AZ-802 · Domain 3 of 7

AZ-802 Domain 3: Manage virtual machines

Running Windows Server workloads as virtual machines: Hyper-V host and guest configuration from memory to GPU partitioning, checkpoints, virtual switches and Replica, plus storage, sizing, availability, JIT access, Bastion and networking for Azure VMs.

Exam weight
10–15%
Official functional groups
2
Estimated questions estimate
~6
Suggested study time estimate
8–10 hrs

About 11 min read Reviewed October 2026

Overview

Domain 3 covers virtual machines on two platforms. The Hyper-V functional group is long and detailed: Enhanced Session Mode, managing guests with PowerShell, PowerShell Direct and SSH Direct for Linux, nested virtualization, memory settings, integration services, device assignment, GPU partitioning, checkpoints, high availability, virtual hard disks, network adapters, NIC teaming, virtual switches and Hyper-V Replica.

The second group moves to Windows Server VMs in Azure. It covers managed disks and storage, capacity changes through resizing and Virtual Machine Scale Sets, availability sets and availability zones, just-in-time VM access and Azure Bastion for secure administration, and VM network configuration. Questions often hinge on a single prerequisite, such as a VM being off, a generation type, or a feature that works only on a specific switch type, so precise facts matter more here than broad concepts.

How it's tested

Questions describe a host, a guest and a goal, such as running containers inside a VM, giving a VM direct GPU access or surviving a data center failure. You choose the setting, cmdlet or Azure feature that works, and you check prerequisites such as VM state, generation, switch type or region support.

  • Spot the prerequisite

    A Hyper-V feature fails to enable, and you identify the missing condition such as a powered-off VM, static memory or a specific generation.

  • Match the availability target

    An uptime or fault-domain requirement is given, and you choose an availability set, zone, scale set or Hyper-V Replica.

  • Secure admin access

    Administrators need RDP to Azure VMs without public exposure, and you choose JIT access, Azure Bastion or both.

Reasoning it through

A developer needs Hyper-V containers inside a Windows Server VM. Nested virtualization is required, so the VM must be shut down, then Set-VMProcessor with ExposeVirtualizationExtensions set to true is run on the host. Dynamic memory should be disabled for the VM, and the virtual network adapter needs MAC address spoofing enabled so nested guests can reach the network. Enabling only the processor setting would leave nested guests without connectivity.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

3.1 Manage Hyper-V and guest VMHost and guest configuration, checkpoints, availability, disks, networking and Replica.
What it means
This group covers Enhanced Session Mode, managing VMs remotely with PowerShell, PowerShell Direct and SSH Direct for Linux guests, nested virtualization, memory settings, integration services, Discrete Device Assignment, GPU partitioning, checkpoints, high availability for VMs, virtual hard disks, virtual network adapters, NIC teaming on host and guest, Hyper-V virtual switches and Hyper-V Replica.
What to understand
PowerShell Direct uses VMBus, so it needs only host access and guest credentials, not network connectivity. Dynamic memory sets startup, minimum and maximum RAM and memory buffer. Production checkpoints use VSS for application-consistent state, while standard checkpoints capture memory too. VHDX supports up to 64 TB and resilience against power loss. External, internal and private switches differ in reach. Switch Embedded Teaming is the recommended host teaming method for Hyper-V. Discrete Device Assignment passes a whole PCIe device to one VM, while GPU partitioning shares a GPU across VMs. Hyper-V Replica sends changes asynchronously to another host and needs a Replica Broker for clustered hosts.
How it shows up
Expect questions about which setting enables a feature, which switch or disk type to use, and how Replica and checkpoints differ from backups.
Common confusion
Treating checkpoints as backups; they depend on the parent disk and should not replace a backup solution.
3.2 Manage Windows Server VMs in AzureAzure disks, resizing, scale sets, availability, JIT, Bastion and VM networking.
What it means
This group covers managed disk types and data disks, caching, disk expansion, resizing VMs and using Virtual Machine Scale Sets, placing VMs in availability sets or availability zones, protecting management ports with just-in-time access from Defender for Cloud and Azure Bastion, and configuring network interfaces, IP addresses and network security groups for Azure VMs.
What to understand
Premium SSD v2, Premium SSD, Standard SSD and Standard HDD trade cost for performance. Resizing may require deallocation if the target size is not available on the current hardware cluster. Scale sets add or remove identical instances based on rules or schedules. Availability sets spread VMs across fault and update domains in one data center, giving 99.95% SLA, while zones spread VMs across separate data centers in a region for 99.99%. JIT opens NSG rules for a short, approved window on request. Azure Bastion provides browser-based RDP and SSH through a dedicated AzureBastionSubnet without public IPs on VMs.
How it shows up
Expect scenarios that ask for the highest SLA, the cheapest suitable disk, or a way to remove public RDP exposure.
Common confusion
Assuming availability sets protect against a full data center outage; only availability zones span separate data centers.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • PowerShell Direct

    Runs commands in a guest from the Hyper-V host over VMBus.

    Remember
    No network or firewall rules needed.
    Tested as
    Remote guest management questions.
    Trap
    Expecting it to work from a remote client.

  • Nested virtualization

    Running Hyper-V inside a VM.

    Remember
    VM off, ExposeVirtualizationExtensions true, MAC spoofing on.
    Tested as
    Lab and container questions.
    Trap
    Leaving dynamic memory enabled.

  • Dynamic memory

    Hyper-V adjusts guest RAM between minimum and maximum.

    Remember
    Startup RAM must be available at boot.
    Tested as
    Memory sizing questions.
    Trap
    Combining it with features that need static memory.

  • Production checkpoint

    Application-consistent checkpoint using VSS in the guest.

    Remember
    Default type on current Hyper-V.
    Tested as
    Checkpoint questions.
    Trap
    Expecting memory state to be saved.

  • Discrete Device Assignment

    Passes an entire PCIe device to one VM.

    Remember
    Device is unavailable to the host and other VMs.
    Tested as
    GPU and NVMe passthrough questions.
    Trap
    Confusing it with GPU partitioning.

  • GPU partitioning

    Shares one physical GPU among several VMs.

    Remember
    Requires supported GPUs and drivers.
    Tested as
    AI and VDI workload questions.
    Trap
    Assuming live migration is unsupported in all cases.

  • Switch Embedded Teaming

    NIC teaming built into the Hyper-V virtual switch.

    Remember
    Preferred over LBFO teams for Hyper-V hosts.
    Tested as
    Host networking questions.
    Trap
    Building an LBFO team then binding a switch.

  • Hyper-V Replica

    Asynchronous VM replication to another host or site.

    Remember
    Replica Broker for clusters; extended replication supported.
    Tested as
    Disaster recovery questions.
    Trap
    Calling it a high-availability feature with zero data loss.

  • Availability zone

    Physically separate data center within an Azure region.

    Remember
    99.99% SLA for VMs across two or more zones.
    Tested as
    Resilience questions.
    Trap
    Assuming every region has zones.

  • Availability set

    Groups VMs across fault and update domains.

    Remember
    99.95% SLA, single data center.
    Tested as
    Legacy resilience questions.
    Trap
    Adding an existing VM to a set after creation.

  • Just-in-time VM access

    Defender for Cloud feature that opens management ports on request.

    Remember
    Requires Defender for Servers Plan 2.
    Tested as
    Attack surface questions.
    Trap
    Expecting it without Defender plans.

  • Azure Bastion

    Managed RDP and SSH through the portal or native client.

    Remember
    Needs AzureBastionSubnet /26 or larger.
    Tested as
    Secure access questions.
    Trap
    Assigning public IPs to VMs anyway.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Hyper-V virtual switch types

ConceptMeaningKey differenceCommon trap
External Bound to a physical NIC VMs reach the physical network Expecting isolation
Internal Host and VMs only No physical network access Assuming VMs reach the internet
Private VMs only, no host Fully isolated lab segment Trying to reach the host

Device access for VMs

ConceptMeaningKey differenceCommon trap
Discrete Device Assignment Whole device for one VM Near-native performance Sharing it between VMs
GPU partitioning Slices of one GPU for several VMs Higher density Expecting full GPU performance per VM

Azure VM resilience

ConceptMeaningKey differenceCommon trap
Availability set Fault and update domains in one data center 99.95% SLA Expecting protection from site loss
Availability zones VMs in separate data centers 99.99% SLA Assuming all regions support zones
Virtual Machine Scale Sets Identical instances that scale automatically Elastic capacity Treating it as only an availability feature

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Checkpoint as backup

    What candidates pick
    Keep weekly checkpoints as the recovery plan.
    Why it looks right
    They restore a VM quickly.
    Why it's wrong
    Checkpoints chain to the parent disk, grow over time and are lost if the storage fails.

    Clue to watch for The requirement is long-term recovery or retention.

  2. Network-based guest access

    What candidates pick
    Use Enter-PSSession to fix a guest with broken networking.
    Why it looks right
    Remoting is the usual tool.
    Why it's wrong
    PowerShell Direct over VMBus works without guest networking, which remoting needs.

    Clue to watch for The guest has no network connectivity.

  3. Set for site failure

    What candidates pick
    Place VMs in an availability set to survive a data center outage.
    Why it looks right
    Sets are a well-known resilience option.
    Why it's wrong
    Sets stay in one data center; zones protect against the loss of a facility.

    Clue to watch for Words like data center or facility failure.

  4. DDA for many VMs

    What candidates pick
    Use Discrete Device Assignment to share a GPU among four VMs.
    Why it looks right
    It gives the best GPU performance.
    Why it's wrong
    DDA gives the device to a single VM; GPU partitioning shares it.

    Clue to watch for Several VMs need GPU acceleration from one card.

  5. Public RDP with NSG

    What candidates pick
    Add an NSG rule allowing RDP from any source.
    Why it looks right
    It is fast to configure.
    Why it's wrong
    Permanent open ports invite brute force; JIT opens time-limited rules, and Bastion removes public exposure.

    Clue to watch for Minimize attack surface or no public IP.

  6. Replica as zero-loss HA

    What candidates pick
    Use Hyper-V Replica for zero-data-loss failover.
    Why it looks right
    It keeps a copy on another host.
    Why it's wrong
    Replica is asynchronous with a replication interval, so recent changes can be lost; failover clustering provides HA.

    Clue to watch for Requirements state no data loss or automatic failover.

Answer framework

Use this order when a question asks you to configure or protect a virtual machine.

  1. Identify the platform: Hyper-V host, Hyper-V cluster or Azure, since features, limits and tooling differ sharply between the on-premises and cloud platforms.
  2. Check VM prerequisites such as state, generation, memory type, switch type and guest operating system before picking a setting.
  3. Choose the feature that matches the goal: performance, device access, connectivity, recovery or administrative access to the guest.
  4. Match resilience to the requirement, choosing clustering or zones for availability and Replica or backup for disaster recovery.
  5. Confirm secure access, using PowerShell Direct on hosts and JIT or Azure Bastion for Azure VMs instead of leaving RDP open to the internet around the clock.

Practice question

A company runs Windows Server VMs in one Azure region. The application must remain available if an entire data center fails, and administrators must connect over RDP without any VM having a public IP address. Which combination should you use?

Want more like this? The AZ-802 practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Practice on a Hyper-V host with at least two guests. Enable Enhanced Session Mode, use PowerShell Direct with Invoke-Command -VMName, and switch memory between static and dynamic to see what the settings page allows. Turn on nested virtualization and install Hyper-V in a guest. Create production and standard checkpoints and apply them. Build each virtual switch type and test which VMs can reach each other. If you have a second host, configure Hyper-V Replica and run a test failover.

For Azure, create two Windows Server VMs in availability zones and one in an availability set, then compare their properties. Resize a VM and note when it needs to stop. Deploy Azure Bastion, remove public IPs, and connect through the portal. Enable Defender for Servers Plan 2 for a short trial and request JIT access to watch the NSG rule appear and expire. Summarize every prerequisite in a one-page table, because most wrong answers in this domain come from a missed requirement.

FAQ

What portion of AZ-802 does Domain 3, Manage virtual machines, cover?

Manage virtual machines is weighted at 10–15%, roughly five to eight questions. Note that the study guide outline heading reads Manage VMs while the summary list says Manage virtual machines.

Is Hyper-V more important than Azure VMs in this domain?

The Hyper-V group lists fourteen objectives against five for Azure VMs, so expect more Hyper-V detail. Azure questions tend to focus on availability, disks and secure access.

Do I need hardware with GPU support to study GPU partitioning?

Not necessarily. Learn the requirements and PowerShell cmdlets, such as Add-VMGpuPartitionAdapter, and the difference from DDA. Hands-on practice is useful but not essential.

Is Hyper-V Replica the same as Azure Site Recovery?

No. Hyper-V Replica copies VMs between Hyper-V hosts. Azure Site Recovery can replicate Hyper-V VMs to Azure and orchestrate failover, but it is a separate Azure service.

What does SSH Direct do?

SSH Direct lets you connect from the Hyper-V host to a Linux guest over the VM bus with hvc, without guest network configuration, similar to PowerShell Direct for Windows guests.

Which Azure disk type should I know best?

Know the trade-offs between Premium SSD v2, Premium SSD, Standard SSD and Standard HDD, plus host caching settings and when to use data disks rather than the OS disk.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

Check your Hyper-V and Azure VM knowledge, from nested virtualization and Replica to availability zones and Bastion, with AZ-802 practice questions.

Take the AZ-802 practice test Check your AZ-802 readiness

Keep going