AZ-802 Administering Windows Server Exam Topics and Questions

Active Directory Domain Services sits at the centre of Windows Server administration, and this topic carries the heaviest weight in the exam. You will face questions that assume fluency with domain controllers, replication, sites, FSMO roles, trusts, security principals, and Group Policy. The cost comes in two places: forgetting how multi-domain and multi-forest mechanics differ from single-domain scenarios, and misunderstanding the constraints that Read-Only Domain Controllers impose on account security.

– Domain controller deployment and FSMO management

You need to deploy domain controllers both on-premises and in Azure, and the exam expects you to know when each approach makes sense. Read-Only Domain Controllers appear frequently, particularly around account security and password caching. FSMO roles demand precision: which role lives where, what breaks when a role holder fails, and how to transfer or seize a role without corrupting the forest. Troubleshooting FSMO issues means recognising symptoms before they escalate, and knowing which tools to use when a role holder is offline. Azure-hosted domain controllers introduce network latency and site topology questions that do not arise in purely on-premises deployments.

– Multi-site, multi-domain, and multi-forest configuration

Trusts, sites, and replication form the backbone of distributed Active Directory environments. You must configure domain and forest trusts, understanding transitive versus non-transitive behaviour and when to use external, realm, or shortcut trusts. Sites control replication schedules and client authentication, so misconfigurations here produce login delays and stale group memberships. Replication itself is tested on topology, bridgehead servers, and conflict resolution. The exam will present scenarios where replication fails silently, and you need to identify whether the cause is a site link cost, a firewall rule, or a DNS misconfiguration.

– Security principals and service accounts

Creating and managing users and groups extends across domains and forests, and the exam tests whether you understand the scope of universal, global, and domain-local groups in multi-domain scenarios. Service accounts appear in questions about managed service accounts, group-managed service accounts, and virtual accounts, with emphasis on selecting the right type for a given workload. The distinction between these account types matters when services run across multiple servers or when automatic password rotation is required. You also need to manage users and groups in environments where trust relationships limit what can be delegated.

– Group Policy implementation and preferences

Group Policy is the primary tool for managing Windows Server at scale, and the exam assumes you can implement policies and preferences without guidance. You need to know processing order, inheritance, blocking, and enforcement, as well as how loopback processing changes behaviour. Group Policy preferences differ from policies in application and failure modes, and questions will test whether you can choose the correct mechanism for a requirement. Troubleshooting Group Policy means reading logs, using Resultant Set of Policy, and understanding why a setting applied to one machine but not another in the same organisational unit.

How Deploy and manage AD DS is tested

Questions present scenarios with multiple domains or forests and ask you to configure replication, resolve FSMO placement, or fix broken trusts. You will see items that describe a failure symptom and require you to identify the underlying cause, such as a seized role that was never cleaned up or a site link with incorrect cost values. Read-Only Domain Controller questions focus on password caching and account security, testing whether you know which accounts can and cannot authenticate against an RODC. Group Policy items present inheritance conflicts or preference failures and ask you to determine why a setting did not apply. Candidates lose marks by confusing FSMO role responsibilities, misunderstanding trust transitivity, and applying Group Policy without accounting for processing order.

Hybrid management connects on-premises Windows Server instances to Azure services, and this topic tests your ability to configure remote access and deploy Azure Arc. The exam assumes you can set up Windows Admin Center, configure PowerShell remoting with double-hop authentication and Just Enough Administration, manage SSH, and control remote desktop access. The second half of the topic focuses on Azure Arc, VM extensions, update management, and Azure Automation runbooks, all in the context of servers that do not run in Azure.

– Remote management configuration

Windows Admin Center operates both on-premises and in the Azure portal, and you need to know how to deploy it in each location and when to use gateway mode versus desktop mode. PowerShell remoting introduces double-hop authentication challenges, where credentials do not pass from the first remote session to a second target. Just Enough Administration limits what a connected user can do, and the exam tests whether you can configure JEA endpoints and role capabilities. SSH on Windows Server is a newer addition, and questions will ask you to configure key-based authentication and manage SSH daemon settings. Remote desktop access covers Network Level Authentication, gateway configuration, and securing RDP connections in hybrid scenarios.

– Azure Arc and hybrid workload management

Azure Arc brings Azure management to servers outside Azure, and the exam expects you to implement Arc-enabled Windows Server instances, including agent installation and connectivity prerequisites. Device configuration through Arc uses Azure Policy guest configuration, and you must understand how to assign configurations and remediate non-compliant machines. VM extensions deploy Azure services such as monitoring agents, antimalware, and custom scripts to non-Azure machines. Azure Update Manager replaces older update solutions, and questions focus on scheduling, compliance reporting, and managing updates across hybrid fleets. Azure Automation runbooks automate tasks across environments, and you need to create, test, and schedule runbooks that target both Azure and on-premises resources.

How Manage Windows Server instances and workloads in a hybrid environment is tested

Questions present hybrid scenarios where remote management fails, and you must identify whether the issue is double-hop authentication, JEA configuration, or SSH key permissions. Windows Admin Center items ask you to choose the correct deployment model or troubleshoot gateway connectivity. Azure Arc questions describe machines that fail to register or extensions that do not deploy, requiring you to check network rules, agent status, or subscription permissions. Update Manager items test your ability to schedule updates, handle prerequisites, and interpret compliance dashboards. Candidates lose marks by confusing JEA roles with Active Directory roles, misconfiguring SSH daemon settings, and failing to recognise when CredSSP is needed for double-hop scenarios.

Virtual machine management splits into two environments: Hyper-V on-premises and Windows Server VMs running in Azure. The on-premises side tests your knowledge of Enhanced Session Mode, PowerShell Direct, nested virtualization, memory settings, integration services, device assignment, GPU partitioning, checkpoints, high availability, virtual hard disks, network adapters, NIC teaming, Virtual Switch, and Hyper-V Replica. The Azure side covers storage management, capacity and scaling, availability sets and zones, just-in-time access, Azure Bastion, and network configuration. Both halves assume hands-on experience.

– Hyper-V guest VM management and advanced features

Enhanced Session Mode allows clipboard and device redirection to VMs, and you need to know when it is available and how to enable it. PowerShell Direct and SSH Direct bypass network configuration to manage VMs, which is useful when network settings are broken. Nested virtualization lets VMs run their own Hyper-V instances, and questions test prerequisites such as processor compatibility and memory allocation. VM memory settings include dynamic memory, minimum and maximum values, and buffer percentages. Integration services provide time synchronisation, heartbeat, and guest shutdown capabilities. Device assignment passes physical devices to VMs using Discrete Device Assignment, and GPU partitioning shares a single GPU across multiple VMs. Checkpoints capture VM state, and you must understand production versus standard checkpoints and when to apply or delete them.

– Hyper-V high availability, storage, and networking

High availability for Hyper-V VMs requires failover clustering, shared storage, and cluster-aware updating. Virtual hard disks come in fixed, dynamically expanding, and differencing formats, and the exam tests when to use each type and how to convert between them. Hyper-V network adapters support VLANs, bandwidth management, and hardware offload features. NIC teaming on the host and inside the VM improves throughput and fault tolerance, and you need to configure teaming modes and load balancing algorithms. Hyper-V Virtual Switch operates in external, internal, or private mode, and questions focus on switch extensions, Quality of Service, and SR-IOV. Hyper-V Replica provides disaster recovery by replicating VMs to a secondary site, and you must configure replication intervals, authentication, and failover.

– Azure VM storage, capacity, and availability

Managing storage for Windows Server VMs in Azure means selecting the correct disk type, resizing disks without downtime, and understanding performance tiers. Capacity management includes resizing individual VMs and using VM scale sets to adjust fleet size based on demand. Availability sets distribute VMs across fault and update domains, while availability zones provide datacenter-level resilience. Questions test when to use each construct and how they interact with load balancers. Just-in-time VM access restricts RDP and SSH exposure by opening ports only when requested, and Azure Bastion provides browser-based access without public IP addresses. Network configuration covers network security groups, accelerated networking, and IP forwarding.

How Manage VMs is tested

Questions present VM failures or performance issues and ask you to identify the cause, such as insufficient memory for nested virtualization, missing integration services, or incorrect NIC teaming mode. Hyper-V Replica items test replication configuration, failover procedures, and authentication requirements. Azure VM items ask you to choose the correct availability construct, resize a disk, or configure just-in-time access. Network configuration questions focus on security group rules, accelerated networking prerequisites, and IP forwarding. Candidates lose marks by confusing availability sets with availability zones, misconfiguring Hyper-V Replica authentication, and selecting the wrong virtual hard disk format for a scenario. Device assignment and GPU partitioning questions catch candidates who do not verify hardware compatibility before attempting configuration.

Networking infrastructure for Windows Server focuses on DNS and DHCP, both in on-premises and hybrid scenarios. DNS integration with Active Directory, zone management, forwarding, conditional forwarding, hybrid name resolution, DNS policies, and DNSSEC all appear in this topic. DHCP covers server role implementation, troubleshooting IP addressing in hybrid environments, scope management, IP reservations, and high availability. The exam expects operational fluency, not theory.

– DNS integration, zones, and forwarding

Integrating DNS with Active Directory means understanding Active Directory-integrated zones, secure dynamic updates, and how DNS records support domain controller location. Zone management includes primary, secondary, and stub zones, as well as conditional forwarding to direct queries for specific domains to designated servers. DNS forwarding sends unresolved queries to external resolvers, and you must configure forwarders and root hints correctly. Hybrid name resolution connects on-premises DNS with Azure DNS, often using conditional forwarders or Azure DNS Private Resolver. DNS policies allow query filtering, traffic management, and split-brain DNS configurations, where internal and external clients receive different answers for the same name.

– DNS security and DHCP implementation

DNSSEC signs DNS records to prevent tampering, and the exam tests trust anchor configuration, zone signing, and validation. DHCP server role implementation includes authorising the server in Active Directory, configuring server options, and managing lease duration. Troubleshooting IP addressing in hybrid environments requires checking DHCP relay agents, firewall rules, and Azure virtual network DHCP settings. DHCP scopes define address ranges, exclusions, and reservations, and you need to create and modify scopes without causing conflicts. IP reservations bind MAC addresses to specific addresses, and questions test when to use reservations versus static IP configuration. High availability for DHCP uses failover partnerships or split-scope configurations, and you must choose the correct mode and configure load balance or hot standby.

How Implement and manage an on-premises and hybrid networking infrastructure is tested

DNS questions present name resolution failures and ask you to identify misconfigured forwarders, missing conditional forwarding entries, or incorrect DNS policies. DNSSEC items test whether you can enable signing, configure trust anchors, and troubleshoot validation failures. DHCP questions describe IP address exhaustion, reservation conflicts, or failover issues, and you must determine the correct scope configuration or failover mode. Hybrid scenarios test your ability to configure DNS forwarding between on-premises and Azure, often involving Azure DNS Private Resolver or conditional forwarding to Azure-provided DNS. Candidates lose marks by confusing DNS forwarding with conditional forwarding, misconfiguring DHCP failover percentages, and failing to authorise DHCP servers in Active Directory before they issue leases.

Storage and file services span Azure Files, Windows Server file shares, and Windows Server storage technologies. Azure Files includes creating and managing file shares, permissions, Azure File Sync, monitoring, and migrating from DFS and legacy file shares. Windows Server file shares cover access control, File Server Resource Manager, DFS, SMB over QUIC, and SMB settings. Storage configuration includes disks and volumes, Storage Spaces, Storage Spaces Direct, Storage Replica, Data Deduplication, SMB direct, Storage QoS, file system selection, iSCSI, and BitLocker. This topic is dense and assumes you have configured these technologies in production.

– Azure Files and Azure File Sync

Azure file shares provide SMB and NFS access to cloud storage, and you need to create shares, configure quotas, and manage identity-based authentication using Active Directory or Azure Active Directory. Permissions for Azure file shares operate at both the share level and the NTFS level when identity-based authentication is enabled. Azure File Sync replicates on-premises file servers to Azure Files, and you must deploy the sync agent, register servers, create sync groups, and configure cloud tiering. Monitoring Azure File Sync involves checking sync health, upload and download activity, and tiering effectiveness. Migrating DFS to Azure File Sync requires namespace consolidation and careful sync group design, while migrating from file shares involves robocopy or Storage Migration Service.

– Windows Server file shares and DFS

Configuring access to Windows Server file shares means setting NTFS permissions, share permissions, and Access-Based Enumeration. File Server Resource Manager enforces quotas, screens file types, and generates storage reports. DFS Namespaces aggregate multiple file shares into a unified namespace, and DFS Replication keeps those shares synchronised across servers. The exam tests namespace configuration, referral ordering, and replication topology. SMB over QUIC encrypts SMB traffic over UDP, allowing secure file access without VPN, and you must configure certificates and firewall rules. SMB settings include SMB signing, encryption, and dialect negotiation, and questions focus on when to enforce each setting.

– Storage Spaces, Storage Replica, and advanced storage features

Storage Spaces pools physical disks into virtual disks with resiliency options such as mirroring and parity. Storage Spaces Direct extends Storage Spaces across a cluster, using local disks to provide shared storage for VMs and file shares. You need to configure storage pools, virtual disks, and volumes, and understand how resiliency settings affect capacity and performance. Storage Replica provides synchronous or asynchronous replication between servers or clusters, and questions test replication direction, log sizing, and failover. Data Deduplication reduces storage usage by eliminating redundant data, and you must select the correct deduplication mode for file servers, VDI, or backup targets. SMB direct uses RDMA-capable network adapters to reduce CPU usage and latency. Storage QoS limits IOPS for VMs or file shares to prevent resource contention.

– File systems, iSCSI, and BitLocker

Selecting between NTFS and ReFS depends on workload requirements: ReFS offers integrity streams and larger volume sizes, while NTFS provides broader feature support. Configuring iSCSI involves creating targets, virtual disks, and initiator connections, and questions test authentication, MPIO, and performance tuning. BitLocker Drive Encryption protects data at rest, and you must manage encryption keys, recovery passwords, and TPM integration. Recovering encrypted volumes requires access to recovery keys stored in Active Directory or Azure AD, and questions test your ability to retrieve and apply those keys when a system fails to boot.

How Manage storage and file services is tested

Azure File Sync questions present sync failures, tiering issues, or replication delays, and you must identify agent version problems, endpoint health, or network throttling. DFS items test namespace referral configuration, replication conflicts, and topology design. Storage Spaces Direct questions describe capacity or performance issues and ask you to adjust resiliency settings, add nodes, or rebalance storage. Storage Replica items focus on replication lag, log disk sizing, and failover procedures. Data Deduplication questions test optimization schedules, chunk store corruption, and mode selection. Candidates lose marks by confusing Storage Spaces with Storage Spaces Direct, misconfiguring Azure File Sync cloud tiering policies, and selecting ReFS when NTFS features such as disk quotas are required.

Security spans operating system hardening and Active Directory protection. Operating system security includes exploit protection, Application Control, Credential Guard, SmartScreen, Group Policy-based security, OSConfig for baseline management, Local Administrator Password Solution, Defender for Servers, and Windows Firewall with connection security rules. Active Directory security covers password policies, Azure AD Password Protection, protected users, domain controller hardening, access restriction, account security options, built-in group security, delegation, and authentication protocols. This topic assumes you understand both what to configure and why each control matters.

– Operating system security controls

Exploit protection applies mitigation techniques such as Data Execution Prevention, Address Space Layout Randomization, and Control Flow Guard to processes. Application Control for Windows restricts which applications can run, using policies based on file attributes, signatures, or paths. Credential Guard isolates credentials in a virtualised container to prevent credential theft attacks. Microsoft Defender SmartScreen blocks malicious downloads and phishing sites, and you must configure it through Group Policy or Intune. Implementing operating system security through Group Policy means configuring security options, user rights assignments, and audit policies. OSConfig applies security baselines to Windows Server, and you need to assign baselines, monitor compliance, and remediate drift. Local Administrator Password Solution rotates local administrator passwords and stores them in Active Directory or Azure AD. Defender for Servers integrates Azure Defender with on-premises and Azure VMs, providing threat detection and vulnerability assessment.

– Windows Firewall and connection security

Windows Firewall with Advanced Security controls inbound and outbound traffic using rules based on program, port, protocol, or service. Connection security rules enforce IPsec authentication and encryption between computers, and you must configure authentication methods, encryption algorithms, and rule scope. Questions test when to use isolation rules, authentication exemptions, and server-to-server rules. Troubleshooting firewall issues requires checking rule order, profile activation, and logging.

– Active Directory security configuration

Password policies include complexity, length, history, and lockout settings, and fine-grained password policies allow different policies for different user groups. Azure AD Password Protection bans weak passwords and integrates with on-premises Active Directory to enforce cloud-sourced banned password lists. Protected users is a global group whose members receive additional protections, such as prohibition of NTLM authentication and credential caching. Hardening domain controllers involves disabling unnecessary services, restricting physical access, and enabling audit logging. Restricting access to domain controllers means configuring firewall rules, limiting interactive logon rights, and using Jump servers. Security options for user accounts control settings such as password storage, Kerberos encryption types, and account lockout. Built-in administrative groups such as Domain Admins and Enterprise Admins require careful membership management and should not be used for day-to-day tasks.

– Delegation and authentication protocols

Active Directory delegation assigns administrative permissions for specific organisational units or objects without granting full domain privileges. You must configure delegation using the Delegation of Control Wizard or direct ACL modification, and questions test least-privilege design. Authentication protocols include Kerberos, NTLM, and certificate-based authentication, and you need to know when each is used, how to enforce Kerberos, and how to disable NTLM where possible. Managing authentication methods involves configuring supported encryption types, enabling AES256, and disabling DES and RC4.

How Secure Windows Server infrastructure is tested

Operating system security questions present attack scenarios and ask you to identify which control would have prevented the attack, such as Credential Guard blocking credential dumping or Application Control preventing unsigned executables. Windows Firewall items test rule precedence, connection security rule configuration, and troubleshooting blocked traffic. Active Directory security questions focus on password policy application, protected user limitations, and delegation scope. Authentication protocol items ask you to disable weak protocols, configure Kerberos encryption types, or troubleshoot NTLM fallback. Candidates lose marks by confusing Application Control policies with Software Restriction Policies, misconfiguring fine-grained password policies so they do not apply, and delegating excessive permissions when a narrower scope would suffice.

Monitoring and troubleshooting split into three areas: monitoring using Windows Server tools and Azure services, troubleshooting general Windows Server issues, and troubleshooting Active Directory. Monitoring tools include Performance Monitor, data collector sets, Windows Admin Center alerts, System Insights, event logs, Azure Monitor data collection rules, alerts, and VM Insights. Troubleshooting covers connectivity, name resolution, Windows Update, Time service, performance, VM and Azure Arc extensions, disk encryption, storage, Active Directory object recovery, database recovery, SYSVOL recovery, replication, on-premises AD, Kerberos, and secure channel trust. This topic assumes you can interpret symptoms, identify root causes, and apply fixes.

– Monitoring with Windows Server tools and Azure services

Performance Monitor collects real-time and logged performance data using counters for CPU, memory, disk, and network. Data collector sets automate counter collection, define schedules, and generate reports. Windows Admin Center provides a browser-based interface for monitoring servers, configuring alerts, and viewing health status. System Insights uses machine learning to predict capacity issues, and you must enable and configure prediction capabilities. Event logs record system, application, and security events, and questions test your ability to filter logs, configure subscriptions, and interpret error codes. Azure Monitor data collection rules define what telemetry is collected from VMs and Arc-enabled servers and where it is sent. Alerts notify you when metrics or logs meet defined conditions, and you must configure alert rules, action groups, and notification channels. VM Insights collects performance and dependency data from Azure VMs, and you need to enable the feature, query logs, and interpret performance charts.

– Troubleshooting connectivity, name resolution, and services

Connectivity troubleshooting involves checking physical links, IP configuration, routing tables, and firewall rules. Name resolution issues require verifying DNS server configuration, cache contents, and zone records. Windows Update troubleshooting includes checking Windows Update service status, clearing the SoftwareDistribution folder, and reviewing WindowsUpdate.log. Time service issues affect Kerberos authentication and event log correlation, and you must configure time sources, check synchronisation status, and verify firewall rules for NTP. Performance troubleshooting uses Performance Monitor to identify bottlenecks, Resource Monitor to find processes consuming resources, and Task Manager for quick checks. VM and Azure Arc extension issues involve checking extension status, logs, and network connectivity to Azure services. Disk encryption troubleshooting requires verifying BitLocker status, TPM health, and recovery key availability. Storage troubleshooting covers disk errors, volume corruption, and replication failures.

– Troubleshooting Active Directory objects and database

Restoring objects from AD Recycle Bin requires enabling the feature, searching for deleted objects, and restoring them with attributes intact. Recovering the AD database using Directory Services Restore Mode involves booting into DSRM, restoring database files from backup, and performing authoritative or non-authoritative restores. SYSVOL recovery addresses replication issues or corruption, and you must determine whether to use authoritative or non-authoritative restore and force replication if needed. AD replication troubleshooting checks replication topology, verifies DNS records for domain controllers, and uses repadmin to diagnose and fix replication failures.

– Troubleshooting authentication and trust

On-premises AD troubleshooting includes verifying domain controller availability, checking LDAP and Kerberos connectivity, and reviewing Directory Services event logs. Kerberos issues involve checking time synchronisation, service principal names, encryption type support, and ticket-granting ticket issuance. Authentication issues require verifying user account status, password expiry, and authentication protocol support. Secure channel and computer account trust issues cause computers to lose domain connectivity, and you must reset the computer account or rejoin the domain. Troubleshooting trust relationships involves checking trust status, verifying DNS name resolution across domains, and testing authentication across the trust.

How Monitor and troubleshoot Windows Server environments is tested

Monitoring questions ask you to select the correct tool or counter for a requirement, configure data collection rules, or interpret alert conditions. Troubleshooting items present failure symptoms and ask you to identify the root cause and the correct fix. Connectivity questions test your ability to isolate network layer issues from application layer issues. Name resolution items require you to distinguish DNS configuration problems from DNS server availability problems. Active Directory recovery questions test whether you know when to use AD Recycle Bin versus DSRM, and when to perform authoritative versus non-authoritative restore. Replication troubleshooting items ask you to interpret repadmin output and identify topology, DNS, or firewall issues. Candidates lose marks by confusing authoritative and non-authoritative restores, misinterpreting Performance Monitor counter values, and failing to check time synchronisation when Kerberos authentication fails.