AZ-802: Administering Windows Server Practice Exam

What the AZ-802 exam covers

• Deploy and manage AD DS144 questions
• Manage Windows Server instances and workloads in a hybrid environment83 questions
• Manage virtual machines91 questions
• Implement and manage an on-premises and hybrid networking infrastructure74 questions
• Manage storage and file services120 questions
• Secure Windows Server infrastructure87 questions
• Monitor and troubleshoot Windows Server environments124 questions

Free AZ-802 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 694.

1. Question 1Deploy and manage AD DS

   You have installed Windows Server on a new machine named DC01 using the Server Core installation option, and it must become the first domain controller in a new forest for contoso.com. Server Core offers no Server Manager GUI, so the promotion has to be driven entirely from a PowerShell prompt. Which command-line/PowerShell tool promotes the server to a domain controller?

   • AInstall-WindowsFeature AD-Domain-Services -IncludeManagementTools
   • BTest-ADDSForestInstallation
   • CAdd-ADDSReadOnlyDomainControllerAccount
   • DInstall-ADDSForest or Install-ADDSDomainControllerCorrect
   ✓ Correct answer: D

   Promoting a server to a domain controller is accomplished using PowerShell cmdlets from the AD DS deployment module. The Install-ADDSForest cmdlet creates a new Active Directory forest when deploying the first domain controller in an environment, while Install-ADDSDomainController adds additional domain controllers to an existing forest or domain. These cmdlets handle the complex deployment process including forest/domain structure creation, AD DS database initialization, DNS integration, and replication setup. Administrators can automate DC promotion through PowerShell scripts to ensure consistency across deployments.

   Why the other options are wrong

   • AInstall-WindowsFeature AD-Domain-Services installs only the AD DS role binaries and the management tools; the machine stays a member server until a promotion cmdlet runs.
   • BTest-ADDSForestInstallation runs the prerequisite checks for creating a new forest and reports whether promotion would succeed. It changes nothing on the server.
   • CAdd-ADDSReadOnlyDomainControllerAccount pre-creates a read-only domain controller account in the directory so a delegated administrator can attach a server to it later; it installs and promotes nothing itself.
2. Question 2Deploy and manage AD DSSelect all that apply

   You are designing AD DS site topology to control replication between a hub datacenter and remote branches connected by costly WAN links. Which TWO settings on a site link directly influence how often and when replication occurs between sites? (Choose TWO)

   • AThe replication interval (frequency) configured on the site linkCorrect
   • BThe replication schedule (allowed time window) configured on the site linkCorrect
   • CThe cost value configured on the site link connecting the two sites
   • DThe site membership list that defines which sites the link connects
   ✓ Correct answer: A, B

   Inter-site replication is controlled by the site link's cost, replication interval (how frequently the KCC attempts replication within the open window), and schedule (the time windows during which replication is permitted). Tuning the interval and schedule lets you limit replication traffic to off-peak periods on expensive WAN links.

   Why the other options are wrong

   • CCost ranks competing paths so the topology can prefer one route over another; it says nothing about when or how often replication runs.
   • DThe membership list names which sites the link connects. It decides which pairs of sites use this link and leaves the frequency and the allowed hours to the interval and the schedule.
3. Question 3Manage Windows Server instances and workloads in a hybrid environmentSelect all that apply

   You need to run remote Windows PowerShell sessions against a server over WS-Management. Which TWO prerequisites must be in place on the target server? (Choose TWO)

   • AWinRM service enabledCorrect
   • BInbound TCP 5985 openCorrect
   • CRDP (TCP 3389) enabled
   • DTelnet client installed
   • ESMB (TCP 445) open
   ✓ Correct answer: A, B

   PowerShell remoting rides on WS-Management, which is provided by the WinRM service. Running Enable-PSRemoting starts and configures WinRM and creates the listener, and the target must allow the inbound HTTP WS-Man port TCP 5985 (or 5986 for HTTPS) through its firewall for the session to connect.

   Why the other options are wrong

   • CRDP on TCP 3389 provides interactive graphical desktop sessions and has nothing to do with WinRM-based PowerShell remoting.
   • DTelnet is an unrelated legacy remote-terminal protocol and is not used by PowerShell remoting.
   • ESMB on TCP 445 is used for file and printer sharing, not for establishing WS-Management sessions.
4. Question 4Manage virtual machines

   Which command creates a production (application-consistent) checkpoint of VM SQL1 named Pre-Patch?

   • ANew-VMSnapshot -VM SQL1 -Name Pre-Patch
   • BCheckpoint-VM -Name SQL1 -SnapshotName Pre-PatchCorrect
   • CExport-VMCheckpoint -VMName SQL1 -Name Pre-Patch
   • DSave-VM -Name SQL1 -Checkpoint Pre-Patch
   ✓ Correct answer: B

   Checkpoint-VM is the Hyper-V cmdlet that creates a checkpoint, with -Name naming the virtual machine and -SnapshotName naming the checkpoint. It creates the checkpoint type configured on that VM, and Production is the default type, so a production checkpoint is taken unless someone has set Standard with Set-VM -CheckpointType. A production checkpoint asks VSS inside the guest to quiesce applications and flush data to disk, which is what you want before patching a database server.

   Why the other options are wrong

   • Anew-VMSnapshot -VM SQL1 -Name Pre-Patch is incorrect because New-VMSnapshot is not a valid Windows PowerShell cmdlet for Hyper-V; the correct cmdlet is Checkpoint-VM.
   • Cexport-VMCheckpoint -VMName SQL1 -Name Pre-Patch is incorrect because Export-VMCheckpoint exports an existing checkpoint for offline use; it does not create a new checkpoint.
   • DSave-VM saves a running VM's state to disk and stops it, much like hibernating a physical computer, and it has no -Checkpoint parameter, so it creates no checkpoint.
5. Question 5Implement and manage an on-premises and hybrid networking infrastructure

   Your team manages 40 on-premises Windows Server machines that are already connected to Azure Arc, and you must centralise their performance counters and Windows event logs in a Log Analytics workspace for alerting. Which component collects that data and sends it to Azure?

   • AAzure Connected Machine agent
   • BAzure Site Recovery Mobility service
   • CAzure Backup MARS agent
   • DAzure Monitor AgentCorrect
   ✓ Correct answer: D

   The Azure Monitor Agent runs on each Windows Server machine, delivered as a VM extension on Azure virtual machines and through the Azure Connected Machine agent on Arc-enabled on-premises servers. A data collection rule tells the agent which performance counters and which Windows event logs to gather and which Log Analytics workspace to send them to, so collection is defined centrally rather than per machine. Once the data lands in the workspace it can be queried with KQL, charted in workbooks, and used to fire alerts. The Azure Monitor Agent replaced the earlier Log Analytics agent, which was retired on 31 August 2024.

   Why the other options are wrong

   • AThe Azure Connected Machine agent registers a server with Azure Arc and installs and updates extensions on it, but it collects no performance counters or event logs itself.
   • BThe Azure Site Recovery Mobility service replicates a server's disks to Azure for disaster recovery and gathers no performance or event telemetry.
   • CThe Azure Backup MARS agent copies files and system state into a Recovery Services vault on a backup schedule and streams no event or performance data.
6. Question 6Manage storage and file services

   You need to grant a user the ability to create SMB shares, modify NTFS permissions, and run the File Server Resource Manager console on a member file server. Which built-in local group membership is required to create and manage SMB shares on that server?

   • AAdd the user to the Power Users group
   • BAdd the user to the local Administrators groupCorrect
   • CAdd the user to the Backup Operators group
   • DAdd the user to the Remote Management Users group
   ✓ Correct answer: B

   On Windows Server, the right to create and manage SMB file shares (including assigning share permissions) is reserved for members of the local Administrators group; there is no lower built-in group that grants only share-management rights. While least privilege is desirable, the platform does not expose a finer-grained built-in delegation for share creation, so Administrators membership is the operational requirement.

   Why the other options are wrong

   • AThe Power Users group is deprecated and retained only for legacy application compatibility; it does not grant the rights needed to create shares or change share permissions.
   • CBackup Operators may read and write every file in order to back it up and restore it, which is a separate privilege from creating a share or editing share permissions.
   • DRemote Management Users may connect over WinRM and open consoles against the server remotely, and the account still holds no right to publish a new share.
7. Question 7Secure Windows Server infrastructure

   On a Windows Server 2022 member server, you must protect cached domain credentials held in the LSASS process from theft by isolating them with virtualization-based security. Which feature should you enable?

   • ALSA protection (RunAsPPL)
   • BLocal Admin Password Solution
   • CRestricted Admin mode for RDP
   • DDefender Credential GuardCorrect
   ✓ Correct answer: D

   Credential Guard uses virtualization-based security to store NTLM hashes and Kerberos tickets in an isolated LSA process that the running operating system cannot read, defeating pass-the-hash and pass-the-ticket attacks. It is supported on member servers running Windows Server 2022.

   Why the other options are wrong

   • ALSA protection (RunAsPPL) runs LSASS as a protected process to block code injection, but it does not isolate the secrets with VBS.
   • BLocal Admin Password Solution rotates and stores local administrator passwords in Active Directory; it does not protect LSASS memory.
   • CRestricted Admin mode stops credentials being sent to an RDP target, but it does not protect the LSASS process on this server.
8. Question 8Monitor and troubleshoot Windows Server environmentsSelect all that apply

   You must install the Azure Monitor Agent on an Arc-enabled server and route data to a workspace. Which TWO actions are required? (Choose TWO)

   • ACreate a Data Collection Rule (DCR) and associate it with the machineCorrect
   • BAdd Windows event logs and performance counters under the workspace Data settings so the agent collects them
   • CInstall the AzureMonitorWindowsAgent VM extension on the Arc machine (e.g., New-AzConnectedMachineExtension -Name AMAAgent -ExtensionType AzureMonitorWindowsAgent -Publisher Microsoft.Azure.Monitor)Correct
   • DRun MMASetup-AMD64.exe on each server and supply the workspace ID and primary key
   ✓ Correct answer: A, C

   These two steps are required to route monitoring data from an Arc-enabled server to an Azure Monitor Log Analytics workspace. First, you create a Data Collection Rule that defines what performance counters and event logs to collect and where to send them. Second, you install the Azure Monitor Agent (AMA) extension on the Arc machine, which is the modern replacement for the legacy MMA (Monitoring and Diagnostics Agent). The AMA extension pulls its configuration from the associated DCR and begins collecting and sending data to your workspace. This modern architecture provides better security, performance, and flexibility compared to the older MMA-based approach.

   Why the other options are wrong

   • BWorkspace-level data settings drive the Microsoft Monitoring Agent. The Azure Monitor Agent ignores them and reads its configuration from an associated data collection rule.
   • DThat installer deploys the Microsoft Monitoring Agent with a workspace key, so the Arc machine never receives the Azure Monitor Agent extension the workspace expects.
9. Question 9Manage virtual machines

   Several virtual machines each need a share of one physical graphics processor rather than exclusive use of it. Which capability provides that?

   • AGPU partitioningCorrect
   • BDiscrete device assignment
   • CRemoteFX vGPU
   • DNested virtualization
   ✓ Correct answer: A

   GPU partitioning splits a single physical adapter into hardware partitions built on SR-IOV, and each virtual machine gets a dedicated fraction of the adapter at the same time as the others. Discrete device assignment is exclusive by design, and a given adapter can be configured for one approach or the other but not both, so taking turns does not give several machines a share. The pairing worth remembering is partitioning for sharing and assignment for dedicated performance.

   Why the other options are wrong

   • BDiscrete device assignment hands the whole adapter to one machine, so it cannot be divided between several.
   • CRemoteFX vGPU was disabled and then removed from Windows, so it is no longer a route to shared acceleration.
   • DNested virtualization runs a hypervisor inside a guest and does not divide an adapter between machines.
10. Question 10Monitor and troubleshoot Windows Server environments

    Policy files are missing from one domain controller while every other controller has them, and replication of directory objects is healthy. What does this point to?

    • AReplication of the shared folder holding policy files has stopped on that controllerCorrect
    • BThe controller was excluded from the policy object's security filtering
    • CThat controller has stopped advertising itself as a global catalog server
    • DThe controller was installed as a read only domain controller rather than a writable one
    ✓ Correct answer: A

    A policy object exists as directory data and as files in a shared folder, and those two halves replicate independently, so the file half can fail while directory replication reports healthy. Missing files on one controller with healthy object replication is the signature. Treating it as a deletion would send an administrator to restore objects that are present and correct.

    Why the other options are wrong

    • BSecurity filtering decides which accounts apply a policy object, not whether the files behind it are present on a controller.
    • CGlobal catalog advertisement affects directory lookups and sign-in, and has no bearing on whether the shared folder contents arrive.
    • DA read only domain controller still receives the contents of the shared folder, so being read only rather than writable does not leave the policy files missing.

Who this AZ-802 practice exam is for

This practice set is for anyone preparing for the AZ-802: Administering Windows Server exam - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AZ-802 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to find weak objectives and focus your study. It shows where you stand on this bank's questions, not whether you are ready to book the real AZ-802 exam.

Related Microsoft resources

• AZ-802 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AZ-900 practice examRelated
• DP-300 practice examRelated
• DP-420 practice examRelated

AZ-802 practice exam FAQ