Microsoft AZ-800 Online Practice Questions and Exam Preparation

Microsoft AZ-800 Online Questions & Answers

• Question 221:

  HOTSPOT

  You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant.

  You have an on-premises web app named WebApp1 that only supports Kerberos authentication.

  You need to ensure that users can access WebApp1 by using their Microsoft Entra account. The solution must minimize administrative effort.

  What should you configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-application

• Question 222:

  You have an on-premises server named Server1 that runs Windows Server. Server1 contains an app named App1 and a firewall named Firewall1.

  You have an Azure subscription.

  Internal users connect to App1 by using WebSockets.

  You need to make App1 available to users on the internet. The solution must minimize the number of inbound ports open on Firewall1.

  What should you include in the solution?

  A. Microsoft Application Request Routing (ARR) Version 2
  B. Azure Application Gateway
  C. Azure Relay
  D. Web Application Proxy
  C. Azure Relay

• Question 223:

  SIMULATION

  You plan to delegate the management of a DNS zone named fabrikam.com located on DC1 to the BranchAdmins group.

  You need to ensure that you can grant permissions to the fabikam.com zone.

  To complete this task, sign in the required computer or computers.

  A. See explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See explanation below.

  ---

  Explanation

  You can create these DNS delegation records before you install DNS server.

  Step 1: To create a zone delegation, open DNS Manager.

  Step 2: Right-click the parent domain. In our case: fabrikam.com

  Step 3: Click New Delegation.

  The New Delegation Wizard starts.

  Step 4: In the New Delegation Wizard, on the Welcome page, click Next.

  Step 5: On the Delegated Domain Name page, as shown below, in the Delegated domain box, type the subdomain name. In this case fabrikam.com.

  

  Step 6: On the Name Servers page, click Add.

  Step 7: In the New Name Server Record dialog box, on the Server Fully Qualified Domain name (FQDN) box, type the name of the DNS server that hosts the new delegated zone, click Resolve, and then click OK.

  Step 8: On the Name Servers page, click Next, and then click Finish.

  References:

  https://www.microsoftpressstore.com/articles/article.aspx?p=2756482&seqNum=2

• Question 224:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are planning the deployment of DNS to a new network.

  You have three internal DNS servers as shown in the following table.

  

  The contoso.local zone contains zone delegations use root hints.

  You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.

  Solution: On Server2, you create a conditional forwarder for contoso.local and west.contoso.local. On Server3, you create a conditional forwarder for contoso.local and east.contoso.local.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

• Question 225:

  HOTSPOT

  You have 10 on-premises servers that run Windows Server.

  You plan to use Azure Network Adapter to connect the servers to the resources in Azure.

  Which prerequisites do you require on-premises and in Azure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/use-azure-network-adapter

• Question 226:

  You have an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with Microsoft Entra by using Microsoft Entra Connect.

  You enable password protection for contoso.com.

  You need to prevent users from including the word contoso as part of their password.

  What should you use?

  A. the Azure Active Directory admin center
  B. Active Directory Users and Computers
  C. Synchronization Service Manager
  D. Windows Admin Center
  A. the Azure Active Directory admin center

  ---

  Explanation

  To prevent users from including the word "contoso" as part of their password in an on-premises Active Directory (AD DS) domain that syncs with Microsoft Entra using Microsoft Entra Connect, you should use Microsoft Entra Password Protection.

  Therefore, the correct option is: "the Azure Active Directory admin center"

• Question 227:

  You need to implement an availability solution for DHCP that meets the networking requirements.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. On DHCP1, create a scope that contains 25 percent of the IP addresses from Scope2.
  B. On the router in each office, configure a DHCP relay.
  C. DHCP2, configure a scope that contains 25 percent of the IP addresses from Scope1.
  D. On each DHCP server, install the Failover Clustering feature and add the DHCP cluster role.
  E. On each DHCP scope, configure DHCP failover.
  B. On the router in each office, configure a DHCP relay.
  E. On each DHCP scope, configure DHCP failover.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831385(v=ws.11)

• Question 228:

  HOTSPOT

  Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the domain controllers shown in the following table.

  

  You need to configure DC3 to be the authoritative time server for the domain.

  Which operations master role should you transfer to DC3, and which console should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: PDC emulator

  How to configure an authoritative time server in Windows Server

  To configure the PDC in the root of an Active Directory forest to synchronize with an external time source, follow these steps:

  Change the server type to NTP. To do this, follow these steps:

  1. Select Start > Run, type regedit, and then select OK.

  2. Locate and then select the following registry subkey:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters In the pane on the right, right-click Type, and then select Modify.

  In Edit Value, type NTP in the Value data box, and then select OK.

  3. Set AnnounceFlags to 5. To do this, follow these steps:

  Etc.

  Box 2: Active Directory Users and Computers Transfer FSMO Roles Using ADUC GUI Just like PowerShell you need to log into the server that you will be transferring to.

  Open the Active Directory Users and Computers console, then right-click on the domain and click on operations masters.

  

  You should now see a screen with three tabs (RID, PDC, and Infrastructure).

  

  To transfer one of these roles just click on the change button. You can't select which domain controller to transfer the role to, that is why you need to log into the server that you want to transfer to. if I wanted to transfer the RID role to DC3 I would log into that server.

  References:

  https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/configure-authoritative-time-server

  https://activedirectorypro.com/transfer-fsmo-roles

• Question 229:

  DRAG DROP

  You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.

  You deploy a server to the domain and configure the server to run a service.

  You need to ensure that the service can use a group managed service account (gMSA) to authenticate.

  Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 230:

  Your network contains an Active Directory Domain Services (AD DS) domain.

  The domain contains servers that run Windows Server and computers that run Windows.

  You link a Group Policy Object (GPO) to the domain and set Turn on BranchCache to Enabled.

  You need to enable BranchCache in BranchCache Distributed Cache mode.

  What should you configure on the computers?

  A. Backg6ro6und Intelligent Transfer Service (BITS)
  B. Offline Files
  C. Advanced sharing settings
  D. Windows Firewall inbound traffic rules
  D. Windows Firewall inbound traffic rules

  ---

  Explanation

  Use Group Policy to Configure Domain Member Client Computers

  You can create a Group Policy Object for all of the computers in your organization, configure domain member client computers with distributed cache mode or hosted cache mode, and then configure Windows Firewall with Advanced Security to allow BranchCache traffic.

  Note:

  To configure Windows Firewall with Advanced Security Inbound Traffic Rules 1. In the Group Policy Management console, expand the following path:

  Forest: example.com, Domains, example.com, Group Policy Objects, where example.com is the name of the domain where the BranchCache client computer accounts that you want to configure are located.

  2. In the Group Policy Management console, ensure that Group Policy Objects is selected, and in the details pane right-click the BranchCache client computers GPO that you created previously. For example, if you named your GPO

  BranchCache Client Computers, right-click BranchCache Client

  Computers. Click Edit. The Group Policy Management Editor console opens.

  3. In the Group Policy Management Editor console, expand the following path: Computer Configuration, Policies, Windows Settings, Security Settings, Windows Firewall with Advanced Security, Windows Firewall with Advanced Security - LDAP, Inbound Rules.

  4. Right-click Inbound Rules, and then click New Rule. The New Inbound Rule Wizard opens.

  5. In Rule Type, click Predefined, expand the list of choices, and then click BranchCache - Content Retrieval (Uses HTTP). Click Next.

  6. In Predefined Rules, click Next.

  7. In Action, ensure that Allow the connection is selected, and then click Finish.

  8. To create the WS-Discovery firewall exception, again right-click Inbound Rules, and then click New Rule. The New Inbound Rule Wizard opens.

  9. In Rule Type, click Predefined, expand the list of choices, and then click BranchCache - Peer Discovery (Uses WSD). Click Next.

  10. In Predefined Rules, click Next.

  11. In Action, ensure that Allow the connection is selected, and then click Finish.

  Important

  You must select Allow the connection for the BranchCache client to be able to receive traffic on this port.

  References:

  https://learn.microsoft.com/en-us/windows-server/networking/branchcache/deploy/use-group-policy-toconfigure-domain-member-client-computers