Microsoft AZ-802 Real Exam Dumps [September 2026 Update]

Seven domains in 120 minutes with a domain weight distribution that concentrates over half your score in three areas you might not have equally prepared for. That is the AZ-802 exam in a sentence, and understanding the weight distribution is the most productive thing a candidate can do before opening any other study material. Active Directory Domain Services at 20-25% is the single heaviest domain, Charbel Nemnom, who shared a detailed first-hand AZ-802 beta exam experience, described AD DS as “by far the dominant topic”: domain controller restoration, AD replication troubleshooting, deleted user recovery from the AD Recycle Bin, Group Policy Preferences for drive mapping, Group Policy Modeling, and Group Policy Results. Storage and file services at 15-20% is the second group, Azure File Sync and DFS migration, FSRM, Storage Spaces Direct, Storage Replica, BitLocker. Monitoring and troubleshooting at 15-20% is the third group. Those three domains together represent 50-65% of the exam. The remaining four domains, hybrid workload management, virtual machines and containers, networking, and securing Windows Server, each carry 10-15%. Candidates who distribute study time equally across all seven domains are systematically underinvesting in the three highest-weight areas.

The Microsoft AZ-802 (Administering Windows Server) is the exam for Microsoft Certified: Windows Server Administrator Associate, consolidating AZ-800 (Administering Windows Server Hybrid Core Infrastructure) and AZ-801 (Configuring Windows Server Hybrid Advanced Services) into a single examination. AZ-800 and AZ-801 both retire September 30, 2026. The beta launched June 2026; general availability is August 2026. Passing score: 700/1000. Cost: $165. Duration: approximately 100-120 minutes across 7 domains.

Cert Empire’s AZ-802 exam questions are domain-weight-aligned: the question bank allocates 20-25% to Active Directory, 15-20% to Storage, and 15-20% to Monitoring, matching the exam’s confirmed distribution.

Exam Snapshot

The Seven AZ-802 Domains and Their Weights

Domain 1: Active Directory Domain Services (20-25%), The Dominant Domain

Based on beta exam reports, AD DS is where the most questions appear and the most unexpected difficulty lives for candidates who have not practiced hands-on AD DS administration recently.

Domain Controllers and Replication

Read-Only Domain Controllers (RODCs): RODCs are deployed in locations with poor physical security (branch offices, retail locations) where a full writable DC would be too much risk if stolen. RODCs replicate a read-only copy of AD; they can authenticate users locally but cannot write to AD. Password Replication Policy (PRP) determines which account credentials the RODC caches locally. The exam tests RODC deployment decisions: when is an RODC appropriate, how is the PRP configured, and what are the credential caching security implications.

FSMO roles: Five Flexible Single Master Operations roles (Schema Master, Domain Naming Master, PDC Emulator, RID Master, Infrastructure Master) must be managed across domain controllers. The exam tests which role does what and what symptoms indicate each role is unavailable: clients cannot authenticate when the PDC Emulator is down (in many environments), joining machines to the domain fails when the RID Master is unavailable, trusts cannot be created when the Domain Naming Master is down.

AD replication troubleshooting with repadmin: repadmin /showrepl displays replication status and errors. repadmin /replsummary shows a summary of replication success/failure rates. repadmin /syncall forces immediate replication. The exam presents a replication failure symptom (objects not appearing on a remote DC, authentication failing at a specific site) and tests which repadmin command diagnoses it.

AD Recycle Bin and object recovery: The AD Recycle Bin must be enabled explicitly (it is not on by default). When enabled, deleted objects are preserved with all attributes for the tombstone lifetime (default 180 days). The exam tests enabling the Recycle Bin and the PowerShell commands for restoring deleted objects: Get-ADObject -Filter {isDeleted -eq $True} -IncludeDeletedObjects | Restore-ADObject.

Group Policy

Group Policy Preferences (GPP): GPP extends Group Policy with settings that can be applied without being enforced, users can change them after application (unlike GP Settings, which are enforced). Drive mapping through GPP is a common scenario: User Configuration > Preferences > Windows Settings > Drive Maps. The exam tests GPP versus GP Settings and specifically drive mapping configuration.

Group Policy Modeling and Group Policy Results:

• Group Policy Modeling (in GPMC): Simulates what GPOs would apply to a user or computer in a specific OU with specific security group memberships, without the user or computer being in that OU currently. Used for planning.
• Group Policy Results (in GPMC): Shows the actual applied GPOs from a specific user’s last login on a specific computer. Used for troubleshooting.

The exam tests which tool to use for which scenario: modeling for “what would happen if we moved this user to that OU,” results for “why isn’t this policy applying to this specific user on this specific computer.”

GPO inheritance and enforcement: GPOs apply in LSDOU order (Local, Site, Domain, OU) with later policies overriding earlier ones for conflicting settings. Enforcement (formerly Block Inheritance) and No Override (formerly Enforced) modify this. The exam tests what “Block Inheritance” does (prevents GPOs from higher-level containers from applying to an OU) and what “Enforced” does (GPO always applies regardless of Block Inheritance below it).

Hybrid Identity with Microsoft Entra Connect

Microsoft Entra Connect (formerly Azure AD Connect) synchronization: Synchronizes on-premises AD objects to Microsoft Entra ID. Filtering controls which objects are synchronized (OU-based, group-based, attribute-based). The exam tests common synchronization issues: objects not appearing in Entra ID (not in synchronized OU, filtered by attribute), duplicate objects (on-premises and cloud identities not matched correctly), and UPN suffix issues (on-premises UPN domain not added to Entra ID).

Domain 2: Manage Storage and File Services (15-20%)

Azure File Sync and DFS Migration

Azure File Sync architecture: A Storage Sync Service in Azure connects to one or more Azure file shares (cloud endpoints) and one or more on-premises file servers (server endpoints). Cloud tiering moves infrequently accessed files from the on-premises server to Azure Files, keeping only recently accessed files cached locally. The exam tests: sync group creation, server endpoint registration, cloud tiering configuration (percentage of free space policy versus date policy), and troubleshooting sync health.

Replacing DFS with Azure File Sync: Many organizations run DFS-N (namespace) and DFS-R (replication) for multi-site file sharing. Azure File Sync provides a modern alternative where Azure Files serves as the authoritative store and server endpoints in each location cache local copies. The exam tests the migration approach: keeping DFS-N namespaces pointing to new server endpoints after sync is established.

FSRM (File Server Resource Manager): Manages disk quotas, file screening (blocking certain file types), and file classification. The exam tests quota template application, file screen creation (blocking .mp3, .avi, or executable files from shared folders), and storage reports.

Storage Spaces Direct (S2D) and Storage Replica

Storage Spaces Direct: Uses local storage in cluster nodes to create shared storage without a SAN. S2D requires Windows Server Datacenter edition and a specific minimum hardware configuration (2+ nodes, each with local NVMe/SSD for cache and HDD or SSD for capacity). The exam tests the S2D validation process and what cluster shared volumes (CSVs) are created from S2D storage pools.

Storage Replica: Block-level, synchronous or asynchronous replication between volumes. Useful for site-to-site disaster recovery without third-party tools. The exam tests Storage Replica modes, synchronous (zero RPO, requires low latency between sites), asynchronous (some RPO, suitable for longer distances), and the replication direction and failover procedure.

BitLocker for data-at-rest encryption: Encrypting volumes on Windows Server. The exam tests BitLocker configuration on server data volumes, TPM-based unlock (unlocks automatically if the hardware is unchanged), and recovery key management for servers where TPM is not available.

Domain 3: Monitor and Troubleshoot Windows Server (15-20%)

Azure Monitor and Azure Arc Integration

Azure Monitor for hybrid servers: Azure Monitor collects metrics and logs from Azure VMs and Azure Arc-enabled servers. The Log Analytics agent (or Azure Monitor Agent) installed on on-premises servers forwards logs and metrics to a Log Analytics workspace. The exam tests agent deployment, workspace configuration, and querying logs using KQL (Kusto Query Language) in Log Analytics.

Azure Update Manager: The current generation of patch management for Azure and Arc-enabled servers (replaces Update Management in Azure Automation). Azure Update Manager provides: assessment (what patches are missing), scheduling (maintenance windows), and deployment (automated patch application). The exam tests how Update Manager schedules are configured and how compliance reports are generated.

Microsoft Defender for Identity: Protects Active Directory by monitoring domain controller traffic for suspicious patterns (pass-the-hash, pass-the-ticket, Kerberoasting, lateral movement). The exam tests Defender for Identity sensor deployment (installed on domain controllers), what it detects, and how its alerts appear in the Defender XDR portal.

Performance Monitoring and Troubleshooting

Windows Server performance counters and tooling: Task Manager for quick checks, Resource Monitor for per-process resource breakdown, Performance Monitor (PerfMon) for structured counter collection over time, and Reliability Monitor for system stability history. The exam tests which tool is appropriate for which performance investigation scenario.

Common Windows Server performance issues and their diagnoses: High CPU with specific processes identifiable in Task Manager, memory pressure identified by high commit charge and heavy pagefile usage in Performance Monitor, disk I/O bottlenecks identified by high disk queue length counters, and network saturation identified by high bytes total/sec counters.

Domains 4-7 (10-15% Each)

Domain 4: Manage Hybrid Windows Server Workloads

Azure Arc-enabled servers: The Azure Connected Machine agent registers on-premises servers with Azure, making them manageable through the Azure portal. Arc-enabled servers can receive Azure Policy assignments (for compliance monitoring), Azure Monitor configurations, and Windows Server licensing benefits (Azure Hybrid Benefit for on-premises servers). The exam tests Arc onboarding and what Azure management capabilities Arc provides to on-premises servers.

Windows Admin Center: Browser-based server management without RDP. Manages individual servers, failover clusters, and hyperconverged infrastructure. The exam tests WAC capabilities: server configuration, certificate management, performance monitoring, and remote PowerShell execution from the WAC interface.

Domain 5: Manage Virtual Machines and Containers

Hyper-V VM management: VM generation (Gen 1 vs. Gen 2), GPU paravirtualization (Set-VMGpuPartitionAdapter for DDA/GPU-P), virtual switch types (External, Internal, Private), live migration prerequisites (shared storage or SMB Direct), and checkpoint management (Standard vs. Production). The exam tests Gen 2 VM requirements (UEFI firmware, Secure Boot) and production checkpoint advantages (application-consistent snapshots).

Windows Server containers: Process-isolated containers (Windows Server containers) share the host kernel, lighter but lower isolation. Hyper-V containers run each container in a lightweight VM, stronger isolation, higher resource overhead. The exam tests when each container isolation type is appropriate and how to run Hyper-V containers on a container host.

Domain 6: Networking Infrastructure

DNS configuration: Zone types (Primary, Secondary, Stub zones), Conditional Forwarders (directing queries for specific domains to specific DNS servers), DNS debugging, and DNSSEC (signing zones for validation). The exam tests when each zone type is appropriate and how to configure split-brain DNS (separate internal and external views for the same domain name).

DHCP failover: DHCP failover allows two DHCP servers to serve the same scope. Hot-standby mode: one server is active, one is standby, standby takes over if the active server fails. Load-sharing mode: both servers share scope servicing, both are active simultaneously and divide IP address allocation. The exam tests which mode is appropriate for high availability versus load distribution.

Domain 7: Securing Windows Server Infrastructure

Windows Defender Application Control (WDAC): Controls which applications can run on a Windows Server by defining code integrity policies. More restrictive than AppLocker (which it partially replaces). The exam tests WDAC policy creation and the audit mode (log but allow) versus enforced mode (block and log) for staged rollout.

Microsoft Defender for Cloud for servers: Provides vulnerability assessment, threat detection, and security recommendations for both Azure VMs and Arc-enabled servers. The exam tests what Defender for Cloud’s security score reflects (percentage of security recommendations implemented) and how to view and act on recommendations.

Just Enough Administration (JEA): Limits PowerShell remoting sessions to specific commands for specific users, implementing the principle of least privilege for administrative tasks. The exam tests JEA configuration: creating role capability files (defining permitted commands), session configuration files (mapping users to roles), and registering the session configuration.

5 Study Tips for Microsoft AZ-802

• Tip 1: Weight study time to match domain weights. Spend 20-25% of study time on AD DS, 15-20% on Storage, and 15-20% on Monitoring. Distribute the remaining 40-50% across the other four domains proportionally (10-15% each).
• Tip 2: Practice AD DS troubleshooting commands hands-on: repadmin /showrepl, gpresult /h, Get-ADObject with -IncludeDeletedObjects, and Test-DomainController. The exam presents symptoms; you need to select the diagnostic command.
• Tip 3: Study Azure File Sync end-to-end: setup, cloud tiering configuration, sync health monitoring, and common sync troubleshooting. Beta exam reports confirm this is heavily tested.
• Tip 4: Study Azure Update Manager specifically as the current-generation patch management tool (not the legacy Update Management from Azure Automation). Know how compliance reporting and scheduling work.
• Tip 5: Practice with Cert Empire’s AZ-802 exam questions domain-weighted to match the confirmed 7-domain distribution from the official study guide.

Best Study Resources

• Cert Empire AZ-802 exam questions PDF and practice simulator (2026 edition).
• Official Microsoft AZ-802 study guide (learn.microsoft.com/credentials/certifications/exams/az-802).
• Charbel Nemnom’s AZ-802 exam study guide (charbelnemnom.com/az-802-exam-study-guide), first-hand beta exam report.
• Microsoft Learn AZ-800 and AZ-801 learning paths (both fully cover AZ-802 content).
• Tutorials Dojo AZ-802 study guide and practice exams.

Career Opportunities After AZ-802

• Windows Server Administrator
• Hybrid Infrastructure Engineer
• Microsoft 365 Systems Administrator
• Azure-Integrated Infrastructure Engineer
• IT Operations Manager

The Microsoft Certified: Windows Server Administrator Associate is the current credential validating hybrid Windows Server expertise. Certified Windows Server administrators earn between USD 75,000 and USD 120,000 annually, with those managing Azure-integrated hybrid environments commanding higher ranges.

Why Candidates Choose Cert Empire for AZ-802 Preparation

✔ Domain-weight-aligned question distribution. Our AZ-802 question bank allocates 20-25% to AD DS, 15-20% to Storage, and 15-20% to Monitoring, matching the official confirmed domain weights rather than treating all 7 domains equally.

✔ AD DS troubleshooting scenario questions at command-line depth. We test repadmin diagnostics, Group Policy Modeling versus Results selection, RODC Password Replication Policy configuration, and AD Recycle Bin recovery procedures.

✔ Azure File Sync and Storage Spaces Direct questions. Our Storage domain coverage includes cloud tiering policy configuration, sync health troubleshooting, and S2D validation scenarios.

✔ Practice under real exam conditions with the Cert Empire Exam Simulator. Our AZ-802 simulator runs 100-120 question sessions across all 7 domains with weight-proportional question distribution.

✔ Instant access, 90-day free updates, and 24/7 support. As Microsoft updates AZ-802 from beta to GA and refines the study guide, your materials update automatically.

✔ Backed by a full money-back guarantee. If our exam questions do not help you pass, we refund your purchase with no conditions.

Readiness Check

1. An administrator needs to restore an Active Directory user account that was accidentally deleted 45 days ago. The AD Recycle Bin was enabled before the deletion occurred and the default tombstone lifetime applies. Describe the complete restoration process using PowerShell, what attributes the restored object retains, and what the administrator must do manually after restoration that the PowerShell cmdlet does not automatically handle.
2. A branch office has an RODC deployed because the physical server room has inadequate security. The branch office serves 80 employees who authenticate locally. The IT director asks whether these users’ passwords are stored on the RODC. Explain how the Password Replication Policy controls this, what the default PRP allows, what the administrator should configure to ensure branch office users can authenticate during a WAN outage without exposing credentials to RODC theft, and what the security risk of caching passwords on an RODC represents.
3. A Windows Server file server is being migrated to use Azure File Sync with cloud tiering enabled. After the migration, users in the Sydney office report that occasionally opening files takes 15-30 seconds instead of the usual subsecond response. Files downloaded normally after the initial wait. Identify what is causing this behavior, what Azure File Sync feature produces it, and what the administrator should configure to reduce this experience for the most commonly accessed files.
4. A domain administrator needs to determine why a specific GPO that should apply to computers in the Sales OU is not showing any effect. The GPO is linked to the Sales OU, the computers are confirmed to be in the Sales OU, and the GPO settings look correct. Describe the two Group Policy troubleshooting tools available in GPMC, explain which one the administrator should use first and why, and identify four common causes of GPO not applying that these tools would reveal.
5. An administrator needs to monitor all Windows Server systems, both Azure VMs and on-premises servers connected via Azure Arc, in a single monitoring dashboard showing CPU, memory, and disk metrics alongside Windows event logs. Describe which Azure service provides this unified monitoring capability, what must be installed on the on-premises Arc-enabled servers to enable log forwarding, and how KQL is used to query for a specific Windows event (Event ID 4625: failed logon) across both Azure VMs and Arc-enabled servers in the same query.

FAQ’s

What is Microsoft AZ-802?

AZ-802 is the Administering Windows Server exam for Microsoft Certified: Windows Server Administrator Associate. It consolidates the content of AZ-800 and AZ-801 into a single exam, effective from its GA in August 2026.

When do AZ-800 and AZ-801 retire?

Both AZ-800 and AZ-801 retire on September 30, 2026. After that date, AZ-802 is the only exam path to the Windows Server Administrator Associate credential.

What are AZ-802’s seven domains?

Deploy and manage AD DS (20-25%), Manage storage and file services (15-20%), Monitor and troubleshoot Windows Server (15-20%), Manage hybrid Windows Server workloads (10-15%), Manage virtual machines and containers (10-15%), Implement and manage networking (10-15%), and Secure Windows Server infrastructure (10-15%).

Do I need to study AZ-801 content for AZ-802?

Yes. AZ-802 covers both AZ-800 content (core infrastructure: AD DS, hybrid management, Hyper-V, networking, storage) and AZ-801 content (advanced services: security hardening, disaster recovery, WSFC, Storage Replica, migration). Both predecessor exam blueprints are in scope.

Related Certifications Worth Exploring

AZ-802 certified professionals expanding their Microsoft certification portfolio will find our AZ-104 Microsoft Azure Administrator exam questions page covers the cloud-side credential that pairs naturally with AZ-802’s hybrid Windows Server expertise. For those pursuing security specialization alongside Windows Server administration, our SC-200 Security Operations Analyst exam questions page covers the security operations credential relevant to the monitoring and threat detection topics in AZ-802’s Domain 7.