AZ-802 Windows Server Hybrid Administrator common mistakes
AZ-802 Windows Server Hybrid Administrator · Understand the traps and how to avoid them.
Treating Microsoft Entra Connect sync as a one-way copy from on-premises AD and assuming an object deleted on-premises simply disappears everywhere, without planning for soft-delete, the recycle bin, and the staging-server cutover.
Candidates memorise the sync direction but never study the lifecycle: deleted objects land in the Entra recycle bin for a limited window, hard deletes and re-created objects can produce duplicate or orphaned cloud objects, and failover requires a staging server in export mode. Exam items probe these edge cases rather than the basic sync flow.
What to do instead
Build a mental timeline: on-premises delete, sync, soft-delete in the cloud, restore window, permanent removal. Practise restoring a deleted user and reconnecting a re-created object with matching source anchor. Know that a staging server runs in staging mode and must be switched to active before it exports.
Choosing password hash synchronization, pass-through authentication, or federation by reflex instead of deriving the choice from stated constraints such as no outbound internet from domain controllers, smart card requirements, or a need for immediate on-premises account lockout.
The three sign-in methods are studied as isolated definitions, so candidates match on keywords like 'high availability' or 'seamless' rather than on the actual requirement. Each method has distinct dependencies: agents, network paths, certificate infrastructure, and where the password is validated.
What to do instead
For every scenario, write the requirement first and map it: hash sync needs no on-premises dependency but cannot enforce on-premises lockout policy in real time; pass-through needs outbound connectivity from the agent hosts and gives real-time validation; federation needs a farm, certificates, and token-signing infrastructure. Rehearse the trade-off table until the mapping is automatic.
Configuring a hybrid network feature such as a site-to-site VPN, Azure Route Server, or user-defined routes without tracing the effective route for a specific source-destination pair, then answering based on the intended design rather than the resulting path.
Questions present a topology in prose and ask where traffic actually flows. Candidates reason from the components they configured instead of from route selection: longest prefix match, route priority, and the interaction between system routes, BGP-learned routes, and user-defined routes.
What to do instead
Practise drawing the effective route table for a given subnet and destination, applying longest prefix match first, then priority, then BGP versus static preference. Check whether peering is transitive, whether gateway transit is enabled, and whether a next-hop appliance has IP forwarding turned on before concluding the path.
Assuming Azure DNS private zones, on-premises DNS forwarders, and conditional forwarders resolve each other automatically after the zone is created, without verifying the forwarder chain and the virtual network links.
Name resolution questions hide the failure in the plumbing: a private zone must be linked to the virtual network that hosts the resolver, and on-premises clients need a conditional forwarder pointing at a resolver in Azure. Candidates often forget that the DNS server must be reachable from the client's subnet.
What to do instead
Trace resolution hop by hop from the client: which server is configured, what forwarder or conditional forwarder it uses, whether the target zone is linked to the resolver's virtual network, and whether the network path allows DNS traffic. Test with a query from each side rather than assuming the link implies resolution.
Mixing up Storage Spaces, Storage Spaces Direct, and clustered shared volumes when asked which technology satisfies a given resiliency or capacity requirement, and misapplying tiering or cache rules.
The names overlap and the exam tests the boundary conditions: which edition supports which feature, how many nodes a converged or hyper-converged deployment needs, and what happens to capacity when a disk fails under a given resiliency setting.
What to do instead
Anchor each technology to its constraint: shared storage versus locally attached disks, minimum node counts, supported resiliency modes, and rebuild behaviour. Work through capacity arithmetic for a two-way mirror versus parity so you can compute usable capacity instead of reciting feature names.
Planning a storage replication or migration by capacity alone, ignoring change rate, available bandwidth, and the seeding step, then predicting a cutover window that the link cannot support.
Replication items are arithmetic problems disguised as feature questions. Candidates estimate transfer time from total data size without subtracting the initial seed, accounting for compression, or checking whether the delta can keep up with ongoing writes.
What to do instead
Compute in three parts: seed time for the baseline copy, delta transfer rate versus change rate to confirm the backlog drains, and final cutover time for the last delta. If change rate exceeds available throughput, the answer is usually offline seeding or a longer cutover, not a different replication tool.
Answering virtual machine mobility and update questions without checking cluster role, quorum, and live migration constraints such as CPU compatibility, shared storage, and network requirements.
Candidates focus on the VM setting they are asked about and forget the cluster-level preconditions. Live migration can fail on processor compatibility mode, missing virtual switch on the target, or insufficient quorum, and cluster-aware updating depends on the cluster functional level.
What to do instead
Before choosing a migration or patching approach, list the preconditions: quorum model and current vote, shared versus local storage, identical virtual switch names, processor compatibility, and cluster functional level. Eliminate options that violate any precondition rather than picking the most familiar feature.
Treating Azure Arc and Azure Monitor as interchangeable onboarding steps, or assuming an agent installed for one purpose also delivers the other's data, without checking which extension or agent provides the signal.
Hybrid monitoring questions hinge on the agent chain: the connected machine agent enables Arc, but guest logs and metrics need the Azure Monitor agent with a data collection rule, and update management needs its own extension. Candidates conflate the control plane with the telemetry plane.
What to do instead
Draw two columns, management and telemetry, and place each component: connected machine agent, Azure Monitor agent, data collection rule, dependency agent, update extension. For any scenario, name the exact agent and configuration object that produces the required data before selecting an answer.
Applying security controls such as Windows Defender Application Control, Credential Guard, or Just Enough Administration as isolated toggles without checking hardware, licensing, and dependency prerequisites.
Each control has a precondition chain that questions deliberately break: virtualisation-based security needs specific CPU features and may conflict with other hypervisor-based features, application control policies need a signed or audited deployment path, and tiered administration depends on privileged access workstations.
What to do instead
For each control, memorise the prerequisite list and the failure symptom when a prerequisite is missing. Check whether the scenario mentions nested virtualisation, an existing hypervisor, or an unsigned application set, and eliminate options whose prerequisites the scenario contradicts.
Reading a multi-part scenario once and answering each question in isolation, so later answers contradict earlier commitments about which server holds which role or which sign-in method was chosen.
Case-style items share a stem but are scored independently, and candidates rush the stem to save time. The result is internally inconsistent choices, such as selecting pass-through authentication in one question and federation prerequisites in the next.
What to do instead
On case items, extract the constraints into a short written list before answering: identity method, network path, storage topology, licensing tier. Re-read the list before each question and reject any option that conflicts with a constraint you already committed to, even if it looks correct in isolation.