Microsoft Administering Windows Server AZ-802 Exam Questions

Answer : B

The legacy Log Analytics agent, also known as the Microsoft Monitoring Agent or OMS agent, reached end of support on August 31, 2024, and Microsoft has retired it in favor of the Azure Monitor Agent (AMA). The Windows Firewall data connector in Microsoft Sentinel is delivered through the Azure Monitor Agent together with a data collection rule that targets the Windows Firewall event log source, not through the retired Log Analytics agent, so an environment built around this connector has no configuration path that recognizes or uses the legacy agent's data. Installing the Log Analytics agent on Server1 therefore does not create the association between Server1 and the data collection rule that the Windows Firewall connector requires, and it does not enable any log forwarding pipeline that Microsoft Sentinel's current connector architecture can consume. Because the connector depends entirely on AMA and Server1 additionally needs to be Azure Arc-enabled since it is an on-premises machine, installing the deprecated Log Analytics agent does not enable Sentinel to collect Windows Firewall logs from Server1, so this solution does not meet the goal.

Answer : B

Group Policy Preferences support item-level targeting, which lets an administrator attach a condition to an individual preference item so that only computers matching the condition apply it, while every other setting in the same GPO continues to apply wherever the GPO is linked. Among the available targeting types, Operating System targeting can filter not just by OS version but also by product type, distinguishing Workstation, Server, and Domain Controller. Setting the item-level target to Operating System with product type equal to Server means the preference is applied only on machines reporting as member servers; domain controllers report a distinct Domain Controller product type and client computers report Workstation, so both are automatically excluded without any extra configuration. This satisfies every requirement in a single step: GPO1 can still be linked once, at the domain, so its non-targeted settings reach all computers, while only the preference items carrying the Operating System/Server target are filtered down to member servers. Security Group targeting would require creating and maintaining a group containing exactly the member servers, which adds ongoing administrative overhead as servers are added or removed. Domain targeting operates at too coarse a level (matching an entire domain, not a computer role) and Environment Variable targeting depends on a variable being present and correctly set on every machine, neither of which reliably distinguishes servers from domain controllers with minimal effort the way Operating System/product-type targeting does.

Answer : D

With BGP disabled, the Site-to-Site connection relies entirely on statically defined routes rather than on dynamic route propagation between the on-premises network and Azure. When Subnet2 is added within Vnet1's extended address space, Azure's own side of the tunnel already knows about it automatically, since it is simply part of the connected virtual network, but the on-premises routers have no static route telling them that traffic destined for Subnet2's address range should be sent across the VPN tunnel to Azure at all. Server1 is able to reach Server2 because that traffic stays entirely inside the Azure virtual network and never needs to cross the tunnel, but on-premises hosts have no configured path to the new subnet until the on-premises routing tables, and the local VPN device's configuration if applicable, are updated to include a route for Subnet2's range pointed at the tunnel. Adding another Site-to-Site tunnel, a private endpoint, or a user-defined route table inside Subnet2 does nothing to address the missing route on the on-premises side, which is the actual point of failure described in the scenario.

Answer : A

Microsoft Entra Password Protection lets an organization extend the global banned-password list with a custom banned-password list containing organization-specific terms, such as a company name, product names, or local landmarks. For an on-premises AD DS domain, the custom banned-password list itself is still authored and managed centrally in the cloud, in the Microsoft Entra admin center, under Protect & Secure > Authentication methods > Password protection. Once configured there, the list is downloaded and cached by the Microsoft Entra Password Protection DC agents running on the domain's writable domain controllers, which enforce the policy locally against password set and change operations, even though the domain itself is on-premises. Active Directory Users and Computers has no interface for managing banned-password lists; it only manages AD objects such as users, groups, and OUs. Synchronization Service Manager is the on-premises troubleshooting console for the Microsoft Entra Connect sync engine and has no role in password policy configuration. Windows Admin Center is a management gateway for Windows Server infrastructure (roles, features, storage, and so on) and likewise does not expose password-protection policy settings. Therefore, to add 'Contoso' to the custom banned-password list and have it enforced across the domain, an administrator must sign in to the Microsoft Entra admin center and configure the custom banned-password list there, letting the on-premises DC agents pick up and apply the updated list.

Answer : D

Storage Migration Service is specifically designed to migrate file shares and their data while also supporting a cutover step that transfers the source server's name (and optionally IP address) to the destination, which is what allows users to keep referencing \\server1\share1 even after Server1 is decommissioned. File Server Resource Manager only manages quotas, screening, and reporting rather than performing migrations, Windows Server Migration Tools does not provide the identity-takeover/cutover capability needed to preserve the original UNC path, and Azure Migrate is oriented toward moving workloads into Azure rather than between on-premises servers. Storage Migration Service also minimizes administrative effort through its wizard-driven Windows Admin Center interface that walks an administrator through inventory, transfer, and cutover in a single tool. Because the requirement explicitly calls for preserving the original UNC path after decommissioning Server1, only a tool that performs an identity transfer as part of the migration satisfies both stated requirements at once.

Answer : B

Creating a new site named Site4 does not, by itself, put the branch office's client computers into Site1, which is the only thing that would make them prefer Site1's domain controllers. A client's site membership is computed exclusively from its IP address matched against subnet objects defined in Active Directory Sites and Services; simply creating Site4 and linking it to DEFAULTIPSITELINK affects replication topology (which sites can replicate with which, and on what schedule/cost), not which site a given IP subnet, and therefore which client, belongs to. Without associating the branch office's actual subnet to a site, and specifically to Site1 as required here, the branch clients remain unassigned to any site (or fall back to whatever default site-coverage logic applies), and creating an unrelated fourth site changes nothing about that. Even if Site4 were intended to represent the branch office, the solution never creates or maps a subnet object to it, let alone to Site1, so there is no mechanism by which client authentication traffic would be steered toward Site1's domain controllers. The only way to meet the goal is to create a subnet object for the branch office's IP range and associate that subnet directly with Site1. Because this solution does neither of those things, it does not meet the stated goal.

Answer : C

The Process performance object exposes a distinct, per-instance set of counters -- including % Processor Time, Working Set, Private Bytes, and Handle Count -- broken out individually for each running executable on the system, so adding it to the Data Collector Set lets the administrator see exactly how much CPU, memory, and other resources each of the five custom applications is individually consuming, and isolate which one is actually responsible for the excessive load. The Processor and Processor Information objects instead report counters at the level of each logical or physical CPU core, aggregated across every process running on the system as a whole, giving a system-wide utilization figure without any breakdown by individual application. Processor Performance reports hardware-level frequency, idle state, and throttling counters for the CPU itself, which is also not broken out by application. Because the stated requirement is specifically to view the resources used by each of the five applications individually, and only the Process object provides that per-application breakdown, Process is the correct object to add to CollectorSet1.