患難可以試驗一個人的品格，非常的境遇方才可以顯出非常的氣節；風平浪靜的海面，所有的船隻都可以並驅競勝。命運的鐵拳擊中要害的時候，只有大勇大智的人才能夠處之泰然。 你是大智大勇的人嗎？如果你的IT認證考試沒有做好考前準備，你還處之泰然嗎？當然，因為你有 Testpdf Microsoft的AZ-802考試培訓資料在手上，任何考試困難都不會將你打到。
| Section | Objectives |
|---|---|
| Networking and high availability | - Networking infrastructure
|
| Secure and manage Windows Server environments | - Identity and access management
|
| Compute, storage, and virtualization | - Virtual machines and containers
|
| Hybrid infrastructure management | - Azure integration
|
Testpdf的關於Microsoft AZ-802 認證考試的針對性練習題卻是很受歡迎的。Testpdf的資料不僅能讓你獲取知識和很多相關經驗，還可以使你為考試做充分的準備。雖然Microsoft AZ-802認證考試很難，但是通過做Testpdf的練習題後，你會很有信心的參加考試。放心地選擇Testpdf的高效練習題吧，為Microsoft AZ-802 認證考試做一個最充分的準備。
問題 #52
You need to configure Azure File Sync to meet the file sharing requirements. What is the minimum number of sync groups you should create, and what is the minimum number of Storage Sync Services you should create? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
答案：
解題說明：
Explanation:
Sync groups: 3. Storage Sync Services: 1.
In Azure File Sync, a sync group defines a single sync topology and can contain exactly one cloud endpoint (one Azure file share) but can contain multiple server endpoints (on-premises server locations) that all sync to that same file share. Fabrikam needs newyorkfiles to sync only to FS1, seattlefiles to sync only to FS2, and companyfiles to sync to both FS1 and FS2. Because each Azure file share can only belong to one sync group, newyorkfiles requires its own sync group with a single server endpoint on FS1, seattlefiles requires its own sync group with a single server endpoint on FS2, and companyfiles requires a third sync group whose one cloud endpoint (companyfiles) has two server endpoints, one on FS1 and one on FS2, which Azure File Sync fully supports within a single sync group. That gives a minimum of three sync groups. A Storage Sync Service is the top-level Azure resource that contains and manages sync groups, and there is no requirement here that forces the shares into separate Storage Sync Service instances (such as differing regions or subscriptions); a single Storage Sync Service can hold all three sync groups. Therefore only one Storage Sync Service is required.
問題 #53
Which three actions should you perform in sequence to meet the security requirements for Webapp1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
答案：
解題說明：
Explanation:
1. Create the KDS root key in AD DS. 2. Create a group managed service account (gMSA) in Active Directory. 3. Configure the IIS application pool (on WEB1 and WEB2) to run as the gMSA via a specified user account.
The requirement is that every instance of Webapp1 (running on both WEB1 and WEB2) uses the same identity, and that identity ' s password rotates automatically every 30 days, without any administrator manually resetting it. A standalone managed service account (sMSA) is tied to a single computer and cannot be shared across WEB1 and WEB2, so it does not meet the requirement. A group managed service account (gMSA) is designed exactly for this scenario: one AD-managed identity that multiple servers can use simultaneously, with the Key Distribution Service automatically rotating its password (by default every 30 days) without needing manual intervention or downtime. Before any gMSA can be created in the forest, a one- time prerequisite must exist: the KDS root key, which the Key Distribution Service uses to generate and later recompute the gMSA ' s password material. So the correct order is to first create the KDS root key, then create the gMSA object in Active Directory, and finally configure the IIS application pool on each web server to run as that gMSA using the " specified user account " identity option (entered as domain\gMSA$ with no password required, since the password is centrally managed). Creating a system- or user-assigned managed identity in Microsoft Entra ID does not apply here, since Webapp1 runs on IIS on domain-joined VMs, not as an Azure PaaS resource.
Topic 3, Case Study 3: A Datum CorporationThis is a case study.
Case studies are not timed separately. You can use as much exam
time as you would like to complete each case. However, there may be
additional case studies and sections on this exam. You must manage
your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
Overview: A Datum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal. A. Datum recently partnered with a company named Fabrikam, Inc. Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
The on-premises network of A Datum contains an Active Directory Domain Services (AD DS) forest named adatum.com. The forest contains two domains named adatum.com and east.adatum.com, and the domain controllers shown in the exhibit below.
Domain controllers
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com. The forest contains two domains named fabrikam.com and south.fabrikam.com. The fabrikam.com domain contains an organizational unit (OU) named Marketing.
The adatum.com domain contains the servers shown in the exhibit below.
Servers
HyperV1 contains the virtual machines shown in the exhibit below. All the virtual machines on HyperV1 have only the default management tools installed.
HyperV1 virtual machines
SSPace1 contains the Storage Spaces virtual disks shown in the exhibit below.
SSPace1 virtual disks
A Datum has an Azure subscription that contains a Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Microsoft Entra ID. The subscription contains the virtual networks shown in the exhibit below.
Virtual networks
The subscription contains the Azure private DNS zones shown in the exhibit below.
Private DNS zones
The subscription contains the virtual machines shown in the exhibit below. All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
Azure virtual machines
Planned Changes: A Datum plans to implement the following changes:
- Sync Data1 to share1.
- Configure an Azure runbook named Task1.
- Enable Microsoft Entra users to sign in to Server1.
- Create an Azure DNS Private Resolver that has the following configuration: Name: Private1; Region: West US; Virtual network: VNet1; Inbound endpoint: SubnetB.
- Enable users in the adatum.com domain to access the resources in the south.fabrikam.com domain.
Technical Requirements: A Datum identifies the following technical requirements:
- The data on SSPace1 must be available always.
- DC2 must become the schema master if DC1 fails.
- VMs must be configured to enable per-folder quotas.
- Trusts must allow access to only the required resources.
- The users in the Marketing OU must have access to storage1.
- Azure Automanage must be used on all supported Azure virtual machines.
- A direct SSH session must be used to manage all the supported virtual machines on HyperV1.
問題 #54
You plan to deploy an Azure virtual machine that will run Windows Server. The virtual machine will host an Active Directory Domain Services (AD DS) domain controller and a drive named F: on a new virtual disk.
You need to configure storage for the virtual machine. The solution must meet the following requirements:
maximize resiliency for AD DS; prevent accidental data loss. How should you configure the storage? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
答案：
解題說明：
Explanation:
Volume for the AD DS database: F. Caching configuration for the volume that hosts the database: NONE.
Microsoft ' s guidance for running AD DS domain controllers on Azure virtual machines is explicit that the NTDS database and logs should be placed on a dedicated data disk rather than the OS disk (C:) or the VM ' s temporary disk (D:). The OS disk mixes the database with the operating system and is not sized or managed for this purpose, and the temporary disk is local, ephemeral storage on the physical host that provides no durability at all - its contents can be lost during routine platform maintenance, a host failure, or a resize
/reallocation, which is completely incompatible with maximizing resiliency for a domain controller ' s database. A separate managed data disk, mounted as F:, is backed by durable, replicated Azure Storage and is the disk that should host the AD DS database, giving the required resiliency. Separately, Azure lets you configure host caching (None, Read, or Read/write) on a managed data disk; for a disk hosting a transactional, write-sensitive database like the AD DS Extensible Storage Engine database, Microsoft explicitly documents that host caching must be set to None. Read or Read/write caching risks acknowledging writes to the VM before they are guaranteed to be durably committed to the underlying storage, which for a database like NTDS.dit can result in inconsistency or accidental data loss if a cache flush is interrupted. Setting caching to None ensures every write is fully committed, directly satisfying the requirement to prevent accidental data loss.
問題 #55
Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains the servers shown in the following table.
For each server. Windows Defender Firewall is configured to allow only communication between servers on the same segment. Server! has the following connection security rule:
* Name: Rule1
* Rule type: Isolation
* Requirement: Require authentication for inbound connections and request authentication for outbound connections
* Authentication method: Computer (Kerberos V5)
* Profile: Domain. Private. Public
Server2 does not have any connection security rules.
Server3 has the following connection security rule:
* Name: Rute3
* Rule type: Server-to-server
* Endpoints:
o Computers in Endpoint 1:192.168.50/24
o Computers in Endpoint 2: 192.168.1.0/24
* Requirement Request authentication (or inbound and outbound connections
* Authentication method: Computer (Kerberos V5)
* Profile: Domain. Private. Public
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Exhibit
答案：
解題說明：
Explanation:
A connection security rule only adds an authentication (IPsec) requirement to traffic that a firewall rule already permits; it does not, by itself, open or expand what a firewall rule allows. Because each server ' s Windows Defender Firewall is configured to allow communication only between servers on the same network segment, Server1 and Server2 (both on 192.168.1.0/24) are already permitted to communicate, so Server1 ' s Isolation rule, which only requests (not requires) outbound authentication, does not block that traffic even without a matching rule on Server2. Server3 sits on a different segment (192.168.5.0/24) from both Server1 and Server2, and because the firewall ' s same-segment scope restriction governs whether traffic is allowed at all, neither Server2 ' s attempt to reach Server3 nor Server3 ' s attempt to reach Server1 succeeds, regardless of the Server-to-server connection security rule configured on Server3, since that rule can only add authentication to already-permitted traffic and cannot bypass the firewall ' s segment-based scope restriction.
問題 #56
You have a Windows server named Server1. You add two 4-TB hard drives named Disk1 and Disk2 to Server1. You need to format the drives. The solution must meet the following requirements: * Disk1 must support disk level quotas. * Disk2 must support Data Deduplication. Which type of file system should you use for each drive? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
答案：
解題說明：
Explanation:
Disk1: NTFS only. Disk2: NTFS only.
Disk-level (NTFS) quotas are an NTFS-specific feature with no ReFS or exFAT equivalent, so a volume that must support disk quotas has to be formatted NTFS -- there is no alternative file system choice for Disk1.
Data Deduplication has historically been an NTFS-only feature, and while Microsoft did extend Data Deduplication support to ReFS starting with Windows Server 2019, that ReFS Dedup capability is specifically documented and supported in the context of Storage Spaces Direct clustered volumes (mirror or parity resiliency) -- it is not a general capability available on an arbitrary standalone server ' s locally attached disk the way it is described here (a plain server with two newly added hard drives, no clustering or Storage Spaces Direct mentioned). For a standalone server like Server1 formatting a local data disk for Data Deduplication, NTFS remains the applicable and supported choice; ReFS Dedup would only become relevant if these disks were part of a Storage Spaces Direct deployment. exFAT supports neither quotas nor Data Deduplication, and plain ReFS without the Storage Spaces Direct context does not support Data Deduplication either. Therefore, both Disk1 and Disk2 should be formatted NTFS to meet their respective requirements in this standalone-server scenario.
問題 #57
......
每個早晨都是全新一天的開始，給自己一個好心情，給自己一個新起點。擁有熱門的IT證照是你開啟IT之路的新起點。Microsoft AZ-802 考題認證考試是個檢驗IT專業知識的認證考試。如果你想取得 AZ-802 的認證資格，Testpdf 的 AZ-802 考古題可以實現你的願望。在你考試之前使用我們提供的針對性培訓和測試練習題以及答案，短時間內你會有很大的收穫。
AZ-802認證題庫: https://www.testpdf.net/AZ-802.html