AZ-802 — frequently asked questions

DHCP server authorization creates an object in the forest's Configuration naming context, which requires Enterprise Admin privileges. Domain Admins only have permissions within their own domain, not at the forest level.

Installing the DHCP role requires local administrator rights on the server. Authorizing it in AD DS prevents rogue DHCP servers by requiring Enterprise Admin privileges in a multi-domain forest.

The server must run a supported version of Windows Server, have TCP/IP configured, and be able to resolve DNS records for the domain.

Yes, but it is recommended to make it a Global Catalog for better login performance and authentication across domains in the forest.

A Global Catalog holds a partial replica of every domain's objects, so its Infrastructure Master sees phantom objects as 'real' and stops refreshing them. Keep the role on a non-GC DC unless every DC in the forest is a GC.

The failures are reported in contoso.com, and each Infrastructure Master updates only the phantom references stored in its own domain. Branch's role cannot repair contoso.com's stale references, so contoso.com's role must move instead.

Microsoft scoping rules can technically allow it in some cases, but distribution groups should not be added to security groups from an administration perspective, so only the global and universal security groups Group1 and Group2 qualify.

A global group can contain only global groups, and only groups from the same domain. Since Group4 is a global group in canada.contoso.com, it is the only valid member for Group5.

No. An Enforced GPO link always applies to all objects below it, regardless of any Block Inheritance settings on child OUs.

You must either remove the GPO link from the domain or clear the 'Enforced' setting on that link, then use Block Inheritance on the target OU.

No. Group Policy Preferences do not validate network configurations. If the filter matches, the static IP address is written to the registry regardless of whether it conflicts with the subnet mask or gateway.

Item-Level Targeting allows you to apply specific preference items only to certain users, computers, or groups. If a user is not a member of the targeted group, that specific preference item is skipped, even if the GPO itself is applied.

No, you cannot transfer roles from a failed server. You must use the Ntdsutil tool to 'seize' the roles on a healthy domain controller.

You cannot modify the Active Directory schema, such as installing Exchange or upgrading OS versions that require schema extensions.

No. Lowering the cost influences the Intersite Topology Generator to choose a cheaper path for replication, but it does not change how often domain controllers poll for changes. To reduce delay, you must reduce the ReplicationFrequencyInMinutes.

Use Set-ADReplicationSiteLink with the -ReplicationFrequencyInMinutes parameter. For example: Set-ADReplicationSiteLink 'Default-IPSITELINK' -ReplicationFrequencyInMinutes 15.

GPMC manages Group Policy Objects. While default domain password policies are in GPOs, Fine-Grained Password Policies are AD objects managed via AD Administrative Center, which requires RSAT-AD-Tools.

It includes the Active Directory Administrative Center, AD DS Snap-ins, and PowerShell modules needed to manage AD DS resources from a member server.

Standard forwarders apply to all external queries. Using them would bypass your existing internet forwarders for all domains, not just fabrikam.com, breaking the requirement to keep existing forwarders for other namespaces.

If you use an Active Directory-integrated conditional forwarder, the configuration is stored in AD DS. When you promote a new server to a domain controller and install the DNS role, it will receive the replicated forwarder configuration automatically.

DHCP uses broadcasts that do not cross routers. A relay agent is required on each client VLAN's gateway to convert broadcasts into unicast packets sent to the remote DHCP server.

No. Each VLAN has a distinct subnet. A DHCP scope must match the subnet of the clients it serves to ensure correct IP assignment and default gateway configuration.

Kerberos requires a trusted Active Directory domain and DNS-based name resolution. Since AdminPC is in a workgroup and connects via IP, Kerberos cannot validate the service principal name.

It appends the new value to the existing list of trusted hosts instead of replacing it, ensuring previously configured IPs remain valid.

Remote Desktop provides a full desktop session. The question specifies managing the OS via the Azure portal, which uses the lightweight Windows Admin Center web interface, not a full RDP session.

No. Since the connection originates from the Azure portal (cloud-based), VM2 only needs internet access to load the portal. The management traffic goes from the portal to VM1's extension, bypassing direct VM-to-VM network requirements.

By default, Domain Controllers restrict remote management to members of the local Administrators group. Being in the 'Remote Management Users' group is insufficient for accessing DCs.

No. Members of the Domain Administrators group are automatically granted local administrative privileges on any domain-joined computer upon authentication.

Managed storage accounts hide the underlying storage keys and endpoints. The Serial Console service requires direct access to these credentials to stream the interactive session, which is only possible with a custom storage account where you control the keys.

First, ensure Boot Diagnostics uses a custom storage account. Then, open the Serial console in the portal, launch cmd.exe, and authenticate to channel 1. Only after this can you run PowerShell commands.

The minimum required version is 10.0, which was introduced in Windows Server 2022. Earlier versions like 9.0 or 8.0 do not support guest OS hibernation.

You can upgrade the VM configuration version using PowerShell (Update-VMVersion), but you must ensure the host runs Windows Server 2022 or later to enable hibernation features.

No. Data Deduplication is only supported on volumes formatted with NTFS or ReFS. Simple file systems like exFAT do not support the necessary metadata structures.

The OS boot volume contains critical system files and the paging file. Enabling deduplication here could impact performance and stability, so Microsoft prohibits it.

Kerberos is preferred for domain-joined servers because it integrates natively with Active Directory, allowing seamless mutual authentication without distributing and managing digital certificates.

If 'Allow security' is chosen, the connection will proceed even if IPsec negotiation fails, potentially leaving traffic unencrypted and unauthenticated, which violates security requirements.

Adding a path rule to the base policy violates the explicit constraint to prevent changing base policy allow rules. It would also enable the app on all 40 servers, not just the pilots.

Supplemental allow lists allow you to add exceptions without rebuilding and redistributing the entire base policy file. You can update just the supplemental list and reapply it via GPO.

This counter aggregates the CPU time of all active processes into a single value. It prevents you from seeing which individual process is consuming resources, defeating the purpose of identifying the root cause.

Processor Information counters measure the state of the physical CPU cores (system-wide). Process counters measure the resource usage of specific applications running within the operating system.

No, the primary purpose of this tool in this context is to reset the RDS configuration and firewall rules. It can also change passwords, but that is not its function for enabling RDP.

Boot Diagnostics requires an Azure Storage account to persist logs. You must explicitly select a storage account in the Boot Diagnostics settings pane.

No. The Map view visualizes high-level health and network connections across VMs. It does not provide process-level breakdowns for disk I/O.

It relies on the Log Analytics agent installed on the VMs, which collects performance counter data and process information from the guest OS.

Snapshots are what Previous Versions displays, but taking them by hand means someone must create and delete them on a schedule. An Azure Files backup policy in a Recovery Services vault does that automatically, minimizing administrative effort.

No. Soft delete only preserves a share or file that was deleted for a retention period so it can be undeleted; it provides no timeline of earlier file versions for users to browse and restore.

No. Storage-account point-in-time restore applies to Azure Blob data, not to file shares, so it cannot deliver previous-version view and restore for share1.

Access-Based Enumeration lists a file only when the user's NTFS rights include Read. User3's NTFS entry is Write only, so Share1 omits File1.txt from the browse list even though writing would be permitted if the path were known.

On the network path the effective right is the intersection of both layers, so it never exceeds the more restrictive of the share permission and the NTFS entry on File1.txt. Either layer alone can deny access.

Without ABE the file would be listed, but User3 would still be denied Read and could only write. ABE affects visibility only; the effective NTFS and share permissions decide what actions actually succeed.