AZ-800 Online Practice Questions and Answers

Correct Answer: C

Reference: https://docs.microsoft.com/en-us/azure/azure-arc/servers/plan-at-scale-deployment

Correct Answer: A

Azure DNS Private Resolver is a new service that enables you to query Azure DNS private zones from an on-premises environment and vice versa without deploying VM based DNS servers.

Azure DNS Private Resolver requires an Azure Virtual Network. When you create an Azure DNS Private Resolver inside a virtual network, one or more inbound endpoints are established that can be used as the destination for DNS queries.

The DNS query process when using an Azure DNS Private Resolver is summarized below:

1.

A client in a virtual network issues a DNS query.

2.

If the DNS servers for this virtual network are specified as custom, then the query is forwarded to the specified IP addresses.

3.

If Default (Azure-provided) DNS servers are configured in the virtual network, and there are Private DNS zones linked to the same virtual network, these zones are consulted.

4.

If the query doesn't match a Private DNS zone linked to the virtual network, then Virtual network links for DNS forwarding rulesets are consulted.

5.

If no ruleset links are present, then Azure DNS is used to resolve the query.

6.

If ruleset links are present, the DNS forwarding rules are evaluated.

7.

If a suffix match is found, the query is forwarded to the specified address.

8.

If multiple matches are present, the longest suffix is used.

9.

If no match is found, no DNS forwarding occurs and Azure DNS is used to resolve the query.

Note: Planned changes:

Create an Azure DNS Private Resolver that has the following configurations:

Name: Private1

Region: West US

Virtual network: VNet1

Inbound endpoint: SubnetB

The subscription contains the Azure Private DNS zones shown in the following table.

Zone1.com has Virtual network link in VNET1.

Zone2.com has Virtual network link in VNET2.

Zone3.com has no Virtual network links.

https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview

Correct Answer: A

The solution of creating conditional forwarders on Server2 and Server3 for contoso.local and east.contoso.local or west.contoso.local, respectively, does meet the goal.

Since all the DNS servers are already using root hints, they will be able to resolve internet host names. By creating the conditional forwarders, the DNS servers will be able to resolve the names of all the internal namespaces as well.

By configuring conditional forwarders, the DNS servers can forward DNS queries for specific domains to specified DNS servers, improving the efficiency and speed of name resolution for those domains.

Correct Answer: A

You can use item-level targeting to change the scope of individual preference items, so they apply only to selected users or computers. Within a single Group Policy object (GPO), you can include multiple preference items, each customized for selected users or computers and each targeted to apply settings only to the relevant users or computers.

From the exhibit we see operating system targeting with Product being Windows Server 2022 Family. Only Server3 has the Windows Server 2022 Operating System.

Operating System targeting An Operating System targeting item allows a preference item to be applied to computers or users only if the processing computer's operating system's product name, release, edition, or computer role matches those specified in the targeting item.

Reference: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789189(v=ws.11)

Correct Answer: A

Hybrid Connections The Hybrid Connections feature in >>Azure Relay<< is a secure, and open-protocol evolution of the Relay features that existed earlier. You can use it on any platform and in any language. Hybrid Connections feature in Azure Relay is based on HTTP and WebSockets protocols. It allows you to send requests and receive responses over web sockets or HTTP(S). This feature is compatible with WebSocket API in common web browsers.

Correct Answer:

Reference: https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/use-azure-network-adapter

Correct Answer:

Box 1: 3

You need a DHCP scope for each of the three subnets.

Box 2: 2

The two client VLANs need a DHCP Relay Agent to forward DHCP requests to the DHCP server. The datacenter VLAN that contains the DHCP server does not require a DHCP Relay Agent.

Correct Answer:

Box 1: PDC emulator How to configure an authoritative time server in Windows Server To configure the PDC in the root of an Active Directory forest to synchronize with an external time source, follow these steps:

Change the server type to NTP. To do this, follow these steps:

1.

Select Start > Run, type regedit, and then select OK.

2.

Locate and then select the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

In the pane on the right, right-click Type, and then select Modify.

In Edit Value, type NTP in the Value data box, and then select OK.

3.

Set AnnounceFlags to 5. To do this, follow these steps:

Etc.

Box 2: Active Directory Users and Computers Transfer FSMO Roles Using ADUC GUI Just like PowerShell you need to log into the server that you will be transferring to.

Open the Active Directory Users and Computers console, then right-click on the domain and click on operations masters.

You should now see a screen with three tabs (RID, PDC, and Infrastructure).

To transfer one of these roles just click on the change button. You can't select which domain controller to transfer the role to, that is why you need to log into the server that you want to transfer to. if I wanted to transfer the RID role to DC3 I would log into that server.

Reference: https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/configure-authoritative-time-server https://activedirectorypro.com/transfer-fsmo-roles

Correct Answer:

1.

User1 can use self-service password reset (SSPR) to reset his password.

-> [YES]. User1 can use self-service password reset (SSPR) because they are in the synchronized organizational unit (OU1), and "Enable Password writeback" is configured.

2.

If User1 connects to Microsoft Exchange Online, an on-premises domain controller provides authentication.

-> [Yes]. When User1 connects to Microsoft Exchange Online or any other Azure AD-integrated service, their authentication request is passed directly to an on-premises AD domain controller for validation because Pass-through Authentication (PTA) is used.

3.

You can add User2 to Group1 as a member.

-> [No]. User2 is in OU2, which is not selected for synchronization according to the provided configuration details. Since User2's OU is not included in the synchronization scope, you cannot directly add User2 to Group1 from the on-premises AD.

Correct Answer:

Box 1: VM2 only

Hotpatch

Hotpatch is supported on the following operating systems for VMs running on Azure and Azure Stack HCI:

Windows Server 2022 Datacenter: Azure Edition Core

Windows Server 2022 Datacenter: Azure Edition with Desktop Experience

Box 2: VM1 only

SMB over QUIC:

To use SMB over QUIC, you need the following things:

A file server running Windows Server 2022 Datacenter: Azure Edition (Microsoft Server Operating Systems)

A Windows 11 computer (Windows for business)

Windows Admin Center (Homepage)

A Public Key Infrastructure to issue certificates like Active Directory Certificate Server or access to a trusted third party certificate issuer like Verisign, Digicert, Let's Encrypt, and so on.

Reference:

https://learn.microsoft.com/en-us/windows-server/get-started/hotpatch

https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-over-quic