Windows Server Hybrid Administrator (AZ-802) practice questions

Domain coverage 4 domains

• Manage Windows Server in a Hybrid Environment
• Implement Hybrid Networking and Storage
• Manage Hybrid Identity and Access
• Implement Security and High Availability

Sample questions 13 of 125 shown

1. Q1 Deploy and Manage Hybrid Active Directory Domain Services (20%)

   Which Active Directory Domain Services role holds the schema master and domain naming master FSMO roles?

   1. Every domain controller in the forest
   2. One domain controller per forest
   3. One domain controller per domain
   4. The first read-only domain controller deployed

   The schema master and domain naming master are forest-wide FSMO roles, so each role exists only once across the entire forest. The other three FSMO roles (RID master, PDC emulator, and infrastructure master) are domain-wide and exist once per domain.
2. Q2 Deploy and Manage Hybrid Active Directory Domain Services (20%)

   You need to deploy a domain controller in a branch office with limited physical security and no local IT staff. Which option best reduces risk?

   1. Deploy a read-only domain controller (RODC)
   2. Deploy a standard writable domain controller with BitLocker disabled
   3. Promote a member server to a global catalog only
   4. Install Azure AD Connect on the branch server

   An RODC stores a read-only copy of the directory and, by default, caches no account passwords, limiting exposure if the server is stolen. This makes RODCs ideal for branch offices with weak physical security and no on-site administrators.
3. Q3 Deploy and Manage Hybrid Active Directory Domain Services (20%)

   Which tool synchronizes on-premises Active Directory identities to Microsoft Entra ID for a hybrid identity solution?

   1. Azure Arc agent
   2. Microsoft Entra Connect (Azure AD Connect)
   3. Windows Admin Center
   4. Azure Migrate appliance

   Microsoft Entra Connect, formerly Azure AD Connect, synchronizes on-premises AD DS users and groups to Microsoft Entra ID, enabling hybrid identity with options such as password hash sync and pass-through authentication.
4. Q4 Deploy and Manage Hybrid Active Directory Domain Services (20%)

   What is the primary purpose of an Active Directory site in AD DS?

   1. To define password complexity requirements
   2. To represent network topology and optimize replication and authentication traffic
   3. To store Group Policy templates
   4. To assign FSMO roles automatically

   AD sites map to physical network locations defined by IP subnets, allowing AD to direct clients to the nearest domain controller and to control replication between well-connected and slow links.
5. Q5 Deploy and Manage Hybrid Active Directory Domain Services (20%)

   Which Group Policy processing behavior applies when a user logs on, overriding conflicting computer settings?

   1. Loopback processing in replace mode
   2. Block inheritance
   3. Security filtering
   4. WMI filtering

   Group Policy loopback processing in replace mode applies the user policies defined in the computer's OU instead of the user's normal user policies, which is common for kiosks and shared computers.
6. Q6 Deploy and Manage Hybrid Active Directory Domain Services (20%)

   You must delegate the ability to reset passwords for users in a single organizational unit without granting broader admin rights. What is the best approach?

   1. Add the helpdesk group to Domain Admins
   2. Use the Delegation of Control Wizard on that OU
   3. Grant the helpdesk group Enterprise Admins
   4. Edit the Default Domain Policy

   The Delegation of Control Wizard assigns specific permissions, such as resetting passwords, scoped to a particular OU. This follows least privilege by avoiding membership in powerful groups like Domain Admins.
7. Q7 Deploy and Manage Hybrid Active Directory Domain Services (20%)

   Which command-line tool is used to perform an authoritative restore of an Active Directory object after deletion?

   1. dcdiag
   2. ntdsutil
   3. repadmin
   4. dsquery

   ntdsutil includes the authoritative restore commands used in Directory Services Restore Mode to mark restored objects with a higher version number so they replicate out to other DCs.
8. Q8 Deploy and Manage Hybrid Active Directory Domain Services (20%)

   What does the AD Recycle Bin feature provide when enabled?

   1. Automatic offsite backup of the NTDS.dit file
   2. Recovery of deleted objects with their attributes intact without a system state restore
   3. Encryption of all directory attributes at rest
   4. Replication compression across site links

   The AD Recycle Bin preserves deleted objects in a recoverable state, retaining link-valued and non-link-valued attributes so they can be restored without rebooting into DSRM.
9. Q9 Deploy and Manage Hybrid Active Directory Domain Services (20%)

   Which trust type would you create to allow users in a separate forest to access resources in your forest, with selective authentication?

   1. External trust
   2. Forest trust
   3. Shortcut trust
   4. Realm trust

   A forest trust links two entire AD forests and supports selective authentication, letting administrators control which users can authenticate to specific resources.
10. Q10 Deploy and Manage Hybrid Active Directory Domain Services (20%)

    Which functional level setting determines which Active Directory features are available forest-wide and is constrained by the oldest DC operating system in the forest?

    1. Domain functional level
    2. Forest functional level
    3. Site link cost
    4. Schema version

    The forest functional level controls forest-wide AD features and cannot be raised higher than the lowest domain functional level, which in turn is limited by the oldest domain controller OS.
11. Q11 Deploy and Manage Hybrid Active Directory Domain Services (20%)

    A company has enabled password hash sync to sync on-premises AD DS users to Microsoft Entra ID. They are migrating a legacy Windows Server application to Azure VMs. The application must continue using domain join, LDAP binds, Kerberos/NTLM, and Group Policy, but the company does not want to deploy or manage domain controllers in Azure. Which identity design is the best choice?

    1. Use staged rollout to migrate users to cloud authentication
    2. Register the application in Microsoft Entra ID for OAuth authentication
    3. Deploy Microsoft Entra Domain Services and join the VMs
    4. Join the Azure VMs directly to Microsoft Entra ID

    When legacy workloads require AD DS-like protocols in Azure without managing domain controllers, Microsoft Entra Domain Services provides a managed domain supporting domain join, LDAP, Kerberos/NTLM, and Group Policy.
12. Q12 Deploy and Manage Hybrid Active Directory Domain Services (20%)

    A company has a single AD DS forest with two domains. The forest and both domain functional levels are Windows Server 2012 R2, and some DCs still run Windows Server 2012 R2. The company syncs identities to Microsoft Entra ID and wants to add time-bound privileged group membership in the existing forest without migrating users to a new forest. Which design is best?

    1. Create a new forest and migrate users using ADMT
    2. Deploy Microsoft Entra Domain Services for privileged groups
    3. Replace legacy DCs, then raise domain and forest functional levels
    4. Extend the schema only and keep current functional levels

    Newer AD DS features require newer DC OS and higher domain/forest functional levels. The solution is to upgrade or replace legacy DCs, demote old DCs, raise domain functional levels, then raise forest functional level.
13. Q13 Deploy and Manage Hybrid Active Directory Domain Services (20%)

    After transferring all FSMO roles to DC01, you are demoting an additional domain controller DC03 in corp.contoso.com. The demotion wizard fails with: "Active Directory Domain Services could not replicate off changes made locally." repadmin /showrepl shows RPC server unavailable errors between DC03 and DC01. What is the best next diagnostic step?

    1. Seize the FSMO roles from DC03 to DC01
    2. Retry the demotion using an Enterprise Admin account
    3. Reconfigure DC03 to use a public DNS resolver
    4. Investigate RPC replication connectivity between DC03 and DC01

    The repadmin output shows error 1722 (RPC server unavailable) between DC03 and its replication partner DC01. Before retrying demotion, investigate and resolve network, firewall, name resolution, or RPC endpoint access issues.

Answer all 125 questions with instant feedback →

Reader reviews 170 ratings

• Got 856 out of 900 on the AZ-802 exam. This question bank was my primary study resource. Highly recommend.

  ★★★★★ Alyssa D.

• Passed the AZ-802 exam today! The scenario-based questions here were extremely similar to what I saw on the test.

  ★★★★★ Riley B.

• Just passed the AZ-802 certification. These questions were more challenging than the real exam, which is exactly how prep should be.

  ★★★★★ Liam H.

• Solid prep material for AZ-802. The questions feel like they were written by someone who actually teaches this stuff.

  ★★★★★★ Brooklyn T.

• I have tried many Microsoft practice tests and this AZ-802 bank is by far the most accurate and well-organized.

  ★★★★★★ Kevin N.

• The AZ-802 questions were tougher than the actual exam, which honestly made me more confident. Great prep tool.

  ★★★★★★ Brandon L.

Frequently asked questions

Free study resources

Community-verified analysis of 22 questions from real test-taker discussions — 2 deep analyses and 0 FAQs.

More Microsoft exams