Your network contains an Active Directory Domain Services (AD DS) domain.The domain contains a member server named DNS1 that has the DNS Server role installed and PowerShell remoting enabled. The domain contains a group named DNSOperators.The members of DNSOperators perform routine DNS tasks on DNS1 by using PowerShell. The DNSOperators members are NOT local administrators on DNS1.You need to configure remote management for DNSOperators. The solution must meet the following requirements: ● Enable access to DNS1 by using non-admin domain accounts. ● Allow only the required DNS commands to run on DNS1. ● Prevent adding DNSOperators to privileged groups.What should you implement?
Answer(s): C
Just Enough Administration (JEA) should be used to configure secure, delegated remote management for this group.Enable non-admin access: JEA allows users to connect to the server using their standard, non-privileged domain user accounts while executing commands under the context of a temporary, elevated local virtual account.Allow only required DNS commands: By using role capability files (.psrc), you can restrict the session to expose only specific DNS PowerShell cmdlets and parameters, blocking all other system commands.Prevent privileged group membership: Group members do not need to be added to the local Administrators, Domain Admins, or any other privileged security groups.
https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/jea/overview
HOTSPOT (Drag and Drop is not supported)You have an Azure Automation account named AA1 in a resource group named RG1.You have an Azure Arc-enabled server named Server1 that runs Windows Server and is in a resource group named RG2.You have a User Hybrid Runbook Worker group named Group1. Server1 is registered as a worker in Group1.You store the service URL required by the Hybrid Runbook Worker extension for AA1 in a variable named $connectionValue.You need to install the Hybrid Worker extension on Server1.How should you complete the PowerShell script? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one pointHot Area:
Answer(s): A
Box 1: AutomationAccountURL AutomationAccountURL: This is the configuration key that the extension looks for to know which Azure Automation service URL endpoint to check into.Box 2: New-AzConnectedMachineExtension Because the target is an Azure Arc-enabled server (and not a native Azure virtual machine), you must use the Arc-specific cmdlet (New-AzConnectedMachineExtension) rather than the native VM version (Set-AzVMExtension).
https://learn.microsoft.com/en-us/azure/automation/extension-based-hybrid-runbook-worker-install
HOTSPOT (Drag and Drop is not supported)You have an Azure virtual machine scale set named vmssWeb.vmssWeb hosts identical virtual machines that run Windows Server and have the Web Server (IIS) server role installed. vmssWeb has a fixed capacity of 10 virtual machine instances.Monitoring shows the following patterns: ● On Saturdays and Sundays, vmssWeb requires only two virtual machine instances by 7:00 AM. ● During business days, launches by your company’s marketing department can cause unpredictable processor demand.You need to configure capacity management for vmssWeb. The solution must meet the following requirements: ● Automatically set weekend capacity to two virtual machine instances. ● Increase capacity during business-day demand spikes. ● Minimize manual intervention.What should you configure for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Configure a recurring autoscale profile Autoscale settings with a recurrence schedule is the correct feature to set up.Steps: 1. Enable Autoscale: Go to your Virtual Machine Scale Set in the Azure Portal and select Scaling.2. Create a Custom Profile for Weekends: Add a new scaling profile configured for a Recurrence schedule.3. Set Weekend Times: Choose Saturday and Sunday and set the time to 7:00 AM.4. Set Instance Limits: Change the instance count to a fixed capacity of 2 for this weekend profile.5. Configure Weekday Scaling: Set up a separate default profile or metric rules based on CPU percentage (e.g., scale out when CPU is high, scale in when low) with a minimum of 2 and a maximum of 10 instances to handle unpredictable marketing launches.Box 2: Create a scheduled scale-out profile Create a Business-Day Profile (Metric-based): Set a scale condition for Monday through Friday (or use as your default profile).Define an instance range with a minimum of baseline instances (e.g., 2 or higher) and a maximum instance limit of 10.Add a scale-out rule based on a host performance metric like Percentage CPU (e.g., increase instance count by 2 or by a percentage when average CPU > 70% over a 5 to 10-minute period) to seamlessly catch unpredictable marketing demand.Add a corresponding scale-in rule (e.g., decrease instance count when CPU < 30% over a 10-minute period) to reduce capacity back down safely during quieter intervals.
https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-autoscale-overview
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server and store BitLocker recovery keys in AD DS.A server named Server1 starts in BitLocker recovery mode.You need to identify the BitLocker recovery key for Server1.Solution: You use ADSI Edit and view the properties of the Server1 computer object.Does this meet the goal?
Answer(s): B
Correct: * From Active Directory Users and Computers, you use BitLocker Recovery Password Viewer. You can locate the BitLocker recovery key in Active Directory by using the BitLocker Recovery Password Viewer extension inside Active Directory Users and Computers (ADUC).Incorrect:* You run ntdsutil.exe on a domain controller.* You run repair-bde.exe by using a BitLocker key package exported from AD DS.* You use ADSI Edit and view the properties of the Server1 computer object.
https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/ recovery-process
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server and store BitLocker recovery keys in AD DS.A server named Server1 starts in BitLocker recovery mode.You need to identify the BitLocker recovery key for Server1.Solution: You run repair-bde.exe by using a BitLocker key package exported from AD DS.Does this meet the goal?
Post your Comments and Discuss Microsoft AZ-802 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-802 content, but please register or login to continue.