AZ-802 Exam Dumps - Administering Windows Server

At 11:30 AM, User1 and User2 are members of Group1: No. At 11:30 AM, the phone number of User2 is 333-333: Yes. At 11:30 AM, User3 is deleted: No.

Group membership is stored as a linked, multivalued attribute, so DC2 ' s removal of User1 from Group1 and DC1 ' s addition of User2 to Group1 modify two different values and merge without conflict once the 10:00 to 10:30 network partition heals. By 11:30 AM, well past the 20-minute replication interval, Group1 has fully converged across both sites to contain only User2, so the claim that both User1 and User2 are members of Group1 is false. For the single-valued telephone-number attribute, Active Directory resolves a genuine write conflict by comparing each domain controller ' s local originating-write version number for that attribute, using the timestamp only as a tiebreaker when the version numbers are equal; because DC1 wrote User2 ' s phone number twice during the outage, first to 222-222 and then to 333-333, while DC2 wrote it only once, to 444-444, DC1 ' s attribute carries the higher version number and wins the conflict regardless of DC2 ' s later wall-clock timestamp, so User2 ' s phone number converges everywhere to 333-333. For User3, DC1 moved the object into OU1 while DC2, still seeing OU1 as empty from its own perspective, deleted OU1 during the same outage window; when these two conflicting changes replicate together, Active Directory detects that User3 has become orphaned by its parent container ' s deletion and relocates the object into the domain ' s LostAndFound container rather than deleting it outright, so User3 still exists, just not in its original location, at 11:30 AM.

Azure Automanage currently does not support virtual machines that use the Trusted launch security type; this is an explicit, documented limitation of the service, independent of which Windows Server version or edition the VM is running. Looking at the four virtual machines ' security types, Server1 (Windows Server 2022 Datacenter: Azure Edition) and Server4 (Windows Server 2019 Datacenter) are both configured with Trusted launch, which makes both of them ineligible for Automanage onboarding regardless of their OS version. Server2 (Windows Server 2022 Datacenter: Azure Edition) and Server3 (Windows Server 2022 Datacenter) both use the Standard security type and run OS versions on Automanage ' s supported list, so both qualify and Automanage should be enabled on them to satisfy the requirement that it be used on " all supported " virtual machines, which by definition excludes the ones the service cannot onboard. It is a common misreading of this scenario to assume the Azure Edition label is the deciding factor, since Server1 and Server2 share that edition; the actual determining attribute the requirement hinges on is the VM ' s security type, not its Windows Server edition. Therefore Server2 and Server3 are the correct machines on which to enable Automanage.

The requirement is that VMs must be configured to enable per-folder quotas. VM3 already has the File and Storage Services role installed, but native NTFS quotas only apply per volume and per user; they cannot restrict the amount of data stored inside an individual folder. File Server Resource Manager (FSRM) is the Windows Server feature that adds true folder-level quota management, letting an administrator define hard or soft quota limits (and quota templates) scoped to specific folders rather than entire volumes, which is exactly the granularity the requirement calls for. Enhanced Storage is an unrelated feature that supports certain storage devices with enhanced storage access (IEEE 1667), Windows Standards-Based Storage Management provides SMI-S/WMI-based management of storage arrays and has nothing to do with folder-level quotas, and the iSNS Server service is used for discovery of iSCSI targets and initiators on a network, also unrelated to quota enforcement. None of those three alternatives provide any per-folder capacity restriction capability, so installing FSRM is the necessary first step before per-folder quotas can be configured on VM3.

hvc.exe, ssh User2@VM2

The requirement is to use a direct SSH session to manage all the supported virtual machines on HyperV1, without relying on a network path to the guest. Hyper-V provides hvc.exe, a helper used as an SSH ProxyCommand, that opens an SSH session to a virtual machine over the VMBus (the internal Hyper-V socket/console channel) rather than over the network, which works even when the guest has no reachable IP configuration and only default management tools installed, matching the stated environment. Direct SSH management this way requires the guest to run an SSH server; of the three VMs, only VM2 runs Red Hat Enterprise Linux, which includes OpenSSH server support out of the box, so it is the only VM realistically " supported " for this direct SSH scenario as described, and the account to use is User2, the local account that exists on VM2. VM1 and VM3 both run Windows Server, so " direct SSH, " as intended by this requirement, targets the Linux guest. Connect-PSSession and Connect-WSMan are PowerShell remoting tools, not SSH, and mstsc.exe launches a graphical Remote Desktop session rather than a console-mode SSH session, so none of those alternatives fit. The correct combination is hvc.exe used as the SSH proxy, connecting as User2@VM2.

Private1 is deployed with its inbound endpoint in VNet1, and an Azure DNS Private Resolver inbound endpoint can resolve only private DNS zones that are virtual-network-linked to the same virtual network where the resolver itself sits; it cannot resolve a zone just because it exists in the same subscription, or because that zone happens to be linked to a different, unrelated virtual network. Per the private DNS zone table, Zone1.com is linked to VNet1, Zone2.com is linked to VNet2, and Zone3.com has no virtual network link at all. Because Private1 ' s inbound endpoint lives in VNet1, only Zone1.com, the zone actually linked to VNet1, can be resolved through it. Zone2.com cannot be resolved by Private1 because it is linked only to VNet2, a separate virtual network with no stated peering or additional resolver configuration connecting it to VNet1; and Zone3.com cannot be resolved by any resolver in any virtual network because it has no virtual network link whatsoever, meaning no virtual network can consult it through the normal Azure-provided DNS resolution path. Extending resolution to Zone2.com would require either a separate resolver deployed in VNet2, or peering combined with a forwarding ruleset and outbound endpoint, neither of which is described as being configured here. Therefore only Zone1.com can currently be resolved.

1. roles 2. connections 3. connect to server dc2.adatum.com 4. quit 5. seize schema master

Because DC1 has failed and cannot gracefully transfer the schema master role, DC2 must forcibly seize it using ntdsutil.exe. From the initial ntdsutil prompt, the first command is roles, which enters the Role Management submenu where FSMO role transfers and seizures are performed. From within that submenu, the command connections opens the Connections submenu, which is required before you can bind ntdsutil to a specific target domain controller. Inside the Connections submenu, connect to server dc2.adatum.com establishes the bind to DC2, the domain controller that will actually take over the schema master role. The quit command then exits the Connections submenu and returns to the Role Management submenu while keeping the established connection to DC2 active. Finally, seize schema master, executed from the Role Management submenu while bound to DC2, forces DC2 to take ownership of the schema master role even though DC1 (the previous holder) is offline and cannot be contacted to confirm the transfer. The unused command in the list, metadata cleanup, is a separate, later step used to remove the failed DC1 ' s leftover directory metadata once its roles have been reassigned; it is not part of seizing the schema master role itself, so it is correctly left out of this five-step sequence.

Enabling Microsoft Entra ID sign-in on an Azure VM running Windows is implemented through a VM extension named AADLoginForWindows, published by Microsoft.Azure.ActiveDirectory. This extension installs the components needed for the VM to accept Microsoft Entra credentials for RDP sign-in and, when combined with Azure RBAC roles such as Virtual Machine Administrator Login, controls who is authorized to sign in. VM extensions in Azure are deployed and managed with the Set-AzVMExtension cmdlet, which is how this specific extension gets installed onto Server1. Set-AzVM modifies general virtual machine properties, such as size or OS profile settings, but has no mechanism for installing extensions. Add-ADComputerServiceAccount and New-ADComputer are on-premises Active Directory cmdlets used to manage computer objects and service accounts in AD DS; they have no relevance to an Azure VM ' s sign-in method and would not apply here since Server1 ' s sign-in requirement is being satisfied by Microsoft Entra ID, not by joining a domain. Set-AzVMExtension is therefore the correct cmdlet.

The Marketing OU users exist in fabrikam.com, a completely separate on-premises AD DS forest belonging to a different company than A. Datum, whose own Microsoft Entra tenant only syncs the adatum.com forest today. To give those Fabrikam users access to storage1 in A. Datum ' s tenant, their identities must also be represented in that tenant. Microsoft Entra Connect cloud sync uses lightweight, cloud-managed provisioning agents that are specifically designed to support complex or multi-forest topologies, including syncing from a partner organization ' s forest, with a much smaller on-premises footprint and configuration burden than the full Microsoft Entra Connect Sync engine, and without requiring a trust relationship between the two companies ' forests. The traditional Microsoft Entra Connect Sync engine (whether in active or staging mode) is built around a single organization ' s identity infrastructure and is a heavier deployment to extend safely across an independent partner company ' s forest; staging mode specifically only prepares a secondary sync server to take over, and does not by itself address the cross-company sync problem. AD FS provides federation and SSO but does not create Microsoft Entra ID objects for Fabrikam ' s users. Microsoft Entra Connect cloud sync is therefore the correct, purpose-built option.