Microsoft - AZ-802: Administering Windows Server
Sample Questions
Question: 102
Measured Skill: Manage Windows Server instances and workloads in a hybrid environment (10–15%)
You have 50 on-premises servers that run Windows Server.
You plan to onboard the servers to Azure Arc by using an unattended script.
You need to configure authentication for the onboarding script. The solution must follow the principle of least privilege.
What should you do?| A | Create a user account that has the Owner role for the subscription. |
| B | Create a service principal that has the Azure Connected Machine Onboarding role. |
| C | Install the Log Analytics agent on each server. |
| D | Deploy an Azure Migrate appliance. |
Correct answer: BExplanation:
For unattended Azure Arc onboarding at scale, Microsoft recommends using a Microsoft Entra service principal instead of a user account. The service principal can be assigned the Azure Connected Machine Onboarding built-in role, which grants only the permissions required to register servers with Azure Arc, following the principle of least privilege.
Why the other options are incorrect
Create a user account that has the Owner role for the subscription
The Owner role provides far more permissions than necessary and violates least-privilege principles. Microsoft specifically recommends using a service principal with the Azure Connected Machine Onboarding role instead.
Install the Log Analytics agent on each server
The Log Analytics agent is not used to authenticate Azure Arc onboarding. Azure Arc uses the Connected Machine agent and appropriate Azure credentials.
Deploy an Azure Migrate appliance
Azure Migrate is used for discovery, assessment, and migration scenarios, not for Azure Arc authentication or onboarding.
References:
Connect hybrid machines to Azure at scale
Planning and deployment guidance
Question: 103
Measured Skill: Manage Windows Server instances and workloads in a hybrid environment (10–15%)
You have 20 Azure Arc-enabled servers that run Windows Server.
You need to ensure that the servers are checked automatically for missing updates every 24 hours. Updates must NOT be installed automatically.
What should you configure in Azure Update Manager?| A | A maintenance configuration |
| B | Change Tracking and Inventory |
| C | Periodic assessment |
| D | Update Management in Azure Automation |
Correct answer: CExplanation:
Azure Update Manager includes Periodic assessment, which automatically checks a machine for missing updates every 24 hours and updates its compliance status, without installing updates. This feature is supported for Azure Arc-enabled servers as well as Azure VMs.
Why the other options are incorrect
Maintenance configuration
Used to define when updates are installed during maintenance windows, not merely to assess update compliance.
Change Tracking and Inventory
Tracks software, files, services, and configuration changes. It is not used to perform update assessments.
Update Management in Azure Automation
This is the legacy update management solution. Azure Update Manager's Periodic assessment is the current feature specifically designed for automatic update scanning.
References:
Assessment options in Update Manager
Automate assessment at scale by using Azure Policy
Question: 104
Measured Skill: Manage virtual machines (10–15%)
You have an Azure virtual machine named VM1 that runs Windows Server and has a public IP address. Microsoft Defender for Servers Plan 2 is enabled for the subscription.
Administrators connect to VM1 by using the Remote Desktop client on their computers.
You need to ensure that RDP access to VM1 is open only when an administrator requests it, and only for a limited time.
What should you use?| A | Azure Bastion |
| B | Just-in-time (JIT) VM access |
| C | An application security group |
| D | A permanent inbound network security group (NSG) rule for TCP 3389 |
Correct answer: BExplanation:
Microsoft Defender for Servers Plan 2 includes Just-in-time (JIT) VM access, which keeps management ports such as RDP (TCP 3389) closed by default and opens them only when an authorized administrator requests access. The access can be limited to a specific IP address and a specific time window, after which the port is automatically closed again.
Why the other options are incorrect
Azure Bastion
Azure Bastion provides secure RDP/SSH connectivity through the Azure portal, but the question specifically requires that RDP access be opened only upon request and for a limited time. This requirement is addressed directly by JIT access.
An application security group
An Application Security Group (ASG) helps organize NSG rules but does not provide time-limited, on-demand access.
A permanent inbound NSG rule for TCP 3389
This would leave RDP permanently exposed, which is the opposite of the requirement and increases the attack surface. JIT was specifically designed to avoid permanently open management ports.
References:
Just-in-time machine access in Microsoft Defender for Cloud
Enable just-in-time access
Question: 105
Measured Skill: Manage storage and file services (15–20%)
You have an Azure File Sync deployment. A server named FS1 is a server endpoint that has cloud tiering enabled on volume D.
You need to ensure that at least 20 percent of volume D remains free at all times.
What should you configure?
| A | A date policy on the server endpoint |
| B | A lifecycle management policy on the storage account |
| C | A quota on the cloud endpoint |
| D | A volume free space policy on the server endpoint |
Correct answer: DExplanation:
Azure File Sync cloud tiering provides two policies:
- Volume free space policy – ensures that a specified percentage of the local volume remains free.
- Date policy – tiers files based on when they were last accessed.
Microsoft states that the volume free space policy ensures that a specified percentage of the local volume is always kept free. Therefore, to guarantee that at least 20% of volume D remains available, you configure the volume free space policy on the server endpoint.
Why the other options are incorrect
A date policy on the server endpoint
Controls tiering based on file age/access time, not the amount of free disk space.
A lifecycle management policy on the storage account
Applies to Azure Storage data management, not to maintaining free space on the local server volume.
A quota on the cloud endpoint
Limits Azure file share growth but does not guarantee free space on the local server volume.
References:
Azure File Sync cloud tiering policies
Azure File Sync cloud tiering overview
Question: 106
Measured Skill: Manage storage and file services (15–20%)
You have a file server named FS1 that runs Windows Server 2025. You configure SMB over QUIC on FS1 so that remote users can access file shares without a VPN.
You need to configure the perimeter firewall to allow remote users to connect to FS1.
Which port should you allow inbound?| A | UDP 443 |
| B | TCP 445 |
| C | UDP 445 |
| D | TCP 443 |
Correct answer: AExplanation:
SMB over QUIC encapsulates SMB traffic inside the QUIC protocol, which uses UDP port 443 and TLS 1.3 encryption. Microsoft states that SMB over QUIC provides secure SMB access over the internet using the "internet-friendly UDP port 443 instead of the legacy TCP port 445."
Reference: SMB over QUIC