Administering Windows Server Hybrid Core Infrastructure practice questions

1. Question 1 of 25

   Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the objects shown in the following table.

   

   You plan to sync contoso.com with an Azure Active Directory (Azure AD) tenant by using Azure AD Connect. You need to ensure that all the objects can be used in Conditional Access policies. What should you do?

   • ASelect the Configure Hybrid Azure AD join option.
   • BChange the scope of Group1 and Group2 to Global.
   • CClear the Configure device writeback option.
   • DChange the scope of Group2 to Universal.

   Show answer

   Correct answer: A

   How others answered

   • A75%
   • C25%

   Explanation

   I think the correct answer is C. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-device-options "Device writeback: Device writeback is used to enable Conditional Access based on devices to AD FS (2012 R2 or higher) protected devices" https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-device-based-conditional-access-on-premises "The following per-requisites are required before you can begin with on-premises conditional access. To enable device write-back for on premises conditional access "

   Adapted from community discussion by [Removed] · 2022-10-31 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

   1. L

      Lu5ck

      2022-12-17

      9 upvotes

      Reading it again, C say " the Configure device writeback option" but we need to enable it. Therefore, A is the only sensible answer. sorry about this.

   2. S

      syu31svc

      2023-03-19

      Selected A6 upvotes

      https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device Answer is A

   3. A

      ant_12

      2023-01-12

      5 upvotes

      Hybrid Azure AD join Allows computer accounts in the on-premises AD DS forest to register with Azure AD. Configuring this option allows you to use features including conditional access in Azure. Thomas, Orin. Exam Ref AZ-800 Administering Windows Server Hybrid Core Infrastructure (3570357) (p. 63). Pearson Education. Kindle Edition.

   4. [

      [Removed]

      2022-10-31

      4 upvotes

      I think the correct answer is C. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-device-options "Device writeback: Device writeback is used to enable Conditional Access based on devices to AD FS (2012 R2 or higher) protected devices" https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-device-based-conditional-access-on-premises "The following per-requisites are required before you can begin with on-premises conditional access. To enable device write-back for on premises conditional access "

2. Question 2 of 25

   You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. You have several Windows 10 devices that are Azure AD hybrid-joined. You need to ensure that when users sign in to the devices, they can use Windows Hello for Business. Which optional feature should you select in Azure AD Connect?

   • ADevice writeback
   • BGroup writebeack
   • CAzure AD app and attribute filtering
   • DPassword writeback
   • EDirectory extension attribute sync

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Device writeback is an optional feature in Azure AD Connect that allows the on-premises AD DS domain to receive information about the Azure AD joined devices, including the device registration state. By enabling this feature, you can ensure that the on-premises AD DS domain has information about the Azure AD joined devices, which is required for Windows Hello for Business to function correctly. Once this information is available in the on-premises AD DS domain, you can set the appropriate policies and configure the required infrastructure to support Windows Hello for Business.

   Adapted from community discussion by empee1977 · 2023-02-05 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

   1. E

      empee1977

      2023-02-05

      Selected A9 upvotes

      Device writeback is an optional feature in Azure AD Connect that allows the on-premises AD DS domain to receive information about the Azure AD joined devices, including the device registration state. By enabling this feature, you can ensure that the on-premises AD DS domain has information about the Azure AD joined devices, which is required for Windows Hello for Business to function correctly. Once this information is available in the on-premises AD DS domain, you can set the appropriate policies and configure the required infrastructure to support Windows Hello for Business.

   2. R

      RMKA_092

      2022-08-29

      Selected A5 upvotes

      https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs

   3. X

      xrisimix

      2022-09-07

      4 upvotes

      Windows Hello for Business deployments need device writeback, which is an Azure Active Directory premium feature.

   4. M

      MR_Eliot

      2023-09-16

      Selected A1 upvote

      Correct Answer is "A". Device registration All devices included in the Windows Hello for Business deployment must go through device registration. Device registration enables devices to authenticate to identity providers. >> For cloud only and hybrid deployment, the identity provider is Azure Active Directory <<. For on-premises deployments, the identity provider is the on-premises server running the Windows Server 2016 Active Directory Federation Services (AD FS) role. https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-planning-guide#device-registration

3. Question 3 of 25

   HOTSPOT - Your network contains three Active Directory Domain Services (AD DS) forests as shown in the following exhibit.

   

   The network contains the users shown in the following table.

   

   The network contains the security groups shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise. select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   Box 1: Yes - User1 is in east.contoso.com. Group1 is Domain Local group in west.adutm.com. Accounts from any domain or any trusted domain Global groups from any domain or any trusted domain can be members of Domain Local groups. Accounts, Global groups, and Universal groups from other forests and from external domains can also be members of Domain Local groups. Box 2: No - User2 is in the fabrikam.com domain. Group3 is a Universal group in east.contso.com. Only accounts from any domain in the same forest can be added as members. Box 3: Yes - Group2 is a Universal group in contoso.com. Group2 can grant permissions On any domain in the same forest or trusting forests. Active Directory Domain Services add to Domain Local group. Reference: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-groups

   Adapted from community discussion by Lu5ck · 2023-06-17 · 30 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

   1. L

      Lu5ck

      2023-06-17

      30 upvotes

      This is about trust. Contoso Adatum Fabrikam User1 is from Contoso Group1 is from Adatum Both forests trusted each other, so Yes. User2 is from Fabrikam Group2 is from Contoso Both forests don't trust each other, so No. Transitive trust is only applicable to domain under the said forest. Group2 is from Contoso Fabrikam is another forest Both forests don't trust each other, so No. Transitive trust is only applicable to domain under the said forest. Yes No No

   2. D

      DesolateMarauder

      2023-06-16

      10 upvotes

      Yes - Domain Local Possible Members: Accounts from any domain or any trusted domain https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn579255(v=ws.11)?redirectedfrom=MSDN No - Universal Possible Members: Accounts from any domain in the same forest. https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn579255(v=ws.11)?redirectedfrom=MSDN Yes - Universal Permissions: On any domain in the same forest or trusting forests https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn579255(v=ws.11)?redirectedfrom=MSDN

   3. L

      Lu5ck

      2023-06-21

      11 upvotes

      No. Transitive trust is only applicable to domains under the said forest. What this means is that Contoso will trust Adatum and all the domains part of Adatum. However, Contoso will not trust Fabrikam because Fabrikam is not part of Adatum. Trusts between forests are required to be made explicitly.

   4. K

      kijken

      2023-04-27

      6 upvotes

      After more invesitgation I know the answer is yes no no: Explicit trusts are also used to enable authenticate across forests. When a forest trust is created, a transitive trust is created between the forest root domains in both forests. This allows all the members in the forest to exchange authentication information with the other forest. The forest trust is also called an explicit trust between the two forests. If an additional forest trust is created between one of the original forests and a third forest, an implicit trust with the other original forest is not established to the third forest. In order for the third forest to have a trust relationship with the other forest, an explicit forest trust must be created between the two https://www.sciencedirect.com/topics/computer-science/transitive-trust#:~:text=A%20forest%20trust%20is%20also,use%20resources%20in%20the%20other.

4. Question 4 of 25

   Your on-premises network contains an Active Directory domain named contoso.com. You have an Azure AD tenant. You plan to sync contoso.com with the Azure AD tenant by using Azure AD Connect cloud sync. You need to create an account that will be used by Azure AD Connect cloud sync. Which type of account should you create?

   • Asystem-assigned managed identity
   • Bgroup managed service account (gMSA)
   • Cuser
   • DInetOrgPerson

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   B. You need the following to use Azure AD Connect cloud sync: Domain Administrator or Enterprise Administrator credentials to create the Azure AD Connect Cloud Sync gMSA (group Managed Service Account) to run the agent service. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-prerequisites?tabs=public-cloud

   Adapted from community discussion by Maup33 · 2023-07-02 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

   1. M

      Maup33

      2023-07-02

      4 upvotes

      B. You need the following to use Azure AD Connect cloud sync: Domain Administrator or Enterprise Administrator credentials to create the Azure AD Connect Cloud Sync gMSA (group Managed Service Account) to run the agent service. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-prerequisites?tabs=public-cloud

   2. F

      franyotron

      2023-06-13

      4 upvotes

      Correct. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-prerequisites?tabs=public-cloud

   3. E

      examesmsft

      2023-07-03

      3 upvotes

      Looks like correct, follow the step by step: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-install

   4. J

      JackBauer

      2023-10-05

      2 upvotes

      Managed Service Account is recommended. the local user account is for 2017-2021 / Legacy. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/concept-adsync-service-account

5. Question 5 of 25

   HOTSPOT - Your on-premises network contains an Active Directory Domain Services (AD DS) domain. You plan to sync the domain with an Azure AD tenant by using Azure AD Connect cloud sync. You need to meet the following requirements: • Install the software required to sync the domain and Azure AD. • Enable password hash synchronization. What should you install, and what should you use to enable password hash synchronization? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   It seems that they are asking to use "cloud sync," the answer should be: 1: The Azure AD Connect provisioning agent: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-install 2: The Azure Portal: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-configure#:~:text=On%20the%20configuration%20screen%2C%20select%20your%20domain%20and%20whether%20to%20enable%20password%20hash%20sync.%20Click%20Create.

   Adapted from community discussion by Mikepsperu · 2023-09-12 · 17 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

   1. M

      Mikepsperu

      2023-09-12

      17 upvotes

      It seems that they are asking to use "cloud sync," the answer should be: 1: The Azure AD Connect provisioning agent: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-install 2: The Azure Portal: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-configure#:~:text=On%20the%20configuration%20screen%2C%20select%20your%20domain%20and%20whether%20to%20enable%20password%20hash%20sync.%20Click%20Create.

   2. B

      bdbea79

      2024-01-13

      11 upvotes

      Payday123 is right, "Azure AD Connect cloud sync" and "Azure AD Connect" are two different tools. I could not find a Microsoft Article about it but this made it clear: https://www.linkedin.com/pulse/how-azure-ad-connect-cloud-sync-different-from-guide-sharif/ Install Provisioning agent Use Azure Portal

   3. M

      MR_Eliot

      2023-09-20

      10 upvotes

      I was wrong, correct answer bellow: KEY: Azure AD Connect cloud sync First Box: The Azure AD Connect Provisioning Agent Second Box: The Azure Portal Explanation: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-configure

   4. P

      Payday123

      2023-10-25

      7 upvotes

      "Azure AD Connect cloud sync" and "Azure AD Connect" are two different tools!

6. Question 6 of 25

   Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the resources shown in the following table.

   

   You plan to replicate a volume from Server1 to Server2 by using Storage Replica. You need to configure Storage Replica. Where should you install Windows Admin Center?

   • AServer1
   • BCLIENT1
   • CDC1
   • DServer2

   Show answer

   Correct answer: B

   How others answered

   • B93%

   Explanation

   B CLient 1 https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/plan/installation-options We don’t recommend using Windows Admin Center for local management of the same server on which it’s installed. - Not A,D. Installing Windows Admin Center on a Domain controller is not supported - Not C

   Adapted from community discussion by RickySmith · 2023-09-19 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

   1. R

      RickySmith

      2023-09-19

      Selected B8 upvotes

      B CLient 1 https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/plan/installation-options We don’t recommend using Windows Admin Center for local management of the same server on which it’s installed. - Not A,D. Installing Windows Admin Center on a Domain controller is not supported - Not C

   2. S

      SIAMIANJI

      2024-04-30

      Selected B2 upvotes

      To configure Storage Replica for replicating a volume from Server1 to Server2, you should install Windows Admin Center on a management workstation or server. Since Server1 and Server2 are involved in the replication process, it's preferable to install Windows Admin Center on a separate machine to centrally manage both servers. Given the options provided, the best choice would be: B. CLIENT1 Installing Windows Admin Center on CLIENT1 allows you to manage both Server1 and Server2 from a single management workstation. This ensures that you have a centralized management interface for configuring and monitoring Storage Replica replication between the two servers.

   3. M

      mohamed1999

      2024-05-19

      Selected B2 upvotes

      Right now you can't use Windows Admin Center on a server to manage Storage Replica. https://learn.microsoft.com/en-us/windows-server/storage/storage-replica/server-to-server-storage-replication

   4. 0

      004b54b

      2024-08-20

      Selected B1 upvote

      https://learn.microsoft.com/en-us/windows-server/storage/storage-replica/server-to-server-storage-replication?source=recommendations#windows-admin-center-requirements To use Storage Replica and Windows Admin Center together, you need the following: [...] 1 PC Win 10 for WAC

7. Question 7 of 25

   You have an Active Directory Domain Services (AD DS) domain that contains the domain controllers shown in the following table.

   

   The domain contains an app named App1 that uses a custom application partition to store configuration data. You decommission App1. When you attempt to remove the custom application partition, the process fails. Which domain controller is unavailable?

   • ADC1
   • BDC2
   • CDC3
   • DDC4

   Show answer

   Correct answer: C

   How others answered

   • C91%

   Explanation

   C Domain Naming Master - Must be online when domains and application partitions in a forest are added or removed. https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/fsmo-placement-and-optimization-on-ad-dcs#more-information

   Adapted from community discussion by RickySmith · 2023-12-22 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

   1. R

      RickySmith

      2023-12-22

      Selected C4 upvotes

      C Domain Naming Master - Must be online when domains and application partitions in a forest are added or removed. https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/fsmo-placement-and-optimization-on-ad-dcs#more-information

   2. S

      Sucxi

      2023-10-26

      1 upvote

      The domain naming master FSMO role holder is the DC responsible for making changes to the forest-wide domain name space of the directory, that is, the Partitions\Configuration naming context or LDAP://CN=Partitions, CN=Configuration, DC= . This DC is the only one that can add or remove a domain from the directory. It can also add or remove cross references to domains in external directories. https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/fsmo-roles#domain%20naming

   3. B

      boapaulo

      2023-11-26

      1 upvote

      To remove a custom application partition, the domain controller that plays the role of schema master must be available. Therefore, if the removal process is failing, it is likely that DC1, which is the schema master, is unavailable. I recommend checking the status of the DC1 and making sure it is online and working properly. If DC1 is inaccessible, you need to resolve this issue before you can remove the custom application partition.

   4. T

      thomasemr

      2025-02-11

      Selected C1 upvote

      https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/fsmo-roles#domain-naming-master-fsmo-role

8. Question 8 of 25

   HOTSPOT - You have an Azure Active Directory Domain Services (Azure AD DS) domain. You create a new user named Admin1. You need Admin1 to deploy custom Group Policy settings to all the computers in the domain. The solution must use the principle of least privilege. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy https://docs.microsoft.com/en-us/azure/active-directory-domain-services/create-ou

   Adapted from community discussion by stonwall12 · 2025-01-03 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

   1. N

      nefaxto

      2023-11-20

      31 upvotes

      AAD DC Administrators Modifying AADDC Computers GPO https://docs.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy The GPO can be linked on UO not to the domain

   2. J

      Josty

      2024-02-24

      6 upvotes

      the group policy can't be linked to the domain only to a OU -> so Modifying AADDC Computers GPO is the correct one

   3. S

      stonwall12

      2025-01-03

      3 upvotes

      Asnwer: 1. AAD DC Administrators 2. Create a new GPO linked to domain 1. This is the required group for managing Group Policy in Azure AD DS. 2. While you can modify the built-in GPOs (AADDC Users and AADDC Computers), creating a custom GPO provides better management and control and is the recommended approach as per Microsoft documentation for implementing custom policies. https://learn.microsoft.com/en-us/entra/identity/domain-services/manage-group-policy

   4. S

      syu31svc

      2024-09-23

      2 upvotes

      https://learn.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy A user account that's a member of the Azure AD DC administrators group in your Azure AD tenant (Before you begin) hese built-in GPOs can be customized to configure specific group policies on your managed domain. Right-select one of the GPOs, such as AADDC Computers GPO, then choose Edit.... (Open the Group Policy Management Console and edit an object) Answer is correct

9. Question 9 of 25

   Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two servers named Server1 and Server2 and the users shown in the following table.

   

   Which users can establish a PowerShell remoting session from Server1 to Server2?

   • AUser1 and User3 only
   • BUser2 and User4 only
   • CUser3 and User4 only
   • DUser1, User3, and User4 only
   • EUser1, User2, User3, and User4

   Show answer

   Correct answer: A

   How others answered

   • A44%
   • E33%

   Only 44% agreed on this answer — treat it as contested rather than settled.

   Explanation

   https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#remote-management-users Use the Remote Management Users group to allow users to manage servers through the Server Manager console. Use the WinRMRemoteWMIUsers\_ group to allow users to remotely run Windows PowerShell commands.

   Adapted from community discussion by zuzmo483 · 2025-02-27 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

   1. Z

      zuzmo483

      2025-02-27

      Selected A2 upvotes

      https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#remote-management-users Use the Remote Management Users group to allow users to manage servers through the Server Manager console. Use the WinRMRemoteWMIUsers\_ group to allow users to remotely run Windows PowerShell commands.

   2. B

      brunosilvam

      2025-02-11

      Selected A1 upvote

      To create remote sessions and run remote commands, by default, the current user must be a member of the Administrators group on the remote computer or provide the credentials of an administrator. Otherwise, the command fails. https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_remote_requirements?view=powershell-7.5

   3. F

      formacaotismic

      2024-11-17

      1 upvote

      E User1 (contoso/administrators): Pode estabelecer uma sessão remota, pois é membro do grupo Administrators no domínio contoso. User2 (contoso/Remote Management Users): Pode estabelecer uma sessão remota, pois é membro do grupo Remote Management Users no domínio contoso. User3 (Server2/administrators): Pode estabelecer uma sessão remota, pois é membro do grupo Administrators no Server2. User4 (Server2/Remote Management Users): Pode estabelecer uma sessão remota, pois é membro do grupo Remote Management Users no Server2.

   4. L

      ltkiller

      2025-01-27

      Selected A1 upvote

      User1 and User3 only, default ONLY administrators. https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_remote_requirements?view=powershell-7.5#user-permissions

10. Question 10 of 25

    You need to meet the technical requirements for VM2. What should you do?

    • AImplement shielded virtual machines.
    • BEnable the Guest services integration service.
    • CImplement Credential Guard.
    • DEnable enhanced session mode.

    Show answer

    Correct answer: D

    How others answered

    • D79%
    • C21%

    Explanation

    The question is about preventing a VMConnect user from taking over another user's VMConnect session. - "Turn on enhanced session mode on Hyper-V host."

    Adapted from community discussion by bastien95 · 2023-01-19 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. B

       bastien95

       2023-01-19

       Selected D13 upvotes

       The question is about preventing a VMConnect user from taking over another user's VMConnect session. - "Turn on enhanced session mode on Hyper-V host."

    2. R

       rimvydukas

       2023-04-07

       Selected D5 upvotes

       Prevent a VMConnect user from taking over another user's VMConnect session Turn on enhanced session mode on Hyper-V host. Not having enhanced session mode turned on may pose a security and privacy risk. If a user is connected and logged on to a virtual machine through VMConnect and another authorized user connects to the same virtual machine, the session will be taken over by the second user and the first user will lose the session. The second user will be able to view the first user's desktop, documents, and applications. https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect

    3. S

       syu31svc

       2023-09-30

       Selected D2 upvotes

       When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without signing out, another administrator can connect to the console session as the currently signed in user. https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect Prevent a VMConnect user from taking over another user's VMConnect session Turn on enhanced session mode on Hyper-V host. Not having enhanced session mode turned on may pose a security and privacy risk. If a user is connected and logged on to a virtual machine through VMConnect and another authorized user connects to the same virtual machine, the session will be taken over by the second user and the first user will lose the session. The second user will be able to view the first user's desktop, documents, and applications. Answer is D

    4. S

       SJHCI

       2023-01-29

       Selected D4 upvotes

       D: https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect

11. Question 11 of 25

    HOTSPOT - You need to configure network communication between the Seattle and New York offices. The solution must meet the networking requirements. What should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-expressroute-portal

    Adapted from community discussion by GoforIT21 · 2024-01-07 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • azure.microsoft.com documentation

    Answer figure

    

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. G

       GoforIT21

       2024-01-07

       14 upvotes

       The network requirements state: "All communications must occur over ExpressRoute." That means you need to create the conditions for that kind of connection: an ExpressRoute gateway and an ExpressRoute circuit connection. See for a detailed description: https://docs.microsoft.com/en-us/learn/modules/implement-hybrid-network-infrastructure/5-implement-azure-expressroute

    2. A

       AnonymousJhb

       2024-01-12

       6 upvotes

       correct, the questions says: Networking Requirements - Fabrikam identifies the following networking requirements: Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over ExpressRoute.

    3. J

       johosofat

       2024-05-07

       3 upvotes

       Id be afraid there is going to be other flavors of this question- A hub and gateway creation is needed to bring this beast to life- but it doesnt seem they would go too deep- here is some links i researched before just going along with the express route answer- https://learn.microsoft.com/en-us/training/modules/implement-hybrid-network-infrastructure/6-configure-azure-virtual-wide-area-network https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-expressroute-portal https://learn.microsoft.com/en-us/azure/route-server/expressroute-vpn-support?source=recommendations

    4. C

       Contactfornitish

       2024-02-23

       4 upvotes

       S2S VPN and simple gateway not applicable when Expressway route is asked

12. Question 12 of 25

    You need to configure remote administration to meet the security requirements. What should you use?

    • Aan Azure Bastion host
    • BAzure AD Privileged Identity Management (PIM)
    • Cthe Remote Desktop extension for Azure Cloud Services
    • Djust in time (JIT) VM access

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    This is defender for cloud now- it has more features possible - you can go to security center and add JIT now and you can also go to the vm properties and ask that way- these are the links that start down the foxhole- but im saving this for az-104 https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks

    Adapted from community discussion by johosofat · 2024-05-07 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. J

       johosofat

       2024-05-07

       Selected D2 upvotes

       This is defender for cloud now- it has more features possible - you can go to security center and add JIT now and you can also go to the vm properties and ask that way- these are the links that start down the foxhole- but im saving this for az-104 https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks

    2. J

       Jawad1462

       2024-04-15

       Selected D3 upvotes

       Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours.

    3. S

       syu31svc

       2024-09-29

       Selected D2 upvotes

       "Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours" https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage JIT lets you allow access to your VMs only when the access is needed, on the ports needed, and for the period of time needed. D is correct

    4. J

       Joystickj

       2024-04-13

       Selected D3 upvotes

       With JIT VM you can request RDP access to a VM. With PIM you set RBAC roles.

13. Question 13 of 25

    You need to meet the technical requirements for VM3. On which volumes can you enable Data Deduplication?

    • AC and D only
    • BD only
    • CC, D, E, and F
    • DD and E only
    • ED, E, and F only

    Show answer

    Correct answer: D

    How others answered

    • D92%

    Explanation

    More info why is D) D and E only You can't include C (Boot drive) https://docs.microsoft.com/en-us/previous-versions/windows/desktop/dedup/about-data-deduplication Deduplication is not supported on: System or boot volumes Remote mapped or remote mounted drives Cluster shared volume file system (CSVFS) for non-VDI workloads or any workloads on Windows Server 2012 Files approaching or larger than 1 TB in size. Volumes approaching or larger than 64 TB in size.

    Adapted from community discussion by AvoKikinha · 2022-05-12 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. A

       AvoKikinha

       2022-05-12

       Selected D17 upvotes

       Wait! ReFS - Data Deduplication is supported starting with Windows Server 2019. From: https://docs.microsoft.com/en-us/windows-server/storage/data-deduplication/interop D E

    2. A

       AvoKikinha

       2022-05-12

       9 upvotes

       More info why is D) D and E only You can't include C (Boot drive) https://docs.microsoft.com/en-us/previous-versions/windows/desktop/dedup/about-data-deduplication Deduplication is not supported on: System or boot volumes Remote mapped or remote mounted drives Cluster shared volume file system (CSVFS) for non-VDI workloads or any workloads on Windows Server 2012 Files approaching or larger than 1 TB in size. Volumes approaching or larger than 64 TB in size.

    3. P

       prepper666

       2022-06-05

       9 upvotes

       Wrong. You cannot dedup the OS volume, only data volume. Thats why its called DataDedup! So many of your answers are incorrect.

    4. P

       prepper666

       2022-06-02

       6 upvotes

       Wrong. You cannot dedup the OS volume, only data volume. Thats why its called DataDedup!

14. Question 14 of 25

    HOTSPOT - Your on-premises network contains an Active Directory domain named contoso.com and 500 servers that run Windows Server. All the servers are Azure Arc-enabled and joined to contoso.com. You need to implement PowerShell Desired State Configuration (DSC) on all the servers. The solution must minimize administrative effort. Where should you store the DSC scripts, and what should you use to apply DSC to the servers? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Correct answer in second part is use virtual machine extensions Here's an overview of the process: You store and compile your DSC scripts in your Azure Automation account. When the scripts are compiled, they become Node Configurations. To apply the DSC configurations to your VMs, you "Onboard" the VMs to Azure Automation DSC. This process involves installing the PowerShell DSC VM extension on the VMs (if it's not already installed), and registering the VMs with the Azure Automation DSC service. As part of the onboarding process, you assign a Node Configuration to each VM. The PowerShell DSC VM extension on each VM then periodically checks with the Azure Automation DSC service, pulls the assigned Node Configuration, and ensures that the VM is configured according to that Node Configuration. The compliance status of each VM (whether it's correctly configured according to its assigned Node Configuration) is then reported back to Azure Automation DSC, and you can view this status in the Azure portal.

    Adapted from community discussion by ala76nl · 2023-05-18 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. A

       ala76nl

       2023-05-18

       14 upvotes

       Correct answer in second part is use virtual machine extensions Here's an overview of the process: You store and compile your DSC scripts in your Azure Automation account. When the scripts are compiled, they become Node Configurations. To apply the DSC configurations to your VMs, you "Onboard" the VMs to Azure Automation DSC. This process involves installing the PowerShell DSC VM extension on the VMs (if it's not already installed), and registering the VMs with the Azure Automation DSC service. As part of the onboarding process, you assign a Node Configuration to each VM. The PowerShell DSC VM extension on each VM then periodically checks with the Azure Automation DSC service, pulls the assigned Node Configuration, and ensures that the VM is configured according to that Node Configuration. The compliance status of each VM (whether it's correctly configured according to its assigned Node Configuration) is then reported back to Azure Automation DSC, and you can view this status in the Azure portal.

    2. M

       MR_Eliot

       2023-09-21

       6 upvotes

       Box1: 3 Box2: 3 https://learn.microsoft.com/en-us/azure/automation/automation-dsc-overview?source=recommendations Before you enable Automation State Configuration, we would like you to know that a newer version of DSC is now generally available, managed by a feature of Azure Policy named guest configuration. The guest configuration service combines features of DSC Extension, Azure Automation State Configuration, and the most commonly requested features from customer feedback. Guest configuration also includes hybrid machine support through Arc-enabled servers.

    3. A

       Anonymouse1312

       2024-03-29

       3 upvotes

       you are CORRECT: https://blog.matrixpost.net/infrastructure-as-code-iac-part-5-azure-automanage-machine-configuration-formerly-called-azure-policy-guest-configuration/ https://blog.matrixpost.net/infrastructure-as-code-iac-part-4-azure-automation-state/ In a nutshell, there are/ were two ways: Azure Automation State Configuration - DSC scripts are stored in an Automation Account under “State Configuration (DSC)” - Seems to be deprecated as of October 2023 - Deployment happens after compiling the DSC config file, after which it is ready to be pulled by the server Azure Automanage Machine Configuration - The DSC config file is compiled into a MOF file, packaged, and used by machine configuration to create the Azure Policy definitions - In order for VMs to be automanaged, they must have assigned a system assigned managed identity So, boxes 3/3 are correct because Azure VM extension are not used to APPLY the DSC. They are a prerequisite for it to work

    4. K

       Krayzr

       2024-07-05

       2 upvotes

       Seems like correct Store in: An Azure Automation account: Azure Automation allows you to automate the creation, deployment, monitoring, and maintenance of resources in your Azure environment using a highly scalable and reliable workflow execution engine. It would be the best place to store the DSC scripts as it provides a way to manage configurations at scale using PowerShell DSC. Use: Azure virtual machines extensions: Azure VM extensions are small applications that provide post-deployment configuration and automation tasks on Azure virtual machines. In this case, the DSC extension for Windows will be used to apply the DSC configuration to the servers. This extension is directly integrated with Azure and provides a seamless experience for applying configuration.

15. Question 15 of 25

    You have an on premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. The domain contains two servers named Server1 and Server2. A user named Admin1 is a member of the local Administrators group on Server1 and Server2. You plan to manage Server1 and Server2 by using Azure Arc. Azure Arc objects will be added to a resource group named RG1. You need to ensure that Admin1 can configure Server1 and Server2 to be managed by using Azure Arc. What should you do first?

    • AFrom the Azure portal, generate a new onboarding script.
    • BAssign Admin1 the Azure Connected Machine Onboarding role for RG1.
    • CHybrid Azure AD join Server1 and Server2.
    • DCreate an Azure cloud-only account for Admin1.

    Show answer

    Correct answer: B

    How others answered

    • B51%
    • A44%

    Only 51% agreed on this answer — treat it as contested rather than settled.

    Explanation

    This is the correct answer. 1. I tested this in LAB. 2. Documentation: https://learn.microsoft.com/en-us/azure/azure-arc/servers/onboard-portal ---snap--- You can enable Azure Arc-enabled servers for one or a small number of Windows or Linux machines in your environment by performing a set of steps manually. Or you can use an automated method by running a template script that we provide. This script automates the download and installation of both agents. This method requires that you have administrator permissions on the machine to install and configure the agent. On Linux, by using the root account, and on Windows, you are member of the Local Administrators group. --snap--

    Adapted from community discussion by phi3nix · 2023-04-30 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. P

       phi3nix

       2023-04-30

       9 upvotes

       This is the correct answer. 1. I tested this in LAB. 2. Documentation: https://learn.microsoft.com/en-us/azure/azure-arc/servers/onboard-portal ---snap--- You can enable Azure Arc-enabled servers for one or a small number of Windows or Linux machines in your environment by performing a set of steps manually. Or you can use an automated method by running a template script that we provide. This script automates the download and installation of both agents. This method requires that you have administrator permissions on the machine to install and configure the agent. On Linux, by using the root account, and on Windows, you are member of the Local Administrators group. --snap--

    2. A

       airfrog

       2022-07-15

       5 upvotes

       I think B is incorrect. You can only assign the "Azure Connected Machine Onboarding" role to Service Principals, not users; so you can't assign it to Admin1. I think A is correct. You just need to generate an onboarding script for a local admin to run. You also need to know the ID and Secret of the Service Principal which is assigned the "Azure Connected Machine Onboarding" role in order to run the script, but that isn't mentioned in the question.

    3. N

       NazerRazer

       2023-10-19

       Selected B2 upvotes

       So the correct answer is: B. Assign Admin1 the Azure Connected Machine Onboarding role for RG1. Having a local admin account on the server is helpful for running scripts and performing server-level tasks, but it's the Azure role and the onboarding process that grant the necessary permissions to configure the server for Azure Arc management. So, a local admin account is a component of the process but not sufficient on its own to perform the Azure Arc onboarding action. You need the proper Azure role assigned to enable the integration between the local server and Azure Arc. Here's why the option is not the first step. A. From the Azure portal, generate a new onboarding script: This is typically done after you've assigned the necessary role permissions to the user. You generate the script to onboard the machines once the user has the required permissions.

    4. R

       RemmyT

       2024-06-20

       Selected B2 upvotes

       Tested in lab: Admin1 without Azure Connected Machine onboarding role assigned on RG1 are unable to onboard any server to Azure. Also are unable to see any machine in Azure Arc | Machines and and as a result it cannot manage any server. After assigning it the Azure Connected Machine onboarding role on RG1, Admin1 can see all the machines in Azure Arc, can manage the servers and can onboard the servers with the generated script. Note: Follow best security practices and avoid using an Azure account with Owner access to onboard servers. Instead, use an account that only has the Azure Connected Machine onboarding or Azure Connected Machine resource administrator role assignment. See Azure Identity Management and access control security best practices for more information. https://learn.microsoft.com/en-us/azure/azure-arc/servers/onboard-portal

16. Question 16 of 25

    HOTSPOT - You have an Azure subscription that contains the virtual machines shown in the following table.

    

    You plan to implement Azure Automanage for Windows Server. You need to identify the operating system prerequisites. Which virtual machines support Hotpatch, and which virtual machines support SMB over QUIC? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Hotpatch: https://learn.microsoft.com/en-us/windows-server/get-started/hotpatch Supported platforms Hotpatch is supported on the following operating systems for VMs running on Azure and Azure Stack HCI: Windows Server 2022 Datacenter: Azure Edition Core Windows Server 2022 Datacenter: Azure Edition with Desktop Experience SMB over QUIC: https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-over-quic Prerequisites To use SMB over QUIC, you need the following things: -A file server running Windows Server 2022 Datacenter: Azure Edition (Microsoft Server Operating Systems) -A Windows 11 computer (Windows for business) Windows Admin Center (Homepage) A Public Key Infrastructure to issue certificates like Active Directory Certificate Server or access to a trusted third party certificate issuer like Verisign, Digicert, Let's Encrypt, and so on.

    Adapted from community discussion by MR_Eliot · 2023-09-22 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. M

       MR_Eliot

       2023-09-22

       9 upvotes

       Windows Server 2022 is the latest Long-Term Servicing Channel (LTSC) release with five years of mainstream support + five years of extended support. Choose the image that is right for your application needs. - Server with Desktop Experience includes all roles and a graphical user interface (GUI). Server Core omits the GUI for a smaller OS footprint. - Azure Edition with Desktop Experience- includes additional new functionality such as >>Hotpatch, SMB over QUIC >Hotpatch, SMB over QUIC<<, extended network for Azure, and is optimized to run in Azure. So answer is "VM1" & "VM2" for both instances.

    2. M

       MR_Eliot

       2023-09-22

       4 upvotes

       Hotpatch: https://learn.microsoft.com/en-us/windows-server/get-started/hotpatch Supported platforms Hotpatch is supported on the following operating systems for VMs running on Azure and Azure Stack HCI: Windows Server 2022 Datacenter: Azure Edition Core Windows Server 2022 Datacenter: Azure Edition with Desktop Experience SMB over QUIC: https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-over-quic Prerequisites To use SMB over QUIC, you need the following things: -A file server running Windows Server 2022 Datacenter: Azure Edition (Microsoft Server Operating Systems) -A Windows 11 computer (Windows for business) Windows Admin Center (Homepage) A Public Key Infrastructure to issue certificates like Active Directory Certificate Server or access to a trusted third party certificate issuer like Verisign, Digicert, Let's Encrypt, and so on.

    3. R

       rknichols01

       2024-01-08

       1 upvote

       sorry, did not post the hot patch support list. Hotpatch is supported only on VMs and Azure Stack HCI created from images with the exact combination of publisher, offer and sku from the below OS images list. Windows Server container base images or Custom images or any other publisher, offer, sku combinations aren't supported. Publisher OS Offer Sku MicrosoftWindowsServer WindowsServer 2022-Datacenter-Azure-Edition-Core MicrosoftWindowsServer WindowsServer 2022-Datacenter-Azure-Edition-Core-smalldisk MicrosoftWindowsServer WindowsServer 2022-Datacenter-Azure-Edition-Hotpatch MicrosoftWindowsServer WindowsServer 2022-Datacenter-Azure-Edition-Hotpatch-smalldisk https://learn.microsoft.com/en-us/windows-server/get-started/hotpatch

    4. R

       rknichols01

       2024-01-08

       1 upvote

       the answers are correct. Automanage supports the following Windows versions: Windows Server 2012 R2 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 Azure Edition Windows 10 https://learn.microsoft.com/en-us/azure/automanage/automanage-windows-server Create an Azure VM with the Windows Server 2022 Datacenter: Azure Edition image to get the Automanage for Windows Server capabilities, including SMB over QUIC. https://learn.microsoft.com/en-us/azure/automanage/automanage-smb-over-quic

17. Question 17 of 25

    You have an Azure virtual machine named VM1 that runs Windows Server. You perform the following actions on VM1: ✑ Create a folder named Folder1 on volume C. ✑ Create a folder named Folder2 on volume D. ✑ Add a new data disk to VM1 and create a new volume that is assigned drive letter E. ✑ Install an app named App1 on volume E. You plan to resize VM1. Which objects will present after you resize VM1?

    • AFolder1, volume E, and App1 only
    • BFolder1 only
    • CFolder1 and Folder2 only
    • DFolder1, Folder2, App1, and volume E

    Show answer

    Correct answer: A

    How others answered

    • A79%
    • D21%

    Explanation

    the answer is A, folder 2 is on D: which by default is the scratch disk that is wiped on a re-boot, a re-size of the VM requires a reboot of the VM, therefore the contents of D will be wiped

    Adapted from community discussion by lpkramit · 2022-05-08 · 44 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. L

       lpkramit

       2022-05-08

       44 upvotes

       the answer is A, folder 2 is on D: which by default is the scratch disk that is wiped on a re-boot, a re-size of the VM requires a reboot of the VM, therefore the contents of D will be wiped

    2. V

       VinoTee

       2022-05-14

       5 upvotes

       This is correct. Volume D is a default temporary storage, hence, anything that you store on that volume letter will be wiped. See link below with the highlighted answer: https://www.cloudelicious.net/azure-vms-and-their-temporary-storage/#:~:text=For%20Windows%20Server%2C%20the%20temporary%20disk%20is%20mounted%20as%20D%3A%5C.%20Linux%20based%20VM%E2%80%99s%20have%20the%20temporary%20disk%20mounted%20as%20%E2%80%9C/dev/sdb1%E2%80%9D.%20Of%20course%2C%20the%20same%20principles%20apply%2C%20your%20risk%20losing%20data%20that%20can%E2%80%99t%20be%20recovered%20when%20storing%20data%20on%20this%20disk.

    3. S

       syu31svc

       2023-03-21

       Selected A3 upvotes

       https://learn.microsoft.com/en-us/azure/virtual-machines/managed-disks-overview Most VMs contain a temporary disk, which is not a managed disk. The temporary disk provides short-term storage for applications and processes, and is intended to only store data such as page or swap files. Data on the temporary disk may be lost during a maintenance event or when you redeploy a VM. During a successful standard reboot of the VM, data on the temporary disk will persist. For more information about VMs without temporary disks, see Azure VM sizes with no local temporary disk. On Azure Linux VMs, the temporary disk is typically /dev/sdb and on Windows VMs the temporary disk is D: by default. "resize VM1" means a restart so answer is A

    4. G

       gargaditya

       2023-12-31

       2 upvotes

       Answer D is correct. As per https://learn.microsoft.com/en-us/azure/virtual-machines/resize-vm?tabs=portal, • After you create a virtual machine (VM), you can scale the VM up or down by changing the VM size. • In some cases, you must deallocate(STOP) the VM first . Deallocation may be necessary if the new size isn't available on the same hardware cluster that is currently hosting the VM. • If the virtual machine is currently running, changing its size will cause it to restart. • If your VM is still running and you don't see the size you want in the list, stopping the virtual machine may reveal more sizes. In summary,here, a reboot will take place. Temporary disk(usually D if not labeled as data disk) is wiped on a stop ; but it persists on a standard reboot. https://learn.microsoft.com/en-us/azure/virtual-machines/managed-disks-overview#temporary-disk Hence, all of folder1, folder2, E drive and app remain intact on REBOOT. Had there been a mention of state of app or user connection, that would NOT be maintained post reboot.

18. Question 18 of 25

    You have an on-premises server named Server1 that runs Windows Server. You have an Azure virtual network that contains an Azure virtual network gateway. You need to connect only Server1 to the Azure virtual network. What should you use?

    • Aa Site-to-Site VPN
    • BAzure Network Adapter
    • Can ExpressRoute circuit
    • DAzure Extended Network

    Show answer

    Correct answer: B

    How others answered

    • B92%

    Explanation

    https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/use-azure-network-adapter Azure Network Adapter Point-to-Site VPN connections are useful when you want to connect to your virtual network from a remote location, such as a branch office, store, or other location. You can also use Azure Network Adapter instead of a Site-to-Site VPN when you require only a few servers to connect to a virtual network. Azure Network Adapter connections don't require a VPN device or a public-facing IP address. Answer is B

    Adapted from community discussion by syu31svc · 2023-03-14 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. M

       marlonmarlon

       2022-08-31

       Selected B11 upvotes

       B https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/use-azure-network-adapter

    2. S

       syu31svc

       2023-03-14

       Selected B4 upvotes

       https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/use-azure-network-adapter Azure Network Adapter Point-to-Site VPN connections are useful when you want to connect to your virtual network from a remote location, such as a branch office, store, or other location. You can also use Azure Network Adapter instead of a Site-to-Site VPN when you require only a few servers to connect to a virtual network. Azure Network Adapter connections don't require a VPN device or a public-facing IP address. Answer is B

    3. V

       Vintya

       2022-09-13

       Selected B3 upvotes

       When to use Azure Network Adapter Azure Network Adapter Point-to-Site VPN connections are useful when you want to connect to your virtual network from a remote location, such as a branch office, store, or other location. You can also use Azure Network Adapter instead of a Site-to-Site VPN when you require only a few servers to connect to a virtual network. Azure Network Adapter connections don't require a VPN device or a public-facing IP address. Source: https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/use-azure-network-adapter

    4. J

       johosofat

       2022-11-08

       Selected B4 upvotes

       AH single server with wac- azure network adapter- https://learn.microsoft.com/en-us/azure/architecture/hybrid/azure-network-adapter extended virtual network would be the new hotness and may not be on test- and would not put these 2 togther? i hope haha

19. Question 19 of 25

    You have an on-premises network that is connected to an Azure virtual network by using a Site-to-Site VPN. Each network contains a subnet that has the same IP address space. The on-premises subnet contains a virtual machine. You plan to migrate the virtual machine to the Azure subnet. You need to migrate the on premises virtual machine to Azure without modifying the IP address. The solution must minim administrative effort. What should you implement before you perform the migration?

    • AAzure Extended Network
    • BAzure Virtual Network NAT
    • CAzure Application Gateway
    • DAzure virtual network peering

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A. Azure Extended Network This allows you to extend your on-premises network to Azure and allows the virtual machine to retain its IP address during the migration. It also allows for minimal administrative effort as it does not require additional configuration on the virtual machine or the on-premises network.

    Adapted from community discussion by empee1977 · 2023-01-28 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion3

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. R

       r50496a

       2022-05-11

       7 upvotes

       A correct: https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/azure-extended-network

    2. E

       empee1977

       2023-01-28

       Selected A5 upvotes

       A. Azure Extended Network This allows you to extend your on-premises network to Azure and allows the virtual machine to retain its IP address during the migration. It also allows for minimal administrative effort as it does not require additional configuration on the virtual machine or the on-premises network.

    3. S

       syu31svc

       2023-03-14

       Selected A3 upvotes

       101% is A The other options are completely invalid https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-overview https://learn.microsoft.com/en-us/azure/application-gateway/overview https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

20. Question 20 of 25

    HOTSPOT - You have on-premises file servers that run Windows Server as shown in the following table.

    

    You have the Azure file shares shown in the following table.

    

    You add a Storage Sync Service named Sync1 and an Azure File Sync sync group named Group1. Group1 uses share1 as a cloud endpoint. You register Server1 and Server2 with Sync1. You add D:\Folder1 from Server1 as a server endpoint in Group1. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-planning

    Adapted from community discussion by prepper666 · 2022-06-03 · 31 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. P

       prepper666

       2022-06-03

       31 upvotes

       Correct answer is No, No, Yes A sync group only has 1 cloud endpoint, so share 2 (a cloud endpoint) cannot be added. Only 1 server endpoint from the same server is allowed in the same sync group, so E:\Folder 2 of Server 1 cannot be a server endpoint. D:\Folder 1 is already the server endpoint within the sync group. Server 2can be added as a Server Endpoint as long as the server is registered. Remember a sync group is just a set of files to be kept in sync between servers or for caching on-prem. Each Share should have its own Sync Group

    2. B

       Bojana

       2022-05-17

       23 upvotes

       Box 1: No A sync group contains one cloud endpoint, or Azure file share, and at least one server endpoint. Box 2: No Azure File Sync does not support more than one server endpoint from the same server in the same Sync Group. Box 3: Yes Multiple server endpoints can exist on the same volume if their namespaces are not overlapping (for example, F:\sync1 and F:\sync2) and each endpoint is syncing to a unique sync group. Reference: https://docs.microsoft.com/en-us/answers/questions/110822/azure-file-sync-multiple-sync-directories-for-same.html https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide

    3. P

       Payday123

       2023-11-10

       5 upvotes

       NNY "A registered server can support multiple server endpoints, however, a sync group can only have one server endpoint per registered server at any given time. Other server endpoints within the sync group must be on different registered servers. Multiple server endpoints can exist on the same volume if their namespaces are not overlapping (for example, F:\sync1 and F:\sync2) and each endpoint is syncing to a unique sync group." https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-server-endpoint-create?tabs=azure-portal

    4. S

       syu31svc

       2023-03-25

       5 upvotes

       https://learn.microsoft.com/en-us/answers/questions/110822/azure-file-sync-multiple-sync-directories-for-same Azure File Sync does not support more than one server endpoint from the same server in the same sync group https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide?tabs=azure-portal%2Cproactive-portal A registered server can support multiple server endpoints, however a sync group can only have one server endpoint per registered server at any given time No No Yes

21. Question 21 of 25

    HOTSPOT - You have a server named Server1 that runs Windows Server. Server1 has a just-a-bunch-of-disks (JBOD) enclosure attached. You plan to create a storage pool on Server1 and a virtual disk that will use a mirror layout. You are considering whether to use a two-way or a three-way mirror layout. What is the minimum number of disks required for each type of mirror layout? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    2 and 5 https://learn.microsoft.com/en-us/training/modules/implement-storage-spaces-storage-spaces-direct/2-define-storage-spaces-architecture-components Resiliency levels To create a highly available virtual disk, you need at least one physical disk that satisfies the following requirements: 1.One physical disk is required to create a storage pool. 2.A minimum of two physical disks are required to create a resilient mirror virtual disk. 3.A minimum of three physical disks are required to create a virtual disk with resiliency through parity. 4.Three-way mirroring requires at least five physical disks. 5.Disks must be blank and unformatted. No volume can exist on the disks.

    Adapted from community discussion by Joystickj · 2023-04-13 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. J

       Joystickj

       2023-04-13

       12 upvotes

       2 and 5 https://learn.microsoft.com/en-us/training/modules/implement-storage-spaces-storage-spaces-direct/2-define-storage-spaces-architecture-components Resiliency levels To create a highly available virtual disk, you need at least one physical disk that satisfies the following requirements: 1.One physical disk is required to create a storage pool. 2.A minimum of two physical disks are required to create a resilient mirror virtual disk. 3.A minimum of three physical disks are required to create a virtual disk with resiliency through parity. 4.Three-way mirroring requires at least five physical disks. 5.Disks must be blank and unformatted. No volume can exist on the disks.

    2. S

       SIAMIANJI

       2024-11-02

       3 upvotes

       To create a storage pool with a mirror layout, let’s explore the minimum disk requirements for both two-way and three-way mirrors: Two-Way Mirror: A two-way mirror provides redundancy by maintaining two copies of data. The minimum number of disks required for a two-way mirror is two. It ensures fault tolerance against a single disk failure. Three-Way Mirror: A three-way mirror enhances redundancy by maintaining three copies of data. The minimum number of disks required for a three-way mirror is five. It provides additional fault tolerance, allowing for two simultaneous disk failures.

    3. A

       ahenriquez02

       2024-01-11

       2 upvotes

       Resiliency levels To create a highly available virtual disk, you need at least one physical disk that satisfies the following requirements: One physical disk is required to create a storage pool. A minimum of two physical disks are required to create a resilient mirror virtual disk. A minimum of three physical disks are required to create a virtual disk with resiliency through parity. Three-way mirroring requires at least five physical disks. Disks must be blank and unformatted. No volume can exist on the disks. You can attach disks by using a variety of bus interfaces, including, small computer system interface (SCSI), Serial Attached SCSI (SAS), Serial ATA (SATA), NVM Express (NVMe).

    4. J

       johosofat

       2023-05-06

       3 upvotes

       This really is a dumb question - you never have a single server pool- but i suppose this is good for academic question. = - Use the storage calculator and play with the numbers - you will see the 2 for two way and 5 for 3 ways is correct- only when you hit 5 drives and 4 nodes- do you see the three mirror for the first time- https://s2dcalc.blob.core.windows.net/www/index.html https://blog.sqlxdetails.com/capacity-calculator-for-storage-spaces/

22. Question 22 of 25

    HOTSPOT - Your company has a main office and 10 branch offices that are connected by using WAN links. The network contains an Active Directory domain. All users have laptops and regularly travel between offices. You plan to implement BranchCache in the branch offices. In each branch office, you install a server that runs Windows Server and the BranchCache feature. You register the servers in Active Directory. You need to configure the laptops to use the local BranchCache server automatically. The solution must minimize administrative effort. Which two Group Policy settings should you configure? To answer, select the settings in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    "Turn on BrancheCache" and "Enable Automatic Hosted Cache Discovery..." From the "Enable Automatic Hosted Cache Discovery..." GPO Help: If you enable this policy setting in addition to the "Turn on BranchCache" policy setting, BranchCache clients attempt to discover hosted cache servers in the local branch office.

    Adapted from community discussion by chadamantium · 2023-02-01 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. C

       chadamantium

       2023-02-01

       15 upvotes

       "Turn on BrancheCache" and "Enable Automatic Hosted Cache Discovery..." From the "Enable Automatic Hosted Cache Discovery..." GPO Help: If you enable this policy setting in addition to the "Turn on BranchCache" policy setting, BranchCache clients attempt to discover hosted cache servers in the local branch office.

    2. E

       empee1977

       2023-02-04

       9 upvotes

       Set the "Turn on BranchCache" policy to "Enabled". This will enable the BranchCache feature on the laptops. Set the "Configure BranchCache" policy to "Hosted Cache mode". This will configure the laptops to use the local BranchCache server automatically, without requiring any manual configuration.

    3. S

       skycrap

       2023-06-14

       7 upvotes

       "Turn on BranchCache" "Enable Automatic Hosted Cache Discovery by Service Connection Point" Why: question ask “The solution must minimize administrative effort”. If you use “Set BrancheCache Hosted mode” would work but you have to define in every site de name of the cache server.

    4. N

       NazerRazer

       2023-10-28

       7 upvotes

       --> Turn on BranchCache Enable Automatic Hosted Cache Discovery by Service Connection ... Set BranchCache Hosted Cache mode<--- THIS IS A SETTING FOR THE SERVER

23. Question 23 of 25

    DRAG DROP - Which three actions should you perform in sequence to meet the security requirements for Webapp1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Reference: https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview

    Adapted from community discussion by Leocan · 2022-11-07 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. L

       Leocan

       2022-11-07

       5 upvotes

       Missing a step to install gMSA on the Web servers. “Configure the IIS application pool to run as a specified user account" can be understood as "run as the gMSA account."

    2. S

       syu31svc

       2023-03-30

       3 upvotes

       https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/getting-started-with-group-managed-service-accounts https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/create-the-key-distribution-services-kds-root-key?source=recommendations Answer is correct

    3. J

       johosofat

       2022-11-06

       3 upvotes

       This is correct only because the GMSA is created in local AD- because we have that as the root domain- this GMSA has to be created in the root domain- See cross domain usage- when you create a on Prem GMSA - it will work in the child domain if you have network ATP- which is a new name for Defender if you look it up https://azurecloudai.blog/2020/04/15/create-a-group-managed-service-account-gmsa/

    4. I

       IcE

       2024-05-22

       3 upvotes

       1. Configure the IIS app pool to run as Network Service 2. Create gMSA 3. Create the key

24. Question 24 of 25

    You need to meet the technical requirements for Server3. Which users can perform the required tasks?

    • AAdmin3 only
    • BAdmin1 and Admin3 only
    • CAdmin1 only
    • DAdmin1, Admin2, and Admin3
    • EAdmin1 and Admin2 only

    Show answer

    Correct answer: C

    How others answered

    • C73%
    • B25%

    Only 73% agreed on this answer — treat it as contested rather than settled.

    Explanation

    My answer would be C because without any additional delegations only members of Enterprise Admins group are able to authorize DHCP servers.

    Adapted from community discussion by rimvydukas · 2022-09-25 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. R

       rimvydukas

       2022-09-25

       Selected C12 upvotes

       My answer would be C because without any additional delegations only members of Enterprise Admins group are able to authorize DHCP servers.

    2. S

       SanMan_NZ

       2024-02-13

       Selected C3 upvotes

       As this is not a single domain environment, the following from MS.... "You must authorize the Windows Server DHCP Server role in AD DS before it can begin leasing IP addresses. It's possible to have a single DHCP server providing IP addresses for subnets that contain multiple AD DS domains. Because of this, you must use an Enterprise Administrator account to authorize the DHCP server. In a single-domain environment, membership in Domain Admins is sufficient to authorize a DHCP server." https://learn.microsoft.com/en-us/training/modules/deploy-manage-dynamic-host-configuration-protocol/3-install-configure-dynamic-host-configuration-protocol

    3. R

       raulgar

       2023-03-12

       Selected C4 upvotes

       Correct answer C, you need a member of enterprise administrator or delegate permissions to authorizate the dhcp https://profadmins.com/2015/10/13/authorizing-dhcp-server-by-a-non-enterprise-administrator/

    4. L

       Lu5ck

       2022-12-20

       Selected C2 upvotes

       It is important to understand the scope of the authority. In this case, you are authorizing domain to have their own DNS. Domain admin only have authority within their own domain, they do not have authority on other domains, therefore, how can domain admin have any authority to authorize others? Root domain admin do have the authority, by default, to self-elevate themselves to obtain higher authority to do things. However, by default as well, they do not have that authority on the get go and assuming the default circumstances, only enterprise admin is the correct answer.

25. Question 25 of 25

    You are planning the implementation Azure Arc to support the planned changes. You need to configure the environment to support configuration management policies. What should you do?

    • ACreate a hybrid runbook worker in Azure Automation.
    • BDeploy the Azure Monitor agent to all the servers.
    • CDeploy the Azure Connected Machine agent to all the servers.
    • DHybrid Azure AD join all the serves.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Azure Arc enables organizations to manage servers, Kubernetes clusters, and applications anywhere, on-premises, multi-cloud, and edge, using the same management tooling as Azure resources in the cloud. To support configuration management policies, you need to deploy the Azure Connected Machine agent to all the servers. The agent will enable you to manage and enforce configuration policies on the servers from the Azure portal, ensuring that all servers comply with the desired state configuration defined in the policies.

    Adapted from community discussion by empee1977 · 2024-08-05 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-800 or CertExamHQ.

    1. E

       empee1977

       2024-08-05

       Selected C7 upvotes

       Azure Arc enables organizations to manage servers, Kubernetes clusters, and applications anywhere, on-premises, multi-cloud, and edge, using the same management tooling as Azure resources in the cloud. To support configuration management policies, you need to deploy the Azure Connected Machine agent to all the servers. The agent will enable you to manage and enforce configuration policies on the servers from the Azure portal, ensuring that all servers comply with the desired state configuration defined in the policies.

    2. S

       syu31svc

       2024-09-30

       Selected C2 upvotes

       https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview Azure Policy's machine configuration feature provides native capability to audit or configure operating system settings as code, both for machines running in Azure and hybrid Arc-enabled machines. The feature can be used directly per-machine, or at-scale orchestrated by Azure Policy. To manage settings inside a machine, a virtual machine extension is enabled and the machine must have a system-managed identity. The extension downloads applicable machine configuration assignment and the corresponding dependencies. The identity is used to authenticate the machine as it reads and writes to the machine configuration service. The extension isn't required for Arc-enabled servers because it's included in the Arc Connected Machine agent. C is correct

    3. J

       johosofat

       2024-05-06

       Selected C2 upvotes

       since 22h2- the connected agent installs itself if you do the azure registration right with AZHCI- but if it does not install then you have to - here is some basic info #1 https://dp.stackhci.azure.com/health browse this with invoke-webrequest -url " https://dp.stackhci.azure.com/health" if you dont get a 200 then you will need to add this URL to their whitelist - this is proof for the cusotmer that MS changed - Please make a note of the Firewall Rule change for AZHCIOS here Firewall requirements for Azure Stack HCI - Azure Stack HCI | Microsoft Learn https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-overview

    4. L

       Leocan

       2024-05-07

       2 upvotes

       To connect hybrid machines to Azure, you install the Azure Connected Machine agent on each machine. This agent does not replace the Azure Log Analytics agent / Azure Monitor Agent. https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-800 practice, question 1 of 25