Microsoft AZ-801 Online Practice Questions and Exam Preparation

Microsoft AZ-801 Online Questions & Answers

• Question 171:

  You have two servers named Server1 and Server2 that run Windows Server and have the Hyper-V role installed.

  You plan to deploy Hyper-V Replica between Server1 and Server2. The deployment will use certificate based authentication.

  You need to configure the prerequisites for the Hyper-V Replica deployment.

  Which two actions should you perform on each server? Each correct answer presents part of the solution.

  NOTE: Each correct answer is worth one point.

  A. Create a self-signed certificate.
  B. Enable the Hyper-V Replica HTTP Listener (TCP-In) firewall rule.
  C. Enable the Hyper-V Replica HTTPS Listener (TCP-In) firewall rule.
  D. Install a trusted user certificate.
  E. Install a trusted computer certificate.
  C. Enable the Hyper-V Replica HTTPS Listener (TCP-In) firewall rule.
  E. Install a trusted computer certificate.

  ---

  Explanation

  [C] Set up the firewall

  To allow replication between the primary and secondary servers, traffic must get through the Windows Firewall (or any other third-party firewalls). When you installed the Hyper-V role on the servers by default exceptions for HTTP (80) and HTTPS (443) are created. If you're using these standard ports, you'll just need to enable the rules:

  To enable the rules on a standalone host server:

  Open Windows Firewall with Advance Security and click Inbound Rules.

  To enable HTTP (Kerberos) authentication, right-click Hyper-V Replica HTTP Listener (TCP-In) > Enable Rule.

  To enable HTTPS certificate-based authentication, right-click Hyper-V Replica HTTPS Listener (TCP-In) > Enable Rule.

  [E]

  For Hyper-V Replica with certificate-based authentication, both the primary and replica Hyper-V servers need X.509 v3 certificates with Server and Client Authentication extended key usage (EKU), exported private keys, and the host's FQDN in the subject name, installed in the local computer's Personal store. You also need network connectivity, enabled firewall rules for HTTPS, and the root certificate must be trusted on both the primary and replica servers.

  Certificate Requirements Type: X.509 v3 certificate.

  Purpose (EKU): Must include both Server Authentication and Client Authentication.

  Subject Name: Must match the FQDN (Fully Qualified Domain Name) of the Hyper-V host.

  Private Key: Must be exportable for encryption of replication data.

  Installation: Installed in the local computer's Personal store on both the primary and replica servers.

  Trust Chain: The certificate must be signed by a trusted root certificate authority (internal or self-signed) and the root certificate must be installed in the Trusted Root Certification Authorities store on the corresponding server.

  References:

  https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/manage/set-up-hyper-v-replica

• Question 172:

  HOTSPOT

  You have a Windows Server failover cluster named Cluster1 that has a cloud witness and the nodes shown in the following table.

  

  Cluster1 has the roles shown in the following table.

  

  Cluster1 has the following configuration.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1. Yes.

  Node 4 has the file server role and is in the same site as node 3. As node 4 is not assigned vote, this means that node 4 will not take part in voting but it can still run the file server service. Furthermore, in multi-stie configuration, failover preference will be on the node in the same site (node 4)

  2. No.

  As node 1 is in the same site as node 2, the preference will be to failover the DFS role on node 1.

  3. Yes

  Site 1 has 2 nodes with the DFS role. Even if site 2 fails, 3 votes will still be remaining (node1, node2 and cloud witness) which is sufficient to maintain quorum.

• Question 173:

  You have 10 servers that run Windows Server in a workgroup.

  You need to configure the servers to encrypt all the network traffic between the servers.

  The solution must be as secure as possible.

  Which authentication method should you configure in a connection security rule?

  A. NTLMv2
  B. pre-shared key
  C. KerberosV5
  D. computer certificate
  D. computer certificate

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/create-an-authentication-request-rule

• Question 174:

  HOTSPOT

  You have an Azure subscription that contains a network security group (NSG) named NSG1 and a virtual network named VNet1.

  NSG1 contains only default security rules. VNet1 contains the subnets shown in the following table.

  

  The subscription contains virtual machines that run Windows Server as shown in the following table.

  

  You configure just-in-time (JIT) VM access as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Yes - From VM1, a Remote Desktop connection to VM3 will be terminated after three hours.

  VM1 is connected to Subnet1, listening ports is 3389, and is associated with NSG1.

  Subnet1 has IP address space 10.10.0.0/24.

  VM3 is connected to Subnet3, listening ports is 3389 and 8080, and is associated with NSG1.

  Subnet3 has IP address space 192.168.10.0/24.

  JIT VM access is allowed on port 3389, IP range allows Subnet1 and Subnet3, and time range is 3 hours.

  Note: NSG1 contains only default security rules.

  The standard port for a Remote Desktop connection, using the Remote Desktop Protocol (RDP), is TCP port 3389.

  Box 2: No

  No - From VM2, you must request access before you can establish a Remote Desktop connection to VM1.

  Per request is configured only for the 8080 Port.

  Box 3: Yes

  Yes-From VM3, you can establish a Remote Desktop connection to VM1 without requesting access.

  References:

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview

• Question 175:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a server named Server1 that runs Windows Server.

  You need to ensure that only specific applications can modify the data in protected folders on Server1.

  Solution: From Virus & threat protection, you configure Controlled folder access.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/customize-controlled-folders?view=o365-worldwide

• Question 176:

  You have an Azure virtual machine named VM1 that runs Windows Server.

  You plan to deploy a new line-of-business (LOB) application to VM1.

  You need to ensure that the application can create child processes.

  What should you configure on VM1?

  A. Microsoft Defender Credential Guard
  B. Microsoft Defender Application Control
  C. Microsoft Defender SmartScreen
  D. Exploit protection
  D. Exploit protection

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/customize-exploit-protection?view=o365-worldwide

• Question 177:

  DRAG DROP

  You have an Azure virtual machine named VM1 that runs Windows Server. VM1 has boot diagnostics configured to use a managed storage account.

  You are troubleshooting connectivity issue on VM1.

  You need to run a PowerShell cmdlet on VM1 by using the Azure Serial Console.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 178:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an on-premises server named Server1 that runs Windows Server.

  You have a Microsoft Sentinel instance.

  You add the Windows Firewall data connector in Microsoft Sentinel.

  You need to ensure that Microsoft Sentinel can collect Windows Firewall logs from Server1.

  Solution: You install the Log Analytics agent on Server1 Does this meet the goal?

  A. Yes
  B. No
  A. Yes

• Question 179:

  HOTSPOT

  You have an Azure subscription. The subscription contains two virtual machines named VM1 and VM2 that run Windows Server.

  You need to use Azure Network Watcher to meet the following requirements:

  Identify security rules that prevent network traffic from reaching VM1.

  Identity the source region of packets sent to VM2.

  What should you use for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  IP flow verify is the Azure Network Watcher feature used to determine whether traffic to or from a VM is allowed or denied. If the traffic is denied, it identifies the specific security rule that blocked the traffic, so it is the correct tool for finding which security rules prevent traffic from reaching VM1. :contentReference[oaicite:0]{index=0}

  Traffic Analytics analyzes flow logs and provides visibility into traffic flow patterns across Azure regions and the internet. It can be used to understand where traffic is coming from, including regional traffic insights, so it is the correct tool for identifying the source region of packets sent to VM2. :contentReference[oaicite:1]{index=1}

  Connection troubleshoot is used to test connectivity between endpoints, Next hop is used to identify the next hop type for traffic routing, and Packet capture is used to capture packets from a VM. These tools do not directly identify the blocking security rule or summarize packet source regions the way the required answers do. :contentReference[oaicite:2]{index=2}

• Question 180:

  Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains a user named User1.

  You deploy a read-only domain controller (RODC) named RODC1.

  You need to ensure that User1 is a local administrator on RODC1. The solution must use the principle of least privilege.

  What should you use?

  A. ntdsutil.exe
  B. dsamain.exe
  C. net user
  D. Local Users and Groups
  D. Local Users and Groups

  ---

  Explanation

  Correct:

  Computer Management

  Local Users and Groups

  Note: See Step 6 below.

  1. Click Start > Computer Management

  

  2. In the console tree navigate to Computer Management > System Tools > Local Users and Groups > Users 3. In Actions menu click More Actions > New user

  4. Fill in the user information and adjust password settings.

  5. Click Create and then click Close

  

  In the console tree navigate to Computer Management > System Tools > Local Users and Groups > Groups 7. Right-click Administrators. Select Properties

  8. Click Add 9. Enter the name of the User created in Step 5

  10. Click Check Names. Then click OK > OK

  

  Incorrect:

  * Active Directory Sites and Services

  Active Directory Sites and Services is used for managing replication topology and site configuration, not for granting local administrator access to a read-only domain controller (RODC).

  Active Directory Users and Computers could be used.

  * dsamain.exe dsamain.exe is the Active Directory Database Mounting Tool on Windows Servers, used to mount a snapshot or backup of the Active Directory (AD) or AD LDS database. It exposes the database as an LDAP server, allowing administrators to access and analyze the data offline without affecting the live environment, which is useful for data recovery, auditing, and forest recovery purposes.

  * dsmgmt.exe dsmgmt.exe is an interactive, command-line tool included in Windows Server that facilitates the management of Active Directory Lightweight Directory Services (AD LDS) and related features, such as FSMO roles, partitioning, and metadata cleanup. It requires an elevated command prompt and provides a text-based interface for various tasks related to AD LDS and abandoned domain controller cleanup.

  * net user

  The net user command allows you to add, modify, or delete user accounts, and display detailed information about user accounts on a local computer or domain. This solution does not use the principle of least privilege.

  * Ntdsutil.exe

  Ntdsutil.exe is a command-line utility for experienced Windows Server administrators to manage and maintain Active Directory (AD) and Active Directory Lightweight Directory Services (AD LDS), providing tools for database maintenance, role management, and metadata cleanup. It allows for tasks such as repairing and defragmenting the AD database, seizing and transferring FSMO roles (Flexible Single Master Operations) from domain controllers, removing metadata of improperly decommissioned servers, and performing database analysis.

  * Local Users and Groups

  * System Configuration References:

  https://support.intermedia.com/app/articles/detail/a_id/10375/~/how-do-i-create-a-local-administrator%3F

  https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-user