Microsoft AZ-801 Online Practice Questions and Exam Preparation

Microsoft AZ-801 Online Questions & Answers

• Question 201:

  HOTSPOT

  With which servers can Server1 and Server3 communicate? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 202:

  You have an Azure Site Recovery deployment for several Azure virtual machines. You need to ensure that the virtual machines fail over together in a specific order.

  What should you configure?

  A. an availability set
  B. an availability zone
  C. a recovery plan
  D. a scale set
  C. a recovery plan

• Question 203:

  DRAG DROP

  Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server 2022.

  You have a Storage Spaces Direct cluster named SSCluster1 that contains two physical nodes named Node1 and Node2. Node1 and Node2 host highly available virtual machines.

  You plan to perform an in-place upgrade to Windows Server 2025 on Node1.

  You need to ensure that the virtual machines remain running during the upgrade.

  Which four actions should you perform in sequence on Node1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  To perform an in-place upgrade of a Storage Spaces Direct (S2D) cluster node, you must first drain the node using Suspend-ClusterNode -Drain, then place it into storage maintenance mode with Enable-StorageMaintenanceMode, perform the Windows Server upgrade, and finally, remove it from maintenance mode using Disable-StorageMaintenanceMode and resume the node with Resume-ClusterNode.

  Step 1: Run Suspend-Clusternode -Drain and the place the node in storage maintenance mode.

  Here is a step-by-step process for performing a rolling in-place OS upgrade for a Storage Spaces Direct cluster:

  1. Prepare the cluster

  Ensure the other nodes have enough resources to handle the workloads from the node being upgraded.

  Download the Windows Server ISO for the upgrade.

  Ensure the Cluster Witness is accessible for two-node clusters.

  2. Pause and Drain the Node

  Open an elevated PowerShell session on the node you intend to upgrade. Run the following command to drain the node, which migrates all VMs and roles to other active nodes in the cluster: Suspend-ClusterNode -Drain

  3. Enable Storage Maintenance Mode:

  Place the node in storage maintenance mode

  Step 2: Upgrade to Windows Server 2025

  4. Perform the In-Place Upgrade:

  Run the setup.exe from your downloaded Windows Server ISO and select the option to keep your personal files and apps.

  The server will restart, and the cluster service will start automatically once the upgrade is complete.

  Step 3: Remove from storage maintenance mode.

  5. Resume and Verify:

  Disable storage maintenance mode on the upgraded node:

  Get-StorageFaultDomain -type StorageScaleUnit | Where-Object {$_.FriendlyName -eq "<NodeName>"} | Disable-StorageMaintenanceMode

  Step 4: Run Resume-ClusterNode

  Resume the cluster node.

  Resume-ClusterNode References:

  https://learn.microsoft.com/en-us/windows-server/storage/storage-spaces/upgrade-storage-spaces-direct

• Question 204:

  You have an Azure virtual machine named VM1 that runs Windows Server.

  You need to encrypt the contents of the disks on VM1 by using Azure Disk Encryption.

  What is a prerequisite for implementing Azure Disk Encryption?

  A. Customer Lockbox for Microsoft Azure
  B. an Azure key vault
  C. a BitLocker recovery key
  D. data-link layer encryption in Azure
  B. an Azure key vault

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-overview

• Question 205:

  HOTSPOT

  Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains domain controllers that run Windows Server 2016.

  You build a new AD DS forest named nwtraders.com. The forest contains domain controllers that run Windows Server 2025.

  You plan to perform a phased migration from contoso.com to nwtraders.com.

  You perform the following actions:

  Migrate the users in contoso.com to nwtraders.com and enable SIDHistory. Establish a two-way forest trust between contoso.com and nwtraders.com. Install the Active Directory Migration Tool (ADMT) in nwtraders.com. Install the Password Export Server (PES) service in contoso.com.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  No - The permissions for the resources in contoso.com must be updated to allow migrated users access.

  Note:

  SID History is an Active Directory (AD) attribute that stores previous SIDs of an object, such as a user or group, to maintain access to resources in a previous domain after migration. It allows users to retain access to old resources during a domain consolidation or forest restructuring without requiring permissions to be re-assigned. Storing old SIDs enables historical Access Control List (ACL) entries to continue working, ensuring a smoother, less disruptive transition.

  Box 2: Yes

  Yes - Migrated users can sign in to nwtraders.com by using their password for contoso.com.

  Note: The Password Export Server (PES) is a Microsoft tool, version 3.1, that works with the Active Directory Migration Tool (ADMT) to securely migrate user account passwords when moving users between different Active Directory Domain Services (AD DS) environments, such as when changing Active Directory forests. To perform password migration, a user must install PES on a domain controller in the source domain and create a special encryption key file that establishes a trusted connection with the ADMT, enabling the migration of passwords.

  How it works:

  Installation: PES is installed on a domain controller within the source Active Directory domain.

  Key Generation: A unique encryption key file is generated for the source domain using the Domain Migration Administrator (DMA) and stored on removable media for security.

  Trusted Connection: This key file is used during the PES installation to establish a secure, trusted connection between the PES service and the ADMT.

  Password Migration: When ADMT performs an account migration, PES intercepts the request and provides the user's password to the target domain, allowing it to be set for the new account.

  Box 3: No

  No - Contoso.com must contain a server that runs Windows Server 2025 to migrate user profiles by using ADMT.

  you would not need to install a Windows Server 2025 in the original domain to migrate user profiles to a new domain. A user migration involves joining clients to the new domain, and then setting up user profiles within that domain. You will need a Windows Server 2025 or a machine with the necessary Remote Server Administration Tools (RSAT) installed in the target domain to perform the migration, not in the source domain..

  References:

  https://www.microsoft.com/en-us/download/details.aspx?id=1838

  https://www.microsoft.com/en-us/download/details.aspx?id=1838

• Question 206:

  You have an on-premises file server named Server1 that runs Windows Server.

  You have an Azure subscription.

  Server1 contains a file share named Share1.

  You need to migrate Share1 to an Azure virtual machine.

  What should you use?

  A. Server Manager
  B. Storage Replica
  C. Windows Admin Center
  D. Azure Migrate
  D. Azure Migrate

  ---

  Explanation

  Azure Migrate isn't designed to migrate just a file share to an Azure File Share; it migrates entire servers (virtual machines) to Azure. For migrating an on-premises file share to an Azure VM, you can use Azure Migrate to migrate the entire server that hosts the share, or you can use specialized tools like Azure Storage Mover, Robocopy, or AzCopy for direct data migration to an Azure file share.

  Incorrect:

  [Not A] Server Manager alone cannot directly facilitate the migration of an on-premises file share to an Azure virtual machine file share

  [Not B] Storage Replica is not the ideal or typical tool for migrating a file share from on-premises to an Azure virtual machine file share

  References:

  https://docs.azure.cn/en-us/migrate/common-questions-server-migration

• Question 207:

  You are planning the data share migration to support the on-premises migration plan.

  What should you use to perform the migration?

  A. Storage Migration Service
  B. Microsoft File Server Migration Toolkit
  C. File Server Resource Manager (FSRM)
  D. Windows Server Migration Tools
  A. Storage Migration Service

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/windows-server/storage/storage-migration-service/migrate-data

• Question 208:

  HOTSPOT

  You have a failover cluster named FC1 that contains two nodes named Server1 and Server2. FC1 is configured to use a file share witness.

  You plan to configure FC1 to use a cloud witness.

  You need to configure Azure Storage accounts for the cloud witness.

  Which storage account type and authorization method should you configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 209:

  You have two Azure Virtual machines that run Windows Server.

  You plan to create a failover cluster that will host the virtual machines.

  You need to configure an Azure Storage account that will be used by the cluster as a cloud witness. The solution must maximize resiliency.

  Which type of redundancy should you configure for the storage account?

  A. Geo-zone-redundant storage (GZRS)
  B. Geo-redundant storage (GRS)
  C. Zone-redundant storage (ZRS)
  D. Locally-redundant storage (LRS)
  C. Zone-redundant storage (ZRS)

  ---

  Explanation

  For Replication, you can select Locally-redundant storage (LRS) or Zone-redundant storage (ZRS) as applicable. ZRS offers more redundancy.

  References:

  https://docs.microsoft.com/en-us/windows-server/failover-clustering/deploy-cloud-witness

• Question 210:

  DRAG DROP

  You have a server named Server1 that runs Windows Server.

  For Server1, you enable the default App Control for Business policies in audit mode.

  You need to ensure that specific third-party applications installed on Server1 are allowed to run by using App Control for Business.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Windows Server Security, Configure App Control for Business by using OSConfig

  Step 1: Run the New-CIPolicy and New-CIPolicyRule cmdlets 1. Step-by-step guide to creating and modifying App Control policies

  Create Rules with New-CIPolicyRule:

  Example: To create an AppId rule for a specific application, use the -AppID option. You can use this with - Level SignedVersion to specify a rule based on a combination of a signing certificate chain and version.

  $rule = New-CiPolicyRule -Level SignedVersion -DriverFilePath <path_to_application>

  2. Create the Policy File with New-CIPolicy:

  Create the base policy file by passing your defined rules to New-CIPolicy.

  New-CIPolicy -rules $rule -FilePath .\\AppIdPolicy.xml

  Step 2: From the Windows Defender App Control Policy Wizard, generate an XML file.

  Configure supplemental policies

  App Control for Business policy rules

  To modify the policy rule options of an existing App Control policy XML, use the App Control Policy Wizard or the Set-RuleOption PowerShell cmdlet.

  Incorrect:

  From Event Viewer, generate an EVTX file.

  Step 3: Run the set-CIPolicyVersion and Set-CIPolicyIdInfo After the supplemental policy is generated [Step 1, Step 2], copy the XML file to your server and run the following script:

  $policyPath = "<Path to the XML policy file>"

  # Reset GUID (best practice)

  Set-CIPolicyIdInfo -FilePath $policyPath -ResetPolicyID [Step 3]

  # Set policy version (VersionEx in the XML file)

  $policyVersion = "1.0.0.1"

  Set-CIPolicyVersion -FilePath $policyPath -Version $policyVersion [Step 3]

  # Set policy info (PolicyName and PolicyID in the XML file)

  Set-CIPolicyIdInfo -FilePath $policyPath -PolicyID "<App name>-Policy_$policyVersion" -PolicyName "<App name>-Policy" # E.g. Set-CIPolicyIdInfo -FilePath $policyPath -PolicyID "Chrome- Policy_$policyVersion" -PolicyName "Chrome-Policy"

  $base = "{9214D8EE-9B0F-4972-9073-A04E917D7989}"

  Set-CIPolicyIdInfo -FilePath $policyPath -SupplementsBasePolicyID $base

  #Set the new policy into the system

  Set-OSConfigDesiredConfiguration -Scenario AppControl -Name Policies -Value $policyPath [Step 4]

  Note: Set PolicyName, PolicyID, and Version metadata for each policy Use the Set-CIPolicyIDInfo cmdlet to give each policy a descriptive name and set a unique policy ID. These unique attributes help you differentiate each policy when reviewing App Control for Business events or when viewing the policy XML document. Although you can specify a string value for PolicyId, for policies using the multiple policy format we recommend using the -ResetPolicyId switch to let the

  system autogenerate a unique ID for the policy.

  Step 4: Run the Set-OSConfigDesiredConfiguration cmdlet. To set App Control for Business policies for a specific Windows Server version using the Set-OSConfigDesiredConfiguration cmdlet, use the Scenario parameter with the path to the policy, such as AppControl\\WS2025\\DefaultPolicy\\Audit for audit mode or AppControl\\WS2025\\DefaultPolicy\\Enforce for enforcement mode. Run the command in an elevated PowerShell session on your server to apply the desired default App Control policy for Windows Server 2025.

  Manage default policies

  To configure the default App Control policies in audit mode, open PowerShell as admin and run the following command: Set-OSConfigDesiredConfiguration -Scenario AppControl\WS2025\DefaultPolicy\Audit -Default Set-OSConfigDesiredConfiguration -Scenario AppControl\WS2025\AppBlockList\Audit -Default

  To configure the default App Control policies in enforcement mode, open PowerShell as admin and run the following command:

  Set-OSConfigDesiredConfiguration -Scenario AppControl\WS2025\DefaultPolicy\Enforce -Default Set-OSConfigDesiredConfiguration -Scenario AppControl\WS2025\AppBlockList\Enforce -Default

  References:

  https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create

  https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/plan-appcontrol-management

  https://learn.microsoft.com/en-us/windows-server/security/osconfig/osconfig-how-to-configure-app-control-for-business