Microsoft Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-800 Questions & Answers

• Question 41:

  Your network contains an on -premises Active Directory Domain Services (AD DS) domain named contoso.com The domain contains the objects shown in the following table.

  

  You plan to sync contoso.com with an Azure Active Directory (Azure AD) tenant by using Azure AD Connect You need to ensure that all the objects can be used in Conditional Access policies

  What should you do?

  A. Change the scope of Group2 to Universal.

  B. Clear the Configure device writeback option.

  C. Change the scope of Group1 and Group2 to Global.

  D. Select the Configure Hybrid Azure AD join option.

  Correct Answer: D

  Hybrid Azure AD join needs to be configured to enable Computer1 to be used in Conditional Access Policies. Synchronized users, universal groups and domain local groups can be used in Conditional Access Policies.

• Question 42:

  Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains three servers that run Windows Server and have the Hyper-V server role installed. Each server has a

  Switch Embedded Teaming (SET) team.

  You need to verify that Remote Direct Memory Access (RDMA) and all the required Windows Server settings are configured properly on each server to support an Azure Stack HCI cluster.

  What should you use?

  A. Server Manager.

  B. The validate-DCB cmdtet.

  C. The Get-NetAdaptor cmdlet.

  D. Failover Cluster Manager.

  Correct Answer: B

  Reference: https://github.com/Microsoft/Validate-DCB

• Question 43:

  You have an Azure subscription that contains the following resources.

  1.

  An Azure Log Analytics workspace

  2.

  An Azure Automation account

  3.

  Azure Arc

  You have an on-premises server named Server1 that is onboarded to Azure Arc.

  You need to manage Microsoft updates on Server1 by using Azure Arc.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Add Microsoft Sentinel to the Log Analytics workspace.

  B. On Server1, install the Azure Monitor agent.

  C. From the Automation account, enable Update Management for Server1.

  D. From the Virtual machines data source of the Log Analytics workspace, connect Server1.

  Correct Answer: BC

  Reference: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/arc-update-management

• Question 44:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are planning the deployment of DNS to a new network.

  You have three internal DNS servers as shown in the following table.

  

  The contoso.local zone contains zone delegations for east.conloso.local and west.contoso.local. All the DNS servers use root hints. You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.

  Solution: On Server2 and Server3, you configure a conditional forwarder for contoso.local. Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 45:

  You have servers that have the DNS Server role installed. The servers are configured as shown in the following table.

  

  All the client computers in the New York office use Server2 as the DNS server.

  You need to configure name resolution in the New York office to meet the following requirements:

  1.

  Ensure that the client computers in New York can resolve names from contoso.com.

  2.

  Ensure that Server2 forwards all DNS queries for internet hosts to 131. 107.100.200.

  The solution must NOT require modifications to Server1.

  Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a forwarder

  B. a conditional forwarder

  C. a delegation

  D. a secondary zone

  E. a reverse lookup zone

  Correct Answer: AB

  A conditional forwarder is required for contoso.com.

  A forwarder is required for all other domains.

  When you have a conditional forwarder and a forwarder configured, the conditional forwarder will be used for the specified domain.

  You could use a secondary zone for contoso.com but that would require a configuration change on Server1.

• Question 46:

  You have an Azure virtual machine named VM1 that runs Windows Server.

  You need to configure the management of VM1 to meet the following requirements:

  1.

  Require administrators to request access to VM1 before establishing a Remote Desktop connection.

  2.

  Limit access to VM1 from specific source IP addresses.

  3.

  Limit access to VM1 to a specific management port. What should you configure?

  A. a network security group (NSG)

  B. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)

  C. Microsoft Defender for Cloud

  D. Azure Front Door

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc

• Question 47:

  Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a DNS server named Server1. Server1 hosts a DNS zone named fabrikam.com that was signed by DNSSEC.

  You need to ensure that all the member servers in the domain perform DNSSEC validation for the fabrikam.com namespace.

  What should you do?

  A. On Server1, run the Add-DnsServerTrustAnchorcmdlet.

  B. On each member server, run the Add-DnsServerTrustAnchorcmdlet.

  C. From a Group Policy Object (GPO), add a rule to the Name Resolution Policy Table (NRPT).

  D. From a Group Policy Object (GPO), modify the Network List Manager policies.

  Correct Answer: C

• Question 48:

  You have five file servers that run Windows Server.

  You need to block users from uploading video files that have the .mov extension to shared folders on the file servers. All other types of files must be allowed. The solution must minimize administrative effort.

  What should you create?

  A. a Dynamic Access Control central access policy

  B. a data loss prevention (DLP) policy

  C. a Dynamic Access Control central access rule

  D. a file screen

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/windows-server/storage/fsrm/file-screening-management

• Question 49:

  You have a server that runs Windows Server and has the DHCP Server role installed. The server has a scope named Scope1 that has the following configurations:

  1.

  Address range: 192.168.0.2 to 192. 168.1.254

  2.

  Mask: 255.255.254.0

  3.

  Router: 192.168.0.1

  4.

  Lease duration: 3 days

  5.

  DNS server: 172.16.0.254

  You have 50 Microsoft Teams Phone devices from the same vendor. All the devices have MAC addresses within the same range.

  You need to ensure that all the Teams Phone devices that receive a lease from Scope1 have IP addresses in the range of 192.168.1.100 to 192.168.1.200. The solution must NOT affect other DHCP clients that receive IP configurations from

  Scope1.

  What should you create?

  A. a scope

  B. a filter

  C. scope options

  D. a policy

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn425040(v=ws.11)

• Question 50:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are planning the deployment of DNS to a new network.

  You have three internal DNS servers as shown in the following table.

  

  The contoso.local zone contains zone delegations for east.contoso.local and west.contoso.local. All the DNS servers use root hints.

  You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.

  Solution: You configure Server2 and Server3 to forward DNS requests to 10.0.1.10.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B