Free Exam AZ-802: Administering Windows Server Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Exam AZ-802: Administering Windows Server practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An application deployment must add a new attribute to the AD DS schema. Which FSMO role holder processes this update?

   1. A. Domain naming master
   2. B. Schema master
   3. C. RID master
   4. D. PDC emulator

   Answer: B

   Explanation: Microsoft states, "This DC is the only one that can process updates to the directory schema." This refers to the schema master. The domain naming master changes the forest domain namespace, the RID master allocates RID pools, and the PDC emulator handles functions such as password-change coordination.

   Reference: Active Directory FSMO roles in Windows — Schema master FSMO role

2. 2Help-desk staff must restart a particular service through PowerShell without receiving general administrator access. Which feature supports an endpoint exposing only approved administrative commands?

   1. A. CredSSP authentication
   2. B. Just Enough Administration
   3. C. PowerShell execution policy
   4. D. Unconstrained Kerberos delegation

   Answer: B

   Explanation: JEA lets you "Limit what users can do by specifying which cmdlets, functions, and external commands they can run." It provides command-scoped delegated administration. Authentication delegation and script execution policy do not supply the same endpoint authorization boundary.

   Reference: Overview of Just Enough Administration (JEA) — JEA capabilities

3. 3A Hyper-V administrator is signed in to a Windows Server 2022 host. A local Windows Server 2022 guest is running with valid guest credentials available, but its network is misconfigured. Which method can run PowerShell inside that guest without fixing its networking first?

   1. A. PowerShell remoting over WinRM
   2. B. PowerShell Direct
   3. C. PowerShell remoting over SSH
   4. D. Remote Desktop over its virtual NIC

   Answer: B

   Explanation: Microsoft states, "Use PowerShell Direct regardless of network configuration or remote management settings." The guest is local, running, and supported; guest credentials and Hyper-V administrative access are available. The network-based alternatives depend on guest connectivity.

   Reference: Manage Windows virtual machines with PowerShell Direct — Opening description and Requirements

4. 4DNS zones on several writable domain controllers must use AD DS replication and allow each hosting DNS server to process secure dynamic updates. Which zone storage model meets this requirement?

   1. A. File-backed secondary zone
   2. B. AD DS-integrated primary zone
   3. C. File-backed stub zone
   4. D. Server-level conditional forwarder

   Answer: B

   Explanation: Microsoft documents "secure dynamic updates and the ability for each domain controller that hosts the zone to function as a primary". These features follow storing primary-zone data in AD DS; a secondary or stub copy does not provide writable host records on every server.

   Reference: DNS zones in Windows Server — Primary zones

5. 5A user authenticates successfully to an SMB Azure file share and has a share-level data role, but the target directory's Windows ACL does not grant access. What must an administrator configure to permit access to that directory?

   1. A. A second share-level role with the same permissions
   2. B. An additional storage account management role
   3. C. A longer SMB session timeout for the user
   4. D. Appropriate Windows ACL permissions on the directory

   Answer: D

   Explanation: Microsoft states, "You still need to separately configure directory-level and file-level permissions." A share-level grant does not override a directory ACL or even automatically grant access to the root directory.

   Reference: Overview of Azure Files authorization and access control — Configure share-level permissions

6. 6Which Windows security feature uses virtualization-based security to isolate NTLM password hashes and Kerberos ticket-granting tickets from the running operating system?

   1. A. Microsoft Defender SmartScreen
   2. B. Windows LAPS
   3. C. Credential Guard
   4. D. BitLocker Drive Encryption

   Answer: C

   Explanation: Microsoft states, "Credential Guard uses Virtualization-based security (VBS) to isolate secrets so that only privileged system software can access them." LAPS manages passwords, BitLocker encrypts volumes, and SmartScreen assesses reputation rather than isolating these in-memory domain secrets.

   Reference: Credential Guard overview — Opening description

7. 7A counter data collector created with logman must sample performance counters every 15 seconds. Which option controls that sampling interval?

   1. A. -sc 15
   2. B. -max 15
   3. C. -si 00:00:15
   4. D. -rf 00:00:15

   Answer: C

   Explanation: For -si, Microsoft states, "Specifies the sample interval for performance counter data collectors." The -sc option limits sample count, -max limits log size, and -rf controls collection duration rather than the interval between samples.

   Reference: logman create counter — Parameters: -si

8. 8A domain controller has nearly exhausted its allocated relative identifiers. Which FSMO role holder supplies an additional RID pool?

   1. A. Schema master
   2. B. Infrastructure master
   3. C. Domain naming master
   4. D. RID master

   Answer: D

   Explanation: The documentation states, "When a DC's allocated RID pool falls below a threshold, that DC issues a request for additional RIDs to the domain's RID master." The other role holders do not allocate domain RID pools.

   Reference: Active Directory FSMO roles in Windows — RID master FSMO role

9. 9From Server A, a user opens a default PowerShell remoting session to Server B, then tries to access a share on Server C. No additional delegation or explicit second credential is configured. Which credential-forwarding behavior applies?

   1. A. Using C's DNS name automatically forwards the user's credentials.
   2. B. Local administrator membership on B automatically forwards the user's credentials.
   3. C. An AD trust path to C automatically forwards the user's credentials.
   4. D. The first-hop user credentials are not automatically passed from B to C.

   Answer: D

   Explanation: Microsoft explains that access is denied because "the credentials you used to create the PowerShell Remoting session aren't passed from ServerB to ServerC." A DNS name, local administrator membership, or a trust path alone does not configure credential delegation for the second hop.

   Reference: Making the second hop in PowerShell Remoting — Second hop problem

10. 10A stopped VM named LabHost meets the hardware and version requirements for nested virtualization. Which host command exposes the processor virtualization extensions so Hyper-V can run inside it?

    1. A. Set-VMProcessor -VMName LabHost -ExposeVirtualizationExtensions $false
    2. B. Set-VMNetworkAdapter -VMName LabHost -MacAddressSpoofing On
    3. C. Set-VM -Name LabHost -CheckpointType ProductionOnly
    4. D. Set-VMProcessor -VMName LabHost -ExposeVirtualizationExtensions $true

    Answer: D

    Explanation: The documented command is "Set-VMProcessor -VMName <VMName> -ExposeVirtualizationExtensions $true", run while the VM is off. MAC spoofing changes networking and checkpoint settings do not expose CPU virtualization support.

    Reference: Run Hyper-V in a Virtual Machine with Nested Virtualization — Enable Nested Virtualization