Microsoft Microsoft Certifications AZ-800 Questions & Answers

• Question 51:

  You have an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.

  You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least privilege.

  To which group should you add the administrator?

  A. AAD DC Administrators

  B. Domain Admins

  C. Schema Admins

  D. Enterprise Admins

  E. Group Policy Creator Owners

  Correct Answer: A

  Settings for user and computer objects in Azure Active Directory Domain Services (Azure AD DS) are often managed using Group Policy Objects (GPOs).

  Azure AD DS includes built-in GPOs for the AADDC Users and AADDC Computers containers. You can customize these built-in GPOs to configure Group Policy as needed for your environment.

  ANSWER (A): Members of the Azure AD DC administrators group have "Group Policy administration privileges in the Azure AD DS domain, and can also create custom GPOs and organizational units (OUs). "

  https://docs.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy

• Question 52:

  Your network contains an Active Directory Domain Services (AD DS) domain.

  You have a Group Policy Object (GPO) named GPO1 that contains Group Policy preferences.

  You plan to link GPO1 to the domain.

  You need to ensure that the preference in GPO1 apply only to domain member servers and NOT to domain controllers or client computers. All the other Group Policy settings in GPO1 must apply to all the computers. The solution must

  minimize administrative effort.

  Which type of item level targeting should you use?

  A. Domain

  B. Operating System

  C. Security Group

  D. Environment Variable

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789189(v=ws.11)#operating-system-targeting

• Question 53:

  You have an Azure virtual machine named VM1 that runs Windows Server.

  You need to configure the management of VM1 to meet the following requirements:

  1.

  Require administrators to request access to VM1 before establishing a Remote Desktop connection.

  2.

  Limit access to VM1 from specific source IP addresses.

  3.

  Limit access to VM1 to a specific management port. What should you configure?

  A. a network security group (NSG)

  B. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)

  C. Microsoft Defender for Cloud

  D. Azure Front Door

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc

• Question 54:

  You have servers that have the DNS Server role installed. The servers are configured as shown in the following table.

  

  All the client computers in the New York office use Server2 as the DNS server.

  You need to configure name resolution in the New York office to meet the following requirements:

  1.

  Ensure that the client computers in New York can resolve names from contoso.com.

  2.

  Ensure that Server2 forwards all DNS queries for internet hosts to 131. 107.100.200.

  The solution must NOT require modifications to Server1.

  Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a forwarder

  B. a conditional forwarder

  C. a delegation

  D. a secondary zone

  E. a reverse lookup zone

  Correct Answer: AB

  A conditional forwarder is required for contoso.com.

  A forwarder is required for all other domains.

  When you have a conditional forwarder and a forwarder configured, the conditional forwarder will be used for the specified domain.

  You could use a secondary zone for contoso.com but that would require a configuration change on Server1.

• Question 55:

  Step 6: After adding the required Performance Counter name, click on Apply to make the changes.

  That's it. You are done. At this point, we have successfully enabled Windows Performance Counters in Azure for Monitoring.

  Reference:

  https://www.geeksforgeeks.org/microsoft-azure-enable-windows-performance-counters-in-azure-for-monitoring/

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.

  You need to identify which server is the PDC emulator for the domain.

  Solution: From Active Directory Sites and Services, you right-click Default-First-Site-Name in the console tree, and then select Properties.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 56:

  SIMULATION

  You need to collect the recommended Windows Performance Counters from SRV1 in a Log Analytics workspace.

  The required files are stored in a shared folder named \\dc1\install.

  To complete this task, sign in to the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Microsoft Azure – Enable Windows Performance Counters in Azure for Monitoring

  Collect windows performance counters from Log Analytics agents at custom intervals to gain insight into the performance of hardware components, operating systems, and applications.

  Implementation:

  Step 1: Log in to Azure Portal.

  Step 2: Access the Log Analytics Workspace >> Select your Log Analytics.

  Step 3: After selecting the select Log Analytics Workspace, Navigate to Settings >> Agents Configuration

  

  Step 4: Select Windows Performance Counters >>You can start with the recommended performance counters by clicking on Add recommended counters or using the add button to add a new performance counter.

  

  Step 5: Click on + Add Performance Counter >> Select the Performance Counter name

  

• Question 57:

  SIMULATION

  You have an application that is copied to a folder named C:\app on SRV1. C:\app also contains a Dockerfile for the app.

  On SRV1, you need to create a container image for the application by using the Dockerfile. The container image must be named app1.

  To complete this task, sign in to the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Create new container images on Windows Admin Center

  Create new container images

  When working with containers, you'll write instructions to Docker on how your container image works, and then Docker creates a new container image based on these instructions. These instructions are saved on a file called "Dockerfile" that's

  saved to the same folder in which your application resides.

  Step 1:

  Windows Admin Center can considerably reduce the overhead of writing Dockerfiles or even remove the need to write these files entirely. To get started, on the Containers extension, select the Create New option on the Images tab.

  

  Step 2: Select: Use an existing Dockerfile Use an existing Dockerfile: This option allows you to rebuild a new container image based on an existing Dockerfile. This is useful when you need to make small changes to an existing Dockerfile or when you need to recreate the container to catch an application update.

  Step 3: Enter: Application source path: C:\app

  Once you select the type of application you want to containerize, you can select common options to finalize the creation of your image:

  Enter:

  Application source path: C:\app

  Step 4: Click Build

  Reference:

  https://learn.microsoft.com/en-us/virtualization/windowscontainers/wac-tooling/wac-images

• Question 58:

  SIMULATION

  You need to run a container that uses the mcr.microsoft.com/windows/servercore/iis image on SRV1. Port 80 on the container must be published to port 5001 on SRV1 and the container must run in the background.

  To complete this task, sign in to the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Pull a container base image

  All containers are created from container images. Microsoft offers several starter images, called base images, to choose from. This procedure pulls (downloads and installs) the lightweight Nano Server base image.

  Step 1:

  Run a Windows container using Windows Admin Center

  You can use Windows Admin Center to run your containers locally. Specifically, you use the Containers extension of your Windows Admin Center instance to run the containers. First, open the container host you want to manage, and in the

  Tools pane, select the Containers extension. Then, select the Images tab inside the Container extension under Container Host.

  

  Step 2:

  If your host doesn't have a base container image, select the Pull option to open the Pull Container Image settings:

  

  Step 3:

  In the Pull Container Image settings, provide the image URL and the tag. If you aren't certain which image to pull, Windows Admin Center provides a list of common images from Microsoft. You can also provide the credentials to pull an image

  from a private repository. Once you fill out the necessary information, click Pull. Windows Admin Center will start the pull process on the container host. After the download is complete, you should see the new image on the Images tab.

  

  On the Run menu, set up the configuration for the container, such as the container name, the isolation type, which ports to publish, and memory and CPU allocation.

  Step 4: In Publish port(s) enter: 80:5001

  We need to specify the port.

  Note: Publish or expose port (-p, --expose)

  docker run -p 127.0.0.1:80:8080/tcp ubuntu bash

  This binds port 8080 of the container to TCP port 80 on 127.0.0.1 of the host machine.

  Step 5: Click 'Add' to add additional options.

  Step 6: Type: -d

  Note: Run in detached mode

  This is great so far, but your sample application is a web server and you shouldn't have to have your terminal connected to the container. Docker can run your container in detached mode in the background. To do this, you can use the -detach or -d for short. Docker will start your container the same as before but this time will detach from the container and return you to the terminal prompt.

  docker run -d -p 8080:8080 docker-gs-ping

  d75e61fcad1e0c0eca69a3f767be6ba28a66625ce4dc42201a8a323e8313c14e

  Docker started your container in the background and printed the container ID on the terminal.

  Step 7: Click Run

  Once you have finished the configuration for the container, click Run. You can see the status of the running containers on the Containers tab:

  

  Reference: https://learn.microsoft.com/en-us/virtualization/windowscontainers/quick-start/run-your-first-container https://docs.docker.com/engine/reference/commandline/run/

• Question 59:

  SIMULATION

  You need to ensure that all the computers in the domain use DNSSEC to resolve names in the adatum.com zone.

  To complete this task, sign in to the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  To sign a zone in DNS Manager

  Step 1: Open DNS Manager on a primary, authoritative DNS server, or connect to a primary, authoritative DNS server with DNS Manager.

  Step 2: Right-click an unsigned zone (here adatum.com), point to DNSSEC, and then click Sign the Zone.

  Step 3: The Zone signing Wizard is displayed, click next

  We will use the default settings.

  Step 4: Choose the default settings, click next, next again, then finish.

  (From the DNS manager press F5. A lock is displayed on our zone telling us that our zone has been signed.)

  Reference:

  https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn593644(v=ws.11) https://www.serveracademy.com/courses/installing-and-configuring-domain-name-system-dns/installing-dnssec-on-windows-2016-server/

• Question 60:

  SIMULATION

  You need to use Azure File Sync to replicate the contents of C:\app on SRV1 to an Azure file share named share1.

  The required source files are located in a folder named \\dc1.contoso.com\install.

  To complete this task, sign in to the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Step 1:

  Create a sync group and a cloud endpoint

  A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with each other. A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server endpoints.

  A server endpoint represents a path on a registered server. A server can have server endpoints in multiple sync groups. You can create as many sync groups as you need to appropriately describe your desired sync topology.

  A cloud endpoint is a pointer to an Azure file share.

  To create a sync group, in the Azure portal, go to your Storage Sync Service, and then select + Sync group:

  

  In the pane that opens, enter the following information to create a sync group with a cloud endpoint:

  Sync group name: The name of the sync group to be created. This name must be unique within the Storage Sync Service, but can be any name that is logical for you.

  Subscription: The subscription where you deployed the Storage Sync Service in Deploy the Storage Sync Service.

  Storage account: If you select Select storage account, another pane appears in which you can select the storage account that has the Azure file share that you want to sync with.

  Azure file share: The name of the Azure file share with which you want to sync

  Enter: share1

  Step 2:

  Create a server endpoint

  A server endpoint represents a specific location on a registered server, such as a folder on a server volume.

  To add a server endpoint, go to the newly created sync group. Under Server endpoints, select +Add server endpoint. The Add server endpoint blade opens. Enter the following information to create a server endpoint:

  

  Registered server: The name of the server or cluster where you want to create the server endpoint.

  Enter: SRV1

  Path: The path on the Windows Server to be synced to the Azure file share. The path can be a folder (for example, D:\Data), volume root (for example, D:\), or volume mount point (for example, D:\Mount).

  Enter: C\app

  Step 3:

  Create an Azure File Sync server endpoint

  To add a server endpoint, go to the newly created sync group. Under Server endpoints, select +Add server endpoint. The Add server endpoint blade opens. Enter the following information to create a server endpoint:

  

  *

  Registered server: The name of the server or cluster where you want to create the server endpoint.

  Enter: SRV1

  *

  Path: The path on the Windows Server to be synced to the Azure file share. The path can be a folder (for example, D:\Data), volume root (for example, D:\), or volume mount point (for example, D:\Mount).

  Enter: C:\app

  Step 4:

  To add the server endpoint, select Create. Your files are now kept in sync across your Azure file share and Windows Server.

  Reference: https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-server-endpoint-create