Microsoft Microsoft Certifications AZ-800 Questions & Answers

• Question 1:

  HOTSPOT

  Your company has offices in Boston and Montreal. The offices are connected by using a 10-Mbps WAN link that is often saturated.

  The office in Boston contains the following:

  1.

  An Active Directory Domain Services (AD DS) domain controller named DC1

  2.

  A server named Server1 that runs Windows Server and has the File Server role installed

  The office in Montreal contains 20 client computers that run Windows 10. Montreal does NOT have any servers.

  The company plans to deploy a new line-of-business (LOB) application to all the client computers. The installation source files for the application are in \\Server1\Apps.

  You need to make the installation source files available to the client computers in the Montreal office by using the minimum amount of WAN bandwidth possible.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 2:

  HOTSPOT

  You plan to deploy an Azure virtual machine that will run Windows Server. The virtual machine will host an Active Directory Domain Services (AD DS) domain controller and a drive named F: on a new virtual disk.

  You need to configure storage for the virtual machine. The solution must meet the following requirements:

  1.

  Maximize resiliency for AD DS.

  2.

  Prevent accidental data loss.

  How should you configure the storage? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: F

  Create a separate virtual data disk for storing the database, logs, and sysvol folder for Active Directory. Do not store these items on the same disk as the operating system.

  Box 2: None

  By default, data disks that are attached to a VM use write-through caching. However, this form of caching can conflict with the requirements of AD DS. For this reason, set the Host Cache Preference setting on the data disk to None.

  Reference:

  https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-extend-domain

• Question 3:

  HOTSPOT

  You have a server named Server1 that runs Windows Server. Server1 has a just-a-bunch-of-disks (JBOD) enclosure attached.

  You plan to create a storage pool on Server1 and a virtual disk that will use a mirror layout.

  You are considering whether to use a two-way or a three-way mirror layout.

  What is the minimum number of disks required for each type of mirror layout? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 4:

  DRAG DROP

  You have a server named Server 1 that runs Windows Server and has the Hyper-V server role installed.

  Server1 hosts a virtual machine named VM1. Server1 has an NV Me storage device that is assigned to VM1 by using Discrete Device Assignment.

  You need to make the device available to the host.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

• Question 5:

  DRAG DROP

  Which three actions should you perform in sequence to meet the security requirements for Webapp1?

  To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview

• Question 6:

  DRAG DROP You need to meet the security requirements for passwords. Where should you configure the components for Azure AD Password Protection? To answer, drag the appropriate components to the correct locations. Each component may be used once, more than once, or not at all. You may need to drag

  the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises

• Question 7:

  DRAG DROP

  DC1 fails.

  You need to meet the technical requirements for the schema master.

  You run ntdsutil.exe.

  Which five commands should you run in sequence? To answer, move the appropriate commands from the list of commands to the answer area and arrange them in the correct order?

  Select and Place:

  

  Correct Answer:

  

  Step 1: roles

  A. Datum identifies the following technical requirements: DC2 must become the schema master if DC1 fails.

  To seize or transfer the Operation Master roles by using the Ntdsutil utility, follow these steps:

  1.

  Sign in to a member computer that has the AD RSAT tools installed, or a DC that is located in the forest where Operation Master roles are being transferred.

  2.

  Select Start > Run, type ntdsutil in the Open box, and then select OK.

  3.

  Type roles, and then press Enter.

  Step 2: connect

  4.

  Type connections, and then press Enter.

  Step 3: connect to server dc2.adatumcom

  5.

  Type connect to server , and then press Enter.

  Note: In this command, is the name of the DC that you want to assign the Operation Master role to.

  Step 4: quit

  6.

  At the server connections prompt, type q, and then press Enter.

  Step 5: seize schema master

  7.

  Do one of the following actions:

  To transfer the role: Type transfer , and then press Enter.

  Note

  In this command, is the role that you want to transfer. To seize the role: Type seize , and then press Enter. Note

  In this command, is the role that you want to seize.

  8. At the fsmo maintenance prompt, type q, and then press Enter to gain access to the ntdsutil prompt. Type q, and then press Enter to quit the Ntdsutil utility.

  Reference: https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/transfer-or-seize-operation-master-roles-in-ad-ds

• Question 8:

  HOTSPOT

  Your network contains an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.

  You need to configure a password policy for the local user accounts on the Azure virtual machines joined to contoso.com.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: AAD DC Administrators group

  To create a custom password policy in a managed domain, you must be signed in to a user account that's a member of the AAD DC Administrators group.

  Box 2: AADDC Users organizational unit (OU)

  Password policies can only be applied to groups. In the Locations dialog, expand the domain name, such as aaddscontoso.com, then select an OU, such as AADDC Users. If you have a custom OU that contains a group of users you wish to

  apply, select that OU.

  Reference: https://learn.microsoft.com/en-us/azure/active-directory-domain-services/password-policy

• Question 9:

  HOTSPOT

  Your on-premises network contains an Active Directory domain named contoso.com and 500 servers that run Windows Server. All the servers are Azure Arc-enabled and joined to contoso.com.

  You need to implement PowerShell Desired State Configuration (DSC) on all the servers. The solution must minimize administrative effort.

  Where should you store the DSC scripts, and what should you use to apply DSC to the servers? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: An Azure Automation account

  Azure Automation allows you to automate tasks against resources in Azure, on-premises, and with other cloud providers such as Amazon Web Services (AWS).

  When you start Azure Automation for the first time, you must create at least one Automation account.

  Azure Automation State Configuration

  Prerequisites include: An Azure Automation account

  Azure Automation State Configuration is an Azure configuration management service that allows you to write, manage, and compile PowerShell Desired State Configuration (DSC) configurations for nodes in any cloud or on-premises

  datacenter.

  Box 2: Guest configuration in Azure policy

  Note: Before you enable Automation State Configuration, we would like you to know that a newer version of DSC is now generally available, managed by a feature of Azure Policy named guest configuration. The guest configuration service

  combines features of DSC Extension, Azure Automation State Configuration, and the most commonly requested features from customer feedback. Guest configuration also includes hybrid machine support through Arc-enabled servers.

  Reference:

  https://learn.microsoft.com/en-us/azure/automation/automation-security-overview

  https://learn.microsoft.com/en-us/azure/automation/automation-dsc-overview

• Question 10:

  HOTSPOT

  You plan to deploy an Azure virtual machine that will run Windows Server.

  You need to ensure that an Azure Active Directory (Azure AD) user named [email protected] can connect to the virtual machine by using the Azure Serial Console.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  https://docs.microsoft.com/en-us/troubleshoot/azure/virtual-machines/serial-console-overview

  "Boot diagnostics must be enabled for the VM"

  "The Azure account accessing Serial Console must have Virtual Machine Contributor role for both the VM and the boot diagnostics storage account"