Best Value Available! 2026 Realistic Verified Free AZ-800 Exam Questions
Pass Your Exam Easily! AZ-800 Real Question Answers Updated
Microsoft AZ-800 (Administering Windows Server Hybrid Core Infrastructure) Certification Exam is designed for IT professionals who specialize in managing and administering hybrid environments that use Windows Server and cloud services from Microsoft Azure. Administering Windows Server Hybrid Core Infrastructure certification exam measures the skills and knowledge required to manage and secure Windows Server workloads in a hybrid environment, including deploying and configuring Azure services, monitoring and troubleshooting hybrid environments, and implementing disaster recovery solutions.
NEW QUESTION # 135
Your company has offices in Boston and Montreal. The offices are connected by using a 10-Mbps WAN link that is often saturated The office in Boston contains the following:
* An Active Directory Domain Services (AD DS) domain controller named DC1.
* A server named Server1 that runs Windows Server and has the File Server role installed The office in Montreal contains 20 client computers that run Windows 10 Montreal does NOT have any servers.
The company plans to deploy a new line of business (LOB) application to all the client computers. The installation source files for the application are in \\Server\Apps.
Answer:
Explanation:
NEW QUESTION # 136
Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. A two-way forest trust exists between the forests. Each forest contains a single domain. The domains contain the servers shown in the following table.
You need to configure resources based constrained delegation so that the users In contoso.com can use Windows Admin Center on Server) to connect to Server? How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Text Description automatically generated
Reference:
https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview
https://docs.microsoft.com/en-us/powershell/module/activedirectory/set-adcomputer?view=windowsserver2022-
NEW QUESTION # 137
You have a server named Server1 that runs Windows Server and has the Hyper-V server role installed. Server1 contains a virtual machine named VM1 that runs Windows Server.
You need to install the Hyper-V server role on VM1.
Which PowerShell command should you run first? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 138
Your network contains two VLANs for client computers and one VLAN for a datacenter Each VLAN is assigned an IPv4 subnet Currently, all the client computers use static IP addresses.
You plan to deploy a DHCP server to the VLAN in the datacenter.
You need to use the DHCP server to provide IP configurations to all the client computers.
What is the minimum number of scopes and DHCP relays you should create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: 3
You need a DHCP scope for each of the three subnets.
Box 2: 2
The two client VLANs need a DHCP Relay Agent to forward DHCP requests to the DHCP server. The datacenter VLAN that contains the DHCP server does not require a DHCP Relay Agent.
NEW QUESTION # 139
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The root domain contains the domain controllers shown in the following table.
A failure of which domain controller will prevent you from creating application partitions?
- A. DC2
- B. DC4
- C. DC3
- D. DC5
- E. DC1
Answer: E
Explanation:
Reference:
https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/fsmo-roles
NEW QUESTION # 140
You have an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.
You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least privilege.
To which group should you add the administrator?
- A. AAD DC Administrators
- B. Enterprise Admins
- C. Group Policy Creator Owners
- D. Domain Admins
- E. Schema Admins
Answer: A
Explanation:
The Azure Active Directory Domain Services (Azure AD DS) section of the AZ-800 materials clarifies the administrative model in a managed domain: "Azure AD DS does not expose Enterprise Admins or Schema Admins. Instead, members of the AAD DC Administrators group are granted delegated privileges to manage the managed domain, including DNS and Group Policy." It explicitly notes: "To create, edit, and link Group Policy Objects in an Azure AD DS managed domain, the user must be a member of the AAD DC Administrators group." While Group Policy Creator Owners is used in traditional AD to allow GPO creation, in Azure AD DS least-privilege administration for GPOs is delegated through AAD DC Administrators. The built-in Domain Admins, Enterprise Admins, and Schema Admins roles are not applicable/available in the Azure AD DS managed domain context. Therefore, to follow the principle of least privilege and enable GPO management in Azure AD DS, add the administrator to AAD DC Administrators.
NEW QUESTION # 141
Task 12
You need to create a Group Policy Object (GPO) named GPO1 that only applies to a group named MemberServers.
Answer:
Explanation:
See the solution of this Task below.
Explanation:
To create a GPO named GPO1 that only applies to a group named MemberServers, you can follow these steps:
* On a domain controller or a computer that has the Remote Server Administration Tools (RSAT) installed, open Group Policy Management from the Administrative Tools menu or by typing gpmc.msc in the Run box.
* In the left pane, expand your domain and right-click on Group Policy Objects. Select New to create a new GPO.
* In the New GPO dialog box, enter GPO1 as the Name of the new GPO and click OK. You can also optionally select a source GPO to copy the settings from.
* Right-click on the new GPO and select Edit to open the Group Policy Management Editor. Here, you can configure the settings that you want to apply to the group under the Computer Configuration and User Configuration nodes. For more information on how to edit a GPO, see Edit a Group Policy Object.
* Close the Group Policy Management Editor and return to the Group Policy Management console.
Right-click on the new GPO and select Scope. Here, you can specify the scope of management for the GPO, such as the links, security filtering, and WMI filtering.
* Under the Security Filtering section, click on Authenticated Users and then click on Remove. This will remove the default permission granted to all authenticated users and computers to apply the GPO.
* Click on Add and then type the name of the group that you want to apply the GPO to, such as MemberServers. Click OK to add the group to the security filter. You can also click on Advanced to browse the list of groups available in the domain.
* Optionally, you can also configure the WMI Filtering section to further filter the GPO based on the Windows Management Instrumentation (WMI) queries. For more information on how to use WMI filtering, see Filter the scope of a GPO by using WMI filters.
* To link the GPO to an organizational unit (OU) or a domain, right-click on the OU or the domain in the left pane and select Link an Existing GPO. Select the GPO that you created, such as GPO1, and click OK. You can also change the order of preference by using the Move Up and Move Down buttons.
* Wait for the changes to replicate to other domain controllers. You can also force the update of the GPO by using the gpupdate /force command on the domain controller or the client computers. For more
* information on how to update a GPO, see Update a Group Policy Object.
Now, you have created a GPO named GPO1 that only applies to a group named MemberServers. You can verify the GPO application by using the gpresult /r command on a member server and checking the Applied Group Policy Objects entry. You can also use the Group Policy Results wizard in the Group Policy Management console to generate a report of the GPO application for a specific computer or user. For more information on how to use the Group Policy Results wizard, see Use the Group Policy Results Wizard.
NEW QUESTION # 142
Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com The domain contains a server named Server1 and the users shown In the following table.
Server1 contains a folder named D:\Folder1. The advanced security settings for Folder 1 are configured as shown in the Permissions exhibit. (Click the Permissions lab.)
Folder1 is shared by using the following configurations
Answer:
Explanation:
NEW QUESTION # 143
You have an Azure subscription that contains a virtual machine named VM1 as shown in the following exhibit.
The subscription has the disks shown in the following table.
Which disks can you attach as data disks to VM1?
- A. Disk4 only
- B. Disk1 and Disk2 only
- C. Disk2 and Disk4 only
- D. Disk2 only
- E. Disk1, Disk3, and Disk4 only
- F. Disk1, Disk2, Disk3. and Disk4
Answer: B
NEW QUESTION # 144
You need to sync files from an on-premises server named Server1 to Azure by using Azure File Sync You have a cloud tiering policy that is configured for 30 percent free space and 70 days.
Volume f on Server1 is 500 GB.
A year ago. you configured E:\Oata on Server1 to sync by using Azure File Sync. The files that are visible in E:\Data are shown in the following table.
Volume E does NOT contain any other files.
Where are File1 and flle3 located? To answer, select the appropriate options In the answer area.
Answer:
Explanation:
NEW QUESTION # 145
You have an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with Azure AD by using Azure AD Connect.
You enable password protection for contoso.com.
You need to prevent users from including the word Contoso as part of their password.
What should you use?
- A. Synchronization Service Manager
- B. the Azure Active Directory admin center
- C. Windows Admin Center
- D. Active Directory Users and Computers
Answer: B
Explanation:
In the Administering Windows Server Hybrid Core Infrastructure material, the section on Configure and manage Azure AD Password Protection states that Azure AD Password Protection "uses a global and custom banned password list to prevent weak or easily guessed passwords." Administration is performed in Azure AD: "The custom banned password list is created and maintained in the Azure AD portal and applies to both cloud users and on-premises domains when the proxy and DC agents are deployed." The guidance further notes that the feature is case-insensitive and blocks substrings: "Words on the custom list are evaluated in all variants and as part of longer strings." Operationally, you configure this at Security # Authentication methods # Password protection (Azure AD admin center). From there you add entries such as "contoso" to the Custom banned password list, and set enforcement/audit. The same module clarifies what you don't use: "Active Directory Users and Computers does not manage Azure AD Password Protection policy," and tools like Synchronization Service Manager or Windows Admin Center are unrelated to defining the password policy.
Therefore, to prevent users from including Contoso in their passwords in a hybrid (Azure AD Connect) environment, you must configure the custom banned password list in the Azure Active Directory admin center.
NEW QUESTION # 146
You have an Azure subscription that contains a virtual network named VNet1. Vnet1 contains three subnets named Subnet1, Subnet2, and Subnet3. You deploy a virtual machine that has the following settings:
* Name:VM1
* Subnet: Subnet2
* Network interface name: NIC1
* Operating system: Windows Server 2022
You need to ensure that VM1 can route traffic between Subnet1 and Subnet3. The solution must minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 147
Your network contains an Azure AD Domain Services domain named contoso.com.
You need to configure a password policy for the local user accounts on the Azure virtual machines joined to contoso.com.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 148
You have four testing devices that are configured with static IP addresses as shown in the following table.
The test devices are turned on once a month.
You need to prevent Server1 from assigning the IP addresses allocated to the test devices to other devices when the test devices are offline. The solution must minimize administrative effort.
What should you do?
- A. Create an exclusion range.
- B. Create reservations.
- C. Create a policy.
- D. Configure the Scope options.
Answer: B
NEW QUESTION # 149
SIMULATION
You need to enable nested virtualization for a virtual machine named VM1 on SRV1.
To complete this task, sign in the required computer or computers.
Answer:
Explanation:
Configure Nested Virtualization
Step 1: While the virtual machine is in the OFF state, run the following command on the physical Hyper-V host, in this case on SRV1. This enables nested virtualization for the virtual machine.
Step 2: Set-VMProcessor -VMName <VMName> -ExposeVirtualizationExtensions $true In our case: Set-VMProcessor -VMName VM1 -ExposeVirtualizationExtensions $true Step 3: Start the virtual machine.
Install Hyper-V within the virtual machine, just like you would for a physical server.
Enable the Hyper-V role through Settings
Step 4: Right click on the Windows button and select 'Apps and Features'.
Step 5: Select Programs and Features on the right under related settings.
Step 6: Select Turn Windows Features on or off.
Step 7: Select Hyper-V and click OK.
When the installation has completed you are prompted to restart your computer.
Reference:
https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/user-guide/nested- virtualization
https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v
NEW QUESTION # 150
Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com. The domain contains a server named Server1 and the users shown in the following table.
Server1 contains a folder named D:\Folder1. The advanced security settings for Folder1 are configured as shown in the Permissions exhibit. (Click the Permissions tab.)
Folder1 is shared by using the following configurations:
The share permissions for Share1 are shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
The course content for Administering Windows Server Hybrid Core Infrastructure explains the effective permission model for SMB shares: "Access to a shared folder is the most restrictive result of the Share permissions and the NTFS permissions. Share permissions control access over the network, while NTFS permissions control access to the file system itself. The effective permission is the intersection-users must have permission in both places." It also clarifies typical rights: "Read includes viewing and opening; Change
/Modify includes creating, changing, and deleting; Full Control adds the ability to change permissions and take ownership." Applying this: User1 is in Group1. Share1 grants Group1 = Change, and NTFS on D:\Folder1 grants Group1 = Read. The intersection is Read, so User1 can read files. User3 is in Group3. Share1 grants Group3 = Full Control, but NTFS has no entry for Group3 (and no broader Allow that would include it).
Without NTFS Modify/Delete, User3 cannot delete.
Regarding visibility, the share was created with FolderEnumerationMode = Unrestricted. The training states: "With Unrestricted enumeration, the share (and items) are not hidden based on access; users may see the share even if they lack permissions, though access will be denied when opened. Access-Based enumeration hides items from users without permission." Therefore, when User2 (member of Group2) browses \\Server1, Share1 will be listed, though opening it would rely on permissions.
NEW QUESTION # 151
You have an Azure Active Directory Domain Services (Azure AD DS) domain.
You create a new user named Admin1.
You need Admin1 to deploy custom Group Policy settings to all the computers in the domain. The solution must use the principle of least privilege.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point
Answer:
Explanation:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy
NEW QUESTION # 152
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are planning the deployment of DNS to a new network.
You have three internal DNS servers as shown in the following table.
The contoso.local zone contains zone delegations for east.contoso.local and west.contoso.local. All the DNS servers use root hints.
You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.
Solution: You configure Server2 and Server3 to forward DNS requests to 10.0.1.10.
Does this meet the goal?
- A. No
- B. Yes
Answer: A
NEW QUESTION # 153
Which groups can you add to Group3 and Group5? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
In Windows Server AD DS, group scope determines which groups/accounts can be members. The AZ-800 study materials summarize: "Domain Local groups can include accounts, Global groups, and Universal groups from any domain and Domain Local groups from the same domain only. Global groups can include accounts and other Global groups from the same domain only. Universal groups can include *accounts, Global groups, and Universal groups from any domain." In addition, distribution vs. security does not change the scope membership rules; it only affects whether the group can be assigned permissions.
Applying the rules: Group3 is a Domain Local security group in contoso.com. Therefore it can contain Universal (Group1), Global from any domain (Group2 in contoso.com and Group4/Group5 in canada.
contoso.com), but cannot contain a Domain Local from another domain (Group6 in canada.contoso.com).
Hence: Group1, Group2, Group4, and Group5 only.
Group5 is a Global distribution group in canada.contoso.com. A Global group can only contain accounts or Global groups from the same domain. From the list, only Group4 (Global distribution, canada.contoso.
com) fits. It cannot contain Group1 (Universal), Group2 (Global but different domain), or Group6 (Domain Local). Therefore: Group4 only.
NEW QUESTION # 154
Which groups can you add to Group3 and Group5? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
Table Description automatically generated
Reference:
https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-g
NEW QUESTION # 155
......
Exam Content
The next point for you to know is the exam content. The AZ-800 test consists of five topics in which you should be proficient. The first topic is the most extensive one and is dedicated to deploying and managing AD DS in on-premises and cloud environments. In this domain, you should have a good understanding of how to deploy and operate AD DS domain controllers, work in multi-domain, multi-forest, and multi-site environments, apply hybrid identities. In addition, your skills to create and operate AD DS security principals, manage Windows Server will be assessed as well.
The second topic refers to managing Windows Server and workloads in a hybrid environment. This implies that you are competent in dealing with Windows Server in a hybrid environment and Azure services to operate Windows Servers and workloads. Thus, you can demonstrate your skills to configure CredSSP, PowerShell Remoting, JEA, operate updates for Windows machines, manage Windows Servers, integrate Windows Servers with Azure Security Center or Log Analytics.
The third domain focuses on managing virtual machines and containers. The aim of this domain is to measure your abilities in working with VM memory, VM Resource Groups, VM CPU Groups, VM Checkpoints, Integration Services, NIC teaming, and Hyper-V switch. This subject area also includes the ability to create and operate containers, and operate Azure Virtual Machines based on Windows Server.
The fourth domain aims to check your skills in applying and operating an on-premises and hybrid networking infrastructure. In this domain you are expected competency in utilizing on-premises and hybrid name resolution, operating IP addressing in hybrid and on-premises scenarios, applying on-premises and hybrid network connectivity. Thus, you should possess top-notch skills to apply DNSSEC, integrate DNS with AD DS, configure DNS forwarding, operate IPAM, create IP reservations, apply Azure Network Adapter, Web App Proxy, Azure Replay.
The fifth topic refers to managing storage and file services. This part evaluates your skills in operating Azure File Sync, operating Windows Server files shares, and Windows Server storage. To deal with the questions from this domain, you need to be able to create Azure File Sync service, monitor File Sync, create cloud endpoints, BranchCache, apply DFS, configure volumes, disks, and Data Deduplication.
Actual Questions Answers Pass With Real AZ-800 Exam Dumps: https://www.actual4test.com/AZ-800_examcollection.html
AZ-800 Dumps Prepare Your Exam With 262 Questions: https://drive.google.com/open?id=1qEhFPOSXGQzH7Kzm1Sbc42rcZA7FgWCr