Administering Windows Server Exam Questions save your study time and help you prepare in less duration. We have hundreds of most probable questions which have a chance to appear in the real Administering Windows Server exam. The Microsoft AZ-802 exam questions are affordable and 365 days free updated, and you can use them without any guidance. However, in case of any trouble, our support team is always available to sort out the problems. We will provide you with the information covered in the current test and incorporate materials that originate from Microsoft AZ-802 Exam Dumps.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Manage virtual machines and containers | 15% | - Deploy and manage containers and Kubernetes on Windows Server - Configure Azure Arc-enabled servers and VMs - Deploy and manage Hyper-V virtual machines |
| Topic 2: Implement and manage an on-premises and hybrid networking infrastructure | 15% | - Configure IP addressing, DNS, and DHCP - Implement hybrid network connectivity - Secure network traffic in hybrid environments - Configure software-defined networking |
| Topic 3: Implement high availability and disaster recovery | 5% | - Monitor and troubleshoot Windows Server environments - Perform server and workload migrations - Implement backup and recovery solutions - Configure failover clustering - Use Azure Site Recovery for hybrid workloads |
| Topic 4: Secure Windows Server on-premises and hybrid infrastructures | 10% | - Manage access control and permissions - Configure Windows Defender and audit policies - Implement security baselines and hardening |
| Topic 5: Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments | 20% | - Install and configure domain controllers - Manage FSMO roles and replication - Integrate AD DS with Azure AD and Azure Arc - Implement and manage Group Policy Objects |
| Topic 6: Manage storage and file services | 15% | - Configure file servers and shares - Configure data deduplication and replication - Implement Storage Spaces and Storage Spaces Direct - Integrate on-premises storage with Azure Storage |
| Topic 7: Manage Windows Servers and workloads in a hybrid environment | 20% | - Manage updates and patches across hybrid servers - Implement hybrid identity solutions - Configure remote management and secure administration - Deploy servers using Windows Admin Center and Azure Arc |
As we all know that the higher position always ask for the more capable man. So your strength and efficiency will really bring you more job opportunities. You must complete your goals in the shortest possible time. How to make it? Our AZ-802 exam materials can give you a lot of help. Our AZ-802 Study Guide is famous for its high-effective and high-efficiency advantages. If you study with our AZ-802 practice engine, you can get the latest and specialized information in the subject and you will be rewarded with the certification.
NEW QUESTION # 490
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains two domains named contoso.com and east.contoso.com. Contoso.com contains two users named CONTOSO\User1 and EAST\User2. You need to ensure that the users can perform the following tasks: * User1 must deploy an additional domain controller to east.contoso.com. * User2 must deploy a new domain controller that will host a domain named west.contoso.com. The solution must follow the principle of least privilege. To which group should you add each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
User1: EAST\Domain Admins. User2: CONTOSO\Enterprise Admins.
Promoting an additional domain controller into a domain that already exists requires rights scoped only to that specific domain -- membership in that domain ' s own Domain Admins group (or an account explicitly delegated the equivalent rights) is sufficient and is the least-privileged group that accomplishes it. Since User1 needs to add an additional DC to the already-existing east.contoso.com domain, adding User1 to EAST\Domain Admins grants exactly the rights needed, without requiring any broader, forest-wide privilege.
Creating an entirely new domain within an existing forest (here, standing up a brand-new west.contoso.com domain) is a forest-wide structural change -- it adds a new partition and a new entry to the forest ' s domain- naming data that all domains and DCs in the forest must become aware of -- and this operation requires Enterprise Admins rights (or equivalent forest-level delegation), since no single domain ' s Domain Admins group has sufficient scope to add a new domain to the forest. Since User2 needs to deploy a DC that will host a brand-new domain, User2 must be added to CONTOSO\Enterprise Admins (Enterprise Admins exists only in the forest root domain, contoso.com, and confers forest-wide rights). Adding either user to a broader group than necessary (for example, adding User1 to Enterprise Admins, or granting Schema Admins to either) would violate least privilege, since each user ' s actual task only requires the narrower, task-appropriate group.
NEW QUESTION # 491
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two users named Contractor1 and Admin1.
You need to configure Account options for the users. The solution must meet the following requirements:
* Contractor1 must be prevented from signing in to their client computer until an administrator enables their account.
* The credentials of Admin1 must NOT be usable by services that access network resources on behalf of users What should you select for each user? To answer, drag the appropriate account options to the correct users.
Each option may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Contractor1: Account is disabled. Admin1: Account is sensitive and cannot be delegated.
The Account is disabled option immediately and completely prevents an account from signing in to any computer at all until an administrator explicitly clears the option, which is exactly the requirement for Contractor1: the account remains fully blocked from interactive sign-in until an administrator re-enables it, unlike options such as User must change password at next logon (which still permits an initial sign-in) or Smart card is required for interactive logon (which changes the authentication method rather than blocking sign-in outright). The requirement for Admin1, that the account ' s credentials must not be usable by any service acting on behalf of other users, describes credential delegation, the mechanism by which a service that has authenticated as Admin1 can reuse those credentials to access further network resources impersonating Admin1; the Account is sensitive and cannot be delegated option sets the underlying userAccountControl flag that prevents any service or application from being granted a delegated (forwardable) Kerberos ticket for that account, so no downstream service can present Admin1 ' s credentials to a third resource on the user ' s behalf, directly satisfying the requirement. Password never expires and User cannot change password address password lifecycle and self-service password changes, not sign-in blocking or delegation, and neither would achieve either stated requirement for Contractor1 or Admin1.
NEW QUESTION # 492
Your on-premises network has a 200-Mbps connection to Azure and contains a server named Server1 that stores 70 TB of data files. You have an Azure Storage account named storage1. You plan to migrate the data files from Server1 to a blob storage container in storage1. Testing shows that copying the data files by using azcopy will take approximately 35 days. You need to minimize how long it will take to migrate the data to Azure. What should you use?
Answer: D
Explanation:
At roughly 200 Mbps of effective throughput, moving 70 TB of data online -- as the azcopy test already demonstrated, at about 35 days -- is impractical for any tool that still has to push the bytes across that same constrained link. Microsoft ' s documented offline-transfer path for exactly this kind of large, bandwidth- constrained migration is Azure Data Box: a physically shipped, ruggedized storage appliance that an administrator loads with the data directly on-premises using a local high-speed connection, then ships back to a Microsoft datacenter, where the data is uploaded into the target storage account over Microsoft ' s own internal high-speed backbone rather than the customer ' s internet link. This approach cuts the effective migration time from many weeks down to a matter of days, dominated mostly by shipping time rather than data-transfer time. Storage Migration Service, Azure Storage Explorer, and Azure File Sync all still depend on moving bytes across that same 200 Mbps network connection, so none of them meaningfully improves on the
35-day estimate for this volume of data, making Azure Data Box the only option that actually minimizes the migration time here.
NEW QUESTION # 493
Your company has a main office and a branch office. The two offices are connected by using a WAN link.
Each office contains a firewall that filters WAN traffic. The network in the branch office contains 10 servers that run Windows Server. All servers are administered from the main office only. You plan to manage the servers in the branch office by using a Windows Admin Center gateway. On a server in the branch office, you install the Windows Admin Center gateway by using the default settings. You need to configure the firewall in the branch office to allow the required inbound connection to the Windows Admin Center gateway. Which inbound TCP port should you allow?
Answer: B
Explanation:
Windows Admin Center ' s gateway installation, by default, hosts its browser-based management portal over HTTPS on TCP port 443. Administrators at the main office reach the gateway server in the branch office by pointing a web browser at https:// < gatewayserver > , and that HTTPS session is what the branch office firewall must permit inbound from the WAN. Once that portal connection is established, the gateway itself relays management traffic to the target servers using WinRM (over HTTP/HTTPS) on the local network, but that relay happens between the gateway and the managed servers inside the branch office, not across the WAN link the firewall is filtering. Port 3389 is used for Remote Desktop Protocol (RDP) sessions, which is a different management channel entirely and not what a default Windows Admin Center gateway installation listens on. Port 5985 is the default WinRM HTTP port used for PowerShell remoting and is what the gateway uses internally to reach managed nodes, not the port browsers use to reach the gateway itself. Port 6516 is unrelated to Windows Admin Center. Because the requirement is specifically to let administrators ' browser sessions reach the gateway from across the WAN, the firewall must allow inbound TCP 443, matching the gateway ' s default HTTPS listener.
NEW QUESTION # 494
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains 10 servers that run Windows Server. The servers currently have static IPv4 addresses.
You plan to use DHCP to assign IPv4 addresses to the servers.
You need to ensure that each server always receives the same IPv4 address.
Which type of identifier should you use to create a DHCP reservation for each server?
Answer: B
Explanation:
A Windows Server DHCP reservation associates a specific IPv4 address with a specific DHCP client by using the client identifier, normally the MAC address of the server ' s network interface. Whenever that NIC requests a lease, DHCP recognizes the associated MAC address and leases the reserved IP address rather than selecting another address dynamically from the available pool. Microsoft's Windows Server DHCP documentation specifically shows reservations created by supplying the NIC MAC address through the ClientId parameter of Add-DhcpServerv4Reservation. An FQDN and NetBIOS name are name-resolution identifiers and are not the standard identifiers used to bind an IPv4 DHCP reservation. A UUID is relevant to other provisioning or boot scenarios but is not the appropriate identifier for an ordinary Windows DHCP IPv4 reservation. Microsoft Learn
NEW QUESTION # 495
......
Our AZ-802 exam training' developers to stand in the perspective of candidate and meet the conditions for each user to tailor their AZ-802 learning materials. What's more, our AZ-802 guide questions are cheap and cheap, and we buy more and deliver more. The more customers we buy, the bigger the discount will be. In order to make the user a better experience to the superiority of our AZ-802 Actual Exam guide, we also provide considerate service, users have any questions related to our AZ-802 study materials, can get the help of our staff in a timely manner.
New AZ-802 Braindumps Free: https://www.vceprep.com/AZ-802-latest-vce-prep.html