AZ-802 認證對於雇員和雇主來說都有好處。對雇員來說，它包括技術可信度,繼續教育和事業升遷的機會,更多的工作滿足感。但是 Microsoft AZ-802 考試是考生所能接受的考試，對有心應考的人來說，實在是不小的負擔。若第一次沒通過，又需一大筆的費用重考。如果您正在准備 Microsoft 的 AZ-802 考試以獲得適當的知識和技能，KaoGuTi 考題網的練習題和答案，為您節約寶貴的時間以及金錢并順利通過考試。
| Section | Weight | Objectives |
|---|---|---|
| Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments | 20% | - Install and configure domain controllers - Manage FSMO roles and replication - Implement and manage Group Policy Objects - Integrate AD DS with Azure AD and Azure Arc |
| Manage Windows Servers and workloads in a hybrid environment | 20% | - Implement hybrid identity solutions - Deploy servers using Windows Admin Center and Azure Arc - Manage updates and patches across hybrid servers - Configure remote management and secure administration |
| Manage virtual machines and containers | 15% | - Configure Azure Arc-enabled servers and VMs - Deploy and manage Hyper-V virtual machines - Deploy and manage containers and Kubernetes on Windows Server |
| Implement high availability and disaster recovery | 5% | - Use Azure Site Recovery for hybrid workloads - Implement backup and recovery solutions - Monitor and troubleshoot Windows Server environments - Perform server and workload migrations - Configure failover clustering |
| Implement and manage an on-premises and hybrid networking infrastructure | 15% | - Secure network traffic in hybrid environments - Configure software-defined networking - Configure IP addressing, DNS, and DHCP - Implement hybrid network connectivity |
| Manage storage and file services | 15% | - Integrate on-premises storage with Azure Storage - Configure data deduplication and replication - Configure file servers and shares - Implement Storage Spaces and Storage Spaces Direct |
| Secure Windows Server on-premises and hybrid infrastructures | 10% | - Implement security baselines and hardening - Manage access control and permissions - Configure Windows Defender and audit policies |
Microsoft AZ-802認證考試是目前IT人士報名參加的考試中很受歡迎的一個認證考試。通過了Microsoft AZ-802認證考試不僅能使你工作和生活帶來提升，而且還能鞏固你在IT 領域的地位。但是事實情況是它通過率確很低。
問題 #197
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contos.
com. The domain contains the accounts shown in the following table.
The domain is configured to store BitLocker recovery keys in Active Directory.
* Admin1 turns on BitLocker Drive Encryption (BitLocker) for volume C on Server1.
* Admin1 moves Server1 to OU1.
* Admin2 turns on BitLocker for removable volume E on Server2.
* Admin2 moves removable volume E from Server2 to Server1 and unlocks the volume.
On which Active Directory object can you each BitLocker recovery key? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth on point.
答案：
解題說明：
Explanation:
The BitLocker recovery key for volume C: the Server1 computer object. The BitLocker recovery key for volume E: the Server2 computer object.
When BitLocker recovery information is backed up to Active Directory Domain Services, it is written as a child object underneath the computer object of whichever machine was actually running when the key protector was created; it is never written under a user object, an organizational unit object, or the domain root itself. Because Admin1 turned on BitLocker for volume C directly on Server1, that recovery password is stored as a child object of Server1 ' s own computer object, and Admin1 subsequently moving Server1 into OU1 only changes Server1 ' s location within the directory tree, not which computer object actually holds its recovery data. Because Admin2 turned on BitLocker for removable volume E while it was physically attached to Server2, its recovery password was written under Server2 ' s computer object at that time. Simply moving the removable drive over to Server1 afterward and unlocking it there does not trigger a new backup to Active Directory, since a new recovery-information object is only created when a key protector is actually added to a volume, not merely when an already-encrypted volume is unlocked elsewhere. The recovery key for volume E therefore remains associated with Server2 ' s computer object even after the drive itself has been physically relocated to Server1.
問題 #198
You have a server that runs Windows Server and has the DHCP Server role installed. The server has a scope named Scope1 that has the following configuration: address range 192.168.0.2 to 192.168.1.254; mask
255.255.254.0; router 192.168.0.1; lease duration 3 days; DNS server 172.16.0.254. You have 50 Microsoft Teams Phone devices from the same vendor. All the devices have MAC addresses within the same range. You need to ensure that all the Teams Phone devices that receive a lease from Scope1 have IP addresses in the range of 192.168.1.100 to 192.168.1.200. The solution must not affect other DHCP clients that receive IP configurations from Scope1. What should you create?
答案：A
解題說明：
Windows Server DHCP policies let an administrator define conditions, such as a MAC address prefix/range or vendor class, and, when a requesting client matches those conditions, assign it an address from a specific sub-range carved out within an existing scope, all without creating a second scope or disturbing how other clients in that same scope are served. Because all 50 Teams Phone devices share MAC addresses within a known, identifiable range, a policy can match on that MAC prefix and hand out addresses only from
192.168.1.100-192.168.1.200, while every other client in Scope1 continues to receive addresses from the rest of the pool as before, exactly matching the requirement to not affect other clients. Creating a second scope would require a distinct, non-overlapping subnet and would not let two scopes share the same 192.168.0.0/23- style address space as described. A DHCP filter (allow/deny list) can only permit or block specific MAC addresses from getting a lease at all; it has no ability to steer a matched device into a particular IP sub-range.
Scope options configure settings such as DNS servers or default gateway for the whole scope and have no address-targeting capability. A policy is therefore the correct feature to create.
問題 #199
Your network contains an Active Directory Domain Services (AD DS) forest. You need to deploy a Storage Spaces Direct converged infrastructure. The solution must meet the following requirements: -- Use an Ethernet fabric. -- Eliminate the need for Data Center Bridging (DCB). Which Remote Direct Memory Access (RDMA) networking technology should you implement?
答案：C
解題說明：
iWARP (Internet Wide Area RDMA Protocol) implements RDMA on top of standard TCP/IP, which allows it to operate over an ordinary, lossy Ethernet fabric without requiring Data Center Bridging or Priority Flow Control to guarantee lossless delivery of RDMA traffic. This is fundamentally different from RoCE (RDMA over Converged Ethernet), in either its v1 or v2 form, both of which depend on a DCB-configured, lossless Ethernet fabric to operate reliably, since RoCE has no built-in congestion or loss-recovery mechanism of its own and instead relies on the underlying network to guarantee lossless delivery. InfiniBand is excluded outright because it is not an Ethernet-based fabric at all, and the requirement explicitly calls for an Ethernet fabric. Because the deployment must use Ethernet while specifically eliminating the DCB dependency that both RoCEv1 and RoCEv2 require, iWARP is the only RDMA technology among the options that satisfies both stated requirements simultaneously for the Storage Spaces Direct converged infrastructure deployment.
問題 #200
Your network contains the Active Directory Domain Services (AD DS) forests shown in the following table.
You need to configure trust relationships as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No NOTE: Each correct selection is worth one point.
答案：
解題說明：
Explanation:
Statement 1: No. Statement 2: Yes. Statement 3: Yes.
Forest trusts are transitive across every domain within each of the two forests they connect but are never transitive into a third, unrelated forest, so a forest trust between contoso.com and fabrikam.com and a separate trust involving adatum.com and research.fabrikam.com do not chain together; contoso.com has no trust relationship of any kind with adatum.com ' s forest, so contoso.com users cannot access resources in adatum.
com after both trusts are configured, making statement 1 false. The Contoso-Fabrikam requirement needs every domain in either forest to reach every domain in the other, which is precisely what a single two-way forest trust provides, since forest trust transitivity automatically extends to every child domain in both forests (contoso.com, europe.contoso.com, asia.contoso.com, fabrikam.com, and research.fabrikam.com), so statement 2 is true and no additional external or domain trusts are needed. The Adatum-Fabrikam requirement is narrower, needing only adatum.com ' s users to reach a single domain, research.fabrikam.com; a one-way external trust in which research.fabrikam.com is the trusting domain and adatum.com is the trusted domain grants exactly that direction of access (the trusting domain permits authorized users of the trusted domain to access its resources), and since only one specific domain pair needs access, the external trust ' s non- transitivity is not a limitation here, so statement 3 is true.
問題 #201
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a domain controller named DC1 and a member server named Server1. Users cannot sign in to Server1 by using domain credentials and receive the following error message: The trust relationship between this workstation and the primary domain failed. You need to restore domain authentication on Server1 without removing Server1 from the domain.
Solution: From Server1, you run Test-ComputerSecureChannel -Repair. Does this meet the goal?
答案：A
解題說明：
The trust relationship between this workstation and the primary domain failed error means the shared secret (the computer account ' s password) that Server1 stores locally no longer matches the password value stored for Server1 ' s computer account in AD DS, breaking the secure channel Server1 needs to authenticate domain sign-ins. Test-ComputerSecureChannel is the PowerShell cmdlet specifically built to test, and with the - Repair switch, restore, that secure channel: when run with -Repair (optionally supplying domain administrator credentials via -Credential if the caller ' s own cached credentials are insufficient), it resynchronizes Server1 ' s local computer account password with the value AD DS expects, using the same underlying mechanism as Netlogon ' s channel-repair logic, without requiring Server1 to be removed from and rejoined to the domain and without requiring any domain-wide or server-wide configuration change. Because this directly restores password synchronization on both sides of the secure channel in a single, targeted operation scoped to Server1 alone, it fully satisfies the stated goal of restoring domain authentication without removing Server1 from the domain. This is, in fact, Microsoft ' s documented first-line remediation for this exact error message, ahead of more disruptive options such as Reset-ComputerMachinePassword or a full disjoin/rejoin, both of which are typically reserved for cases where Test-ComputerSecureChannel -Repair itself fails to resolve the broken channel.
問題 #202
......
KaoGuTi Microsoft的AZ-802考試培訓資料是個性價很高的培訓資料，與眾多培訓資料相比，KaoGuTi Microsoft的AZ-802考試培訓資料是最好的，如果你需要IT認證培訓資料，不選擇KaoGuTi Microsoft的AZ-802考試培訓資料，你將後悔一輩子，選擇了KaoGuTi Microsoft的AZ-802考試培訓資料，你將終身受益。
AZ-802考試指南: https://www.kaoguti.com/AZ-802_exam-pdf.html