Microsoft Microsoft Certifications AZ-800 Questions & Answers

• Question 71:

  SIMULATION

  You plan to delegate the management of a DNS zone named fabrikam.com located on DC1 to the BranchAdmins group.

  You need to ensure that you can grant permissions to the fabikam.com zone.

  To complete this task, sign in the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  You can create these DNS delegation records before you install DNS server.

  Step 1: To create a zone delegation, open DNS Manager.

  Step 2: Right-click the parent domain. In our case: fabrikam.com

  Step 3: Click New Delegation.

  The New Delegation Wizard starts.

  Step 4: In the New Delegation Wizard, on the Welcome page, click Next.

  Step 5: On the Delegated Domain Name page, as shown below, in the Delegated domain box, type the subdomain name. In this case fabrikam.com.

  

  Step 6: On the Name Servers page, click Add.

  Step 7: In the New Name Server Record dialog box, on the Server Fully Qualified Domain name (FQDN) box, type the name of the DNS server that hosts the new delegated zone, click Resolve, and then click OK.

  Step 8: On the Name Servers page, click Next, and then click Finish.

  Reference: https://www.microsoftpressstore.com/articles/article.aspx?p=2756482andseqNum=2

• Question 72:

  SIMULATION

  You need to ensure that SRV1 only leases IP addresses from the range of 192.168.1.190 to 192.168.1.200 to computers that have a MAC address that starts with aabb.

  To complete this task, sign in the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Create policies The DHCP Policy Configuration Wizard will be used to create a unique policy for SRV1. A policy configured for an individual computer is not typical and is only configured for demonstration purposes. On a corporate network, you can use wildcards and other conditions to match multiple DHCP client devices.

  Step 1: In the DHCP console, under Scope, right-click Policies and then click New Policy.

  Step 2: Next to Policy Name, type Client1 Policy, and then click Next.

  Step 3: On the Configure Conditions for the policy page, click Add.

  Step 4: In the Add/Edit Condition dialog box, choose MAC Address next to Criteria, type the MAC address for Client1 next to Value (aabb* ), and then click Add, then click OK.

  In our case use: aabb*

  

  Step 5: Click Next, and then in Configure settings for the policy, type 192.168.1.190 next to Start IP address and type 192.168.1.200 next to End IP address.

  

  Step 6: Finish the wizard.

  Reference: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831538

• Question 73:

  SIMULATION

  You plan to promote a domain controller named DC3 in a site in Seattle.

  You need to ensure that DC3 only replicates with DC1 and DC2 between 8 PM and 6 AM.

  To complete this task, sign in the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Step 1: Create a site link between Seattle and the site in which DC1 and DC2 are located (if the site link does not already exist. If the site link already exists, then skip Step 1).

  Step 2: To open Active Directory Sites and Services, click Start, click Administrative Tools, and then click Active Directory Sites and Services.

  Open Active Directory Sites and Services.

  Step 3: In the console tree, click the intersite transport folder that contains the site link for which you are configuring intersite replication availability.

  Step 4: In the details pane, right-click the site link whose schedule you want to configure, and then click Properties.

  Step 5: Click Change Schedule.

  Step 6: Select the block of time during which you want replication to be either available or not available, and then click Replication Not Available or Replication Available, respectively.

  Change the schedule to: from 8 PM to 6 AM.

  Note: Site link

  Site links are Active Directory objects that represent logical paths that the KCC uses to establish a connection for Active Directory replication. A site link object represents a set of sites that can communicate at uniform cost through a specified

  intersite transport.

  All sites contained within the site link are considered to be connected by means of the same network type. Sites must be manually linked to other sites by using site links so that domain controllers in one site can replicate directory changes

  from domain controllers in another site. Because site links do not correspond to the actual path taken by network packets on the physical network during replication, you do not need to create redundant site links to improve Active Directory replication efficiency.

  When two sites are connected by a site link, the replication system automatically creates connections between specific domain controllers in each site that are called bridgehead servers. Reference: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc770712(v=ws.10) https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/replication/active-directory-replication-concepts

• Question 74:

  SIMULATION

  You need to ensure that DC2 is the schema master for contoso.com.

  To complete this task, sign in the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Seize operations master roles

  You cannot use AD DS snap-ins to seize operations master roles. Instead, you must use either the ntdsutil.exe command-line tool or Windows PowerShell to seize roles.

  To seize or transfer the FSMO roles by using the Ntdsutil utility, follow these steps:

  Step 1: Sign in to a member computer, in our case DC2, that has the AD RSAT tools installed, or a DC that is located in the forest where FSMO roles are being transferred.

  Step 2: Select Start > Run, type ntdsutil in the Open box, and then select OK.

  Step 3: Type roles, and then press Enter.

  Note:

  To see a list of available commands at any one of the prompts in the Ntdsutil utility, type ?, and then press Enter.

  Step 4: Type connections, and then press Enter.

  Step 5: Type connect to server , and then press Enter.

  Step 6: At the server connections prompt, type q, and then press Enter.

  Step 7: To seize the role: Type seize , and then press Enter.

  In our case we type: size schema master.

  Step 8: At the fsmo maintenance prompt, type q, and then press Enter to gain access to the ntdsutil prompt. Type q, and then press Enter to quit the Ntdsutil utility.

  Reference: https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/transfer-or-seize-fsmo-roles-in-ad-ds

• Question 75:

  SIMULATION

  You need to configure a Group Policy preference to ensure that users in the organizational unit (OU) named Server Admins have a shortcut to a folder named \\srv1.contoso.com\data on their desktop when they sign in to the computers in the domain.

  To complete this task, sign in the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Create Desktop Shortcuts on Domain Computers via GPO.

  Step 1: Open the Group Policy Management Console (gpmc.msc).

  Step 2: Right-click an AD container (Organizational Unit) you want to apply a shortcut creation policy. In this case right-click on the OU Server Admins.

  

  Step 3: Select Create a GPO in this domain, and Link it here..

  Step 4: Go to the Group Policy Preferences section: User Configuration -> Preferences -> Windows Settings -> Shortcuts. Click it and select New -> Shortcut;

  

  Step 5: Create a new shortcut item with the following settings: Name: Something Target Type: File System Object (you can select a URL or a Shell object here) Location: Desktop Target Path: \\srv1.contoso.com\data

  Reference: http://woshub.com/create-desktop-shortcuts-group-policy/

• Question 76:

  SIMULATION

  You need to ensure that the minimum password length for members of the BranchAdmins group is 12 characters. The solution must affect only the BranchAdmins group.

  To complete this task, sign in the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Create a new fine-grained password policy.

  In the following procedure you will create a new fine-grained password policy using the UI in ADAC.

  To create a new fine grained password policy.

  Step 1: Right click the Windows PowerShell icon, click Run as Administrator and type dsac.exe to open ADAC.

  Step 2: Click Manage, click Add Navigation Nodes and select the appropriate target domain in the Add Navigation Nodes dialog box and then click OK.

  Step 3: Click Manage, click Add Navigation Nodes and select the appropriate target domain in the Add Navigation Nodes dialog box and then click OK.

  Step 4: In the Tasks pane, click New, and then click Password Settings.

  Fill in or edit fields inside the property page to create a new Password Settings object. The Name and Precedence fields are required.

  In our case:

  Minimum password length: 12

  

  Step 5: Under Directly Applies To, click Add, type BranchAdmin, and then click OK.

  Reference: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/adac/introduction-to-active-directory-administrative-center-enhancements--level-100-#bkmk2_test_fgpp1

• Question 77:

  You need to ensure that access to storage1 for the Marketing OU users meets the technical requirements.

  What should you implement?

  A. Active Directory Federation Services (AD FS)

  B. Azure AD Connect in staging mode

  C. Azure AD Connect cloud sync

  D. Azure AD Connect in active mode

  Correct Answer: C

  Azure AD Connect cloud sync is a new offering from Microsoft designed to meet and accomplish your hybrid identity goals for synchronization of users, groups, and contacts to Azure AD. It accomplishes this by using the Azure AD cloud provisioning agent instead of the Azure AD Connect application. However, it can be used alongside Azure AD Connect sync and it provides the following benefits:

  *

  Support for synchronizing to an Azure AD tenant from a multi-forest disconnected Active Directory forest environment: The common scenarios include merger and acquisition (where the acquired company's AD forests are isolated from the parent company's AD forests), and companies that have historically had multiple AD forests.

  *

  Etc.

  

  How is Azure AD Connect cloud sync different from Azure AD Connect sync?

  With Azure AD Connect cloud sync, provisioning from AD to Azure AD is orchestrated in Microsoft Online Services. An organization only needs to deploy, in their on-premises or IaaS-hosted environment, a light-weight agent that acts as a

  bridge between Azure AD and AD. The provisioning configuration is stored in Azure AD and managed as part of the service.

  Comparison between Azure AD Connect and cloud sync

  The following table provides a comparison between Azure AD Connect and Azure AD Connect cloud sync:

  

  Scenario:

  The users in the Marketing OU must have access to storage1.

  The subscription contains a storage account named storage1 that has a file share named share1.

  The fabrikam.com domain contains an organizational unit (OU) named Marketing.

  The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.

  The on-premises network of A. Datum contains an Active Directory Domain Services (AD DS) forest named adatum.com.

  Incorrect:

  * Azure AD Connect in staging mode

  With a server in staging mode, you can make changes to the configuration and preview the changes before you make the server active.

  Staging mode

  Staging mode can be used for several scenarios, including:

  High availability.

  Test and deploy new configuration changes.

  Introduce a new server and decommission the old.

  During installation, you can select the server to be in staging mode. This action makes the server active for import and synchronization, but it does not run any exports. A server in staging mode is not running password sync or password

  writeback, even if you selected these features during installation.

  Reference:

• Question 78:

  SIMULATION

  You need to create a user named Admin1 in contoso.com. Admin1 must be able to back up and restore files on SRV1. The solution must use principle of the least privilege.

  To complete this task, sign in the required computer or computers.

  A. See explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Step 1: Sign in to the Azure portal in the User Administrator role for the organization.

  Add a new user

  You can create a new user using the Azure Active Directory portal.

  To add a new user, follow these steps:

  Step 1. Sign in to the Azure portal in the User Administrator role for the organization.

  Step 2: Search for and select Azure Active Directory from any page.

  Step 3: Select Users, and then select New user.

  

  Step 4: On the User page, enter information for this user:

  Name: Admin1

  User name: Admin1

  Groups. Optional

  Groups. Optional: Backup Operator

  Step 5: Copy the autogenerated password provided in the Password box. You'll need to give this password to the user to sign in for the first time.

  Step 6: Select Create.

  The user is created and added to your Azure AD organization.

  Note:

  Azure Backup provides three built-in roles to control backup management operations.

  Backup Operator - This role has permissions to everything a contributor does except removing backup and managing backup policies. This role is equivalent to contributor except it can't perform destructive operations such as stop backup

  with delete data or remove registration of on-premises resources.

  Incorrect:

  Backup Contributor - This role has all permissions to create and manage backup except deleting Recovery Services vault and giving access to others. Imagine this role as admin of backup management who can do every backup management

  operation.

  Backup Reader - This role has permissions to view all backup management operations. Imagine this role to be a monitoring person.

  Reference:

  https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/add-users-azure-active-directory

  https://learn.microsoft.com/en-us/azure/backup/backup-rbac-rs-vault

• Question 79:

  Which two languages can you use for Task1? Each correct answer presents a complete solution.

  A. Bicep

  B. Python

  C. Java

  D. PowerShell

  E. JavaScript

  Correct Answer: BD

  Planned changes: Configure an Azure runbook named Task1.

  The Azure Automation Process Automation feature supports several types of runbooks, as defined in the following table.

  *

  Python

  Textual runbook based on Python scripting. The currently supported versions are: Python 2.7 (GA), Python 3.8 (GA), and Python 3.10 (preview).

  *

  PowerShell

  Textual runbook based on Windows PowerShell scripting. The currently supported versions are: PowerShell 5.1 (GA), PowerShell 7.1 (preview), and PowerShell 7.2 (preview).

  *

  Etc.

  Reference: https://learn.microsoft.com/en-us/azure/automation/automation-runbook-types

• Question 80:

  You need to ensure that Automanage meets the technical requirements.

  On which Azure virtual machines should you enable Automanage?

  A. Server1 only

  B. Server2 only

  C. Server1 and Server2 only

  D. Server2 and Server3 only

  E. Server1 and Server4 only

  Correct Answer: D

  Azure Automanage must be used on all supported Azure virtual machines.

  Automanage does not support Trusted Launch VMs. This excludes Server1 and Server4.

  Note: What are all of the prerequisites required to enable Azure Automanage?

  The following are prerequisites for enabling Azure Automanage:

  Supported Windows Server versions and Linux distros

  VMs must be in a supported region

  User must have correct permissions

  Non-scale set VMs only

  Automanage does not support Sandbox subscriptions at this time

  *-> Automanage does not support Trusted Launch VMs at this time

  Reference:

  https://learn.microsoft.com/en-us/azure/automanage/faq