AZ-802 — Microsoft Certified: Windows Server Hybrid Administrator Associate Cheat Sheet

AZ-802 is not just “Windows Server in Azure.” It tests whether you can secure, migrate, protect, monitor, and troubleshoot Windows Server workloads across on-premises and hybrid environments. Expect scenario questions where the best answer depends on constraints such as downtime tolerance, identity model, data size, recovery objective, network connectivity, administrative scope, and whether the workload is physical, virtual, clustered, or cloud-connected.

Quick service-selection table

AD DS operations to recognize

Privileged access decision table

Fast security checks

Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled

Get-SmbServerConfiguration |
  Select-Object EnableSMB1Protocol,EncryptData,RejectUnencryptedAccess

auditpol /get /category:*

Get-LocalUser | Where-Object Enabled -eq $true

Get-LocalGroupMember Administrators

Identity and administrative access

AZ-802 security questions often reward least privilege and controlled administration over broad local admin access.

Active Directory Domain Services hardening

For hybrid Windows Server environments, AD DS is often the most important security dependency.

High-yield reminders:

• Domain controllers should be patched, monitored, backed up, and isolated from general workloads.
• Do not install unnecessary server roles or applications on domain controllers.
• Use separate administrative accounts for privileged administration.
• Protect privileged groups such as Domain Admins, Enterprise Admins, and Schema Admins.
• Audit authentication failures, privilege use, account changes, and directory changes.
• Confirm time synchronization; Kerberos depends on time.
• Use secure DNS configuration because AD DS depends heavily on DNS.
• Use read-only domain controllers where appropriate for locations with lower physical security.

Common trap: a question describes a branch office with poor physical security and asks how to provide local authentication. A read-only domain controller may be better than placing a writable domain controller there.

Server hardening decision rules

Certificates and PKI

Know the difference between certificate problems and identity problems.

Common trap: renewing a certificate does not automatically update every application binding. The service may still be using the old certificate.

Common hybrid connectivity traps

Common AZ-802 traps

Failover clustering quick checks

Cluster PowerShell snippets

Install-WindowsFeature Failover-Clustering -IncludeManagementTools

Test-Cluster -Node "SRV1","SRV2"

New-Cluster -Name "CL01" -Node "SRV1","SRV2" -StaticAddress "10.0.0.50"

Get-ClusterNode
Get-ClusterGroup
Get-ClusterQuorum

Cloud witness example pattern:

Set-ClusterQuorum -CloudWitness `
  -AccountName "<storage-account-name>" `
  -AccessKey "<storage-account-key>"

Failover clustering essentials

A failover cluster provides high availability for supported workloads by moving clustered roles between nodes.

Know these concepts:

Quorum and witness logic

Avoid memorizing only one witness type. Understand the scenario.

Trap: a witness does not host the workload. It helps the cluster make quorum decisions.

High availability versus disaster recovery

Common mistake: choosing failover clustering for site disaster recovery without considering shared dependencies. A cluster may still fail if the entire site, network, storage, or identity dependency is unavailable.

Storage Spaces Direct and Storage Replica

Trap: Storage Replica is not a backup. If malware encrypts replicated data, the encrypted data may replicate too.

Azure Backup components

Azure Site Recovery components

DR decision checklist

1. Define the workload dependency map: identity, DNS, database, file shares, certificates, IP dependencies.
2. Determine RPO/RTO from the scenario, then choose backup, replication, clustering, or ASR.
3. Verify network design: Azure VNets, subnets, DNS, routing, VPN/ExpressRoute, NSGs, firewalls.
4. Configure replication or backup policy.
5. Run test failover or test restore.
6. Document cutover order, validation steps, and rollback.
7. Monitor jobs, agent health, replication health, and recovery point availability.

Azure Backup

Azure Backup is for protected recovery points and restore operations.

Know the workflow:

1. Create or use a Recovery Services vault.
2. Configure backup policy.
3. Register/protect the workload.
4. Run initial backup.
5. Monitor jobs and alerts.
6. Test restore procedures.

Common traps:

• Backups must be restorable; a configured backup policy is not enough.
• System state backup is different from full application-aware workload protection.
• Backup helps with corruption, deletion, ransomware recovery, and point-in-time restore; replication alone may not.

Azure Site Recovery

Azure Site Recovery focuses on workload replication and orchestrated failover.

ASR decision clues:

• “Fail over workloads to Azure”
• “Orchestrate recovery”
• “Minimize downtime during site outage”
• “Run a test failover”
• “Replicate VMs”

Hyper-V Replica

Hyper-V Replica replicates VMs between Hyper-V hosts or clusters.

Use it when the scenario is specifically about Hyper-V-based replication and does not require broader Azure recovery orchestration.

Trap: Hyper-V Replica is not the same as failover clustering. Clustering handles high availability within the cluster; Replica handles VM replication for recovery.

Disaster recovery decision path

    flowchart TD
	    A[What is the protection goal?] --> B[Restore deleted/corrupt data]
	    A --> C[Keep workload running after host failure]
	    A --> D[Fail over to another site or Azure]
	    A --> E[Replicate storage volumes]
	
	    B --> F[Use backup and tested restores]
	    C --> G[Use failover clustering / HA design]
	    D --> H[Use Azure Site Recovery or Hyper-V Replica]
	    E --> I[Use Storage Replica where appropriate]

Storage Migration Service flow

Azure Migrate flow

Azure Migrate

Azure Migrate is commonly used to assess and migrate servers to Azure.

• Assessment and migration are not the same step.
• Dependency mapping matters for multi-tier applications.
• Sizing should reflect observed utilization, not just allocated resources.
• Network, identity, DNS, and firewall dependencies can break an otherwise successful server migration.
• Test migration reduces risk; it does not replace application validation.

Storage Migration Service

Storage Migration Service is high-yield for file server migrations.

Decision rule: if the scenario says “migrate file servers while preserving shares, permissions, and server identity,” think Storage Migration Service.

Trap: copying files manually may lose permissions, share configuration, timestamps, or client access continuity.

Azure File Sync

Azure File Sync synchronizes on-premises Windows Server file shares with Azure Files.

Common mistakes:

• Treating Azure File Sync as backup. It synchronizes changes, including unwanted changes.
• Forgetting that users may still access local file servers while data synchronizes with Azure Files.
• Ignoring bandwidth, initial sync time, and namespace design.

Migration choice table

KQL patterns to recognize

Table availability depends on the agent, DCR, workspace, and solution configuration.

Heartbeat
| where TimeGenerated > ago(1h)
| summarize LastHeartbeat=max(TimeGenerated) by Computer
| order by LastHeartbeat asc

Event
| where TimeGenerated > ago(24h)
| where EventLog == "System"
| where EventLevelName in ("Error", "Critical")
| summarize Count=count() by Computer, Source, EventID
| order by Count desc

Perf
| where TimeGenerated > ago(1h)
| where ObjectName == "LogicalDisk"
| where CounterName == "% Free Space"
| summarize LatestFreePercent=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName

Update
| where TimeGenerated > ago(7d)
| summarize Updates=count() by Computer, Classification

Alert design checklist

Command reference

## AD DS health
dcdiag /v
repadmin /replsummary
nltest /dsgetdc:contoso.com
w32tm /query /status
Test-ComputerSecureChannel

## Network tests
Test-NetConnection dc01.contoso.com -Port 53
Test-NetConnection server01.contoso.com -Port 5985
Resolve-DnsName _ldap._tcp.dc._msdcs.contoso.com

## Azure Arc agent
azcmagent show
azcmagent check
azcmagent logs

## Cluster checks
Get-ClusterNode
Get-ClusterGroup
Get-ClusterResource
Get-ClusterQuorum

## Backup / VSS checks
vssadmin list writers
wbadmin get status

Azure Monitor and Log Analytics

Azure Monitor collects and analyzes telemetry. Log Analytics is commonly used for querying collected logs.

KQL basics to recognize:

Trap: Log Analytics only shows data that has been collected and sent. If a server is not connected, configured, or authorized, queries will not magically return its logs.

Windows Server troubleshooting checklist

Use this order when a scenario gives symptoms but not the cause:

1. Scope — one user, one server, one subnet, one site, or all systems?
2. Recent change — patch, GPO, certificate, DNS, firewall, route, storage, identity?
3. Identity — authentication, authorization, Kerberos, SPN, time sync?
4. Name resolution — DNS records, suffixes, conditional forwarders, stale records?
5. Network path — firewall, routing, NSG if Azure, VPN/ExpressRoute, ports?
6. Service health — service status, event logs, dependencies?
7. Performance — CPU, memory, disk latency, queue length, network throughput?
8. Storage — free space, permissions, locks, replication status?
9. Cluster state — node status, quorum, role ownership, CSV health?
10. Logs and metrics — correlate time of failure with events.

Common symptom-to-cause map

Final review checklist

Before moving into original practice questions, make sure you can explain:

• When to use Azure Backup versus Azure Site Recovery.
• When to use failover clustering versus Hyper-V Replica.
• How quorum and witnesses affect cluster availability.
• Why Storage Replica is not backup.
• How Azure Arc changes hybrid server management.
• How Azure Monitor, Log Analytics, and agents fit together.
• How Storage Migration Service differs from Azure File Sync.
• How Azure Migrate assessment differs from migration execution.
• How to troubleshoot DNS, Kerberos, firewall, and certificate issues.
• How to apply least privilege to Windows Server administration.
• How to patch clustered workloads safely.
• How to read scenario clues around downtime, RPO/RTO, identity, and connectivity.

Decision rule: choose Azure Arc when the server remains on-premises or outside Azure but needs Azure-based management, governance, monitoring, or security visibility.

Trap: Azure Arc does not automatically convert a server into an Azure VM and does not eliminate the need for network connectivity, permissions, or agents.

Windows Admin Center

Windows Admin Center is useful for managing Windows Server roles, failover clusters, Hyper-V, updates, certificates, storage, and Azure integrations.

Exam clue: if the question asks for a practical management tool for on-premises Windows Server with optional Azure integrations, Windows Admin Center is often relevant.

Trap: “User cannot access a share” may be a permissions issue, a name resolution issue, a firewall issue, or a server availability issue. Do not jump directly to NTFS permissions without reading the symptom.

Hyper-V

Trap: checkpoints can create operational risk if left unmanaged, especially on production workloads.

Containers and application workloads

If containers appear, focus on the operational distinction:

Do not over-focus on developer details unless the scenario specifically asks about container hosting, isolation, or compatibility.