AZ-802 Exam Prep: Free Sample Questions with Full Explanations

The AZ-802 isn't a vocabulary test. It tests whether you can make the right infrastructure decision when AD DS, Azure Arc, and a management deadline are all competing for your attention at once. The exam is broad: seven domains, from AD DS and hybrid management to storage, security and troubleshooting.

The sample questions below are pulled directly from the CertCompanion question bank for AZ-802. No signup, no paywall. Work through them before you read anything else on this page, your score will tell you more than any study plan can.

Quick Facts#

Where Can You Practise with Realistic AZ-802 Questions?#

Right here. The section below contains free sample questions from our bank: scenario-based prompts in multiple-choice and multiple-response style.

Before you start, know the exam's shape. The passing score is 700/1000, confirmed in the official study guide.

10 free AZ-802 practice questions#

These are real questions from our 600-question AZ-802 bank - the same pool the full practice exam draws from, not simplified samples. Answer before you expand the explanation.

Question 1#

Proseware Inc. has two separate Active Directory forests that do not have a trust relationship between them. The company needs to synchronize user identities from both forests into a single Microsoft Entra ID tenant while minimizing infrastructure footprint and avoiding the deployment of a dedicated synchronization server. Which Microsoft identity synchronization solution should they implement? (Select one!)

• A. Microsoft Entra Connect Sync installed on a dedicated server with multi-forest configuration enabled
• B. Microsoft Entra Connect Health with custom synchronization rules defined for each forest
• C. Microsoft Entra Domain Services with a separate managed domain created in Azure for each forest
• D. Microsoft Entra Cloud Sync with lightweight provisioning agents deployed independently in each forest

Show answer and explanation

Correct answer: D. Microsoft Entra Cloud Sync with lightweight provisioning agents deployed independently in each forest

Microsoft Entra Cloud Sync is specifically architected for multi-forest scenarios, including environments where forests have no trust relationship between them. Lightweight provisioning agents are installed independently within each forest and communicate directly with Microsoft Entra ID over outbound HTTPS, eliminating the need for a dedicated synchronization server or any network connectivity between the two forests. This allows identities from multiple disconnected forests to flow into a single tenant with minimal on-premises infrastructure. Microsoft Entra Connect Sync requires the synchronization server to have network access to all participating forests and is a heavier deployment that benefits from a dedicated server, making it unsuitable when minimizing infrastructure is a requirement. Microsoft Entra Domain Services provides a managed domain service hosted in Azure and does not synchronize on-premises identities from existing forests into a customer-managed Entra ID tenant. Microsoft Entra Connect Health is a monitoring and diagnostic solution for synchronization health, not an identity synchronization engine.

Question 2#

A systems administrator at Trey Research is deploying a security testing and vulnerability assessment lab on a Windows Server 2022 Hyper-V host. The lab consists of five virtual machines running various operating systems and penetration testing tools. The lab design requirements specify the following: all five VMs must be able to communicate with each other over a shared network segment; the VMs must have no network connectivity to the Hyper-V host operating system; the VMs must have no access to the corporate physical network or the internet. Which type of Hyper-V virtual switch should the administrator create to satisfy all three requirements? (Select one!)

• A. Internal virtual switch that creates a virtual NIC on the Hyper-V host for management communication
• B. Private virtual switch that allows VM-to-VM communication with no connection to the host operating system or any physical network
• C. External virtual switch configured with VLAN tagging to segment traffic away from the production network
• D. External virtual switch bound to the host physical network adapter to provide full network connectivity

Show answer and explanation

Correct answer: B. Private virtual switch that allows VM-to-VM communication with no connection to the host operating system or any physical network

A private virtual switch in Hyper-V creates an isolated network segment that is shared exclusively among the virtual machines connected to it. Unlike an internal virtual switch, a private switch does not create a virtual network adapter on the Hyper-V host operating system, ensuring the host has no layer-2 path into the VM network. Unlike an external virtual switch, it is not bound to any physical network adapter, preventing all connectivity to corporate infrastructure or the internet. This makes a private virtual switch the correct choice for security labs and isolated test environments where VMs require mutual network access but must remain completely segregated from the host and external networks. An external virtual switch connects VMs to the physical network through the host adapter, violating the isolation requirement. An internal virtual switch also provides connectivity to the host through a virtual NIC, which violates the requirement that the host have no access to the VM network.

Question 3#

A virtualization administrator at Contoso Ltd. is provisioning a Hyper-V environment on Windows Server 2022 to support two separate workloads. The first workload consists of QA test virtual machines used for malware behavior analysis that must have absolutely no network connectivity to the Hyper-V host operating system, the corporate LAN, or the internet. The second workload consists of production application virtual machines that require full access to the corporate network and internet. The administrator wants to use the minimum number of virtual switches while meeting both isolation requirements. Which two virtual switch types should the administrator create? (Select two!)

• A. External virtual switch for the malware analysis VMs
• B. Private virtual switch for the malware analysis VMs
• C. Internal virtual switch for the malware analysis VMs
• D. External virtual switch for the production application VMs
• E. Internal virtual switch for the production application VMs

Show answer and explanation

Correct answer: B. Private virtual switch for the malware analysis VMs and D. External virtual switch for the production application VMs

A private virtual switch provides network connectivity exclusively between virtual machines connected to that switch on the same Hyper-V host. It has no pathway to the Hyper-V host operating system or any physical network adapter, making it the correct choice for malware analysis VMs that must be completely isolated from the corporate environment. An external virtual switch binds to a physical network adapter on the Hyper-V host and provides virtual machines with direct connectivity to the physical network, enabling full corporate LAN and internet access for the production application VMs. An internal virtual switch allows communication between virtual machines and the Hyper-V host operating system but not to the external physical network; it does not satisfy the total isolation requirement for malware analysis, since the host can still communicate with those VMs. Using an external switch for malware analysis VMs would create a direct path from potentially dangerous workloads to the physical corporate network, violating the isolation requirement.

Question 4#

Litware Inc. has a Windows Server 2022 Active Directory forest with three domains: a forest root domain and two child domains. The forest root domain has four domain controllers. Two of these domain controllers are configured as Global Catalog servers, and the remaining two are not. During a routine FSMO role audit, an administrator discovers that the Infrastructure Master role is hosted on one of the two Global Catalog servers. What is the potential consequence of this placement in the current environment? (Select one!)

• A. Intra-site replication for the domain partition will fail on domain controllers that do not hold the Global Catalog role
• B. Schema attribute modifications will be rejected until the Infrastructure Master is relocated to a non-Global Catalog domain controller
• C. Cross-domain group membership references in the forest may become stale or fail to update correctly
• D. Account lockout processing will be delayed because the Infrastructure Master conflicts with Global Catalog server responsibilities

Show answer and explanation

Correct answer: C. Cross-domain group membership references in the forest may become stale or fail to update correctly

In a multi-domain forest where not all domain controllers are Global Catalog servers, the Infrastructure Master should not be hosted on a Global Catalog server. The Infrastructure Master is responsible for updating phantom objects, which are cross-domain references used to resolve group memberships that span domain boundaries. When the Infrastructure Master runs on a Global Catalog server, it already holds a full replicated copy of all objects across the forest and therefore never detects which phantom references have become stale, causing cross-domain group membership data to stop refreshing correctly. This rule has one important exception: if every domain controller in the domain is also a Global Catalog server, the Infrastructure Master placement does not matter because phantom reference detection becomes unnecessary. Schema modification authority belongs exclusively to the Schema Master and is entirely unrelated to Infrastructure Master placement. Account lockout processing is managed by the PDC Emulator. Intra-site replication topology is managed by the Knowledge Consistency Checker and is not influenced by which DC holds the Infrastructure Master role.

Question 5#

Northwind Traders is deploying IP Address Management (IPAM) on Windows Server 2022 to provide centralized management of their enterprise DHCP and DNS infrastructure. The network team is reviewing the architectural requirements before beginning the deployment. Which two statements accurately describe the requirements and capabilities of Windows Server IPAM? (Select two!)

• A. IPAM can be installed directly on a domain controller to consolidate directory services and IP address management on a single infrastructure server
• B. When Group Policy-based provisioning is selected during IPAM configuration, IPAM automatically creates a Group Policy Object that configures Windows Firewall rules on managed DHCP and DNS servers and enables automatic server discovery across the corporate network
• C. IPAM stores its operational data in either the Windows Internal Database for smaller deployments or a Microsoft SQL Server instance for larger enterprise environments requiring greater scalability
• D. IPAM's primary function is limited to DHCP scope management and it cannot track IP address utilization statistics or generate address space reporting
• E. IPAM can only manage DHCP and DNS servers running Windows Server 2019 or later and does not support managing servers running earlier operating system versions

Show answer and explanation

Correct answer: B. When Group Policy-based provisioning is selected during IPAM configuration, IPAM automatically creates a Group Policy Object that configures Windows Firewall rules on managed DHCP and DNS servers and enables automatic server discovery across the corporate network and C. IPAM stores its operational data in either the Windows Internal Database for smaller deployments or a Microsoft SQL Server instance for larger enterprise environments requiring greater scalability

Group Policy-based provisioning is the recommended and most automated provisioning method for IPAM. When selected during setup, IPAM creates a GPO that is linked to the domain and automatically pushes the required Windows Firewall exception rules to all managed DHCP and DNS servers, enabling IPAM communication without manual firewall configuration on each managed server. IPAM then uses these communication paths to perform automatic scheduled discovery of DHCP and DNS servers across the corporate network. IPAM also supports two database backends: the Windows Internal Database, which is suitable for smaller deployments and requires no additional SQL Server licensing, and Microsoft SQL Server for large enterprise environments that require higher capacity, concurrent access, and database management capabilities. IPAM cannot be installed on a domain controller, this is an explicitly documented and tested deployment limitation; IPAM must be deployed on a dedicated member server. IP address utilization tracking and space reporting are core IPAM functions and are among the primary reasons organizations deploy it. IPAM supports managing DHCP servers running Windows Server 2008 R2 and later, not exclusively Windows Server 2019 or later.

Question 6#

Southridge Video needs internal DNS clients to resolve hostnames in the partner domain fabrikam.internal, which is managed entirely by a separate IT organization with authoritative DNS servers at 172.16.5.10 and 172.16.5.11. The Southridge DNS infrastructure policy strictly prohibits storing any DNS zone resource records for external or partner domains on Southridge DNS servers. Which DNS configuration should be applied to the Southridge DNS servers? (Select one!)

• A. Create a secondary zone for fabrikam.internal and configure zone transfers from 172.16.5.10
• B. Create a primary zone for fabrikam.internal on the Southridge DNS servers and populate it with manually entered records
• C. Configure a conditional forwarder for fabrikam.internal targeting 172.16.5.10 and 172.16.5.11
• D. Create a stub zone for fabrikam.internal referencing the name servers at 172.16.5.10 and 172.16.5.11

Show answer and explanation

Correct answer: C. Configure a conditional forwarder for fabrikam.internal targeting 172.16.5.10 and 172.16.5.11

A conditional forwarder instructs DNS servers to forward queries for a specific domain directly to designated DNS servers without storing any zone resource records locally. When Southridge clients query for names in fabrikam.internal, the Southridge DNS servers forward those queries to the specified addresses and return the results transparently. No DNS zone data is stored on the Southridge infrastructure, fully satisfying the policy requirement. A stub zone stores a subset of zone data including the SOA record, NS records, and address records for those name servers on the local DNS servers, which violates the no-local-records policy even though it is smaller than a full zone. A secondary zone transfers and maintains a complete read-only copy of the entire fabrikam.internal zone on the Southridge servers, directly contradicting the policy prohibition. A primary zone would make the Southridge DNS servers authoritative for fabrikam.internal, creating administrative conflicts with the actual zone owner and storing all zone records locally.

Question 7#

Adatum Corporation has a single Windows Server 2022 Active Directory domain with 2,500 user accounts. The company wants to synchronize on-premises identities to Microsoft Entra ID. Their small IT team prefers minimal on-premises infrastructure overhead. They do not require Exchange hybrid writeback, device writeback, or pass-through authentication with seamless SSO. Which synchronization solution should they deploy? (Select one!)

• A. Microsoft Entra Connect Health to monitor synchronization status
• B. Microsoft Entra Cloud Sync using a lightweight provisioning agent
• C. Microsoft Entra Connect Sync installed on a dedicated Windows Server
• D. Active Directory Federation Services with Web Application Proxy

Show answer and explanation

Correct answer: B. Microsoft Entra Cloud Sync using a lightweight provisioning agent

Microsoft Entra Cloud Sync uses a lightweight provisioning agent that can be installed directly on a domain controller or member server, requiring no dedicated synchronization server. It's the modern choice for organizations wanting minimal infrastructure overhead without needing Exchange hybrid writeback, device writeback, pass-through authentication, or seamless SSO, features exclusive to Microsoft Entra Connect Sync. For a single-domain environment with 2,500 users and a small IT team, Cloud Sync minimizes infrastructure complexity and maintenance burden. Microsoft Entra Connect Sync requires installing and maintaining a dedicated synchronization server and provides advanced features unnecessary in this scenario. Microsoft Entra Connect Health is a monitoring and reporting service for synchronization health, not a synchronization engine that replicates directory objects to Microsoft Entra ID. Active Directory Federation Services provides claims-based authentication federation but does not synchronize or provision directory objects into Microsoft Entra ID.

Question 8#

Contoso has a multi-domain Active Directory forest containing six domains. The IT team is planning to decommission the current Infrastructure Master role holder in the Sales domain and transfer the role to another available domain controller. Two candidates exist: DC-SALES01, which is also configured as a Global Catalog server, and DC-SALES02, which is not a Global Catalog server. No other domain controller in the forest is configured as a Global Catalog server. Which domain controller should hold the Infrastructure Master role, and why? (Select one!)

• A. DC-SALES02, because the Infrastructure Master must never be placed on a Global Catalog server in any multi-domain forest regardless of other domain controllers
• B. DC-SALES01 is acceptable in this scenario because the placement restriction only applies when every domain controller in the forest is also a Global Catalog server
• C. DC-SALES01, because the Infrastructure Master should always colocate with the Global Catalog server to ensure cross-domain object references are resolved most efficiently
• D. DC-SALES02, because the Infrastructure Master should avoid Global Catalog servers in a multi-domain forest unless every domain controller in the forest is also a Global Catalog server

Show answer and explanation

Correct answer: D. DC-SALES02, because the Infrastructure Master should avoid Global Catalog servers in a multi-domain forest unless every domain controller in the forest is also a Global Catalog server

The Infrastructure Master role maintains phantom objects representing principals from other domains referenced in cross-domain group memberships. When the Infrastructure Master role holder is also a Global Catalog server, it already has current information about all objects in all domains from the GC partial attribute set, so it never detects stale phantom references and therefore never updates them. This causes cross-domain group membership references to become stale over time. The correct placement rule is to avoid putting the Infrastructure Master on a GC server in a multi-domain forest unless every domain controller in the forest is a GC, at which point every DC already has complete cross-domain data and the phantom update mechanism is irrelevant. In this scenario, DC-SALES01 is the only GC and other non-GC DCs exist, so DC-SALES02 is the correct placement. The answer stating the rule applies only when all DCs are GCs reverses the logic incorrectly. The answer stating the rule is absolute with no exceptions is also wrong because the all-GC exception is a documented and important edge case.

Question 9#

Fabrikam's IT team is deploying a group Managed Service Account (gMSA) for a web farm of five IIS servers running Windows Server 2019. The domain functional level is Windows Server 2016. The administrator creates the KDS Root Key by running Add-KdsRootKey -EffectiveImmediately on the PDC Emulator and immediately attempts to create the gMSA using New-ADServiceAccount. The command fails with an error indicating the KDS Root Key cannot be found. What is the most likely cause of the failure? (Select one!)

• A. The domain functional level must be Windows Server 2019 or higher to support group Managed Service Accounts
• B. The KDS Root Key requires up to 10 hours to replicate to all domain controllers before gMSA creation can succeed
• C. The PrincipalsAllowedToRetrieveManagedPassword parameter must be populated on all IIS servers before the KDS Root Key is generated
• D. The New-ADServiceAccount cmdlet must be executed on the same domain controller where the KDS Root Key was created

Show answer and explanation

Correct answer: B. The KDS Root Key requires up to 10 hours to replicate to all domain controllers before gMSA creation can succeed

The Add-KdsRootKey -EffectiveImmediately parameter does not make the KDS Root Key immediately available for gMSA creation in production environments. Despite the parameter name, the key requires up to 10 hours to replicate to all domain controllers to ensure any DC can validate it before allowing gMSA creation. In lab and test environments only, administrators use the workaround Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10)) to backdate the key's effective time and allow immediate use. The domain functional level requirement for gMSAs is Windows Server 2012 or higher, so a Windows Server 2016 domain is fully supported. The New-ADServiceAccount cmdlet can be executed from any domain controller or management workstation with RSAT tools installed, not just the DC where the KDS Root Key was created. The PrincipalsAllowedToRetrieveManagedPassword parameter is specified as part of the gMSA creation command itself, not as a prerequisite before KDS Root Key generation.

Question 10#

Proseware Inc. operates an Active Directory forest with a domain controller deployed at a remote location that is reachable only through SMTP due to strict perimeter firewall rules blocking RPC traffic. The network team proposes configuring SMTP-based inter-site replication to keep the remote domain controller synchronized with the main site. An administrator is reviewing which Active Directory partitions support SMTP transport before approving the design. Which partition CANNOT be replicated using SMTP-based inter-site replication? (Select one!)

• A. Schema partition
• B. Configuration partition
• C. Application partition hosting forest-wide DNS zones
• D. Domain partition

Show answer and explanation

Correct answer: D. Domain partition

SMTP-based inter-site replication cannot replicate the domain partition. The domain partition contains all domain-specific objects such as user accounts, groups, computer objects, and organizational units. It requires RPC over IP as its transport and cannot use SMTP under any configuration. SMTP replication is supported only for the schema partition, configuration partition, and application partitions. This is a critical design constraint: a domain controller using SMTP replication will have an outdated copy of domain objects including users and security groups, making it unsuitable as a read-write DC for domain authentication. Organizations with sites that can only communicate via SMTP should evaluate read-only domain controllers (RODCs) or establish an RPC-capable path for full domain partition replication.

Time-Pressure Math#

The rule of thumb that holds up: if you can't find the answer in under 90 seconds, mark the question and move on. Come back if time allows.

How to Read Your Sample Test Score#

Set a timer before starting the questions above and don't look anything up while the timer runs. Treat it like the actual exam.

When time's up, score yourself honestly. A 10-question sample isn't a pass-fail verdict; it's a diagnostic. Different scores point to different next actions:

• 8–10 correct: You're likely ready to book. Schedule within the next two weeks while the material is fresh.
• 5–7 correct: Close, but not there yet. Identify which domains cost you points; spend a focused week on those before booking.
• Under 5 correct: Go back to fundamentals. The exam is genuinely broad, and gaps at this stage will compound under time pressure.

If you missed questions on AD DS or hybrid management, those domains carry the most weight: AD DS is 20–25% of the exam, and hybrid management questions thread through several other domains too.

If you missed questions on storage or security, those are each 10–15% of the exam. Meaningful, but more contained. Focused study on Azure Files integration and Microsoft Defender for Cloud closes most gaps there.

Passing is 700 out of 1000 on the real exam, so aim comfortably above that on timed practice rather than scraping the line. If you got everything right on the sample: don't assume you're done. The real exam covers all seven domains. Use the CertCompanion full bank to stress-test your readiness before you schedule.

How Should I Study for the AZ-802?#

CertCompanion practice questions form your primary preparation strategy. Work through the AZ-802 bank systematically, the detailed explanations on each question will surface gaps faster than re-reading documentation. Support that with the official AZ-802T00 instructor-led course, which covers all seven domains.

The exam's scope is wide. You need on-premises Windows Server depth (AD DS, Hyper-V, DNS, DHCP, storage) plus hybrid management fluency (Azure Arc, Windows Admin Center, Microsoft Defender for Cloud, Azure Monitor). Neither half alone is sufficient.

Hands-on time matters more than extra reading. Set up a home lab or use Azure free-tier resources: deploy a domain controller, configure FSMO roles, join a server to Arc, and run Windows Admin Center against it.

The official free practice assessment (free, requires sign-in) is worth running through once as a format check alongside the CertCompanion bank. You can also practise the exam interface through the official exam sandbox before test day.

Official free tools to support your preparation:

• Official AZ-802T00 instructor-led course, covers all seven domains
• Official practice assessment, free with a Microsoft account; useful as a format check
• Exam interface sandbox, practise the question types before test day so nothing surprises you

For a full domain-by-domain breakdown and study sequence, the AZ-802 exam guide covers the preparation path in detail. You can also browse all Microsoft certification exams on CertCompanion.

What Does the AZ-802 Exam Cost?#

The exam fee is set by the country or region where you sit it, so check the official exam documentation when you schedule. The exam is offered in English.

Book when your practice scores are consistently strong, not as a trial run. The certification renews annually via a free online assessment, no re-exam required, no additional fee.

Official domain weights#

Frequently Asked Questions#

Is there a free practice test for AZ-802? Yes, the questions on this page are free, pulled from the CertCompanion bank, no account needed. An official free practice assessment is also available with sign-in. Both are useful; the official assessment checks your format familiarity, while the CertCompanion bank tests domain depth across all seven areas.

What is the passing score for AZ-802? 700 out of 1000. Aim comfortably above that on timed practice before booking rather than trying to thread the needle at 700.

How hard is the AZ-802 exam? AZ-802 spans seven domains, from AD DS and hybrid management to storage, security and troubleshooting, so the breadth is what to plan for. Work through each domain in the official study guide, then test yourself on timed sets.

Do I need Windows Server experience to pass AZ-802? Candidates are expected to have experience administering Windows Server with tools such as Windows Admin Center, Hyper-V, PowerShell and Azure Arc, plus familiarity with AD DS. The exam tests practical decision-making in hybrid scenarios, so hands-on practice helps.

Does the AZ-802 expire? The certification renews annually via a free online assessment. No re-exam, no fee. Missing the renewal window means the certification lapses, so set a calendar reminder when you pass.

What jobs does AZ-802 support? The certification maps to Windows Server Administrator, Systems Administrator, Hybrid Infrastructure Administrator, and IT Administrator roles in on-premises and hybrid environments.

The AZ-802 is a serious exam for administrators who manage real Windows Server infrastructure in hybrid environments. The questions on this page give you an honest first look at what the exam asks. Score yourself, find the gaps, and use the time between now and your exam date to close them with hands-on practice, not just more reading. This certification opens doors to hybrid infrastructure roles where on-premises and cloud management overlap, and that's where the demand for qualified administrators continues to grow.

Start with 30 free questions from the full CertCompanion AZ-802 bank at CertCompanion and find out exactly where you stand.

Checked against official Microsoft AZ-802 exam documentation and current candidate reports. Last verified 2026-10-30.