Microsoft Administering Windows Server AZ-802 Exam Dumps: Updated Questions & Answers (October 2026)

Authentication policies and authentication policy silos work together to restrict where a set of privileged accounts can sign in and to control their Kerberos ticket lifetimes, but the policy must exist before a silo can reference it. An authentication policy is created first, defining the one-hour Kerberos TGT lifetime restriction and the sign-in restriction limiting authentication to domain controllers. An authentication policy silo is then created, and this silo references the authentication policy that was just created so the silo knows which restrictions to enforce for its members. Finally, the silo is assigned to the Domain Admins user and computer accounts, which is the step that actually enrolls those specific accounts into the silo ' s restrictions, causing both the sign-in restriction and the shortened TGT lifetime to take effect for Domain Admins members. Skipping or reordering any of these three steps leaves the restrictions either undefined or unenforced, so create-policy, create-silo, then assign-accounts is the required sequence.

An Active Directory-integrated zone ' s replication scope controls exactly which set of domain controllers receive a copy of the zone data, and Windows Server offers four scopes: all DNS servers in the forest, all DNS servers in the domain, all domain controllers in the domain, or the domain controllers enumerated in a custom application directory partition. The current setting, all DNS servers in the forest, replicates contoso.com ' s zone data to every DNS server anywhere in the forest, including the DNS servers hosted on domain controllers in the child domain corp.contoso.com, which is exactly the behavior that must be stopped. Changing the replication scope to all the DNS servers on the domain controllers in the contoso.com domain confines replication strictly to DNS servers that are also domain controllers within contoso.com itself, which both excludes every DNS server in corp.contoso.com (satisfying the first requirement) and reduces the replication set from a forest-wide scope down to a single-domain scope, cutting unnecessary AD replication traffic (satisfying the second requirement). Scoping to all domain controllers in the domain would replicate to contoso.com DCs that lack the DNS Server role entirely, needlessly bloating those DCs with zone data they will never serve, which is worse than necessary for minimizing traffic. Converting to a secondary zone on each DC abandons AD-integration and its dynamic update and multi-master benefits, and scoping to all DNS servers in the forest is the current, over-broad configuration causing the problem.

Azure Disk Encryption for a VM that authenticates using a managed identity needs the target key vault to explicitly authorize that identity before the disk encryption extension can write BitLocker or DM-Crypt protector secrets into the vault and, optionally, wrap an encryption key stored there. This authorization is granted by, from Vault1, creating an access policy that gives VM1 ' s system-assigned managed identity permission to use keys and secrets, typically Get, List, and Set on secrets, plus wrap and unwrap on keys if a key encryption key is used to further protect the BitLocker secret. This access policy must be configured before running Set-AzVMDiskEncryptionExtension, or the encryption operation will fail with access-denied errors when it attempts to write the encryption secret to a vault that has not yet trusted VM1 ' s identity. Installing a BitLocker recovery certificate on VM1, editing a local Group Policy Object on VM1 to allow BitLocker key storage, or enabling confidential OS disk encryption are all unrelated to authorizing a managed identity against a key vault, and none of them substitutes for the required Vault1 access-policy grant, which remains the mandatory first step for standard Azure Disk Encryption using a managed identity.

The documented approach for minimizing cluster downtime while performing an operating system upgrade on a single cluster node is to first pause that node and drain its currently running clustered roles, which causes those roles, including any highly available virtual machines or other clustered workloads, to live-migrate over to the remaining, still-active cluster members before any disruptive action is taken directly against Server1 itself. Only once Server1 has been paused and fully drained of its workloads is it safe to proceed with the actual operating system upgrade to Windows Server 2025 on that node, since the workloads it was hosting are now running elsewhere in the cluster and will not experience downtime while Server1 is being upgraded. Evicting Server1 from the cluster entirely, or taking the whole three-node cluster offline, are both far more disruptive first steps than necessary and would cause unnecessary downtime well beyond what pausing and draining a single node requires, since eviction removes the node from cluster membership altogether and taking the whole cluster offline would stop every clustered role on every node rather than only the one node being upgraded. Updating the functional level of the cluster is a step performed only after every node in the cluster has already been upgraded to the new operating system version, not before the rolling upgrade process even begins, so pausing Server1 and draining its workloads is the correct first action to take.

When a standalone (workgroup) server is promoted to become the FIRST domain controller of a brand-new domain, its existing local SAM accounts are not simply discarded as they would be if the server instead joined an already-existing domain; with no pre-existing domain database to join, the local SAM becomes the seed for the new domain ' s Active Directory database, and local user accounts are converted into domain accounts, carrying forward their prior local group memberships in equivalent form. Because User3 was a member of the local Administrators group before promotion, User3 becomes administrator-equivalent in the new east.contoso.com domain, granting the default " Allow log on locally " right on that domain ' s own domain controllers. User4, previously only in the local Users group, becomes an ordinary domain user with no special local-logon right on a DC. Domain controllers, by default, grant " Allow log on locally " only to privileged groups such as Administrators, Account Operators, Backup Operators, Print Operators, and Server Operators -- not to ordinary Domain Users. User1, a member of the forest-wide Enterprise Admins group, is administrator-equivalent everywhere in the forest, including the new DC, so User1 can log on locally. User2, a plain Domain Users member, has no such right. Therefore, only User1 and User3 can sign in to Server1 locally.

Set-VMProcessor VM1 -ExposeVirtualizationExtensions $true

Installing the Hyper-V role inside a virtual machine -- running Hyper-V as a nested hypervisor on top of another Hyper-V host -- requires nested virtualization to be explicitly enabled for that specific VM, because a virtual processor does not, by default, expose the hardware virtualization extensions (Intel VT-x/EPT or AMD-V) that a guest hypervisor needs to create and run its own virtual machines. This is enabled on the Hyper-V host (Server1), targeting the guest VM, with Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true, run before Hyper-V is installed inside VM1; only after virtualization extensions are exposed to VM1 can the Hyper-V role be installed and function correctly inside that guest. Set-VMHost configures host-wide Hyper-V settings such as default storage/VM paths or NUMA spanning and has an -EnableEnhancedSessionMode-equivalent policy setting for the VMConnect enhanced session experience, but it has no role in enabling nested virtualization. Set-VM, Set-VMFirmware, and Set-VMSecurity configure other unrelated VM properties (general VM settings, boot firmware/Secure Boot, and security features such as Shielded VM/vTPM, respectively) and do not control virtualization extension exposure. Therefore, the required first command is Set-VMProcessor VM1 -ExposeVirtualizationExtensions $true, run on Server1.

Because Server1 runs Windows Server 2025 and every existing domain controller runs Windows Server 2019, promoting Server1 requires the AD DS schema to be extended to the Windows Server 2025 version — a step (adprep /forestprep) that the Active Directory Domain Services Configuration Wizard runs automatically on your behalf, but only if the account performing the promotion has sufficient rights to do so. Microsoft documents that running adprep /forestprep requires membership in Schema Admins, Enterprise Admins, and Domain Admins of the domain that hosts the schema master, while adprep /domainprep needs only Domain Admins. Since the forest-wide schema extension is unavoidable in this scenario, User1 needs all three group memberships — Domain Admins, Enterprise Admins, and Schema Admins — to be able to promote Server1, which represents the least-privilege set of rights that still allows the promotion to succeed without a separate administrator pre-running adprep manually before User1 ' s promotion attempt.

Azure Migrate ' s CSV import path for building a business case or an assessment requires exactly four mandatory columns for every server entry: Server name, Cores, Memory in MB, and OS name, and the OS name value must match one of the specific supported OS name strings that Azure Migrate recognizes, or the import validation fails for that row. Every other column available in the official import template -- including IP addresses, disk sizes, disk counts, and CPU or OS version details -- is optional and only improves the accuracy of the resulting sizing and cost assessment rather than being required for the row to import successfully. Servers added through this CSV import path can only be used for assessment purposes; they cannot later be migrated directly from this inventory method, since migration requires discovery through an actual appliance instead. Because only server name, cores, OS name, and memory are enforced as mandatory by Azure Migrate ' s own import validation, that combination is the correct answer, while the other two options each include at least one optional field alongside fields that are not the actual mandatory set.

Register-PSSessionConfiguration -Path .\HyperVJeaConfig.pssc -Name ' HyperVJeaHelpDesk ' -Force

Just Enough Administration constrains what a remote user can do in a PowerShell session by combining a role capabilities file (.psrc, which lists exactly which cmdlets, functions, and parameters a given role is allowed to use -- for example, a curated subset of the Hyper-V module ' s cmdlets) with a session configuration file (.pssc, generated by New-PSSessionConfigurationFile, which ties one or more role capabilities to security principals and session-wide restrictions). Once the .pssc file has been authored, it must be registered as an actual, connectable PowerShell endpoint on Server1 using Register-PSSessionConfiguration, specifying the .pssc file ' s path and a name for the resulting endpoint; -Force allows the registration to proceed even if a session configuration by that name already exists or the WinRM service needs restarting. Enter-PSSession simply starts an interactive remoting session against an existing endpoint and plays no role in creating or registering one. New-PSSessionConfigurationFile only creates the .pssc content -- it does not make the file usable as an actual session endpoint that remote users can connect to. Registering the wrong file type, such as a .ps1 script or .psm1 module, would fail, since Register-PSSessionConfiguration ' s -Path parameter specifically expects a .pssc session configuration file. Therefore, the command must be Register-PSSessionConfiguration -Path .\HyperVJeaConfig.pssc -Name ' HyperVJeaHelpDesk ' -Force.

The App Service Migration Assistant is the specific Microsoft tool built to assess and migrate on-premises IIS-hosted .NET, and also PHP, web applications directly into Azure App Service as native App Service web apps running on the platform ' s own managed compute, without requiring any Docker containerization step at all, which directly matches this scenario ' s requirement that the applications not be containerized. Internally, the App Service Migration Assistant uses the Web Deploy tool to actually push the application ' s content and configuration up to the target App Service web app once the assessment and migration plan have been generated, but Web Deploy on its own is only a content-transfer mechanism and is not the discovery-and-migration tool an administrator would run to start and orchestrate the overall migration. Data Migration Assistant is a completely different tool scoped to assessing and migrating SQL Server databases rather than web applications, and Windows Admin Center and IIS Manager are general-purpose server and IIS management consoles that have no dedicated App Service migration capability whatsoever, so none of those alternatives can perform this specific migration task the way the App Service Migration Assistant is purpose-built to do.