Microsoft AZ-802 - Administering Windows Server

On Cluster1: Import the Azure Migrate appliance. In Azure: Create an Azure Migrate project.

APP3 and APP4 run as virtual machines on the on-premises Cluster1 Hyper-V failover cluster, so migrating them to Azure uses the Azure Migrate: Server Migration workflow for Hyper-V. That workflow requires an Azure Migrate project to first be created in Azure, since the project is the container that organizes the migration effort, tracks discovered and assessed machines, and holds the configuration for the subsequent discovery and replication work. On the Cluster1 side, the Azure Migrate appliance -- a purpose-built VM or OVA image supplied by Azure Migrate specifically for Hyper-V environments -- must be imported (deployed) onto the Hyper-V host or cluster, where it discovers the VMs running there and orchestrates their replication into Azure. Configuring an Azure Network Adapter, creating a Point-to-Site VPN connection to Vnet1, installing the Azure File Sync agent, and installing the Windows Server Migration Tools are all unrelated actions that do not perform Hyper-V VM discovery or replication for an Azure Migrate project. Similarly, creating a premium block blob storage account, a private endpoint, or a VPN gateway in Azure are not the resource that Azure Migrate itself requires to begin a migration project -- an Azure Migrate project is. Therefore, importing the Azure Migrate appliance onto Cluster1 and creating an Azure Migrate project in Azure are the two required preparatory actions.

Server administrators can be prevented from configuring Windows Defender Firewall rules by defining firewall policy centrally in a Group Policy Object and linking it to the servers ' organizational unit(s); domain-based GPO firewall policy overrides any local, administrator-configured Windows Defender Firewall rules on the domain-joined servers, since Group Policy-delivered firewall settings take precedence over local policy. Adaptive network hardening in Microsoft Defender for Cloud only generates recommendations to tighten network security group (NSG) rules protecting Azure resources -- it has no visibility into or control over host-based Windows Defender Firewall configuration on on-premises servers. A network security group (NSG) in Sub1 filters traffic at the Azure virtual network boundary and has no bearing on the on-premises Chicago office servers described in the scenario. An Azure Firewall policy governs the centrally managed Azure Firewall network virtual appliance, not the host-based Windows Defender Firewall running locally on each on-premises server. Because the servers in question are on-premises and domain-joined, only a Group Policy Object can centrally enforce and lock down their local Windows Defender Firewall configuration, preventing server administrators from modifying the rules directly on each machine. Therefore, configuring a GPO is the correct way to reduce this security risk.

Microsoft Defender for Identity is the Microsoft Sentinel data connector purpose-built to monitor on-premises Active Directory domain controllers and surface exactly the insecure-protocol activity described in the requirement, including authentication attempts and sign-ins that rely on legacy or unsigned protocols such as NTLMv1, SMBv1, and unsigned LDAP binds. It does this by analyzing domain controller network traffic and Windows Events directly on the DCs, which is exactly where this insecure-protocol usage originates. The Threat Intelligence - TAXII connector ingests external threat-intelligence indicator feeds (IP addresses, file hashes, domains) from TAXII-compliant sources and has nothing to do with monitoring authentication protocol usage on domain controllers. The Azure Active Directory (Microsoft Entra ID) connector reports on cloud sign-in and audit log events for the Entra tenant, not on legacy protocol usage against on-premises AD DS domain controllers. Microsoft Defender for Cloud focuses on cloud resource security posture management and workload protection rather than detecting legacy authentication protocol usage against on-premises domain controllers. Therefore, connecting Microsoft Defender for Identity to Microsoft Sentinel is the correct connector to identify connections to the domain controllers that use insecure protocols.

Storage Migration Service is purpose-built to inventory the data, security descriptors, and both share-level and NTFS-level permissions on a source file server such as Fileserver1, transfer that data to a destination server such as Fileserver2, and then perform a cutover that reassigns the source server ' s network identity -- its computer name and IP address -- to the destination server. That cutover step is precisely what allows the existing \\Fileserver1\Data UNC path, already relied upon by the Chicago office application, to continue working unchanged after the migration, since client requests to that path transparently resolve to Fileserver2 once it has taken on Fileserver1 ' s identity. The Microsoft File Server Migration Toolkit and Windows Server Migration Tools are older, largely superseded utilities that can move some file server settings but do not provide this automated inventory-transfer-and-cutover workflow, and neither preserves the source server ' s identity on the destination the way Storage Migration Service does, meaning the UNC path would need to be manually updated or redirected. File Server Resource Manager (FSRM) is a quota, file-screening, and storage-reporting feature entirely unrelated to migrating data between servers. Therefore, Storage Migration Service is the correct tool to perform this migration while preserving the existing UNC path.

DHCP1: Export-DhcpServer, Remove-DhcpServerInDC. DHCP2: Add-DhcpServerInDC, Import-DhcpServer.

Migrating a DHCP server ' s configuration together with its existing leases and reservations by PowerShell follows an export/unauthorize-then-authorize/import pattern across the two servers. On the source server, DHCP1, Export-DhcpServer captures the existing scopes, options, leases, and reservations into a migration file, which is what allows the existing leases and reservations to actually carry over to the replacement server. Remove-DhcpServerInDC is then run on DHCP1 to unauthorize it in Active Directory, which is what prevents DHCP1 from continuing to service client requests once DHCP2 is brought online, satisfying that specific migration requirement. On the target server, DHCP2, Add-DhcpServerInDC authorizes the new server in AD DS so it is permitted to lease addresses on the network, and Import-DhcpServer then applies the configuration file exported from DHCP1, causing DHCP2 to hand out the same address ranges as DHCP1 along with the existing leases and reservations that were captured during export. Add-DhcpServerv4Scope and Remove-DhcpServerv4Scope only create or delete an individual scope ' s address range and do not export, import, or preserve any existing lease or reservation data, so neither is part of this migration sequence. Therefore, DHCP1 requires Export-DhcpServer and Remove-DhcpServerInDC, while DHCP2 requires Add-DhcpServerInDC and Import-DhcpServer.

In Azure File Sync, a sync group defines the synchronization topology between exactly one cloud endpoint (an Azure file share) and one or more server endpoints (on-premises or IaaS VM paths). Microsoft ' s documented Azure File Sync limits state explicitly that a sync group can contain, at most, a single cloud endpoint -- there is no supported configuration in which a sync group is associated with two or more Azure file shares simultaneously. This 1:1 relationship between a sync group and its cloud endpoint is a hard architectural limit, not a configurable quota, and it holds true regardless of how many storage accounts exist in the subscription or which Azure region the Storage Sync Service (SyncA) was created in. The number of available storage accounts shown in the exhibit ' s table, and the fact that they might reside in the same or different regions, does not change this per-sync-group limit; each additional cloud endpoint would require creating an entirely separate sync group rather than adding it to GroupA. By contrast, a sync group can contain multiple server endpoints, registering as many on-premises servers/shares as needed to sync against that single cloud endpoint. Therefore, the maximum number of cloud endpoints that can be used with GroupA is 1.

Answer: 1. Create a storage pool. 2. Create a virtual disk. 3. Create a simple volume.

Storage Spaces virtualizes physical disks into a storage pool and then carves virtual disks out of that pool; it does not use the legacy Disk Management concept of converting disks to " dynamic " disks, so those options are distractors that play no role in a Storage Spaces workflow. The first real step is to create a storage pool containing all eight physical disks (four HDDs and four SSDs together), which makes the combined capacity of every disk available to virtual disks created from that pool. The second step is to create a virtual disk from the pool; because the pool contains two distinct media types, creating the virtual disk with storage tiers enabled lets Storage Spaces automatically place and keep frequently accessed ( " hot " ) data on the faster SSD tier while colder data resides on the larger, slower HDD tier, which is exactly what maximizes read performance for frequently used files while still using the capacity of every disk in the pool. The third step is to create a simple volume on top of that virtual disk, formatting it with a file system and drive letter so it becomes usable storage; a simple volume (no resiliency) is appropriate here since the requirement is about read speed rather than fault tolerance, and " spanned volume " is again a legacy Disk Management dynamic-disk term that does not apply to a Storage Spaces virtual disk. The correct sequence is therefore: create the storage pool, create the tiered virtual disk, then create the simple volume.

1. Get-ClusterSharedVolume -Name " Volume1 " | Suspend-ClusterResource. 2. Enable-BitLocker -MountPoint " C:\ClusterStorage\Volume1 " -RecoveryPasswordProtector. 3. $KeyProtectorID = (Get-BitlockerVolume -MountPoint " C:\ClusterStorage\Volume1 " ).KeyProtector. 4. Get-ClusterSharedVolume " Volume1 " | Set-ClusterParameter -Name BitLockerProtectorInfo -Value " $KeyProtectorID.keyprotectorid:$KeyProtectorID.RecoveryPassword " -Create. 5. Get-ClusterSharedVolume -Name " Volume1 " | Resume-ClusterResource.

Microsoft ' s documented procedure for enabling BitLocker on a Cluster Shared Volume begins by suspending the CSV ' s cluster resource with Suspend-ClusterResource, which takes the volume into a maintenance state so that BitLocker can safely take ownership of and begin encrypting it without interference from ongoing cluster I/O. With the resource suspended, Enable-BitLocker is run against the volume ' s mount point using a recovery password protector, which starts the encryption process and generates a key protector. The script then retrieves that key protector ' s ID by querying Get-BitlockerVolume and reading its KeyProtector property into a variable, since this ID, together with the recovery password, needs to be registered with the cluster itself. That information is registered by setting the BitLockerProtectorInfo cluster parameter on the CSV resource, using Set-ClusterParameter with the -Create switch, which is what allows every node in the cluster, not only the node that ran the commands, to automatically unlock the encrypted volume going forward. Only after this registration step is complete is the CSV resource resumed with Resume-ClusterResource, bringing Volume1 back online cluster-wide with BitLocker now protecting it.

When you create a new user object through Active Directory Administrative Center (ADAC), the Create User dialog enforces exactly two attributes as mandatory before the object can be saved: the user ' s SamAccountName logon name (the pre-Windows 2000 logon name, unique within the domain) and the Full name field, which ADAC uses to derive the object ' s display name and Common Name (CN) in the directory. Neither a password nor a UPN logon name is strictly mandatory at creation time in the ADAC UI: you can create a disabled account without setting a password immediately (though a password will be required before the account can be enabled and used to log on), and the UPN logon name is optional -- if left blank, AD DS can still construct an implicit UPN from the SamAccountName and the domain ' s UPN suffix. Profile path and First name are optional descriptive/administrative attributes that have no bearing on whether the object can be created; they can be added or edited at any time after the account exists. Therefore, the only two attributes ADAC treats as required to successfully create User1 are the SamAccountName logon name and the Full name, matching options C and D. This distinction matters operationally because bulk-provisioning scripts or delegated helpdesk staff using ADAC must supply at minimum these two values, while other fields such as password can be deferred to a later step in the account lifecycle (for example, when the account is enabled for first use).

When a connection security rule requires all incoming traffic to be encrypted via IPsec, protocols such as ICMP that are not themselves covered by an IPsec-aware connection security rule would otherwise be dropped by that encryption requirement, since they cannot participate in the IPsec negotiation the rule demands. Windows Defender Firewall with Advanced Security ' s IPsec Settings include an " IPsec exemptions " configuration that lets an administrator exclude specific traffic -- most commonly ICMP -- from the IPsec authentication and encryption requirement entirely, allowing Server1 to respond to unencrypted diagnostic traffic such as tracert (which relies on ICMP Echo/Time Exceeded messages) while every other type of traffic continues to be required to use encryption. Configuring general IPsec defaults changes the default algorithms and key exchange settings used for IPsec but does not exempt any traffic from the encryption requirement. Turning off the Private profile ' s firewall state would disable firewall protection broadly and is neither targeted nor appropriate. Creating a custom outbound rule for ICMPv4 addresses outbound traffic, not the inbound tracert responses the requirement is actually about. Therefore, configuring IPsec exemptions is the correct action.