Microsoft Microsoft Certifications AZ-800 Questions & Answers

• Question 151:

  Your on-premises network contains an Active Directory domain named contoso.com. You have an Azure AD tenant.

  You plan to sync contoso.com with the Azure AD tenant by using Azure AD Connect cloud sync.

  You need to create an account that will be used by Azure AD Connect cloud sync.

  Which type of account should you create?

  A. system-assigned managed identity

  B. group managed service account (gMSA)

  C. user

  D. InetOrgPerson

  Correct Answer: B

  Migrate to Azure AD Connect cloud sync for an existing synced AD forest Install the Azure AD Connect provisioning agent

  1.

  In the Azure portal, select Azure Active Directory.

  2.

  On the left, select Azure AD Connect.

  3.

  On the left, select Cloud sync.

  * Details omitted*

  11. On the Configure Service Account screen, select a group Managed Service Account (gMSA). This account is used to run the agent service. If a managed service account is already configured in your domain, you might skip this screen. If prompted, choose either:

  Create gMSA which lets the agent create the provAgentgMSA$ managed service account for you. The group managed service account (for example, CONTOSO\provAgentgMSA$) will be created in the same Active Directory domain where the host server has joined. To use this option, enter the Active Directory domain administrator credentials.

  Reference: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/tutorial-pilot-aadc-aadccp

• Question 152:

  Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the domain controllers shown in the following table.

  

  You need to ensure that if an attacker compromises the computer account of RODC1, the attacker cannot view the Employee-NumberAD DS attribute. Which partition should you modify?

  A. configuration

  B. global catalog

  C. domain

  D. schema

  Correct Answer: D

  Schema Master FSMO Role The Schema Master role manages the read-write copy of your Active Directory schema. The AD Schema defines all the attributes – things like employee ID, phone number, email address, and login name – that you can apply to an object in your AD database.

  Reference: https://www.varonis.com/blog/fsmo-roles

• Question 153:

  Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the resources shown in the following table.

  

  You plan to replicate a volume from Server1 to Server2 by using Storage Replica.

  You need to configure Storage Replica.

  Where should you install Windows Admin Center?

  A. Server1

  B. CLIENT1

  C. DC1

  D. Server2

  Correct Answer: B

  Note: Storage Replica is Windows Server technology that enables replication of volumes between servers or clusters for disaster recovery. It also enables you to create stretch failover clusters that span two sites, with all nodes staying in sync.

  Reference: https://learn.microsoft.com/en-us/windows-server/storage/storage-replica/server-to-server-storage-replication

• Question 154:

  You have an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with Azure AD by using Azure AD Connect.

  You enable password protection for contoso.com.

  You need to prevent users from including the word contoso as part of their password.

  What should you use?

  A. the Azure Active Directory admin center

  B. Active Directory Users and Computers

  C. Synchronization Service Manager

  D. Windows Admin Center

  Correct Answer: A

  To prevent users from including the word "contoso" as part of their password in an on-premises Active Directory (AD DS) domain that syncs with Azure AD using Azure AD Connect, you should use Azure AD Password Protection. Therefore, the correct option is:

  A. the Azure Active Directory admin center

• Question 155:

  You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD.

  You deploy an app that adds custom attributes to the domain.

  From Azure Cloud Shell, you discover that you cannot query the custom attributes of users.

  You need to ensure that the custom attributes are available in Azure AD.

  Which task should you perform from Microsoft Azure Active Directory Connect first?

  A. Configure device options

  B. Manage federation

  C. Customize synchronization options

  D. Refresh directory schema

  Correct Answer: C

  Azure AD Connect sync: Directory extensions

  You can use directory extensions to extend the schema in Azure Active Directory (Azure AD) with your own attributes from on-premises Active Directory. This feature enables you to build LOB apps by consuming attributes that you continue to

  manage on-premises. These attributes can be consumed through extensions. You can see the available attributes by using Microsoft Graph Explorer. You can also use this feature to create dynamic groups in Azure AD.

  Customize which attributes to synchronize with Azure AD

  You configure which additional attributes you want to synchronize in the custom settings path in the installation wizard.

  Reference:

  https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-sync-feature-directory-extensions

• Question 156:

  You have an Active Directory Domain Services (AD DS) domain that contains the domain controllers shown in the following table.

  

  The domain contains an app named App1 that uses a custom application partition to store configuration data.

  You decommission App1.

  When you attempt to remove the custom application partition, the process fails.

  Which domain controller is unavailable?

  A. DC1

  B. DC2

  C. DC3

  D. DC4

  Correct Answer: C

  The Domain Naming Master is used to add and to remove domains and application partitions to and from the forest.

  - Must be online when domains and application partitions in a forest are added or removed.

  Reference: https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/fsmo-placement-and-optimization-on-ad-dcs

• Question 157:

  Your network contains an Active Directory Domain Services (AD DS) domain.

  You plan to use Active Directory Administrative Center to create a new user named User1.

  Which two attributes are required to create User1? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Password

  B. Profile path

  C. User SamAccountName logon

  D. Full name

  E. First name

  F. User UPN logon

  Correct Answer: CD

  To create test users

  1.

  Right click the Windows PowerShell icon, click Run as Administrator and type dsac.exe to open ADAC.

  2.

  Click Manage, click Add Navigation Nodes and select the appropriate target domain in the Add Navigation Nodes dialog box and then click OK.

  3.

  In the Tasks pane, click New and then click User.

  4.

  Enter the following information under Account and then click OK:

  Full name: test1 User SamAccountName logon: test1 Password: p@ssword1 Confirm password: p@ssword1 Repeat the previous steps to create a second user, test2.

  Reference:

  https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/adac/introduction-to-active-directory-administrative-center-enhancements--level-100

• Question 158:

  You have an Active Directory domain that contains a file server named Server1. Server1 runs Windows Server and includes the file shares shown in the following table.

  

  When users login to the network they receive the following network drive mappings.

  1.

  H: maps to \\server1\users\%UserName%

  2.

  G: maps to \\server1\%Department%

  You need to limit the amount of space consumed by user's on Server1. The solution must meet the following requirements:

  1.

  Prevent users using more than 5GB of space on their H: drive

  2.

  Prevent Accounts department users from using more than 10GB of space on the G: drive

  3.

  Prevent Marketing department users from using more than 15GB of space on the G: drive

  4.

  Prevent Customer Service department users from using more than 2GB of space on the G: drive

  5.

  Minimize administrative effort

  What should you use?

  A. File Server Resource Manager (FSRM) quotas

  B. Storage tiering

  C. NTFS Disk quotas

  D. Group Policy Preferences

  Correct Answer: A

  On the Quota Management node of the File Server Resource Manager Microsoft® Management Console (MMC) snap-in, you can perform the following tasks:

  Create quotas to limit the space allowed for a volume or folder, and generate notifications when the quota limits are approached or exceeded.

  Generate auto apply quotas that apply to all existing subfolders in a volume or folder and to any subfolders that are created in the future.

  Define quota templates that can be easily applied to new volumes or folders and then used across an organization.

  For example, you can:

  Place a 200 megabyte (MB) limit on users' personal server folders, with an email notification sent to you and the user when 180 MB of storage has been exceeded.

  Set a flexible 500 MB quota on a group's shared folder. When this storage limit is reached, all users in the group are notified by e-mail that the storage quota has been temporarily extended to 520 MB so that they can delete unnecessary files

  and comply with the preset 500 MB quota policy.

  Receive a notification when a temporary folder reaches 2 gigabytes (GB) of usage, yet not limit that folder's quota because it is necessary for a service running on your server.

  Reference:

  https://learn.microsoft.com/en-us/windows-server/storage/fsrm/quota-management

• Question 159:

  You have a server named Server1 that runs Windows Server. The disks on Server1 are configured as shown in the following exhibit.

  

  You need to convert volume E to ReFS. The solution must meet the following requirements:

  1.

  The data on volume E needs to be retained.

  2.

  Minimize administrative effort. What should you do first?

  A. Back up the data on volume E.

  B. Take Disk 2 offline.

  C. Convert Disk 2 to a dynamic disk.

  D. Run convert.exe.

  Correct Answer: A

• Question 160:

  You have a server named Server1 that runs Windows Server and contains a file share named Share1.

  You need to prevent users from storing MP4 files in Share1. The solution must ensure that the users can store other types of files in the share.

  What should you configure on Server1?

  A. File Management Tasks

  B. NTFS Quotas

  C. NTFS permissions

  D. file screens

  Correct Answer: D

  File Screening Management

  On the File Screening Management node of the File Server Resource Manager MMC snap-in, you can perform the following tasks:

  Create file screens to control the types of files that users can save, and generate notifications when users attempt to save unauthorized files.

  Define file screening templates that can be applied to new volumes or folders and that can be used across an organization.

  Create file screening exceptions that extend the flexibility of the file screening rules.

  Reference: https://learn.microsoft.com/en-us/windows-server/storage/fsrm/file-screening-management