Try Update Microsoft AZ-800 Sample Questions and Answers

1. You have an Azure subscription that contains the following resources:

• An Azure Log Analytics workspace

• An Azure Automation account

• Azure Arc.

You have an on-premises server named Server1 that is onboaraed to Azure Arc

You need to manage Microsoft updates on Server! by using Azure Arc

Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point

2. What should you implement for the deployment of DC3?

3. You haw? a server named Host! that has the Hyper-V server role installed. Host! hosts a virtual machine named VM1.

You have a management server named Server! that runs Windows Server. You remotely manage Host1 from Server1 by using Hyper-V Manager.

You need to ensure that you can access a USB hard drive connected to Server1 when you connect to VM1 by using Virtual Machine Connection.

Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

4. HOTSPOT

You have an on-premises server named Server1 that runs Windows Server and has internet connectivity.

You have an Azure subscription.

You need to monitor Server1 by using Azure Monitor.

Which resources should you create in the subscription, and what should you install on Server1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

5. DRAG DROP

You have a server named Server1 that runs Windows Server and has the Hyper V server role installed. Server1 hosts a virtual machine named VM1.

Server1 has an NVMe storage device. The device is currently assigned to VM1 by using Discrete Device Assignment.

You need to make the device available to Server1.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

6. Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain controllers.

You plan to store a DNS zone in a custom Active Directory partition.

You need to create the Active Directory partition for the zone. The partition must replicate to only four of the domain controllers.

What should you use?

7. You need to configure the Group Policy settings to ensure that the Azure Virtual Desktop session hosts meet the security requirements.

What should you configure?

8. Topic 2, Fabrikam inc.



This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.



To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more Information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.



At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.



To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements, if the case study has an All Information tab. note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.



Overview

Fabrikam, Inc. Is a manufacturing company that has a main office In New York and a branch office in Seattle.



On-premises Servers

The on-premises network contains servers that run Windows Server as shown in the following table.





DC1 hosts all the operation master roles.

WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.



On-premises Network

The New York and Seattle offices are connected by using redundant WAN links.

The client computers in each office get IP addresses from their local DHCP server.

DHCP! contains a scope named Scope1 that has addresses for the New York office.

DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.



Group Policy Object (GPOs)

The cwp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.







Requirements:

Fabrikam Identifies the following planned changes:

• Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.

• Replace the WAN links between the Seattle and New York offices by using Azure Virtual

WAN and ExpressRoute. Both on-premises offices will be connected to Vnet1 by using ExpressRoute.

• Create three Azure file shares named newyorkfiles, seattfefiles, and companyfiles.

• Create a domain controller named dc3.corp.fabrikam,com in Vnet1.

• Deploy an Azure Virtual Desktop host pool lo Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD joined.

• License all servers for Microsoft Defender for servers.

• Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.



Networking Requirements

Fabrikam identifies the following security requirements:

• Apply GP04 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout lime manually from their client computer.

• Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours.

• Prevent user passwords from containing all or part of words that are based on the company name, such as Fab. fabrikam or fsbr! |.

• Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days.

• Prevent domain controllers from directly contacting hosts on the internet.



File Sharing Requirements

You need to configure the synchronization of Azure files to meet the following requirements:

• Ensure that seattlefiles syncs to FS2.

• Ensure that newyorkfiles syncs to FS1.

• Ensure that companyfiles syncs to both FS1 and FS2.



DRAG DROP

You need to meet the security requirements for passwords.

Where should you configure the components for Azure AD Password Protection? lo answer, drag the appropriate components to the correct locations. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE Each correct selection is worth one point.

9. HOTSPOT

Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. A two-way forest trust exists between the forests. Each forest contains a single domain.

The domains contain the servers shown in the following table.





You need to configure resources based constrained delegation so that the users In contoso.com can use Windows Admin Center on Server) to connect to Server? How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

10. You need to implement a name resolution solution that meets the networking requirements.

Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point

11. HOTSPOT

You have a Group Policy Object (GPO) named GPO1 that contains user settings only.

You plan to apply GPO1 to a global security group named Group1.

You link GP01 to the domain, and you remove all the permissions granted to the Authenticated Users group.

You need to configure permissions for GP01 to meet the following requirements.

• GPO1 must apply only to the users in Group 1.

• The solution must use the principle of least privilege

12. You have an on premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. The domain contains two servers named Server1 and Server2.

A user named Admin1 is a member of the local Administrators group on Server1 and Server2.

You plan to manage Server1 and Server2 by using Azure Arc. Azure Arc objects will be added to a resource group named RG1.

You need to ensure that Admin1 can configure Server1 and Server2 to be managed by using Azure Arc.

What should you do first?

13. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.

You need to identify which server is the PDC emulator for the domain.

Solution: From Active Directory Domains and Trusts, you right-click Active Directory Domains and Trusts in the console tree, and then select Operations Master.

Does this meet the goal?

14. You have an Azure virtual machine named VM1 that runs Windows Server.

You have an Azure subscription that has Microsoft Defender for Cloud enabled.

You need to ensure that you can use the Azure Policy guest configuration feature to manage VM1.

What should you do?

15. HOTSPOT

You plan to deploy an Azure virtual machine that will run Windows Server.

You need to ensure that an Azure Active Directory (Azure AD) user [email protected] can connect 10 the virtual machine by using the Azure Serial Console.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

16. HOTSPOT

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

17. You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant Group writeback is enabled in Azure AD Connect.

The AD DS domain contains a server named Server1 Server 1 contains a shared folder named share1.

You have an Azure Storage account named storage2 that uses Azure AD-based access control. The storage2 account contains a share named shared

You need to create a security group that meets the following requirements:

• Can contain users from the AD DS domain

• Can be used to authorize user access to share 1 and share2

What should you do?

18. You need to meet the technical requirements for User1. The solution must use the principle of least privilege.

What should you do?

19. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are planning the deployment of DNS to a new network.

You have three internal DNS servers as shown in the following table.





The contoso.local zone contains zone delegations for east.conloso.local and west.contoso.local. All the DNS servers use root hints.

You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.

Solution: On Server2 and Server3, you configure a conditional forwarder for contoso.local.

Does this meet the goal?

20. Your network contains a Active Directory Domain Service (AD DS) forest named contoso.com. The forest root domain contains a server named server1. contoso.com.

A two-way forest trust exists between the contoso.com forest and an AD DS forest named fabrikam.com. The fabrikam.com forest contains 10 child domains.

You need to ensure that only the members of a group named fabrikamGroup1 can authenticate to server1.contoso.com.

What should you do first?

21. Your network contains an Active Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain controllers.

You plan to store a DNS zone in a custom active Directory partition.

You need to create the Active Directory partition for the zone. The partition replicate to only four of the domain controllers.

What should you use?

22. Your network contains a single-domain Active Directory Domain Services (AD DS) forest named conto.com.

The forest contains the servers shown in the following exhibit table.





You plan to install a line-of-business (LOB) application on Server1. The application will install a custom windows services.

A new corporate security policy states that all custom Windows services must run under the context of a group managed service account (gMSA). You deploy a root key.

You need to create, configure, and install the gMSA that will be used by the new application.

Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

23. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK.

You open a new branch office that contains only client computers.

You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.

Solution: You create an organization unit (OU) that contains the client computers in the branch office. You configure the Try Next Closest Site Group Policy Object (GPO) setting in a GPO that is linked to the new OU.

Does this meet the goal?

24. DRAG DROP

You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.

You deploy five servers to the domain. You add the servers to a group named iTFarmHosts.

You plan to configure a Network Load Balancing (NIB) cluster named NLBCluster.contoso.com that will contain the five servers.

You need to ensure that the NLB service on the nodes of the cluster can use a group managed service account (gMSA) to authenticate.

Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdiets from the list of cmdlets to the answer area and arrange them in the correct order.

25. You need to configure remote administration to meet the security requirements.

What should you use?

26. HOTSPOT

You need to meet the technical requirements for VM1.

Which cmdlet should you run first? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

27. DRAG DROP

Which three actions should you perform in sequence to meet the security requirements for Webapp1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

28. HOTSPOT

You have a Windows Server container host named Server1 and an Azure subscription.

You deploy an Azure container registry named Registry1 to the subscription.

On Server1, you create a container image named image1.

You need to store imager in Registry1.

Which command should you run on Server1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.