AZ-802 Practice Test

Sample AZ-802 Practice Questions

10 real questions from the free AZ-802bank. Pick an answer in your head, then open “Show answer” for the explanation.

1. 1. Which cmdlet adds a security group to the Allowed list of an RODC's password replication policy so that its members' passwords can be cached on that RODC?

   • A. Set-ADAccountPassword
   • B. Add-ADDomainControllerPasswordReplicationPolicy
   • C. New-ADReplicationSite
   • D. Grant-ADAuthenticationPolicySiloAccess
   Show answer

   Correct answer: B

   Add-ADDomainControllerPasswordReplicationPolicy adds users, computers, or groups to either the allowed or denied list of a specified RODC's password replication policy. Set-ADAccountPassword changes a single account's password, New-ADReplicationSite creates a site object, and Grant-ADAuthenticationPolicySiloAccess is unrelated to RODC password caching.

2. 2. You need to promote a new writable domain controller at a branch office connected to the hub site by a low-bandwidth, metered WAN link. The hub site already has several domain controllers. You want to avoid replicating the entire directory database across the WAN link during promotion, and you cannot physically ship removable media to the branch office. What should you do?

   • A. Run Install-ADDSDomainController directly against the hub-site domain as the replication source, and rely on intersite compression to shrink the initial replication traffic.
   • B. Use Ntdsutil to create an Install From Media (IFM) snapshot on a hub-site domain controller, copy the IFM folder to the branch server over the network during off-peak hours, then run Install-ADDSDomainController with -InstallationMediaPath.
   • C. Pre-stage an RODC account for the branch site with Add-ADDSReadOnlyDomainControllerAccount, then attach the branch server to that staged account using -UseExistingAccount.
   • D. Export the hub domain controller's virtual hard disk over the network and import it as a new virtual machine acting as a domain controller at the branch office.
   Show answer

   Correct answer: B

   Install From Media (IFM) lets a new domain controller build its database from a local media set instead of pulling the full directory over the WAN, and the media can be moved over the network rather than on physical disks. Option A still requires replicating the full naming context over the WAN despite compression. Option C changes the outcome to a read-only DC, which was not requested. Option D copies a virtualized DC's VHD, which is explicitly unsupported and risks USN rollback.

3. 3. Within a single AD DS site containing eight writable domain controllers, administrators notice that replication changes reach every domain controller even if one intermediate domain controller in the chain temporarily goes offline. What replication topology characteristic explains this resilience?

   • A. Intrasite replication uses a linear chain topology with a single point of failure at each end.
   • B. Intrasite replication relies exclusively on SMTP as a fallback transport whenever RPC fails.
   • C. Intrasite replication uses the same spanning-tree topology as intersite replication, which has no redundant paths.
   • D. Intrasite replication connections between writable domain controllers form a bidirectional ring, with additional shortcut connections added in larger sites to reduce latency and provide redundancy.
   Show answer

   Correct answer: D

   Within a site, the KCC arranges writable domain controllers into a bidirectional ring and adds shortcut connections in larger sites, so changes can still reach every domain controller through the other direction of the ring even if one intermediate domain controller is temporarily unavailable. A linear chain would create single points of failure, SMTP is not used as an automatic RPC fallback for intrasite replication, and the spanning-tree layering with no redundant paths describes intersite replication, not intrasite replication.

4. 4. What is the primary security benefit of deploying a Read-Only Domain Controller (RODC) at a branch office with limited physical security?

   • A. The RODC holds a read-only copy of the AD DS database and, by default, caches no user credentials, limiting exposure if the server is stolen.
   • B. The RODC automatically encrypts the entire NTDS.dit file using BitLocker as part of promotion.
   • C. The RODC cannot be joined to the domain, removing it from the security boundary.
   • D. The RODC provides the same write access to AD DS as a writable domain controller, with extra audit logging.
   Show answer

   Correct answer: A

   By default no account passwords replicate to a newly promoted RODC, and security-sensitive accounts are explicitly denied from ever caching their passwords there, so theft of the server exposes little usable credential data. BitLocker is not enabled automatically as part of RODC promotion, an RODC is still a full domain member, and it accepts no writes at all rather than matching a writable DC.

5. 5. A consultant with only Domain Admins rights in a child domain (not the forest root domain) attempts to create a new forest trust from the forest root domain to a partner forest and the operation fails with an access-denied error. What is the most likely reason?

   • A. Creating a forest trust requires membership in Domain Admins in the forest root domain, or in Enterprise Admins - membership in a child domain's Domain Admins group is not sufficient.
   • B. Forest trusts can be created exclusively by members of Schema Admins.
   • C. The consultant must first be added to the Denied RODC Password Replication Group.
   • D. Forest trusts require the target forest to lower its forest functional level to Windows 2000.
   Show answer

   Correct answer: A

   Creating a forest trust requires membership in Domain Admins in the forest root domain, or in Enterprise Admins; being a Domain Admin in a child domain does not carry that authority. Schema Admins and the Denied RODC Password Replication Group have no role in trust creation, and forest trusts require a reasonably current functional level rather than a legacy Windows 2000 level.