Microsoft - AZ-802: Administering Windows Server
Sample Questions
Question: 66
Measured Skill: Deploy and manage AD DS (20–25%)
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. Determine whether the solution meets the stated goals.
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK.
You open a new branch office that contains only client computers.
You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.
Solution: You create a new site named Site4 and associate Site4 to DEFAULTIPSITELINK.
Does the solution meet the goal?Correct answer: BExplanation:
Creating a new site (Site4) and associating it with DEFAULTIPSITELINK does not ensure that clients in the new branch office will be authenticated primarily by the domain controllers in Site1.
Reasons:
- A new Active Directory site by itself contains no domain controllers.
- Simply adding Site4 to DEFAULTIPSITELINK does not establish Site1 as the preferred authentication site.
- Client authentication behavior is determined by site-to-subnet mappings and site-link costs.
- The solution does not associate the branch office subnet with Site1, nor does it configure site-link costs to make Site1 the preferred site.
References:
Enabling Clients to Locate the Next Closest Domain Controller
Locating domain controllers in Windows and Windows Server
Question: 67
Measured Skill: Manage Windows Server instances and workloads in a hybrid environment (10–15%)
You have a Windows Server 2022 server named Cert1 that runs Active Directory Certificate Services (AD CS) as an enterprise root certification authority (CA).
You need to allow a subordinate CA hosted in Azure to be trusted by domain-joined clients without manually distributing the subordinate CA certificate to every device.
What should you do?| A | Issue the subordinate CA's certificate from Cert1 and distribute it via Group Policy Public Key Policies to the Trusted Root Certification Authorities store of the domain-joined clients. |
| B | Email the certificate to all users. |
| C | Manually import the certificate on each client using certutil. |
| D | Disable certificate revocation checking. |
Correct answer: AExplanation:
The subordinate CA hosted in Azure must be trusted by all domain-joined clients without manually importing certificates on each device.
In an AD CS hierarchy:
- The Enterprise Root CA (Cert1) issues the certificate for the subordinate CA.
- Trust can be distributed automatically through Active Directory Group Policy using Public Key Policies.
- Domain-joined clients receive the certificate automatically, eliminating the need for manual deployment. Certificates can be distributed to domain computers through Group Policy using the Computer Configuration → Windows Settings → Security Settings → Public Key Policies stores.
Reference: Distribute certificates to Windows devices by using Group Policy
Question: 68
Measured Skill: Implement and manage an on-premises and hybrid networking infrastructure (10–15%)
You have an Azure subscription and an on-premises datacenter connected by a Site-to-Site VPN.
You need to extend an on-premises VLAN into Azure so that an on-premises server and an Azure VM can communicate on the same Layer 2 broadcast domain without changing their IP addresses.
What should you deploy?| A | Azure Virtual WAN |
| B | Azure Extended Network |
| C | Azure ExpressRoute Global Reach |
| D | Azure Firewall |
Correct answer: BExplanation:
Azure Extended Network is specifically designed for this scenario. It enables you to stretch an on-premises subnet into Azure using a VXLAN-based overlay, allowing workloads migrated to Azure to retain their original private IP addresses and communicate as if they were on the same network.
Reference: Extend your on-premises subnets into Azure using extended network for Azure
Question: 69
Measured Skill: Manage Windows Server instances and workloads in a hybrid environment (10–15%)
You have an Active Directory Domain Services (AD DS) domain that contains a certification authority (CA).
You need to configure autoenrollment so that all domain-joined computers automatically request and renew a computer certificate from the CA without administrator intervention.
What should you do?| A | Configure a Group Policy with the Certificate Services Client - Auto-Enrollment setting enabled and configure the certificate template with autoenroll permissions. |
| B | Manually request a certificate on each computer using the Certificates MMC snap-in. |
| C | Disable the certificate revocation list (CRL) distribution point. |
| D | Configure IPsec policies on each computer. |
Correct answer: AExplanation:
You can distribute certificates that chain to a trusted root in an Active Directory domain to Windows devices by using Group Policy.
To automatically issue and renew computer certificates in an AD DS environment, you must:
- Enable Certificate Services Client – Auto-Enrollment in a Group Policy Object (GPO).
- Configure the certificate template with Autoenroll permissions for the target computers (typically the Domain Computers group).
This allows domain-joined computers to automatically:
- Request certificates
- Renew certificates before expiration
- Update certificates without administrator intervention
This is the standard AD CS autoenrollment solution.
Reference: Distribute certificates to Windows devices by using Group Policy
Question: 70
Measured Skill: Deploy and manage AD DS (20–25%)
Your network contains an Active Directory Domain Services (AD DS) domain with domain controllers running Windows Server 2022.
You need to ensure that domain controllers automatically clean up tombstoned objects and metadata for deleted objects after the configured retention period. The solution must not require manual intervention and administrators must be able to recover accidentally deleted objects for up to 180 days if needed.
What should you configure?| A | Enable the AD Recycle Bin and set msDS-deletedObjectLifetime to 180 days. |
| B | Disable the Garbage Collection process entirely. |
| C | Reduce the tombstone lifetime to 0 days. |
| D | Use only Windows Server Backup with daily full backups as the sole recovery method. |
Correct answer: AExplanation:
When Active Directory Recycle Bin is enabled, deleted objects remain fully recoverable for the duration specified by the msDS-DeletedObjectLifetime attribute. After that period expires, Active Directory's built-in garbage collection process automatically removes tombstoned objects and metadata. The garbage collection process runs automatically on every domain controller.
References:
The Active Directory database garbage collection process and calculation of allowed intervals
3.1.1.1.5.1 Tombstone Lifetime and Deleted-Object Lifetime