2026 Actual Microsoft AZ-802 Dumps, Updated Exam Questions for Guaranteed Pass

AZ-802 free sample questions and answers

Microsoft AZ-802 practice quiz with correct answers for search indexing.

1. Question 1

   You are remediating the firewall security risks to meet the security requirements. What should you configure to reduce the risks?

   Aa Group Policy Object (GPO)
   

   Badaptive network hardening in Microsoft Defender for Cloud
   

   Ca network security group (NSG) in Sub1
   

   Dan Azure Firewall policy
   

   Correct answer: A

   Server administrators can be prevented from configuring Windows Defender Firewall rules by defining firewall policy centrally in a Group Policy Object and linking it to the servers' organizational unit(s); domain-based GPO firewall policy overrides any local, administrator-configured Windows Defender Firewall rules on the domain-joined servers, since Group Policy-delivered firewall settings take precedence over local policy. Adaptive network hardening in Microsoft Defender for Cloud only generates recommendations to tighten network security group (NSG) rules protecting Azure resources -- it has no visibility into or control over host-based Windows Defender Firewall configuration on on-premises servers. A network security group (NSG) in Sub1 filters traffic at the Azure virtual network boundary and has no bearing on the on-premises Chicago office servers described in the scenario. An Azure Firewall policy governs the centrally managed Azure Firewall network virtual appliance, not the host-based Windows Defender Firewall running locally on each on-premises server. Because the servers in question are on-premises and domain-joined, only a Group Policy Object can centrally enforce and lock down their local Windows Defender Firewall configuration, preventing server administrators from modifying the rules directly on each machine. Therefore, configuring a GPO is the correct way to reduce this security risk.

   
   

2. Question 2

   You are administering a multi-site Active Directory environment with domain controllers distributed across three geographic locations. A new site has been added to the infrastructure, and you need to ensure that replication topology is optimized and that the Knowledge Consistency Checker (KCC) generates the appropriate connection objects between sites.

   What should you do to verify and optimize the replication topology for the new site?

   ARun the kcc.exe utility from an elevated command prompt on each domain controller, then use repadmin /kcc to force KCC recalculation across all sites
   

   BManually create connection objects in Active Directory Sites and Services between the new site and all existing sites, then disable automatic KCC topology generation
   

   CConfigure the new site with a lower site link cost than existing sites to ensure it receives preferential replication traffic
   

   DUse the Set-ADReplicationSiteLink cmdlet to assign the new site a unique GUID and force immediate replication convergence
   

   Correct answer: A

   The correct answer is to run the kcc.exe utility and use repadmin /kcc to force KCC recalculation. The Knowledge Consistency Checker is the Active Directory service that automatically generates replication connection objects based on site topology. By running repadmin /kcc on one or more domain controllers, you force the KCC to immediately recalculate the topology for the new site, ensuring optimal replication paths are created. This is the standard and recommended approach for optimizing replication after topology changes.

   Why the other options are incorrect:

   • Manually creating connection objects is not necessary and disabling KCC removes the automatic optimization that ensures replication converges properly.
   • Adjusting site link costs does not directly address topology optimization for the new site and does not guarantee proper connection object creation.
   • The Set-ADReplicationSiteLink cmdlet does not assign GUIDs to sites; sites already have GUIDs, and this cmdlet is for modifying link properties, not forcing KCC recalculation.

3. Question 3

   You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains the resources shown in the following table. Sub1 has Microsoft Defender for Servers enabled. You are assigned the Contributor role for Sub1. You need to implement just-in-time (JIT) VM access for VM1. What should you do first? (Exhibit: resources table.)

   

   Resources in RG1

   AEnable enhanced security in Microsoft Defender for Cloud.
   

   BRequest the Owner role for Sub1.
   

   CCreate a network security group (NSG).
   

   DCreate an application security group.
   

   Correct answer: C

   Just-in-time VM access works by dynamically tightening and loosening inbound rules on a network security group, or on Azure Firewall, that protects the target virtual machine, so Microsoft Defender for Cloud requires an NSG to already be associated with the VM's network interface or with its subnet before a JIT access policy can be created for it at all; without an NSG in place, the JIT configuration blade has nothing to apply its dynamically scoped allow rules to and the feature cannot be enabled. Microsoft Defender for Servers is already enabled on the subscription per the scenario, so there is no need to enable enhanced security again before configuring JIT, and the Contributor role already held on Sub1 is sufficient to configure JIT policies, since it includes the necessary Microsoft.Security/locations/jitNetworkAccessPolicies/write and Microsoft.Compute/virtualMachines/write permissions, making a request for the Owner role unnecessary overhead. An application security group serves a different purpose, namely grouping virtual machines together as a single unit for NSG rule targeting, and it does not substitute for the underlying NSG itself, so creating one would not unblock enabling JIT access for VM1. Creating and associating an NSG with VM1 is therefore the required first step.

   
   

4. Question 4

   You are troubleshooting authentication failures in a Windows Server forest with three domains. Users in the child domain report intermittent Kerberos authentication errors when accessing resources in the parent domain, particularly after domain replication events. The forest has bidirectional transitive trusts configured correctly. You suspect the issue relates to Kerberos ticket validation across domain boundaries.

   Which two of the following should you investigate or configure to resolve this issue?

   AVerify that the secure channel between domain controllers is healthy and that the NetLogon service is running on all DCs
   

   BCheck the system time synchronization across all domain controllers, as Kerberos is time-sensitive
   

   CDisable bidirectional trust relationships and replace them with unidirectional trusts for better security
   

   DIncrease the Kerberos ticket lifetime to 24 hours to reduce ticket renewal frequency
   

   EConfigure a dedicated Key Distribution Center (KDC) exclusively for child domain resources
   

   Correct answer: A, B

   The correct answers are: Verify that the secure channel between domain controllers is healthy and that the NetLogon service is running on all DCs and Check the system time synchronization across all domain controllers, as Kerberos is time-sensitive.

   Intermittent Kerberos failures across domain boundaries typically stem from two root causes: (1) broken secure channels or NetLogon service issues that prevent proper trust validation, and (2) time skew across DCs, since Kerberos uses timestamps for ticket validation and synchronization can drift after replication events. Checking event logs on child domain DCs for trust errors and using the nltest utility to verify secure channels are essential troubleshooting steps.

   Disabling transitive trusts would eliminate the entire trust relationship rather than fix it. Modifying Kerberos ticket lifetime is a global policy change and does not address the root cause of intermittent failures. Creating a dedicated KDC is not a supported architecture and would further complicate the trust topology.

5. Question 5

   You have servers that run Windows Server 2022 as shown in the following exhibit: Server1 (on-premises, hosts a Microsoft SQL Server 2019 instance), Server2 (Azure, contains the .NET SDK, hosts a .NET app named App1). You need to establish a WebSocket connection from App1 to the SQL Server instance on Server1. The solution must meet the following requirements: minimize the number of network ports that must be open on the on-premises network firewall; minimize administrative effort. What should you create first?

   

   Server1 (on-premises, SQL Server 2019) / Server2 (Azure, .NET SDK, hosts App1).

   Aan Azure Relay namespace
   

   Ban Azure VPN gateway
   

   Ca WCF relay connection
   

   Da hybrid connection
   

   Correct answer: A

   Azure Relay's Hybrid Connections capability is built specifically to expose an on-premises TCP endpoint, such as a SQL Server instance, to a cloud application without opening any inbound port on the on-premises firewall: an on-premises Hybrid Connection Manager makes only an outbound connection to the relay, and the cloud application (App1) connects to the same relay, so traffic tunnels through a connection the on-premises network itself initiated. Both the WebSocket-based transport and the automatic connection management of Hybrid Connections satisfy the requirements to minimize open firewall ports and administrative effort far better than standing up a full site-to-site network path. However, a Hybrid Connection is a resource that must live inside an Azure Relay namespace, which is the container resource that has to exist first before any individual Hybrid Connection (or WCF relay) can be created within it; you cannot create a Hybrid Connection without first provisioning the namespace that will hold it. An Azure VPN gateway would establish full network-level connectivity between the networks, which is a heavier-weight solution requiring more firewall ports and more ongoing administrative overhead than is justified for reaching a single SQL endpoint. A WCF relay connection is an older, more complex Azure Relay capability aimed at SOAP/WCF scenarios and is not the modern minimal-effort choice for a WebSocket-based connection. Because the Relay namespace is the prerequisite container, it must be created first.