AZ-802 Exam Dumps - Microsoft Certified: Windows Server Hybrid Administrator Associate Questions and Answers

The requirement is that VMs must be configured to enable per-folder quotas. VM3 already has the File and Storage Services role installed, but native NTFS quotas only apply per volume and per user; they cannot restrict the amount of data stored inside an individual folder. File Server Resource Manager (FSRM) is the Windows Server feature that adds true folder-level quota management, letting an administrator define hard or soft quota limits (and quota templates) scoped to specific folders rather than entire volumes, which is exactly the granularity the requirement calls for. Enhanced Storage is an unrelated feature that supports certain storage devices with enhanced storage access (IEEE 1667), Windows Standards-Based Storage Management provides SMI-S/WMI-based management of storage arrays and has nothing to do with folder-level quotas, and the iSNS Server service is used for discovery of iSCSI targets and initiators on a network, also unrelated to quota enforcement. None of those three alternatives provide any per-folder capacity restriction capability, so installing FSRM is the necessary first step before per-folder quotas can be configured on VM3.

Disk1: 2. Disk2: 1.

The requirement is that data on SSPace1 must remain available at all times, meaning the storage pool ' s virtual disks must be able to tolerate physical disk failures without becoming unavailable or losing data. A three-way mirror keeps three copies of every block of data spread across different physical disks, so it remains available and readable even if any two of those disks fail simultaneously; the resiliency is fixed at tolerating two failures regardless of how many total disks (8, in Disk1 ' s case) make up the pool, as long as there are enough disks to support three-way mirroring, which eight comfortably provides. Disk2 uses parity resiliency, which stores a single parity block that can reconstruct data after one physical disk failure; unless dual parity is explicitly configured (which requires being set at virtual disk creation time and is not indicated here), a standard parity virtual disk tolerates only one physical disk failure before data becomes unavailable, regardless of the pool having twelve physical disks. Administrators sometimes assume more disks in a parity pool automatically means more fault tolerance, but the number of disks a parity space can lose is determined by the resiliency configuration (single vs. dual parity), not by the total disk count. Therefore Disk1 tolerates two disk failures and Disk2 tolerates one.

The stated problem is that when an administrator connects to VM2 ' s console through Virtual Machine Connection and disconnects without signing out, a second administrator who opens the console can silently inherit that still-signed-in session without ever supplying credentials. By default, VMConnect attaches directly to the raw console of the guest, which behaves like walking up to a physical, unlocked machine. Enhanced Session Mode changes this behavior by routing the VMConnect session over the Remote Desktop Protocol into the guest, which means every connection is treated as a new interactive Remote Desktop logon and therefore always prompts for credentials, eliminating the ability to passively inherit someone else ' s open session. Enabling Enhanced Session Mode requires both host-side and guest-side support (the guest operating system must support RDP and have the setting enabled) but is the direct, purpose-built fix for this exact console-sharing problem. The Guest Services integration component only enables basic file-copy functionality between host and guest and has no effect on console/session behavior. Credential Guard protects locally stored credentials from theft using virtualization-based security, and shielded VMs protect a VM ' s disk, state, and console from a compromised or malicious fabric administrator; neither addresses console session takeover between two legitimate administrators. Enhanced Session Mode is therefore the correct solution.

Site, subnet, and site-link objects are stored in the Configuration partition, which replicates to every domain controller in the forest but is administratively owned by the forest root domain. By default, only members of Enterprise Admins and members of the Domain Admins group of the forest root domain (contoso.com in this forest) have permissions to modify objects in the Configuration container, including editing a site link ' s replication schedule. Admin1 is a member of Contoso\Enterprise Admins and therefore has forest-wide rights over the Configuration partition. Admin2 is a member of Contoso\Domain Admins; because contoso.com is the forest root domain, this group also carries default rights over the Configuration and Schema partitions. Admin3, however, is a member of Canada\Domain Admins, the Domain Admins group of the canada.contoso.com child domain, which has no inherent rights over the Configuration partition. Consequently, to change the replication schedule on all site links to 30 minutes, only Admin1 and Admin2 currently have the necessary permissions, making option C the correct answer.

Group3: Group1, Group2, Group4, and Group5 only. Group5: Group4 only.

Group nesting in AD DS is governed strictly by group scope, independent of whether a group is security- or distribution-type. A Domain Local group can contain user accounts, Global groups from any domain, and Universal groups from any domain, plus other Domain Local groups from its own domain only. Group3 is a Domain Local group in contoso.com, so it can accept Group1 (Universal, contoso.com), Group2 (Global, contoso.com), and Group4 and Group5 (both Global, canada.contoso.com), since Global groups from any domain are valid Domain Local members. It cannot accept Group6, because Group6 is Domain Local in canada.contoso.com, a different domain, and Domain Local groups may only nest other Domain Local groups from their own domain. That gives Group3: Group1, Group2, Group4, and Group5 only. A Global group, by contrast, can contain only user accounts and other Global groups from the same domain. Group5 is Global in canada.contoso.com, so among the remaining groups only Group4 qualifies, since it is also Global and in the same domain; Group1 (Universal), Group2 (Global but a different domain), and Group6 (Domain Local) are all excluded by scope rules. That gives Group5: Group4 only.

Data Deduplication is a Windows Server file-and-storage feature that can only be enabled on NTFS-formatted data volumes; it cannot be enabled on the operating system (boot/system) volume, and it does not support ReFS or FAT/exFAT volumes at all. VM3 ' s volumes are C (NTFS, the operating system volume), D (NTFS, a data volume), E (ReFS), and F (exFAT). Volume C is excluded because Deduplication is never supported on the volume that hosts the operating system, even though its file system is NTFS. Volume E is excluded because Data Deduplication has no ReFS support in general-purpose deployments; ReFS uses its own separate storage-efficiency mechanisms such as block cloning, not the Deduplication feature. Volume F is excluded because exFAT is a lightweight file system with no support for Windows Server roles or features such as Deduplication, which depends on NTFS-specific metadata structures. That leaves volume D as the only NTFS data volume that is neither the boot volume nor formatted with an unsupported file system, so it is the only volume on which Data Deduplication can currently be enabled, making option C correct.

Server1: Set-Item. Server4: Enable-PSRemoting.

The requirement is to manage Server4 from Server1 by using PowerShell remoting. Server4 is a workgroup computer, not a member of either AD DS domain, so the WinRM authentication that PowerShell remoting relies on cannot use Kerberos between Server1 and Server4; it must fall back to NTLM, which WinRM only permits toward hosts explicitly listed in the client ' s TrustedHosts list. On Server1, the correct action is therefore Set-Item, used as Set-Item WSMan:\localhost\Client\TrustedHosts -Value " Server4 " (with -Concatenate as needed), which adds Server4 to Server1 ' s trusted hosts so an NTLM-based remoting session is permitted. On Server4, the target must first be configured to accept remote commands at all, which is done with Enable-PSRemoting; this cmdlet starts and configures the WinRM service, creates a listener, and enables the Windows Remote Management firewall rule for the current network profile, matching Server4 ' s private firewall profile. Enable-ServerManagerStandardUserRemoting only grants a non-administrator limited Server Manager access and does not establish remoting, and Start-Service alone does not create or configure a WinRM listener or firewall exception. Configuring Set-Item on Server1 and Enable-PSRemoting on Server4 together satisfies the requirement.

Installing and authorizing a DHCP server in an Active Directory-integrated environment requires two distinct sets of rights: local Administrators group membership on Server3 to install the DHCP Server role itself, and Enterprise Admins group membership to authorize that server in AD DS, because DHCP server authorization is stored as a forest-wide object under CN=NetServices,CN=Services,CN=Configuration and only Enterprise Admins can create or modify objects there by default. Admin1 is a member of Contoso\Enterprise Admins, which grants exactly this forest-wide right and also carries local administrative rights on every domain-joined computer in the forest, including Server3, so Admin1 can both install the role and authorize the server, fully satisfying the requirement on his own. Admin2, a member of only Contoso\Domain Admins, has full administrative rights over contoso.com and its member computers, but Domain Admins does not carry the right to authorize a DHCP server in the forest-wide NetServices container, so Admin2 cannot complete authorization even though he can install the role. Admin3, a member of Canada\Domain Admins, has administrative rights limited to the canada.contoso.com domain and likewise lacks the Enterprise Admins-only authorization right needed here, since Server3 and the DHCP authorization object both fall outside that domain ' s scope of control. Because only Admin1 holds both the local administrative rights needed to install the DHCP Server role on Server3 and the Enterprise Admins membership needed to authorize it in AD DS, Admin1 only is correct.

The requirement is narrow: User1 must be able to manage the membership of all the groups located in Contoso\OU3, and nothing more. The Delegation of Control Wizard, run against OU3 specifically, lets an administrator grant User1 exactly the built-in task " Modify the membership of a group, " which grants write access to the member attribute on group objects contained in that OU only. This satisfies the requirement while granting no rights outside OU3, which is the definition of least privilege. Creating the same delegation at the domain root (contoso.com) would technically work but grants far broader scope than needed, since it would apply to every container in the domain, not just OU3, violating least privilege. Adding User1 to Account Operators grants domain-wide rights to create, delete, and modify most user, group, and computer accounts throughout the domain (with some protections for built-in admin accounts), which is excessive for a task limited to group membership in one OU. Server Operators is unrelated to Active Directory object management altogether; it governs local administrative rights on domain controllers themselves. Therefore, delegating control on OU3 is the correct, minimally scoped solution.

Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true

The requirement is to run virtual machines on VM1 itself, which means enabling nested virtualization so that VM1 (a guest VM hosted on Server2) can install Hyper-V and host its own virtual machines. Nested virtualization on Hyper-V requires the parent VM ' s virtual processor to expose the host ' s hardware virtualization extensions (Intel VT-x or AMD-V) through to the guest. This is done with the Set-VMProcessor cmdlet using the -ExposeVirtualizationExtensions parameter set to $true, run against VM1 from the Hyper-V host (Server2): Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true. VM1 must be turned off before this setting can be applied, and after it is applied, VM1 needs the Hyper-V role installed inside the guest before it can run its own VMs. Set-VM, Set-VMBios, Set-VMHost, and Set-VMFirmware do not control virtualization extension exposure: Set-VM manages general VM configuration such as memory and name, Set-VMHost configures host-wide settings, and Set-VMFirmware/Set-VMBios control boot and firmware settings for generation 2 and generation 1 VMs respectively. Only Set-VMProcessor with -ExposeVirtualizationExtensions satisfies the stated requirement, making it the correct first step.