Microsoft AZ-802 - Administering Windows Server Exam
Page: 3 / 45
Total 224 questions
Question #11 (Topic: Topic 1, Deploy and manage AD DS
)
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com.
You have an Azure virtual network named VNet1 that is connected to the on-premises network by using a Site-to-Site (S2S) VPN.
VNet1 contains a domain-joined virtual machine named VM1 that hosts an application named App1.
App1 uses Kerberos authentication and updates objects in AD DS. An Azure Firewall filters communication from VM1 to the domain controllers in contoso.com.
You need to deploy domain controllers to VNet1. The solution must support the requirements of VM1 and provide domain controller redundancy in Azure.
What should you deploy?
You have an Azure virtual network named VNet1 that is connected to the on-premises network by using a Site-to-Site (S2S) VPN.
VNet1 contains a domain-joined virtual machine named VM1 that hosts an application named App1.
App1 uses Kerberos authentication and updates objects in AD DS. An Azure Firewall filters communication from VM1 to the domain controllers in contoso.com.
You need to deploy domain controllers to VNet1. The solution must support the requirements of VM1 and provide domain controller redundancy in Azure.
What should you deploy?
A. two writable domain controller virtual machines across availability zones
B. two read-only domain controller (RODC) virtual machines across availability sets
C. two writable domain controller virtual machines, each in a distinct Azure region
D. two read-only domain controller (RODC) virtual machines, each in a distinct Azure region
Answer: A
Question #12 (Topic: Topic 1, Deploy and manage AD DS
)
Your network contains an Active Directory Domain Services (AD DS) forest.
The forest contains a root domain named contoso.com and a child domain named branch.contoso.com.
The forest contains the domain controllers shown in the following table.
You discover that cross-domain object references in contoso.com fail to update for objects in branch.contoso.com.
You need to modify the FSMO role placement. The solution must minimize administrative changes.
What should you do?
The forest contains a root domain named contoso.com and a child domain named branch.contoso.com.
The forest contains the domain controllers shown in the following table.
You discover that cross-domain object references in contoso.com fail to update for objects in branch.contoso.com.
You need to modify the FSMO role placement. The solution must minimize administrative changes.
What should you do?
A. Transfer the infrastructure master role for contoso.com from DC1 to DC2.
B. Transfer the PDC emulator role for contoso.com from DC1 to DC2.
C. Transfer the schema master role from DC1 to DC2.
D. Transfer the infrastructure master role for branch contoso.com from DC4 to DC3.
E. Transfer the domain naming master role from DC1 to DC2.
Answer: A
Question #13 (Topic: Topic 1, Deploy and manage AD DS
)
HOTSPOT
You have an Active Directory Domain Services (AD DS) domain that contains 1,000 users.
The domain has the following password requirements:
• The minimum password length must be 12 characters.
• Passwords must expire in 90 days.
• Passwords must be complex.
You need to ensure that the members of a security team have passwords that meet the following requirements:
• The minimum password length must be 16 characters.
• Passwords must expire in 60 days.
• Passwords must be complex.
The solution must minimize the impact on users who are NOT members of the security team.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have an Active Directory Domain Services (AD DS) domain that contains 1,000 users.
The domain has the following password requirements:
• The minimum password length must be 12 characters.
• Passwords must expire in 90 days.
• Passwords must be complex.
You need to ensure that the members of a security team have passwords that meet the following requirements:
• The minimum password length must be 16 characters.
• Passwords must expire in 60 days.
• Passwords must be complex.
The solution must minimize the impact on users who are NOT members of the security team.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer: 
Question #14 (Topic: Topic 1, Deploy and manage AD DS
)
Your network contains an Active Directory Domain Services (AD DS) domain.
The domain contains three domain-joined Azure Arc-enabled servers that run Windows Server 2022. Each server hosts an instance of an IIS application named App1. The servers are behind a network load balancer.
Users access App1 by using Windows authentication and the shared DNS name app1.contoso.com.
You need to select a service account for the App1 application pools. The solution must meet the following requirements:
• Use the same AD DS identity on all three servers.
• Support Kerberos authentication for the shared application name.
• Minimize password and service principal name (SPN) administration.
Which type of account should you choose?
The domain contains three domain-joined Azure Arc-enabled servers that run Windows Server 2022. Each server hosts an instance of an IIS application named App1. The servers are behind a network load balancer.
Users access App1 by using Windows authentication and the shared DNS name app1.contoso.com.
You need to select a service account for the App1 application pools. The solution must meet the following requirements:
• Use the same AD DS identity on all three servers.
• Support Kerberos authentication for the shared application name.
• Minimize password and service principal name (SPN) administration.
Which type of account should you choose?
A. Azure managed identity
B. group Managed Service Account (gMSA)
C. delegated Managed Service Account (dMSA)
D. standalone Managed Service Account (sMSA)
Answer: B
Question #15 (Topic: Topic 1, Deploy and manage AD DS
)
HOTSPOT
The Default Domain Policy Group Policy Object (GPO) is shown in the GPO exhibit.
The members of a group named ServiceAccounts is shown in the Group exhibit.
An organizational unit (OU) named ServiceAccounts is shown in the OU exhibit.
You create a Password Settings Object (PSO) as shown in the PSO exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
The Default Domain Policy Group Policy Object (GPO) is shown in the GPO exhibit.
The members of a group named ServiceAccounts is shown in the Group exhibit.
An organizational unit (OU) named ServiceAccounts is shown in the OU exhibit.
You create a Password Settings Object (PSO) as shown in the PSO exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer: 
