作為IT業界的頂級公司，Microsoft 通過其認證確定了產品專家的標準，可以說 Microsoft 在業界的聲望和 Microsoft 產品的市場佔有率提升了其認證工程師的含金量，一個 Microsoft 認證工程師獲取在優秀企業工作的機會比普通工程師大60％－80％，平均薪水高出30％-50％。世界500強企業中，有超過2/3的企業選擇了Microsoft電子商務軟體產品作為其核心的運用。因此，獲得AZ-802 的證照，即使在強手林立的競爭環境中，你同樣能夠脫穎而出。
| Section | Objectives |
|---|---|
| Secure and manage Windows Server environments | - Identity and access management
|
| Networking and high availability | - High availability and disaster recovery
|
| Compute, storage, and virtualization | - Virtual machines and containers
|
| Hybrid infrastructure management | - Azure integration
|
如果你想通過Microsoft的AZ-802考試認證使自己在當今競爭激烈的IT行業中地位更牢固，在IT行業中的的專業技能更強大，你的需要很強的專業知識和日積月累的努力，而且通過Microsoft的AZ-802考試認證也不是簡單的，或許通過Microsoft的AZ-802考試認證是你向IT行業推廣自己的時候，但是不一定需要花費大量的時間和精力來學習專業知識，你可以選擇我們KaoGuTi Microsoft的AZ-802考試培訓資料，專門是針對IT相關考試認證研究出來的培訓產品。有了它你就可以毫不費力的通過了這麼困難的Microsoft的AZ-802考試認證。
問題 #232
You have an Azure virtual machine named VM1 that runs Windows Server. The disks on VM1 are protected by using Azure Disk Encryption.
You need to use PowerShell to disable disk encryption on the data disks attached to VM1.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Exhibit
答案：
解題說明：
Explanation:
The Disable-AzVMDiskEncryption cmdlet, part of the Az.Compute module, removes Azure Disk Encryption
' s protection from a VM ' s disks by uninstalling or reconfiguring the encryption extension, and its - VolumeType parameter accepts the values All, OS, or Data to scope exactly which class of disk the disable operation applies to. Specifying -VolumeType Data restricts the disable operation strictly to the data disks attached to VM1, leaving the OS disk ' s own BitLocker or DM-Crypt encryption state completely untouched, which precisely matches the requirement to disable encryption specifically on VM1 ' s data disks without affecting the operating system volume. The other candidate cmdlets shown, Disable-BitLocker, Set- AzVMDiskEncryptionExtension, and Set-AzVMDataDisk, either operate at the wrong layer, such as Disable- BitLocker acting inside the guest OS rather than through the Azure Resource Manager-level encryption extension, or perform the opposite or an unrelated operation, such as enabling encryption or attaching a data disk, so none of them accomplishes the specific disable-on-data-disks-only outcome the scenario calls for.
Running this cmdlet against VM1 also triggers a VM reboot as part of removing the encryption extension ' s configuration from the targeted data disks.
問題 #233
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a domain controller named DC1. The domain uses Microsoft Entra Connect sync with a Microsoft Entra tenant and uses Microsoft Entra Password Protection to enforce a custom banned password list. You deploy a new domain controller named DC2 to the domain. You discover that the custom banned password list is applied inconsistently and often allows banned passwords to be used. You need to ensure that the custom banned password list is always enforced. What should you do on DC2?
答案：A
解題說明：
Microsoft Entra Password Protection enforces the custom banned password list on-premises through a DC agent service that must be installed on every domain controller in the domain; any domain controller that lacks the agent will not evaluate password change or reset attempts against the policy at all, which produces exactly the inconsistent enforcement described in the scenario, where some password changes get validated on DCs that already have the agent while others processed on DC2 slip through unchecked. Installing the Microsoft Entra Password Protection DC agent on DC2 closes this gap by making DC2 itself evaluate every password change against the downloaded banned-password policy, the same way DC1 and any other agent- equipped domain controllers already do, restoring consistent enforcement domain-wide. The Password Protection proxy service only relays policy download requests from domain controllers to Microsoft Entra ID and is typically installed on just one or two servers rather than on every DC, so it plays no direct role in evaluating password attempts on DC2. The provisioning agent and Azure Monitor Agent serve entirely unrelated purposes, namely identity provisioning workflows and telemetry collection, and installing either would do nothing to make DC2 enforce the banned password list.
問題 #234
You have an Azure subscription named sub1 and 500 on-premises virtual machines that run Windows Server.
You plan to onboard the on-premises virtual machines to Azure Arc by running the Azure Arc deployment script. You need to create an identity that will be used by the script to authenticate access to sub1. The solution must use the principle of least privilege. How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. ___ - DisplayName ' arc-for-servers ' -Role ___
答案：
解題說明：
Explanation:
New-AzADServicePrincipal -DisplayName ' arc-for-servers ' -Role ' Azure Connected Machine Onboarding ' At-scale onboarding to Azure Arc with a deployment script authenticates using a service principal rather than an interactive sign-in, and Microsoft ' s guidance for scripted, least-privilege onboarding is to create that service principal with New-AzADServicePrincipal, supplying a -DisplayName and assigning it the built-in Azure Connected Machine Onboarding role, optionally scoped to a specific resource group with -Scope. This role grants only the permissions required to register a machine with Arc and complete the connect operation; it does not include general compute, storage, or networking rights, which is why it satisfies least privilege far better than a broad role such as Contributor. The other two cmdlets in the option list do not fit this task: New- AzADAppCredential only adds or rotates a credential (secret or certificate) on an application object that already exists, and it performs no role assignment; New-AzUserAssignedIdentity creates a standalone managed identity resource, which is a different authentication mechanism used by Azure resources calling other Azure services, not a mechanism a locally run onboarding script can use to authenticate against an Azure AD tenant. For the role value, Virtual Machine Contributor and Virtual Machine User Login both exceed what onboarding needs, since they grant ongoing VM management or interactive sign-in rights rather than the narrow, one-time registration permission the Azure Connected Machine Onboarding role provides.
問題 #235
You have a server named Host1 that has the Hyper-V server role installed. Host1 hosts a virtual machine named VM1. You have a management server named Server1 that runs Windows Server. You remotely manage Host1 from Server1 by using Hyper-V Manager. You need to ensure that you can access a USB hard drive connected to Server1 when you connect to VM1 by using Virtual Machine Connection. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
答案：D,E
解題說明：
Redirecting a local device such as a USB hard drive that is physically connected to the client computer (Server1) into a Virtual Machine Connection session requires Enhanced Session Mode, which upgrades the VMConnect session to use RDP-based redirection channels instead of a raw console attach; a basic session has no device-redirection capability at all, so switching to a basic session (option C) would remove USB redirection rather than enable it. Enhanced Session Mode must first be allowed at the host level, which is configured in Hyper-V Settings on Host1 under the Enhanced Session Mode Policy setting. Once Enhanced Session Mode is permitted by the host, the actual redirection of a specific local resource, such as a drive, printer, or supported Plug and Play device, is selected per-connection from the Virtual Machine Connection client itself by expanding Show Options and choosing the local resources tab, where the USB hard drive can be selected for redirection into the session. Attaching a virtual hard disk or rescanning disks in Disk Management on Host1 would only be relevant if you were trying to present the physical drive as a native Hyper-V virtual hard disk to the VM, which is a different (and here, unnecessary) approach; the requirement specifically calls for Virtual Machine Connection-based redirection, achieved through options A and D.
問題 #236
Your network contains an Active Directory Domain Services (AD DS) domain. You have a Group Policy Object (GPO) named GPO1 that contains Group Policy preferences. You plan to link GPO1 to the domain.
You need to ensure that the preferences in GPO1 apply only to domain member servers and NOT to domain controllers or client computers. All the other Group Policy settings in GPO1 must apply to all the computers.
The solution must minimize administrative effort. Which type of item-level targeting should you use?
答案：C
解題說明：
Group Policy Preferences support item-level targeting, which lets an administrator attach a condition to an individual preference item so that only computers matching the condition apply it, while every other setting in the same GPO continues to apply wherever the GPO is linked. Among the available targeting types, Operating System targeting can filter not just by OS version but also by product type, distinguishing Workstation, Server, and Domain Controller. Setting the item-level target to Operating System with product type equal to Server means the preference is applied only on machines reporting as member servers; domain controllers report a distinct Domain Controller product type and client computers report Workstation, so both are automatically excluded without any extra configuration. This satisfies every requirement in a single step:
GPO1 can still be linked once, at the domain, so its non-targeted settings reach all computers, while only the preference items carrying the Operating System/Server target are filtered down to member servers. Security Group targeting would require creating and maintaining a group containing exactly the member servers, which adds ongoing administrative overhead as servers are added or removed. Domain targeting operates at too coarse a level (matching an entire domain, not a computer role) and Environment Variable targeting depends on a variable being present and correctly set on every machine, neither of which reliably distinguishes servers from domain controllers with minimal effort the way Operating System/product-type targeting does.
問題 #237
......
機會從來都是屬於那些有準備的人。但是，當屬於我們的機會到來的時候我們是否能成功地抓住它呢？正在準備Microsoft的AZ-802考試的你，是否抓住了KaoGuTi這個可以讓你成功的機會呢？KaoGuTi的AZ-802資料是你可以順利通過考試的保障，有了它，你將節省大量的時間，高效率地準備考試。如果你用了KaoGuTi的資料，你可以很明顯地感覺到它的與眾不同和它的高品質。這絕對是你成功的一個捷徑。它可以讓你充分地準備AZ-802考試。
AZ-802最新考題: https://www.kaoguti.com/AZ-802_exam-pdf.html