AZ-802 Exam Dumps - Administering Windows Server

Restoring deleted objects from the Active Directory Recycle Bin requires permission to view and restore objects inside the forest ' s Deleted Objects container, and by default that container ' s access control list denies access to everyone except the SYSTEM account and members of Domain Admins (and Enterprise Admins at the forest root) -- no delegation to any other built-in group exists out of the box. Among the four groups offered, only Domain Admins carries this permission by default, since Account Operators (which can manage most user, group, and computer objects but has no special access to the hidden Deleted Objects container), Schema Admins (which governs schema modifications, not object restoration), and Backup Operators (which can back up and restore files and the system state, but not perform an online Active Directory Recycle Bin object restore through the Active Directory Administrative Center) all lack the needed access. The case study ' s general instruction to use the principle of least privilege where possible does not change this outcome here, since none of the three lower-privileged alternatives actually has the required capability by default -- Domain Admins is not merely the most convenient choice but the only one of the four that functionally works. Therefore, User1 must be added to Domain Admins to be able to recover objects from the Active Directory Recycle Bin.

User1: 9. Admin1: 8.

Fine-grained password policies delivered through Password Settings Objects (PSOs) take precedence over the domain-wide Default Domain Policy for any user they apply to. When more than one PSO would apply to the same user only through different group memberships (as opposed to one being linked directly to the user), the PSO with the lowest numeric precedence value wins. User1 is a member of both Group2 (targeted directly by PSO1, precedence 10, minimum password length 9) and Group4 (targeted directly by PSO2, precedence 20, minimum password length 11); since PSO1 ' s precedence value of 10 is lower than PSO2 ' s 20, PSO1 governs, giving User1 an effective minimum password length of 9. Admin1 is a member only of Domain Admins, which is not targeted by either PSO, so no fine-grained password policy applies. Admin1 is also in OU1, which has GPO1 linked to it with a minimum password length of 10, but Account Policy settings such as password policy configured in an OU-linked GPO never affect the effective password policy of domain user accounts -- only a GPO linked at the domain root can supply a fallback domain-wide default, and PSOs otherwise take precedence over that default. With no applicable PSO, Admin1 ' s effective policy falls back to the Default Domain Policy, whose minimum password length in this environment is 8.

repair-bde.exe is a disk-repair utility, not a lookup or reporting tool: its purpose is to attempt to decrypt or repair a corrupted BitLocker-protected volume when normal unlock methods have failed, and it accepts either a recovery password or a previously exported BitLocker key package (a file containing the actual encryption keys needed to decrypt sectors directly) as the credential it uses to perform that repair; running it does not display, output, or otherwise identify the volume ' s 48-digit numerical recovery password value to the administrator at all, and a key package is a different artifact from the recovery password that would actually need to be entered at Server1 ' s BitLocker recovery screen to unlock it through the normal recovery workflow. The stated goal is specifically to identify the recovery key, meaning to determine and retrieve its value, not to repair or decrypt a damaged volume using key material that must already have been exported in advance; even successfully running repair-bde with an exported key package would leave the administrator no closer to knowing what Server1 ' s recovery password actually is, and it does nothing to address a server that is simply sitting at the BitLocker recovery prompt waiting for a password rather than suffering from actual volume corruption. Because this solution does not retrieve or display the recovery key, it does not meet the stated goal.

Windows Server DHCP policies let an administrator define conditions, such as a MAC address prefix/range or vendor class, and, when a requesting client matches those conditions, assign it an address from a specific sub-range carved out within an existing scope, all without creating a second scope or disturbing how other clients in that same scope are served. Because all 50 Teams Phone devices share MAC addresses within a known, identifiable range, a policy can match on that MAC prefix and hand out addresses only from 192.168.1.100–192.168.1.200, while every other client in Scope1 continues to receive addresses from the rest of the pool as before, exactly matching the requirement to not affect other clients. Creating a second scope would require a distinct, non-overlapping subnet and would not let two scopes share the same 192.168.0.0/23-style address space as described. A DHCP filter (allow/deny list) can only permit or block specific MAC addresses from getting a lease at all; it has no ability to steer a matched device into a particular IP sub-range. Scope options configure settings such as DNS servers or default gateway for the whole scope and have no address-targeting capability. A policy is therefore the correct feature to create.

Hyper-V Replica supports two authentication-and-transport combinations: Kerberos authentication carried over HTTP on TCP port 80, and certificate-based authentication carried over HTTPS on TCP port 443. Enabling Hyper-V Replica on a host creates both corresponding inbound firewall rules but leaves them disabled by default, so to actually receive replication traffic authenticated with Kerberos on its default port, an administrator must explicitly enable the Hyper-V Replica HTTP Listener (TCP-In) rule in Windows Defender Firewall with Advanced Security on Server1. Enabling the HTTPS Listener rule instead would only be correct if certificate-based authentication were being used, which is not the case here since Kerberos is specifically required. Adding primary servers to a Hyper-V Replica Broker configuration applies only to a clustered replica destination, but Server1 is a standalone Hyper-V host, not a cluster, so no broker role exists to configure. Enabling incoming and outgoing live migrations addresses live migration functionality entirely separate from Hyper-V Replica traffic. Therefore, enabling the Hyper-V Replica HTTP Listener (TCP-In) rule on Server1 is the correct action.

Azure Disk Encryption artifacts (such as the BitLocker/DM-Crypt encryption keys) can be protected in Key Vault by a software-protected key or by a hardware-protected key. Choosing ' key ' (rather than ' certificate ' or ' secret ' ) creates a cryptographic key object that can be used as a key-encryption key to wrap the disk encryption secret before it is written to the vault. Specifying --kty RSA-HSM (as opposed to plain RSA) ensures the key material is generated and protected inside a FIPS 140-validated hardware security module rather than in software, which is the highest level of protection Key Vault offers for this purpose. This matches the completed command shown in the exhibit, and Vault1 must be a Premium-tier vault for the RSA-HSM key type to be available, since HSM-backed keys are not supported on the Standard vault tier. Once artifact1 exists as an RSA-HSM key, its key identifier is supplied to Set-AzVMDiskEncryptionExtension as the key-encryption key parameter so that every BitLocker protector secret written to Vault1 is wrapped by it before storage.

1. az extension add. 2. az vm repair create. 3. az vm repair run. 4. az vm repair restore.

The Azure VM repair commands are delivered as the vm-repair Azure CLI extension rather than as a built-in part of the core CLI, so az extension add, which installs that extension, is always the required first step before any az vm repair subcommand can be invoked in Cloud Shell. Once the extension is installed, az vm repair create copies VM1 ' s operating system disk and attaches that copy to a new, temporary repair virtual machine so it can be examined and worked on without further risking the original VM. The optional az vm repair run step then executes a diagnostic or fix-up script against the disk that is now attached to the temporary repair VM, allowing an administrator to inspect or repair the file system, boot configuration, or other disk-level issue that is preventing VM1 from starting. Finally, az vm repair restore swaps the repaired disk back onto the original VM1 in place of its damaged disk and cleans up the temporary repair VM and its associated resources, completing the recovery process and allowing VM1 to start normally again with its repaired disk.

App1 is being blocked because Windows Defender Firewall with Advanced Security denies unsolicited inbound connections by default. To let remote users reach App1 on TCP port 52310 while keeping the solution scoped to only this application on Server1, an administrator creates a new inbound rule restricted to that specific port (or program path). Allowing all inbound connections for the profile would open every port on Server1 and violate the requirement to scope access narrowly, an outbound rule has no bearing on inbound client requests since App1 is being accessed rather than initiating connections, and a connection security (isolation) rule only governs authentication requirements between peers rather than which ports or programs are permitted to receive traffic. A scoped inbound port or program rule is therefore the only option that opens exactly the access App1 needs. The rule can be created through the Windows Defender Firewall with Advanced Security console, PowerShell ' s New-NetFirewallRule cmdlet, or Group Policy if Server1 is domain-joined, and scoping it to the specific port (or the App1 executable path) ensures no other service on Server1 gains unintended inbound reachability.