AZ-802 무료 덤프문제 온라인 액세스

Your on-premises network contains an Active Directory Domain Services (AD DS) domain.
You plan to implement BitLocker Drive Encryption (BitLocker) for the domain.
You create a Group Policy Object (6P0) and enable the Choose how BitLocker-protected operating system drives can be recovered Group Policy setting.
You need to configure a data recovery agent (DRA) for drive recovery.
What should you use to configure the DRA, and which additional Group Policy setting should you enable? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

정답:

Explanation:

Configure the DRA by using: A digital certificate. Enable setting: Choose default folder for recovery password.
A BitLocker data recovery agent is configured using a public-key (PKI) digital certificate issued from a duplicated Key Recovery Agent template that carries the BitLocker Drive Encryption and BitLocker Data Recovery Agent application policies; the certificate ' s public key is added to the domain ' s DRA configuration through Public Key Policies > BitLocker Drive Encryption in Group Policy, after which every computer that later encrypts a drive under that policy automatically protects the drive ' s recovery key with the DRA certificate, letting a holder of the corresponding private key decrypt any protected drive domain-wide. A BitLocker recovery password (a 48-digit numerical key), a user principal name, and a security identifier are all identifiers or credentials associated with individual users or computers rather than the credential type used to configure a data recovery agent itself, so none of those options describes how a DRA is set up. Because a DRA relies on 48-digit numerical recovery passwords being generated and escrowed for each protected drive as the actual recovery mechanism the DRA certificate later decrypts, enabling Choose default folder for recovery password ensures every BitLocker-enabled computer automatically saves a copy of its numerical recovery password to a specified, centrally accessible network folder as each drive is encrypted, giving administrators (and, in effect, the DRA-holding recovery workflow) a reliable location to retrieve recovery data from without depending solely on AD DS storage or manual per-user handling.

Your network contains a Microsoft Entra Domain Services managed domain named contoso.com. You need to configure a password policy for the local user accounts on the Azure virtual machines joined to contoso.
com. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

정답:

Explanation:
In a Microsoft Entra Domain Services managed domain, the only group delegated rights to create and manage Group Policy is AAD DC Administrators, since traditional groups such as Domain Admins are not exposed for customer administration in a managed domain and a plain local Administrators group membership on some other machine has no bearing on directory-wide GPO rights; any GPO change here must be made while signed in as a member of AAD DC Administrators. The more subtle part of this question is where the GPO must be linked. Windows ' Account Policies (including password policy) behave differently depending on GPO scope: a GPO linked at the domain level sets the domain account password policy for domain user accounts, but a GPO linked to an organizational unit instead affects the local Security Accounts Manager (SAM) password policy of the computers contained in that OU - which is exactly the target here, since the requirement is to set a policy for local user accounts on the VMs, not for domain accounts. Because computer objects for domain-joined Azure VMs in a managed domain land in the built-in AADDC Computers OU (not AADDC Users, which holds user objects, and not a plain Computers container, which isn ' t used by Entra Domain Services), the GPO must be linked to AADDC Computers to affect the local account password policy of those VMs.

You have a Windows Server 2022 Storage Spaces Direct cluster named Cluster1. Cluster1 has four nodes that contain virtual machines.
You need to perform an in-place upgrade of Cluster! to Windows Server 2025. The solution must ensure that the virtual machines are always available during the upgrade.
In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

정답:

Explanation:
To keep virtual machines available while performing an in-place OS upgrade of a Storage Spaces Direct node, the node is first paused and drained (Suspend-ClusterNode -Drain) so its cluster roles, including running VMs, move to other nodes. The node ' s storage is then placed into storage maintenance mode, which stops it from participating in the storage pool ' s redundancy operations while its physical disks are offline for the upgrade. With the node drained and its storage quiesced, the in-place Windows Server 2025 upgrade is performed, and afterward storage maintenance mode is removed so the node ' s disks rejoin the pool and Storage Spaces Direct resynchronizes data before the node resumes cluster roles. This drain-upgrade-resync cycle is then repeated node by node across the four-node cluster, and because only one node at a time is unavailable while the others continue serving storage and hosting migrated VMs, the workload stays online throughout the entire rolling upgrade.

You have 20 on-premises servers, including a server named Server1, that run Windows Server. Server1 has Windows Admin Center deployed and is connected to the internet. You have an Azure subscription. You need to integrate Windows Admin Center with Azure so that you can use Azure services to manage and monitor the on-premises servers. What should you do first?

• A.From Server1, run the Connect-AzAccount cmdlet.
• B.Enable Azure Arc on each managed server.
• C.From Server1, run the Set-AzWebApp cmdlet.
• D.Install Microsoft Entra Connect Sync on Server1.

You have a Hyper-V host named HV1 that contains a virtual machine named VM1. HV1 supports nested visualization. VM1 is connected to an external virtual switch.
You plan to install the Hyper-V server role on VM1.
You need to prepare VM1 to host nested virtual machines. The solution must meet the following requirements:
* Enable VM1 to run Hyper-V.
* Enable nested virtual machines to communicate on the physical LAN.
How should you configure VM1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

정답:

Explanation:

Processor configuration: Expose virtualization extensions. Network configuration: Enable MAC address spoofing.
Nested virtualization, running the Hyper-V role inside a VM so that VM itself can host further, nested virtual machines, requires the parent VM ' s virtual processor to expose the hardware virtualization extensions (Intel VT-x/EPT or AMD-V equivalents) that the guest hypervisor inside VM1 needs to create and run its own nested VMs; this is enabled with the -ExposeVirtualizationExtensions $true parameter on Set-VMProcessor, and without it, VM1 ' s own attempt to enable Hyper-V would fail because the guest OS would detect no hardware virtualization support at all. Increasing the number of virtual processors or enabling processor compatibility mode (which is for live-migrating between hosts with different CPU generations) do nothing to expose the extensions nested virtualization depends on. On the networking side, nested VMs inside VM1 use their own, further-virtualized MAC addresses that VM1 ' s own virtual network adapter did not originally advertise to HV1 ' s external switch; unless MAC address spoofing is enabled on VM1 ' s virtual network adapter, HV1 ' s virtual switch will drop outbound frames from those nested VM MAC addresses as spoofed traffic, silently blocking their connectivity to the physical LAN. Enabling NIC Teaming, Router Guard, or port mirroring on VM1 ' s adapter address entirely different scenarios (link aggregation, rogue DHCP/router protection, and traffic monitoring, respectively) and would not allow nested VMs ' distinct MAC addresses to reach the physical network.