AZ-802 Windows Server Hybrid Administrator flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Azure Connected Machine agent

Agent installed on non-Azure servers that enables Azure Arc enrollment, inventory, extension deployment, and policy evaluation for on-premises or multicloud Windows Server machines.

Azure Arc-enabled servers

Azure resource representation of servers running outside Azure, allowing Azure Policy, Update Manager, Defender for Cloud, and extensions to manage them like Azure VMs.

Azure Automanage

Service that applies a curated set of best-practice configurations, including backup, monitoring, and updates, to Azure VMs and Arc-enabled servers with minimal manual setup.

Azure Update Manager

Azure service that assesses and deploys operating system updates to Azure VMs, Arc-enabled servers, and Azure Stack HCI nodes using schedules and maintenance windows.

Windows Admin Center

Browser-based management tool for Windows Server, clusters, and hybrid services; it runs as a gateway and supports extensions for Azure Backup and Azure File Sync.

Password hash synchronization

Entra Connect feature that synchronizes a hash of the on-premises password hash to Microsoft Entra ID so users can authenticate in the cloud with the same credentials.

Pass-through authentication

Authentication method where Microsoft Entra ID validates sign-ins against on-premises AD through lightweight agents, so passwords are never stored in the cloud.

Seamless SSO

Feature that lets domain-joined devices sign users into Microsoft Entra ID automatically using Kerberos tickets, reducing repeated credential prompts on corporate networks.

Password writeback

Entra Connect option that allows password changes made in the cloud, including self-service password reset, to be written back to on-premises Active Directory.

Microsoft Entra Connect cloud sync

Lightweight agent-based provisioning service that synchronizes users and groups from AD to Microsoft Entra ID for multi-forest and disconnected directory topologies.

Microsoft Entra Domain Services

Managed domain service providing LDAP, Kerberos, and Group Policy for cloud workloads without deploying domain controllers; it synchronizes one way from Microsoft Entra ID.

Windows LAPS

Feature that manages and rotates local administrator passwords, backing them up to Active Directory or Microsoft Entra ID with role-based retrieval and auditing.

Privileged Identity Management

Service providing just-in-time activation of privileged roles with approval, multi-factor authentication, and time-bound assignments for Entra and Azure resources.

Route-based VPN gateway

Azure VPN gateway type required for point-to-site coexistence, ExpressRoute coexistence, and VNet-to-VNet connections; it uses routes rather than traffic selectors.

Azure DNS Private Resolver

Azure service with inbound and outbound endpoints that forwards DNS queries between on-premises networks and Azure private DNS zones without DNS forwarder virtual machines.

Private endpoint

Network interface that connects a private IP address in a subnet to an Azure PaaS service, keeping traffic on the Microsoft backbone and private network.

Conditional forwarder

DNS configuration that forwards queries for a specific domain namespace to designated name servers, commonly used to resolve on-premises names from Azure or vice versa.

Azure Network Watcher

Regional service providing diagnostics such as IP flow verify, next hop, connection troubleshoot, packet capture, and topology for Azure network resources.

Azure File Sync

Service that centralizes file shares in Azure while caching frequently accessed files on Windows servers, using sync groups and cloud tiering for capacity savings.

Cloud tiering

Azure File Sync feature that replaces cold files on the local server with reparse points while the full file content remains in the Azure file share.

Sync group

Azure File Sync object that defines the relationship between one Azure file share cloud endpoint and one or more registered server endpoints.

Storage Replica

Windows Server feature providing block-level synchronous or asynchronous replication between volumes, servers, or clusters for disaster recovery and stretch clusters.

MARS agent

Microsoft Azure Recovery Services agent that backs up files, folders, and system state from on-premises Windows servers directly to an Azure Recovery Services vault.

SMB over QUIC

Windows Server feature that provides SMB file access over QUIC using TCP 443 and certificates, enabling secure access over untrusted networks without a VPN.

Nested virtualization

Hyper-V capability that lets a virtual machine host its own Hyper-V role; it is required to run Hyper-V inside an Azure VM and needs a supporting VM size.

Production checkpoint

Hyper-V checkpoint type that uses Volume Shadow Copy Service to capture an application-consistent state, avoiding the disruption caused by standard checkpoints.

Cloud witness

Failover cluster quorum witness stored in an Azure storage account, providing a tie-breaking vote without requiring a third site or file share.

Shielded VM

Hyper-V virtual machine protected by Host Guardian Service attestation, with an encrypted virtual TPM, encrypted disks, and restricted console access by fabric administrators.

Azure Monitor Agent

Agent that collects telemetry from Azure and Arc-enabled servers using data collection rules, replacing the legacy Log Analytics agent for monitoring.

Data collection rule

Azure Monitor configuration object that specifies which data sources to collect, how to transform them, and which destinations receive the collected telemetry.

Microsoft Defender for Cloud

Cloud security posture management and workload protection service providing secure score, recommendations, and Defender plans for servers and other resource types.

BitLocker key escrow

Process of storing BitLocker recovery keys in Active Directory or Microsoft Entra ID so administrators can recover encrypted volumes when users cannot supply the key.