Microsoft AZ-800 Online Practice Questions and Exam Preparation

Microsoft AZ-800 Online Questions & Answers

• Question 191:

  HOTSPOT

  Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a child domain named east.contoso.com.

  In the contoso.com domain, you create two users named Admin1 and Admin2.

  You need to ensure that the users can perform the following tasks:

  1. Admin1 can create and manage Active Directory sites.

  2. Admin2 can deploy domain controllers to the east.contoso.com domain.

  The solution must use the principle of least privilege.

  To which group should you add each user? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/windows-server/remote/remote-access/ras/multisite/configure/step-2-configure-the-multisite-infrastructure

• Question 192:

  SIMULATION

  You plan to promote a domain controller named DC3 in a site in Seattle.

  You need to ensure that DC3 only replicates with DC1 and DC2 between 8 PM and 6 AM.

  To complete this task, sign in the required computer or computers.

  A. See explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See explanation below.

  ---

  Explanation

  Step 1: Create a site link between Seattle and the site in which DC1 and DC2 are located (if the site link does not already exist. If the site link already exists, then skip Step 1).

  Step 2: To open Active Directory Sites and Services, click Start, click Administrative Tools, and then click Active Directory Sites and Services.

  Open Active Directory Sites and Services.

  Step 3: In the console tree, click the intersite transport folder that contains the site link for which you are configuring intersite replication availability.

  Step 4: In the details pane, right-click the site link whose schedule you want to configure, and then click Properties.

  Step 5: Click Change Schedule.

  Step 6: Select the block of time during which you want replication to be either available or not available, and then click Replication Not Available or Replication Available, respectively.

  Change the schedule to: from 8 PM to 6 AM.

  Note: Site link

  Site links are Active Directory objects that represent logical paths that the KCC uses to establish a connection for Active Directory replication. A site link object represents a set of sites that can communicate at uniform cost through a specified intersite transport.

  All sites contained within the site link are considered to be connected by means of the same network type. Sites must be manually linked to other sites by using site links so that domain controllers in one site can replicate directory changes from domain controllers in another site. Because site links do not correspond to the actual path taken by network packets on the physical network during replication, you do not need to create redundant site links to improve Active Directory replication efficiency.

  When two sites are connected by a site link, the replication system automatically creates connections between specific domain controllers in each site that are called bridgehead servers.

  References:

  https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc770712(v=ws.10)

  https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/replication/active-directory-replication-concepts

• Question 193:

  You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant.

  You plan deploy 100 new Azure virtual machines that will run Windows Server.

  You need to ensure that each new virtual machine is joined to the AD DS domain.

  What should you use?

  A. an Azure Resource Manager (ARM) template
  B. a Group Policy Object (GPO)
  C. Microsoft Entra Connect
  D. an Azure management group
  A. an Azure Resource Manager (ARM) template

  ---

  Explanation

  References:

  https://www.ludovicmedard.com/create-an-arm-template-of-a-virtual-machine-automatically-joined-to-a-domain/

• Question 194:

  HOTSPOT

  You have a Windows Server container host named Server1.

  You start the containers on Server1 as shown in the following table.

  

  You need to validate the status of ProcessA and ProcessC.

  Where can you verify that ProcessA and ProcessC are in a running state? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  ProcessA is in a container that has process isolation. So, both Container1 and the host (Server1) can see the process. Per this article "When you have a Windows container running in process isolation mode, all processes are isolated between the containers so they have no influence on each other. However, the security boundary between container host and containers is simply the process isolation itself, which means the container host has visibility into the processes running inside the container."

  https://argonsys.com/microsoft-cloud/library/how-to-identify-processes-running-inside-a-windows-container-from-the-container-host/ProcessC

  is in a hyper-V isolation container in contrast, so only Container3 can see the process.So,Container1andServer1onlyforthefirstanswer.Container3onlyforthesecondone.

• Question 195:

  SIMULATION

  You need to monitor the security configuration of DC1 by using Microsoft Defender for Cloud.

  The required source files are located in a folder named \\dc1.contoso.com\install.

  To complete this task, sign in the required computer or computers.

  A. See the explanation below
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See the explanation below

  ---

  Explanation

  You can comnect your non-Azure computers in any of the following ways:

  * Onboarding with Azure Arc:

  - By using Azure Arc-enabled servers (recommended)

  -->By using the Azure portal

  * Onboarding directy with Microsoft Defender for Endpoint

  Connect on-premises machines by using the Azure portal

  After you connect Defender for Cloud to your Azure subscription, you can start connecting your on-premises machines from the Getting started page in Defender for Cloud.

  Step 1: Sign in to the Azure portal Step 2: Search for and select Microsoft Defender for Cloud.

  Step 3: On the Defender for Cloud menu, select Getting started.

  Step 4: Select the Get started tab.

  Step 5: Find Add non-Azure servers and select Configure

  

  A list of your Log Analytics workspaces appears

  Step 6: (Optio)nal) If you don't already have a Log Analytics workspace in which to store the data, select Create new workspace, and follow the on-screen guidance.

  Step 7: From the list of workspaces, select Upgrade for the relevant workspac to turn on Defender for Cloud paid plans for 30 free days.

  Step 8: From the list of workspaces, select Add Servers for workspac

  On the Agents management page, choose one of the following procedures, depending on the type of machines you're onboarding (Either Windows or Linux) Onboard your Windows server

  When you add a Windows server, you need to get the information on the Agents management page and download the appropriate agent file (32 bit or 64 bit) To onboard a Windows server:

  Step 1: Select Windows servers.

  

  Step 2: Select the Download Windows Agent link that's applicable to your computer processor type to download the setup file.

  Step 3: From the Agents management page, copy the Workspace ID and Primary Key values into Notepad.

  Step 4: Copy the downloaded setup file to the target computer and run it.

  Step 5: Follow the installation wizard (select Next > I Agree > Next > Next).

  Step 6: On the Azure Log Analyics page, paste the Workspace ID and Primary Key values that you copied into Notepad.

  Step 7:Ifthe computer should report to a Log Analytics workspace in the Azure Govermment cloud, select Azure US Govermment from the Azure Cloud dropdown list.

  Step 8:Ifthe computer needs to communicate through aproxy server to the Log Analytics service, select Advanced. Then provide the URL and portnumber of the proxy server Step 9: When you finish entering all of the configuration settings, select Next Step 10: On the Ready to Install page, review the settings to be applied and select Install Step 11: On the Configuration completed successfuly page, select Finish.

  When the process is complete, Microsoft Monitoring agent appearsin Control Panel. You can review your configuration there and verify that the agent is conncted.

  References:

  https:/eam.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-machines

• Question 196:

  You have an on-premises server named Server1 that runs Windows Server.

  You have an Azure virtual network that contains an Azure virtual network gateway.

  You need to connect only Server1 to the Azure virtual network.

  What should you use?

  A. a Site-to-Site VPN
  B. Azure Network Adapter
  C. an ExpressRoute circuit
  D. Azure Extended Network
  B. Azure Network Adapter

  ---

  Explanation

  https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/use-azure-network-adapter

• Question 197:

  Your network contains an Active Directory Domain Services (AD DS) domain.

  You plan to use Active Directory Administrative Center to create a new user named User1.

  Which two attributes are required to create User1? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Password
  B. Profile path
  C. User SamAccountName logon
  D. Full name
  E. First name
  F. User UPN logon
  C. User SamAccountName logon
  D. Full name

  ---

  Explanation

  To create test users 1. Right click the Windows PowerShell icon, click Run as Administrator and type dsac.exe to open ADAC.

  2. Click Manage, click Add Navigation Nodes and select the appropriate target domain in the Add Navigation Nodes dialog box and then click OK.

  3. In the Tasks pane, click New and then click User.

  4. Enter the following information under Account and then click OK:

  Full name: test1

  User SamAccountName logon: test1

  Password: p@ssword1

  Confirm password: p@ssword1

  Repeat the previous steps to create a second user, test 2.

  References:

  https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/adac/introduction-to-active-directory-administrative-center-enhancements--level-100-

• Question 198:

  HOTSPOT

  You have an Active Directory Domain Services (AD DS) domain that contains a group named Group1.

  You need to create a group managed service account (gMSA) named Account1. The solution must ensure that Group1 can use Account1.

  How should you complete the script? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 199:

  DRAG DROP

  Which three actions should you perform in sequence to meet the security requirements for Webapp1?

  To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview

• Question 200:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK.

  You open a new branch office that contains only client computers.

  You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.

  Solution: You configure the Try Next Closest Site Group Policy Object (GPO) setting in a GPO that is linked to Site1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No