Free AZ-802 sample questions

Correct answer: The Denied RODC Password Replication Group supersedes the Allowed RODC Password Replication Group, preventing User1's credentials from being cached.

In Active Directory Domain Services, evaluation of the RODC Password Replication Policy (PRP) follows strict precedence where explicit Deny rules supersede Allow rules. The Denied RODC Password Replication Group is specifically designed to protect administrative and sensitive accounts from having their credentials stored in branch offices with limited physical security. Because User1 is a member of the Denied group, their credentials are never cached locally on the RODC, causing authentication to fail when the WAN link is unavailable.

Correct answer: The technician becomes a local administrator on that specific RODC only, with no administrative privileges on other domain controllers or directory partitions.

Staging an RODC via Add-ADDSReadOnlyDomainControllerAccount allows domain administrators to delegate the installation and day-to-day server maintenance to a standard user or group. When the delegated principal attaches the server to the staged account during promotion, they automatically become a member of the local Administrators group on that specific RODC. They do not gain administrative permissions on writable domain controllers or other domain resources.

Correct answer: True

In a multi-domain forest, authenticating user accounts requires resolving universal group memberships across all domains, which requires contacting a Global Catalog (GC) server. If the RODC is not designated as a Global Catalog and Universal Group Membership Caching (UGMC) is disabled on the branch site, the RODC must forward universal group resolution queries over the WAN to an external GC. If the WAN link fails, universal group memberships cannot be verified, causing user logons to fail even if password hashes are cached locally.

Correct answer: Create a site link bridge containing Link-AB and Link-AC; the cumulative cost is 25.

When 'Bridge all site links' is disabled (standard in non-fully routed networks), site links operate as isolated conduits without implicit transitivity. To establish a transitive replication pathway between SiteB and SiteC across intermediate SiteA, an administrator must create an explicit site link bridge containing Link-AB and Link-AC. The KCC calculates replication routing costs across a site link bridge by summing the individual costs of all included member links (10 + 15 = 25). graph LR SiteB[SiteB: Branch] ---|Link-AB Cost: 10| SiteA[SiteA: Hub] SiteA ---|Link-AC Cost: 15| SiteC[SiteC: Branch] subgraph Site Link Bridge: Bridge-BAC Link-AB Link-AC end

Correct answer: Intersite replication is strictly unidirectional outbound from the writable bridgehead server to the RODC; bridgehead servers never pull directory changes from the RODC.

Active Directory intersite replication involving an RODC is strictly unidirectional. Because the RODC database is read-only, writable bridgehead domain controllers never pull directory changes from an RODC. The KCC automatically generates one-way inbound connection objects on the RODC, pulling updates from writable bridgehead servers in the hub site.

Correct answer: In Active Directory Sites and Services, create a subnet object for 10.120.0.0/20 and associate it with the Branch-Denver site.

The Active Directory DC Locator mechanism matches the client's IP address against configured subnet objects in Active Directory Sites and Services to determine the client's site. When a workstation's IP (such as 10.120.4.50 within 10.120.0.0/20) does not match any defined subnet object, the client is deemed site-agnostic and may authenticate against any DC in the domain, including remote DCs in HQ-Chicago. Defining the subnet object and associating it with Branch-Denver ensures Denver workstations query and authenticate against local DCs. flowchart TD Client[Denver Workstation: 10.120.4.50] -->|DC Locator Query| DNS[DNS Server] DNS -->|Returns DC IP List| Client Client -->|Netlogon Ping to DC| DC_HQ[HQ-Chicago DC] DC_HQ -->|Evaluates Client Subnet| SubnetCheck{Subnet Object in AD?} SubnetCheck -->|No Subnet Defined| Fallback[Returns Random/HQ DC - High Latency] SubnetCheck -->|Mapped to Branch-Denver| LocalDC[Redirects to DEN-DC01/02 - Fast Logon]