Practice Exam AZ-802: Windows Server Hybrid Administrator Associate

Question bank: 109 · timed mock exam: 75 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab) Official prep course (opens in a new tab)

Compare: AZ-802 vs AZ-104

  • Deploy and manage AD DS 20 questions
  • Manage Windows Server instances and workloads in a hybrid environment 18 questions
  • Manage storage and file services 16 questions
  • Monitor and troubleshoot Windows Server environments 16 questions
  • Secure Windows Server infrastructure 15 questions
  • Manage virtual machines 12 questions
  • Implement and manage an on-premises and hybrid networking infrastructure 12 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 109 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for Windows Server Hybrid Administrator Associate (AZ-802: Administering Windows Server) with InfraPrep

The 109 questions cover 7 domains: Deploy and manage AD DS, Manage Windows Server instances and workloads in a hybrid environment, Manage storage and file services, Monitor and troubleshoot Windows Server environments, Secure Windows Server infrastructure, Manage virtual machines, Implement and manage an on-premises and hybrid networking infrastructure. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 75 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Deploy and manage AD DS

The domain controller that holds the RID Master operations master role has permanently failed and cannot be repaired. No other role transfer is possible from this server. What is the correct way to move the RID Master role to a healthy domain controller?

  1. Recreate the domain so that a new domain controller is assigned all FSMO roles automatically
  2. Wait for Active Directory to automatically reassign the role at the next replication cycle
  3. Edit the fsmoRoleOwner attribute directly with Get-ADDomainController
  4. Run Move-ADDirectoryServerOperationMasterRole with -Force to seize the role onto a working DC
Show the answer and the explanation

Correct answer: D

When an operations master role holder has failed and can't be repaired, the documented method is to use Move-ADDirectoryServerOperationMasterRole with the Force parameter to seize the role onto a working domain controller.

Source: official documentation

Question 2 Manage Windows Server instances and workloads in a hybrid environment

An administrator wants to manage several on-premises Windows Servers through a browser without installing any agent on each managed server, and without needing an Internet connection. Which tool provides this, and what mechanism does its gateway use to reach the managed servers?

  1. Azure Arc, which requires every managed server to be connected to Azure first
  2. SSH exclusively, required on every managed server with no alternative protocol
  3. A permanent agent service installed on every managed server that phones home to a cloud portal
  4. Windows Admin Center, whose gateway manages servers by using Remote PowerShell and WMI over WinRM
Show the answer and the explanation

Correct answer: D

Windows Admin Center is a locally deployed, browser-based tool that lets you manage servers without connecting to the cloud, and its gateway manages servers using Remote PowerShell and WMI over WinRM.

Source: official documentation

Question 3 Manage virtual machines

An administrator needs to take a checkpoint of a production Hyper-V virtual machine that creates a data-consistent backup without capturing the VM's memory state, using the type of checkpoint selected by default for new VMs. Which checkpoint type meets this requirement?

  1. A Production Checkpoint, using Volume Shadow Copy Service (or File System Freeze on Linux), no memory snapshot
  2. A Standard Checkpoint configured with -CheckpointType Production
  3. A Standard Checkpoint, which captures the VM memory state and is intended for production backups
  4. No checkpoint type in Hyper-V can create a data-consistent backup
Show the answer and the explanation

Correct answer: A

Production Checkpoints use Volume Shadow Copy Service or File System Freeze to create a data-consistent backup without taking a memory-state snapshot, and they are selected by default for new virtual machines.

Source: official documentation

Question 4 Implement and manage an on-premises and hybrid networking infrastructure

A DNS server has no forwarder configured, so it uses root hints to resolve every query it cannot answer locally. What documented risk does this configuration create, compared with using a forwarder?

  1. Root hints improve internal DNS security by hiding queries from the Internet
  2. It can expose internal DNS information to the Internet, creating security and privacy risks
  3. This configuration automatically reduces external network traffic
  4. There is no meaningful difference between root hints and a forwarder
Show the answer and the explanation

Correct answer: B

Without a designated forwarder, a DNS server uses root hints to send queries outside the network, and this configuration can expose internal DNS information to the Internet, leading to security and privacy risks.

Source: official documentation

Question 5 Manage storage and file services

An on-premises file server syncs with Azure File Sync and has a 200 GiB local volume. The administrator wants at least 40 GiB of local disk capacity to always remain free by tiering cool files to Azure. Which cloud tiering policy and setting achieve this?

  1. The date policy, set to 20%
  2. The date policy, set to 40 days
  3. The volume free space policy, set to 20%
  4. The volume free space policy, set to a literal 40 GiB value, since only absolute values are accepted
Show the answer and the explanation

Correct answer: C

The example in the documentation matches exactly: with a 200 GiB local disk and a goal of keeping at least 40 GiB free, the volume free space policy should be set to 20%.

Source: official documentation

Question 6 Secure Windows Server infrastructure

On Windows Server 2025, an administrator wants a tool that automatically detects and corrects configuration drift away from a security baseline, and that also integrates with Azure Policy, Microsoft Defender, and Windows Admin Center for monitoring and compliance reporting. Which tool matches this description?

  1. OSConfig; it detects and corrects security-baseline drift automatically
  2. Windows LAPS, which manages local administrator passwords, not baseline drift
  3. System Insights, which forecasts CPU and storage usage, not baseline drift
  4. Group Policy preferences, which configure settings but don't detect drift
Show the answer and the explanation

Correct answer: A

OSConfig automatically detects and corrects configuration drift, and on Windows Server 2025 it integrates with Azure Policy, Microsoft Defender, Windows Admin Center, and Azure Policy machine configuration for monitoring and compliance reporting.

Source: official documentation

Question 7 Monitor and troubleshoot Windows Server environments

An administrator wants to troubleshoot a suspected performance issue on a remote Windows Server by creating a Performance Monitor data collector set that targets that server directly from an elevated command prompt, without logging on to it. Which logman command syntax matches the documented remote approach, and how does it differ from the documented local command?

  1. The remote command requires PowerShell remoting (Enter-PSSession) instead of logman, per the documentation
  2. logman create counter -u -c "\\\processor(*)\*"; the local command omits -u and the \\\ prefix
  3. logman.exe create counter core_%computername% -f bin -v mmddhhmm -max 2048 -c "\processor(*)\*" ...; this is identical for both local and remote monitoring
  4. Performance Monitor cannot target a remote server under any circumstances; only local counters can be collected
Show the answer and the explanation

Correct answer: B

The documented remote command uses logman create counter with a -u credential switch and counter paths prefixed with \\\, whereas the documented local command uses logman.exe create counter core_%computername% with plain, unprefixed counter paths and no -u switch.

Source: official documentation

Question 8 Deploy and manage AD DS

A company wants to place a domain controller in a small branch office that has relatively few users, poor physical security, and poor network bandwidth back to the hub site, with local staff who have limited IT knowledge. Which type of domain controller best fits this scenario?

  1. A read-only domain controller (RODC)
  2. A domain controller with no replication partners configured
  3. No domain controller; route every logon over the WAN to the hub site
  4. A standard writable domain controller with a full read-write copy of the AD DS database
Show the answer and the explanation

Correct answer: A

An RODC is designed primarily for branch offices with few users, poor physical security, poor bandwidth to a hub site, and limited local IT knowledge — exactly this scenario.

Source: official documentation

Question 9 Manage Windows Server instances and workloads in a hybrid environment

An organization wants a single Windows Admin Center gateway running in an Azure VM to manage several other Azure VMs, using the script-based deployment method from Azure Cloud Shell. Which approach matches this requirement?

  1. Use the single-VM Windows Admin Center feature built into the Azure portal
  2. Run Deploy-WACAzVM.ps1 from Azure Cloud Shell to set up a Windows Admin Center gateway in Azure
  3. Deploy Windows Admin Center exclusively through Azure Arc onboarding of each target VM
  4. Windows Admin Center cannot be deployed in Azure; it only supports on-premises gateways
Show the answer and the explanation

Correct answer: B

The documented script-based method to set up a Windows Admin Center gateway for managing multiple Azure VMs is to run Deploy-WACAzVM.ps1 from Azure Cloud Shell.

Source: official documentation

Question 10 Manage virtual machines

A Hyper-V host with an AMD EPYC processor needs to run nested virtualization for a guest VM. What is the minimum host operating system version required for AMD-based nested virtualization, and how does this compare to the Intel requirement?

  1. Windows Server 2016 or later for both AMD and Intel processors, with no difference
  2. Any Windows Server version supports nested virtualization on AMD EPYC with no minimum
  3. Windows Server 2012 R2 or later for AMD EPYC, versus Windows Server 2019 or later for Intel
  4. Windows Server 2022 or later for AMD EPYC, versus Windows Server 2016 or later for Intel VT-x/EPT processors
Show the answer and the explanation

Correct answer: D

For AMD EPYC/Ryzen processors, the Hyper-V host must be Windows Server 2022 or later, while for Intel processors with VT-x and EPT, the host must be Windows Server 2016 or later — a different, later minimum for AMD.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.