Microsoft AZ-802 Practice Exam Questions & Answers

The three requirements together describe just-in-time (JIT) VM access: administrators must request approval before an RDP connection is allowed, and once granted, access is restricted to specific source IP addresses and to a specific management port. JIT VM access is a capability of Microsoft Defender for Cloud (under the Defender for Servers plan); it dynamically locks down inbound rules on the VM's network security group and only opens the specified port, for the specified source IP addresses, for a limited time after an access request is approved. A network security group alone can restrict traffic by port and source IP, but it has no request-and-approval workflow or automatic time-limited opening/closing behavior --- it only enforces whatever rules are already statically configured; it is really the mechanism JIT manipulates, not the solution that provides the request-approval layer. Microsoft Entra Privileged Identity Management manages time-bound elevation for Entra ID and Azure RBAC roles, not network-level port access. Azure Front Door is a global HTTP/HTTPS load balancer and application delivery service, unrelated to RDP access control. Microsoft Defender for Cloud is therefore the correct configuration target.

Azure Site Recovery recovery plans support inserting automated steps before or after each failover group within the plan, and the mechanism used to run that automation is an Azure Automation runbook invoked directly from the recovery plan. Runbooks can call Azure Resource Manager operations, PowerShell workflows, or other custom orchestration logic, which makes them a natural fit for replacing a manual step such as reconfiguring a load balancer, updating DNS records, or validating application health once the 200 virtual machines have failed over. An Azure Desired State Configuration virtual machine extension enforces configuration state on a running VM rather than integrating with the recovery plan's action framework, an Azure PowerShell function run outside of Automation has no native hook point within a recovery plan, and a Custom Script Extension executes a script inside a VM rather than as an orchestrated recovery-plan action. Because Azure Automation runbooks are the specific, documented integration point Site Recovery recovery plans use for automating manual actions, that is the correct choice for automating one of the plan's three manual steps.

For hybrid-joined devices using a hybrid key trust or hybrid certificate trust Windows Hello for Business deployment model, the on-premises AD DS domain controllers need visibility of the device objects that Microsoft Entra ID has registered for hybrid join, so that the domain controller can validate the device during Kerberos authentication as part of the Windows Hello for Business sign-in flow. Device writeback, an optional Microsoft Entra Connect feature, writes those Microsoft Entra-registered device objects back into the on-premises AD DS forest, which is the specific prerequisite this hybrid Windows Hello for Business scenario depends on. Group writeback instead synchronizes cloud-created Microsoft 365 and security groups back to on-premises AD and has no relationship to device sign-in. Password writeback lets cloud-initiated self-service password resets be written back to on-premises AD DS, which is unrelated to Windows Hello for Business enrollment. Directory extension attribute sync and Microsoft Entra app and attribute filtering both control which custom attributes or objects are included in synchronization scope and do not affect device authentication capabilities. Device writeback is therefore the correct optional feature to enable.

Hyper-V Replica supports two authentication methods: Kerberos (integrated Windows authentication) over an unencrypted HTTP connection, which requires both the primary and replica servers to be domain-joined and mutually trusted, or certificate-based authentication over an encrypted HTTPS connection. Because Server2 is a non-domain-joined, remotely located Hyper-V host, Kerberos authentication is not available, so replication from Server1 must be configured to use certificate-based authentication, which also has the advantage of encrypting replication traffic in transit over the connection to the remote location. Setting this up requires issuing or importing a matching certificate on both Server1 and Server2, configuring the Replica server to accept HTTPS connections on the Hyper-V Replica listener, and specifying the certificate thumbprint when enabling replication for VM1, none of which is required for the simpler but domain-dependent Kerberos option. Because the certificates must chain to a mutually trusted root and Server2 is not part of the same AD DS forest, the certificates are typically issued by a third-party or shared internal certificate authority that both hosts already trust independently of any Active Directory relationship.

Microsoft Defender for Cloud's Workflow automation feature lets an administrator configure a trigger based on a specific security alert -- such as 'Antimalware disabled in the virtual machine' -- a recommendation, or a regulatory compliance change, that automatically invokes an Azure Logic App when that trigger condition occurs. The Logic App can then execute whatever remediation steps are defined in its workflow, including calling the Azure Resource Manager / Compute API to shut the affected virtual machine down, providing fully automated, alert-driven response without requiring manual intervention from an administrator. A workbook only visualizes and reports on data and cannot take remediation action. A security policy defines which security recommendations and standards apply to a scope of resources but does not execute response actions when an alert fires. Adaptive network hardening only generates recommendations to tighten network security group rules and has no relationship to antimalware alerts or virtual machine shutdown actions. Therefore, configuring workflow automation to trigger a logic app is the correct approach.

Onboarding Server1 to Microsoft Defender for Endpoint enables endpoint detection and response telemetry, threat protection, and security recommendations for that specific device, but Defender for Endpoint is a separate security product from Microsoft Sentinel and does not configure Server1 as a log source for the Windows Firewall data connector. Onboarding to Defender for Endpoint installs its own sensor and forwards its own telemetry to the Microsoft 365 Defender portal and, when connected, to Sentinel through the Defender for Endpoint connector, but it does not deploy the Azure Monitor Agent or the data collection rule that the Windows Firewall connector specifically depends on to collect Windows Firewall event log entries from Server1. Because these are two independent data pipelines with different underlying agents and different data collection rules, onboarding Server1 to Defender for Endpoint has no effect on whether Windows Firewall logs specifically reach Sentinel through the Windows Firewall connector, so this solution does not meet the stated goal.

Hyper-V Replica's Additional Recovery Points setting, which is configured on the Configure Recovery History page of the Enable Replication wizard when replication for VM1 is first set up, lets an administrator specify that a series of hourly recovery points, for up to a maximum of 24 hours of history, be retained on the replica server alongside the single latest, most up-to-date replica of the virtual machine. Because the requirement in this scenario is to be able to restore VM1 to a specific state from as far back as eight hours ago, the Enable Replication wizard's recovery points configuration must be used and set to retain at least eight hours of Additional Recovery Points, since without this setting enabled with a sufficiently long retention window, only the latest replica state would be available and no historical point-in-time restore within that eight-hour window would be possible. Enabling automatic checkpoints on VM1's own properties is unrelated to Hyper-V Replica's separate point-in-time replica history mechanism and would not create restorable recovery points on the replica server at all, NUMA spanning is a memory-configuration setting on the Hyper-V host with no bearing whatsoever on replication or recovery points, and modifying the replication frequency only changes how often changed data is sent from Host1 to Host2, not how many historical recovery points are retained once it arrives, so configuring recovery points from the Enable Replication wizard is the only option that actually addresses this requirement.