that has the following configuration: Name: Private1; Region: West US; Virtual network: VNet1; Inbound endpoint: SubnetB.
- Enable users in the adatum.com domain to access the resources in the south.fabrikam.com domain.
Technical Requirements: A Datum identifies the following technical requirements:
- The data on SSPace1 must be available always.
- DC2 must become the schema master if DC1 fails.
- VMs must be configured to enable per-folder quotas.
- Trusts must allow access to only the required resources.
- The users in the Marketing OU must have access to storage1.
- Azure Automanage must be used on all supported Azure virtual machines.
- A direct SSH session must be used to manage all the supported virtual machines on HyperV1.
NEW QUESTION # 159
Your network contains an Active Directory Domain Services (AD DS) forest.
The forest contains a root domain named contoso.com and a child domain named branch.contoso.com. The domain contains a domain controller named DC1 that holds all the domain-wide FSMO roles.
DC1 fails and cannot be restored, causing the following issues:
* Recent password changes are NOT recognized immediately during sign-ins to contoso.com.
* Domains cannot be added or removed from the forest.
You need to seize the minimum domain-wide FSMO roles on a domain controller named DC2 to resolve the issues.
Which role should you seize for each issue? To answer, drag the appropriate roles to the correct issue. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Recent password changes not recognized immediately: PDC emulator. Domains cannot be added or removed:
Domain naming master.
The PDC emulator role is responsible for handling urgent, time-sensitive password change replication: when a user ' s password is changed on any writable domain controller, that DC immediately and preferentially replicates the change to the PDC emulator, and any other DC that fails to validate a sign-in attempt with a presented password will, before rejecting it, forward the authentication check to the PDC emulator to see if a more recent password change simply has not replicated to it yet; without a functioning PDC emulator, that fallback check cannot happen, so recently changed passwords fail to be recognized immediately across the domain until normal replication eventually catches up, exactly matching the first issue, and seizing the PDC emulator role onto DC2 restores that immediate cross-DC password-change recognition path. The domain naming master role is the single forest-wide authority responsible for ensuring the uniqueness of domain names anywhere new domains are added to, or existing domains removed from, the forest, and every add- domain or remove-domain operation must contact the domain naming master to be permitted to proceed; without an available domain naming master, those operations are blocked outright, exactly matching the second issue, and seizing that role onto DC2 restores the ability to add or remove domains. The RID master, infrastructure master, and schema master roles have no bearing on either symptom described.
NEW QUESTION # 160
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contos.
com. The domain contains the accounts shown in the following table.
The domain is configured to store BitLocker recovery keys in Active Directory.
* Admin1 turns on BitLocker Drive Encryption (BitLocker) for volume C on Server1.
* Admin1 moves Server1 to OU1.
* Admin2 turns on BitLocker for removable volume E on Server2.
* Admin2 moves removable volume E from Server2 to Server1 and unlocks the volume.
On which Active Directory object can you each BitLocker recovery key? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth on point.
Answer:
Explanation:
Explanation:
The BitLocker recovery key for volume C: the Server1 computer object. The BitLocker recovery key for volume E: the Server2 computer object.
When BitLocker recovery information is backed up to Active Directory Domain Services, it is written as a child object underneath the computer object of whichever machine was actually running when the key protector was created; it is never written under a user object, an organizational unit object, or the domain root itself. Because Admin1 turned on BitLocker for volume C directly on Server1, that recovery password is stored as a child object of Server1 ' s own computer object, and Admin1 subsequently moving Server1 into OU1 only changes Server1 ' s location within the directory tree, not which computer object actually holds its recovery data. Because Admin2 turned on BitLocker for removable volume E while it was physically attached to Server2, its recovery password was written under Server2 ' s computer object at that time. Simply moving the removable drive over to Server1 afterward and unlocking it there does not trigger a new backup to Active Directory, since a new recovery-information object is only created when a key protector is actually added to a volume, not merely when an already-encrypted volume is unlocked elsewhere. The recovery key for volume E therefore remains associated with Server2 ' s computer object even after the drive itself has been physically relocated to Server1.
NEW QUESTION # 161
Your on-premises network contains an Active Directory Domain Services (AD DS) domain.
You plan to implement BitLocker Drive Encryption (BitLocker) for the domain.
You create a Group Policy Object (6P0) and enable the Choose how BitLocker-protected operating system drives can be recovered Group Policy setting.
You need to configure a data recovery agent (DRA) for drive recovery.
What should you use to configure the DRA, and which additional Group Policy setting should you enable? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Configure the DRA by using: A digital certificate. Enable setting: Choose default folder for recovery password.
A BitLocker data recovery agent is configured using a public-key (PKI) digital certificate issued from a duplicated Key Recovery Agent template that carries the BitLocker Drive Encryption and BitLocker Data Recovery Agent application policies; the certificate ' s public key is added to the domain ' s DRA configuration through Public Key Policies > BitLocker Drive Encryption in Group Policy, after which every computer that later encrypts a drive under that policy automatically protects the drive ' s recovery key with the DRA certificate, letting a holder of the corresponding private key decrypt any protected drive domain-wide. A BitLocker recovery password (a 48-digit numerical key), a user principal name, and a security identifier are all identifiers or credentials associated with individual users or computers rather than the credential type used to configure a data recovery agent itself, so none of those options describes how a DRA is set up. Because a DRA relies on 48-digit numerical recovery passwords being generated and escrowed for each protected drive as the actual recovery mechanism the DRA certificate later decrypts, enabling Choose default folder for recovery password ensures every BitLocker-enabled computer automatically saves a copy of its numerical recovery password to a specified, centrally accessible network folder as each drive is encrypted, giving administrators (and, in effect, the DRA-holding recovery workflow) a reliable location to retrieve recovery data from without depending solely on AD DS storage or manual per-user handling.
NEW QUESTION # 162
Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a file server named Server1 that hosts multiple shared folders. You have an Azure subscription. You need to migrate the files stored on Server1 to Azure by using an Azure Data Box Gateway. To which storage services can you migrate the files?
Answer: B
Explanation:
Azure Data Box Gateway is a virtual storage appliance deployed on-premises that accepts data over SMB and NFS shares and then transfers it to Azure, and it can write that data to Azure Files as well as to Azure Storage as either block blobs or page blobs, depending on how the local share is mapped to a destination storage account. This flexibility lets Server1 ' s file shares be migrated to whichever storage service best fits the workload, so all three destinations are valid targets for the migration, not just a subset of them. An administrator configures this mapping per share when setting up the Data Box Gateway ' s storage account connection, choosing a file share endpoint for Azure Files, a block blob container for general unstructured data, or a page blob container when the workload specifically needs page blob semantics such as for VHD- backed data, all from the same Data Box Gateway appliance without deploying separate migration tooling for each destination type.
NEW QUESTION # 163
......
With AZ-802 study engine, you will get rid of the dilemma that you work hard but cannot improve. With our AZ-802 learning materials, you can spend less time but learn more knowledge than others. AZ-802 exam questions will help you reach the peak of your career. Just think of that after you get the AZ-802 Certification, you will have a lot of opportunities of going to biger and better company and getting higher incomes! what a brighter future!
100% AZ-802 Exam Coverage: https://www.pdfdumps.com/AZ-802-valid-exam.html