2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Microsoft AZ-802 Exam Practice Questions, practice question pack
MICROSOFT · AZ-802

Microsoft AZ-802 Exam Practice Questions

99% pass rateUpdated 1 Nov 202663 questions2 PDFs, instant download

US$39

Every question with the correct answer and why the other options are wrong.

Download the free sample

Card, Apple Pay, Google Pay or PayPal. Download links are on your order page and in your email the moment you pay.

99% pass rate. Pass or your money back.Fail the exam after using this pack and we refund it, or swap it for any other pack. How the guarantee works
Category:
TRY BEFORE YOU BUY

Three of the 63 questions in this pack

Question 1

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named DHCP1 that runs Windows Server and has the DHCP Server role installed. DHCP1 has a static IPv4 address of 10.10.10.5/24.

DHCP1 is authorized in AD DS and contains an active scope for a subnet of 10.10.20.0/24.

Client computers on the 10.10.20.0/24 subnet receive APIPA addresses. You verify that the DHCP Server service is running, and the scope has available IP addresses.

You need to ensure that the computers on 10.10.20.0/24 can obtain IPv4 address leases from DHCP1.

What should you do?

  1. Run Add-DhcpServerInDC.
  2. Create an exclusion.
  3. Configure a DHCP relay.
  4. Run Add-DhcpServerSecurityGroup.
Show answer and explanation

Correct answer: C. Configure a DHCP relay.

DHCP1 is on the 10.10.10.0/24 subnet, while the clients are on 10.10.20.0/24. DHCP discover messages are broadcasts that do not cross routers, so the clients never reach the server and fall back to APIPA addresses. Configuring a DHCP relay agent, or an IP helper address on the router for the client subnet, forwards those requests to DHCP1. The server is already authorized and the scope has free addresses, so the missing piece is delivery of the requests.

Why the other options are wrong

  • A. Add-DhcpServerInDC authorizes the server in AD DS, and DHCP1 is already authorized.
  • B. An exclusion removes addresses from distribution, which would reduce available addresses rather than allow clients to reach the server.
  • D. Add-DhcpServerSecurityGroup creates the local DHCP administrative groups and does not affect how broadcasts from another subnet reach the server.

Question 2

Your network contains an Active Directory Domain Services (AD DS) domain.

A Group Policy Object (GPO) named Security Baseline is linked to the domain. The link is configured as Enforced.

A GPO named Kiosk Baseline is linked to an organizational unit (OU) named Kiosks.

Client computers in the Kiosks OU receive Group Policy settings from the Security Baseline GPO.

You need to ensure that the computers in Kiosks receive settings from the Kiosk Baseline GPO. Security Baseline must continue to apply to other client computers in the domain.

What should you do?

  1. Select Enforced for Kiosk Baseline.
  2. Clear Enforced for the Security Baseline link.
  3. Block inheritance for Kiosks.
  4. Link Kiosk Baseline to the domain.
Show answer and explanation

Correct answer: B. Clear Enforced for the Security Baseline link.

An enforced GPO link cannot be overridden by GPOs linked at lower levels, and it also applies to child containers even when Block Inheritance is set. Clearing Enforced on the Security Baseline link lets normal precedence apply again. The Kiosk Baseline GPO linked to the Kiosks OU is processed after the domain-level GPO, so its settings win where the two conflict. Security Baseline still applies to every other client computer through the domain link.

Why the other options are wrong

  • A. Enforcing Kiosk Baseline does not help, because the enforced domain-level link would still take precedence over a link at a lower level.
  • C. Block Inheritance has no effect on a link that is enforced, so Security Baseline would still apply to the Kiosks OU.
  • D. Linking Kiosk Baseline to the domain would apply it to every computer, and the enforced Security Baseline would still take precedence where settings conflict.

Question 3

Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. Each forest contains a single domain. Both forests are at the Windows Server 2016 forest functional level. Users in contoso.com must be able to access shared resources in fabrikam.com by using Kerberos authentication. Users in fabrikam.com must NOT be able to access resources in contoso.com. You need to create a trust relationship to meet the requirements. What should you create?

  1. A one-way forest trust in which fabrikam.com trusts contoso.com.
  2. A one-way forest trust in which contoso.com trusts fabrikam.com.
  3. A two-way forest trust between contoso.com and fabrikam.com.
  4. A one-way external trust in which fabrikam.com trusts contoso.com.
Show answer and explanation

Correct answer: A. A one-way forest trust in which fabrikam.com trusts contoso.com.

A trust is directional: the trusting domain holds the resources and the trusted domain holds the users who are granted access. Because contoso.com users must reach resources in fabrikam.com, fabrikam.com must be the trusting side, and contoso.com the trusted side. Both forests are at the Windows Server 2016 functional level, so a forest trust is available, and it supports Kerberos authentication across the forests. A one-way trust prevents fabrikam.com users from reaching contoso.com.

Why the other options are wrong

  • B. In this trust contoso.com is the trusting side, which would let fabrikam.com users access contoso.com resources, the opposite of the requirement.
  • C. A two-way trust would also let users in fabrikam.com access resources in contoso.com, which is not allowed.
  • D. An external trust does not provide the Kerberos support between forests that a forest trust provides, so a forest trust is the supported choice when Kerberos authentication is required.

See all 12 free questions Get the full pack, US$39

How much of the Microsoft AZ-802 bank is free?

63 questions in the bank

Each step includes the one before, so buying only adds new questions.

  • You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
  • 1219% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
  • 31the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
  • 63100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
ABOUT THIS PACK

What’s in the Microsoft AZ-802 pack

  • 63 questions mapped to the AZ-802 exam objectives
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Instant delivery by email the moment you check out
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

Microsoft sets the AZ-802 exam price by country, and a failed attempt means paying it again. This pack is US$39, paid once, and refunded if you fail.

What makes the AZ-802 hard

AZ-802 replaces both AZ-800 and AZ-801. One exam now covers the whole Windows Server administrator role, so the old split between core infrastructure and hybrid advanced services is gone.

The blueprint spans seven areas: Active Directory Domain Services, hybrid management with Azure Arc and Azure Automation, Hyper-V and Azure virtual machines, DNS and DHCP, Azure Files and Windows Server storage, operating system and Active Directory security, and monitoring and troubleshooting. Expect scenario questions where several options work and only one meets the stated constraint, such as least privilege or minimum effort, and tasks like picking the right cmdlet or the right setting from a list. The exam is in English only.

This pack has 63 practice questions for the AZ-802, including the hotspot and drag-and-drop tasks and the Contoso case study, so the question style is familiar before exam day.

About the exam

AZ-802 (Administering Windows Server) leads to Microsoft Certified: Windows Server Administrator Associate. It validates the ability to deploy, implement, manage and troubleshoot Windows Server workloads across on-premises, cloud and hybrid environments, using tools such as Windows Admin Center, Hyper-V, PowerShell, Azure Arc, Azure Monitor, Azure Update Manager and Microsoft Defender for Cloud. There is no formal prerequisite, and the certification renews annually through a free online assessment on Microsoft Learn.

Read the Microsoft AZ-802 study guide

Questions before you buy

How quickly do I receive it?

Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

What is your pass rate?

99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products