Microsoft · AZ-802
Validates the ability to deploy, manage, and troubleshoot Windows Server in on-premises and hybrid Azure environments. Covers identity, security, networking, storage, high availability, disaster recovery, and monitoring for Windows Server workloads.
Practice Questions
600
≈ 12 practice exams
Duration
120 minutes
Passing Score
700/1000
Difficulty
AssociateLast Updated
Aug 2026
This AZ-802 practice exam follows the July 2026 version of Microsoft's official study guide. Deploy and manage AD DS is the heaviest domain at 20 to 25 percent of the marks, with storage and file services and monitoring and troubleshooting at 15 to 20 percent each, so those three areas alone decide roughly half of your score. The remaining four domains, hybrid workload management, virtual machines, networking, and securing Windows Server infrastructure, carry 10 to 15 percent each, and the question bank mirrors that weighting.
AZ-802 replaces the AZ-800 and AZ-801 pair, which retire on September 30, 2026; after that date this single exam is the only path to the Windows Server Administrator Associate credential. You get 120 minutes through Pearson VUE, at a test center or online proctored, and you need a scaled 700 on a 1000-point scale to pass. Expect scenario questions that reach across domains: hybrid identity with Microsoft Entra Connect Sync, Azure Arc-enabled servers, Hyper-V and Azure VM management, Azure File Sync, and Active Directory recovery all appear in applied contexts rather than as isolated definitions.
Microsoft has not yet released an official practice assessment for AZ-802, which makes independent question practice the main way to pressure-test your readiness before booking. Start with the 30 free questions to benchmark yourself, then work through the full 600-question bank until your accuracy holds steady across all seven domains, especially AD DS, storage, and troubleshooting, where most of the marks sit.
The Microsoft Certified: Windows Server Hybrid Administrator Associate, earned by passing exam AZ-802, validates a professional's ability to deploy, manage, and troubleshoot Windows Server workloads across both on-premises and hybrid Azure environments. AZ-802 consolidates the content previously covered by two separate exams—AZ-800 (Administering Windows Server Hybrid Core Infrastructure) and AZ-801 (Configuring Windows Server Hybrid Advanced Services)—into a single associate-level credential, with AZ-800 and AZ-801 retiring on September 30, 2026. The exam entered beta in June 2026 and covers a broad range of hybrid infrastructure topics including Active Directory Domain Services (AD DS), hybrid identity with Microsoft Entra ID, Hyper-V virtualization, containerization, storage management, and hybrid networking.
Candidates are assessed on their ability to use core administrative toolsets such as Windows Admin Center, PowerShell, Azure Arc, Azure Policy, Azure Monitor, Azure Update Manager, Microsoft Defender for Identity, and Microsoft Defender for Cloud. The certification also covers high availability and disaster recovery strategies, server and workload migration to Azure, and end-to-end monitoring and troubleshooting of Windows Server environments. It is a role-based credential that reflects the real-world skills required of hybrid infrastructure administrators who bridge traditional on-premises Windows Server management with cloud-native Azure services.
This certification is designed for IT professionals who administer Windows Server as a workload in hybrid environments—both on-premises and in Azure. Relevant job roles include system administrators, infrastructure engineers, identity and access administrators, network engineers, security engineers, support engineers, and technology managers who are responsible for Windows Server operations at their organizations. Candidates typically collaborate with architects and cloud engineers on hybrid deployments.
Ideal candidates will have several years of hands-on experience with Windows Server operating systems and should be comfortable working across on-premises Active Directory, Azure IaaS virtual machines, and hybrid connectivity scenarios. Those who previously held the Windows Server Hybrid Administrator Associate certification via AZ-800 and AZ-801 can maintain their credential through the standard annual renewal assessment rather than sitting the full AZ-802 exam.
Microsoft does not enforce formal prerequisites for AZ-802, but candidates are strongly recommended to have several years of practical experience administering Windows Server in enterprise environments before attempting the exam. Foundational knowledge of Active Directory Domain Services, Group Policy, DNS, DHCP, and Windows Server networking is essential, as these topics form a significant portion of the exam content.
Familiarity with Azure fundamentals—particularly Azure IaaS, Azure Arc, Microsoft Entra ID (formerly Azure Active Directory), and hybrid connectivity concepts—is also expected. Candidates without prior Azure exposure may benefit from first earning the Microsoft Azure Fundamentals (AZ-900) certification or completing relevant Microsoft Learn learning paths. Hands-on experience with tools such as Windows Admin Center, PowerShell remoting, and Hyper-V is strongly recommended, as many exam questions are scenario-based and require applied knowledge.
AZ-802 is an associate-level exam administered through Pearson VUE, available via online proctoring or at an authorized testing center. You have 120 minutes to complete the exam, which typically contains 40-60 questions. A passing score of 700 out of 1000 is required. The exam uses a scaled scoring model, meaning 700 does not equate directly to 70% correct answers. While AZ-802 is in beta, results are not scored immediately; scores are released after the beta data-collection period ends.
Question types include single-answer multiple choice, multiple-response, drag-and-drop, hotspot (active screen), and yes/no scenario-based questions. The exam is currently offered in English only, with localized versions typically released approximately eight weeks after the English version. Candidates whose preferred language is unavailable may request an additional 30 minutes. Microsoft recommends registering with a personal Microsoft account (MSA) rather than an organizational account to ensure exam records are permanently retained. A free exam sandbox is available at aka.ms/examdemo to familiarize candidates with the interface before exam day.
Earning the Windows Server Hybrid Administrator Associate credential positions professionals for roles such as Windows Server Administrator, Hybrid Cloud Administrator, Infrastructure Engineer, and Systems Engineer in organizations that maintain on-premises Windows Server environments alongside Azure workloads. These roles are consistently in demand across enterprise IT departments, government agencies, healthcare, and financial services. As organizations pursue hybrid cloud strategies rather than full cloud migration, Windows Server expertise with Azure integration skills remains highly valuable and difficult to automate away.
According to industry salary surveys, Windows Server administrators with hybrid cloud skills and Microsoft certifications typically earn between $85,000 and $130,000 annually in the United States, depending on experience, location, and scope of responsibility. Compared to cloud-only certifications such as AZ-104 (Azure Administrator), this certification differentiates candidates who can manage the full hybrid lifecycle—on-premises Active Directory, hybrid networking, and Azure IaaS—making it particularly valuable for mid-to-large enterprises where full datacenter retirement is not imminent. The credential renews annually via a free, unproctored online assessment on Microsoft Learn, keeping certified professionals current with platform updates.
5 sample questions with answers and explanations. The full bank has 600 questions, enough for 12 full-length practice exams.
Preview — answers shown1. Tailspin Toys has 600 users distributed across regional offices in New York, Chicago, and Los Angeles. Each office hosts a Windows Server 2022 file server that stores the same shared financial documents. Users currently must know the specific UNC path for their local server. The IT manager wants all users to access documents using a single UNC path such as \\tailspintoys.com\Finance that automatically directs each user to the nearest file server copy. The solution must remain available if one regional file server goes offline. Which two components should the administrator deploy to meet all of these requirements? (Select two!)
Multiple correct answersExplanation
DFS Namespaces (DFS-N) creates a virtual namespace that presents multiple file server targets under a single UNC path. A domain-based namespace stored in Active Directory survives individual server failures because any domain controller can serve namespace referrals. DFS-N uses Active Directory site information and site link costs to refer connecting clients to the nearest folder target automatically, eliminating the need for users to know server-specific paths. DFS Replication (DFS-R) is required alongside DFS-N to keep file content consistent across all three regional targets. Without replication, a client redirected to the Chicago server would not see changes made by a user working against the New York server. Together DFS-N and DFS-R deliver the unified access path, automatic nearest-server referral, and continued availability when one regional server is offline. Storage Spaces Direct is designed for hyper-converged compute and storage clusters and is not architecturally intended for geographically dispersed multi-site deployments. Azure File Sync would require all client access to route through Azure and introduces cloud dependency not needed for this scenario. SMB Multichannel aggregates network paths to a single file server and does not provide cross-server namespace federation or content replication.
2. Tailspin Toys has a branch office in Phoenix with 150 users and a single Windows Server 2022 domain controller. The office connects to headquarters via a 2 Mbps WAN link. Users experience slow logon times during peak hours because Universal Group membership resolution queries traverse the WAN to reach Global Catalog servers at headquarters. The IT team cannot deploy a Global Catalog server in Phoenix due to storage capacity limitations and data sovereignty requirements for the forest-wide partial attribute set. What is the MOST appropriate configuration to resolve the slow logon times without violating these constraints? (Select one!)
Explanation
Universal Group Membership Caching eliminates the need for a Global Catalog server in a branch office by caching Universal Group memberships directly on the local domain controller. After the first successful logon, which contacts a Global Catalog server at headquarters to resolve memberships, those memberships are cached locally on the Phoenix domain controller and refreshed every 8 hours by default. Subsequent logons use the cached membership data, removing WAN queries to headquarters entirely and significantly reducing logon times. Promoting the Phoenix domain controller to a Global Catalog server would replicate the partial attribute set from all objects across all domains in the forest, directly violating both the storage capacity and data sovereignty constraints the team identified. Deploying a Read-Only Domain Controller with Password Replication Policy addresses local credential caching for authentication but does not resolve Universal Group membership resolution, which still requires communication with a Global Catalog server over the WAN. Reducing site link cost affects inter-site replication topology path selection and has no bearing on client authentication queries or Universal Group membership resolution latency.
3. Proseware Inc. has two Active Directory sites connected by an unreliable WAN link that experiences frequent outages. The network team configures the inter-site site link to use SMTP instead of RPC over IP, hoping to leverage SMTP's store-and-forward capability to improve reliability. The environment contains a single forest with two domains. Shortly after the change, the administrator notices that newly created user accounts and updated group memberships in the primary site are not appearing on domain controllers at the remote site. What is the reason for this behavior? (Select one!)
Explanation
SMTP-based inter-site replication has a fundamental and often misunderstood limitation: it can only replicate the schema partition, configuration partition, and application partitions such as DNS zones. The domain partition, which contains all user accounts, computer accounts, group memberships, and other domain-specific objects, cannot be replicated using SMTP. This is precisely why new user accounts and group memberships created in the primary site are not appearing at the remote site despite the SMTP site link being active. While SMTP replication does require an Enterprise CA for message signing and authentication, that is a configuration prerequisite rather than the root cause here. Even with a fully deployed CA, the domain partition still cannot traverse an SMTP site link under any circumstance. The domain functional level has no bearing on SMTP replication capabilities for any partition type. SMTP replication remains supported in current Windows Server versions, but its scope is strictly limited to non-domain partitions, making it unsuitable as the sole replication mechanism for environments that need to replicate user and computer objects.
4. Northgate Hospital is building a private Hyper-V cloud to host virtual machines containing protected health information. The security team requires that even Hyper-V administrators who have physical access to the host servers must be unable to read, access, or tamper with the contents of regulated virtual machines. Which solution should the administrator implement? (Select one!)
Explanation
Guarded Fabric with Host Guardian Service and Shielded VMs is specifically architected to protect virtual machines from fabric administrators, including those with direct physical access to Hyper-V hosts. Shielded VMs use BitLocker encryption tied to a virtual Trusted Platform Module and a shielding data file that cryptographically controls which guarded hosts are permitted to run the VM. The VM cannot be decrypted, started, or inspected on an unattested host, even by an administrator with local credentials. BitLocker encryption on host volumes combined with NTFS permissions protects data on disk at rest, but does not prevent a Hyper-V administrator from accessing VM files through native Hyper-V management interfaces or by moving virtual disk files to another system. Hyper-V Replica with certificate-based authentication and encryption protects data in transit during replication but does not encrypt VM virtual disk contents at rest on the primary or replica host. Just Enough Administration restricts PowerShell cmdlets available within constrained remote sessions but provides no encryption-based protection and is ineffective against administrators with direct physical or console access to the host.
5. Woodgrove Bank recently upgraded all domain controllers from Windows Server 2016 to Windows Server 2022 and migrated workstations from Windows 10 to Windows 11. After the migration, administrators in the finance department report that several user-targeted Group Policy Objects linked to the Finance organizational unit stopped applying to workstations. Investigation confirms the GPOs are correctly configured and linked, and an administrator had previously removed the Authenticated Users group from the security filter of each GPO and replaced it with specific user security groups. No changes were made to the GPO settings or user group memberships since the migration. Which action will restore Group Policy application for the affected users? (Select one!)
Explanation
Microsoft security update MS16-072 changed how user-targeted Group Policy Objects are processed on Windows Server 2016 and later domain controllers, as well as on Windows 10 and Windows 11 clients. Before this update, only the user account needed Read and Apply Group Policy permissions on the GPO for user settings to apply. After MS16-072, the computer account that the user is signed into must also have at least Read permission on the GPO so the computer can enumerate the GPO during machine startup. When the Authenticated Users group is removed from security filtering and replaced with specific user groups, the computer accounts lose the implicit Read permission they previously had through the Authenticated Users group. User-targeted GPOs then silently fail to apply because the computer cannot read the GPO at startup time. Adding the workstation computer accounts or a computer security group with Read permission (but not Apply Group Policy) restores the required computer-side access without incorrectly applying user settings to the computer itself. Re-adding Authenticated Users with Apply Group Policy permission would grant the GPO settings to every authenticated user and computer in the domain, defeating the purpose of the targeted security filter. Moving workstations to the Computers container removes them from the Finance OU scope entirely, preventing Finance-specific GPOs from applying at all. Loopback processing applies computer-OU GPOs to users logging into those computers and is an unrelated mechanism that does not resolve security filter access control issues.
AZ-802 (Administering Windows Server) is a single associate-level Microsoft exam that consolidates the retiring AZ-800 and AZ-801 pair. It entered beta in June 2026 and covers Windows Server administration across on-premises, hybrid, and Azure environments, from Active Directory and Hyper-V to Azure Arc and Azure File Sync.
Microsoft retires both exams on September 30, 2026. Until then, passing the pair still earns the certification; after that date, AZ-802 is the only available path.
If you have already passed one of the two older exams, finish the second before September 30, 2026 so the pair counts. If you are starting fresh, prepare for AZ-802 directly: the older exams retire soon and the consolidated exam gives you one blueprint to study instead of two.
You have 120 minutes and need a scaled score of 700 out of 1000 to pass. Microsoft associate exams typically contain 40 to 60 questions mixing multiple choice, drag-and-drop, hotspot, and scenario formats. While AZ-802 is in beta, scores are released after the beta period ends rather than immediately.
Seven domains: deploy and manage AD DS (20-25%), manage Windows Server instances and workloads in a hybrid environment (10-15%), manage virtual machines (10-15%), on-premises and hybrid networking (10-15%), storage and file services (15-20%), secure Windows Server infrastructure (10-15%), and monitor and troubleshoot Windows Server environments (15-20%).
USD $165 in the United States, with the price varying by country or region. Scheduling is through Pearson VUE, and if you fail you can retake after 24 hours, with longer waits between later attempts.
Not yet. Microsoft says the practice assessment usually arrives within about eight weeks of an exam leaving beta and becoming generally available, so independent practice questions are currently the main way to test yourself under exam-style conditions.
Passing AZ-802 earns the Microsoft Certified: Windows Server Administrator Associate credential, the successor title to Windows Server Hybrid Administrator Associate. Like other associate certifications it renews annually through a free online assessment on Microsoft Learn, and existing holders who certified via AZ-800 and AZ-801 keep their credential through that same renewal, without retaking the full exam.
Microsoft Certified: Power Platform Solution Architect Expert (PL-600)
PL-600 · 1080 questions
Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)
SC-900 · 230 questions
Microsoft Certified: Security Operations Analyst Associate (SC-200)
SC-200 · 599 questions
Microsoft 365 Certified: Administrator Expert (MS-102)
MS-102 · 965 questions
Microsoft 365 Certified: Copilot and Agent Administration Fundamentals (AB-900)
AB-900 · 700 questions
Microsoft 365 Certified: Fundamentals (MS-900)
MS-900 · 1201 questions
$17.99
One-time access to this exam