Pass the Microsoft Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-802 Questions and answers with CertsForce

The Active Directory Migration Tool is used to move or restructure objects such as user accounts, groups, and computer accounts between separate Active Directory forests or domains, along with related tasks such as translating security identifiers during an inter-forest migration; it has no function whatsoever related to SYSVOL replication technology, since SYSVOL replication configuration is not one of the object types ADMT operates on. Running ADMT does not convert FRS-based SYSVOL replication to DFS Replication, does not touch the FRS binaries requirement that blocks newer-OS domain controllers from being promoted, and is not even applicable here since this scenario describes a single existing forest and domain rather than a migration between two separate forests. Because ADMT does nothing to remove the actual restriction preventing a Windows Server 2022 domain controller from being added while SYSVOL still uses FRS, running it does not meet the stated goal; only migrating SYSVOL to DFS Replication actually resolves the blocking condition described in the scenario.

Power-state changes to an Azure virtual machine, such as the VM being stopped or deallocated through a control-plane operation, are recorded as administrative entries in the Azure Activity Log, which tracks every subscription-level operation performed against an Azure resource through Azure Resource Manager. Because turning a virtual machine off is exactly this kind of control-plane, administrative operation rather than a metric or a log query result, an alert rule that must fire when a VM is turned off needs to use the Activity Log signal type, configured to filter on the relevant operation name, such as the deallocate or power off action recorded against that specific virtual machine resource. A Log signal type, which is based on Log Analytics and Kusto Query Language queries, is used for alerting on data that has been collected into a Log Analytics workspace, such as performance counters or custom application telemetry, rather than on subscription-level control-plane events like a VM power-state change, so it is not the appropriate signal type here. Service Health is reserved specifically for alerting on Azure platform incidents, planned maintenance, and service issues affecting the platform itself, not on customer-initiated actions such as a specific virtual machine being turned off, so Activity Log is the correct and only appropriate signal type for this alert rule.

hvc.exe, ssh User2@VM2

The requirement is to use a direct SSH session to manage all the supported virtual machines on HyperV1, without relying on a network path to the guest. Hyper-V provides hvc.exe, a helper used as an SSH ProxyCommand, that opens an SSH session to a virtual machine over the VMBus (the internal Hyper-V socket/console channel) rather than over the network, which works even when the guest has no reachable IP configuration and only default management tools installed, matching the stated environment. Direct SSH management this way requires the guest to run an SSH server; of the three VMs, only VM2 runs Red Hat Enterprise Linux, which includes OpenSSH server support out of the box, so it is the only VM realistically " supported " for this direct SSH scenario as described, and the account to use is User2, the local account that exists on VM2. VM1 and VM3 both run Windows Server, so " direct SSH, " as intended by this requirement, targets the Linux guest. Connect-PSSession and Connect-WSMan are PowerShell remoting tools, not SSH, and mstsc.exe launches a graphical Remote Desktop session rather than a console-mode SSH session, so none of those alternatives fit. The correct combination is hvc.exe used as the SSH proxy, connecting as User2@VM2.

Disk1: 2. Disk2: 1.

The requirement is that data on SSPace1 must remain available at all times, meaning the storage pool ' s virtual disks must be able to tolerate physical disk failures without becoming unavailable or losing data. A three-way mirror keeps three copies of every block of data spread across different physical disks, so it remains available and readable even if any two of those disks fail simultaneously; the resiliency is fixed at tolerating two failures regardless of how many total disks (8, in Disk1 ' s case) make up the pool, as long as there are enough disks to support three-way mirroring, which eight comfortably provides. Disk2 uses parity resiliency, which stores a single parity block that can reconstruct data after one physical disk failure; unless dual parity is explicitly configured (which requires being set at virtual disk creation time and is not indicated here), a standard parity virtual disk tolerates only one physical disk failure before data becomes unavailable, regardless of the pool having twelve physical disks. Administrators sometimes assume more disks in a parity pool automatically means more fault tolerance, but the number of disks a parity space can lose is determined by the resiliency configuration (single vs. dual parity), not by the total disk count. Therefore Disk1 tolerates two disk failures and Disk2 tolerates one.

The requirement is that VMs must be configured to enable per-folder quotas. VM3 already has the File and Storage Services role installed, but native NTFS quotas only apply per volume and per user; they cannot restrict the amount of data stored inside an individual folder. File Server Resource Manager (FSRM) is the Windows Server feature that adds true folder-level quota management, letting an administrator define hard or soft quota limits (and quota templates) scoped to specific folders rather than entire volumes, which is exactly the granularity the requirement calls for. Enhanced Storage is an unrelated feature that supports certain storage devices with enhanced storage access (IEEE 1667), Windows Standards-Based Storage Management provides SMI-S/WMI-based management of storage arrays and has nothing to do with folder-level quotas, and the iSNS Server service is used for discovery of iSCSI targets and initiators on a network, also unrelated to quota enforcement. None of those three alternatives provide any per-folder capacity restriction capability, so installing FSRM is the necessary first step before per-folder quotas can be configured on VM3.

Task1 is an Azure Automation runbook, and Azure Automation supports a specific, limited set of runbook types: PowerShell (and PowerShell Workflow), Python, and Graphical runbooks (which are authored visually rather than in a scripting language). Of the listed options, PowerShell and Python are the two genuine scripting languages Azure Automation lets you author a runbook in directly, making them the two correct answers. Java and JavaScript are not supported runbook languages in Azure Automation; JavaScript is used elsewhere in Azure (for example, in Azure Functions or Logic Apps custom code), but not for Automation runbooks. Bicep is a domain-specific language for declaratively defining Azure infrastructure as code (compiling down to ARM templates) and has no role as an executable runbook language; you would not write a Task1 runbook in Bicep, since runbooks execute imperative logic rather than declare resource deployments. Therefore, Python and PowerShell are the two languages available for Task1.

Enabling Microsoft Entra ID sign-in on an Azure VM running Windows is implemented through a VM extension named AADLoginForWindows, published by Microsoft.Azure.ActiveDirectory. This extension installs the components needed for the VM to accept Microsoft Entra credentials for RDP sign-in and, when combined with Azure RBAC roles such as Virtual Machine Administrator Login, controls who is authorized to sign in. VM extensions in Azure are deployed and managed with the Set-AzVMExtension cmdlet, which is how this specific extension gets installed onto Server1. Set-AzVM modifies general virtual machine properties, such as size or OS profile settings, but has no mechanism for installing extensions. Add-ADComputerServiceAccount and New-ADComputer are on-premises Active Directory cmdlets used to manage computer objects and service accounts in AD DS; they have no relevance to an Azure VM ' s sign-in method and would not apply here since Server1 ' s sign-in requirement is being satisfied by Microsoft Entra ID, not by joining a domain. Set-AzVMExtension is therefore the correct cmdlet.

Azure Automanage currently does not support virtual machines that use the Trusted launch security type; this is an explicit, documented limitation of the service, independent of which Windows Server version or edition the VM is running. Looking at the four virtual machines ' security types, Server1 (Windows Server 2022 Datacenter: Azure Edition) and Server4 (Windows Server 2019 Datacenter) are both configured with Trusted launch, which makes both of them ineligible for Automanage onboarding regardless of their OS version. Server2 (Windows Server 2022 Datacenter: Azure Edition) and Server3 (Windows Server 2022 Datacenter) both use the Standard security type and run OS versions on Automanage ' s supported list, so both qualify and Automanage should be enabled on them to satisfy the requirement that it be used on " all supported " virtual machines, which by definition excludes the ones the service cannot onboard. It is a common misreading of this scenario to assume the Azure Edition label is the deciding factor, since Server1 and Server2 share that edition; the actual determining attribute the requirement hinges on is the VM ' s security type, not its Windows Server edition. Therefore Server2 and Server3 are the correct machines on which to enable Automanage.

1. roles 2. connections 3. connect to server dc2.adatum.com 4. quit 5. seize schema master

Because DC1 has failed and cannot gracefully transfer the schema master role, DC2 must forcibly seize it using ntdsutil.exe. From the initial ntdsutil prompt, the first command is roles, which enters the Role Management submenu where FSMO role transfers and seizures are performed. From within that submenu, the command connections opens the Connections submenu, which is required before you can bind ntdsutil to a specific target domain controller. Inside the Connections submenu, connect to server dc2.adatum.com establishes the bind to DC2, the domain controller that will actually take over the schema master role. The quit command then exits the Connections submenu and returns to the Role Management submenu while keeping the established connection to DC2 active. Finally, seize schema master, executed from the Role Management submenu while bound to DC2, forces DC2 to take ownership of the schema master role even though DC1 (the previous holder) is offline and cannot be contacted to confirm the transfer. The unused command in the list, metadata cleanup, is a separate, later step used to remove the failed DC1 ' s leftover directory metadata once its roles have been reassigned; it is not part of seizing the schema master role itself, so it is correctly left out of this five-step sequence.

1. Deploy the Azure Storage Sync service. 2. Install and register the Azure File Sync agent. 3. Create a sync group. 4. Add a server endpoint.

Data1 is a file share on VM1 that must be synced to the Azure Files share1 using Azure File Sync. The documented deployment order starts in Azure: you must first deploy a Storage Sync Service resource, because the on-premises agent registration process needs an existing Storage Sync Service to register against. With that resource in place, the next step, already fixed in the sequence, is to install the Azure File Sync agent on VM1 and register the server with the Storage Sync Service, which establishes the server ' s identity and trust relationship with Azure. After registration, you create a sync group, the container that pairs one Azure file share (the cloud endpoint) with one or more on-premises folders (server endpoints); the sync group must exist before endpoints can be attached to it. Finally, you add a server endpoint pointing at the Data1 path on VM1, which starts the actual namespace and content synchronization with share1. Installing the DFS Replication role service and installing the Storage Replica feature are unrelated technologies, DFS-R replicates between on-premises servers and Storage Replica performs block-level volume replication, neither of which is part of an Azure File Sync deployment, so both are correctly excluded from the sequence.