Sie können Prüfungsfragen und Antworten zur Microsoft AZ-802 Zertifizierungsprüfung teilweise umsonst als Probe herunterladen. Sobald Sie PrüfungFrage wählen, würden wir alles tun, um Ihnen bei der Prüfung zu helfen. Wenn Sie später finden, dass die von uns gebotenen Microsoft AZ-802 Prüfungsfragen und Antworten den echten Prüfungsfragen und Antworten nicht entsprechen und Sie somit die Prüfung nicht bestehen, dann erstatten wir Ihnen die an uns geleisteten Zahlung.
| Section | Objectives |
|---|---|
| Topic 1: Secure and manage Windows Server environments | - Identity and access management
|
| Topic 2: Networking and high availability | - Networking infrastructure
|
| Topic 3: Compute, storage, and virtualization | - Virtual machines and containers
|
| Topic 4: Hybrid infrastructure management | - Azure integration
|
Die Zertifikat der Microsoft AZ-802 ist international anerkannt. Sie zu erwerben bedeutet, dass Sie den Schlüssel zur höheren Stelle besitzen. Die Microsoft AZ-802 Prüfungsunterlagen von PrüfungFrage werden von erfahrenen IT-Profis herstellt und immer wieder aktualisiert. Jetzt können Sie mit günstigem Preis die verlässliche Microsoft AZ-802 Prüfungsunterlagen genießen. Nachdem Sie die Zertifizierung erwerbt haben, können Sie leicht eine höhere Arbeitsposition oder Gehalten bekommen.
299. Frage
You have a Storage Spaces Direct cluster named Cluster1 that contains multiple nodes.
You have a firmware update for the hard disks attached to each node.
You create a configuration file named FileLxm1 for the update.
You need to automate the rollout of the firmware update to the nodes of Cluster1. The solution must minimize downtime of the workloads hosted in Cluster1.
How should you complete the PowerShell commands? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Exhibit
Antwort:
Begründung:
Explanation:
Automating a Storage Spaces Direct firmware or driver rollout is done by pointing the clustered storage subsystem at a components manifest file that describes the supported firmware/driver versions, then letting Storage Spaces Direct orchestrate the update across nodes with the workload kept online. Get- StorageSubSystem retrieves the clustered storage subsystem object for Cluster1, and piping it to Set- StorageSetting with the System.Storage.SupportedComponents.Document parameter registers File1.xml as that manifest, which is the documented mechanism for automating a rolling, low-downtime firmware update.
The other cmdlets shown (Get-StorageFirmwareInformation, Get-StorageEnclosureVendorData, Set- StorageProvider, Set-StorageHealthSetting) either only report information or configure unrelated settings and would not register the manifest or trigger the orchestrated rollout that keeps virtual machines and other workloads running while each node ' s disks are updated in turn. Once the manifest is registered, Storage Spaces Direct automatically sequences the firmware update node by node, draining and updating one node ' s drives at a time so cluster resources continue to run on the remaining nodes throughout the rollout.
300. Frage
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that runs Windows Server. Server1 has volume C: (OperatingSystem, unencrypted) and volume D: (Data, fully encrypted with BitLocker, KeyProtector currently Password and RecoveryPassword).
You need to add the computer account of Server1 as a key protector for volume D so that Server1 can automatically unlock the volume without a signed-in user. How should you complete the command? To answer, select the appropriate options in the answer area.
BitLocker status for volumes C and D
Antwort:
Begründung:
Explanation:
Cmdlet: Add-BitLockerKeyProtector -MountPoint D: -ADAccountOrGroupProtector CONTOSO\Server1$ - Service.
The -ADAccountOrGroupProtector parameter of Add-BitLockerKeyProtector adds an Active Directory account or group as a key protector for a BitLocker-protected volume, and this protector type can only be applied to a data volume, not an operating system volume, which is consistent with the scenario targeting the D: data volume rather than the C: operating system volume shown as unencrypted in the exhibit. Pairing - ADAccountOrGroupProtector with the -Service switch specifically tells BitLocker that the AD object being added as a protector is the computer ' s own service, or machine, account, expressed in the form DOMAIN\ComputerName$, which is what lets Server1 automatically unlock the volume on its own using its computer account credentials without requiring any signed-in user to enter a password or PIN. The second dropdown correctly resolves to -Service rather than -TPMandPinProtector or - TPMandPinAndStartupKeyProtector, since neither of those protector types is meant to be combined with an AD account or group protector, and neither one authenticates using a computer account the way -Service does.
301. Frage
You have an Azure subscription that contains an Azure Recovery Services vault. You have an on-premises physical server that runs Windows Server. You need to back up the server daily to Azure. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Antwort:
Begründung:
Explanation:
1. Download the Vault Credentials file. 2. Install and register the Microsoft Azure Recovery Services (MARS) agent. 3. Schedule a backup.
Backing up an on-premises physical Windows Server directly to an Azure Recovery Services vault follows a fixed order of operations. First, the administrator downloads the Vault Credentials file from the Recovery Services vault in the Azure portal; this file contains the information the server needs to authenticate itself against that specific vault. Next, the Microsoft Azure Recovery Services (MARS) agent is installed on the physical server and, during its setup wizard, registered to the vault using that downloaded credentials file.
Only after registration completes can a backup policy actually be created and a recurring schedule configured from within the registered agent ' s console, which is the final step that establishes the daily backup cadence the requirement calls for. The Azure Connected Machine agent and the Azure Site Recovery Mobility service agent serve entirely different purposes -- Arc onboarding and disaster-recovery replication, respectively -- and play no role in this straightforward MARS-based backup-to-vault workflow.
302. Frage
You have a Microsoft Entra Domain Services managed domain named contoso.com. You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least privilege. To which group should you add the administrator?
Antwort: E
Begründung:
Microsoft Entra Domain Services is a managed domain: Microsoft operates the underlying domain controllers, so the traditional highly privileged forest-wide groups (Enterprise Admins, Schema Admins) and even Domain Admins do not exist, or exist with far more restricted scope than in a self-managed AD DS forest. Instead, Microsoft provisions a purpose-built group, AAD DC Administrators, whose members are delegated exactly the rights needed to administer the managed domain - including creating, editing, and linking Group Policy Objects, and administering domain-joined computers - without granting broader control over the managed domain controllers themselves, which remain outside customer control. Group Policy Creator Owners is a legitimate GPO-creation group in traditional AD DS, but it is not the delegation model used in a Microsoft Entra Domain Services managed domain, and in this managed context GPO administration is specifically routed through AAD DC Administrators. Domain Admins, Enterprise Admins, and Schema Admins either do not apply, are not exposed to customers, or would grant far more than is needed (and in several cases simply are not available options in a managed domain). Because the requirement explicitly calls for least privilege while still enabling GPO management, adding the administrator to the AAD DC Administrators group is the correct and only appropriate choice.
303. Frage
You plan to deploy an Azure confidential virtual machine named VM1. You need to ensure that you can implement confidential disk encryption for VM1. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Antwort:
Begründung:
Explanation:
Confidential disk encryption is a platform feature available only on confidential VM sizes such as the DCasv5
/DCadsv5/DCesv6 (and equivalent ECasv5/ECesv6) series, so VM1 must be deployed on a DC-series confidential SKU rather than the NC (GPU) or HB (HPC) families. Confidential disk encryption itself binds the encryption key to the VM ' s own vTPM and, by design, protects the operating system disk; the temp disk can optionally be added through a separate confidential temp disk encryption extension, but data disks are not covered by this mechanism and instead rely on guest-level encryption such as BitLocker if extra protection is required. Consequently the disk scope for confidential disk encryption is the operating system disk only, not the OS disk together with data disks. The encryption keys can be customer-managed and held in a managed HSM or Key Vault with purge protection enabled, ensuring the platform itself cannot access the disk contents outside the attested confidential VM boundary, which is the core security guarantee this feature provides over standard Azure Disk Encryption.
304. Frage
......
PrüfungFrage ist eine Website, die alle Ihrer Bedürfnisse zur Microsoft AZ-802 Zertifizierungsprüfung abdecken kann. Mit den Prüfungsmaterialien von PrüfungFrage können Sie die Microsoft AZ-802 Zertifizierungsprüfung mit einer ganz hohen Note bestehen.
AZ-802 Exam Fragen: https://www.pruefungfrage.de/AZ-802-dumps-deutsch.html