Microsoft Updated AZ-802 Exam Questions and Answers by stella

1. Create a site and a subnet (RemoteSite1, associated with the datacenter ' s IP subnet). 2. Create a site link (connecting RemoteSite1 to the existing site, with the desired schedule/cost). 3. Pre-create an RODC account (delegating its installation to User1).

Because Server1 must end up in a brand-new site, the plan must begin by creating that site along with a subnet object mapped to the datacenter ' s IP range and associated with the new site, which is exactly what places Server1 in RemoteSite1 once it is promoted there. Next, to be able to control the replication schedule between RemoteSite1 and the rest of the forest, an administrator must create a dedicated site link, since replication timing, frequency, and cost between sites are properties of the site link object, not of the sites themselves; without an explicit site link (or by relying only on a shared default link), that granular scheduling control would not exist for this specific site pair. Finally, to satisfy least privilege while still letting User1 — a mere local administrator on Server1, not a domain administrator — complete the RODC promotion, the recommended practice is to pre-create (stage) the RODC computer account in advance and explicitly delegate the installation to User1 during that staging process. This lets User1 attach Server1 to the pre-created account and finish the promotion locally without ever needing domain-wide administrative rights. Running the AD DS installation wizard directly as a non-delegated local admin would fail without domain credentials, and adding User1 to the Contoso\Administrators (Domain Admins) group would grant far more access than necessary, violating least privilege. The correct order is: create the site and subnet, create the site link, then pre-create the RODC account.

Promoting a member server to a domain controller in a specific domain requires membership in either the Enterprise Admins group (forest-wide rights) or the Domain Admins group of that target domain. Server1 is a member server in canada.contoso.com, and the requirement is to promote it to a domain controller in that same domain. Admin1 belongs to Contoso\Enterprise Admins, which has full administrative rights across every domain in the forest, including the right to install AD DS and promote a server anywhere in the forest, so Admin1 qualifies. Admin3 belongs to Canada\Domain Admins, the Domain Admins group of canada.contoso.com itself, which grants full administrative control, including domain controller promotion, within that domain, so Admin3 also qualifies. Admin2, by contrast, is a member of Contoso\Domain Admins, the Domain Admins group of the contoso.com domain; Domain Admins rights are scoped to their own domain and do not extend into a child domain such as canada.contoso.com, so Admin2 cannot promote Server1. User1 has only standard Domain Users membership and holds no administrative rights anywhere. Therefore, only Admin1 and Admin3 currently have sufficient rights, making option C correct.

Group3: Group1, Group2, Group4, and Group5 only. Group5: Group4 only.

Group nesting in AD DS is governed strictly by group scope, independent of whether a group is security- or distribution-type. A Domain Local group can contain user accounts, Global groups from any domain, and Universal groups from any domain, plus other Domain Local groups from its own domain only. Group3 is a Domain Local group in contoso.com, so it can accept Group1 (Universal, contoso.com), Group2 (Global, contoso.com), and Group4 and Group5 (both Global, canada.contoso.com), since Global groups from any domain are valid Domain Local members. It cannot accept Group6, because Group6 is Domain Local in canada.contoso.com, a different domain, and Domain Local groups may only nest other Domain Local groups from their own domain. That gives Group3: Group1, Group2, Group4, and Group5 only. A Global group, by contrast, can contain only user accounts and other Global groups from the same domain. Group5 is Global in canada.contoso.com, so among the remaining groups only Group4 qualifies, since it is also Global and in the same domain; Group1 (Universal), Group2 (Global but a different domain), and Group6 (Domain Local) are all excluded by scope rules. That gives Group5: Group4 only.

The stated problem is that when an administrator connects to VM2 ' s console through Virtual Machine Connection and disconnects without signing out, a second administrator who opens the console can silently inherit that still-signed-in session without ever supplying credentials. By default, VMConnect attaches directly to the raw console of the guest, which behaves like walking up to a physical, unlocked machine. Enhanced Session Mode changes this behavior by routing the VMConnect session over the Remote Desktop Protocol into the guest, which means every connection is treated as a new interactive Remote Desktop logon and therefore always prompts for credentials, eliminating the ability to passively inherit someone else ' s open session. Enabling Enhanced Session Mode requires both host-side and guest-side support (the guest operating system must support RDP and have the setting enabled) but is the direct, purpose-built fix for this exact console-sharing problem. The Guest Services integration component only enables basic file-copy functionality between host and guest and has no effect on console/session behavior. Credential Guard protects locally stored credentials from theft using virtualization-based security, and shielded VMs protect a VM ' s disk, state, and console from a compromised or malicious fabric administrator; neither addresses console session takeover between two legitimate administrators. Enhanced Session Mode is therefore the correct solution.