AZ-802 Exam Dumps and Practice Questions

By default, replication between sites waits for a scheduled interval and does not immediately notify partner domain controllers when a change occurs, which is the main source of intersite convergence delay; intra-site replication, by contrast, uses change notification and typically converges within seconds. The site link's options attribute contains a bit flag that controls whether intersite change notification is enabled for that link; turning it on causes a source domain controller to notify its intersite replication partners of a change almost immediately, similar to intra-site behavior, rather than waiting for the next scheduled replication cycle, which directly minimizes convergence time. Modifying site link costs changes which path the Knowledge Consistency Checker prefers when multiple routes exist, affecting topology efficiency but not how quickly a given link propagates a change once it's used. Modifying the replication schedule adjusts the windows during which replication over a link is permitted to occur at all, and while a more frequent schedule can reduce worst-case latency somewhat, it does not eliminate the fundamental polling-interval delay the way change notification does. A site link bridge only affects whether transitivity is assumed between site links for cost calculation and has no bearing on notification behavior. Enabling change notification via the options attribute is therefore the correct answer.

DHCP1 (New York, Scope1) and DHCP2 (Seattle, Scope2) currently serve only their own local office. To make DHCP highly available across both offices, the modern, supported approach is DHCP Failover, configured per scope (option E), which replicates lease information between DHCP1 and DHCP2 in either load-balance or hot-standby mode so that either server can service either scope's clients if its partner becomes unavailable. However, DHCP Failover alone only helps if a client's DHCP broadcast can actually reach the surviving partner server across the WAN; broadcasts do not cross routed office boundaries on their own. Configuring a DHCP relay agent on the router (or another relay-capable device) in each office (option B) forwards DHCPDISCOVER broadcasts from local clients to the remote partner server whenever the local DHCP server is down, allowing failover to actually take effect for clients in either office. The legacy split-scope technique of manually carving off a percentage of the other scope's addresses (options A and C) is the older, pre-failover workaround and is unnecessary once DHCP Failover is used; there is also no DHCP cluster role delivered through Windows Failover Clustering (option D), since DHCP achieves high availability through Failover mode, not a clustered role.

An Azure private DNS zone can only be resolved through the Azure-provided DNS resolver (168.63.129.16) by resources inside a virtual network the zone is linked to; it does not expose a directly queryable DNS server IP address that an on-premises server could target across the Site-to-Site VPN, so on-premises DC1 cannot resolve fabrikam.com by itself no matter what zone type it creates locally (ruling out a stub zone or secondary zone, both of which would need a real, reachable authoritative source to transfer from or refer to). The standard solution is to deploy a Windows Server virtual machine inside the linked virtual network and configure it as a DNS forwarder that forwards fabrikam.com queries to the Azure-provided resolver, which it can reach locally within the VNet; that VM's own IP address is then reachable from on-premises across the Site-to-Site VPN. With that forwarder VM in place, DC1 on-premises is configured with a conditional forwarder for the fabrikam.com domain pointed at the forwarder VM's IP address, so any fabrikam.com query DC1 receives is relayed across the VPN to the forwarder VM, which resolves it against Azure's private DNS resolution path. Modifying the VNet's DNS Servers setting is unnecessary for this specific requirement, since it changes name resolution for Azure resources, not for on-premises clients.

Read-only domain controllers support a feature called Administrator Role Separation, which allows an administrator to designate a specific domain user as a local administrator of one particular RODC without granting that user any domain-wide administrative rights whatsoever, which is exactly what satisfies the principle of least privilege in this scenario. This role separation is configured using ntdsutil.exe, specifically through its local roles management menu, where a command such as adding CONTOSO\User1 to the administrators role is run against the target RODC to grant User1 local administrative access to just that one domain controller. Computer Management's Local Users and Groups snap-in does not expose or apply the same role-separation mechanism when used against a domain controller, since domain controllers do not maintain a separate local SAM database of local users and groups the way member servers do. dsamain.exe is used to expose a static, offline snapshot of an Active Directory database, such as one restored from a backup, for browsing and comparison purposes, which is unrelated to granting administrative rights. The net user command only creates or modifies domain or local user account properties; it does not add a user to an RODC's local administrative role, so ntdsutil.exe is the only tool listed that correctly accomplishes this least-privilege delegation.

Direct access (DAX) mode for persistent memory volumes in Storage Spaces Direct is supported only in combination with the NTFS file system; a persistent memory volume formatted with ReFS can only be used in block access mode, not DAX mode, regardless of when that volume was created. Volume1 and Volume3 are formatted with NTFS, while Volume2 and Volume4 are formatted with ReFS, so DAX is available on Volume1 and Volume3 and is not available on Volume2 or Volume4. Because file system type -- rather than whether a volume is part of the existing deployment or a newly planned addition -- is the determining factor for DAX eligibility, both the currently deployed NTFS volume (Volume1) and the newly planned NTFS volume (Volume3) qualify for DAX. This NTFS-only restriction for DAX, contrasted with block access mode's support for both NTFS and ReFS, is a core planning consideration whenever persistent memory is deployed with Storage Spaces Direct. Therefore, Volume1 and Volume3 only is the correct answer.