12 free Microsoft AZ-802 practice questions from the CertStash pack of 63, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 12 free here, all 63 in the pack, and each step includes the one before it.
Get all 63 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named DHCP1 that runs Windows Server and has the DHCP Server role installed. DHCP1 has a static IPv4 address of 10.10.10.5/24.
DHCP1 is authorized in AD DS and contains an active scope for a subnet of 10.10.20.0/24.
Client computers on the 10.10.20.0/24 subnet receive APIPA addresses. You verify that the DHCP Server service is running, and the scope has available IP addresses.
You need to ensure that the computers on 10.10.20.0/24 can obtain IPv4 address leases from DHCP1.
What should you do?
Show answer and explanation
Correct answer: C. Configure a DHCP relay.
DHCP1 is on the 10.10.10.0/24 subnet, while the clients are on 10.10.20.0/24. DHCP discover messages are broadcasts that do not cross routers, so the clients never reach the server and fall back to APIPA addresses. Configuring a DHCP relay agent, or an IP helper address on the router for the client subnet, forwards those requests to DHCP1. The server is already authorized and the scope has free addresses, so the missing piece is delivery of the requests.
Why the other options are wrong
- A. Add-DhcpServerInDC authorizes the server in AD DS, and DHCP1 is already authorized.
- B. An exclusion removes addresses from distribution, which would reduce available addresses rather than allow clients to reach the server.
- D. Add-DhcpServerSecurityGroup creates the local DHCP administrative groups and does not affect how broadcasts from another subnet reach the server.
Question 2
Your network contains an Active Directory Domain Services (AD DS) domain.
A Group Policy Object (GPO) named Security Baseline is linked to the domain. The link is configured as Enforced.
A GPO named Kiosk Baseline is linked to an organizational unit (OU) named Kiosks.
Client computers in the Kiosks OU receive Group Policy settings from the Security Baseline GPO.
You need to ensure that the computers in Kiosks receive settings from the Kiosk Baseline GPO. Security Baseline must continue to apply to other client computers in the domain.
What should you do?
Show answer and explanation
Correct answer: B. Clear Enforced for the Security Baseline link.
An enforced GPO link cannot be overridden by GPOs linked at lower levels, and it also applies to child containers even when Block Inheritance is set. Clearing Enforced on the Security Baseline link lets normal precedence apply again. The Kiosk Baseline GPO linked to the Kiosks OU is processed after the domain-level GPO, so its settings win where the two conflict. Security Baseline still applies to every other client computer through the domain link.
Why the other options are wrong
- A. Enforcing Kiosk Baseline does not help, because the enforced domain-level link would still take precedence over a link at a lower level.
- C. Block Inheritance has no effect on a link that is enforced, so Security Baseline would still apply to the Kiosks OU.
- D. Linking Kiosk Baseline to the domain would apply it to every computer, and the enforced Security Baseline would still take precedence where settings conflict.
Question 3
Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. Each forest contains a single domain. Both forests are at the Windows Server 2016 forest functional level. Users in contoso.com must be able to access shared resources in fabrikam.com by using Kerberos authentication. Users in fabrikam.com must NOT be able to access resources in contoso.com. You need to create a trust relationship to meet the requirements. What should you create?
Show answer and explanation
Correct answer: A. A one-way forest trust in which fabrikam.com trusts contoso.com.
A trust is directional: the trusting domain holds the resources and the trusted domain holds the users who are granted access. Because contoso.com users must reach resources in fabrikam.com, fabrikam.com must be the trusting side, and contoso.com the trusted side. Both forests are at the Windows Server 2016 functional level, so a forest trust is available, and it supports Kerberos authentication across the forests. A one-way trust prevents fabrikam.com users from reaching contoso.com.
Why the other options are wrong
- B. In this trust contoso.com is the trusting side, which would let fabrikam.com users access contoso.com resources, the opposite of the requirement.
- C. A two-way trust would also let users in fabrikam.com access resources in contoso.com, which is not allowed.
- D. An external trust does not provide the Kerberos support between forests that a forest trust provides, so a forest trust is the supported choice when Kerberos authentication is required.
Question 4
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server and store BitLocker recovery keys in AD DS.
A server named Server1 starts in BitLocker recovery mode.
You need to identify the BitLocker recovery key for Server1.
Solution: You run ntdsutil.exe on a domain controller.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Ntdsutil.exe is a command-line tool for managing the AD DS database, covering tasks such as metadata cleanup, ownership transfer of operations master roles and offline database maintenance. It has no function for looking up the BitLocker recovery password stored for a computer. The recovery information is retrieved with the BitLocker Recovery Password Viewer in Active Directory Users and Computers, so running ntdsutil.exe on a domain controller does not meet the goal.
Why the other options are wrong
- A. Ntdsutil.exe manages the directory database and roles and cannot display the BitLocker recovery password of a computer.
Question 5
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server and store BitLocker recovery keys in AD DS.
A server named Server1 starts in BitLocker recovery mode.
You need to identify the BitLocker recovery key for Server1.
Solution: You use ADSI Edit and view the properties of the Server1 computer object.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
BitLocker recovery information is stored in AD DS as a child object of the computer object, of the type msFVE-RecoveryInformation, and the recovery password is held in an attribute of that child object. Viewing the properties of the Server1 computer object itself does not display the recovery password, so the solution does not identify the key. The supported way to read it is the BitLocker Recovery Password Viewer in Active Directory Users and Computers, which searches by computer or by password ID.
Why the other options are wrong
- A. The recovery password is stored on a child object beneath the computer object, so the computer object's own properties do not reveal it.
Question 6
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server and store BitLocker recovery keys in AD DS.
A server named Server1 starts in BitLocker recovery mode.
You need to identify the BitLocker recovery key for Server1.
Solution: You run repair-bde.exe by using a BitLocker key package exported from AD DS.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Repair-bde.exe is a repair tool that recovers data from a damaged BitLocker-protected volume, and it needs a recovery password or recovery key as its input, plus the key package when the BitLocker metadata is damaged. It does not search AD DS and does not report which recovery password belongs to a server. The key still has to be located first, which is done by viewing the recovery information stored for the computer in AD DS with the BitLocker Recovery Password Viewer.
Why the other options are wrong
- A. Repair-bde.exe consumes a recovery password or recovery key (and optionally a key package) to repair a volume, so it cannot be used to identify the key for Server1.
Question 7
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server and store BitLocker recovery keys in AD DS.
A server named Server1 starts in BitLocker recovery mode.
You need to identify the BitLocker recovery key for Server1.
Solution: From Active Directory Users and Computers, you use BitLocker Recovery Password Viewer.
Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
When the BitLocker Drive Encryption Administration Utilities feature is installed, Active Directory Users and Computers gains the BitLocker Recovery Password Viewer. From a computer object's properties you can open the BitLocker Recovery tab to see the recovery passwords stored for that server, or you can search the domain by password ID. Because the keys are already stored in AD DS, this identifies the recovery key for Server1 and meets the goal.
Why the other options are wrong
- B. The BitLocker Recovery Password Viewer is the supported tool for reading recovery passwords stored in AD DS, so the solution does meet the goal.
Question 8
You have a server named DHCP1 that runs Windows Server and has the DHCP Server role installed.
DHCP1 hosts an activated IPv4 scope for a subnet of 192.168.15.0/24.
You have a CSV file named PrinterReservations.csv that contains the following columns:
• ClientId
• ScopeId
• IPAddress
• MacAddress
All the IP addresses in PrinterReservations.csv are within the scope range and are currently available. You need to create DHCP reservations for 20 printers by using PrinterReservations.csv. The solution must minimize administrative effort.
Which PowerShell command should you run?
Show answer and explanation
Correct answer: B. Import-Csv .\PrinterReservations.csv | Add-DhcpServerv4Reservation -ComputerName DHCP1
Add-DhcpServerv4Reservation creates new reservations, and it accepts the ScopeId, IPAddress and ClientId values from pipeline input by property name. Piping the rows from Import-Csv into it therefore creates all 20 reservations in one command, which minimizes administrative effort. The addresses are currently available, so none of them conflicts with an existing lease or reservation.
Why the other options are wrong
- A. Set-DhcpServerv4Reservation modifies reservations that already exist, so it fails for printers that have no reservation yet.
- C. Add-DhcpServerv4ExclusionRange excludes address ranges from distribution and does not create reservations.
- D. Add-DhcpServerv4Filter builds an allow list of MAC addresses for filtering and does not reserve IP addresses, and the file path is also not the file in the current folder.
Question 9
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com.
You have an Azure virtual network named VNet1 that is connected to the on-premises network by using a Site-to-Site (S2S) VPN.
VNet1 contains a domain-joined virtual machine named VM1 that hosts an application named App1.
App1 uses Kerberos authentication and updates objects in AD DS. An Azure Firewall filters communication from VM1 to the domain controllers in contoso.com.
You need to deploy domain controllers to VNet1. The solution must support the requirements of VM1 and provide domain controller redundancy in Azure.
What should you deploy?
Show answer and explanation
Correct answer: A. two writable domain controller virtual machines across availability zones
App1 updates objects in AD DS, so it needs writable domain controllers, which excludes read-only domain controllers. Deploying two writable domain controller virtual machines across availability zones in VNet1 places them close to VM1 and gives redundancy, because the virtual machines run in separate datacenters within the same region. Domain controllers in the same virtual network also avoid the extra latency and inter-region connectivity that cross-region placement would add.
Why the other options are wrong
- B. Read-only domain controllers cannot accept the writes that App1 makes to AD DS.
- C. Placing each domain controller in a different Azure region adds latency and requires extra virtual network connectivity between the regions, such as virtual network peering or a VPN.
- D. Read-only domain controllers cannot accept the writes that App1 makes, and separate regions add latency and complexity.
Question 10
Your network contains an Active Directory Domain Services (AD DS) domain.
The domain contains a member server named DNS1 that has the DNS Server role installed and PowerShell remoting enabled. The domain contains a group named DNSOperators.
The members of DNSOperators perform routine DNS tasks on DNS1 by using PowerShell. The DNSOperators members are NOT local administrators on DNS1.
You need to configure remote management for DNSOperators. The solution must meet the following requirements:
• Enable access to DNS1 by using non-admin domain accounts.
• Allow only the required DNS commands to run on DNS1.
• Prevent adding DNSOperators to privileged groups.
What should you implement?
Show answer and explanation
Correct answer: C. a Just Enough Administration (JEA) endpoint that uses a role capability and a virtual account
Just Enough Administration (JEA) is built for this scenario. A JEA endpoint is a constrained PowerShell session configuration, and a role capability file lists exactly which DNS cmdlets the DNSOperators members may run. The session runs under a virtual account that holds the needed privileges only for the duration of the session, so the users connect with their normal non-admin domain accounts and are never added to privileged groups.
Why the other options are wrong
- A. Resource-based Kerberos constrained delegation controls delegation of credentials between services and does not restrict which commands a user can run.
- B. CredSSP delegates credentials to the remote server and does not limit the commands that can be run, and it gives non-admin users no administrative capability.
- D. A standard session configuration with a RunAsCredential does not restrict commands to the required DNS ones and exposes a stored privileged credential.
Question 11
Your network contains an Active Directory Domain Services (AD DS) forest.
The forest contains a parent domain named contoso.com and a child domain named corp.contoso.com. Both domains contain domain controllers that have the DNS Server role installed. Some domain controllers in contoso.com do NOT have the DNS Server role installed.
The DNS zone for contoso.com is Active Directory-integrated and uses secure dynamic updates. The zone replicates to all the DNS servers in the forest.
You need to modify the zone to meet the following requirements:
• Prevent the DNS servers in corp.contoso.com from receiving contoso.com zone data.
• Minimize Active Directory replication traffic.
What should you do?
Show answer and explanation
Correct answer: C. Change the zone replication scope to all the DNS servers on the domain controllers in the contoso.com domain.
Setting the replication scope to all DNS servers on domain controllers in the contoso.com domain stores the zone in the DomainDnsZones application partition. That partition replicates only to domain controllers in contoso.com that run the DNS Server role, so the corp.contoso.com DNS servers do not receive the zone, and domain controllers without DNS are not burdened with replication. This keeps Active Directory replication traffic to the minimum needed.
Why the other options are wrong
- A. Replicating to all domain controllers in the domain stores the zone in the domain partition, which also goes to domain controllers that do not run DNS and increases replication traffic.
- B. Replicating to all DNS servers in the forest sends the zone to the corp.contoso.com DNS servers, which violates the requirement.
- D. Secondary zones are not Active Directory-integrated and do not support secure dynamic updates, so the zone would lose its integration.
Question 12
Your network contains an on-premises Active Directory Domain Services (AD DS) forest named contoso.com.
The forest contains three domain controllers that have the DNS Server role installed and host an Active Directory-integrated zone for contoso.com. The DNS servers use existing forwarders for internet name resolution.
You have a partner company that owns a DNS namespace named fabrikam.com and provides DNS servers at IP addresses 172.16.10.10 and 172.16.10.11 over a Site-to-Site (S2S) VPN.
You need to configure the DNS servers in the contoso.com forest. The solution must meet the following requirements:
• Send queries for fabrikam.com to the partner company's DNS servers.
• Continue to use the existing forwarders for other external namespaces.
• Apply the configuration to all the current and future DNS servers on the domain controllers in contoso.com.
What should you do?
Show answer and explanation
Correct answer: B. Create an Active Directory-integrated conditional forwarder for fabrikam.com that uses 172.16.10.10 and 172.16.10.11.
A conditional forwarder for fabrikam.com sends only queries for that namespace to 172.16.10.10 and 172.16.10.11, while all other names continue to use the existing forwarders. Storing the conditional forwarder in Active Directory and replicating it to all DNS servers in the domain applies it automatically to every current and future DNS server on the domain controllers in contoso.com, without configuring each server separately.
Why the other options are wrong
- A. Adding the partner servers as forwarders would send all external queries to them and replace the intended use of the existing forwarders for other namespaces.
- C. A locally stored conditional forwarder exists only on the one server where it is created, so it does not apply to current and future servers.
- D. Root hints are used to resolve names from the root of the DNS hierarchy and do not direct a single namespace to specific servers.
That was 12 of 63.
The full Microsoft AZ-802 pack has all 63 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 31 free as one PDF by email. Get the Half Pack →