About these questions
These five questions are original. We wrote them in the style of the AZ-802 skills measured, using scenarios like those an administrator meets at work. They are not real exam questions, and the real exam will word things differently. Five questions cannot cover all seven domains, so these touch Active Directory, hybrid management, storage, security, and monitoring. The domains explained page covers the rest.
How to use these
Try each question without looking at your notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped and revisit it in the study plan.
Question 1 (Deploy and manage AD DS)
Northwind Traders keeps all of its user accounts in the forest northwind.com. It moves its legacy applications into a new resource forest, tailspin-apps.com. Northwind users must be able to reach servers in tailspin-apps.com. Accounts in tailspin-apps.com must not be able to reach anything in northwind.com. Which trust should you create?
- A. A two-way forest trust between northwind.com and tailspin-apps.com
- B. A one-way forest trust in which northwind.com trusts tailspin-apps.com
- C. A one-way forest trust in which tailspin-apps.com trusts northwind.com
- D. A one-way external trust in which northwind.com trusts tailspin-apps.com
Show the answer and explanation
Correct answer: C. In a one-way trust, users in the trusted domain or forest can reach resources in the trusting one, but not the other way around. Northwind holds the accounts and tailspin-apps.com holds the resources, so tailspin-apps.com must trust northwind.com. Option B is the closest wrong answer because it reverses the direction, which would let tailspin-apps.com users reach Northwind resources and leave Northwind users locked out. A two-way trust gives both sides access, which breaks the requirement. An external trust in the wrong direction has the same problem as B.
Question 2 (Manage Windows Server instances and workloads in a hybrid environment)
Adatum is building a Just Enough Administration endpoint on the member server SRV-PRINT1. A role capability file named PrintOps.psrc already lists the commands that are allowed. Where do you state that members of ADATUM\PrintHelpers receive the PrintOps role?
- A. In the RunAsVirtualAccount setting of the session configuration file
- B. In the VisibleCmdlets field of PrintOps.psrc
- C. In the TranscriptDirectory setting of the session configuration file
- D. In the RoleDefinitions setting of the session configuration file
Show the answer and explanation
Correct answer: D. JEA splits what a user may do from who may do it. The role capability file (.psrc) lists allowed commands, using fields such as VisibleCmdlets. The session configuration file (.pssc) defines the endpoint and maps groups to roles through RoleDefinitions. Option B is the closest wrong answer: it sits in the right file family but controls the allowed commands, not who gets the role. RunAsVirtualAccount decides which identity runs the commands, and TranscriptDirectory only sets where session transcripts are saved.
Question 3 (Manage storage and file services)
Litware’s standalone file server has a Storage Spaces pool with 8 TB of usable capacity. Three teams each ask for a 4 TB virtual disk today, although each team stores less than 500 GB. The company will buy more physical disks only when real usage grows. Which provisioning approach should you use?
- A. Fixed provisioning with a two-way mirror layout
- B. Fixed provisioning with a simple layout
- C. Thin provisioning, with free pool capacity monitored
- D. Fixed provisioning with a parity layout
Show the answer and explanation
Correct answer: C. Thin provisioning takes capacity from the pool only as data is written, so you can create virtual disks whose combined size is larger than the pool and add physical disks later. The cost is that you must watch free pool space, because the pool can run out before the virtual disks look full. Fixed provisioning reserves the full size when the disk is created, so three 4 TB fixed disks (12 TB) cannot fit in an 8 TB pool whatever the layout. Option B is the closest wrong answer, since a simple layout uses the least raw space, but it still cannot fit and it gives no resiliency.
Question 4 (Secure Windows Server infrastructure)
Wingtip Toys wants Windows LAPS to manage the Directory Services Restore Mode (DSRM) account password on its domain controllers, so that each recovery password is stored centrally and rotated. The domain currently runs at the Windows Server 2012 R2 functional level. Which two requirements must be met? Choose two.
- A. The legacy Microsoft LAPS client-side extension must be installed on each domain controller
- B. Password encryption must be enabled, which requires the Windows Server 2016 domain functional level or later
- C. The passwords must be backed up to Microsoft Entra ID
- D. The passwords must be backed up to Windows Server Active Directory
- E. Password encryption must be turned off so Domain Admins can read the passwords
Show the answer and explanation
Correct answers: B and D. Windows LAPS can manage the DSRM password of a domain controller, but it can store it only in Windows Server Active Directory, and only with password encryption enabled. Encryption in Active Directory needs the 2016 domain functional level or higher, so Wingtip must raise its level from 2012 R2. Option C is the closest wrong answer, because Entra ID is a valid backup target for other local accounts but not for the DSRM account. Option A is wrong because Windows LAPS is built into current Windows Server and does not use the legacy extension. Option E is wrong because authorized users can still read an encrypted password, so turning encryption off is neither required nor allowed for this scenario.
Question 5 (Monitor and troubleshoot Windows Server environments)
Two days after enabling System Insights on SRV-APP2, an administrator opens Windows Admin Center and sees the status None for the volume consumption forecasting capability. What does this status mean?
- A. The capability ran and predicts no growth, so no action is needed
- B. The capability failed to run because of an unknown problem
- C. No prediction was made, for example because too little data has been collected
- D. SRV-APP2 has no volumes that could be forecast
Show the answer and explanation
Correct answer: C. System Insights capabilities report one of five statuses: Ok, Warning, Critical, Error, or None. None means no prediction was made, which can happen when a capability has not yet collected enough history, as on a server where the feature was just turned on. Error is the closest wrong answer; it means the capability tried and failed, which would call for troubleshooting rather than waiting. A prediction of no growth would be reported with a status such as Ok, not None. The scenario gives no sign that the server lacks volumes.
More guides for AZ-802
- AZ-802 Exam Format: Time, Scoring, Retakes
- Is AZ-802 Hard? An Honest Difficulty Check
- AZ-802 Prerequisites: What to Know First
- AZ-802 Renewal and Retakes Explained
- Is AZ-802 Worth It? An Honest Look
- AZ-802 Cheat Sheet: Key Facts to Review
- AZ-104 vs AZ-802: Which First?
Next step
If a question surprised you, read the matching section in domains explained. For more questions in this style, our AZ-802 practice tests contain 500 original questions across all seven domains. Microsoft’s AZ-802 study guide remains the reference for what is tested.