Microsoft AZ-800 Online Practice Questions and Exam Preparation

Microsoft AZ-800 Online Questions & Answers

• Question 61:

  DRAG DROP

  Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site.

  You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1.

  You need to recommend a deployment plan that meets the following requirements:

  1. Ensures that a user named User1 can perform the RODC installation on Server1

  2. Ensures that you can control the AD DS replication schedule to the Server1

  3. Ensures that Server1 is in a new site named RemoteSite1

  4. Uses the principle of least privilege

  Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Box 1.

  We need to create a site and subnet for the remote site. The new site will be added to the Default IP Site Link so we don't need to create a new site link. You configure the replication schedule on the site link.

  Box 2.

  When we pre-create an RODC account, we can specify who is allowed to attach the server to the prestaged account. This means that the User1 does not need to be added to the Domain Admins group.

  Box3.

  User1 can connect the RODC to the prestaged account by running the AD DS installation wizard.

  References:

  https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/rodc/install-a-windows-server-2012-active-directory-read-only-domain-controller--rodc---level-200-

• Question 62:

  You have an on-premises server named Server1 that runs Windows Server 2022 and is a container host.

  You have an Azure subscription.

  You plan to develop custom container images.

  You need to recommend a storage solution for the containers.

  The solution must meet the following requirements:

  1. Support the use of Docker commands.

  2. Minimize administrative effort

  What should you include in the recommendation?

  A. Azure Container instances
  B. Azure Kubernetes Service (AKS)
  C. Azure Container Registry
  D. Azure Files
  C. Azure Container Registry

  ---

  Explanation

  You can deploy a custom-configured Windows image from Visual Studio to make OS changes that your app needs. This makes it easy to migrate an on-premises app that requires a custom OS and software configuration.

  Configure Windows container

  In Solution Explorer, right-click the CustomFontSample project and select Add > Container Orchestration Support.

  Select Docker Compose > OK.

  Your project is now set to run in a Windows container. A Dockerfile is added to the CustomFontSample project, and a docker-compose project is added to the solution.

  Publish to Azure Container Registry Azure Container Registry can store your images for container deployments. You can configure App Service to use images that are hosted in Azure Container Registry.

  References:

  https://learn.microsoft.com/en-us/azure/app-service/tutorial-custom-container

• Question 63:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise. select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 64:

  You have an Azure virtual machine named VM1 that runs Windows Server.

  You need to ensure that administrators request access to VM1 before establishing a Remote Desktop connection.

  What should you configure?

  A. Azure Front Door
  B. Microsoft Defender for Cloud
  C. Microsoft Entra Privileged Identity Management (PIM)
  D. a network security group (NSG)
  B. Microsoft Defender for Cloud

  ---

  Explanation

  Enable just-in-time access on VMs

  You can use Microsoft Defender for Cloud's just-in-time (JIT) access to protect your Azure virtual machines (VMs) from unauthorized network access. Many times firewalls contain allow rules that leave your VMs vulnerable to attack. JIT lets you allow access to your VMs only when the access is needed, on

  the ports needed, and for the period of time needed.

  References:

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc

• Question 65:

  SIMULATION

  You need to configure Hyper-V to ensure that running virtual machines can be moved between SRV1 and SRV2 without downtime.

  You do NOT need to move any virtual machines at this time.

  To complete this task, sign in the required computer or computers.

  A. See the explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See the explanation below.

  ---

  Explanation

  One possible solution to configure Hyper-V to ensure that running virtual machines can be moved between SRV1 and SRV2 without downtime is to use Live Migration. Live Migration is a feature of Hyper-V that allows you to move a running virtual machine from one host to another without any noticeable interruption of service. To set up Live Migration between SRV1 and SRV2, you need to perform the following steps:

  On both SRV1 and SRV2, openHyper-V Managerfrom theAdministrative Toolsmenu or by typingvirtmgmt.mscin the Run box.

  In the left pane, right-click on the name of the server and selectHyper-V Settings.

  In theHyper-V Settingsdialog box, selectLive Migrationsin the navigation pane.

  Check the boxEnable incoming and outgoing live migrations.

  UnderAuthentication protocol, select the method that you want to use to authenticate the live migration traffic between the servers. You can choose eitherKerberosorCredSSP. Kerberos does not require you to sign in to the source server before starting a live migration, but it requires you to configure constrained delegation on the domain controller. CredSSP does not require you to configure constrained delegation, but it requires you to sign in to the source server through a local console session, a Remote Desktop session, or a remote Windows PowerShell session. For more information on how to configure constrained delegation, seeConfigure constrained delegation.

  UnderPerformance options, select the option that best suits your network configuration and performance requirements. You can choose eitherTCP/IPorCompressionorSMB. TCP/IP uses a single TCP connection for the live migration traffic.

  Compression uses multiple TCP connections and compresses the live migration traffic to reduce the migration time and network bandwidth usage. SMB uses the Server Message Block (SMB) 3.0 protocol and can leverage SMB features such as SMB Multichannel and SMB Direct. For more information on how to choose the best performance option, seeChoose a live migration performance option.

  UnderAdvanced Features, you can optionally enable theUse any available network for live migrationoption, which allows Hyper-V to use any available network adapter on the source and destination servers for live migration. If you do not enable this option, you need to specify one or more network adapters to be used for live migration by clicking on theAddbutton and selecting the network adapter from the list. You can also change the order of preference by using theMove UpandMove Downbuttons.

  ClickOKto apply the settings.

  Now, you have configured Hyper-V to enable live migration between SRV1 and SRV2. You can use Hyper-V Manager or Windows PowerShell to initiate a live migration of a running virtual machine from one server to another.

• Question 66:

  You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant. The on-premises network is connected to Azure by using a Site-to-Site VPN.

  You have the DNS zones shown in the following table.

  

  You need to ensure that names from fabrikam.com can be resolved from the on-premises network.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Create a stub zone for fabrikam.com on DC1.
  B. Create a conditional forwarder for fabrikam.com on DC1.
  C. Create a secondary zone for fabrikam.com on DC1.
  D. Deploy an Azure virtual machine that runs Windows Server. Modify the DNS Servers settings for the virtual network.
  E. Deploy an Azure virtual machine that runs Windows Server. Configure the virtual machine as a DNS forwarder.
  B. Create a conditional forwarder for fabrikam.com on DC1.
  E. Deploy an Azure virtual machine that runs Windows Server. Configure the virtual machine as a DNS forwarder.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-dns#on-premises-workloads-using-a-dns-forwarder

• Question 67:

  HOTSPOT

  You need to meet technical requirements for HyperV1.

  Which command should you run? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: hvc.exe

  A direct SSH session must be used to manage all the supported virtual machines on HyperV1.

  HyperV1 has the Hyper-V role.

  HyperV1 contains the virtual machines shown in the following table.

  * VM1 with Windows Server 2022 Datacenter. VM1 contains a local user named User1.

  * VM2 with Red Hat Enterprise Linux (RHEL). VM2 contains a local user named User2.

  * VM3 with Windows Server 2022 standard

  All the virtual machines on HyperV1 have only the default management tools installed.

  PowerShell Direct & HVC

  If you want to interact with your virtual machine running on Windows 10, you can use the Hyper-V Manager and the console to interact with the operating system directly. However, there are also two other options that allow you to manage and access the VMs using the command line. PowerShell Direct lets you create a PowerShell remoting session to the virtual machine using the VM Bus, so no networking is required. The same applies to Linux virtual machines and the HVC tool, which allows you to create an SSH connection directly into the VM. Both options also allow you to copy files to and from virtual machines.

  How to connect to Linux VMs using SSH Direct

  To connect to Linux VMs using SSH Direct (HVC) type hvc.exe into the command line or PowerShell. This will give you all the possible command options. Of course, SSH has to be configured inside the Linux virtual machine.

  hvc ssh Thomas@VMNAME

  To make this work, the SSH server inside the VM needs to be configured.

  Box 2: User2@VM2

  Only VM2 is Linux.

  VM2 contains a local user named User2

  Incorrect:

  * Connect-PSSession

  Reconnects to disconnected sessions.

  The Connect-PSSession cmdlet reconnects to user-managed PowerShell sessions (PSSessions) that were disconnected. It works on sessions that are disconnected intentionally, such as by using the Disconnect-PSSession cmdlet or the InDisconnectedSession parameter of the Invoke-Command cmdlet, and those that were disconnected unintentionally, such as by a temporary network outage.

  Example: Reconnect to a session Connect-PSSession -ComputerName Server01 -Name ITTask

  Id Name ComputerName State ConfigurationName Availability

  -- ---- ------------ ----- ----------------- ------------ 4 ITTask Server01 Opened ITTasks Available

  This command reconnects to the ITTask session on the Server01 computer.

  * Connect-WSMan

  Description

  This cmdlet is only available on the Windows platform.

  The Connect-WSMan cmdlet connects to the WinRM service on a remote computer, and it establishes a persistent connection to the remote computer. You can use this cmdlet in the context of the WSMan provider to connect to the WinRM service on a remote computer. However, you can also use this cmdlet to connect to the WinRM service on a remote computer before you change to the WSMan provider. The remote computer appears in the root directory of the WSMan provider.

  About WS-Management

  Windows Remote Management is the Microsoft implementation of the WS-Management protocol, a standard SOAP-based, firewall-friendly protocol that allows hardware and operating systems from different vendors to interoperate. The WS-Management protocol specification provides a common way for systems to access and exchange management information across an information technology (IT) infrastructure. WS-Management and Intelligent Platform Management Interface (IPMI), along with the Event Collector, are components of the Windows Hardware Management features.

  * mstsc.exe

  It is a command interface to run Microsoft Remote Desktop Client (Remote Desktop Connection) in Windows. Then, you can establish a connection to a remote computer on the same network or different networks, if the Remote Desktop has been enabled on the remote PC.

  References:

  https://techcommunity.microsoft.com/t5/itops-talk-blog/hyper-v-for-developers-on-windows-10/ba-p/1062570

  https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/connect-pssession

  https://learn.microsoft.com/en-us/powershell/module/microsoft.wsman.management/connect-wsman

• Question 68:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a server named Server1 that runs Windows Server 2022 and has the DHCP Server role. Server1 contains a single DHCP scope named Scope1.

  You deploy five printers to the network.

  You need to ensure that the printers are always assigned the same IP address.

  Solution: You configure the DHCP scope options for Scope1.

  Does this meet the requirement?

  A. Yes
  B. No
  B. No

• Question 69:

  Your network contains a multi-site Active Directory Domain Services (AD DS) forest. Each Active Directory site is connected by using manually configured site links and automatically generated connections.

  You need to minimize the latency for changes to Active Directory.

  What should you do?

  A. For each site links, modify the site link costs.
  B. Create a site link bridge that contains all the site links.
  C. For each site link, modify the options attribute.
  D. For each site link, modify the replication schedule.
  C. For each site link, modify the options attribute.

  ---

  Explanation

  Reconfigure the link site option to use notification.

  Details: Active Directory - Change Notification (Inter-Site Replication)

  Since we know Active Directory, we know also that its replication works automatically between the domain controllers. The lowest value of this replication schedule is 15 minutes. You can't get lower. If there aren't that many frequent changes, or the active directory site is not large (probably with only one site) then this value should work for you.

  But what if your active directory environment is larger? What if you have more than one site, on different locations, with different networks? Or what if you've got some remotedesktop services running in your main site and some users working with them in a branch office? What about the "I forgot my password" cases?

  Well, there is a solution for you. We can tune-up the Active Directory Inter-Site Replication. The inter-site replication works also automatically, and you can also schedule the replication only for 15 minutes. But there are some settings we can tweak to get the domain controllers pulling the changes made recently.

  1. First open "Active Directory Sites and Services" on your primary domain controller (that's the icon with the blue "building").

  2. Let's start now with the tuning operation. Expand "Sites" and "Inter-Site Transports" (if you haven't already). Click on the IP folder.

  3. Now right-click (or double-click) on your site link on the right hand side. If you did not rename it, it's just the DEFAULTIPSITELINK. Then click "Properties". Then click on the "Attribute Editor" tab.

  4. The attribute we should edit is called "options".

  We now have to change this attribute to a specific value which allows us to tweak the inter-site replication.

  Value, Explanation 1 USE_NOTIFY (use this setting!) 2 TWOWAY_SYNC 4 DISABLE_COMPRESSION

  Incorrect:

  Not B: Two scenarios in which you need a site link bridge design to control replication flow include controlling replication failover and controlling replication through a firewall.

  Not D: The minimal replication schedule is 15 minutes. When you use manual site link replication interval is set to 15 minutes and cannot be lowered further.

  References:

  https://www.driftar.ch/2016/10/26/active-directory-change-notification-inter-site-replication/

• Question 70:

  HOTSPOT

  Your network contains an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.

  You need to configure a password policy for the local user accounts on the Azure virtual machines joined to contoso.com.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: AAD DC Administrators group

  To create a custom password policy in a managed domain, you must be signed in to a user account that's a member of the AAD DC Administrators group.

  Box 2: AADDC Users organizational unit (OU)

  Password policies can only be applied to groups. In the Locations dialog, expand the domain name, such as aaddscontoso.com, then select an OU, such as AADDC Users. If you have a custom OU that contains a group of users you wish to apply, select that OU.

  References:

  https://learn.microsoft.com/en-us/azure/active-directory-domain-services/password-policy