AZ-802 Practice Questions

To deploy the Azure Monitor agent (AMA) to non-Azure environments such as on-premises servers, the host machines must first be registered as Azure Arc-enabled servers. When deploying at scale across 100 on-premises Windows servers, non-interactive authentication is required during the deployment script execution. This requires providing the client ID and client secret of an Azure Active Directory (Microsoft Entra ID) service principal created specifically for Azure Arc onboarding. The service principal authenticates the automated installation and registers each server with Azure Arc. Once registered to Azure Arc, the Azure Monitor agent extension can be deployed and managed centrally from the Azure portal.

B. Storage account credentials are used for storage access and do not authenticate Azure Arc onboarding or agent installation on hybrid machines.

C. Azure SQL Database connection strings provide database access and play no role in server onboarding or monitoring agent deployment.

D. Workspace ID and workspace keys were required for the legacy Log Analytics agent (MMA), whereas Azure Monitor agent relies on Azure Arc identity.

- Microsoft Learn: "Azure Monitor Agent overview - Prerequisites for hybrid environments", Section: "Non-Azure machines", Doc ID: azure-monitor-agent-overview.

- Microsoft Learn: "Connect hybrid machines to Azure at scale using a service principal", Section: "Create a Service Principal for onboarding at scale", Doc ID: connect-at-scale-service-principal.

To block users from uploading specific file types, such as video files with the .mov extension, to shared folders on Windows Server, you should create a file screen. File screens are a core feature of the File Server Resource Manager (FSRM) role service. By configuring an active file screen, you can explicitly prevent users from saving unauthorized file types to designated volumes or directory trees. You can define a file group that includes the .mov extension and apply it to the shared folders. This approach minimizes administrative effort because it natively targets file extensions at the file system level without requiring complex identity-based rules or external compliance engines.

A. Dynamic Access Control (DAC) is used for permission management based on user claims and file classifications, not for blocking specific file extensions.

C. Central access rules are components of DAC used for authorization, which cannot natively block file uploads based solely on extensions.

D. Data loss prevention (DLP) is typically used in Microsoft 365 to prevent the sharing of sensitive information, not for basic file extension blocking on local file servers.

1. Microsoft Learn. "File Screening Management." Windows Server Storage Documentation. Section: Create a File Screen.

2. Microsoft Learn. "File Server Resource Manager (FSRM) overview." Section: Features.

The netdom query fsmo command is a built-in Windows Server command-line utility specifically designed to locate and display the domain controllers holding the Flexible Single Master Operations (FSMO) roles within an Active Directory domain or forest. When executed from an elevated command prompt, it queries the directory and outputs the names of the servers currently holding the Schema Master, Domain Naming Master, PDC Emulator, RID Pool Manager, and Infrastructure Master roles. Because the PDC emulator is explicitly listed in the output of this command, running it directly satisfies the goal of identifying which server holds the PDC emulator role for the contoso.com domain.

[B] No is incorrect because the provided command accurately and effectively retrieves the FSMO role holders, including the PDC emulator, fulfilling the stated requirement.

Microsoft Learn: "Netdom query" - Windows Server command reference. Section: Syntax and Parameters (fsmo).

Microsoft Learn: "Active Directory FSMO roles in Windows" (Article ID: 223346). Section: Determine FSMO role holders.

To ensure that domain member servers perform DNSSEC validation for a specific namespace (in this case, fabrikam.com), you must configure the Name Resolution Policy Table (NRPT). The NRPT is managed centrally via Group Policy Objects (GPOs) and allows administrators to define specific rules for DNS domains. By adding an NRPT rule for fabrikam.com, you instruct the DNS clients on the member servers to require DNSSEC validation for any queries directed at that domain. Distributing this configuration via a GPO ensures that all member servers consistently enforce the validation requirement without needing manual configuration on each individual machine.

A: Adding a trust anchor on Server1 only configures the DNS server to validate DNSSEC, but it does not force the member servers (clients) to request validation.

B: Trust anchors are configured on DNS servers to validate responses, not on standard member servers acting as DNS clients. Clients rely on the NRPT for validation rules.

D: Network List Manager policies are used to identify networks and configure network-specific settings like firewall profiles, not to enforce DNSSEC validation rules for clients.

- Microsoft Learn, "The Name Resolution Policy Table (NRPT)", Windows Server DNS documentation. https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn593632(v=ws.11)

- Microsoft Learn, "Deploy DNSSEC with Windows Server", Windows Server documentation. https://learn.microsoft.com/en-us/windows-server/networking/dns/deploy/deploy-dnssec-with-windows-server

To create a Storage Spaces volume optimized for read performance using mixed HDD and SSD disks:

Create a storage pool using all eight disks (4 HDDs + 4 SSDs) - Combine all physical disks into a

1.

single storage pool in Storage Spaces.

Create a virtual disk with tiered storage (SSD tier for frequently accessed data) - Configure a

2.

tiered virtual disk that automatically moves frequently accessed data to the SSD tier for faster read

performance.

Format the volume and assign a drive letter - Complete the volume creation by formatting it with NTFS

3.

and assigning a drive letter for use.