Score Higher on Verified AZ-802 | Administering Windows Server Exam Questions with Answers

When upgrading a Remote Desktop Services deployment, Microsoft ' s documented order is to upgrade the RD Connection Broker server or servers first, because the Connection Broker holds the deployment configuration and every other role server depends on it; RD License servers and RD Session Host servers follow, with RD Web Access, RD Virtualization Host, and RD Gateway able to be upgraded afterward. In the table, Server3 hosts the RD Connection Broker role, so it must be the first server upgraded to Windows Server 2025 before the rest of the deployment is upgraded. Upgrading a dependent role server first, such as a Session Host or Web Access server, risks a version mismatch against a still-outdated Connection Broker and can break the deployment ' s ability to broker new sessions, which is why Microsoft ' s guidance treats the Connection Broker ' s own upgrade as the mandatory starting point for any RDS deployment upgrade regardless of how many other role servers are involved.

In the subscription, create: a Log Analytics workspace. On Server1, install: the Azure Monitor agent.

Azure Monitor collects and analyzes telemetry through Log Analytics workspaces, which are the destination data store for the logs and performance counters that monitored machines send. Because Server1 is on-premises but has internet connectivity, it does not need to be Arc-onboarded merely to send monitoring telemetry via Azure Monitor Agent (AMA) using Microsoft Entra-based or token authentication; the essential subscription-side resource that must exist first is the Log Analytics workspace that will store the collected data and against which data collection rules and queries are defined. On the server side, the Azure Monitor agent is the current, supported agent for collecting events, performance counters, and logs from Windows and Linux machines, whether they are Azure VMs, on-premises servers, or Arc-enabled servers, and forwarding that data to the configured Log Analytics workspace through an associated data collection rule. The distractor options do not fit this scenario: an Azure Files storage account and Azure SQL Database/Blob Storage accounts are unrelated data stores that Azure Monitor does not use as its telemetry destination; the Analytics gateway is a Power BI on-premises data gateway component, not a monitoring agent; and the Device Health Attestation server role is a Windows feature for validating device boot-time security state, unrelated to Azure Monitor telemetry collection. Creating the workspace and installing the Azure Monitor agent together is what is needed to monitor Server1.

Both Kerberos V5-based authentication methods, whether configured as Computer (Kerberos V5) or the less common User (Kerberos V5) variant, fundamentally require that both endpoints of the connection be joined to, and trusted by, the same Active Directory domain, since Kerberos authentication depends entirely on that domain trust relationship to issue and validate tickets. Because the two workgroup servers in this scenario are not joined to the domain at all, neither Kerberos-based method can successfully authenticate a connection security rule between them and the five domain member servers, and NTLMv2, while it can work across a domain trust in some configurations, still generally depends on a domain or trusted account context that a plain workgroup server does not participate in for this kind of IPsec connection security scenario. Computer certificate authentication, by contrast, does not depend on Active Directory domain membership at all; it only requires that both computers, regardless of whether they are domain-joined or standalone workgroup members, trust a common certification authority and each hold an appropriate certificate issued by that authority. This makes computer certificate authentication the correct and supported method for securing an IPsec connection security rule between domain-joined member servers and workgroup servers, which is exactly the mixed-membership scenario described.