CertArea
All Microsoft exams

Free AZ-802 practice test: 30 questions with answers

30 original questions for Administering Windows Server, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

AZ-802 exam guide: topics, cost and format

All 30 AZ-802 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Monitor and troubleshoot Windows Server environments (3 questions)

  1. Question 1

    Which two Azure services help monitor and govern hybrid Windows Server machines? (Choose two.)

    1. AAzure Monitor with data collection rules for logs and performance
    2. BAzure Arc for governance, policy and configuration of non-Azure servers
    3. CAzure Front Door for DNS record management
    4. DAzure Load Balancer as a log archive
    5. EAzure Cosmos DB as an event log store
    Show answer and explanation
    Correct answer: A, B

    Azure Monitor collects logs and metrics from hybrid machines, and Azure Arc applies governance and configuration. Front Door, Load Balancer and Cosmos DB do not monitor or govern servers.

  2. Question 2

    An administrator wants alerts when CPU usage stays above 90 percent on a set of servers. Which Windows Server tool can create this monitoring with data collector sets?

    1. AWindows Explorer search bar with file name and content filters
    2. BPerformance Monitor with data collector sets and alerts
    3. CNotepad with a timer that logs elapsed minutes daily
    4. DPaint with a color scheme brush palette for editing wallpaper
    Show answer and explanation
    Correct answer: B

    Performance Monitor data collector sets collect counters, and alerts can notify when thresholds are exceeded. Notepad, Paint and Explorer do not collect performance counters.

  3. Question 3

    A security team needs to review logon events for a specific server over the last day. Which tool should be used?

    1. AEvent Viewer, filtering the Security log for logon events
    2. BDisk Defragmenter optimization schedule for the system volumes
    3. CSnipping Tool capture mode for selecting a window or screen region
    4. DPrinters and Scanners control panel for default print queue settings
    Show answer and explanation
    Correct answer: A

    The Security log in Event Viewer records logon events, which can be filtered by time and event ID. Defragmenter, Snipping Tool and printer settings do not record logons.

Secure Windows Server infrastructure (3 questions)

  1. Question 4

    A server must prevent exploited memory-corruption attacks from running injected code, using built-in protections that can be configured by policy. Which feature should be enabled?

    1. ADisk Cleanup scheduled tasks that clear old temporary files
    2. BPrint Spooler service set to start automatically at boot
    3. CA larger page file configured on the system volume at a fixed size
    4. DExploit protection settings applied by Group Policy or PowerShell
    Show answer and explanation
    Correct answer: D

    Exploit protection mitigates memory-corruption techniques and can be configured centrally. Disk cleanup, print spooler startup and page file size do not block exploitation.

  2. Question 5

    Credential theft from LSASS must be mitigated on a Windows Server host where administrators log on. Which feature isolates credentials in a virtualization-based secure environment?

    1. AWindows Search indexing
    2. BOffline Files
    3. CCredential Guard
    4. DRemote Desktop Services licensing
    Show answer and explanation
    Correct answer: C

    Credential Guard isolates secrets using virtualization-based security so that credential theft from LSASS is much harder. Licensing, search indexing and offline files do not protect credentials.

  3. Question 6

    Local administrator passwords on hundreds of servers must be unique and rotated automatically. Which Microsoft solution handles this?

    1. ADisabling local administrator accounts without any other changes
    2. BWindows Local Administrator Password Solution (Windows LAPS)
    3. CA single shared local administrator password
    4. DStoring passwords in a text file on the desktop
    Show answer and explanation
    Correct answer: B

    Windows LAPS generates unique local administrator passwords per machine, rotates them, and stores them securely in AD or Entra ID. Shared or text-stored passwords and disabling accounts without a plan do not meet the requirement.

Manage storage and file services (3 questions)

  1. Question 7

    Azure File Sync must keep an on-premises file server's data in sync with an Azure file share while keeping frequently used files local. Which feature provides this?

    1. AA DHCP scope option
    2. BRemote Desktop Services licensing
    3. CStorage Spaces parity only
    4. DCloud tiering in Azure File Sync
    Show answer and explanation
    Correct answer: D

    Cloud tiering keeps frequently used files local and stores less-used content in Azure, which saves on-premises space. DHCP options, parity spaces and RDS licensing do not synchronize or tier files.

  2. Question 8

    A storage administrator needs to create a mirrored storage pool that tolerates a disk failure for a file server. Which feature should be used?

    1. AA single disk formatted as FAT32
    2. BA disk with no redundancy and a daily copy to a USB drive only
    3. CCompression on the volume
    4. DStorage Spaces with a mirror resiliency setting
    Show answer and explanation
    Correct answer: D

    Storage Spaces with mirror resiliency keeps copies of data on multiple disks, which tolerates a disk failure. A single disk, a USB copy alone and compression do not provide disk-failure resiliency.

  3. Question 9

    A volume stores many duplicate files from user backups and the administrator wants to reduce the space they use without changing file behavior. Which feature should be enabled?

    1. AStorage Replica for the volume
    2. BOffline files without any dedup
    3. CBitLocker To Go
    4. DData Deduplication
    Show answer and explanation
    Correct answer: D

    Data Deduplication removes duplicate chunks of data on the volume and keeps files accessible transparently. BitLocker encrypts data, Storage Replica copies data, and offline files do not reduce duplicates.

Manage Windows Server instances and workloads in a hybrid environment (3 questions)

  1. Question 10

    An administrator must manage on-premises servers from a browser-based tool that can also connect to Azure resources. Which tool should be used?

    1. AWindows Admin Center
    2. BPrint Management
    3. CNotepad with a list of server names
    4. DThe Windows Calculator
    Show answer and explanation
    Correct answer: A

    Windows Admin Center provides browser-based management of Windows Server and integrates with Azure services. Notepad, Calculator and Print Management do not provide that management surface.

  2. Question 11

    Servers in a data center must be onboarded to Azure Arc so that policies and updates can be managed from Azure. What must be installed on each server?

    1. AThe Hyper-V hypervisor role
    2. BThe SMB1 protocol on port 445
    3. CThe DHCP scope with reservations
    4. DThe Azure Connected Machine agent
    Show answer and explanation
    Correct answer: D

    The Azure Connected Machine agent registers non-Azure servers with Azure Arc, which enables management from Azure. Hyper-V, DHCP scopes and SMB1 do not onboard servers to Arc.

  3. Question 12

    An administrator needs to run a PowerShell command on a remote server that then connects to a second server, and the command fails with an authentication error. Which concept explains the failure?

    1. AA stale DNS resolver cache error on the local computer after a name change
    2. BA missing printer driver on the print server after a Windows update
    3. CAn expired antivirus signature database on the Windows Defender endpoint
    4. DThe double-hop problem when credentials are not delegated to the second server
    Show answer and explanation
    Correct answer: D

    Credentials from the first hop do not pass to the second hop by default, which causes the double-hop failure. Delegation or alternative authentication methods address it. DNS cache, printer drivers and antivirus signatures do not cause this error.

Manage VMs (3 questions)

  1. Question 13

    A Hyper-V host has two network adapters that must provide redundancy for a virtual switch. Which Windows Server feature should be configured on the host?

    1. ANIC teaming with an appropriate teaming mode
    2. BNested virtualization for the guest VMs
    3. CEnhanced Session Mode for remote desktop
    4. DDynamic memory on each VM with startup RAM
    Show answer and explanation
    Correct answer: A

    NIC teaming combines adapters for redundancy and throughput, and it can support a virtual switch. Enhanced session mode, nested virtualization and dynamic memory do not provide adapter redundancy.

  2. Question 14

    A Hyper-V VM must remain available if a host fails. Which feature provides high availability across a failover cluster?

    1. AFailover clustering with a clustered VM role
    2. BA DHCP scope with a longer lease on the default subnet
    3. CA single checkpoint on the VM before planned updates
    4. DAn unmanaged external virtual switch on the host adapter
    Show answer and explanation
    Correct answer: A

    A clustered VM role fails over to another node when the host fails, which provides high availability. Checkpoints are not high availability, unmanaged switches are not clustering, and DHCP leases are unrelated.

  3. Question 15

    A copy of a critical VM must be kept in another location and updated regularly for recovery. Which Hyper-V feature provides asynchronous replication to a replica server?

    1. ADevice assignment
    2. BHyper-V Replica
    3. CEnhanced Session Mode
    4. DPowerShell Direct
    Show answer and explanation
    Correct answer: B

    Hyper-V Replica replicates VM changes asynchronously to a replica host for disaster recovery. Enhanced session mode is a client feature, PowerShell Direct manages VMs locally, and device assignment passes hardware to a VM.

Deploy and manage AD DS (3 questions)

  1. Question 16

    A branch office has unreliable WAN links and needs local authentication with limited exposure of credentials. Which domain controller type should be deployed?

    1. AA writable domain controller at the branch with default credential caching enabled and no password replication policy
    2. BA domain controller in a different forest with no trust relationship and no replication link to the local site
    3. CRead-only domain controller (RODC) with a password replication policy limited to branch accounts
    4. DA member server with a local Security Accounts Manager user database and no domain authentication role assigned
    Show answer and explanation
    Correct answer: C

    An RODC holds a read-only copy of AD DS and a password replication policy limits which credentials it caches, which reduces exposure at the branch. A writable DC caches everything by default and a member server does not authenticate domain users.

  2. Question 17

    An administrator must find which domain controller holds the schema master role and transfer it during maintenance. Which tool should be used?

    1. AEvent Viewer on the file server to review System logs for errors
    2. BWindows Server Backup to schedule nightly system state backups
    3. CDNS Manager to edit host records and configure conditional forwarders
    4. DActive Directory Domains and Trusts or PowerShell with the FSMO role commands
    Show answer and explanation
    Correct answer: D

    FSMO roles such as schema master are viewed and transferred with AD management tools or PowerShell cmdlets. Event Viewer, DNS Manager and Windows Server Backup do not manage FSMO roles.

  3. Question 18

    Two replication partners in different sites take a long time to replicate changes. Which configuration controls how often replication occurs between sites?

    1. AThe site link replication interval and schedule in AD Sites and Services
    2. BThe DHCP lease duration assigned to clients on each scope
    3. CThe desktop wallpaper policy applied through a Group Policy Object to user accounts
    4. DThe Windows Update active hours setting that limits restart times
    Show answer and explanation
    Correct answer: A

    Site links carry replication interval and schedule settings between sites, which control how often changes replicate. Wallpapers, DHCP leases and update hours do not control AD replication.

Troubleshoot Active Directory (3 questions)

  1. Question 19

    Replication between two domain controllers is failing and an administrator needs a summary of replication status. Which command should be used?

    1. Anetsh wlan show profiles
    2. Bgpupdate /force on a client
    3. Crepadmin /replsummary
    4. Dipconfig /flushdns
    Show answer and explanation
    Correct answer: C

    repadmin /replsummary summarizes replication health across domain controllers, which helps identify failing partners. Flushing DNS, wireless profiles and client policy updates do not report replication status.

  2. Question 20

    A domain controller's SYSVOL share is not replicating, and the Group Policy files are out of date on other controllers. Which area should be investigated first?

    1. AThe SYSVOL replication mechanism and its health on the domain controllers
    2. BThe DHCP lease duration assigned on the scope serving a remote branch office site
    3. CThe printer driver package list stored on the clustered file server hosting print queues
    4. DThe desktop wallpaper policy settings configured for the domain-wide Group Policy Objects
    Show answer and explanation
    Correct answer: A

    SYSVOL replication copies policy files between domain controllers, so its health explains outdated Group Policy files. Printer drivers, wallpapers and DHCP lease times do not replicate SYSVOL.

  3. Question 21

    A domain controller needs its directory database restored after corruption, and the administrator must boot into a mode that allows an authoritative restore. Which mode should be used?

    1. ADirectory Services Restore Mode
    2. BSafe Mode with Networking for a client PC
    3. CWindows Recovery Environment for a laptop only
    4. DKiosk mode
    Show answer and explanation
    Correct answer: A

    Directory Services Restore Mode is used to restore and repair the AD DS database on a domain controller. Client safe mode, recovery for laptops and kiosk mode do not restore directory databases.

Implement and manage an on-premises and hybrid networking infrastructure (3 questions)

  1. Question 22

    Which two statements about DHCP high availability are accurate? (Choose two.)

    1. ADHCP failover removes the need for reservations in all cases
    2. BDHCP can run only on Windows client computers
    3. CDHCP failover can split a scope's address pool between two servers
    4. DHot standby mode keeps a standby server ready to take over the scope
    5. EDHCP requires a database entry on every client computer
    Show answer and explanation
    Correct answer: C, D

    DHCP failover can divide a pool between partners, and hot standby keeps a backup ready to serve clients. DHCP does not need client database entries, reservations still have uses, and DHCP runs on server operating systems.

  2. Question 23

    Clients in a hybrid network must resolve names for an Azure-hosted domain that is not publicly delegated. Which DNS configuration should be used on the on-premises DNS servers?

    1. ARemoving the configured forwarders and relying on hosts files copied to each client
    2. BConfiguring each on-premises DNS server as an authoritative root for the internal namespace.
    3. CA conditional forwarder for the Azure domain pointing to the Azure DNS resolver or private DNS endpoint
    4. DDisabling the DNS Server service on each domain controller and stopping its zone replication
    Show answer and explanation
    Correct answer: C

    A conditional forwarder sends queries for the Azure zone to the resolver that can answer them, which enables hybrid name resolution. Hosts files do not scale, root configuration is unnecessary, and disabling DNS breaks AD.

  3. Question 24

    An administrator wants DNS records to be automatically removed when they become stale. Which feature should be configured on the zone?

    1. ADNS scavenging with appropriate aging and refresh intervals
    2. BA DNS forwarder to a public recursive resolver for external names
    3. CDHCP reservations binding each host's MAC address to an IPv4 address
    4. DIncreasing the TTL value on every cached record to 86400 seconds
    Show answer and explanation
    Correct answer: A

    Scavenging removes stale dynamic records based on aging settings. Reservations assign addresses, forwarders forward queries, and TTL affects caching rather than removal.

Configure and manage Windows Server file shares (3 questions)

  1. Question 25

    A file share must allow remote users to access files over an encrypted connection without a VPN, using the latest transport. Which feature should be configured?

    1. AUnencrypted SMB over TCP port 445 from the internet
    2. BFTP with anonymous access
    3. CSMB over QUIC on the file server
    4. DPrinting files through a shared printer
    Show answer and explanation
    Correct answer: C

    SMB over QUIC tunnels SMB inside an encrypted QUIC connection, which allows remote access without a VPN. Open SMB on the internet and anonymous FTP expose data, and printing does not provide file access.

  2. Question 26

    Users in a company should see only the files in a folder that they have permission to access, not the names of folders they cannot open. Which setting should be enabled?

    1. AShadow copies of the volume, scheduled daily
    2. BAccess-based enumeration on the share
    3. CDisk quotas on the root folder of each drive
    4. DCompression enabled on the folder and its files
    Show answer and explanation
    Correct answer: B

    Access-based enumeration hides files and folders from users who lack access. Shadow copies, quotas and compression do not control what users can see in a listing.

  3. Question 27

    A file server must limit the size of user home folders and generate reports when users approach the limit. Which tool should be configured?

    1. AHyper-V replica set for the file server
    2. BEvent Viewer custom views filtered by log
    3. CFile Server Resource Manager quota management
    4. DWindows Defender Firewall inbound rules
    Show answer and explanation
    Correct answer: C

    File Server Resource Manager provides quota management with thresholds and notifications. Firewall rules, replicas and event views do not manage folder quotas.

Troubleshoot Windows Server issues (3 questions)

  1. Question 28

    A server with an encrypted volume will not unlock after a hardware change. What does the administrator need to unlock the volume?

    1. AThe administrator's personal favorite password for the local user account
    2. BThe BitLocker recovery key that was backed up for the volume
    3. CThe server's wallpaper image file in the Windows folder
    4. DThe printer's serial number printed on the hardware label of the device
    Show answer and explanation
    Correct answer: B

    The BitLocker recovery key unlocks a volume when the normal unlock method fails, such as after hardware changes. Personal passwords, wallpapers and printer serial numbers do not unlock BitLocker volumes.

  2. Question 29

    Storage Spaces Direct reports a degraded virtual disk after a drive failure. What should the administrator do first?

    1. ATurning off every server in the cluster before inspecting the failed drive
    2. BReplacing the failed physical disk and allowing the storage pool to repair the virtual disk
    3. CDeleting the virtual disk immediately without first checking storage pool health
    4. DFormatting every physical disk in the pool to reset the storage layout
    Show answer and explanation
    Correct answer: B

    Replacing the failed drive lets the pool repair data redundancy, which restores resiliency. Deleting the virtual disk, shutting down the cluster and formatting every disk cause data loss.

  3. Question 30

    Azure Arc extension installation fails on a hybrid server. Which first step is most effective?

    1. ADeleting every SMB file share hosted on the server without reviewing its contents or NTFS permissions
    2. BChanging the server's desktop wallpaper through the Personalization settings across the cluster
    3. CRestarting the Print Spooler service on the server while the extension is installing as a quick fix
    4. DReviewing the extension status and the agent logs on the server for the error code
    Show answer and explanation
    Correct answer: D

    Extension status and agent logs usually show the cause, such as connectivity or permissions. Printer spooler restarts, deleting shares and wallpaper changes do not address extension installation.