AZ-802 · Domain 4 of 7

AZ-802 Domain 4: Implement and manage an on-premises and hybrid networking infrastructure

Name resolution and IP addressing for Windows Server networks: AD-integrated DNS zones and records, forwarders and conditional forwarders, hybrid resolution with Azure, DNS policies and DNSSEC, plus DHCP scopes, reservations, failover and troubleshooting.

Exam weight
10–15%
Official functional groups
2
Estimated questions estimate
~6
Suggested study time estimate
7–9 hrs

About 11 min read Reviewed October 2026

Overview

Domain 4 focuses on two core network services that Windows Server still provides in most organizations. The name resolution group covers integrating DNS with AD DS, creating and managing zones and resource records, configuring forwarders and conditional forwarders, resolving names between on-premises and Azure, applying DNS policies, and signing zones with DNSSEC.

The IP addressing group covers installing and authorizing the DHCP Server role, creating scopes, setting options and reservations, implementing DHCP high availability, and troubleshooting addressing problems that span on-premises networks and Azure. The domain does not test Azure networking in depth; Azure appears where Windows DNS servers must resolve private Azure zones or where Azure VMs need predictable addresses, since Azure VNets assign IPs themselves rather than through Windows DHCP.

How it's tested

Name resolution questions describe clients that cannot resolve a partner domain, an Azure private zone or an internal name, and ask which zone, forwarder or policy fixes it. DHCP questions describe a site, a failure or a device that needs a fixed address and ask for the scope, option, reservation or failover mode.

  • Route the query

    Clients must resolve a name owned elsewhere, and you choose a forwarder, conditional forwarder, stub zone or secondary zone.

  • Answer differently by client

    Different subnets or times need different answers, and you design DNS policies with client subnets and zone scopes.

  • Keep addresses available

    A DHCP server or site may fail, and you choose load balance or hot standby failover and set the correct partner settings.

Reasoning it through

On-premises clients must resolve privatelink.file.core.windows.net records hosted in an Azure Private DNS zone. Azure Private DNS zones answer only queries from linked VNets. Deploying an Azure DNS Private Resolver inbound endpoint in a linked VNet gives on-premises DNS servers a private IP to forward to. A conditional forwarder for file.core.windows.net on the Windows DNS servers, pointing at that inbound endpoint, completes the path.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

4.1 Implement on-premises and hybrid name resolutionAD-integrated DNS, zones and records, forwarding, hybrid resolution, policies and DNSSEC.
What it means
This group covers integrating DNS with AD DS, creating primary, secondary, stub and reverse lookup zones, managing A, AAAA, CNAME, MX, SRV and PTR records, configuring forwarders and conditional forwarders, resolving names between on-premises networks and Azure, creating DNS policies for traffic management and filtering, and signing zones with DNSSEC.
What to understand
AD-integrated zones store data in AD DS partitions, replicate with the directory and support secure dynamic updates. Replication scope can be all DNS servers in the forest, all in the domain, or a custom partition. Forwarders send all unresolved queries to one upstream, while conditional forwarders target a specific namespace. Stub zones hold only NS, SOA and glue records and update automatically. DNS policies use criteria such as client subnet, time of day and query type, with zone scopes to return different answers. DNSSEC signs zones with a key signing key and zone signing key, and clients validate using trust anchors and the Name Resolution Policy Table.
How it shows up
Expect questions that ask which zone or forwarding method resolves a partner or Azure namespace, and how to return location-based answers.
Common confusion
Confusing stub zones with secondary zones; a secondary holds a full copy, while a stub holds only the records needed to find authoritative servers.
4.2 Manage IP addressing in on-premises and hybrid scenariosDHCP role, scopes, reservations, failover and hybrid addressing troubleshooting.
What it means
This group covers installing the DHCP Server role and authorizing it in AD DS, creating scopes, superscopes and options, adding exclusions and reservations, configuring DHCP failover for high availability, and troubleshooting IP addressing problems such as overlapping ranges, relay issues and address conflicts across on-premises and Azure networks.
What to understand
A domain-joined DHCP server must be authorized in AD DS before it leases addresses. Options can be set at server, scope or reservation level, with the most specific winning. Reservations bind an address to a MAC address or client ID. Clients on remote subnets need a DHCP relay agent or IP helper. DHCP failover pairs two servers per scope: load balance splits leases by percentage, while hot standby keeps a partner on standby with a reserved address percentage and uses maximum client lead time. Azure VMs get addresses from the VNet, so Windows DHCP does not serve them, and overlapping on-premises and Azure ranges break routing.
How it shows up
Expect scenarios about a new DHCP server that issues no leases, a branch needing failover, or a device needing a fixed address.
Common confusion
Thinking Windows DHCP can lease addresses to Azure VMs; Azure assigns VM addresses from subnet configuration.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • AD-integrated zone

    DNS zone stored in AD DS and replicated with the directory.

    Remember
    Supports secure dynamic updates.
    Tested as
    Zone design questions.
    Trap
    Expecting zone transfers to replicate it.

  • Conditional forwarder

    Sends queries for one namespace to specific DNS servers.

    Remember
    Can be stored in AD DS and replicated.
    Tested as
    Partner and hybrid resolution questions.
    Trap
    Using a global forwarder for one domain.

  • Stub zone

    Holds only NS, SOA and glue records for another zone.

    Remember
    Updates its server list automatically.
    Tested as
    Delegation questions.
    Trap
    Treating it as a full copy.

  • Azure DNS Private Resolver

    Managed resolver with inbound and outbound endpoints in a VNet.

    Remember
    Inbound endpoint is the target for on-premises forwarders.
    Tested as
    Hybrid DNS questions.
    Trap
    Forwarding to 168.63.129.16 from on-premises.

  • DNS policy

    Rules that change DNS answers based on criteria.

    Remember
    Uses client subnets and zone scopes.
    Tested as
    Geo-location and split-brain questions.
    Trap
    Creating separate zones instead of scopes.

  • DNSSEC

    Digital signatures that let resolvers validate DNS answers.

    Remember
    KSK, ZSK, DNSKEY, RRSIG and DS records.
    Tested as
    Spoofing protection questions.
    Trap
    Assuming it encrypts queries.

  • Name Resolution Policy Table

    Client policy that requires DNSSEC validation for namespaces.

    Remember
    Distributed by Group Policy.
    Tested as
    Client validation questions.
    Trap
    Signing the zone but not enforcing validation.

  • DHCP authorization

    Registering a DHCP server in AD DS.

    Remember
    Unauthorized domain servers do not lease.
    Tested as
    New server questions.
    Trap
    Troubleshooting scopes before authorization.

  • DHCP reservation

    Fixed IP for a specific MAC or client ID.

    Remember
    Options can be set per reservation.
    Tested as
    Printer and appliance questions.
    Trap
    Using an exclusion when a reservation is needed.

  • DHCP failover load balance

    Two partners share leasing by percentage.

    Remember
    Default 50/50 split.
    Tested as
    Same-site HA questions.
    Trap
    Choosing it for a central backup server.

  • DHCP failover hot standby

    Primary leases while standby takes over after failure.

    Remember
    Reserve percentage and MCLT apply.
    Tested as
    Branch backup questions.
    Trap
    Expecting both servers to lease normally.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Ways to resolve another namespace

ConceptMeaningKey differenceCommon trap
Forwarder Sends all unresolved queries upstream Server-wide Using it for one specific domain
Conditional forwarder Sends queries for one namespace to named servers Static IP list Forgetting to update IPs when servers change
Stub zone Keeps authoritative server list for a zone Updates automatically Expecting it to answer every record
Secondary zone Read-only full copy via zone transfer Needs transfer permission Choosing it when only routing is needed

DHCP failover modes

ConceptMeaningKey differenceCommon trap
Load balance Both servers lease from the scope Active-active split Using it across a slow WAN
Hot standby One active, one waiting partner Reserve percentage for standby Expecting even load sharing

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Wire server from on-premises

    What candidates pick
    Configure on-premises DNS to forward to 168.63.129.16.
    Why it looks right
    It is the Azure DNS address.
    Why it's wrong
    That virtual IP answers only from inside Azure; an Azure DNS Private Resolver inbound endpoint is the reachable target.

    Clue to watch for Clients are on-premises over VPN or ExpressRoute.

  2. Secondary for partners

    What candidates pick
    Create a secondary zone for a partner domain.
    Why it looks right
    It gives full local answers.
    Why it's wrong
    It needs zone transfer rights and replicates all records; a conditional forwarder or stub zone is lighter.

    Clue to watch for The partner will not allow zone transfers.

  3. DNSSEC means encryption

    What candidates pick
    Enable DNSSEC to keep queries private.
    Why it looks right
    It sounds like a security feature for traffic.
    Why it's wrong
    DNSSEC provides integrity and origin authentication, not confidentiality.

    Clue to watch for The requirement says prevent spoofed answers.

  4. Unauthorized DHCP

    What candidates pick
    Recreate the scope when a new server gives no leases.
    Why it looks right
    Scope issues are common.
    Why it's wrong
    Domain-joined DHCP servers do not lease until authorized in AD DS.

    Clue to watch for A newly installed server in a domain.

  5. Exclusion instead of reservation

    What candidates pick
    Exclude the printer address from the scope.
    Why it looks right
    It stops other clients getting the address.
    Why it's wrong
    An exclusion does not assign it to the printer; a reservation does and can carry options.

    Clue to watch for The device should keep using DHCP with a fixed address.

Answer framework

Apply these steps to name resolution and IP addressing questions on AZ-802.

  1. Identify who owns the name or address range: AD DS, a partner, Azure Private DNS, Azure VNet configuration or a Windows DHCP server, because ownership decides where configuration must change.
  2. Choose the zone type and replication scope, preferring AD-integrated zones with secure dynamic updates for domain names.
  3. Route foreign namespaces with conditional forwarders or stub zones, using a Private Resolver inbound endpoint for Azure private zones.
  4. Add DNS policies for subnet or time-based answers and DNSSEC with client validation where answers must be trusted.
  5. For DHCP confirm authorization, scope options, reservations and relay, then choose load balance or hot standby failover based on whether partners share a site.

Practice question

Your on-premises Windows Server DNS servers must resolve names in an Azure Private DNS zone linked to a hub VNet. The sites connect through a site-to-site VPN. You must avoid deploying DNS server VMs in Azure. What should you configure?

Want more like this? The AZ-802 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Use a lab with two DNS servers that are also domain controllers. Create an AD-integrated zone, a reverse zone and a stub zone for a second lab forest, then add a conditional forwarder and compare how each responds with Resolve-DnsName. Create a DNS policy with Add-DnsServerClientSubnet and Add-DnsServerZoneScope so one subnet gets a different answer. Sign a test zone with DNSSEC and check the RRSIG records.

For Azure, deploy a small VNet with a Private DNS zone and an Azure DNS Private Resolver, then forward to its inbound endpoint from your lab over a VPN if you have one. If not, study the design until you can draw it from memory. Finish with DHCP: install the role, authorize it, build a scope with exclusions and a reservation, add a second server and configure failover in both modes. Record each command, since the exam often names cmdlets such as Add-DhcpServerv4Failover in answer options.

FAQ

How heavily is Domain 4, on-premises and hybrid networking infrastructure, weighted on AZ-802?

Implement and manage an on-premises and hybrid networking infrastructure is weighted at 10–15%, around five to eight questions. Microsoft does not publish exact per-domain counts.

Does this domain cover Azure virtual networking?

Only where it touches Windows Server. Expect hybrid DNS resolution with Azure and addressing issues between on-premises and Azure, not VNet peering or Azure Firewall design.

Is IPAM on the exam?

IP Address Management is not named in the current AZ-802 outline. Focus on DHCP scopes, reservations, failover and hybrid troubleshooting instead.

Which DNS record types should I know?

Know A, AAAA, CNAME, MX, NS, SOA, SRV and PTR. SRV records matter because domain controllers are located with them, and PTR records support reverse lookups.

What is the difference between DNSSEC and DNS over HTTPS?

DNSSEC signs records so resolvers can check that answers are authentic. DNS over HTTPS encrypts the query in transit. AZ-802 lists DNSSEC, not DoH, as an objective.

How many servers can share a DHCP failover relationship?

A failover relationship has exactly two partner servers. One server can join several relationships with different partners, each covering its own scopes.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

See whether you can choose the right zone, forwarder, DNS policy and DHCP failover mode with AZ-802 practice questions on networking infrastructure.

Take the AZ-802 practice test Check your AZ-802 readiness

Keep going