Microsoft Administering Windows Server Hybrid Core Infrastructure AZ-800 Exam Questions

Page: 1 / 14
Total 260 questions
Question 1

You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. You plan deploy 100 new Azure virtual machines that will run Windows Server. You need to ensure that each new virtual machine is joined to the AD DS domain. What should you use?



Answer : C


In Administering Windows Server Hybrid Core Infrastructure (AZ-800) guidance on deploying and managing Windows Server IaaS VMs, Microsoft emphasizes automating domain join during provisioning by using Azure VM extensions within an Azure Resource Manager (ARM) template. The supported method for joining Azure VMs to an on-premises AD DS domain is the JsonADDomainExtension (Microsoft.Compute/virtualMachines/extensions). In the ARM template, you provide parameters such as the AD DS domain name, OUPath (optional), User (a domain account with join rights), Password (as a secure parameter), Restart (true/false), and Options. When the VM is created, the extension executes on first boot and performs the classic AD DS domain join, ensuring every newly deployed VM is joined consistently and at scale.

By contrast, Azure AD Connect (A) only synchronizes identities between AD DS and Azure AD; it does not join Windows Server computers to AD DS. A GPO (B) can configure domain-joined computers after they are in the domain, but it cannot join non-domain systems. Azure management groups (D) provide governance and hierarchy for subscriptions and policies, not machine domain-join operations. Therefore, to ensure that 100 newly deployed Windows Server VMs are automatically joined to the on-premises AD DS domain during deployment, the verified and supported approach is to use an ARM template with the JsonADDomainExtension.

Question 2

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1.

On Server 1, you install Windows Admin Center and use Windows Admin Center to remove BUILTlN\Users from the allowed groups.

Vou discover that all users can still sign in to Windows Admin Center.

Vou need to prevent unauthorized users from signing in to Windows Admin Center.

What should you do in Windows Admin Center?



Answer : D

In Windows Admin Center (WAC), ''gateway access'' is controlled by the Allowed groups list on the gateway. The AZ-800 materials explain that membership in the local Administrators group on the WAC gateway still permits sign-in unless you explicitly scope access to specific groups in the Allowed groups list. The guidance further states that to restrict who can sign in to the WAC gateway, you must populate Allowed groups with one or more security groups (for example, a domain group) and remove broad principals (like BUILTIN\Users). Until you add at least one explicit group, existing administrators can continue to authenticate, which is why ''everyone'' appears able to sign in after only removing BUILTIN\Users. By adding a dedicated security group to Allowed groups, only members of that group can authenticate to the gateway UI; non-members are denied. Settings such as Performance profile or Require manage-as sessions to re-authenticate affect performance and remote management prompts, not gateway sign-in. Proxy bypass lists control outbound connectivity, not access control. Therefore, to prevent unauthorized sign-ins, configure Allowed groups with a specific security group and manage membership there.


Question 3

You have an Active Directory Domain Services (AD DS) domain that contains the domain controllers shown in the following table.

The domain contains an app named App1 that uses a custom application partition to store configuration data.

You decommission App1.

When you attempt to remove the custom application partition, the process fails.

Which domain controller is unavailable?



Answer : C

In the Windows Server hybrid administrator objectives for AD DS, application directory partitions (also called ''naming contexts'') are forest-wide objects whose creation and deletion are controlled by the Domain Naming Master FSMO. The AZ-800 materials explain that operations which ''add or remove naming contexts in the forest'' must be performed on, or reachable by, the DC that holds the Domain Naming Master; if that role holder is unavailable, the operation fails until connectivity is restored or the role is transferred/seized. Because your custom application partition belongs to the forest schema of naming contexts, removing it requires contacting the Domain Naming Master. From the table, DC3 holds the Domain naming master role. Therefore, a failed attempt to delete the partition indicates the Domain Naming Master is not available, which points to DC3 being unavailable.


Question 4

You have a Windows Server container host named Server! that has a single disk. On Server1, you plan to start the containers shown in the following table.

Which isolation mode can you use for each container? To answer, select the appropriate options in the answer are

a. NOTE: Each correct selection is worth one point.

Your network contains an Active Directory Domains Services (AD DS) domain named contoso.com. You implement a central store.

You create a new Group Policy Object (GPO) named GP01.

When you attempt to edit GP01, you see the settings shown in the exhibit. (Click the Exhibit tab.) You need to ensure that all settings are available.

Solution: You delete the \\contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions folder. Does this meet the goal?



Answer : B


Question 5

You have on-premises Windows devices.

You have an Azure subscription that contains a virtual network named VNet1.

You need to create a Site-to-Site (S2S) VPN between the on-premises network and VNet1.

Which three resources should you create? Each correct answer present part of the solution.

NOTE; Each correct selection is worth one point.



Answer : D, E, F


Question 6

You have on-premises servers that run Windows Server as shown in the following table.

You have an Azure subscription that contains a virtual machine named VMV

You need to ensure that you can manage all the servers by using Azure Arc. The solution must minimize administrative effort.

On which servers should you install the Azure Connected Machine agent?



Answer : E

Azure Arc--enabled servers use the Azure Connected Machine agent to onboard non-Azure machines (on-premises or other clouds) so they appear in Azure for inventory, policy, Update Management, Defender, etc. The AZ-800 study guide emphasizes: ''Install the Connected Machine agent on Windows or Linux servers that are outside of Azure. Native Azure VMs are already Azure resources and can be managed without Arc; onboarding Azure VMs to Arc is optional and not required for basic management.'' In the scenario, Server1 (a physical on-premises server) and VM2 (a Hyper-V VM on-premises) are non-Azure; both require the Connected Machine agent to be projected into Azure via Arc. VM1 is already an Azure VM and can be managed through Azure natively (Azure VM resource model, extensions, policies) without installing the Arc agent. Because the requirement is to manage all servers via Azure Arc while minimizing administrative effort, you install the agent only where it's needed---on Server1 and VM2. This provides Arc governance and management for on-prem systems without redundant configuration on the Azure VM.


Question 7

You haw? a server named Host1 that has the Hyper-V server role installed. Host! hosts a virtual machine named VM1.

You have a management server named Server! that runs Windows Server. You remotely manage Host1 from Server1 by using Hyper-V Manager.

You need to ensure that you can access a USB hard drive connected to Server1 when you connect to VM1 by using Virtual Machine Connection.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.



Answer : A, D

In Hyper-V, access to local devices such as a USB hard drive connected to the management computer (Server1) from within a VM session (VM1) is provided only when using Enhanced Session Mode through the Virtual Machine Connection (vmconnect) client. The AZ-800/''Administering Windows Server Hybrid Core Infrastructure'' materials emphasize that Enhanced Session Mode ''enables redirection of local resources (audio, clipboard, printers, drives, and supported Plug and Play devices) to a guest when connecting with Virtual Machine Connection.'' To use it, you must first enable it on the host and then select the device in vmconnect before establishing the session.

Accordingly, you should:

Enable Enhanced Session on the host: In Hyper-V Manager Host1 Hyper-V Settings Enhanced Session Mode Policy, select Allow enhanced session mode (and optionally Use enhanced session mode under User settings). This satisfies option A.

Choose the USB drive in the vmconnect UI: When launching the connection to VM1, click Show Options Local Resources More..., and select Drives or the specific USB device so it is redirected into the guest. This matches option D.

Options B and E relate to host Disk Management operations and do not provide guest redirection of a USB attached to Server1. Option C (''switch to a basic session'') explicitly disables the RDP-based redirection channel that Enhanced Session Mode relies upon, preventing USB/drive passthrough. Therefore, the correct pair is A and D.


Page:    1 / 14   
Total 260 questions