I85PREP
⌘ K
Azure AZ-801 study materials
Azure AZ-801 study resources

Azure AZ-801 practice questions

One question at a time. Build your Azure AZ-801 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Secure Windows Server on-premises and hybrid infrastructures

You need to ensure that a Windows Server 2022 file server records every attempt to access a specific folder, including failed attempts, in the Security log. Which configuration should you enable?

  1. Dynamic Access Control central access policies
  2. Object access auditing via a folder audit entry in the local or domain audit policy Correct answer.
  3. Encrypting File System recovery agent logging
  4. System access control lists on the volume root

Explanation

Auditing file access requires two parts: enabling the Object Access auditing subcategory in the audit policy, and adding a SACL audit entry on the folder itself. Without both the policy and the SACL entry, no events are generated.

Question 2Secure Windows Server on-premises and hybrid infrastructures

A security team wants to prevent administrators from installing unapproved applications on a Windows Server 2022 member server without blocking approved line-of-business software. Which feature should you implement?

  1. Local Security Policy password complexity
  2. AppLocker with publisher and path rules Correct answer.
  3. Windows Defender Firewall connection security rules
  4. BitLocker Network Unlock

Explanation

AppLocker lets you allow only specified applications based on publisher, path, or file hash, and blocks everything else when default deny rules apply. It is designed to restrict application execution while permitting approved software.

Question 3Secure Windows Server on-premises and hybrid infrastructures

You are configuring a Windows Server 2022 server as a remote access VPN endpoint using Always On VPN with IKEv2. Which certificate requirement must the server certificate meet?

  1. It must be self-signed and installed in the Trusted Publishers store
  2. It must be issued to the computer account of the VPN client
  3. It must be issued by a CA trusted by clients and contain the server name in the subject or SAN Correct answer.
  4. It must use a 1024-bit RSA key and SHA-1 signature

Explanation

For IKEv2, clients validate the VPN server's certificate during tunnel establishment, so the certificate must chain to a CA the clients trust and identify the server name. A self-signed certificate would not be trusted by remote clients.

Question 4Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server feature provides just-in-time privileged access by placing administrators into a temporary group membership that expires automatically?

  1. Windows LAPS
  2. Credential Guard
  3. Privileged Access Management in Microsoft Identity Manager Correct answer.
  4. Group Policy Preferences

Explanation

Privileged Access Management (PAM) with Microsoft Identity Manager implements a bastion forest model in which users request time-bound membership in privileged groups. The membership expires automatically, reducing standing administrative rights.

Question 5Secure Windows Server on-premises and hybrid infrastructures

You must configure a Windows Server 2022 server so that only signed SMB traffic is accepted from clients. Which action accomplishes this requirement?

  1. Enable SMB encryption on the share
  2. Configure the server to use only NTLM authentication
  3. Disable SMB1 and enable SMB multichannel
  4. Enable the SMB signing requirement on the server and reject unsigned connections Correct answer.

Explanation

Requiring SMB signing on the server causes it to refuse sessions that do not sign packets, which mitigates tampering and relay attacks. Encryption protects confidentiality but is a separate control from signing.

Question 6Secure Windows Server on-premises and hybrid infrastructures

A Windows Server 2022 host runs multiple Hyper-V virtual machines. You need to prevent malicious code on the host from reading credentials stored in the VM worker processes. Which feature should you enable?

  1. Hyper-V replica
  2. Storage QoS
  3. Nested virtualization
  4. Host Guardian Service with shielded VMs Correct answer.

Explanation

Shielded VMs, backed by the Host Guardian Service, ensure that host administrators cannot inspect or tamper with VM memory and disks. This protects guest credentials from a compromised or malicious host.

Question 7Secure Windows Server on-premises and hybrid infrastructures

You need to restrict which domain controllers can be used for authentication by members of a specific site. Which configuration should you use?

  1. Authentication policy silos
  2. Fine-grained password policies
  3. Group Managed Service Accounts
  4. Active Directory Sites and Services subnet-to-site mapping Correct answer.

Explanation

Site and subnet mapping ensures clients locate the closest domain controllers in their site for authentication. Proper subnet definitions prevent clients from randomly selecting domain controllers in distant sites.

Question 8Secure Windows Server on-premises and hybrid infrastructures

You are implementing Windows LAPS on Windows Server 2022 domain members. Which permission must be granted to the authorized users so they can read the managed local administrator password?

  1. SeBackupPrivilege on each member server
  2. Read share permission on the SYSVOL folder
  3. Domain Admin membership
  4. Read permission on the password attribute in Active Directory Correct answer.

Explanation

Windows LAPS stores the password in Active Directory and delegates read access through permissions on the relevant attribute. Authorized users need read permission on that attribute rather than broad administrative group membership.

Question 9Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server 2022 feature uses virtualization-based security to protect credential-derived secrets such as NTLM hashes from being extracted by malware running in the OS?

  1. Constrained delegation
  2. Protected Users group
  3. Credential Guard Correct answer.
  4. Windows Defender Application Guard

Explanation

Credential Guard isolates LSASS secrets in a secure virtualized environment so that even kernel-level malware cannot read them. It specifically targets credential theft techniques such as hash dumping.

Question 10Secure Windows Server on-premises and hybrid infrastructures

You must ensure that a Windows Server 2022 DNS server accepts dynamic updates only from computers that have authenticated to Active Directory. Which configuration should you choose?

  1. Zone transfers restricted to named servers
  2. Secure only dynamic updates on an AD-integrated zone Correct answer.
  3. Nonsecure and secure dynamic updates on a primary zone
  4. DNSSEC signing of the zone

Explanation

The Secure only setting on an Active Directory-integrated zone requires that dynamic update clients authenticate, typically using Kerberos. This prevents unauthenticated hosts from registering records.

Question 11Secure Windows Server on-premises and hybrid infrastructures

A Windows Server 2022 file server must encrypt data on disk so that theft of the physical drive does not expose files. Which solution meets this requirement with the least administrative effort?

  1. SMB encryption on the share
  2. BitLocker Drive Encryption on the data volume Correct answer.
  3. Storage Spaces with parity
  4. EFS on each user profile folder

Explanation

BitLocker encrypts the entire volume, protecting all data if the drive is removed or the server is stolen. It requires far less per-file administration than encrypting individual files with EFS.

Question 12Secure Windows Server on-premises and hybrid infrastructures

You need to configure a Windows Server 2022 server to require LDAP signing and channel binding for all directory connections. Which tool should you use to enforce these settings on the domain controller?

  1. Certificate Authority console
  2. Registry policy for LDAP server signing requirements and channel binding Correct answer.
  3. Windows Defender Firewall with Advanced Security
  4. Disk Management

Explanation

LDAP signing and channel binding requirements are controlled through registry-based policy settings on domain controllers. These settings reject unsigned or unbound LDAP binds, mitigating relay attacks.

Question 13Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server 2022 technology should you use to give administrators time-limited, audited access to on-premises servers through Azure without exposing inbound ports?

  1. Remote Desktop Gateway with self-signed certificates
  2. Azure Arc-enabled servers with Azure Bastion and just-in-time access Correct answer.
  3. Direct RDP exposure through the perimeter firewall
  4. A site-to-site VPN with split tunneling

Explanation

Azure Arc projects on-premises servers into Azure, where Bastion and just-in-time VM access broker administrative connections without opening inbound management ports. Sessions are audited and time-bound.

Question 14Secure Windows Server on-premises and hybrid infrastructures

You need to prevent domain users from authenticating to a specific set of sensitive servers using cached credentials after their accounts are disabled. Which control best addresses this?

  1. Add the accounts to the Protected Users group Correct answer.
  2. Enable account lockout threshold
  3. Configure a fine-grained password policy
  4. Deploy roaming user profiles

Explanation

Protected Users prevents the use of NTLM, cached credentials, and other weaker authentication mechanisms for member accounts. This limits the persistence of stolen credentials on sensitive hosts.

Question 15Secure Windows Server on-premises and hybrid infrastructures

You are configuring a Windows Server 2022 Network Policy Server to enforce health policies for VPN clients. Which component validates the client's health state before granting full access?

  1. DHCP failover scopes
  2. DNS scavenging intervals
  3. Windows Server Update Services approval rules
  4. System Health Validators in NPS with NAP enforcement Correct answer.

Explanation

Network Access Protection uses System Health Validators in NPS to evaluate client health and can place noncompliant clients on a remediation network. Only compliant clients receive unrestricted access.

Question 16Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server 2022 setting should you configure to ensure that a stolen domain controller's disk cannot be read offline by an attacker?

  1. DNS zone replication scope
  2. Audit policy for account logon events
  3. Windows Defender Firewall domain profile
  4. BitLocker with TPM and PIN on the system volume Correct answer.

Explanation

BitLocker encrypts the system volume so the disk contents are unreadable if removed and mounted elsewhere. Requiring a PIN in addition to the TPM adds protection against cold-boot style attacks.

Question 17Secure Windows Server on-premises and hybrid infrastructures

You need to enforce that all administrative PowerShell sessions on a Windows Server 2022 host are logged to a central location. Which technology provides this?

  1. PowerShell execution policy set to AllSigned
  2. PowerShell script block logging forwarded through Windows Event Forwarding Correct answer.
  3. Just Enough Administration endpoints
  4. Constrained Language Mode in the session configuration

Explanation

Script block logging records the content of executed PowerShell code in the event log, and Windows Event Forwarding centralizes those events. Together they provide an auditable record of administrative activity.

Question 18Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server 2022 feature allows you to define central access rules that use user claims such as department or clearance for file authorization?

  1. File Server Resource Manager quotas
  2. DFS Replication
  3. Dynamic Access Control Correct answer.
  4. Access-based enumeration

Explanation

Dynamic Access Control uses claims, central access policies, and resource properties to express rich authorization rules. It lets file access depend on attributes such as department rather than group membership alone.

Question 19Secure Windows Server on-premises and hybrid infrastructures

You are hardening a Windows Server 2022 server and must disable legacy protocols that send credentials in cleartext. Which two protocols should be disabled? (Choose the option that lists both.)

  1. Telnet and unencrypted FTP Correct answer.
  2. RDP and HTTPS
  3. SNMPv3 and LDAPS
  4. Kerberos and SMB3

Explanation

Telnet and plain FTP transmit credentials and data without encryption, so they should be replaced with SSH and FTPS or SFTP. The other listed protocols either provide encryption or are modern secure standards.

Question 20Secure Windows Server on-premises and hybrid infrastructures

A Windows Server 2022 server hosts a web application that must trust only certificates issued by a specific internal CA. Which action should you take?

  1. Enable certificate autoenrollment for the web server
  2. Distribute the internal root CA certificate to the Trusted Root Certification Authorities store Correct answer.
  3. Publish the root certificate to the Trusted Publishers store
  4. Configure the web server to use a self-signed certificate

Explanation

Trust is established by placing the issuing root CA certificate in the Trusted Root Certification Authorities store of the server. The server then accepts certificates that chain to that root.

Question 21Secure Windows Server on-premises and hybrid infrastructures

You need to ensure that a Windows Server 2022 failover cluster running Hyper-V can boot encrypted VMs only on hosts that prove their health to a guardian service. Which configuration should you implement?

  1. Cluster-aware updating
  2. Shielded VMs with the Host Guardian Service in TPM-trusted attestation mode Correct answer.
  3. BitLocker on the CSV volumes
  4. Live migration with compression

Explanation

Host Guardian Service attestation verifies that a host is healthy and trusted before releasing the key protector for a shielded VM. TPM-trusted attestation uses the host's TPM and measured boot data.

Question 22Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server 2022 capability allows an administrator to grant a user only the specific cmdlets needed for a task, without granting full administrative rights?

  1. Windows Defender Firewall IPsec rules
  2. Just Enough Administration Correct answer.
  3. Constrained delegation
  4. Group Policy Loopback processing

Explanation

Just Enough Administration defines role capability files and session configurations that expose only the commands required for a task. Users connect to a restricted endpoint instead of receiving full administrative rights.

Question 23Secure Windows Server on-premises and hybrid infrastructures

You must prevent NTLM authentication across the domain while allowing Kerberos. Which approach should you take first to avoid breaking applications?

  1. Audit NTLM usage before restricting it with policy Correct answer.
  2. Remove all computer accounts from the domain
  3. Block TCP port 445 on all firewalls
  4. Disable the NTLM registry key on all servers at once

Explanation

Auditing NTLM usage identifies which applications and servers still depend on NTLM before enforcement. Restricting NTLM without this data risks breaking authentication for legacy systems.

Question 24Secure Windows Server on-premises and hybrid infrastructures

A Windows Server 2022 server must automatically obtain and renew a certificate for TLS from an internal enterprise CA. Which configuration provides this?

  1. Export and import of a PFX file
  2. Publishing a self-signed certificate to Active Directory
  3. Manual certificate request via the Web Enrollment page
  4. Certificate autoenrollment through Group Policy Correct answer.

Explanation

Autoenrollment through Group Policy lets computers request, receive, and renew certificates from an enterprise CA automatically. It removes manual request and renewal steps.

Question 25Secure Windows Server on-premises and hybrid infrastructures

You are reviewing security events on a Windows Server 2022 server and need to identify the event that indicates a successful logon. Which event ID should you look for in the Security log?

  1. 4625
  2. 4624 Correct answer.
  3. 4648
  4. 4776

Explanation

Event ID 4624 is logged when an account successfully logs on, and it includes logon type and source details. Event 4625 records failed logons, while 4648 records explicit credential use.

Question 26Secure Windows Server on-premises and hybrid infrastructures

A security team wants to ensure that a Windows Server 2022 file server blocks executables from running in user-writable folders such as Downloads, even when the user is a local administrator. Which built-in control should you configure?

  1. User Account Control with admin approval mode enabled
  2. Software Restriction Policies with a disallowed extension list
  3. AppLocker default rules applied to all users Correct answer.
  4. Windows Defender Application Control in audit mode

Explanation

AppLocker default rules include a rule that allows executables only in Program Files and Windows folders for all users, which blocks execution from user-writable paths even for administrators. Enforcement must be set to Enforce rather than Audit Only for the block to take effect.

Question 27Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server 2022 feature allows an administrator to define which applications a user can run based on the publisher, product name, file name, or file hash?

  1. Windows Defender Firewall with Advanced Security
  2. Group Policy Preferences
  3. AppLocker Correct answer.
  4. BitLocker Network Unlock

Explanation

AppLocker evaluates applications against publisher, path, file name, and file hash conditions to allow or deny execution. It is configured through Group Policy or local security policy and is the standard application control mechanism in Windows Server 2022.

Question 28Secure Windows Server on-premises and hybrid infrastructures

You need to protect a Windows Server 2022 member server so that only signed and validated drivers can load, blocking unsigned kernel-mode drivers. Which configuration should you enable?

  1. Device Guard Credential Guard
  2. Code integrity policy in enforcement mode Correct answer.
  3. Kernel DMA Protection
  4. Secure Boot with a custom key

Explanation

A code integrity policy, part of Windows Defender Application Control, enforces which kernel-mode drivers are permitted to load. In enforcement mode unsigned or noncompliant drivers are blocked, protecting the kernel from malicious drivers.

Question 29Secure Windows Server on-premises and hybrid infrastructures

A Windows Server 2022 server stores sensitive logs. You must ensure that an attacker who removes the disk cannot read the contents offline. Which technology should you implement?

  1. NTFS permissions with a deny rule
  2. Storage Spaces with parity
  3. BitLocker with TPM and PIN protector Correct answer.
  4. Encrypting File System on the log folder

Explanation

BitLocker encrypts the entire volume, so the data is unreadable when the disk is removed and mounted elsewhere. A TPM and PIN protector requires both hardware validation and a user-entered PIN at startup.

Question 30Secure Windows Server on-premises and hybrid infrastructures

You want a Windows Server 2022 domain controller to store its BitLocker recovery password in Active Directory so helpdesk staff can retrieve it. Which requirement must be met?

  1. The domain controller must be a global catalog server
  2. The recovery password must be stored in a file share
  3. The TPM must be version 2.0 with PCR 7 only
  4. The computer account must be in an organizational unit linked to a policy that enables backup to AD DS Correct answer.

Explanation

BitLocker recovery information is written to Active Directory only when a Group Policy setting enables backup of recovery information to AD DS and the computer account is within the policy's scope. The schema must also be extended, which is standard in current domains.

Question 31Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server 2022 role service allows you to enforce a central access policy that applies to files across multiple servers based on resource properties?

  1. BranchCache
  2. Distributed File System Replication
  3. File Server Resource Manager
  4. Dynamic Access Control Correct answer.

Explanation

Dynamic Access Control uses central access policies, claims, and resource properties so access rules can be defined once and applied across file servers. Central access policies are deployed through Group Policy.

Question 32Secure Windows Server on-premises and hybrid infrastructures

You must ensure that a Windows Server 2022 server rejects SMB connections that do not support signing. Which action should you take?

  1. Disable SMB 1.0 and enable SMB 3.1.1
  2. Disable NetBIOS over TCP/IP on all adapters
  3. Configure the firewall to block TCP port 445
  4. Enable the SMB signing requirement through Group Policy on the server Correct answer.

Explanation

The policy setting Microsoft network server: Digitally sign communications (always) forces the SMB server to require signing, so clients that cannot sign are rejected. This protects against tampering and man-in-the-middle attacks.

Question 33Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server 2022 mechanism should you use to ensure that only approved scripts can run in PowerShell while recording every script block that executes?

  1. Execution Policy set to AllSigned on all hosts
  2. Just Enough Administration endpoints
  3. Windows Remote Management with Basic authentication disabled
  4. Constrained Language Mode combined with script block logging Correct answer.

Explanation

Constrained Language Mode restricts PowerShell to approved language elements, and script block logging records the content of scripts as they execute. Together they limit what scripts can do and provide an audit trail.

Question 34Secure Windows Server on-premises and hybrid infrastructures

You need to give a helpdesk group the ability to reset user passwords but nothing else in Active Directory. Which approach follows least privilege?

  1. Grant the group the Account Operators role at the domain root
  2. Delegate the Reset password permission on the target organizational unit Correct answer.
  3. Add the group to the Domain Admins group
  4. Assign the group the Backup Operators role

Explanation

Delegation of control lets you grant only the Reset password extended right on a specific organizational unit, so the group cannot modify other objects or attributes. This follows the principle of least privilege.

Question 35Secure Windows Server on-premises and hybrid infrastructures

A Windows Server 2022 server must be protected against pass-the-hash attacks that use stolen local account hashes. Which control most directly reduces this risk?

  1. Renaming the local Administrator account
  2. Disabling NTLM authentication for the domain
  3. Configuring Local Security Authority protection Correct answer.
  4. Enabling the built-in Administrator account

Explanation

Local Security Authority protection prevents code from reading LSA memory, which blocks tools that extract credential material used in pass-the-hash attacks. It is enabled through the Local Security Authority protection setting in Windows Defender.

Question 36Secure Windows Server on-premises and hybrid infrastructures

You need to configure a Windows Server 2022 server so that administrators must use a smart card to log on interactively. Which policy setting should you configure?

  1. Interactive logon: Require smart card Correct answer.
  2. System cryptography: Use FIPS compliant algorithms
  3. Network security: Restrict NTLM
  4. Accounts: Limit local account use of blank passwords

Explanation

The Interactive logon: Require smart card policy forces interactive logons to use a smart card, which supports multifactor authentication for administrators. It is configured under Security Options in local or Group Policy.

Question 37Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server 2022 feature should you enable to prevent a compromised virtual machine from reading the memory of another virtual machine on the same Hyper-V host?

  1. Hyper-V Replica
  2. Dynamic memory
  3. Shielded virtual machines with a host guardian service Correct answer.
  4. Nested virtualization

Explanation

Shielded virtual machines encrypt their state and disk and are attested by a Host Guardian Service, so a compromised host cannot inspect their memory or disks. This isolates tenants from host administrators.

Question 38Secure Windows Server on-premises and hybrid infrastructures

A Windows Server 2022 server must use only TLS 1.2 or later for incoming connections and must disable older protocol versions. Where should you make this change?

  1. In the Network Policy Server connection request policy
  2. In the Windows Firewall inbound rules
  3. In the IIS bindings configuration
  4. In the SCHANNEL registry settings under Protocols Correct answer.

Explanation

TLS protocol versions are controlled by SCHANNEL registry keys under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols. Disabling older versions there removes support for them across services that use SCHANNEL.

Question 39Secure Windows Server on-premises and hybrid infrastructures

You need to configure a Windows Server 2022 server as a reverse proxy that inspects and filters inbound HTTP requests before they reach an internal web server. Which role should you install?

  1. Web Application Proxy Correct answer.
  2. Routing and Remote Access
  3. Active Directory Federation Services
  4. Network Policy Server

Explanation

Web Application Proxy publishes internal web applications and can pre-authenticate and filter requests before forwarding them. It is installed as a Remote Access role service.

Question 40Secure Windows Server on-premises and hybrid infrastructures

You need to ensure that a Windows Server 2022 server records when a user is added to a privileged domain group. Which audit policy should you enable?

  1. Audit Account Logon
  2. Audit Account Management Correct answer.
  3. Audit Logon
  4. Audit Object Access

Explanation

Audit Account Management records changes to user, group, and computer accounts, including membership changes in security groups. The events appear in the Security log on domain controllers.

Question 41Secure Windows Server on-premises and hybrid infrastructures

A security analyst wants to detect attempts to use compromised credentials against many servers. Which Windows event should the analyst monitor to identify failed Kerberos pre-authentication?

  1. Event ID 4768 with failure status Correct answer.
  2. Event ID 4672
  3. Event ID 5140
  4. Event ID 4624

Explanation

Event 4768 is logged by a domain controller when a Kerberos authentication ticket is requested; a failure status indicates a failed pre-authentication, often from a bad password or spray attempt. Monitoring these events helps detect credential attacks.

Question 42Secure Windows Server on-premises and hybrid infrastructures

You need to protect administrative credentials on a Windows Server 2022 server by ensuring that privileged accounts cannot be used to access the internet or email. Which control should you implement?

  1. Restricted Groups policy
  2. Fine-grained password policy
  3. Protected Users security group Correct answer.
  4. Account lockout policy

Explanation

Members of the Protected Users group cannot use credentials for delegation and are prevented from using weaker authentication such as NTLM, and their credentials are not cached. This reduces exposure of privileged credentials to untrusted resources.

Question 43Secure Windows Server on-premises and hybrid infrastructures

You are configuring a Windows Server 2022 server to use a hardware security module for key storage. Which Windows feature should you configure to bind private keys to the HSM?

  1. Windows Defender Credential Guard
  2. Cryptography Next Generation key storage provider Correct answer.
  3. Data Execution Prevention
  4. AppLocker publisher rules

Explanation

A key storage provider, such as a vendor-provided KSP, lets Windows use the HSM to store and protect private keys without exposing them in software. Certificate requests and services then reference the KSP.

Question 44Secure Windows Server on-premises and hybrid infrastructures

You must ensure that members of a specific group can access a file server only during business hours. Which Windows Server 2022 capability should you use?

  1. NTFS deny permissions
  2. Dynamic Access Control with a central access rule using a time condition Correct answer.
  3. BitLocker Network Unlock
  4. File Server Resource Manager file screening

Explanation

Dynamic Access Control central access rules can include conditions beyond group membership, such as device or resource attributes, and can be combined with claims to enforce context-based access. Time-based conditions can be expressed through claims and policy evaluation.

Question 45Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server 2022 service should you deploy to centrally manage and audit privileged access to domain controllers with approval workflows?

  1. Privileged Access Management in Microsoft Identity Manager Correct answer.
  2. DNS Server role
  3. Local Administrator Password Solution
  4. Windows Defender Firewall

Explanation

Privileged Access Management provides just-in-time privileged access with approval workflows and auditing, using a bastion forest to isolate administrative accounts. It is implemented through Microsoft Identity Manager and a PAM trust.

Question 46Secure Windows Server on-premises and hybrid infrastructures

You need to ensure that a Windows Server 2022 server's local administrator password is unique and rotated automatically. Which solution should you deploy?

  1. Local Security Policy account lockout
  2. Windows LAPS Correct answer.
  3. Microsoft Defender Credential Guard
  4. Group Policy Restricted Groups

Explanation

Windows LAPS automatically generates, rotates, and stores unique local administrator passwords, optionally backing them up to Active Directory or Entra ID. This prevents lateral movement using shared local credentials.

Question 47Secure Windows Server on-premises and hybrid infrastructures

A Windows Server 2022 server must authenticate wireless users through RADIUS. Which role should you install?

  1. Network Policy Server Correct answer.
  2. Web Server (IIS)
  3. Hyper-V
  4. Active Directory Certificate Services

Explanation

Network Policy Server implements RADIUS and provides authentication, authorization, and accounting for wireless, VPN, and 802.1X clients. It is installed as part of the Network Policy and Access Services role.

Question 48Secure Windows Server on-premises and hybrid infrastructures

You need to prevent a Windows Server 2022 server from sending NTLM responses to untrusted servers while still allowing NTLM to trusted servers. Which setting should you use?

  1. Network security: Minimum session security for NTLM SSP
  2. Network security: LAN Manager authentication level
  3. Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers Correct answer.
  4. Network security: Configure encryption types allowed for Kerberos

Explanation

The Restrict NTLM outgoing traffic policy can be set to Audit, Block, or Allow with an exception list, so NTLM can be blocked to untrusted servers while permitting specific trusted targets. This limits credential exposure.

Question 49Secure Windows Server on-premises and hybrid infrastructures

Which Windows Server 2022 feature blocks malicious code from running in the kernel by enforcing that only trusted code can execute, using virtualization-based security?

  1. Windows Firewall
  2. Secure Boot
  3. Windows Defender Application Control with hypervisor-enforced code integrity Correct answer.
  4. User Account Control

Explanation

Hypervisor-enforced code integrity uses virtualization-based security to validate kernel-mode code in a protected environment, blocking untrusted drivers and code. It complements WDAC policies by enforcing integrity at a level the guest OS cannot bypass.

Question 50Secure Windows Server on-premises and hybrid infrastructures

You need to ensure that a Windows Server 2022 server's security log is forwarded to a central collector for correlation. Which built-in feature should you configure?

  1. Task Scheduler with an event trigger
  2. Performance Monitor data collector sets
  3. Windows Event Forwarding with a source-initiated subscription Correct answer.
  4. Reliability Monitor

Explanation

Windows Event Forwarding uses WinRM to send events from source servers to a collector, where subscriptions define which events are gathered. Source-initiated subscriptions let each source contact the collector.