Pass the Microsoft Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-802 Questions and answers with CertsForce

The Failover TCP/IP settings (the IPv4/IPv6 address, subnet, and gateway a replicated VM should assume after failover) are a network-adapter property that only applies to the Replica copy of the virtual machine, so they are configured on VM1 as it exists on the Replica server, Server2 — this is the only place the option is exposed in Hyper-V Manager. A virtual switch, on the other hand, must be present and correctly mapped on both the primary host and the Replica host so that the VM ' s virtual network adapter can connect to a switch whether it is running on Server1 (normal operation) or has failed over to run on Server2, which is why virtual switch configuration needs to be addressed for VM1 on both servers rather than only on the one where failover TCP/IP settings apply. Configuring the Failover TCP/IP settings on Server2 before running the failover test ensures VM1 comes online there with a working static address rather than retaining Server1 ' s original address on an unreachable subnet.

Two-way mirror: 2. Three-way mirror: 5.

A Storage Spaces mirror layout keeps multiple identical copies of every piece of data spread across separate physical disks so that the loss of a disk does not lose data. A two-way mirror keeps two copies of the data, and the minimum configuration that can hold two independent copies across separate physical disks is two disks; this layout tolerates the loss of a single disk. A three-way mirror keeps three copies of the data and is designed to tolerate the simultaneous loss of two disks, but Storage Spaces does not implement this with the naive minimum of three disks; to be able to actually rebuild and re-protect data after a failure (and to spread the write load so that a single physical disk failure does not create a data-loss window while resiliency is temporarily reduced), Microsoft ' s documented minimum requirement for a three-way mirror space is five physical disks. This is a specific, documented number that differs from the pattern one might expect by simply extending the two-way mirror ' s minimum (two disks for two copies) to three copies (which would suggest three disks); the extra disks in the three-way case exist to give Storage Spaces the flexibility it needs to safely place and later re-mirror three copies of every slab of data across the pool. Administrators planning capacity for a three-way mirror pool on a JBOD enclosure must provision at least five disks, not three, before the layout can even be created.

The Protected Users security group in Active Directory is specifically designed to strengthen authentication protection for sensitive and highly privileged accounts by having Windows apply a fixed set of hardening restrictions the moment an account becomes a member, without needing any custom Group Policy authoring or additional infrastructure. Members of Protected Users cannot authenticate by using NTLM, Digest authentication, or CredSSP at all, and their credentials are not cached on the computers they sign into in the same persistent way that ordinary user credentials are, directly satisfying the requirement to prevent cached credentials and legacy protocols from being used by these accounts. Kerberos authentication for Protected Users members is also hardened at the same time by preventing the use of weaker encryption types such as DES and RC4 and by disabling the ability to use a long-lived Kerberos ticket-granting-ticket renewal, further reducing the account ' s exposure to credential theft techniques such as pass-the-hash and pass-the-ticket attacks. The existing Windows Server 2016 domain functional level in this environment is already fully sufficient to support Protected Users functionality, so raising the functional level would accomplish nothing toward this goal. Enabling reversible password encryption would weaken credential security rather than improve it, and while an authentication policy silo is useful for restricting where specific privileged accounts are permitted to authenticate, it does not by itself provide the complete set of credential-caching and legacy-protocol protections that Protected Users membership delivers directly.

Migrate the physical servers to Azure virtual machines: Migration and modernization. Migrate the Hyper-V virtual machines to Azure: Migration and modernization.

Inside the Azure Migrate hub, the Migration and modernization tool, also known as Azure Migrate: Server Migration, is the single unified tool that handles both agent-based replication of physical servers, as well as virtual machines from other clouds, and agentless replication of on-premises Hyper-V virtual machines directly into Azure virtual machines. Because both tasks in this scenario, migrating physical servers and migrating Hyper-V VMs, fall within the scope of this same tool, Migration and modernization is the correct choice for each answer position. Azure Data Box is used for large-scale offline bulk data transfers rather than for live server or VM migration, Data Migration Assistant is scoped specifically to assessing and migrating SQL Server databases, and Movere is a discovery and inventory tool used to assess an environment before migration rather than an engine that performs the actual migration. None of those three tools perform the server or VM migration itself, so Migration and modernization is the only option among those listed that correctly answers both parts of this question.

A broken trust relationship exists because the computer account password Server1 has stored locally no longer matches the password value AD DS holds for the Server1$ computer account, and repairing the secure channel requires both sides of that shared secret to be resynchronized to the same value. Set-ADAccountPassword -Identity " Server1$ " -Reset changes only the AD DS side of that shared secret: it sets a new password value on the computer account object as stored in the directory, but it has no mechanism to also update the local secret Server1 itself has cached, since Set-ADAccountPassword is an Active Directory module cmdlet that operates purely against the directory over LDAP/Kerberos and never touches a computer ' s local machine-account secret store. After running this cmdlet, the two sides of the secure channel are now mismatched in the opposite direction from before (AD DS has the new password, Server1 still has the old one), which does not restore the trust relationship at all and can, in practice, leave the account in exactly the same broken state or worse. Restoring the secure channel properly requires a cmdlet or tool that updates both sides together, such as Test-ComputerSecureChannel -Repair or Reset-ComputerMachinePassword run from Server1 itself, neither of which this solution uses, so this solution does not meet the goal.

Azure Storage Mover uses a purpose-built migration agent that is deployed as its own dedicated virtual machine on the on-premises hypervisor rather than as software layered onto an existing guest operating system, so for a Hyper-V environment the correct first step is to download the agent ' s VHD image from the Storage Mover resource in Azure and use it to create a new, separate agent virtual machine on the Hyper-V host, Server1, that hosts the source VM whose file shares need migrating. Once that agent VM is powered on and registered against the Storage Mover resource using an activation key generated in the portal, it can enumerate and transfer the file shares hosted on VM1 with minimal ongoing administration, running the actual copy jobs in the background while VM1 continues serving those shares, and without installing any agent software inside VM1 itself. This approach differs from Azure Migrate ' s Connected Machine agent, which is used for a different assessment-and-lift-and-shift migration workflow that projects on-premises machines into Azure as Azure Arc resources rather than for file-share transfer through Storage Mover, and installing it on either VM1 or Server1 would not accomplish the file-share migration the scenario requires.

Onboarding Server1 to Microsoft Defender for Endpoint enables endpoint detection and response telemetry, threat protection, and security recommendations for that specific device, but Defender for Endpoint is a separate security product from Microsoft Sentinel and does not configure Server1 as a log source for the Windows Firewall data connector. Onboarding to Defender for Endpoint installs its own sensor and forwards its own telemetry to the Microsoft 365 Defender portal and, when connected, to Sentinel through the Defender for Endpoint connector, but it does not deploy the Azure Monitor Agent or the data collection rule that the Windows Firewall connector specifically depends on to collect Windows Firewall event log entries from Server1. Because these are two independent data pipelines with different underlying agents and different data collection rules, onboarding Server1 to Defender for Endpoint has no effect on whether Windows Firewall logs specifically reach Sentinel through the Windows Firewall connector, so this solution does not meet the stated goal.

An Azure private DNS zone can only be resolved through the Azure-provided DNS resolver (168.63.129.16) by resources inside a virtual network the zone is linked to; it does not expose a directly queryable DNS server IP address that an on-premises server could target across the Site-to-Site VPN, so on-premises DC1 cannot resolve fabrikam.com by itself no matter what zone type it creates locally (ruling out a stub zone or secondary zone, both of which would need a real, reachable authoritative source to transfer from or refer to). The standard solution is to deploy a Windows Server virtual machine inside the linked virtual network and configure it as a DNS forwarder that forwards fabrikam.com queries to the Azure-provided resolver, which it can reach locally within the VNet; that VM ' s own IP address is then reachable from on-premises across the Site-to-Site VPN. With that forwarder VM in place, DC1 on-premises is configured with a conditional forwarder for the fabrikam.com domain pointed at the forwarder VM ' s IP address, so any fabrikam.com query DC1 receives is relayed across the VPN to the forwarder VM, which resolves it against Azure ' s private DNS resolution path. Modifying the VNet ' s DNS Servers setting is unnecessary for this specific requirement, since it changes name resolution for Azure resources, not for on-premises clients.

Command: wecutil qc /q. Server: Server1 only.

wecutil qc, the quick-config option of the Windows Event Collector utility, is the command that enables and starts the Windows Event Collector service on a machine, and it must be run on whichever computer is going to act as the event collector for the subscription. In this scenario, Server1 is the intended destination that will receive the forwarded events from DC1, meaning Server1 is the collector and DC1 is only the event source, so the command must be run on Server1, not on DC1. wevtutil is a related but different utility that manages individual event logs and their configuration, such as querying, exporting, or clearing logs, rather than enabling the collector service itself, so it does not accomplish this task. winrm qc only configures and quick-starts the Windows Remote Management service, which is a separate prerequisite that may need to be enabled on both the source and the collector for subscriptions to function, but running it alone does not enable event collection. Running wecutil qc /q on Server1 alone is therefore the correct command and target to enable the event subscription infrastructure needed to forward events from DC1.

Azure Disk Encryption artifacts (such as the BitLocker/DM-Crypt encryption keys) can be protected in Key Vault by a software-protected key or by a hardware-protected key. Choosing ' key ' (rather than ' certificate ' or ' secret ' ) creates a cryptographic key object that can be used as a key-encryption key to wrap the disk encryption secret before it is written to the vault. Specifying --kty RSA-HSM (as opposed to plain RSA) ensures the key material is generated and protected inside a FIPS 140-validated hardware security module rather than in software, which is the highest level of protection Key Vault offers for this purpose. This matches the completed command shown in the exhibit, and Vault1 must be a Premium-tier vault for the RSA-HSM key type to be available, since HSM-backed keys are not supported on the Standard vault tier. Once artifact1 exists as an RSA-HSM key, its key identifier is supplied to Set-AzVMDiskEncryptionExtension as the key-encryption key parameter so that every BitLocker protector secret written to Vault1 is wrapped by it before storage.