In the full course
What you get
- 200 exam-style questions, each with a full explanation
- 6 performance-based tasks, marked with partial credit
- 200 flashcards, filtered by domain
- The full study guide, 24 chapters
- Timed mock exams matched to the real exam length
- A readiness score weighted by the official exam blueprint
Get full access to AZ-802: Administering Windows Server
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Lifetime · all courses
$29.99
One payment · future courses included
30 seconds, then straight to checkout.
Pass, or your money back
Reach 85% readiness on this course, sit the real exam, and if you don't pass we refund it in full. Applies to this single-course purchase. Terms.
More free samples
Marked, and passed
Real feedback from people who passed
“I failed my CISSP on the first attempt with another platform. Switched to CertCrush, focused on my weak domains using the tracking feature, and passed three months later. The explanations for wrong answers are genuinely useful, not just 'A is correct because A is correct'.”
“Honestly wasn't expecting much but this is probably the best ten bucks I've spent on exam prep. Did 20–30 questions every morning before work for 6 weeks. Passed with a comfortable margin. The timed exam mode is what really got me comfortable with the pressure.”
“The flashcards are underrated. I used them during my commute and it made a huge difference for the theory-heavy ITIL questions. Passed first try. Already using it again for CISM.”
Microsoft's Windows Server Hybrid Administrator Associate exam, covering AD DS, hybrid management with Azure Arc, Hyper-V, networking, storage, security, and troubleshooting across on-premises, cloud, and hybrid environments. AZ-802 consolidates the retiring AZ-800 and AZ-801 into a single exam.
Practice content last updated · Independently written and aligned to Microsoft’s published exam objectives.
About the AZ-802: Administering Windows Server Exam
AZ-802, "Administering Windows Server", is Microsoft's exam for the Windows Server Hybrid Administrator Associate credential. If you deploy, manage, and troubleshoot Windows Server across on-premises, Azure, and hybrid environments, this is the exam that certifies it. Here is the part that matters if you have been studying already: AZ-802 replaces the old two-exam path. Microsoft retired AZ-800 and AZ-801 on 30 September 2026 and folded both into this single exam, which earns the identical credential. If you were halfway through the old route, you are not starting over, but you do need to know what moved and what got cut. The exam spans seven domains. Active Directory Domain Services is the heaviest, and the hybrid half is where traditional Windows administrators feel least at home: Azure Arc, Azure Update Manager, Azure Monitor, and Microsoft Defender for Cloud all appear, alongside the on-premises skills you already have. You are expected to be comfortable with Windows Admin Center, Hyper-V, PowerShell, and AD DS going in. Expect roughly 40 to 60 items in a mix of multiple choice, drag-and-drop, and case studies. The pass mark is 700 on a 1000-point scaled scale, and the credential renews annually through a free assessment on Microsoft Learn. This is a broad exam with no domain small enough to skip, which is exactly why targeted practice beats re-reading. Work every domain in proportion to its weight, and treat the case studies as their own skill. CertCrush helps you prepare with free AZ-802 practice questions, timed practice tests and full mock exams with a clear explanation for every answer.
Exam Domains Covered
- Deploy and manage AD DS21%
- Manage Windows Server instances and workloads in a hybrid environment12%
- Manage virtual machines12%
- Implement and manage an on-premises and hybrid networking infrastructure12%
- Manage storage and file services16%
- Secure Windows Server infrastructure11%
- Monitor and troubleshoot Windows Server environments16%
Exam Format & Details
Roughly 40 to 60 questions in a mix of multiple choice, drag-and-drop, and case studies. Pass mark is 700 out of 1000 (scaled scoring, so this is not a simple percentage of questions correct). Voucher cost is around 165 USD in the United States, with regional variation. Book through Pearson VUE, at a test centre or online proctored. There are no traditional performance-based labs, but case studies present a scenario with multiple linked questions and are where unprepared candidates lose the most marks. You can explore the exam interface in advance using Microsoft's exam sandbox at aka.ms/examdemo. The credential renews every year via a free online assessment on Microsoft Learn.
Why Practice Questions Matter
AZ-802 is wide, and Microsoft Learn reads like a parts catalogue: you can finish it and still have no mental model of how the pieces fit. Practice questions fix that by forcing recall and decision-making instead of recognition. They also rehearse the exam's real traps, the ones that fail prepared people: transfer versus seize on FSMO roles, why Protected Users breaks service accounts, how DFSR authoritative SYSVOL restore actually works. And they build stamina for the case studies, which blindside candidates who only ever practised isolated questions. Work each domain to its weight, and let your weak spots surface here rather than on exam day.
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real AZ-802: Administering Windows Server exam, marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the AZ-802: Administering Windows Server exam, not actual exam content.
Q1.A domain controller's system state was restored from last night's backup to recover an organizational unit that was deleted at 4 p.m. After the domain controller booted and replicated, the OU was gone again. What is the cause?
- A.The backup predates the tombstone lifetime configured for the forest
- B.The domain controller was restored while the Recycle Bin was disabled
- C.The DSRM password was reset before the restore was performed
- D.A system state restore is non-authoritative by default
Domain: Monitor and troubleshoot Windows Server environments
Q2.Users at a branch office report that logons take about ninety seconds. Investigation shows the branch machines are authenticating against a domain controller in another country. Nothing reports an error. What should you check first?
- A.Whether the site link cost between the branch and the remote site has been set too low.
- B.Whether the Knowledge Consistency Checker has built connection objects for the branch site.
- C.Whether the PDC Emulator role has been moved to a domain controller in the remote site.
- D.Whether the branch subnet is defined and associated with the branch site in Sites and Services.
Domain: Deploy and manage AD DS
Q3.A virtual machine cannot receive inbound traffic from another virtual machine. A network security group is attached to the subnet and a second network security group is attached to the virtual machine's NIC. Which three statements about network security group evaluation are correct? (Select THREE.)
- A.Azure evaluates the subnet network security group first for inbound traffic, then the NIC network security group
- B.Rules are processed in priority order, lowest number first, and processing stops at the first match
- C.The default DenyAllInBound rule at priority 65500 blocks inbound traffic unless a lower numbered rule allows it
- D.The NIC network security group is always evaluated before the subnet network security group for inbound traffic
- E.An allow rule on either the subnet or the NIC network security group is sufficient to permit the traffic
- F.Rules with the highest priority number are evaluated first
Domain: Manage virtual machines
Q4.You are creating an Azure File Sync sync group. How many cloud endpoints and server endpoints can the sync group contain?
- A.Exactly one cloud endpoint and one or more server endpoints
- B.One or more cloud endpoints and exactly one server endpoint
- C.Exactly one cloud endpoint and exactly one server endpoint
- D.One or more cloud endpoints and one or more server endpoints
Domain: Manage storage and file services
Q5.You need domain-joined servers to refuse unauthenticated inbound connections from any machine that is not a member of the domain, while continuing to accept authenticated connections from domain members. Which type of connection security rule should you create?
- A.Isolation
- B.Authentication exemption
- C.Server-to-server
- D.Tunnel
Domain: Secure Windows Server infrastructure
Q6.An administrator sets the no-refresh interval to 8 hours and the refresh interval to 8 hours on a busy Active Directory integrated zone to clear stale records faster. Users then report that working file servers cannot be resolved. What is the cause?
- A.The combined intervals total less than the roughly 24 hour re-registration period, so live records are scavenged
- B.Zone transfers cannot complete inside an 8 hour window, so records are lost
- C.Secure dynamic update rejects the refresh attempts from the file servers
- D.The SOA serial number stops incrementing, so refreshed records are discarded
Domain: Implement and manage an on-premises and hybrid networking infrastructure
Q7.You need to apply the shipped Microsoft security baseline to a Windows Server 2025 member server using OSConfig, taking the baseline exactly as Microsoft provides it. Which command should you run?
- A.Get-OSConfigDesiredConfiguration -Scenario SecurityBaseline/WindowsServer/2025/MemberServer
- B.Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline/WindowsServer/2025/DomainController -Default
- C.Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline/WindowsServer/2025/MemberServer -Setting AuditDetailedFileShare -Value 3
- D.Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline/WindowsServer/2025/MemberServer -Default
Domain: Secure Windows Server infrastructure
Q8.You onboard a server to Azure Arc and install the Windows Admin Center extension on it. A colleague who is an Owner on the subscription selects Connect and receives an access error. You need to grant the colleague access with the least privilege. What should you do?
- A.Add the account to the local Administrators group on the Arc-enabled server.
- B.Assign the Contributor role on the Arc-enabled server resource.
- C.Assign the Windows Admin Center Administrator Login role.
- D.Assign the Azure Connected Machine Onboarding role on the resource group.
Domain: Manage Windows Server instances and workloads in a hybrid environment
Q9.You enable just-in-time (JIT) VM access on an Azure virtual machine, and a user later requests access to port 3389. Which three statements correctly describe what Microsoft Defender for Cloud does? (Select THREE.)
- A.It ensures deny all inbound rules exist for the selected ports in the network security group
- B.It verifies the requesting user's Azure role-based access control permissions for that virtual machine
- C.It deletes the network security group attached to the virtual machine for the duration of the request
- D.It restores the network security groups to their previous state when the time window expires
- E.It removes the public IP address from the virtual machine
- F.It routes the requested session through Azure Bastion automatically
Domain: Manage virtual machines
Q10.You created a server endpoint on the system volume of a registered server. You now need to enable cloud tiering on that endpoint, but the option is unavailable. What should you do?
- A.Change the drive letter of the existing server endpoint to a non-system volume.
- B.Move the data to a non-system volume and create the server endpoint there.
- C.Unregister the server, then register it again and re-create the endpoint.
- D.Set the volume free space policy on the system volume, then enable tiering.
Domain: Manage storage and file services
AZ-802: Administering Windows Server guides & exam news
How to Pass the Microsoft AZ-802 Exam in 2026: An 8-Week Windows Server Administrator Study Plan
Microsoft AZ-802 replaces AZ-800 and AZ-801, both retiring on 30 September 2026. This 8-week study plan breaks down the seven exam domains, the cost and pass mark, and a week-by-week schedule to certify as a Windows Server Administrator Associate.
AZ-800 and AZ-801 Retired on 30 September 2026: Your Route Is Now AZ-802
Microsoft retired AZ-800 and AZ-801 on 30 September 2026. AZ-802 is now the single exam for the Windows Server Hybrid Administrator Associate. Here is what changed, how AZ-802 is weighted and what to do next.
SC-500 vs SC-200 in 2026: Which Microsoft Security Exam Should You Take?
SC-500 is for engineers who build and harden Azure, hybrid and AI workloads. SC-200 is for analysts who detect, investigate and respond. How the two 2026 exams differ, where their objectives overlap, and which to take first.
Microsoft AB-650 Exam Topics and Domain Weightings in 2026: The MS-102 Replacement, Now in Beta
AB-650 replaces MS-102 as Microsoft's tenant administration exam, and the weightings tell a different story. Security and governance take 40 to 45 percent, AI services take 35 to 40 percent, and classic tenant admin is down to a fifth of the exam.
Frequently Asked Questions
Does the AZ-802: Administering Windows Server course include performance-based questions?
Yes. The AZ-802: Administering Windows Server course includes 6 performance-based questions (PBQs): hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free AZ-802: Administering Windows Server sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full AZ-802: Administering Windows Server course?
The full AZ-802: Administering Windows Server course includes 200 practice questions and 6 performance-based tasks, covering all 7 exam domains. Every question carries a full explanation for the right answer and the wrong ones.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned. They mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the AZ-802: Administering Windows Server course cover?
The course covers 7 exam domains: Deploy and manage AD DS, Manage Windows Server instances and workloads in a hybrid environment, Manage virtual machines, Implement and manage an on-premises and hybrid networking infrastructure, Manage storage and file services, Secure Windows Server infrastructure, Monitor and troubleshoot Windows Server environments.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.
Start with 10 free questions
No account, no card. The full AZ-802: Administering Windows Server course is $9.99, once.