Microsoft Microsoft Certifications AZ-800 Questions & Answers

• Question 121:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using

  DEFAULTIPSITELINK.

  You open a new branch office that contains only client computers.

  You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.

  Solution: You create an organization unit (OU) that contains the client computers in the branch office. You configure the Try Next Closest Site Group Policy Object (GPO) setting in a GPO that is linked to the new OU.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 122:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK.

  You open a new branch office that contains only client computers.

  You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.

  Solution: You create a new site named Site4 and associate Site4 to DEFAULTIPSITELINK

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  You create a new subnet object that is associated to Site1.

  By associating a site with one or more subnets, you assign a set of IP addresses to the site

  DNS uses the site name to locate a domain controller in that site (or in the next closest site to the client). DNS then provides the IP address of the domain controller to the client for the purpose of connecting to the domain controller. For this reason, it is important to ensure that the IP address that you assign to a domain controller maps to a subnet that is associated with the site of the respective server object

  Note: Assigning computers to sites Server objects are created in AD DS by applications or services, and they are placed into a site based on their IP address. When you add the Active Directory Domain Services server role to a server, a server object is created in the AD DS site that contains the subnet to which the server's IP address maps. If the domain controller's IP address does not map to any site in the forest, the domain controller's server object is created in the site of the domain controller that provides the replication source for AD DS.

  Reference: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754697(v=ws.11)

• Question 123:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using

  DEFAULTIPSITELINK.

  You open a new branch office that contains only client computers.

  You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.

  Solution: You configure the Try Next Closest Site Group Policy Object (GPO) setting in a GPO that is linked to Site1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 124:

  You have a server named Server1 that runs Windows Server. Server1 has the storage pools shown in the following table.

  

  You plan to create a virtual disk named VDisk1 that will use storage tiers. Which pools can you use to create VDisk1?

  A. Pool2 only

  B. Pool1 only

  C. Pool1, Pool2, and Pool3

  D. Pool1 and Pool2 only

  E. Pool3 only

  F. Pool2 and Pool3 only

  G. Pool1 and Pool3 only

  Correct Answer: F

  Storage tiering requires both standard HDDs and SSDs. We cannot use Pool1 because it does not have any SSDs.

• Question 125:

  You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. The on-premises network is connected to Azure by using a Site-to-Site VPN. You have the DNS zones shown in the following table.

  

  You need to ensure that names from fabrikam.com can be resolved from the on-premises network. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  A. Create a stub zone for fabrikam.com on DC1.

  B. Create a conditional forwarder for fabrikam.com on DC1.

  C. Create a secondary zone for fabrikam.com on DC1.

  D. Deploy an Azure virtual machine that runs Windows Server. Modify the DNS Servers settings for the virtual network.

  E. Deploy an Azure virtual machine that runs Windows Server. Configure the virtual machine as a DNS forwarder.

  Correct Answer: BE

  Reference: https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-dns#on-premises-workloads-using-a-dns-forwarder

• Question 126:

  You have an on-premises server named Server1 that runs Windows Server.

  You have an Azure virtual network that contains an Azure virtual network gateway.

  You need to connect only Server1 to the Azure virtual network.

  What should you use?

  A. a Site-to-Site VPN

  B. Azure Network Adapter

  C. an ExpressRoute circuit

  D. Azure Extended Network

  Correct Answer: B

  https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/use-azure-network-adapter

• Question 127:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are planning the deployment of DNS to a new network.

  You have three internal DNS servers as shown in the following table.

  

  The contoso.local zone contains zone delegations for east.contoso.local and west.contoso.local. All the DNS servers use root hints.

  You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.

  Solution: On Server2, you create a conditional forwarder for west.contoso.local. On Server3, you create a conditional forwarder for east.contoso.local.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 128:

  You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant.

  You plan deploy 100 new Azure virtual machines that will run Windows Server.

  You need to ensure that each new virtual machine is joined to the AD DS domain.

  What should you use?

  A. an Azure Resource Manager (ARM) template

  B. a Group Policy Object (GPO)

  C. Azure AD Connect

  D. an Azure management group

  Correct Answer: A

  Reference: https://www.ludovicmedard.com/create-an-arm-template-of-a-virtual-machine-automatically-joined-to-a-domain/

• Question 129:

  You have an Azure virtual machine named VM1 that has a private IP address only.

  You configure the Windows Admin Center extension on VM1.

  You have an on-premises computer that runs Windows 11. You use the computer for server management.

  You need to ensure that you can use Windows Admin Center from the Azure portal to manage VM1.

  What should you configure?

  A. an Azure Bastion host on the virtual network that contains VM1.

  B. a VPN connection to the virtual network that contains VM1.

  C. a private endpoint on the virtual network that contains VM1.

  D. a network security group (NSG) rule that allows inbound traffic on port 443.

  Correct Answer: D

• Question 130:

  Your company has a main office and a branch office. The two offices are connected by using a WAN link. Each office contains a firewall that filters WAN traffic.

  The network in the branch office contains 10 servers that run Windows Server. All servers are administered from the main office only.

  You plan to manage the servers in the branch office by using a Windows Admin Center gateway.

  On a server in the branch office, you install the Windows Admin Center gateway by using the defaults settings.

  You need to configure the firewall in the branch office to allow the required inbound connection to the Windows Admin Center gateway.

  Which inbound TCP port should you allow?

  A. 443

  B. 3389

  C. 5985

  D. 6516

  Correct Answer: A