Microsoft Updated AZ-802 Exam Questions and Answers by cory

Older logs overwritten: The Performance Counter properties. Stop below 500 MB free: The Data Manager properties.

The individual Performance Counter data collector inside a Data Collector Set has its own Properties dialog with a File tab that includes an Overwrite option, and enabling that option causes each new logging run to overwrite the previous log file in place rather than creating a new, separately numbered file each time -- this is exactly the control needed to make older performance counter logs get replaced by newer ones. Disk-space-based retention, on the other hand, is governed at the level of the Data Collector Set as a whole through its Data Manager properties, which expose a Minimum Free Disk Space setting, alongside Maximum Folders and Maximum Root Path Size settings, that Windows evaluates against the log directory ' s volume to manage or halt further data collection once free space drops below the configured threshold. Because these two behaviors live on two entirely different property pages -- one scoped to the individual counter ' s file settings and the other scoped to the Data Collector Set ' s overall data management -- the Configuration properties option, which governs sample interval and duration settings, does not control either of these two requirements.

Core isolation, which is the feature group that includes Memory Integrity, also known as Hypervisor-protected Code Integrity or HVCI, is surfaced and enabled from the Device security tile of the Windows Security app, since it is a hardware- and virtualization-based security capability grouped alongside other device-level protections such as the Security processor and Secure Boot status. Mandatory ASLR, which forces address space layout randomization for images that were not compiled with ASLR support, is one of the individually configurable system-level Exploit Protection settings, and Exploit Protection as a whole is configured from the App & browser control tile, alongside Windows Defender SmartScreen and Controlled folder access, rather than from Device security or Virus & threat protection. Because these two settings live under two different top-level tiles in the Windows Security app despite both being low-level exploit-mitigation and platform-security features, an administrator enabling both Core isolation and Mandatory ASLR needs to visit Device security for the first setting and App & browser control for the second.

Rule Type: Isolation. Requirements: Require authentication for inbound and outbound connections. Authentication Method: Computer (Kerberos V5).

Restricting a set of servers so that they only accept inbound connections from, and only initiate outbound connections to, other domain-joined computers describes the classic domain or server isolation scenario in Windows Defender Firewall with Advanced Security, so the rule type must be Isolation rather than Tunnel, which is used to secure gateway-to-gateway traffic, or Authentication exemption, which excludes specific hosts from having to authenticate at all. Because both stated requirements use the word only, with no allowance for a fallback to unauthenticated traffic in either direction, the Requirements setting must be set to Require authentication for inbound and outbound connections rather than the softer default of requiring authentication only for inbound connections while merely requesting it for outbound connections. Since every server in OU1 and every legitimate client that needs to reach them is already joined to the contoso.com domain, Computer (Kerberos V5) is the appropriate authentication method, because it uses the existing Active Directory infrastructure for authentication and avoids the certificate enrollment and public key infrastructure overhead that would only be necessary if non-domain-joined devices needed to be included in the trust boundary.

1. Restore the system state to an alternate location. 2. Mount Active Directory to port 51389. 3. From Active Directory Users and Computers, change the domain controller to localhost:51389. 4. View the membership of the group.

Because the group object itself was not deleted -- only its member attribute was changed -- the Active Directory Recycle Bin cannot help, since it restores deleted objects rather than attribute-level changes made to objects that still exist. The documented, non-destructive way to recover this kind of historical data without touching production is to restore a system state backup to an alternate location, leaving the live directory database untouched, and then use dsamain.exe to mount that restored database as a standalone, read-only LDAP instance listening on a custom port such as 51389. An administrator then points Active Directory Users and Computers at localhost on that port, which lets the snapshot ' s contents be browsed exactly as if it were a live domain controller, and simply views the group ' s prior membership from within that mounted, historical copy. This retrieves the list of former members precisely as required, without performing an authoritative restore or altering any production data.