Microsoft Microsoft Certifications AZ-800 Questions & Answers

• Question 101:

  DRAG DROP

  Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. Contoso.com contains three child domains named amer.contoso.com, apac.contoso.com, and emea.contoso.com.

  Fabrikam.com contains a child domain named apac.fabrikam.com. A bidirectional forest trust exists between contoso.com and fabrikam.com.

  You need to provide users in the contoso.com forest with access to the resources in the fabrikam.com forest. The solution must meet the following requirements:

  1.

  Users in contoso.com must only be added directly to groups in the contoso.com forest.

  2.

  Permissions to access the resources in fabrikam.com must only be granted directly to groups in the fabrikam.com forest.

  3.

  The number of groups must be minimized.

  Which type of groups should you use to organize the users and to assign permissions? To answer, drag the appropriate group types to the correct requirements. Each group type may be used once, more than once, or not at all. You may

  need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 102:

  DRAG DROP

  Your network contains an Active Directory domain named contoso.com. The domain contains group managed service accounts (gMSAs).

  You have a server named Server1 that runs Windows Server and is in a workgroup. Server! hosts Windows containers.

  You need to ensure that the Windows containers can authenticate to contoso.com.

  Which three actions should you perform in sequence?

  To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: In contoso.com, generate a Key Distribution Services (KDS) Root Key

  One-time preparation of Active Directory.

  If you have not already created a gMSA in your domain, you'll need to generate the Key Distribution Service (KDS) root key. The KDS is responsible for creating, rotating, and releasing the gMSA password to authorized hosts. When a

  container host needs to use the gMSA to run a container, it will contact the KDS to retrieve the current password.

  Step 2: On Server, run New-CredentialSpec

  Create a credential spec.

  A credential spec file is a JSON document that contains metadata about the gMSA account(s) you want a container to use. By keeping the identity configuration separate from the container image, you can change which gMSA the container

  uses by simply swapping the credential spec file, no code changes are necessary.

  Run the following cmdlet to create the new credential spec file:

  # Replace 'WebApp01' with your own gMSA

  New-CredentialSpec -AccountName WebApp01

  By default, the cmdlet will create a credential spec using the provided gMSA name as the computer account for the container. The file will be saved in the Docker CredentialSpecs directory using the gMSA domain and account name for the

  filename.

  Step 3: On Server1, install and run ccg.exe.

  View the diagram below to follow the steps of the Container Credential Guard process:

  1.

  Using a CredSpec file as input, the ccg.exe process is started on the node host.

  2.

  ccg.exe uses information in the CredSpec file to launch a plug-in and then retrieve the account credentials in the secret store associated with the plug-in.

  3.

  ccg.exe uses the retrieved account credentials to retrieve the gMSA password from AD.

  4.

  ccg.exe makes the gMSA password available to a container that has requested credentials.

  5.

  The container authenticates to the domain controller using the gMSA password to get a Kerberos Ticket-Granting Ticket (TGT).

  6.

  Applications running as Network Service or Local System in the container can now authenticate and access domain resources, such as the gMSA.

  

  Incorrect:

  * In contoso.com, create a gMSA and a standard user account.

  Note: gMSA architecture and improvements

  To address the limitations of the initial implementation of gMSA for Windows containers, new gMSA support for non-domain-joined container hosts uses a portable user identity instead of a host computer account to retrieve gMSA credentials.

  Therefore, manually joining Windows worker nodes to a domain is no longer necessary, although it's still supported. The user identity/credentials are stored in a secret store accessible to the container host (for example, as a Kubernetes

  secret) where authenticated users can retrieve it.

  

  gMSA support for non-domain-joined container hosts provides the flexibility of creating containers with gMSA without joining the host node to the domain. Starting in Windows Server 2019, ccg.exe is supported which enables a plug-in mechanism to retrieve gMSA credentials from Active Directory. You can use that identity to start the container.

  Reference: https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts

• Question 103:

  DRAG DROP

  You create an Azure virtual machine named Server1 that runs Windows Server.

  Server1 has the disk configurations shown in the following exhibit.

  

  You need to create a new 100-GB volume on Server1.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Create and attach a new data disk Add a data disk.

  1.

  Sign in to the Azure portal.

  2.

  Search for and select Virtual machines.

  3.

  Select a virtual machine from the list.

  4.

  On the Virtual machine pane, select Disks.

  5.

  On the Disks pane, select Create and attach a new disk.

  6.

  In the drop-downs for the new disk, make the selections you want, and name the disk.

  7.

  Select Save to create and attach the new data disk to the VM.

  Step 2: Initialize the disk Initialize a new data disk.

  1.

  Connect to the VM.

  2.

  Select the Windows Start menu inside the running VM and enter diskmgmt.msc in the search box. The Disk Management console opens.

  3.

  Disk Management recognizes that you have a new, uninitialized disk and the Initialize Disk window appears.

  4.

  Verify the new disk is selected and then select OK to initialize it.

  5.

  The new disk appears as unallocated. Right-click anywhere on the disk and select New simple volume. The New Simple Volume Wizard window opens.

  6.

  Etc.

  Step 3: Create a new simple volume

  Reference: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/attach-managed-disk-portal

• Question 104:

  DRAG DROP

  You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. VM1 contains a 128-GB operating system disk.

  You need to increase the size of volume C on VM1 to 250 GB.

  Which four actions should you perform in sequence?

  To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  How to expand virtual hard disks attached to a Windows virtual machine

  You may need to expand the OS disk if you're supporting a legacy application that installs components on the OS disk or if you're migrating a physical PC or VM from on-premises that has a larger OS disk.

  Step 1: Stop VM1.

  Resize a managed disk by using PowerShell

  1.

  Stop the VM before resizing the disk:

  Stop-AzVM -ResourceGroupName $rgName -Name $vmName

  Step 2: Resize the operating system disk.

  2.

  Obtain a reference to the managed OS disk. Set the size of the managed OS disk to the desired value and update the Disk:

  $disk= Get-AzDisk -ResourceGroupName $rgName -DiskName $diskName $disk.DiskSizeGB = 1023 Update-AzDisk -ResourceGroupName $rgName -Disk $disk -DiskName $disk.Name

  Step 3: Start VM1.

  3. Updating the VM might take a few seconds. When the command finishes executing, restart the VM:

  Start-AzVM -ResourceGroupName $rgName -Name $vmName

  Step 4: Resize Volume C.

  Expand the volume in the operating system

  When you've expanded the disk for the VM, you need to go into the OS and expand the volume to encompass the new space.

  Reference: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/expand-os-disk

• Question 105:

  DRAG DROP

  Your network contains an Active Directory domain, a web app named App1, and a perimeter network. The perimeter network contains a server named Server1 that runs Windows Server.

  You plan to provide external access to App1.

  You need to implement the Web Application Proxy role service on Server1.

  Which role should you add to Server1, and which role should you add to the network? To answer, drag the appropriate roles to the correct targets. Each role may be used once, more than once, or not at all. You may need to drag the split bar

  between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Remote Access

  Web Application Proxy is a new Remote Access role service in Windows Server 2012 R2.

  To install the Web Application Proxy role service (see step 4 below).

  1.

  On the edge server, open Server Manager. To do this, click Server Manager on the Start screen, or Server Manager in the taskbar on the desktop.

  2.

  In the Quick Start tab of the Welcome tile on the Dashboard page, click Add roles and features. Alternatively, you can click Add Roles and Features on the Manage menu.

  3.

  In the Add Roles and Features Wizard, click Next three times to get to the server role selection screen.

  4.

  On the Select server roles dialog, select Remote Access, and then click Next.

  5.

  Click Next twice.

  6.

  On the Select role services dialog, select Web Application Proxy, click Add Features, and then click Next.

  7.

  On the Confirm installation selections dialog, click Install.

  8.

  On the Installation progress dialog, verify that the installation was successful, and then click Close.

  Box 2: Active Directory Federation Services Web Application Proxy preauthenticates access to web applications using Active Directory Federation Services (AD FS), and also functions as an AD FS proxy. Using Active Directory Federation Services

  This scenario describes the additions and changes that you must make to your AD FS servers to provide the following functionality:

  Application publishing For all applications and services that you want to publish through Web Application Proxy, you must configure a relying party on the AD FS server.

  Authentication No specific configuration is required to provide authentication for published applications.

  Incorrect:

  *

  Active Directory Certificate Services

  *

  Network Policy and Access Services

  Reference: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn280943(v=ws.11)

• Question 106:

  DRAG DROP

  You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.

  You deploy a server to the domain and configure the server to run a service.

  You need to ensure that the service can use a group managed service account (gMSA) to authenticate.

  Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

• Question 107:

  DRAG DROP

  Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site.

  You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1.

  You need to recommend a deployment plan that meets the following requirements:

  1.

  Ensures that a user named User1 can perform the RODC installation on Server1

  2.

  Ensures that Server1 is in a new site named RemoteSite1

  3.

  Uses the principle of least privilege

  Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Pre-create an RODC account.

  You can deploy RODC using the Staged feature. It consists of pre-creating the RODC computer account in the ADUC console and basic setup.

  Step 2: Create a site and a subnet

  Step 3: Instruct User1 to run the Active Directory Domain Services installation Wizard on Server1.

  The Domain Controller Options page also enables you to choose the appropriate Active Directory logical site name from the forest configuration. By default, it selects the site with the most correct subnet. If there is only one site, it selects that

  site automatically.

  Important:

  If the server does not belong to an Active Directory subnet and there is more than one Active Directory site, nothing is selected and the Next button is unavailable until you choose a site from the list.

  Incorrect:

  * Add User1 to the Contoso\Administrators group.

  This is against the principle of least privilege.

  Reference:

  https://woshub.com/deploying-read-domain-controller-windows-server-2016/

  https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/rodc/install-a-windows-server-2012-active-directory-read-only-domain-controller--rodc---level-200

• Question 108:

  DRAG DROP

  You have two on-premises servers named Server1 and Server2 that run Windows Server.

  You have an Azure Storage account named storage1 that contains a file share named share1. Server1 syncs with share1 by using Azure File Sync.

  You need to configure Server2 to sync with share1.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-server-registration https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-server-endpoint-create?tabs=azure-portal

• Question 109:

  DRAG DROP

  You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.

  You deploy five servers to the domain. You add the servers to a group named ITFarmHosts.

  You plan to configure a Network Load Balancing (NLB) cluster named NLBCluster.contoso.com that will contain the five servers.

  You need to ensure that the NLB service on the nodes of the cluster can use a group managed service account (gMSA) to authenticate.

  Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/create-the-key-distribution-services-kds-root-key https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/getting-started-with-group-managed-service-accounts

• Question 110:

  DRAG DROP

  You have a server named Server1.

  You plan to use Storage Spaces to expand the storage available to Server1. You attach eight physical disks to Server1. Four disks are HDDs and four are SSDs.

  You need to create a volume on Server1 that will use the storage on all the new disks. The solution must provide the fastest read performance for frequently used files.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://redmondmag.com/articles/2018/07/31/storage-spaces-windows-server-2016-1.aspx https://redmondmag.com/articles/2018/08/02/storage-spaces-windows-server-2016-2.aspx