Pass the Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-802 Questions and answers with Dumpstech

A Windows Server failover cluster requires a distinct IP address for each individual cluster node ' s network adapter, plus one additional IP address for the cluster ' s own network name resource -- the cluster access point that clients and management tools use to address the cluster as a single logical entity rather than any one specific node. Cluster3 will contain two physical nodes, Node1 and Node2, so at minimum one IP address is required for Node1 ' s network adapter and one for Node2 ' s network adapter. Beyond those two node-level addresses, the cluster core resource itself (the cluster name object and its associated IP address resource) requires one more address so that the cluster can be addressed and managed as a whole and so that any highly available roles hosted on the cluster (such as the file share role planned for Cluster3) can obtain the network identity they need to fail over between nodes. Adding these together -- one for Node1, one for Node2, and one for the cluster ' s own network name -- yields a minimum of three IP addresses required for Cluster3 ' s node and cluster roles. Fewer than three would leave either a node or the cluster itself without a usable network identity, and while additional IP addresses may be consumed by highly available roles later added to the cluster, three is the baseline minimum for the node and cluster roles themselves.

To enable WebApp1 to handle requests for the website: Add a custom domain name. To point client connections to WebApp1: Modify a DNS record.

For an Azure App Service web app to accept and correctly serve requests addressed to https://www.fabrikam.com rather than only its default *.azurewebsites.net hostname, the custom domain www.fabrikam.com must be added and bound to WebApp1 -- this is the specific configuration step that makes the app recognize and handle that custom hostname at all. Creating a deployment slot supports staged rollout and swap scenarios and does nothing to bind a custom domain, and creating a private endpoint provides private, VNet-restricted connectivity rather than public custom-domain handling, so neither accomplishes the stated goal. Once WEB1 and WEB2 are decommissioned per the migration plan, client traffic that currently resolves to those on-premises-facing web servers must instead be directed to WebApp1; since DNS is what resolves the www.fabrikam.com name to a specific endpoint, the DNS record for that hostname must be modified (typically to a CNAME record pointing at WebApp1 ' s default hostname, together with the domain-verification TXT record Azure requires before it will accept the custom domain binding). Azure Front Door and Azure Traffic Manager are global routing and load-balancing services meant for multi-region or multi-endpoint failover scenarios and are unnecessary complexity for redirecting a single custom domain to a single web app, and adding HTTP redirect rules on WEB1/WEB2 is not a viable option once those servers have been decommissioned. Therefore, adding a custom domain name to WebApp1 and then modifying the DNS record are the two required actions.

Enforce the security policy: Microsoft Defender Application Control. Manage the policy settings: Group Policy Objects (GPOs).

Windows Defender Application Control (WDAC) is the platform feature that enforces which applications are authorized to install or run on a Windows Server, directly meeting the stated requirement that only authorized applications can be installed or run on the servers in the forest. Microsoft Defender Application Guard isolates untrusted browsing sessions in a container and Microsoft Defender Credential Guard protects credential material from theft -- neither controls which applications are permitted to execute. Microsoft Defender for Endpoint is an endpoint detection-and-response platform that detects and responds to threats rather than enforcing a whitelist of permitted applications. Because the servers described are on-premises, domain-joined machines rather than Intune-managed, Microsoft Entra-joined devices, the WDAC policy settings here must be managed through Group Policy Objects distributed via AD DS, not through Intune. Configuration profiles in Microsoft Intune and compliance policies in Microsoft Intune are both cloud-management mechanisms that apply only to devices enrolled in and managed by Intune, which these on-premises, domain-joined servers are not. Therefore, WDAC is the enforcing service and Group Policy Objects are the correct management mechanism for these on-premises servers.

Microsoft Defender for Identity is the Microsoft Sentinel data connector purpose-built to monitor on-premises Active Directory domain controllers and surface exactly the insecure-protocol activity described in the requirement, including authentication attempts and sign-ins that rely on legacy or unsigned protocols such as NTLMv1, SMBv1, and unsigned LDAP binds. It does this by analyzing domain controller network traffic and Windows Events directly on the DCs, which is exactly where this insecure-protocol usage originates. The Threat Intelligence - TAXII connector ingests external threat-intelligence indicator feeds (IP addresses, file hashes, domains) from TAXII-compliant sources and has nothing to do with monitoring authentication protocol usage on domain controllers. The Azure Active Directory (Microsoft Entra ID) connector reports on cloud sign-in and audit log events for the Entra tenant, not on legacy protocol usage against on-premises AD DS domain controllers. Microsoft Defender for Cloud focuses on cloud resource security posture management and workload protection rather than detecting legacy authentication protocol usage against on-premises domain controllers. Therefore, connecting Microsoft Defender for Identity to Microsoft Sentinel is the correct connector to identify connections to the domain controllers that use insecure protocols.

1. Add a disk resource to the cluster. 2. Create a Cluster Shared Volume (CSV). 3. Put the disk in maintenance mode. 4. Enable BitLocker on the volume. 5. Update the BitLockerProtectorInfo property of the volume.

BitLocker can only be enabled on a Cluster Shared Volume disk while that disk is taken offline to cluster I/O, so the CSV must exist and be placed into maintenance mode before encryption can be applied. The supported sequence begins by adding the disk resource to the cluster and converting it into a Cluster Shared Volume, since BitLocker-on-CSV support requires the disk to already be a CSV rather than a plain cluster disk. The disk is then put into maintenance mode, which takes it offline to the other cluster nodes so it can be safely encrypted without a node attempting to access it mid-operation. With the CSV disk offline in maintenance mode, BitLocker is enabled on the volume. Finally, the volume ' s BitLockerProtectorInfo property is updated so that Failover Clustering registers the unlock protector, allowing the volume to automatically unlock on every cluster node once maintenance mode ends and the CSV is brought back online. Performing these steps out of order either fails outright -- BitLocker cannot be enabled on a CSV disk that is still online and actively used by the cluster -- or leaves the other cluster nodes unable to bring the encrypted volume back online afterward, since they would lack the registered unlock protector. Therefore, the correct order is: add the disk resource, create the CSV, put the disk in maintenance mode, enable BitLocker, and update BitLockerProtectorInfo.

Statement 1: No. Statement 2: Yes. Statement 3: No.

Password-policy (Account Policy) settings inside a GPO behave differently depending on where the GPO is linked. For domain user accounts, only Account Policy settings defined in a GPO linked at the domain level (or in a fine-grained Password Settings Object) take effect; Account Policy settings in a GPO linked to an OU are ignored for domain accounts and instead apply only to the local SAM password policy of computer objects located in that OU. GPO1 (minimum length 14) is linked to OU1, where Admin1 ' s user object resides, but because it is linked to an OU rather than the domain, it has no effect on Admin1 ' s domain account password requirement. Admin1 ' s domain password is governed only by the Default Domain Policy (minimum length 10), so statement 1 is false. User1 is likewise a domain account subject only to the Default Domain Policy ' s minimum length of 10, so statement 2 is true. GPO2 (minimum length 8) is linked to the Member Servers OU, which contains Server1 as a computer object; this makes GPO2 the effective local password policy for local accounts created on Server1 (overriding the Default Domain Policy locally), not the domain policy ' s 10-character minimum. Therefore a new local account on Server1 needs only eight characters, not ten, making statement 3 false.

Group3: Group1, Group2, Group4, and Group5 only. Group5: Group4 only.

Group nesting in AD DS is governed strictly by group scope, independent of whether a group is security- or distribution-type. A Domain Local group can contain user accounts, Global groups from any domain, and Universal groups from any domain, plus other Domain Local groups from its own domain only. Group3 is a Domain Local group in contoso.com, so it can accept Group1 (Universal, contoso.com), Group2 (Global, contoso.com), and Group4 and Group5 (both Global, canada.contoso.com), since Global groups from any domain are valid Domain Local members. It cannot accept Group6, because Group6 is Domain Local in canada.contoso.com, a different domain, and Domain Local groups may only nest other Domain Local groups from their own domain. That gives Group3: Group1, Group2, Group4, and Group5 only. A Global group, by contrast, can contain only user accounts and other Global groups from the same domain. Group5 is Global in canada.contoso.com, so among the remaining groups only Group4 qualifies, since it is also Global and in the same domain; Group1 (Universal), Group2 (Global but a different domain), and Group6 (Domain Local) are all excluded by scope rules. That gives Group5: Group4 only.

Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true

The requirement is to run virtual machines on VM1 itself, which means enabling nested virtualization so that VM1 (a guest VM hosted on Server2) can install Hyper-V and host its own virtual machines. Nested virtualization on Hyper-V requires the parent VM ' s virtual processor to expose the host ' s hardware virtualization extensions (Intel VT-x or AMD-V) through to the guest. This is done with the Set-VMProcessor cmdlet using the -ExposeVirtualizationExtensions parameter set to $true, run against VM1 from the Hyper-V host (Server2): Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true. VM1 must be turned off before this setting can be applied, and after it is applied, VM1 needs the Hyper-V role installed inside the guest before it can run its own VMs. Set-VM, Set-VMBios, Set-VMHost, and Set-VMFirmware do not control virtualization extension exposure: Set-VM manages general VM configuration such as memory and name, Set-VMHost configures host-wide settings, and Set-VMFirmware/Set-VMBios control boot and firmware settings for generation 2 and generation 1 VMs respectively. Only Set-VMProcessor with -ExposeVirtualizationExtensions satisfies the stated requirement, making it the correct first step.

The requirement is narrow: User1 must be able to manage the membership of all the groups located in Contoso\OU3, and nothing more. The Delegation of Control Wizard, run against OU3 specifically, lets an administrator grant User1 exactly the built-in task " Modify the membership of a group, " which grants write access to the member attribute on group objects contained in that OU only. This satisfies the requirement while granting no rights outside OU3, which is the definition of least privilege. Creating the same delegation at the domain root (contoso.com) would technically work but grants far broader scope than needed, since it would apply to every container in the domain, not just OU3, violating least privilege. Adding User1 to Account Operators grants domain-wide rights to create, delete, and modify most user, group, and computer accounts throughout the domain (with some protections for built-in admin accounts), which is excessive for a task limited to group membership in one OU. Server Operators is unrelated to Active Directory object management altogether; it governs local administrative rights on domain controllers themselves. Therefore, delegating control on OU3 is the correct, minimally scoped solution.

Installing and authorizing a DHCP server in an Active Directory-integrated environment requires two distinct sets of rights: local Administrators group membership on Server3 to install the DHCP Server role itself, and Enterprise Admins group membership to authorize that server in AD DS, because DHCP server authorization is stored as a forest-wide object under CN=NetServices,CN=Services,CN=Configuration and only Enterprise Admins can create or modify objects there by default. Admin1 is a member of Contoso\Enterprise Admins, which grants exactly this forest-wide right and also carries local administrative rights on every domain-joined computer in the forest, including Server3, so Admin1 can both install the role and authorize the server, fully satisfying the requirement on his own. Admin2, a member of only Contoso\Domain Admins, has full administrative rights over contoso.com and its member computers, but Domain Admins does not carry the right to authorize a DHCP server in the forest-wide NetServices container, so Admin2 cannot complete authorization even though he can install the role. Admin3, a member of Canada\Domain Admins, has administrative rights limited to the canada.contoso.com domain and likewise lacks the Enterprise Admins-only authorization right needed here, since Server3 and the DHCP authorization object both fall outside that domain ' s scope of control. Because only Admin1 holds both the local administrative rights needed to install the DHCP Server role on Server3 and the Enterprise Admins membership needed to authorize it in AD DS, Admin1 only is correct.