AZ-802 Exam Questions & Answers

Limiting how much storage space an individual user can consume within a specific shared folder is a per-folder, per-user quota requirement, and File Server Resource Manager (FSRM) is the Windows Server role service built for exactly this: FSRM quotas are applied to a volume or folder path and can automatically enforce a hard or soft capacity limit, optionally sending notifications or running scripts as usage approaches the threshold. Because FSRM quotas are folder-scoped, an administrator can apply one directly to UserData (or to per-user subfolders beneath it) to cap consumption without affecting unrelated shares on the same volume. Storage Spaces is a platform for pooling physical disks into virtual disks and has no concept of per-user or per-folder capacity limits; it only manages capacity at the storage-pool and virtual-disk level. Work Folders is a technology for syncing user files between devices and a central server location, addressing availability/synchronization, not capacity enforcement. Distributed File System (DFS) Namespaces provides a unified logical namespace over shared folders that may reside on different servers, which simplifies access and organization but does nothing to restrict how much data any given user stores. Because the requirement is specifically about capping per-user consumption inside one shared folder, File Server Resource Manager quotas are the appropriate and only fitting tool among the options.

After a Microsoft Defender for Identity instance has been connected to a domain, each domain controller is onboarded individually by downloading the sensor package generated by that instance, extracting it, and running Azure ATP Sensor Setup.exe with elevated administrative privileges, which installs the Defender for Identity sensor on that domain controller and registers it against the connected instance so it can begin capturing and analyzing local authentication and directory traffic. AzureConnectedMachineAgent.msi is instead used to onboard a server to Azure Arc, which has nothing to do with Defender for Identity sensor deployment; MARSAgentInstaller.exe installs the Microsoft Azure Recovery Services agent used for Azure Backup scenarios, which is also unrelated; and MMASetup-AMD64.exe installs the legacy Microsoft Monitoring Agent, which is a completely different, now largely retired monitoring component. Because none of those three alternatives installs or registers the Defender for Identity sensor itself, running Azure ATP Sensor Setup.exe on each of DC1, DC2, and DC3 is the correct and necessary action to onboard all three domain controllers.

Because a domain-wide Group Policy Object already enforces Credential Guard with UEFI lock across all domain members, that policy setting is authoritative and will simply reapply the enabled, UEFI-locked Credential Guard configuration to Server1 the moment Group Policy next refreshes, entirely regardless of whatever one-time local change was just made to disable it. For the currently disabled state on Server1 to actually persist rather than being silently overwritten at the next policy refresh, the governing Group Policy Object itself has to be updated so that its Turn On Virtualization Based Security setting is no longer configured to enforce Credential Guard for the organizational unit or scope that Server1 falls under; only changing the policy that controls this setting stops Group Policy from re-asserting Credential Guard on Server1. Running the Device Guard and Credential Guard hardware readiness tool only assesses hardware compatibility and makes no configuration changes at all, and running dism with the /Disable-Feature and /FeatureName:IsolatedUserMode parameters only changes local machine state, which, exactly like the earlier local disable action, would simply be reverted the next time the domain-wide Group Policy setting reapplies to Server1.

Azure Site Recovery's replication policy for protecting on-premises Hyper-V virtual machines by replicating them to Azure is built on top of the underlying Hyper-V Replica engine, and the Copy frequency setting exposed in that replication policy offers only a small, fixed set of selectable intervals rather than an arbitrary custom value, with the shortest of those available intervals being 30 seconds. Selecting 30 seconds for the Copy frequency setting therefore configures the replication policy to send VM1's changed data to Azure as frequently as the underlying platform allows, which produces the smallest achievable recovery point interval and the least amount of potential data loss in the event of a failover, directly satisfying the requirement to replicate changes as often as possible. Values shorter than 30 seconds, such as 15 seconds, are not among the set of supported choices for this setting at all, since the Hyper-V Replica engine underlying this replication policy was not designed to support sub-30-second replication cycles, and the 1-minute and 5-minute options, while valid selectable choices, both replicate less frequently than the 30-second option and would therefore not satisfy the requirement to minimize the interval between replication cycles as much as the platform supports.

A DFS namespace's own availability, independent of which file servers ultimately host its folder targets, depends on how many namespace servers host the namespace's root, and only a domain-based namespace supports hosting the same namespace root on multiple servers simultaneously; a stand-alone namespace can exist on only a single server and has no built-in redundancy for the namespace root itself, so if that one server goes down, the entire \\domain\Corp path becomes unreachable regardless of how many file servers actually hold the underlying share data. Configuring a domain-based namespace named Corp and adding both Server1 and Server2 as namespace servers means the namespace root and its full folder-target referral list are hosted redundantly on two independent servers, so clients can still resolve and browse \\contoso.com\Corp even if either Server1 or Server2 is offline, directly satisfying the availability requirement; Server3's and Server4's shares are then simply added as folder targets under that namespace, which does not by itself require redundancy for the requirement described. A DFS Replication group only synchronizes file content between folder targets and provides no client-facing namespace redundancy at all, and configuring only Server1 as the namespace server leaves a single point of failure exactly like a stand-alone namespace would, failing the requirement.