Microsoft AZ-801 Online Practice Questions and Exam Preparation

Microsoft AZ-801 Online Questions & Answers

• Question 141:

  HOTSPOT

  Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains an organizational unit (OU) named OU1. OU1 contains servers that run sensitive workloads.

  You plan to add connection security rules that meet the following requirements:

  1. The servers in OU1 must only accept connections from domain-joined

  2. The servers in OU1 must only be able to communicate with domain-joined

  You create a Group Policy Object (GPO) named GPO1 and link GPO1 to contoso.com.

  You need to configure a connection security rule in GPO1 by using Windows Defender Firewall with Advanced Security.

  How should you configure the rule? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 142:

  You have an Azure virtual machine named VM1.

  You enable Microsoft Defender SmartScreen on VM1.

  You need to ensure that the SmartScreen messages displayed to users are logged.

  What should you do?

  A. From a command prompt, run WinRM quickconfig.
  B. From the local Group Policy, modify the Advanced Audit Policy Configuration settings.
  C. From Event Viewer, enable the Debug log.
  D. From the Windows Security app. configure the Virus & threat protection settings.
  C. From Event Viewer, enable the Debug log.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview

• Question 143:

  DRAG DROP

  You have an Azure subscription that contains a virtual machine named VM1. VM1 is created by using a Windows Server image from Azure Marketplace.

  You need to configure Azure Backup to back up VM1. The solution must minimize storage costs.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: From the Azure portal, create a Recovery Services vault.

  Back up Azure VMs in a Recovery Services vault Create a Recovery Services vault

  A Recovery Services vault is a management entity that stores recovery points that are created over time, and it provides an interface to perform backup-related operations. These operations include taking on-demand backups, performing restores, and creating backup policies.

  Step 2: Set Storage replicate type to locally-redundant By default, vaults use geo-redundant storage (GRS).

  If the vault is your primary backup mechanism, we recommend you use GRS. *-> You can use locally redundant storage (LRS) for a cheaper option. Zone-redundant storage (ZRS) replicates your data in availability zones, guaranteeing data residency and resiliency in the same region.

  Step 3: Configure a backup policy for VM1 and perform a backup.

  Apply a backup policy

  Trigger the initial backup

  The initial backup will run in accordance with the schedule, but you can also run it immediately.

  Incorrect:

  Install the Azure VM agent on VM1

  Action: Install Azure VM agent [Skip]

  To back up Azure VMs, Azure Backup installs an extension on the VM agent running on the machine. If your VM was created from an Azure Marketplace image, the agent will be running. In some cases, for example if you create a custom VM, or you migrate a machine from on-premises, you might need to install the agent manually.

  References:

  https://learn.microsoft.com/en-us/azure/backup/backup-azure-arm-vms-prepare

• Question 144:

  You have a Windows Server failover cluster that uses Cluster-Aware Updating (CAU). You need to run a script before updates are installed and another script after updates complete.

  What should you configure?

  A. Scheduled tasks
  B. Run profiles
  C. Windows Server Update Services (WSUS)
  D. Azure Automation
  B. Run profiles

• Question 145:

  You have a server that runs Windows Server and hosts an app named App1.

  You need to prevent App1 from accessing external SMTP servers. The solution must meet the following requirements:

  1. Minimize the impact on App1's access to external HTTP servers.

  2. Minimize the impact on other apps on the server.

  3. Minimize administrative effort.

  What should you implement in Windows Defender Firewall?

  A. an outbound program rule
  B. an inbound custom rule
  C. an outbound custom rule
  D. an inbound program rule
  E. an outbound port rule
  E. an outbound port rule

• Question 146:

  HOTSPOT

  You have a Hyper-V failover cluster named Cluster1 at a main datacenter. Cluster1 contains two nodes that have the Hyper-V server role installed. Cluster1 hosts 10 highly available virtual machines.

  You have a cluster named Cluster2 in a disaster recovery site. Cluster2 contains two nodes that have the Hyper-V server role installed.

  You plan to use Hyper-V Replica to replicate the virtual machines from Cluster1 to Cluster2.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 147:

  You have 500 on-premises servers that run Windows Server.

  You have an Azure subscription that contains a Log Analytics workspace named Workspace1.

  You plan to use VM insights in Azure Monitor to monitor the on-premises servers.

  You need to onboard the servers to Azure Arc by using the template script. The solution must meet the following requirements:

  Follow the principle of least privilege.

  Minimize administrative effort.

  What should you do first?

  A. Create a group managed service account (gMSA).
  B. Generate a Log Analytics key.
  C. Create a Microsoft Entra service principal.
  D. Download the Log Analytics workspace ID.
  C. Create a Microsoft Entra service principal.

  ---

  Explanation

  Connect hybrid machines to Azure at scale

  You can enable Azure Arc-enabled servers for multiple Windows or Linux machines in your environment with several flexible options depending on your requirements. Using the template script we provide, you can automate every step of the installation, including establishing the connection to Azure Arc.

  One method to connect the machines to Azure Arc-enabled servers is to use a Microsoft Entra service principal. This service principal method can be used instead of your privileged identity to interactively connect the machine. This service principal is a special limited management identity that has only the minimum permission necessary to connect machines to Azure using the azcmagent command. This method is safer than using a higher privileged account like a Tenant Administrator and follows our access control security best practices. The service principal is used only during onboarding; it is not used for any other purpose.

  References:

  https://learn.microsoft.com/en-us/azure/azure-arc/servers/onboard-service-principal

• Question 148:

  HOTSPOT

  Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains the servers shown in the following table.

  

  For each server, Windows Defender Firewall is configured to allow only communication between servers on the same segment.

  Server1 has the following connection security rule:

  Name: Rule1

  Rule type: isolation

  Requirement: Require authentication for inbound connections and request authentication for outbound connections Authentication method: Computer (Kerberos V5) Profile: Domain, Private, Public

  Server2 does not have any connection security rules.

  Server3 has the following connection security rule:

  Name: Rule3

  Rule type: Server-to-server Endpoints Computers in Endpoint 1: 192.168:5.0/24

  Computers in Endpoint 2: 192.168.1.0/24

  Requirement: Request authentication for inbound and outbound connections Authentication method: Computer (Kerberos V5) Profile: Domain, Private, Public

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Yes - Server1 can initiate communication with Server2 successfully.

  Server1 and Server2 is in the same network segment.

  The Server1 isolation connection security rule will allow communication between Server1 and Server2. Server1 has request authentication for outbound connections.

  Server2 has no connection security rules.

  Note: Windows Defender Firewall is configured to allow only communication between servers on the same segment.

  Box 2: Yes

  Yes - Server2 can initiate communication with Server3 successfully.

  Server2 and Server3 are in different network segments.

  Server2 has no connection security rules.

  Server3 has connection rule, where Computers in Endpoint cover the Server2 and server3 network segments.

  The connection rule has request authentication for inbound and outbound connections.

  Box 3: No

  No - Server3 can initiate communication with Server1 successfully.

  The Server1 isolation connection security rule will disallow communication between Server3 and Server1, Note: A Windows Defender Firewall isolation rule restricts communication and prevents it from traversing between different network segments by design, as its primary function is to isolate computers by limiting connections based on credentials. Instead of allowing broad communication, isolation rules are configured to enforce authentication and restrict connections only to other members of the same isolated domain or specified authentication exemptions.

  References:

  https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/rules

• Question 149:

  You have an Azure subscription. The subscription contains multiple virtual machines that run Windows Server.

  You have the Azure virtual machine backup policies shown in the following table.

  

  You are evaluating automatically moving recovery points to the vault-archive tier.

  For which policies can you enable tiering?

  A. Policy2 and Policy4 only
  B. Policy4 only
  C. Policy1, Policy2, Policy3, and Policy4
  D. Policy3 and Policy4 only
  A. Policy2 and Policy4 only

  ---

  Explanation

  Policy1 - No

  Policy1 has a weekly backup frequency, and retention of 56 weeks. There is no retention policy for monthly or yearly backups.

  Policy2 - Yes

  Policy1 has a daily backup frequency, and retention of 90 weeks for daily backups, and 6 months for monthly backups.

  Policy3 - No

  Policy3 has a daily backup frequency, and retention of 180 days. Policy1 has a weekly backup frequency, and retention of 56 weeks. There is no retention policy for monthly or yearly backups.

  Policy4 - Yes Nore:

  What are the possible reasons if my VM recovery point was not moved to archive? Before you move VM recovery points to archive tier, ensure that the following criteria are met:

  The recovery point should be a monthly or yearly recovery point. The age of the recovery point in standard tier needs to be >= 3 months.

  The remaining retention duration should be >= 6 months.

  There should be no unexpired daily or weekly recovery point between the recovery point in consideration and the next monthly or yearly recovery point.

  Note 2: In Azure VM backup policies, tiering refers to a strategy of storing different recovery points in different storage tiers to optimize cost and performance. Typically, recent, frequently accessed recovery points are stored in a Standard Tier (also called the "instant recovery tier" or "snapshot tier") for rapid restores, while older data is moved to a lower-cost Archive Tier for long-term retention. This allows you to meet compliance needs and reduce costs by keeping less critical, older backups in cheaper, slower storage.

  References:

  https://learn.microsoft.com/en-us/azure/backup/archive-tier-support

• Question 150:

  Your on-premises network is connected to Azure.

  You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server.

  You need to identify the latency between the on-premises network and VM1.

  Which Azure Network Watcher settings should you use?

  A. IP flow verify
  B. Connection monitor
  C. VPN troubleshoot
  D. Connection troubleshoot
  B. Connection monitor