The short version
AZ-802 has seven domains. Active Directory is the biggest at 20-25%, followed by storage and by monitoring and troubleshooting at 15-20% each. The other four sit at 10-15%. Weightings describe the share of the exam, not the share of difficulty, so a 10-15% domain can still cost you a pass. The “traps” below are our general advice from how these topics are usually confused, not statements from Microsoft.
Deploy and manage AD DS (20-25%)
What it covers. Domain controllers on-premises and in Azure, read-only domain controllers (RODCs) and their account security, and managing and troubleshooting operations master (FSMO) roles. Then trusts, sites, and replication across multiple domains and forests; users, groups, and service accounts; and Group Policy with preferences.
In practice. You add a domain controller to a branch office, decide which accounts may cache on an RODC, move a role before maintenance, or pick the right trust between two forests. You choose between a managed service account type and a regular account for a service.
Typical traps. Mixing up a transfer and a seizure of a role. Getting the direction of a trust backward. Forgetting that site and subnet design decides which domain controller a client uses. Confusing Group Policy settings with preferences.
Practice. Build a two-domain lab, create a trust, move all five roles with PowerShell, and break replication on purpose to read the output.
Manage Windows Server instances and workloads in a hybrid environment (10-15%)
What it covers. Windows Admin Center on-premises and in the Azure portal, PowerShell remoting (including the double-hop problem and Just Enough Administration), SSH, and remote desktop. Then Azure Arc-enabled servers, device configuration through Arc, VM extensions on machines outside Azure, Azure Update Manager, and Azure Automation runbooks.
In practice. You connect existing servers to Azure, apply a baseline, patch them on a schedule, and give a help desk team a limited endpoint instead of full admin rights.
Typical traps. Treating JEA as a permissions list for everyone: the role capability file says what is allowed, while the session configuration says who gets which role. Assuming Arc needs inbound firewall ports. Mixing up what runs on the server (the agent) and what runs in Azure.
Practice. Onboard a lab server to Arc, install an extension, run an update assessment, and create a JEA endpoint for one job.
Manage virtual machines (10-15%)
What it covers. Hyper-V features such as enhanced session mode, PowerShell Direct, nested virtualization, memory settings, integration services, device assignment, GPU partitioning, checkpoints, high availability, virtual hard disks, network adapters, NIC teaming, virtual switches, and Hyper-V Replica. It also covers Windows Server VMs in Azure: storage, resizing, scale sets, availability sets and zones, just-in-time access, Azure Bastion, and network configuration.
In practice. You enable nested virtualization for a test host, replicate a VM to another site, give one VM a dedicated GPU, or resize an Azure VM and keep its disks.
Typical traps. Mixing up host-to-guest tools: some copy files only in one direction, and some work when the guest has no network. Forgetting that a feature may need a setting changed while the VM is off. Confusing availability sets with availability zones.
Practice. Practice each task in both PowerShell and the graphical tool, since questions mention cmdlets as often as screens.
Implement and manage an on-premises and hybrid networking infrastructure (10-15%)
What it covers. DNS integrated with AD DS, zones and records, forwarding and conditional forwarding, hybrid name resolution, DNS policies, and DNSSEC. Also DHCP: the role, scopes, reservations, high availability, and troubleshooting IP addressing in hybrid environments.
In practice. You make internal and external users see different answers for one name, forward queries for a partner namespace, or keep DHCP running when one server fails.
Typical traps. Choosing a stub zone when a conditional forwarder is the lighter answer. Setting a static IP inside an Azure VM guest when the address belongs on the Azure network interface. Not noticing which replication scope an AD-integrated zone or forwarder uses.
Practice. Build split DNS with a policy, set up a DHCP failover pair, and read the options of each DNS cmdlet.
Manage storage and file services (15-20%)
What it covers. Three groups. Azure Files: shares, permissions, Azure File Sync, monitoring, and migrating from DFS or other shares. Windows file shares: access, File Server Resource Manager, DFS, SMB over QUIC, and SMB settings. Local storage: disks and volumes, Storage Spaces and Storage Spaces Direct, Storage Replica, deduplication, SMB Direct, Storage QoS, NTFS and ReFS, iSCSI, and BitLocker with recovery.
In practice. You pick a resiliency type for a given number of disks, block file types with a screen, sync a branch server to a cloud share, or recover a BitLocker volume.
Typical traps. Picking a resiliency layout that needs more disks or servers than the scenario has. Confusing a file screen with a quota. Forgetting prerequisites such as the order in which File Sync is deployed.
Practice. Create each Storage Spaces layout in a lab, note the minimum disk counts, and run File Sync end to end once.
Secure Windows Server infrastructure (10-15%)
What it covers. Operating system security: exploit protection, Application Control, Credential Guard, SmartScreen, Group Policy security, security baselines with OSConfig, Windows LAPS, Defender for Servers, and Windows Firewall with connection security rules. Then securing AD DS: password policies, Microsoft Entra Password Protection, protected users, hardening and restricting domain controllers, user account options, built-in admin groups, delegation, and authentication protocols.
In practice. You limit who can sign in to a domain controller, rotate local admin passwords, stop an account from being delegated, or phase out an older authentication protocol without breaking applications.
Typical traps. Applying a restrictive setting before auditing who still uses the old method. Mixing protection features that sound alike but guard different things. Forgetting a requirement such as a minimum domain functional level.
Practice. For each feature, write down its prerequisite and how you would test its effect safely.
Monitor and troubleshoot Windows Server environments (15-20%)
What it covers. Monitoring with Performance Monitor, data collector sets, Windows Admin Center alerts, System Insights, and event logs, plus Azure Monitor data collection rules, alerts, and VM Insights. Troubleshooting covers connectivity, name resolution, Windows Update, time service, performance, VM and Arc extension problems, disk encryption, and storage. The Active Directory part covers the recycle bin, Directory Services Restore Mode, SYSVOL recovery, replication, Kerberos, and secure channel trust.
In practice. A server is slow, a computer account has lost trust with the domain, or an object was deleted yesterday. The question gives symptoms, and you choose the first diagnostic step or the least risky fix.
Typical traps. Choosing a drastic fix (such as rebuilding) when a targeted one exists. Skipping the question’s constraint, such as “no downtime”. Misreading a status that means “no data yet” as “everything is fine”.
Practice. Break things in your lab: stop the time service, reset a computer account, delete an object, and walk through the fix.
More guides for AZ-802
- AZ-802 Exam Format: Time, Scoring, Retakes
- Is AZ-802 Hard? An Honest Difficulty Check
- AZ-802 Prerequisites: What to Know First
- AZ-802 Renewal and Retakes Explained
- Is AZ-802 Worth It? An Honest Look
- AZ-802 Cheat Sheet: Key Facts to Review
- AZ-104 vs AZ-802: Which First?
Next step
Take the sample questions to see how these domains are tested, then match your weak spots to the study plan. Our AZ-802 practice tests report on all seven domains. For the exact skills list, the Microsoft Learn study guide is the authority.
Frequently asked questions
Which domain should I study first?
Start with Active Directory. It has the biggest weighting, and many other topics (Group Policy, DNS, security) build on it.
Do the weightings tell me how many questions each domain has?
They are approximate shares of the exam. Microsoft does not publish the exact number of questions per domain.