Pass the Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-802 Questions and answers with Dumpstech

Type of storage account: General-purpose v2. Redundancy: Zone-redundant storage (ZRS).

Standard SMB Azure file shares, which use lower-cost HDD-backed (transaction-optimized) storage rather than the SSD-backed premium file shares, are created only in a general-purpose v2 storage account, whereas the FileStorage account kind is required specifically for premium (SSD-based) file shares and BlobStorage accounts cannot host file shares at all; selecting General-purpose v2 both supports the standard, non-premium file share needed here and directly satisfies the requirement to minimize SSD-based performance costs, since premium/SSD-backed shares would be considerably more expensive for a temporary, general-purpose migration workload. Of the available redundancy options, zone-redundant storage (ZRS) synchronously replicates data across three physically separate availability zones within the region and continues to serve both read and write requests even if one entire zone becomes unavailable, satisfying the availability-during-a-zone-outage requirement, whereas locally-redundant storage (not listed in the options here but implied by the need to choose something with zone protection) offers no zone protection at all. Geo-redundant storage (GRS) and geo-zone-redundant storage (GZRS) both add asynchronous replication to a secondary, distant region on top of zone protection, which costs meaningfully more than ZRS while providing disaster-recovery protection this temporary, migration-phase workload does not require, so ZRS is the option that meets the availability requirement at the lowest additional cost.

Set-VMProcessor VM1 -ExposeVirtualizationExtensions $true

Installing the Hyper-V role inside a virtual machine -- running Hyper-V as a nested hypervisor on top of another Hyper-V host -- requires nested virtualization to be explicitly enabled for that specific VM, because a virtual processor does not, by default, expose the hardware virtualization extensions (Intel VT-x/EPT or AMD-V) that a guest hypervisor needs to create and run its own virtual machines. This is enabled on the Hyper-V host (Server1), targeting the guest VM, with Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true, run before Hyper-V is installed inside VM1; only after virtualization extensions are exposed to VM1 can the Hyper-V role be installed and function correctly inside that guest. Set-VMHost configures host-wide Hyper-V settings such as default storage/VM paths or NUMA spanning and has an -EnableEnhancedSessionMode-equivalent policy setting for the VMConnect enhanced session experience, but it has no role in enabling nested virtualization. Set-VM, Set-VMFirmware, and Set-VMSecurity configure other unrelated VM properties (general VM settings, boot firmware/Secure Boot, and security features such as Shielded VM/vTPM, respectively) and do not control virtualization extension exposure. Therefore, the required first command is Set-VMProcessor VM1 -ExposeVirtualizationExtensions $true, run on Server1.

VM1 on Host1: Planned Failover only. VM1 on Host2: Test Failover and Failover only.

Hyper-V Replica exposes different failover actions depending on whether an administrator is working from the primary host or the replica host. On Host1, the primary server where VM1 actually runs, only a Planned Failover can be initiated, because a planned failover requires the source VM to be shut down cleanly and its final changes replicated before control transfers to the replica -- an operation that is only meaningful and available from the currently-running primary copy; ordinary (unplanned) Failover and Test Failover are actions performed against a replica virtual machine, not the primary, so neither is available on Host1. On Host2, the replica server, the available actions are Test Failover, which brings up an isolated, temporary copy of the replica VM for verification purposes without disrupting ongoing replication, and (unplanned) Failover, used to bring the replica online for real when the primary is unreachable; Planned Failover is not offered on Host2 because that operation is scoped specifically to the currently-running primary copy on Host1, not to the passive replica. This split of available actions by role is a deliberate safeguard against accidentally initiating a graceful failover from what is meant to be a passive, standby replica.

1. Obtain and install a new certificate. 2. Copy the certificate thumbprint. 3. Run Windows Admin Center Setup and select Change.

When the certificate backing a Windows Admin Center gateway installation expires, the fix is to supply the gateway with a new certificate through its own Setup program rather than through IIS, because a standalone gateway installation binds its HTTPS listener itself (via the installer) rather than being hosted inside IIS; the IIS Manager certificate-binding option is a distractor that does not apply to this deployment model. The correct sequence starts by obtaining a new certificate from the CA and installing it into the local machine certificate store on Server1, exactly as would have been done for the original certificate. Once the new certificate is in the store, its thumbprint must be copied, because the Windows Admin Center Setup program asks for the certificate by thumbprint when reconfiguring the gateway. The final step is to re-run Windows Admin Center Setup and choose the Change option, which lets you supply the new certificate thumbprint and rebinds the gateway ' s HTTPS listener to it, without uninstalling the product. Repair only reinstalls existing files and settings and does not prompt for a new certificate, and Remove would uninstall Windows Admin Center entirely, losing its configuration, so neither is appropriate. Following obtain-and-install, copy-thumbprint, then Setup-Change replaces the certificate with minimal disruption.

An Azure Private DNS zone such as contoso.com is only directly resolvable by resources inside a virtual network it is linked to; once Server1 is migrated out of VNet1 to the on-premises datacenter, it loses that direct resolution path and needs a route back into Azure to reach the private zone ' s records. An Azure DNS Private Resolver ' s inbound endpoint is specifically designed to provide an IP address inside the VNet that on-premises DNS infrastructure (reachable via the existing ExpressRoute circuit, ER1) can send queries to for names in the linked private zone. Since Server1 already runs the DNS Server role and already has a conditional forwarder configured for contoso.com (previously usable while Server1 was inside the VNet), the necessary follow-up action after migration is to modify that existing conditional forwarder so it points at PR1 ' s inbound endpoint IP address, letting Server1 continue resolving contoso.com entries by forwarding those specific queries over ER1 into Azure. Creating a secondary zone on Server1 would not work, since Azure Private DNS zones do not support zone transfers (AXFR/IXFR) at all. Creating an outbound endpoint on PR1, or a DNS forwarding ruleset associated with an outbound endpoint, are both mechanisms for resolving external (for example, on-premises) namespaces from within Azure -- the opposite direction of what ' s needed here, which is on-premises resolution of an Azure-hosted private zone. Therefore, modifying Server1 ' s conditional forwarder for contoso.com to target PR1 ' s inbound endpoint is the correct action.

Active Directory Sites and Services is the console used to manage physical network topology objects — sites, subnets, site links, and the NTDS Settings/connection objects on individual server objects — and it has no interface for viewing or transferring any of the five FSMO roles. Right-clicking a site object such as Default-First-Site-Name and opening Properties surfaces only site-level configuration, such as the intersite topology generator ' s settings and general site description/location metadata; it does not display operations master role holders anywhere in that dialog. The domain-wide roles (PDC Emulator, RID Master, Infrastructure Master) are surfaced through Active Directory Users and Computers by right-clicking the domain and choosing Operations Masters, while the forest-wide roles (Schema Master, Domain Naming Master) are surfaced through the Active Directory Schema snap-in and Active Directory Domains and Trusts, respectively; command-line tools such as netdom query fsmo or ntdsutil ' s roles context provide the same information without a GUI. Because Sites and Services Properties for a site object exposes none of that role information, the proposed action cannot reveal which server holds the PDC Emulator role, and the solution fails to meet the stated goal.

Older logs overwritten: The Performance Counter properties. Stop below 500 MB free: The Data Manager properties.

The individual Performance Counter data collector inside a Data Collector Set has its own Properties dialog with a File tab that includes an Overwrite option, and enabling that option causes each new logging run to overwrite the previous log file in place rather than creating a new, separately numbered file each time -- this is exactly the control needed to make older performance counter logs get replaced by newer ones. Disk-space-based retention, on the other hand, is governed at the level of the Data Collector Set as a whole through its Data Manager properties, which expose a Minimum Free Disk Space setting, alongside Maximum Folders and Maximum Root Path Size settings, that Windows evaluates against the log directory ' s volume to manage or halt further data collection once free space drops below the configured threshold. Because these two behaviors live on two entirely different property pages -- one scoped to the individual counter ' s file settings and the other scoped to the Data Collector Set ' s overall data management -- the Configuration properties option, which governs sample interval and duration settings, does not control either of these two requirements.

The Azure Migrate App Containerization tool discovers the ASP.NET application on Server1, containerizes it, and pushes the image to a container registry as part of the integrated App Service migration flow. Running a migration task in Azure Migrate then deploys that container to an Azure App Service Web App for Containers instance. Because the App Service app is initially reachable only through its default azurewebsites.net hostname, a custom domain (app1.contoso.com) must be bound and validated on the App Service app afterward so users can continue using the same URL. Creating an App Service plan, an Azure Migrate assessment, or a Private DNS zone are not part of this specific containerize-and-migrate-then-rebind-domain sequence, since the plan is provisioned implicitly during deployment and the assessment step is only relevant before the migration decision is made. Validating the custom domain also typically requires adding a CNAME or TXT record with the domain registrar and, for HTTPS, binding a TLS certificate, but these DNS-provider-side steps happen outside the three Azure Migrate actions being sequenced here.

BitLocker: C, D, and E. Disk quotas: C and D only.

Server1 has three volumes: C and D are formatted NTFS, and E is formatted ReFS. BitLocker Drive Encryption supports encrypting NTFS, FAT16/32, exFAT, and ReFS volumes, so it can be enabled on all three volumes regardless of whether they use NTFS or ReFS; there is no BitLocker restriction that excludes ReFS. Disk quotas, by contrast, are an NTFS-specific feature built into the NTFS file system driver to track and limit per-user storage consumption on a volume; ReFS does not implement the same per-user quota tracking mechanism that classic NTFS disk quotas rely on, so disk quotas cannot be configured on volume E. Because C and D are both NTFS, disk quotas can be enabled on both of them. It is a common point of confusion to assume that any feature available on NTFS is automatically available on ReFS, or vice versa, since both are modern Microsoft-supported file systems, but they diverge specifically on this legacy per-user quota capability. Therefore, BitLocker applies to C, D, and E, while disk quotas apply only to C and D.

The Azure Policy guest configuration feature audits and remediates settings inside the operating system of a VM, such as local security policies, registry keys, and installed roles/features. To do this, the guest configuration extension running inside the VM must be able to authenticate to Azure without storing any credential inside the VM, and it does this using the VM ' s own system-assigned managed identity: Azure Policy uses that identity to communicate securely between the guest configuration extension and the guest configuration service. Enabling a system-assigned managed identity on VM1 is therefore the prerequisite that allows the guest configuration extension to be deployed and to report compliance back to Azure Policy. A user-assigned managed identity is not what the guest configuration extension is documented to use for this purpose; the feature specifically relies on the VM ' s system-assigned identity being present. The PowerShell Desired State Configuration (DSC) extension and the Custom Script Extension are unrelated extensions used for different configuration-management and scripting scenarios; neither one enables or is required by the Azure Policy guest configuration capability. Because the requirement is specifically to use guest configuration for policy auditing/remediation on VM1, enabling a system-assigned managed identity on the VM is the necessary and sufficient configuration change.