Microsoft AZ-800 Online Practice Questions and Exam Preparation

Microsoft AZ-800 Online Questions & Answers

• Question 111:

  Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals.

  More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

  After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

  Your network contains an Active Directory Domains Services (AD DS) domain named contoso.com.

  You implement a central store.

  You create a new Group Policy Object (GPO) named GPO1.

  When you attempt to edit GPO1, you see the settings shown in the exhibit. (Click the Exhibit tab.)

  

  You need to ensure that all settings are available.

  Solution: You delete the \\contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions folder.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  In an Active Directory Domains Services (AD DS) domain with a central store, how to ensure that a GPO have all settings available?

  Correct:

  You copy the contents of the C:\Windows\PolicyDefinitions folder to the central store. available, you need to ensure the.admx and.adml files for those settings are present in the central store (the PolicyDefinitions folder within the SYSVOL share). These files contain the administrative templates that define the available settings within a GPO.

  To ensure a Group Policy Object (GPO) in an Active Directory domain with a central store has all settings

  Incorrect:

  You delete the \\contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions folder.

  You modify the properties of GPO1.

  Understanding the Central Store:

  The central store is a designated location on a domain controller (typically \\<domain>\SYSVOL \<domain>\Policies\PolicyDefinitions) where administrative template files (.admx and.adml) are stored. It ensures that all domain controllers have the same set of administrative templates for managing Group Policy, preventing inconsistencies.

  It replaces the older method of storing templates within individual GPOs.

  Ensuring Template Availability:

  Locate and Download Templates: Download the necessary .admx and .adml files for the specific features or applications you want to manage.

  These can often be found on Microsoft's website, from the application vendor, or in the operating system's installation media.

  Managing GPOs:

  Edit GPOs: Open Group Policy Management (GPMC) and edit the desired GPO.

  *-> Access Settings: When you browse the Computer or User Configuration settings in the Group Policy Management Editor, the available settings will be populated based on the templates in the central store.

  Configure Settings: Configure the desired settings within the GPO as needed.

  References:

  https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/create-and-manage-central-store

• Question 112:

  DRAG DROP

  You have a server named Server1 that has Windows Admin Center installed. The certificate used by Windows Admin Center was obtained from a certification authority (CA).

  The certificate expires.

  You need to replace the certificate.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  Select and Place:

  

  

  ---

  Step 1: Run Windows Admin Center Setup and select Change.

  Updating the certificate used by Windows Admin Center.

  When you have Windows Admin Center deployed as a service, you must provide a certificate for HTTPS. To update this certificate at a later time, re-run the installer and choose change.

  

  Step 2: Obtain and install a new certificate.

  Step 3: Copy the certificate thumbprint.

  The final step is to copy the certificate's thumbprint into the setup soon after installing it into the local store.

  References:

  https://4sysops.com/archives/install-an-ssl-certificate-in-windows-admin-center/

• Question 113:

  You have an Active Directory Domain Services (AD DS) domain. The domain contains a member server named Server1 that runs Windows Server.

  You need to ensure that you can manage password policies for the domain from Serve1.

  Which command should you run first on Server1?

  A. Install-Windows Feature RSAT-AO-PowerShell
  B. Install-Windows Feature 6PHC
  C. Install-Windows Feature RSAT-AD-Tool$
  D. Install-windows Feature RSAT-AWIMS
  C. Install-Windows Feature RSAT-AD-Tool$

• Question 114:

  HOTSPOT

  Your on-premises network contains a single-domain Active Directory Domain Services (AD DS) forest. You have an Microsoft Entra tenant named contoso.com. The AD DS forest syncs with the Microsoft Entra tenant by using Microsoft Entra Connect.

  You need to ensure that users in the forest that have a custom attribute of NoSync are excluded from synchronization.

  How should you configure the Microsoft Entra Connect cloudFiltered attribute, and which tool should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: True

  Attribute-based filtering

  Inbound filtering

  Inbound filtering uses the default configuration, where objects going to Microsoft Entra ID must have the metaverse attribute cloudFiltered not set to a value to be synchronized. If this attribute's value is set to True, then the object isn't synchronized. It shouldn't be set to False, by design. To make sure other rules have the ability to contribute a value, this attribute is only supposed to have the values True or NULL (absent).

  Box 2: Synchronization Rules Editor

  Example.

  Negative filtering: "do not sync these"

  In the following example, you filter out (not synchronize) all users where extensionAttribute15 has the value NoSync.

  1. Sign in to the server that is running Microsoft Entra Connect Sync by using an account that is a member of the ADSyncAdmins security group.

  2. Start *Synchronization Rules Editor* from the Start menu.

  3. Make sure Inbound is selected, and click Add New Rule.

  4. Etc.

  References:

  https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-configure-filteringBox1:TrueAttribute-basedfiltering

  Inbound filtering Inbound filtering uses the default configuration, where objects going to Microsoft Entra ID must have the metaverse attribute cloudFiltered not set to a value to be synchronized. If this attribute's value is set to True, then the object isn't synchronized. It shouldn't be set to False, by design. To make sure other rules have the ability to contribute a value, this attribute is only supposed to have the values True or NULL (absent). Box 2: Synchronization Rules Editor Example. Negative filtering: "do not sync these" In the following example, you filter out (not synchronize) all users where extensionAttribute15 has the value NoSync. 1. Sign in to the server that is running Microsoft Entra Connect Sync by using an account that is a member of the ADSyncAdmins security group. 2. Start *Synchronization Rules Editor* from the Start menu. 3. Make sure Inbound is selected, and click Add New Rule. 4. Etc. Reference:

• Question 115:

  You have a server named Server1 that runs Windows Server.

  You plan to host applications in Windows containers.

  You need to configure Server1 to run containers.

  What should you install?

  A. Windows Admin Center
  B. Docker
  C. the Windows Subsystem for Linux
  D. Hyper-V
  B. Docker

• Question 116:

  Your network contains a DHCP server.

  You plan to add a new subnet and deploy Windows Server to the subnet.

  You need to use the server as a DHCP relay agent.

  Which role should you install on the server?

  A. Network Policy and Access Services
  B. Remote Access
  C. Network Controller
  D. DHCP Server
  B. Remote Access

  ---

  Explanation

  DHCP and Remote Access Overview.

  When a remote computer connects to a remote access server (RRAS), it is automatically provided with an IP address when the Point-to-Point Protocol (PPP) connection is established.

  You can configure the RRAS server to allocate IP addresses to remote clients from:

  A static range of IP addresses: This method is usually implemented when there are no internal DHCP servers.

  An existing DHCP Server: This is achieved by relaying clients to the DHCP server for IP address allocation.

  If you have an internal DHCP server, you should configure the remote access server to allocate IP addresses via this server. If your DHCP server is not within broadcast range of the RRAS server, you must perform the one of the following configuration as well:

  1. Configure the DHCP Relay Agent on the remote access server.

  2. Configure the DHCP Relay Agent on the same subnet as the remote access server.

  References:

  https://www.tech-faq.com/dhcp-and-remote-access.html

• Question 117:

  HOTSPOT

  You have a file server named Server1 that runs Windows Server and contains the volumes shown in the following table.

  

  On which volumes can you use BitLocker Drive Encryption (BitLocker) and disk quotas? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/windows-server/storage/refs/refs-overview

• Question 118:

  SIMULATION

  You need to prevent domain users from saving executable files in a share named \\SRV1\Data. The users must be able to save other files to the share.

  To complete this task, sign in the required computer or computers.

  A. See the explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See the explanation below.

  ---

  Explanation

  One possible solution to prevent domain users from saving executable files in a share named \SRVl\Data is to use file screening on the file server. File screening allows you to block certain files from being saved based on their file name extension. Here are the steps to configure file screening:

  On the file server, openFile Server Resource Managerfrom theAdministrative Toolsmenu.

  In the left pane, expandFile Screening Managementand click onFile Groups.

  Right-click onFile Groupsand selectCreate File Group.

  In theFile Group Propertiesdialog box, enter a name for the file group, such asExecutable Files.

  In theFiles to includebox, enter the file name extensions that you want to block, such as.exe, .bat, .cmd, .com, .msi, .scr. You can use wildcards to specify multiple extensions, such as *.exe.

  ClickOKto create the file group.

  In the left pane, click onFile Screen Templates.

  Right-click onFile Screen Templatesand selectCreate File Screen Template.

  In theFile Screen Template Propertiesdialog box, enter a name for the template, such asBlock Executable Files.

  On theSettingstab, select the optionActive screening: Do not allow users to save unauthorized files.

  On theFile Groupstab, check the box next to the file group that you created, such asExecutable Files.

  On theNotificationtab, you can configure how to notify users and administrators when a file screening event occurs, such as sending an email, logging an event, or running a command or script. You can also customize the message that users see when they try to save a blocked file.

  ClickOKto create the file screen template.

  In the left pane, click onFile Screens.

  Right-click onFile Screensand selectCreate File Screen.

  In theCreate File Screendialog box, enter the path of the folder that you want to apply the file screening to, such as\SRVl\Data.

  Select the optionDerive properties from this file screen template (recommended)and choose the template that you created, such asBlock Executable Files.

  ClickCreateto create the file screen.

  Now, domain users will not be able to save executable files in the share named \SRVl\Data. They will be able to save other files to the share.

• Question 119:

  Please finish the following requirement on Azure Active Directory Domain Services (Microsoft Entra DS) domain named contoso.com.

  You need to provide a solution to administrator with the ability to manage Group Policy Objects (GPOs). The principle of least privilege must be fulfilled.

  You need to you add the administrator to the group:

  A. AAD DC Administrators
  B. Enterprise Admins
  C. Schema Admins
  D. Domain Admins
  B. Enterprise Admins

• Question 120:

  HOTSPOT

  You have an Azure subscription that contains the storage accounts shown in the following table.

  

  In the East US Azure region, you create a storage sync service named Sync1.

  You need to create a sync group in Sync1.

  Which storage accounts can you use, and what can you specify as the cloud endpoints. To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: storage1 and storage3 only Storage1 and storage3 are in the same region as the storage sync service. They are both of acceptable types, StorageV2 and FileStorage respectively.

  Incorrect:

  * storage2

  Storage2 is BlobBlobStorage.

  * storage4

  Storage4 is in another region.

  Note:

  There are two main types of storage accounts you will use for Azure Files deployments:

  * General purpose version 2 (GPv2) storage accounts: GPv2 storage accounts allow you to deploy Azure file shares on standard/hard disk-based (HDD-based) hardware. In addition to storing Azure file shares, GPv2 storage accounts can store other storage resources such as blob containers, queues, or tables.

  * FileStorage storage accounts: FileStorage storage accounts allow you to deploy Azure file shares on premium/solid-state disk-based (SSD-based) hardware.

  Region

  The storage account for the Azure file share must be located in the same region as the Storage Sync Service.

  Box 2: share1 and share3 only

  A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with each other. A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server endpoints.

  A cloud endpoint is a pointer to an Azure file share. All server endpoints will sync with a cloud endpoint, making the cloud endpoint the hub. The storage account for the Azure file share must be located in the same region as the Storage Sync Service.

  References:

  https://learn.microsoft.com/en-us/azure/storage/files/storage-files-planning

  https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide