What's below: 12 scenario-based questions weighted toward AZ-802's two heaviest domains — Deploy and manage AD DS (3 questions) and storage/monitoring (2 each) — with single questions covering hybrid workload management, security, virtual machines, and networking. Each question includes why the correct choice is right and why every distractor is wrong, since spotting why a plausible-sounding answer fails is most of what the real exam tests.
The scenarios below come straight from Microsoft's official AZ-802 exam domains. We re-check them against our audited 500-question AZ-802 practice bank so nothing drifts out of date.
AD DS Scenarios (Questions 1-3)
How do you protect a branch-office domain controller with weak physical security?
A branch office has an unreliable WAN link and no locked server room. Local staff must not be able to authenticate using cached Domain Admins credentials if the server is stolen. Which deployment best meets this?
- A. A standard writable domain controller with a strong local firewall policy
- B. A Read-Only Domain Controller (RODC) with Domain Admins excluded from the Allowed RODC Password Replication Group✓ Correct
- C. A member server running AD LDS instead of a domain controller
- D. A writable domain controller with BitLocker and no cached credential changes
Why B is correct: RODCs only cache credentials for accounts explicitly allowed to replicate to them. Excluding Domain Admins (and any other privileged group) from the Allowed RODC Password Replication Group means those credentials are never cached locally, so theft of the box exposes only non-privileged cached accounts.
Why A is wrong: A writable DC caches credentials for any account that has logged on, including privileged ones — a firewall policy does nothing to stop offline extraction of the NTDS.dit database if the box is physically stolen.
Why C is wrong: AD LDS is a lightweight directory service for application data — it isn’t a domain controller and can’t authenticate domain logons for the branch at all.
Why D is wrong: BitLocker protects data at rest if the drive is removed while powered off, but it doesn’t change which credentials a writable DC caches while running — an attacker with console access while the DC is online can still extract cached credentials.
A domain controller holding the RID Master role fails permanently — what do you do?
The domain controller holding the RID Master FSMO role suffers a motherboard failure and won’t return. No other DC will be rebuilt with the same name. What’s the correct recovery step?
- A. Transfer the RID Master role using Active Directory Users and Computers
- B. Seize the RID Master role onto a surviving DC using ntdsutil, then never bring the failed DC back online✓ Correct
- C. Demote and repromote every remaining domain controller
- D. Wait for AD DS replication to automatically reassign the role
Why B is correct: Seizing is the correct operation when the role holder is unrecoverable — it forcibly assigns the role to another DC. The failed DC must never rejoin the domain afterward, since it may still believe it holds the role and could issue duplicate RIDs.
Why A is wrong: A graceful transfer requires the source DC to be online and reachable so it can hand off the role cleanly. A permanently failed DC can’t participate in a transfer.
Why C is wrong: This is unnecessary and disruptive — FSMO role recovery only requires action on the specific role that was lost, not a rebuild of the entire domain controller fleet.
Why D is wrong: FSMO roles are single-master operations by design — replication does not auto-elect a new holder. An administrator must explicitly seize the role.
Two companies are merging — which trust direction lets Domain A users access Domain B resources without the reverse?
Company A’s users need to access file shares in Company B’s domain after a partial merger, but Company B’s users must not be able to access anything in Company A’s domain. Which trust configuration is correct?
- A. A two-way transitive forest trust between both domains
- B. A one-way trust where Domain B trusts Domain A✓ Correct
- C. A one-way trust where Domain A trusts Domain B
- D. A shortcut trust within a single forest
Why B is correct: In a one-way trust, the trusting domain’s resources become available to the trusted domain’s users. Domain B trusting Domain A lets Domain A’s users authenticate against Domain B’s resources, while Domain B’s users get no reciprocal access.
Why A is wrong: A two-way trust lets both sides authenticate into each other, which violates the requirement that Company B users have no access into Company A.
Why C is wrong: This is the reverse of what’s needed — it would let Domain B’s users access Domain A’s resources, not the other way around.
Why D is wrong: Shortcut trusts optimize authentication paths between domains that are already in the same forest and already have an implicit trust path — they don’t apply to two separate companies with separate forests.
Storage and File Services Scenarios (Questions 4-5)
How do you migrate an on-premises DFS namespace to Azure without disrupting UNC paths?
A company wants to move its DFS namespace file shares to Azure while keeping the same \\contoso.com\shares UNC path that users and scripts already reference. What’s the right approach?
- A. Recreate the shares as Azure Files and tell users to remap drives to the new storage account URL
- B. Use Azure File Sync with the existing DFS namespace as an endpoint, syncing data to an Azure file share while DFS continues serving the same namespace path✓ Correct
- C. Convert the DFS namespace to a Storage Spaces Direct volume
- D. Export the shares with Robocopy and re-import them into a new Azure VM file server
Why B is correct: Azure File Sync is designed for exactly this: it tiers and syncs data between on-premises servers and an Azure file share while DFS Namespaces continues to provide the same UNC path users already use, keeping the migration transparent.
Why A is wrong: This breaks every existing UNC reference and script, which is exactly what the requirement says to avoid — it also skips the migration tooling built for this scenario.
Why C is wrong: Storage Spaces Direct builds hyper-converged local storage for clustered VMs — it has no relationship to migrating a DFS namespace to Azure and doesn’t preserve UNC paths.
Why D is wrong: A one-time copy doesn’t provide the ongoing sync, tiering, or namespace continuity that Azure File Sync provides, and still requires repointing the namespace.
Which storage feature protects data if an entire datacenter site goes offline?
A Windows Server cluster spans two sites. The requirement is that all volumes stay available and current if one entire site loses power. Which feature should be configured between the sites?
- A. Storage Spaces Direct within a single site
- B. Storage Replica configured for synchronous replication between the two sites✓ Correct
- C. Data Deduplication enabled on both sites independently
- D. File Server Resource Manager quotas split across both sites
Why B is correct: Storage Replica is built specifically for site-to-site (or cluster-to-cluster) volume replication. Synchronous mode guarantees writes are committed to both sites before being acknowledged, so a full site outage leaves the surviving site with fully current data.
Why A is wrong: Storage Spaces Direct pools local disks across cluster nodes for high availability inside one site — it doesn’t replicate data to a second, physically separate site by itself.
Why C is wrong: Data Deduplication reduces storage footprint by eliminating redundant blocks — it has no replication or availability function between sites.
Why D is wrong: FSRM manages quotas, screening, and reporting on file shares — it does not replicate or protect data across sites.
Halfway through — how are you scoring?
These 12 are a sample. MSCertQuiz's full AZ-802 bank has 500 questions across all 7 domains — 40 free to start.
Try 40 Free AZ-802 QuestionsMonitoring and Troubleshooting Scenarios (Questions 6-7)
What’s the right tool to monitor CPU/memory/disk performance of a non-Azure server?
A physical Windows Server that has been onboarded to Azure Arc needs the same performance dashboards the team already uses for its Azure VMs. What should be configured?
- A. Local Performance Monitor data collector sets only, exported manually
- B. VM Insights, enabled through the Azure Monitor agent on the Arc-enabled server✓ Correct
- C. Windows Admin Center alerts with no Azure Monitor integration
- D. System Insights forecasting rules only
Why B is correct: VM Insights works for both Azure VMs and Azure Arc–enabled servers once the Azure Monitor agent is deployed, giving the same performance dashboards and health views regardless of whether the underlying machine is in Azure or on-premises.
Why A is wrong: This works locally but doesn’t produce the centralized, Azure-native dashboards the team wants, and doesn’t scale across multiple Arc-enabled servers.
Why C is wrong: Windows Admin Center provides useful local alerting, but it’s a separate tool from Azure Monitor and won’t produce the same centralized dashboards used for Azure VMs.
Why D is wrong: System Insights predicts future resource exhaustion using local machine learning models — it’s a forecasting feature, not the general performance-monitoring dashboard being asked for here.
AD replication has stalled between two sites — what’s the first diagnostic step?
Users in a branch site report stale group membership changes. You suspect AD DS replication has failed between the branch site’s DC and the hub site. What should you check first?
- A. Run repadmin /showrepl on both domain controllers to check replication status and last successful sync time✓ Correct
- B. Immediately seize all FSMO roles to the hub site DC
- C. Rebuild the branch site DC from a system state backup
- D. Disable the Group Policy that manages account lockout
Why A is correct: repadmin /showrepl is the standard first diagnostic for AD replication problems — it shows the last attempt, last success, and any error codes per replication partner, immediately narrowing down whether the issue is connectivity, DNS, or a specific partner failure.
Why B is wrong: Seizing FSMO roles is a destructive last resort for a permanently failed role holder — it isn’t a diagnostic step and is inappropriate for a replication delay where both DCs are still online.
Why C is wrong: This skips diagnosis entirely and risks reintroducing the same replication problem if the root cause (e.g., a WAN or DNS issue) isn’t identified first.
Why D is wrong: This is unrelated to replication — stale group membership isn’t caused by a lockout policy, and disabling it doesn’t diagnose or fix a sync problem.
Hybrid Workload Management Scenarios (Questions 8-9)
How do on-premises servers get Defender for Servers and Update Manager coverage?
A company runs 40 on-premises Windows Servers with no direct internet-facing management endpoint. Leadership wants the same Microsoft Defender for Servers protection and Azure Update Manager patch visibility used on their Azure VMs. What’s the required first step?
- A. Install Microsoft Defender for Endpoint manually on each server with no other configuration
- B. Onboard the servers to Azure Arc so they get an Azure resource ID, then enable Defender for Servers and Update Manager against the Arc-enabled machines✓ Correct
- C. Move all 40 servers into Azure as VMs
- D. Configure a site-to-site VPN and treat the servers as if they were already Azure resources
Why B is correct: Azure Arc is the prerequisite that projects an on-premises server into Azure as a manageable resource. Once Arc-enabled, the same Azure-native services — Defender for Servers, Azure Update Manager, Azure Policy — extend to it exactly as they do for Azure VMs.
Why A is wrong: Defender for Endpoint alone doesn’t connect the servers to Azure Update Manager or give them an Azure resource identity — it’s only one piece of what’s needed.
Why C is wrong: A full migration is a far larger undertaking than the requirement calls for, and isn’t necessary — Azure Arc extends Azure management capability to servers without moving them.
Why D is wrong: A VPN provides network connectivity but doesn’t register the servers as Azure resources — without Arc onboarding, services like Defender for Servers and Update Manager have no resource to attach to.
How do you let a junior admin restart a specific service remotely without giving them full admin rights?
A junior administrator needs to restart one specific Windows service on a set of servers via PowerShell remoting, but must not be granted local Administrator rights on those servers. What should you configure?
- A. Add the junior admin to the local Administrators group but train them not to run other commands
- B. Configure a Just Enough Administration (JEA) endpoint that exposes only the specific cmdlet needed to restart that service✓ Correct
- C. Enable double-hop authentication for the junior admin’s session
- D. Grant Remote Desktop access instead of PowerShell remoting
Why B is correct: JEA lets you define a constrained PowerShell endpoint that exposes only approved cmdlets and parameters to a specific role, so the junior admin can restart the named service through PowerShell remoting without any broader administrative access.
Why A is wrong: This grants full administrative rights, which is precisely what the requirement says to avoid — training isn’t an access control and doesn’t technically restrict what they can run.
Why C is wrong: Double-hop configuration solves a specific credential-passing problem in multi-server remoting scenarios — it has nothing to do with restricting which commands a user can run.
Why D is wrong: RDP access to the desktop doesn’t restrict what the user can do once logged in, and doesn’t address the requirement to limit access to one specific action.
Security Scenario (Question 10)
Which feature prevents pass-the-hash attacks using cached derived credentials?
A security review flags that an attacker with local admin on one server could extract cached credentials and reuse the underlying hash to move laterally to other servers. Which built-in feature is designed to stop this specific technique?
- A. Windows Local Administrator Password Solution (LAPS)
- B. Credential Guard✓ Correct
- C. Microsoft Defender SmartScreen
- D. Exploit protection mitigations
Why B is correct: Credential Guard uses virtualization-based security to isolate and protect derived credentials (like NTLM hashes and Kerberos tickets) so that even an attacker with local admin rights can’t extract them from LSASS to reuse in a pass-the-hash or pass-the-ticket attack.
Why A is wrong: LAPS randomizes and rotates local Administrator account passwords per machine, which limits reuse of a stolen local admin password — but it doesn’t address in-memory credential theft on a machine where the attacker already has admin rights.
Why C is wrong: SmartScreen warns about malicious downloads and websites — it has no role in protecting derived credentials stored in memory.
Why D is wrong: Exploit protection hardens processes against memory-corruption exploits like buffer overflows — it doesn’t specifically isolate or protect derived credential material the way Credential Guard does.
Virtual Machines Scenario (Question 11)
A production Hyper-V VM needs continuous replication to a second host for disaster recovery — which feature applies?
A single Hyper-V VM running a line-of-business app needs to be continuously replicated to a secondary Hyper-V host at another site, with the ability to fail over if the primary host goes down. Standard checkpoints aren’t sufficient. What should be configured?
- A. Production checkpoints taken every hour
- B. Hyper-V Replica between the primary and secondary hosts✓ Correct
- C. NIC teaming on the Hyper-V host
- D. GPU partitioning on the VM
Why B is correct: Hyper-V Replica is purpose-built for this scenario — it asynchronously replicates VM changes to a secondary host on an ongoing basis and supports planned or unplanned failover, which checkpoints alone cannot provide.
Why A is wrong: Checkpoints are point-in-time snapshots taken on demand or on a schedule — they don’t provide continuous replication or an automated failover mechanism to a second host.
Why C is wrong: NIC teaming provides network fault tolerance and bandwidth aggregation for the host’s network adapters — it has no relationship to replicating VM state to another host.
Why D is wrong: GPU partitioning shares a physical GPU across multiple VMs for graphics workloads — it’s unrelated to disaster recovery or replication.
Networking Scenario (Question 12)
How does an on-premises DNS server resolve names for an Azure-hosted domain without duplicating every zone?
An on-premises AD DS domain needs to resolve names for a separate Azure-hosted domain used by a partner team, without manually recreating and maintaining that team’s entire DNS zone on-premises. What’s the appropriate configuration?
- A. Manually recreate every record from the Azure-hosted zone as a static entry in the on-premises DNS server
- B. Configure a conditional forwarder on the on-premises DNS server that points queries for the partner domain to the Azure-hosted DNS server✓ Correct
- C. Enable DNSSEC on the on-premises zone
- D. Create a DHCP reservation for the partner domain’s DNS server
Why B is correct: A conditional forwarder tells the on-premises DNS server to send queries for one specific namespace to a designated DNS server, letting it resolve names for the partner’s Azure-hosted domain live, without copying or maintaining any of that zone’s records locally.
Why A is wrong: This works initially but requires manual updates every time a record changes in the partner’s zone — exactly the duplicated-maintenance burden the requirement is trying to avoid.
Why C is wrong: DNSSEC adds cryptographic validation to protect against DNS spoofing — it doesn’t create a resolution path to an entirely separate domain.
Why D is wrong: DHCP reservations assign a fixed IP address to a specific client — they have no effect on how DNS queries are forwarded or resolved.
How Do These Compare to the Real AZ-802 Exam?
The real exam tests the same pattern: a scenario with constraints (no lab access, no downtime, specific security requirement) followed by several plausible-sounding tools, only one of which actually satisfies every constraint. Based on attempts logged across our own AZ-802 question bank, the most common miss isn't picking a wrong tool outright — it's picking a correct tool for the wrong environment, like choosing an on-premises-only feature for a scenario that already mentions Azure Arc. That's exactly what questions 8 and 9 above are built to test.
MSCertQuiz sells practice-exam access for AZ-802 and other Microsoft certifications; these sample questions are written by the same team that builds and maintains the full 500-question bank.
Practice Questions FAQ
Are these the actual AZ-802 exam questions?
No. Reproducing real exam content violates Microsoft's certification agreement. These are original scenarios built from the same published skills-measured objectives Microsoft uses to write the real exam, covering the same decision points.
Why do the explanations cover every wrong answer, not just the right one?
Because that's what the exam actually tests. AZ-802 distractors are usually real Windows Server or Azure features that solve a different problem — understanding why they don't fit this scenario is what separates a guess from a confident answer.
How many questions are on the real AZ-802 exam?
Microsoft doesn't publish a per-exam count, but its general exam-duration policy puts most Associate role-based exams at 40-60 questions within a 100-120 minute window (120-140 minutes if the exam includes lab tasks).
Should I practice with multiple-choice questions if AZ-802 has labs?
Yes — Microsoft's exam FAQ confirms that even exams with labs still include traditional question types like multiple choice and drag-and-drop for skills that can't be assessed in a timed lab task. Scenario-based multiple choice remains the bulk of most role-based exams.
Can I take a full timed mock exam instead of individual questions?
Yes — MSCertQuiz's exam readiness quiz runs a timed, exam-length AZ-802 mock so you can practice pacing across all 7 domains in one sitting, the same way the real exam is structured.
More AZ-802 Resources
An 8-week, domain-weighted plan for the full exam.
Every domain as a scannable reference table.
A timed, full-length mock exam across all 7 domains.
Full exam details and the complete 500-question practice bank.
Want 488 more questions like these?
Start with 40 free AZ-802 questions across every domain above.
Start Free AZ-802 Practice