Microsoft • AZ-802
Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ-802) Practice Test
Validates the ability to deploy, manage, and troubleshoot Windows Server in on-premises and hybrid Azure environments. Covers identity, security, networking, storage, high availability, disaster recovery, and monitoring for Windows Server workloads.
Exam Details
Questions
600
Duration
120 minutes
Passing Score
700/1000
Difficulty
AssociateLast Updated
May 2026
Topics Covered
Deploy and Manage Active Directory Domain Services (AD DS)Manage Windows Servers and Workloads in a Hybrid EnvironmentManage Virtual Machines and ContainersImplement and Manage Hybrid Networking InfrastructureManage Storage and File ServicesSecure Windows Server On-Premises and Hybrid InfrastructuresImplement and Manage Windows Server High AvailabilityImplement Disaster RecoveryMigrate Servers and WorkloadsMonitor and Troubleshoot Windows Server Environments
Exam Domain Breakdown
Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments33%
Manage Windows Servers and workloads in a hybrid environment13%
Manage virtual machines and containers18%
Implement and manage an on-premises and hybrid networking infrastructure18%
Manage storage and file services18%
Exam Overview
The Microsoft Certified: Windows Server Hybrid Administrator Associate, earned by passing exam AZ-802, validates a professional's ability to deploy, manage, and troubleshoot Windows Server workloads across both on-premises and hybrid Azure environments. AZ-802 consolidates the content previously covered by two separate exams—AZ-800 (Administering Windows Server Hybrid Core Infrastructure) and AZ-801 (Configuring Windows Server Hybrid Advanced Services)—into a single associate-level credential, with AZ-800 and AZ-801 retiring on September 30, 2026. The exam entered beta in June 2026 and covers a broad range of hybrid infrastructure topics including Active Directory Domain Services (AD DS), hybrid identity with Microsoft Entra ID, Hyper-V virtualization, containerization, storage management, and hybrid networking.
Candidates are assessed on their ability to use core administrative toolsets such as Windows Admin Center, PowerShell, Azure Arc, Azure Policy, Azure Monitor, Azure Update Manager, Microsoft Defender for Identity, and Microsoft Defender for Cloud. The certification also covers high availability and disaster recovery strategies, server and workload migration to Azure, and end-to-end monitoring and troubleshooting of Windows Server environments. It is a role-based credential that reflects the real-world skills required of hybrid infrastructure administrators who bridge traditional on-premises Windows Server management with cloud-native Azure services.
Who Should Take This Exam
This certification is designed for IT professionals who administer Windows Server as a workload in hybrid environments—both on-premises and in Azure. Relevant job roles include system administrators, infrastructure engineers, identity and access administrators, network engineers, security engineers, support engineers, and technology managers who are responsible for Windows Server operations at their organizations. Candidates typically collaborate with architects and cloud engineers on hybrid deployments.
Ideal candidates will have several years of hands-on experience with Windows Server operating systems and should be comfortable working across on-premises Active Directory, Azure IaaS virtual machines, and hybrid connectivity scenarios. Those who previously held the Windows Server Hybrid Administrator Associate certification via AZ-800 and AZ-801 can maintain their credential through the standard annual renewal assessment rather than sitting the full AZ-802 exam.
Prerequisites
Microsoft does not enforce formal prerequisites for AZ-802, but candidates are strongly recommended to have several years of practical experience administering Windows Server in enterprise environments before attempting the exam. Foundational knowledge of Active Directory Domain Services, Group Policy, DNS, DHCP, and Windows Server networking is essential, as these topics form a significant portion of the exam content.
Familiarity with Azure fundamentals—particularly Azure IaaS, Azure Arc, Microsoft Entra ID (formerly Azure Active Directory), and hybrid connectivity concepts—is also expected. Candidates without prior Azure exposure may benefit from first earning the Microsoft Azure Fundamentals (AZ-900) certification or completing relevant Microsoft Learn learning paths. Hands-on experience with tools such as Windows Admin Center, PowerShell remoting, and Hyper-V is strongly recommended, as many exam questions are scenario-based and require applied knowledge.
Exam Format
AZ-802 is an associate-level exam administered through Pearson VUE, available via online proctoring or at an authorized testing center. The exam has a time limit of 100 minutes (approximately 120 minutes total with pre-exam administrative tasks) and contains approximately 40–60 scored questions. A passing score of 700 out of 1000 is required. The exam uses a scaled scoring model, meaning 700 does not equate directly to 70% correct answers.
Question types include single-answer multiple choice, multiple-response, drag-and-drop, hotspot (active screen), and yes/no scenario-based questions. The exam is available in English, with localized versions typically released approximately eight weeks after the English version. Candidates whose preferred language is unavailable may request an additional 30 minutes. Microsoft recommends registering with a personal Microsoft account (MSA) rather than an organizational account to ensure exam records are permanently retained. A free exam sandbox is available at aka.ms/examdemo to familiarize candidates with the interface before exam day.
Skills Measured
- 1.Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%): Covers deploying and managing domain controllers on-premises and in Azure (including RODCs), configuring multi-site/multi-domain/multi-forest environments, managing AD DS trusts and replication, creating and managing users and service accounts, implementing hybrid identities via Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync, and managing Group Policy in both AD DS and Microsoft Entra Domain Services.
- 2.Manage Windows Servers and workloads in a hybrid environment (10–15%): Covers configuring Windows Admin Center (on-premises and in Azure), PowerShell remoting including Just Enough Administration (JEA) and second-hop scenarios, SSH and RDP remote access, Azure Arc-enabled server management via the Azure Connected Machine Agent, Azure Machine Configuration, VM extensions, Azure Update Manager, and Azure Automation runbooks.
- 3.Manage virtual machines and containers (15–20%): Covers Hyper-V VM management including checkpoints, memory, integration services, GPU partitioning, guarded fabric, and shielded VMs; Hyper-V networking including NIC Teaming and virtual switches; creating and managing Windows Server container images and instances; configuring Windows Subsystem for Linux for containers; Azure Kubernetes Service (AKS) on Windows Server; and managing Windows Server VMs on Azure including JIT VM access, Azure Bastion, availability sets, and VM scale sets.
- 4.Implement and manage an on-premises and hybrid networking infrastructure (15–20%): Covers DNS integration with AD DS, DNS zones, forwarding, DNSSEC, Azure DNS Private Resolver, IPAM, DHCP configuration and high availability, the Remote Access role, Azure Network Adapter, Azure Extended Network, Network Policy and Access Services (NPAS), Web Application Proxy, site-to-site VPN, Azure Relay, Microsoft Entra Private Access, and Microsoft Entra Application Proxy.
- 5.Manage storage and file services (15–20%): Covers creating and managing Azure File Shares including permissions, Azure File Sync configuration and monitoring, DFS migration to Azure File Sync, Windows Server file share configuration via FSRM and BranchCache, SMB over QUIC, Storage Spaces, Storage Replica, Data Deduplication, SMB Direct, Storage QoS, iSCSI, and file system configuration.
- 6.Secure Windows Server on-premises and hybrid infrastructures: Covers securing Windows Server using Microsoft Defender for Cloud, Microsoft Defender for Identity, Azure Policy, and security baselines; implementing privileged access workstations; configuring Windows Firewall and Azure network security; and managing certificate services and PKI in hybrid environments.
- 7.Implement and manage Windows Server high availability, disaster recovery, migration, and monitoring: Covers Failover Clustering, cluster sets, and stretch clusters; Azure Site Recovery for Windows Server workloads; Storage Replica for disaster recovery; server and workload migration to Azure using Azure Migrate; and monitoring Windows Server environments using Azure Monitor, Azure Monitor Agent, and Log Analytics.
Study Tips
- Use the official Microsoft Learn study guides for AZ-800 and AZ-801 as your primary content baseline—since AZ-802 consolidates both exams, these study guides collectively define the full scope of skills measured. Pay close attention to domain percentage weights to prioritize study time, especially AD DS (30–35%).
- Take the free Practice Assessments on Microsoft Learn for both AZ-800 and AZ-801 (linked directly from their exam pages) to identify knowledge gaps before sitting AZ-802. These assessments use question styles representative of the actual exam.
- Build hands-on labs using a hybrid environment: set up a Windows Server VM with Hyper-V, install and configure Windows Admin Center, connect the VM to Azure via Azure Arc, and practice key tasks like configuring Microsoft Entra Connect Sync, creating Azure File Sync endpoints, and testing failover with Azure Site Recovery.
- Study Windows Admin Center deeply—it is a central management tool referenced across multiple exam domains (remote management, Azure hybrid services, Hyper-V management, storage). Practice deploying it both on-premises and as an Azure-hosted gateway.
- Review the Microsoft Exam Readiness Zone videos on Microsoft Learn (search for 'AZ-800 Exam Readiness Zone') as these are produced by Microsoft and aligned to specific exam skill areas, particularly helpful for hybrid identity and networking topics.
- Focus on Microsoft Entra hybrid identity scenarios: understand the difference between Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync, when to use Microsoft Entra Domain Services vs. on-premises AD DS, and how staged rollout and password hash sync work—these are consistently tested scenarios.
- For the beta exam period, register early via Pearson VUE to take advantage of the typical 80% beta discount. After passing, expect a delay of 6–8 weeks before your score is reported, as beta exam results are processed after a sufficient candidate pool is collected.
Career Benefits
Earning the Windows Server Hybrid Administrator Associate credential positions professionals for roles such as Windows Server Administrator, Hybrid Cloud Administrator, Infrastructure Engineer, and Systems Engineer in organizations that maintain on-premises Windows Server environments alongside Azure workloads. These roles are consistently in demand across enterprise IT departments, government agencies, healthcare, and financial services. As organizations pursue hybrid cloud strategies rather than full cloud migration, Windows Server expertise with Azure integration skills remains highly valuable and difficult to automate away.
According to industry salary surveys, Windows Server administrators with hybrid cloud skills and Microsoft certifications typically earn between $85,000 and $130,000 annually in the United States, depending on experience, location, and scope of responsibility. Compared to cloud-only certifications such as AZ-104 (Azure Administrator), this certification differentiates candidates who can manage the full hybrid lifecycle—on-premises Active Directory, hybrid networking, and Azure IaaS—making it particularly valuable for mid-to-large enterprises where full datacenter retirement is not imminent. The credential renews annually via a free, unproctored online assessment on Microsoft Learn, keeping certified professionals current with platform updates.
Sample Questions
Preview — answers shown5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 600 questions.
1. Contoso operates shared public-facing kiosk computers deployed in retail stores. The kiosk computers are members of a dedicated OU called KioskComputers. Multiple employees log into these shared machines throughout the day. Regardless of which user logs in, the desktop environment must always be locked down according to the kiosk policy defined by the IT team. Currently, users are receiving their personal user GPO settings rather than the kiosk policy when they log into the kiosk computers. What should you configure to ensure the kiosk policy is always applied when any user logs into these computers? (Select one!)
ASet the Enforced attribute on the GPO linked to the KioskComputers OU
BConfigure Block Inheritance on the KioskComputers OU to prevent user GPOs from applying
CEnable Loopback Processing in Replace mode in the GPO linked to the KioskComputers OU
DEnable Loopback Processing in Merge mode in the GPO linked to the KioskComputers OU
Explanation
Loopback Processing in Replace mode causes user GPO settings derived from the computer's OU (KioskComputers) to completely replace any user GPO settings the logged-in user would normally receive from their own user account OU. This ensures a consistent, locked-down kiosk experience regardless of which user authenticates on the machine. Merge mode combines user settings from both the computer's OU and the user's own OU, with computer-OU settings winning in any conflicts — this would not fully replace personal user settings and could allow some user-specific policies to remain in effect. Block Inheritance only prevents GPOs from parent containers from cascading down to the KioskComputers OU and does not substitute computer-based user settings for the logged-in user's own settings. Setting the Enforced attribute forces a GPO to apply even when child OUs have Block Inheritance configured, but it does not redirect user GPO processing to use the computer's OU user settings instead of the user's own OU settings.
2. The compliance team at VanArsdel Ltd. requires that a Windows Server 2022 file server hosting project share directories must actively prevent users from saving executable files (.exe, .bat, .cmd, .ps1) and media files (.mp3, .mp4, .avi) to those directories. Administrators must also receive automated email notifications whenever a blocked save attempt occurs. The solution must use a built-in Windows Server role service. Which role service and configuration approach should you use? (Select one!)
AInstall the File Server VSS Agent Service and configure shadow copy schedules with file type exclusion rules to prevent the specified extensions from being included in protected snapshots
BConfigure a Software Restriction Policy GPO targeting the file server computer account with Disallowed path rules for each blocked file extension to prevent creation on shared volumes
CInstall File Server Resource Manager, create active file screens on the project share directories using file groups that define the blocked extensions, and configure SMTP email notification actions on each file screen
DEnable Windows Defender Application Control on the file server and define a policy rule that blocks creation of files matching the blocked extensions in directories exposed via Server Message Block
Explanation
File Server Resource Manager (FSRM) is the purpose-built Windows Server role service for enforcing file type restrictions on shared directories. File screens define whether specific file name patterns are permitted or blocked within a target directory. Active file screens actively deny save operations for files matching the defined file groups, while passive screens log violations without blocking. File groups are collections of wildcard patterns such as *.exe, *.bat, *.ps1, *.mp3, and *.mp4 that can be created or customized within FSRM. FSRM also supports configurable notification actions on file screens including email alerts that fire immediately when an active screen violation is attempted, satisfying both the blocking and alerting requirements with a single built-in feature. The File Server VSS Agent Service handles application-consistent shadow copies for backup applications and has no capability to restrict file types saved by users. Software Restriction Policies control the execution of files on the server itself from a local security context, not whether remote users can write file types to a share from their workstations. Windows Defender Application Control is an execution-focused whitelisting technology that governs what code runs, not what files users may create or upload to shared directories.
3. Lucerne Publishing's infrastructure team is provisioning a new virtual machine on a Windows Server 2022 Hyper-V host. The VM will run Windows 11 Enterprise and must support BitLocker Drive Encryption backed by the built-in virtual TPM, as well as UEFI Secure Boot, to comply with the corporate security baseline. Which Hyper-V virtual machine generation must the team select when creating this VM? (Select one!)
AGeneration 1 with Discrete Device Assignment configured to pass through the host's physical TPM chip
BGeneration 2
CGeneration 1 with Enhanced Session Mode enabled on the Hyper-V host
DGeneration 1 with Dynamic Memory and a high memory weight configured for performance
Explanation
Generation 2 virtual machines in Hyper-V use UEFI firmware and expose a virtual TPM 2.0 (vTPM), supporting Secure Boot and the hardware requirements mandated by Windows 11. Windows 11 enforces TPM 2.0 and Secure Boot as non-negotiable installation prerequisites, and only Generation 2 VMs provide both of these capabilities. BitLocker uses the vTPM to seal encryption keys in the same way it uses a physical TPM on bare-metal hardware. Generation 1 VMs rely on legacy BIOS firmware, do not support UEFI Secure Boot, and cannot expose a virtual TPM, making them incompatible with Windows 11 and TPM-backed BitLocker regardless of any other configuration applied. Enhanced Session Mode provides a rich RDP-like console connection to VMs but makes no change to the VM's firmware architecture or security capabilities. Discrete Device Assignment passes physical hardware directly into a VM at the PCIe level, but using the host's physical TPM this way removes TPM protection from the host OS itself and is not the recommended path for providing guest VM TPM support. Dynamic Memory is a RAM allocation feature entirely unrelated to firmware type or platform security requirements.
4. Tailspin Toys has deployed a Read-Only Domain Controller (RODC) at their Phoenix branch office. Branch office employees need to authenticate locally even when WAN connectivity is unavailable, requiring their passwords to be cached on the RODC. Security policy mandates that members of the Domain Admins and IT Administrators groups must never have their passwords cached on this RODC. Which two actions should you perform to implement this configuration? (Select two!)
Multiple correct answersAAdd the branch office employee accounts to the Allowed RODC Password Replication Group
BAdd the Domain Admins and IT Administrators groups to the Denied RODC Password Replication Group
CAdd the branch office employee accounts to the Denied RODC Password Replication Group
DConfigure selective authentication on the forest trust to restrict access to the RODC
EEnable Universal Group Membership Caching on the RODC site instead of password caching
Explanation
To allow branch employee passwords to be cached on the RODC, their accounts must be added to the Allowed RODC Password Replication Group, which permits the RODC to cache those credentials for offline authentication. To prevent IT administrator credentials from ever being cached, those groups must be added to the Denied RODC Password Replication Group. The Denied list always takes precedence over the Allowed list when an account appears in both. Adding employee accounts to the Denied list would block password caching entirely, defeating the purpose of local authentication. Selective authentication is a trust configuration option that controls which users from a trusted domain can authenticate to resources in the trusting domain and does not govern password caching behavior on an RODC. Universal Group Membership Caching enables a site to resolve universal group memberships without contacting a Global Catalog server and is unrelated to individual account password caching on an RODC.
5. Alpine Ski House's virtualization team is configuring a Windows Server 2022 Hyper-V host with three distinct networking requirements. First, a public-facing web VM must send and receive traffic through the server's physical network adapter to reach external customers. Second, an internal database VM and the Hyper-V host management operating system must communicate with each other while remaining completely isolated from all external and physical networks. Third, a pair of isolated security testing VMs must communicate exclusively with each other, with no access to the Hyper-V host OS or any physical network. Listed in the same order as the three requirements, which combination of Hyper-V virtual switch types should the team create? (Select one!)
APrivate, External, Internal
BInternal, External, Private
CExternal, Internal, Private
DExternal, Private, Internal
Explanation
An External virtual switch binds to a physical network adapter on the Hyper-V host, allowing VMs to send and receive traffic on the physical network and reach external destinations, which satisfies the requirement for the public-facing web VM. An Internal virtual switch creates a network segment that is visible to both VMs and the Hyper-V host management operating system but has no connection to any physical adapter, satisfying the requirement for isolated host-to-database-VM communication. A Private virtual switch creates an isolated network segment that exists only between VMs assigned to it; the Hyper-V host OS has no network interface on this switch type, making it correct for the security testing VMs that must communicate solely with each other without host visibility. The order External, Internal, Private directly matches the three stated requirements as listed.
$7
One-time access to this exam
Full access to all 600 questions
Or $15/mo for all 227 exams
Detailed explanations
Free preview stays available