AZ-802 — Windows Server Hybrid Administrator
Microsoft

Windows Server Hybrid Administrator (AZ-802) Practice Questions

★★★★★ 5.0 146 verified reviews
125 questions
June 15, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Manage Windows Server in a Hybrid Environment
  • Implement Hybrid Networking and Storage
  • Manage Hybrid Identity and Access
  • Implement Security and High Availability

Sample Questions (13 of 125 shown)

Q1 Deploy and Manage Hybrid Active Directory Domain Services (20%)
Which Active Directory Domain Services role holds the schema master and domain naming master FSMO roles?
  1. Every domain controller in the forest
  2. One domain controller per forest
  3. One domain controller per domain
  4. The first read-only domain controller deployed
✓ Correct Answer: B
The schema master and domain naming master are forest-wide FSMO roles, so each role exists only once across the entire forest. The other three FSMO roles (RID master, PDC emulator, and infrastructure master) are domain-wide and exist once per domain.
Q2 Deploy and Manage Hybrid Active Directory Domain Services (20%)
You need to deploy a domain controller in a branch office with limited physical security and no local IT staff. Which option best reduces risk?
  1. Deploy a read-only domain controller (RODC)
  2. Deploy a standard writable domain controller with BitLocker disabled
  3. Promote a member server to a global catalog only
  4. Install Azure AD Connect on the branch server
✓ Correct Answer: A
An RODC stores a read-only copy of the directory and, by default, caches no account passwords, limiting exposure if the server is stolen. This makes RODCs ideal for branch offices with weak physical security and no on-site administrators.
Q3 Deploy and Manage Hybrid Active Directory Domain Services (20%)
Which tool synchronizes on-premises Active Directory identities to Microsoft Entra ID for a hybrid identity solution?
  1. Azure Arc agent
  2. Microsoft Entra Connect (Azure AD Connect)
  3. Windows Admin Center
  4. Azure Migrate appliance
✓ Correct Answer: B
Microsoft Entra Connect, formerly Azure AD Connect, synchronizes on-premises AD DS users and groups to Microsoft Entra ID, enabling hybrid identity with options such as password hash sync and pass-through authentication.
Q4 Deploy and Manage Hybrid Active Directory Domain Services (20%)
What is the primary purpose of an Active Directory site in AD DS?
  1. To define password complexity requirements
  2. To represent network topology and optimize replication and authentication traffic
  3. To store Group Policy templates
  4. To assign FSMO roles automatically
✓ Correct Answer: B
AD sites map to physical network locations defined by IP subnets, allowing AD to direct clients to the nearest domain controller and to control replication between well-connected and slow links.
Q5 Deploy and Manage Hybrid Active Directory Domain Services (20%)
Which Group Policy processing behavior applies when a user logs on, overriding conflicting computer settings?
  1. Loopback processing in replace mode
  2. Block inheritance
  3. Security filtering
  4. WMI filtering
✓ Correct Answer: A
Group Policy loopback processing in replace mode applies the user policies defined in the computer's OU instead of the user's normal user policies, which is common for kiosks and shared computers.
Q6 Deploy and Manage Hybrid Active Directory Domain Services (20%)
You must delegate the ability to reset passwords for users in a single organizational unit without granting broader admin rights. What is the best approach?
  1. Add the helpdesk group to Domain Admins
  2. Use the Delegation of Control Wizard on that OU
  3. Grant the helpdesk group Enterprise Admins
  4. Edit the Default Domain Policy
✓ Correct Answer: B
The Delegation of Control Wizard assigns specific permissions, such as resetting passwords, scoped to a particular OU. This follows least privilege by avoiding membership in powerful groups like Domain Admins.
Q7 Deploy and Manage Hybrid Active Directory Domain Services (20%)
Which command-line tool is used to perform an authoritative restore of an Active Directory object after deletion?
  1. dcdiag
  2. ntdsutil
  3. repadmin
  4. dsquery
✓ Correct Answer: B
ntdsutil includes the authoritative restore commands used in Directory Services Restore Mode to mark restored objects with a higher version number so they replicate out to other DCs.
Q8 Deploy and Manage Hybrid Active Directory Domain Services (20%)
What does the AD Recycle Bin feature provide when enabled?
  1. Automatic offsite backup of the NTDS.dit file
  2. Recovery of deleted objects with their attributes intact without a system state restore
  3. Encryption of all directory attributes at rest
  4. Replication compression across site links
✓ Correct Answer: B
The AD Recycle Bin preserves deleted objects in a recoverable state, retaining link-valued and non-link-valued attributes so they can be restored without rebooting into DSRM.
Q9 Deploy and Manage Hybrid Active Directory Domain Services (20%)
Which trust type would you create to allow users in a separate forest to access resources in your forest, with selective authentication?
  1. External trust
  2. Forest trust
  3. Shortcut trust
  4. Realm trust
✓ Correct Answer: B
A forest trust links two entire AD forests and supports selective authentication, letting administrators control which users can authenticate to specific resources.
Q10 Deploy and Manage Hybrid Active Directory Domain Services (20%)
Which functional level setting determines which Active Directory features are available forest-wide and is constrained by the oldest DC operating system in the forest?
  1. Domain functional level
  2. Forest functional level
  3. Site link cost
  4. Schema version
✓ Correct Answer: B
The forest functional level controls forest-wide AD features and cannot be raised higher than the lowest domain functional level, which in turn is limited by the oldest domain controller OS.
Q11 Deploy and Manage Hybrid Active Directory Domain Services (20%)
A company has enabled password hash sync to sync on-premises AD DS users to Microsoft Entra ID. They are migrating a legacy Windows Server application to Azure VMs. The application must continue using domain join, LDAP binds, Kerberos/NTLM, and Group Policy, but the company does not want to deploy or manage domain controllers in Azure. Which identity design is the best choice?
  1. Use staged rollout to migrate users to cloud authentication
  2. Register the application in Microsoft Entra ID for OAuth authentication
  3. Deploy Microsoft Entra Domain Services and join the VMs
  4. Join the Azure VMs directly to Microsoft Entra ID
✓ Correct Answer: C
When legacy workloads require AD DS-like protocols in Azure without managing domain controllers, Microsoft Entra Domain Services provides a managed domain supporting domain join, LDAP, Kerberos/NTLM, and Group Policy.
Q12 Deploy and Manage Hybrid Active Directory Domain Services (20%)
A company has a single AD DS forest with two domains. The forest and both domain functional levels are Windows Server 2012 R2, and some DCs still run Windows Server 2012 R2. The company syncs identities to Microsoft Entra ID and wants to add time-bound privileged group membership in the existing forest without migrating users to a new forest. Which design is best?
  1. Create a new forest and migrate users using ADMT
  2. Deploy Microsoft Entra Domain Services for privileged groups
  3. Replace legacy DCs, then raise domain and forest functional levels
  4. Extend the schema only and keep current functional levels
✓ Correct Answer: C
Newer AD DS features require newer DC OS and higher domain/forest functional levels. The solution is to upgrade or replace legacy DCs, demote old DCs, raise domain functional levels, then raise forest functional level.
Q13 Deploy and Manage Hybrid Active Directory Domain Services (20%)
After transferring all FSMO roles to DC01, you are demoting an additional domain controller DC03 in corp.contoso.com. The demotion wizard fails with: "Active Directory Domain Services could not replicate off changes made locally." repadmin /showrepl shows RPC server unavailable errors between DC03 and DC01. What is the best next diagnostic step?
  1. Seize the FSMO roles from DC03 to DC01
  2. Retry the demotion using an Enterprise Admin account
  3. Reconfigure DC03 to use a public DNS resolver
  4. Investigate RPC replication connectivity between DC03 and DC01
✓ Correct Answer: D
The repadmin output shows error 1722 (RPC server unavailable) between DC03 and its replication partner DC01. Before retrying demotion, investigate and resolve network, firewall, name resolution, or RPC endpoint access issues.

You've viewed 3 of 125 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

The AZ-802 exam marks a significant shift in Microsoft's Windows Server certification strategy — it consolidates the legacy two-exam requirement (AZ-800 + AZ-801) into a single, streamlined assessment for the Windows Server Hybrid Administrator Associate credential. Instead of splitting coverage across an on-premises administration exam and a hybrid integration exam, AZ-802 tests your ability to manage Windows Server workloads holistically across both local datacenters and Azure cloud environments. The exam covers four domains that span hybrid management, networking and storage, identity and access, and security and high availability — reflecting the reality that most Windows Server environments today operate in a hybrid state rather than purely on-premises or purely cloud.

There are no mandatory prerequisite exams to register for AZ-802, but Microsoft recommends several years of professional experience managing Windows Server operating systems with solid knowledge of Active Directory Domain Services (AD DS), DNS, DHCP, and core Azure services. If you already hold the Windows Server Hybrid Administrator certification through the legacy AZ-800 and AZ-801 path, your existing credential remains valid — you do not need to take AZ-802. The exam is designed for administrators who regularly move between on-premises Server Manager and the Azure Portal, deploying Azure Arc-connected servers, synchronizing identities with Entra Connect, and extending on-premises file shares to Azure Files via Azure File Sync. The official preparation path consists of modular Learning Paths on Microsoft Learn mapped to each domain.

Four domains shape the AZ-802 blueprint, with near-equal weight across three of them. Manage Windows Server in a Hybrid Environment (25–30%) covers deploying Windows Server IaaS VMs, implementing Azure Arc-enabled servers, and managing local servers through Windows Admin Center and Azure Update Manager. Implement Hybrid Networking and Storage (20–25%) focuses on Azure File Sync and Storage Migration Service for migrating file server data, VPN Gateway and ExpressRoute connectivity integrated with on-premises AD DS, and DNS resolution across hybrid topologies. Manage Hybrid Identity and Access (20–25%) tests Microsoft Entra Connect synchronization, AD DS security hardening, and hybrid identity authentication methods (Password Hash Sync, Pass-through Authentication, Federation). Implement Security and High Availability (20–25%) covers Azure Policy for hybrid server compliance, Azure Monitor Log Analytics for centralized logging, Azure Site Recovery for disaster recovery, and Azure Backup for Windows Server workload protection.

The practice questions here target the four hybrid domains with scenario-based items that reproduce the real exam's emphasis on cross-environment troubleshooting. Each question includes a detailed walkthrough of the hybrid configuration decisions — why Azure Arc onboarding requires a specific service principal role, how Azure File Sync cloud tiering policies affect on-premises storage utilization, which Entra Connect authentication method fits a given security compliance requirement, and when to choose Azure Site Recovery over Azure Backup for a specific workload recovery objective. The downloadable PDF packages the same question bank for offline study, so you can review Azure Arc deployment scripts, Entra Connect synchronization rule flows, and Azure Policy initiative definitions during commutes or in restricted environments. Because the Associate-level exam grants access to Microsoft Learn documentation during the test, our practice questions are designed to be attempted without documentation first, forcing you to internalize the hybrid management patterns before relying on the searchable reference.

Official Exam Domains & Weighting

To successfully pass the AZ-802 exam, candidates must master the following core domains:
  • Domain 1: Manage Windows Server in a Hybrid Environment — 25–30%
Covers deploying and configuring Windows Server IaaS VMs in Azure, implementing Azure Arc-enabled servers for centralized management, and managing on-premises and hybrid servers using Windows Admin Center. Includes Azure Update Manager for patch compliance, Azure Automation for configuration drift remediation, and Azure Policy for hybrid governance.
  • Domain 2: Implement Hybrid Networking and Storage — 20–25%
Focuses on Azure File Sync configuration including cloud tiering policies and multi-server sync groups, Storage Migration Service for migrating file server data to Azure, and hybrid networking connectivity via VPN Gateway and ExpressRoute. Includes DNS resolution across hybrid topologies and integrating on-premises AD DS with Azure networking.
  • Domain 3: Manage Hybrid Identity and Access — 20–25%
Tests Microsoft Entra Connect synchronization configuration (Password Hash Sync, Pass-through Authentication, Federation), AD DS security hardening in hybrid environments, and hybrid identity authentication method selection. Includes managing group Managed Service Accounts (gMSAs), implementing Just Enough Administration (JEA), and securing hybrid domain joins.
  • Domain 4: Implement Security and High Availability — 20–25%
Covers Azure Policy assignment for hybrid server compliance evaluation and remediation, Azure Monitor Log Analytics workspace deployment and KQL query authoring, Azure Site Recovery replication for Windows Server VMs and physical servers, and Azure Backup for file, system state, and VM backup policies. Includes Defender for Identity and Defender for Servers integration for threat detection.

What Our Customers Say 146 verified reviews

5.0 ★★★★★ Based on 146 reviews
★★★★★★
Excellent value for AZ-802 prep. The lifetime access means I can always come back to review concepts when needed.
— Samantha L.
★★★★★★
Good bang for your buck on the AZ-802 practice exam. Unlimited attempts means you can really drill the material.
— Zoey L.
★★★★★★
Solid prep material for AZ-802. The questions feel like they were written by someone who actually teaches this stuff.
— Brooklyn T.
★★★★★★
Great Microsoft exam preparation tool. The AZ-802 questions are current and the interface is clean and easy to use.
— Chris D.
★★★★★★
Covered all five domains of the AZ-802 exam thoroughly. I especially appreciated the detailed breakdowns for the tricky questions.
— Natalie R.
★★★★★
Passed the AZ-802 exam today! The scenario-based questions here were extremely similar to what I saw on the test.
— Riley B.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

No. If you are already certified through the legacy AZ-800 and AZ-801 path, you do not need to take the new exam. Your existing certification remains valid, and you should continue to manage your credential through the standard annual renewal process on Microsoft Learn. AZ-802 is designed for new candidates entering the Windows Server Hybrid Administrator track.

Candidates often struggle with the hybrid configuration settings — specifically, ensuring the correct synchronization between on-premises Group Policy Objects (GPOs) and Active Directory versus Azure Policy and Microsoft Entra ID. Deep familiarity with Azure Arc integration and Windows Admin Center is essential, as these represent the modern standard for hybrid management tested in the new blueprint. Another common pitfall is Azure File Sync cloud tiering policy configuration, where incorrect temperature policy settings can cause unexpected storage costs or performance degradation. Our practice questions reproduce these exact failure scenarios with step-by-step hybrid troubleshooting walkthroughs.

If you do not pass, you must wait 24 hours for your first retake. For any subsequent attempts (up to a maximum of five per rolling 12-month period), a 14-day waiting period is enforced between each attempt. Each retake requires the standard $165 USD exam fee unless protected by an Exam Replay voucher bundle.

Like all Microsoft Associate-level certifications, the Windows Server Hybrid Administrator credential is valid for 12 months from the date of issue. Within the final 6 months, you can renew for free by passing an unproctored, open-book renewal assessment on Microsoft Learn that covers technical updates from the preceding year. If you already hold the credential via the legacy AZ-800/801 path, the same renewal process applies — you renew once per year regardless of which exam path you used.

The mock exam includes full-length scenario questions where you must troubleshoot Azure Arc server onboarding failures (missing service principal permissions, incorrect Azure Connected Machine agent version), configure Azure File Sync cloud tiering policies for optimal cost-performance balance, select the correct Microsoft Entra Connect authentication method based on security and compliance requirements (Password Hash Sync vs. Pass-through Authentication vs. Federation), design Azure Site Recovery replication policies with appropriate RTO/RPO targets for Windows Server workloads, and author KQL queries in Log Analytics for hybrid server compliance reporting. Every practice question includes a detailed walkthrough of the hybrid configuration decisions and Azure CLI/PowerShell remediation steps.

Yes, our complete AZ-802 practice test is available as a downloadable PDF package that includes all scenario-based questions, hybrid configuration case studies, and detailed answer explanations. The PDF covers every domain: Manage Windows Server in a Hybrid Environment (Azure Arc-enabled servers, Windows Admin Center, Azure Update Manager, Azure Automation), Implement Hybrid Networking and Storage (Azure File Sync cloud tiering, Storage Migration Service, VPN Gateway, ExpressRoute, hybrid DNS), Manage Hybrid Identity and Access (Microsoft Entra Connect sync rules, AD DS security hardening, hybrid domain join, JEA and gMSAs), and Implement Security and High Availability (Azure Policy hybrid compliance, Log Analytics KQL queries, Azure Site Recovery replication, Azure Backup policies, Defender for Identity). Download the PDF for offline review during commutes or in restricted network environments.

The legacy path required two separate exams: AZ-800 (Administering Windows Server Hybrid Core Infrastructure) focused on on-premises and hybrid infrastructure like AD DS, DNS, DHCP, and file services, while AZ-801 (Configuring Windows Server Hybrid Advanced Services) focused on advanced topics like security, high availability, disaster recovery, and migration. AZ-802 consolidates all of this content into a single exam with one passing score requirement, reducing total testing time and cost. The consolidated blueprint places greater emphasis on Azure Arc, Windows Admin Center, and Azure File Sync than the legacy exams did, reflecting Microsoft's strategic direction for hybrid server management. The exam fee remains $165 USD — half the combined cost of the two-exam path.