AZ-802 Exam Dumps - Microsoft Certified: Windows Server Hybrid Administrator Associate Questions and Answers

In Microsoft Entra ID: the Application Proxy service. On-premises: the Application Proxy connector.

Microsoft Entra Application Proxy is designed exactly for publishing an internal, Kerberos-only web application to users who authenticate with their Microsoft Entra account, using Kerberos Constrained Delegation to perform single sign-on into the app on the user ' s behalf, which minimizes administrative effort compared to re-architecting the app ' s authentication. The feature has two halves: a cloud-side component, the Application Proxy service in Microsoft Entra ID, which publishes an external URL, terminates user authentication, and brokers the connection; and an on-premises component, a lightweight Application Proxy connector installed on a server inside the corporate network, which maintains an outbound connection to the service and relays traffic to WebApp1, performing the Kerberos delegation locally where the app lives. Because the connector only makes outbound connections, no inbound firewall changes or DMZ placement are required, unlike the retired Web Application Proxy/reverse-proxy pattern. Configuring the service in Microsoft Entra ID and the connector on-premises together completes the publishing setup with minimal administrative overhead.

Each Active Directory MMC snap-in only exposes the specific FSMO role or roles that fall within its area of responsibility. Active Directory Domains and Trusts manages forest-level trust relationships and domain/forest functional levels, and the single Operations Master dialog it provides — reached by right-clicking the root node of the console — shows only the Domain Naming Master, which is a forest-wide role responsible for adding or removing domains from the forest. It does not show the PDC Emulator, the RID Master, or the Infrastructure Master, all of which are domain-wide roles surfaced instead through Active Directory Users and Computers by right-clicking the domain object and selecting Operations Masters, then viewing the PDC tab specifically. Because the proposed action opens the Operations Master dialog from Active Directory Domains and Trusts rather than from Active Directory Users and Computers, it will report only the Domain Naming Master and gives no information about who holds the PDC Emulator role. Since the stated goal is specifically to identify the PDC Emulator, and this console cannot show that role under any circumstance, the solution does not meet the goal.

A file screen is the File Server Resource Manager (FSRM) feature purpose-built to block files of a specific type, matched by file-group name pattern (such as *.mov), from being saved into a designated folder or volume, while allowing every other file type through; it can be defined once as a file screen template and then applied consistently across all five file servers with minimal effort, especially if FSRM is centrally managed. Dynamic Access Control central access policies and central access rules operate at a much higher level of complexity, using claims-based conditional expressions (based on user, device, or resource properties) to control access to files and folders; they are designed for scenario-specific, attribute-driven authorization decisions, not simple extension-based upload blocking, and configuring them for this narrow requirement would take considerably more administrative effort than necessary. A data loss prevention (DLP) policy is a Microsoft Purview / Microsoft 365 concept for protecting sensitive information across cloud and endpoint locations; it is not a Windows Server file server feature and has no direct role in blocking a specific file extension from an on-premises SMB share. A file screen is therefore the simplest, correct, purpose-built solution.

You can move App1 to Node4 manually: No. If Node3 fails, App1 will fail over to Node2 automatically: No. If App1 automatically fails over from Node3, App1 will fail back to Node3 automatically after Node3 is repaired: No.

App1 ' s General tab shows its Preferred Owners list contains only Node1 and Node2, checked in that priority order, with Node3 and Node4 both unchecked, and its Node field shows the role is currently running on Node2 rather than Node3. Because App1 is not actually running on Node3 at this moment, a failure of Node3 has no clustered workload on it to relocate, so it triggers no automatic failover to Node2 or to any other node; failover in Windows Server Failover Clustering only occurs when the node that is currently hosting a role fails, not when an unrelated node fails. Automatic failback always targets the highest-priority node that is checked in the role ' s Preferred Owners list on the General tab, never simply whichever node the role most recently happened to run on, and since Node3 is not checked as a Preferred Owner for App1 at all, App1 can never automatically fail back to Node3, even though the Failover tab shows Allow failback set to Immediately. Whether App1 can be moved to Node4 manually is governed separately by the Possible Owners list on the Advanced Policies tab, a setting distinct from Preferred Owners, and for this role that list excludes Node4 as a valid host, so a manual move to Node4 is not possible either.

Older logs overwritten: The Performance Counter properties. Stop below 500 MB free: The Data Manager properties.

The individual Performance Counter data collector inside a Data Collector Set has its own Properties dialog with a File tab that includes an Overwrite option, and enabling that option causes each new logging run to overwrite the previous log file in place rather than creating a new, separately numbered file each time -- this is exactly the control needed to make older performance counter logs get replaced by newer ones. Disk-space-based retention, on the other hand, is governed at the level of the Data Collector Set as a whole through its Data Manager properties, which expose a Minimum Free Disk Space setting, alongside Maximum Folders and Maximum Root Path Size settings, that Windows evaluates against the log directory ' s volume to manage or halt further data collection once free space drops below the configured threshold. Because these two behaviors live on two entirely different property pages -- one scoped to the individual counter ' s file settings and the other scoped to the Data Collector Set ' s overall data management -- the Configuration properties option, which governs sample interval and duration settings, does not control either of these two requirements.

A point-to-site VPN client profile embeds the address-space routes that existed in Azure at the moment the profile was generated and downloaded onto Computer1. When VNet2, hosting AppSvr2, is peered with VNet1 after User1 ' s VPN client profile was already configured and downloaded, the previously issued profile has no route entry for VNet2 ' s address space baked into it, so traffic aimed at AppSvr2 never gets forwarded across the existing tunnel even though the VNet peering itself is fully established and healthy on the Azure side. Microsoft ' s documented point-to-site troubleshooting guidance for exactly this symptom is to, if needed, reset the gateway and then download and reinstall the VPN client on the affected computer so it picks up a refreshed profile that includes routes for the newly peered network, which restores connectivity to AppSvr2 without requiring any changes to the peering configuration itself, to network security groups, or to Computer1 ' s local Windows Defender Firewall settings. Creating a route table on GatewaySubnet or adding a service endpoint to VNet2 would not address a client-side profile that is simply missing the newly peered address space, since the routing problem in this case lives in the already-downloaded client configuration rather than in Azure ' s own routing tables.

Discovering Hyper-V hosts and VMs with Azure Migrate begins in the Azure portal by adding the Discovery and assessment tool to Project1 and generating a project key, which is the credential the on-premises Azure Migrate appliance uses during its initial setup to register itself against that project. Only after the key is generated and the appliance is deployed and registered with it can the appliance be pointed at the Hyper-V hosts to begin discovery; registering an appliance, creating a private endpoint, and deploying an Azure Network Adapter are all later or unrelated steps that depend on, or are independent of, having generated the project key first. Generating the key is a single portal action that takes only moments and requires no additional infrastructure, which is what keeps this approach aligned with the requirement to minimize administrative effort compared with any manual discovery alternative. Once the appliance is deployed as a VM on the Hyper-V infrastructure and registered using that key, it automatically enumerates the Hyper-V hosts and their VMs and reports the inventory back to Project1 for assessment.

Reset-ComputerMachinePassword is a PowerShell cmdlet designed specifically to reset a computer ' s domain account password directly against a specified domain controller, and when run locally on the affected computer itself, here Server1, targeting DC1 with -Server, it resets and resynchronizes the computer account ' s password on both sides of the secure channel: it generates a new password, writes it to the Server1$ computer account object on DC1, and simultaneously updates Server1 ' s own local machine-account secret to match, in a single coordinated operation. Because both the AD DS side and the local Server1 side of the shared secret end up holding the same new password value, the secure channel between Server1 and the domain is fully restored, resolving the trust relationship failed error. This is done without removing Server1 from the domain at any point, satisfying the stated constraint, and without changing any domain-wide or server-wide authentication policy setting. This cmdlet, along with Test-ComputerSecureChannel -Repair, is one of Microsoft ' s two documented, non-disruptive remediation methods for a broken computer secure channel, both of which succeed precisely because they update the password consistently on both the local computer and the domain controller rather than on only one side, unlike a solution that touches only the AD DS-stored value.

With the Active Directory Recycle Bin enabled, deleted objects retain their attributes and can be restored, and Active Directory Administrative Center is the graphical tool that exposes the Deleted Objects container and a Restore (or Restore To) action for recovering them, including User1. Active Directory Users and Computers does not expose the Deleted Objects container by default and has no restore functionality, and Sites and Services or Domains and Trusts are unrelated to object recovery. ADAC is therefore the tool to use for a straightforward Recycle Bin restore of a deleted user. From ADAC, an administrator navigates to the Deleted Objects container in the domain, selects User1, and chooses Restore to return the account to its original location with its original attributes and group memberships intact, avoiding the more involved authoritative-restore or tombstone-reanimation procedures required when the Recycle Bin is not enabled. The same restore operation can also be performed with the Restore-ADObject PowerShell cmdlet once the object ' s deleted-object GUID is identified, which is a useful alternative when scripting bulk recoveries rather than restoring a single account interactively through ADAC.

DC1 can replicate directly to DC3: No. DC1 will load balance replication traffic to DC4 via SiteLink3 and SiteLink4: No. To ensure that replication between DC4 and DC2 is routed via DC1, the configuration of the IP intersite transport container must be modified: No.

Site1 and Site3 have no direct site link connecting them; they are only connected transitively through Site2 (Site1-Site2 via SiteLink1, Site2-Site3 via SiteLink2). Even with site link bridging enabled (the default), the KCC computes least-cost transitive paths for scheduling purposes, but actual replication connections are still built between adjacent, directly linked sites ' bridgeheads -- meaning replication between Site1 and Site3 flows through Site2 ' s bridgehead (DC1-to-DC2, then DC2-to-DC3), not as a single direct DC1-to-DC3 connection, since no direct site link exists between Site1 and Site3. Where two site links exist between the same pair of sites at different costs (SiteLink3 at cost 60 and SiteLink4 at cost 20, both between Site1 and Site4), the KCC ' s spanning-tree replication topology algorithm selects the lowest-cost link (SiteLink4) as the active path and does not simultaneously load-balance traffic across both links; the higher-cost SiteLink3 instead serves only as a failover path if SiteLink4 becomes unavailable. Finally, because Site4 is connected only to Site1 in this topology (with no direct or alternate path to Site2 or Site3 at all), any replication between Site4 and Site2 must already, unavoidably, transit through Site1 -- this is simply the only physically possible path given the topology, and it occurs automatically under the default site-link-bridging behavior with no need to modify the IP intersite transport container ' s configuration.