Configuring Windows Server Hybrid Advanced Services practice questions

1. Question 1 of 25

   You have a Microsoft Sentinel deployment and 100 Azure Arc-enabled on-premises servers. All the Azure Arc-enabled resources are in the same resource group. You need to onboard the servers to Microsoft Sentinel. The solution must minimize administrative effort. What should you use to onboard the servers to Microsoft Sentinel?

   • AAzure Automation
   • BAzure Policy
   • CAzure virtual machine extensions
   • DMicrosoft Defender for Cloud

   Show answer

   Correct answer: B

   How others answered

   • B94%

   Explanation

   Correct Answer "you can use Azure Policy to audit settings in the operating system of an Azure Arc-enabled server, if a setting is not compliant you can also trigger a remediation task (deployIfNotExists)."

   Adapted from community discussion by xxxxx85xx · 2022-04-23 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

   1. X

      xxxxx85xx

      2022-04-23

      13 upvotes

      Correct Answer "you can use Azure Policy to audit settings in the operating system of an Azure Arc-enabled server, if a setting is not compliant you can also trigger a remediation task (deployIfNotExists)."

   2. L

      Leocan

      2022-12-22

      Selected B4 upvotes

      Enforce organization standards and assess compliance at scale for all your resources anywhere with Azure Policy. https://learn.microsoft.com/en-us/azure/architecture/hybrid/azure-arc-hybrid-config

   3. S

      syu31svc

      2023-05-01

      Selected B3 upvotes

      Please disregard my previous post https://learn.microsoft.com/en-us/azure/governance/policy/overview It's important to recognize that with the introduction of Azure Arc, you can extend your policy-based governance across different cloud providers and even to your local datacenters. Chaning my answer to B

   4. T

      Telekon

      2023-03-01

      2 upvotes

      Azure automation would also be correct ? https://learn.microsoft.com/en-us/azure/azure-arc/servers/concept-log-analytics-extension-deployment?source=recommendations

2. Question 2 of 25

   You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant by using password hash synchronization. You have a Microsoft 365 subscription. All devices are hybrid Azure AD-joined. Users report that they must enter their password manually when accessing Microsoft 365 applications. You need to reduce the number of times the users are prompted for their password when they access Microsoft 365 and Azure services. What should you do?

   • AIn Azure AD, configure a Conditional Access policy for the Microsoft Office 365 applications.
   • BIn the DNS zone of the AD DS domain, create an autodiscover record.
   • CFrom Azure AD Connect, enable single sign-on (SSO).
   • DFrom Azure AD Connect, configure pass-through authentication.

   Show answer

   Correct answer: C

   How others answered

   • C75%
   • A25%

   Explanation

   Answer is not correct. The computers are hybrid AAD joined, PC Windows 10 and later have PRT. Seamless SSO are for Windows 7/8. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-sso#sso-via-primary-refresh-token-vs-seamless-sso I suggest the answer A, configuring sign in frequency with conditional access (answer A).

   Adapted from community discussion by examonlabs · 2023-05-08 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

   1. E

      examonlabs

      2023-05-08

      4 upvotes

      Answer is not correct. The computers are hybrid AAD joined, PC Windows 10 and later have PRT. Seamless SSO are for Windows 7/8. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-sso#sso-via-primary-refresh-token-vs-seamless-sso I suggest the answer A, configuring sign in frequency with conditional access (answer A).

   2. W

      windowsmodulesinstallerworker

      2023-12-02

      2 upvotes

      For Windows 10, Windows Server 2016 and later versions, it’s recommended to use SSO via primary refresh token (PRT). For Windows 7 and Windows 8.1, it’s recommended to use Seamless SSO. Seamless SSO needs the user's device to be domain-joined, but it isn't used on Windows 10 Microsoft Entra joined devices or Microsoft Entra hybrid joined devices. SSO on Microsoft Entra joined, Microsoft Entra hybrid joined, and Microsoft Entra registered devices works based on the Primary Refresh Token (PRT)

   3. S

      syu31svc

      2023-04-25

      Selected C1 upvote

      https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso Azure Active Directory Seamless single sign-on (Azure AD Seamless SSO) automatically signs users in when they are on their corporate devices connected to your corporate network. When enabled, users don't need to type in their passwords to sign in to Azure AD, and usually, even type in their usernames. This feature provides your users easy access to your cloud-based applications without needing any additional on-premises components C for correct

   4. V

      Vallion

      2024-10-16

      Selected C1 upvote

      I see how PRT is more suitable when using W10+, but the client version is not listed here and PRT does not work on older devices. I'd still pick C because this works will old and modern devices, but the question here is simply missing information. Just know that W10+ = PRT (A) and anything older = SSSO (C)

3. Question 3 of 25

   You have an Azure subscription that has Microsoft Defender for Cloud enabled. You have 50 Azure virtual machines that run Windows Server. You need to ensure that any security exploits detected on the virtual machines are forwarded to Defender for Cloud. Which extension should you enable on the virtual machines?

   • AVulnerability assessment for machines
   • BMicrosoft Dependency agent
   • CLog Analytics agent for Azure VMs
   • DGuest Configuration agent

   Show answer

   Correct answer: A

   How others answered

   • A85%
   • C15%

   Explanation

   If I understand it correctly, then there's a difference between a VM extension and an agent. As the question is about an extension and three of the four answers mention an agent, the answer must be A, I guess...

   Adapted from community discussion by GoforIT21 · 2022-09-24 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

   1. G

      GoforIT21

      2022-09-24

      Selected A7 upvotes

      If I understand it correctly, then there's a difference between a VM extension and an agent. As the question is about an extension and three of the four answers mention an agent, the answer must be A, I guess...

   2. L

      Leocan

      2022-12-22

      Selected A4 upvotes

      https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-vulnerability-assessment-agentless

   3. S

      syu31svc

      2023-04-25

      Selected A2 upvotes

      https://learn.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-vm When a machine is found that doesn't have a vulnerability assessment solution deployed, Defender for Cloud generates the security recommendation: Machines should have a vulnerability assessment solution. Use this recommendation to deploy the vulnerability assessment solution to your Azure virtual machines and your Azure Arc-enabled hybrid machines. Answer is A

   4. R

      rimvydukas

      2022-12-26

      3 upvotes

      Defender for Cloud's integrated vulnerability assessment solution works seamlessly with Azure Arc. When you've deployed Azure Arc, your machines will appear in Defender for Cloud and no Log Analytics agent is required.

4. Question 4 of 25

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains the domains shown in the following table.

   

   You are implementing Microsoft Defender for Identity sensors. You need to install the sensors on the minimum number of domain controllers. The solution must ensure that Defender for Identity will detect all the security risks in both the domains. What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   Reference: https://docs.microsoft.com/en-us/defender-for-identity/technical-faq#deployment https://docs.microsoft.com/en-us/defender-for-identity/install-step4

   Adapted from community discussion by syu31svc · 2023-04-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

   1. T

      thaizzzz

      2022-06-16

      11 upvotes

      Every domain controller in the environment should be covered by a Defender for Identity sensor or standalone sensor. Agree!

   2. T

      tatendazw

      2022-08-01

      7 upvotes

      Sensor: https://docs.microsoft.com/en-us/defender-for-identity/technical-faq#how-many-defender-for-identity-sensors-do-i-need Access Key: part 4, https://docs.microsoft.com/en-us/defender-for-identity/download-sensor

   3. S

      syu31svc

      2023-04-28

      2 upvotes

      https://learn.microsoft.com/en-us/defender-for-identity/technical-faq#deployment%20https://docs.microsoft.com/en-us/defender-for-identity/install-step4 Every domain controller in the environment should be covered by a Defender for Identity sensor or standalone sensor https://learn.microsoft.com/en-us/defender-for-identity/download-sensor A pane will open, providing you with a button to download the sensor installer and a generated access key Answer is correct

   4. R

      RemmyT

      2024-08-07

      1 upvote

      Domain controllers that require the sensors: - All the domain controllers in the forest: Authentication information that must be provided during the sensor installation: - The access key generated by the Microsoft 365 Defender portal Depreciated: - The access key generated by the Microsoft Defender for Identity portal

5. Question 5 of 25

   You have an Azure virtual machine named VM1 that runs Windows Server. You need to encrypt the contents of the disks on VM1 by using Azure Disk Encryption. What is a prerequisite for implementing Azure Disk Encryption?

   • ACustomer Lockbox for Microsoft Azure
   • Ban Azure key vault
   • Ca BitLocker recovery key
   • Ddata-link layer encryption in Azure

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Correct B) Azure Disk Encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. It uses the BitLocker feature of Windows to provide volume encryption for the OS and data disks of Azure virtual machines (VMs), and is integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets. https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-overview

   Adapted from community discussion by AvoKikinha · 2022-05-15 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

   1. A

      AvoKikinha

      2022-05-15

      Selected B7 upvotes

      Correct B) Azure Disk Encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. It uses the BitLocker feature of Windows to provide volume encryption for the OS and data disks of Azure virtual machines (VMs), and is integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets. https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-overview

   2. T

      thaizzzz

      2022-06-16

      4 upvotes

      It askes for a prerequisite. Also see this link: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-key-vault

   3. S

      syu31svc

      2023-04-25

      Selected B2 upvotes

      https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-overview "integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets." B is the answer

   4. T

      tatendazw

      2022-08-01

      2 upvotes

      Recommended key storage solution in MS Azure, https://docs.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest#azure-key-vault

6. Question 6 of 25

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server as shown in the following table.

   

   Server1 has the connection security rules shown in the following table.

   

   Server2 has the connection security rules shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/change-rules-from-request-to-require-mode

   Adapted from community discussion by Lu5ck · 2023-01-19 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

   1. L

      Lu5ck

      2023-01-19

      10 upvotes

      Request - Authenticate whenever possible but authentication is not required Require - Must be authenticated to be allowed NTLM is the fallback protocol and is always available unless explicitly disabled. https://learn.microsoft.com/en-us/windows-server/security/kerberos/ntlm-overview With that said, the answer indeed is Y, Y, Y.

   2. L

      Leocan

      2022-12-22

      7 upvotes

      1. Y - combine Rule12 and Rule 31. 2. Y - Rule 31, (assume there are no connection security rules on Server3) 3. Y - Rule 31, (assume there are no connection security rules on Server3)

   3. G

      GoforIT21

      2022-10-10

      3 upvotes

      I think the answer is indeed Y,N,N. Here is a source that states that more specific rules take precedence: "Administrators should keep the following rule precedence behaviors in mind when allowing these inbound exceptions. 1. Explicitly defined allow rules will take precedence over the default block setting. 2. Explicit block rules will take precedence over any conflicting allow rules. 3. More specific rules will take precedence over less specific rules, except if there are explicit block rules as mentioned in 2. (For example, if the parameters of rule 1 include an IP address range, while the parameters of rule 2 include a single IP host address, rule 2 will take precedence.)" (https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/best-practices-configuring) In that case, rule32 does indeed block connections between server2 and server3. In contrast, rule11 and rule32 nicely overlap so that connections between server1 and server2 are possible.

   4. J

      joehoesofat

      2022-12-04

      4 upvotes

      So we cant really answer any question about node 3 because we dont know its rules- so that makes this question easier- you see that ntlm is required for node 1 but not node 2- node 2 can do KErberos- and node 2 can a well- so the first one is Y. beyond that- It would seem node 3 would need to have NTLM enabled for the other 2 questions to be yes- but since we dont know we say no and no so Yes no no

7. Question 7 of 25

   You have an Azure subscription that contains a user named User1 and the resources shown in the following table.

   

   User1 has a computer named Computer1 that runs Windows 11. User1 works from home and establishes a Point-to-Site (P2S) connection to GW1 to access AppSvr1. You deploy the resources shown in the following table.

   

   User1 cannot access AppSvr2. You need to ensure that User1 can access AppSvr2. What should you do?

   • AOn Computer1, download and reinstall the VPN client.
   • BCreate a route table and associate the table with GatewaySubnet on VNet1.
   • COn Computer1, modify the Windows Defender Firewall settings.
   • DAdd a service endpoint to VNet2.

   Show answer

   Correct answer: A

   How others answered

   • A75%
   • B25%

   Explanation

   https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview For peered virtual networks, resources in either virtual network can directly connect with resources in the peered virtual network. The traffic between virtual machines in peered virtual networks is routed directly through the Microsoft backbone infrastructure, not through a gateway or over the public Internet. Full connectivity is the default option. So, just reinstall the client.

   Adapted from community discussion by Kurko · 2023-02-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

   1. N

      nefaxto

      2023-02-10

      Selected A12 upvotes

      Perhaps A is correct https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing

   2. A

      afridi43

      2023-10-01

      3 upvotes

      B is correct B. Create a route table and associate the table with GatewaySubnet on VNet1. Reason below: 1- User1 is already able to establish a Point-to-Site (P2S) connection to GW1 to access AppSvr1. This indicates that the VPN client on Computer1 is configured correctly for the existing P2S connection. 2- The problem is that User1 cannot access AppSvr2, which is located in Vnet2 and not directly connected to the P2S connection. To enable User1 to access resources in Vnet2, you need to ensure that the traffic from the P2S connection is correctly routed to Vnet2. 3- Creating a route table and associating it with the GatewaySubnet on VNet1 allows you to define custom routes for the VPN traffic. You can configure the route table to route traffic destined for Vnet2 through the peering connection between Vnet1 and Vnet2.

   3. W

      wyvern8888

      2023-04-24

      3 upvotes

      B. Create a route table and associate the table with GatewaySubnet on VNet1. Since User1 can establish a P2S connection to GW1, User1 can access resources in VNet1. However, User1 cannot access resources in VNet2 because there is no route between the two VNets. To enable access to AppSvr2, you need to create a route table and associate the table with GatewaySubnet on VNet1. The route table should contain a user-defined route that has a destination prefix of the address space of VNet2 (10.2.0.0/16 in this case) and the next hop type Virtual appliance. The next hop address should be the IP address of the virtual network gateway on VNet1. This route table will enable User1 to access AppSvr2 over the P2S connection to GW1.

   4. T

      thefscale

      2023-01-29

      4 upvotes

      Azure default routes will be populated automatically once peering is established, no need for manual routing changes with Route Tables. Will need to re-download the client and reinstall it again, So the answer is A

8. Question 8 of 25

   Your network contains an Active Directory Domain Services (AD DS) forest. The forest functional level is Windows Server 2012 R2. The forest contains the domains shown in the following table.

   

   You create a user named Admin1. You need to ensure that Admin1 can add a new domain controller that runs Windows Server 2022 to the east.contoso.com domain. The solution must follow the principle of least privilege. To which groups should you add Admin1?

   • AEAST\Domain Admins only
   • BCONTOSO\Enterprise Admins only
   • CCONTOSO\Schema Admins and EAST\Domain Admins
   • DCONTOSO\Enterprise Admins and CONTOSO\Schema Admins

   Show answer

   Correct answer: A

   How others answered

   • A88%

   Explanation

   I'm not so sure. As shown in this link, there are no forest-wide updates, domain-wide updates, or schema updates required to install a 2022 DC in a domain that already has a 2019 DC. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/adprep/changes-made-by-adprep Therefore, Domain Admins in the target domain should suffice.

   Adapted from community discussion by NotThatGuy242 · 2024-03-28 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

   1. N

      NotThatGuy242

      2024-03-28

      6 upvotes

      I'm not so sure. As shown in this link, there are no forest-wide updates, domain-wide updates, or schema updates required to install a 2022 DC in a domain that already has a 2019 DC. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/adprep/changes-made-by-adprep Therefore, Domain Admins in the target domain should suffice.

   2. N

      nap61

      2024-08-01

      Selected A2 upvotes

      According with this article https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers a WS2022 DC can be installed in a FL 2008 and above without have to prepare de forest. Also is not required to runadprep. And, in this case the minimum to install a 2022DC in a 2012R2 FL would be Domain Admin of the respective domain, so East/Domain Admin.

   3. K

      Kuikz

      2024-05-20

      Selected A1 upvote

      https://u-tools.com/help/UpgradeRunAdprep.asp Before you can replace your old computer with a new computer that is running a new version of Windows Server, you need to first prepare the Active Directory schema by running adprep. The adprep console utility will upgrade the Active Directory schema to add new object types required by the new operating system. If you forget to run adprep, U-Move will display a warning message to remind you. Windows Server 2012-2022: Windows will automatically run adprep during the promotion of the new domain controller.

   4. S

      sardonique

      2025-02-24

      1 upvote

      EAST\Domain Admins is ok, tested in Lab it has successfully promoted to a DC, however it failed to create a DNS delegation on the parent domain. DNS delegation is an option, it is not mentioned in the question. Normally you would want to flag that option upon promotion of a DC in a Child domain. the premises of the question are met with "EAST\Domain Admins only", however you end up in a non optimally configured infrastructure. Yet another badly formulated misleading scenario. In the real world "EAST\Domain Admins only" is not enough, you would need either some admin privileges on the parent domain, or to cooperate with one of the parent domain admins to create the missing DNS delegations

9. Question 9 of 25

   HOTSPOT - You are planning the europe.fabrikam.com migration to support the on-premises migration plan. Where should you install the Password Export Server (PES) service, where should you generate the encryption key? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   Box 1: dc2.europe.fabrikam.com - To migrate passwords, select or install a backup domain controller in the source Windows NT 4.0 domain to act as the Secure Password Export server. Run the PES service on the dc2 domain controller in source domain europe.fabrikam.com domain. Scenario: * Migrate all users, groups, and client computers from europe.fabrikam.com to corp.fabrikam.com. * The migration will be performed by using the Active Directory Migration Tool (ADMT). * A computer named ADMTcomputer will be deployed to the corp.fabrikam.com domain to run ADMT migration procedures. * User accounts will retain their existing password. Box 2: dc1.corp.fabrikam.com - dc1.corp.fabrikam.com is the target server, and we generate the encryption key on it. To migrate passwords, select or install a backup domain controller in the source Windows NT 4.0 domain to act as the Secure Password Export server. This server will communicate with the Active Directory Migration Tool (ADMT) Server in the Target Domain. Note: Create an encryption key to install on the Password Export server Using an Encryption Key on the Password Export Server. The Password server encryption key is a key created on the ADMT server and is required to complete the installation of the Password Export Server. The encryption key can be created and stored in one or both of the following methods, by copying to the local floppy disk drive for transport to the password export server or by storing the encryption key in a folder on the local hard drive. Reference: https://www.serverbrain.org/secrets-2003/setting-up-an-admt-password-migration-server.html

   Adapted from community discussion by syu31svc · 2023-05-01 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

   1. D

      dieymir

      2022-10-02

      14 upvotes

      Generate encryption key in admtcomputer and install PES in dc2 Reference: https://akhil0087.home.blog/2020/09/10/password-migration-using-admt/

   2. S

      syu31svc

      2023-05-01

      6 upvotes

      https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc974435(v=ws.10)?redirectedfrom=MSDN#to-create-an-encryption-keyhttps://learn.microsoft.com/en-us/answers/questions/130203/admt-pes-password-export-server-31-x64-package-dow.html The PES service can be installed on any writable domain controller in the source domain The PES service installation in the source domain requires an encryption key. However, you must create the encryption key on the computer running the ADMT in the target domain Install PES on dc2.europe.fabrikam.com Generate encryption key on admtcomputer.fabrikam.com

   3. J

      joehoesofat

      2022-12-08

      3 upvotes

      Apologies - this was hard to pin down- -I was wrong earlier again - answer is : Source - Dc1.europe ENcryption key- ADMTserver === 1. The Encryption tool can be installed on the ADMT server in the target domain member server 2. The PES is installed on the DC in the source domain controller 3. generate the key in target admt and input into source PES 4. Run PES server to perform the migraiton - https://social.technet.microsoft.com/wiki/contents/articles/13904.how-to-migrate-users-across-forest-cross-forest-using-admt-3-2-with-sid-and-passwords.aspx https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc974435(v=ws.10)?redirectedfrom=MSDN#to-create-an-encryption-key https://learn.microsoft.com/en-us/answers/questions/130203/admt-pes-password-export-server-31-x64-package-dow.html

   4. R

      RemmyT

      2024-08-05

      1 upvote

      Fabrikam Case Study On-Premises Migration Plan Fabrikam has an Active Directory Domain Services (AD DS) forest that syncs with an Azure Active Directory (Azure AD) tenant. The AD DS forest contains two domains named corp.fabrikam.com and europe.fabrikam.com. The office in Paris contains a physical server named dc2.europe.fabrikam.com that runs Windows Server 2016 and is a domain controller for the europe.fabrikam.com domain. Migrate all users, groups, and client computers from europe.fabrikam.com to corp.fabrikam.com. - The migration will be performed by using the Active Directory Migration Tool (ADMT). - A computer named ADMTcomputer will be deployed to the corp.fabrikam.com domain to run ADMT migration procedures. - User accounts will retain their existing password Answer • Install the PES service on: dc2.europe.fabrikam.com • Generate the encryption key on: admtcomputer.fabrikam.com ADMTcomputer will be deployed to the corp.fabrikam.com domain so to name admtcomputer.fabrikam.com more likely is wrong. The right name could be : admtcomputer.corp.fabrikam.com

10. Question 10 of 25

    Which domain controller should be online to meet the technical requirements for DC4?

    • ADC1
    • BDC2
    • CDC3

    Show answer

    Correct answer: A

    How others answered

    • A83%

    Explanation

    The RID Master holds the global RID pool for the domain. The size is limited to 30-bits by default, so the maximum RID size is 2 to the power of 30, or about one billion. The RID Master assigns each Domain Controller a pool of RIDs to use for SID creation. By default, DCs are assigned 500 contiguous RIDs at a time and request a standby pool containing another 500 RIDs when they have used 50% of their original allocation. If a RID master is not online, the DC promotion cannot complete.

    Adapted from community discussion by Leocan · 2023-06-23 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. L

       Leocan

       2023-06-23

       Selected A10 upvotes

       The RID Master holds the global RID pool for the domain. The size is limited to 30-bits by default, so the maximum RID size is 2 to the power of 30, or about one billion. The RID Master assigns each Domain Controller a pool of RIDs to use for SID creation. By default, DCs are assigned 500 contiguous RIDs at a time and request a standby pool containing another 500 RIDs when they have used 50% of their original allocation. If a RID master is not online, the DC promotion cannot complete.

    2. G

       GoforIT21

       2023-03-28

       9 upvotes

       None, I would have said? The only answer that remotely makes sense is B, for the PDC emulator role...

    3. A

       ala76nl

       2024-01-18

       4 upvotes

       Follow these general steps before you promote a server to a DC that runs a newer version of Windows Server: Verify the target server meets the system requirements. Verify application compatibility. Review recommendations for moving to a newer version of Windows Server. Verify security settings. Check connectivity to the target server from the computer where you plan to run the installation. Check for availability of the necessary Flexible Single Master Operation (FSMO) roles in Active Directory. This step is required for the following scenarios: To install the first DC that runs the latest Windows Server version in an existing domain and forest, the machine where you run the installation needs connectivity to: The schema master to run adprep /forestprep. The infrastructure master to run adprep /domainprep. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers So answer A

    4. S

       SmartBiking

       2023-04-01

       6 upvotes

       The answer is correct - "If the Domain Naming Master role holder is lost, domains won't be able to be added or removed from the Active Directory forest. DCPROMO is also affected, meaning that servers can neither be promoted nor demoted"

11. Question 11 of 25

    HOTSPOT - You have a failover cluster named Cluster1 that contains the nodes shown in the following table.

    

    A File Server for general use cluster role named HAFS is configured as shown in the General exhibit. (Click the General tab.)

    

    The Advanced Policies settings for HAFS are configured as shown in the Advanced Policies exhibit. (Click the Advanced Policies tab.)

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Box 1: Yes - HAFS will move from Node1 to Node3 if we test failover for the cluster. Note: Test failover. Test failover of the clustered resource to validate cluster functionality. Take the following steps: 1. Connect to one of the SQL Server cluster nodes by using RDP. 2. Open Failover Cluster Manager. Select Roles. Notice which node owns the SQL Server FCI role. 3. Right-click the SQL Server FCI role. 4. Select Move, and then select Best Possible Node. 5. Failover Cluster Manager shows the role, and its resources go offline. The resources then move and come back online in the other node. Box 2: Yes - Node1 is the preferred owner. Box 3: No - Node2 is not a possible owner of the cluster. Reference: https://docs.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/failover-cluster-instance-vnn-azure-load-balancer-configure

    Adapted from community discussion by GoforIT21 · 2022-10-10 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. G

       GoforIT21

       2022-10-10

       8 upvotes

       Correct, Y,Y,N. To back up answer 1, Move... [to Best Possible Node] is a way to run a test failover. It does move the workload, even if it IS running on the best possible node (with the highest preference) already: "Test failover of the clustered resource to validate cluster functionality. Take the following steps: - Connect to one of the SQL Server cluster nodes by using RDP. - Open Failover Cluster Manager. Select Roles. Notice which node owns the SQL Server FCI role. - Right-click the SQL Server FCI role. - Select Move, and then select Best Possible Node." (https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/failover-cluster-instance-vnn-azure-load-balancer-configure?view=azuresql&tabs=ilb)

    2. R

       Robrol

       2023-02-12

       4 upvotes

       Correct Y, Y, N The first 2 question is straightforward. The last question is tricky: The Advanced Policies tab - Possible Owners meaning: https://forsenergy.com/en-us/cluadmin/html/8e1c1455-2f8b-400d-a6f8-378c8d7f4f7a.htm "Clear the check box for a node only if you want to prevent this resource (and the clustered service or application that contains this resource) from failing over to that node. Otherwise, leave the boxes checked for all nodes. Note that if you leave the box for only one node checked, this resource (and the clustered service or application that contains this resource) cannot fail over." As Node2 is not checked the cluster will never fail over to Node2, even if you try Move -> Select Node -> Node2. So the 3rd question is NO.

    3. S

       syu31svc

       2023-04-29

       2 upvotes

       https://learn.microsoft.com/en-us/sql/sql-server/failover-clusters/windows/windows-server-failover-clustering-wsfc-with-sql-server?view=sql-server-ver16&viewFallbackFrom=sql-server-2014 Preferred owner A node on which a resource group prefers to run. Each resource group is associated with a list of preferred owners sorted in order of preference. During automatic failover, the resource group is moved to the next preferred node in the preferred owner list. Possible owner A secondary node on which a resource can run. Each resource group is associated with a list of possible owners. Roles can fail over only to nodes that are listed as possible owners. First one is Yes as Node3 is a possible owner Second one is Yes since Node1 is the preferred owner Third is No since it is not checked

    4. V

       vaaws

       2022-10-19

       4 upvotes

       Correct YYY https://learn.microsoft.com/en-US/troubleshoot/windows-server/high-availability/groups-fail-logic-three-more-cluster-node-members

12. Question 12 of 25

    Select 2

    You have an on-premises server named Server1 that runs Windows Server and has the Hyper-V server role installed. You have an Azure subscription. You plan to back up Server1 to Azure by using Azure Backup. Which two Azure Backup options require you to deploy Microsoft Azure Backup Server (MABS)? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

    • ABare Metal Recovery
    • BFiles and folders
    • CSystem State
    • DHyper-V Virtual Machines

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    Please, open an Azure Subscription and check before answer on this forum. If you create a Recovery service Vault you can see the following: - Bare metal recovery - Install Microsoft Azure Backup Server (MABS) - File and Folders - Download Agent for Windows Server or Windows Client - System state - Download Agent for Windows Server or Windows Client - Hyper-v - Install Microsoft Azure Backup Server (MABS) So, A & D is the right answer.

    Adapted from community discussion by SJHCI · 2023-04-08 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. S

       SJHCI

       2023-04-08

       Selected A, D13 upvotes

       Please, open an Azure Subscription and check before answer on this forum. If you create a Recovery service Vault you can see the following: - Bare metal recovery - Install Microsoft Azure Backup Server (MABS) - File and Folders - Download Agent for Windows Server or Windows Client - System state - Download Agent for Windows Server or Windows Client - Hyper-v - Install Microsoft Azure Backup Server (MABS) So, A & D is the right answer.

    2. C

       cris66

       2023-02-19

       6 upvotes

       A and D. Just adding references: Do not require MABS for System State, https://learn.microsoft.com/en-us/azure/backup/backup-azure-system-state Do not require MABS for files and folders: https://learn.microsoft.com/en-us/azure/backup/backup-azure-file-folder-backup-faq "Can I use the MARS agent to back up files and folders on an Azure VM? Yes." MABS to backup Hyper-V VMs. https://learn.microsoft.com/en-us/azure/backup/back-up-hyper-v-virtual-machines-mabs

    3. V

       Vitu

       2023-01-17

       4 upvotes

       Sorry but i think that the correct answer is the answer marked, see: https://learn.microsoft.com/en-us/azure/backup/backup-mabs-system-state-and-bmr

    4. E

       err007

       2023-01-31

       4 upvotes

       BMR and Hyper-V is the correct answer. You can do system state with Recovery service agent

13. Question 13 of 25

    DRAG DROP - You have a server that runs Windows Server. You plan to back up the server to an Azure Recovery Services vault once per week starting on the next Saturday. You need to schedule the weekly backup and perform the initial backup as soon as possible. In which order should you perform the actions? To answer, move all actions from the list of actions to the answer are and arrange them in the correct order. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/backup/install-mars-agent#download-the-mars-agent https://docs.microsoft.com/en-us/azure/backup/backup-windows-with-mars-agent

    Adapted from community discussion by GoforIT21 · 2022-10-10 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. G

       GoforIT21

       2022-10-10

       3 upvotes

       I was confused at first what to make of step 3. What is meant here is the linking of the locally installed agent with Azure via the registration key. When you do that, it feels like part of the installation, because it happens right afterwards and the UI doesn't really change. But it is listed as a separate step here (which, in principle, it is).

    2. G

       GoforIT21

       2022-10-10

       2 upvotes

       Yes, correct, see this graphic: https://learn.microsoft.com/en-us/azure/backup/media/backup-try-azure-backup-in-10-mins/backup-process.png (source: https://learn.microsoft.com/en-us/azure/backup/backup-azure-about-mars#backup-process)

    3. B

       BlackCat9588

       2025-02-06

       1 upvote

       Download the Microsoft Azure Recover Services agent and the Vault Credentials file. Run the Microsoft Azure Recovery Services Agent Setup Wizard Run the register server Wizard From Microsoft Azure Backup, run the schedule backup Wizard From Microsoft Azure Backup, run the Backup now Wizard.

    4. S

       syu31svc

       2023-04-29

       1 upvote

       https://learn.microsoft.com/en-us/azure/backup/install-mars-agent#download-the-mars-agent https://learn.microsoft.com/en-us/azure/backup/backup-windows-with-mars-agent Answer is correct

14. Question 14 of 25

    Select 2

    Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains two virtual machines named VM1 and VM2 that run Windows Server. You plan to implement a failover cluster named Cluster1 that will use VM1 and VM2 as nodes. You need to ensure that Cluster1 can use floating IP addresses. Which two components should you deploy? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

    • ANetwork Load Balancing (NLB)
    • Bthe MultiPoint Services role
    • Cthe Network Controller role
    • Dthe Host Guardian Service role
    • ESoftware Load Balancer (SLB)

    Show answer

    Correct answer: A, E

    How others answered

    • AE45%
    • CE36%
    • AC18%

    Only 45% agreed on this answer — treat it as contested rather than settled.

    Explanation

    So what you're saying is that you need either NLB or SLB, not both NLB AND SLB. Since SLB is the more modern approach and more or less the way to go for software defined networking it's probably E. You will also need a Network Controller to connect to the Virtual Network. So I'm sticking with C and E on this one. https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/create-a-tenant-vm https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/guest-clustering#example-load-balancer-configuration

    Adapted from community discussion by neusaap · 2023-11-07 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. M

       milosp

       2024-02-12

       Selected A, E4 upvotes

       To ensure that the failover cluster can use floating IP addresses, you should deploy the following components: A. Network Load Balancing (NLB)1: NLB is a feature of Windows Server that provides high network performance and availability by balancing network traffic among multiple servers. It can also be used to distribute network traffic to multiple IP addresses, which can be useful in a failover cluster scenario. E. Software Load Balancer (SLB): SLB is used in Azure to provide high availability and network performance to your applications. It can distribute network traffic to multiple IP addresses, which is necessary for a failover cluster that uses floating IP addresses. The method for making the floating IP reachable is to use a Software Load Balancer (SLB) virtual IP (VIP). The software load balancer must be configured with a health probe on a port on that IP so that SLB directs traffic to the machine that currently has that IP

    2. S

       Selena97

       2023-11-05

       Selected A, E4 upvotes

       Network Load Balancing (NLB): NLB is used for load balancing and providing a floating IP address for high availability. It's commonly used for failover clusters. A Software Load Balancer can also be used for load balancing and providing floating IP addresses for failover clusters. This is a more modern and software-based approach compared to NLB.

    3. N

       neusaap

       2023-11-07

       4 upvotes

       So what you're saying is that you need either NLB or SLB, not both NLB AND SLB. Since SLB is the more modern approach and more or less the way to go for software defined networking it's probably E. You will also need a Network Controller to connect to the Virtual Network. So I'm sticking with C and E on this one. https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/create-a-tenant-vm https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/guest-clustering#example-load-balancer-configuration

    4. N

       NazerRazer

       2024-04-24

       Selected A, E1 upvote

       To ensure that Cluster1 can use floating IP addresses, you need to deploy the following components: A. Network Load Balancing (NLB): NLB is a Windows Server feature that provides high availability and scalability by distributing network traffic across multiple servers. It can be configured to use floating IP addresses, which are assigned to the cluster nodes as needed. E. Software Load Balancer (SLB): SLB is a feature of Software Defined Networking (SDN) in Windows Server that provides load balancing for virtual network traffic. It can also be configured to use floating IP addresses for failover scenarios. These components, NLB and SLB, enable the assignment and management of floating IP addresses for failover clusters like Cluster1.

15. Question 15 of 25

    DRAG DROP - You have two physical servers named AppSrv1 and AppSrv2 and an unconfigured server named Server1. All the servers run Windows Server. Only Server1 can access the internet. You plan to use Azure Site Recovery to replicate AppSrv1 and AppSrv2 to Azure. You need to deploy the required components to AppSrv1, AppSrv2, and Server1. Which components should you deploy? To answer, drag the appropriate components to the correct servers. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/site-recovery/physical-azure-architecture https://docs.microsoft.com/en-us/azure/site-recovery/physical-azure-set-up-source

    Adapted from community discussion by Burnie · 2022-11-30 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. J

       Josty

       2022-09-07

       8 upvotes

       Correct Answers https://docs.microsoft.com/en-us/azure/site-recovery/physical-azure-disaster-recovery

    2. B

       Burnie

       2022-11-30

       4 upvotes

       When you set up disaster recovery for VMware virtual machines (VM) and physical servers using Azure Site Recovery, you install the Site Recovery Mobility service on each on-premises VMware VM and physical server. The Mobility service captures data, writes on the machine, and forwards them to the Site Recovery process server. https://learn.microsoft.com/en-us/azure/site-recovery/vmware-physical-mobility-service-overview

    3. S

       syu31svc

       2023-04-29

       2 upvotes

       https://docs.microsoft.com/en-us/azure/site-recovery/physical-azure-disaster-recovery The Mobility service must be installed on each server you want to replicate https://learn.microsoft.com/en-us/azure/site-recovery/media/physical-azure-disaster-recovery/add-server.png Answer given is right

    4. B

       BlackCat9588

       2025-02-06

       1 upvote

       The Azure site Recovery mobility service An Azure Site recovery configuration server

16. Question 16 of 25

    HOTSPOT - You have three servers named Host1, Host2, and VM1 that run Windows Server. Host1 and Host2 have the Hyper-V server role installed. VM1 is a virtual machine hosted on Host1. You configure VM1 to replicate to Host2 by using Hyper-V Replica. Which types of failovers can you perform on VM1 on each host? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Test failover - only option for running vm Planned failover - for second answer ================ Options are planned failover - then test or unplanned are both only done from the secondary replica side Failover is just failover- not a test- should br planned or unplanned!!! This is the first answer https://learn.microsoft.com/en-us/virtualization/community/team-blog/2012/20120731-types-of-failover-operations-in-hyper-v-replica-part-ii-planned-failover https://learn.microsoft.com/en-us/virtualization/community/team-blog/2012/20120725-types-of-failover-operations-in-hyper-v-replica-part-i-test-failover https://learn.microsoft.com/en-us/virtualization/community/team-blog/2012/20120808-types-of-failover-operations-in-hyper-v-replica-part-iii-unplanned-failover

    Adapted from community discussion by joehoesofat · 2022-12-05 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. B

       Burnie

       2022-11-30

       5 upvotes

       Correct. Planned failover performs prerequisites checks to ensure zero data loss. It checks that the primary virtual machine is shut down before beginning the failover. After the virtual machine is failed over, it starts replicating the changes back to the primary site when it's available. Failover. Pick the latest or other recovery point if configured. A new test virtual machine will be created and started on the secondary site. Unplanned Failover from Hyper-V Manager or Failover Clustering Manager. You can recover from the latest recovery point or from previous recovery points if this option is enabled. https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/manage/set-up-hyper-v-replica

    2. J

       joehoesofat

       2022-12-05

       4 upvotes

       Test failover - only option for running vm Planned failover - for second answer ================ Options are planned failover - then test or unplanned are both only done from the secondary replica side Failover is just failover- not a test- should br planned or unplanned!!! This is the first answer https://learn.microsoft.com/en-us/virtualization/community/team-blog/2012/20120731-types-of-failover-operations-in-hyper-v-replica-part-ii-planned-failover https://learn.microsoft.com/en-us/virtualization/community/team-blog/2012/20120725-types-of-failover-operations-in-hyper-v-replica-part-i-test-failover https://learn.microsoft.com/en-us/virtualization/community/team-blog/2012/20120808-types-of-failover-operations-in-hyper-v-replica-part-iii-unplanned-failover

    3. X

       xxxxx85xx

       2022-04-24

       6 upvotes

       https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v/manage/set-up-hyper-v-replica

    4. L

       Leocan

       2022-12-22

       5 upvotes

       Correct answers: Where is Failover initiated? 1. Test - On the replica virtual machine 2. Planned - Initiated on primary and completed on secondary 3. Unplanned - On the replica virtual machine https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/manage/set-up-hyper-v-replica

17. Question 17 of 25

    You have two servers that run Windows Server as shown in the following table.

    

    You need to copy the contents of volume E from Server1 to Server2. The solution must meet the following requirements: ✑ Ensure that files in-use are copied. ✑ Minimize administrative effort. What should you use?

    • AStorage Migration Service
    • BAzure File Sync
    • CAzure Backup
    • DStorage Replica

    Show answer

    Correct answer: C

    How others answered

    • C78%
    • A22%

    Explanation

    How can the answer be Storage Migration Service when it does not satisfy the requirement of copying files in-use? "The Storage Migration Service doesn't migrate files that applications exclusively lock". Same reason NOT Azure File Sync - Files in-use are not copied, sync resumes when files are closed. Azure Backup is based on VSS and can copy open files, and so does Storage Replica - "it does replicate in-use or open files" . Storage Replica has to be within the same AD Forest. I don´t think it's legit to say that you can just add Server2 to the domain when it goes against the given scenario, and the solution does not include that. Therefore Answer is Azure Backup. Backup files using MARS and then restore them to Server2.

    Adapted from community discussion by cris66 · 2023-08-20 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. C

       cris66

       2023-08-20

       Selected C14 upvotes

       How can the answer be Storage Migration Service when it does not satisfy the requirement of copying files in-use? "The Storage Migration Service doesn't migrate files that applications exclusively lock". Same reason NOT Azure File Sync - Files in-use are not copied, sync resumes when files are closed. Azure Backup is based on VSS and can copy open files, and so does Storage Replica - "it does replicate in-use or open files" . Storage Replica has to be within the same AD Forest. I don´t think it's legit to say that you can just add Server2 to the domain when it goes against the given scenario, and the solution does not include that. Therefore Answer is Azure Backup. Backup files using MARS and then restore them to Server2.

    2. S

       syu31svc

       2023-10-27

       Selected C6 upvotes

       Storage Migration Service, Azure File Sync, and Storage Replica cannot be used to copy the contents of volume E from Server1 to Server2. These solutions require both servers to be in the same domain or a trusted domain, which is not the case here. Answer is C

    3. P

       ProfileX

       2023-03-28

       4 upvotes

       The requirements say "Ensure that files in use are copied" but I've used Storage Migration Service and files were skipped. "Are locked files migrated? The Storage Migration Service doesn't migrate files that applications exclusively lock. The service does automatically retry three times with a sixty second delay between tries, and you can control the number of attempts and the delay. You can also re-run transfers to copy just the files that were previously skipped due to sharing violations." https://learn.microsoft.com/en-us/windows-server/storage/storage-migration-service/faq

    4. C

       cris66

       2023-08-20

       4 upvotes

       https://learn.microsoft.com/en-us/azure/backup/restore-all-files-volume-mars#volume-level-restore-to-an-alternate-machine

18. Question 18 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains a single-domain Active Directory Domain Services (AD DS) forest named contoso.com. The functional level of the forest is Windows Server 2012 R2. All domain controllers run Windows Server 2012 R2. Sysvol replicates by using the File Replication Service (FRS). You plan to replace the existing domain controllers with new domain controllers that will run Windows Server 2022. You need to ensure that you can add the first domain controller that runs Windows Server 2022. Solution: You raise the domain and forest functional levels. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B63%
    • A38%

    Only 63% agreed on this answer — treat it as contested rather than settled.

    Explanation

    ChatGPT: The answer is B. No. Raising the domain and forest functional levels alone is not enough to ensure that you can add the first domain controller that runs Windows Server 2022. The domain also has to use DFS-R as the engine to replicate SYSVOL. The minimum requirement to add a Windows Server 2022 Domain Controller is a Windows Server 2008 functional level. https://learn.microsoft.com/en-us/answers/questions/524754/windows-server-2022-minimum-requirement-to-add-a-w https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels https://learn.microsoft.com/en-us/windows-server/get-started/hardware-requirements

    Adapted from community discussion by antoniow · 2023-07-12 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. A

       antoniow

       2023-07-12

       5 upvotes

       ChatGPT: The answer is B. No. Raising the domain and forest functional levels alone is not enough to ensure that you can add the first domain controller that runs Windows Server 2022. The domain also has to use DFS-R as the engine to replicate SYSVOL. The minimum requirement to add a Windows Server 2022 Domain Controller is a Windows Server 2008 functional level. https://learn.microsoft.com/en-us/answers/questions/524754/windows-server-2022-minimum-requirement-to-add-a-w https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels https://learn.microsoft.com/en-us/windows-server/get-started/hardware-requirements

    2. G

       gmamorim

       2023-07-25

       2 upvotes

       Bing chat: Yes Yes, raising the domain and forest functional levels is one of the prerequisites for adding the first domain controller that runs Windows Server 2022. You can raise domain and forest functional levels in Windows Server 2022 by following these steps: Go to Start and open Administrative Tools. Go to Active Directory Domains and Trusts. In the left pane, right-click on Active Directory Domains and Trusts and select Raise Forest Functional Level. You will see a list of forest functional levels that are available. Select the required functional level. Note that when upgrading or transitioning Active Directory from Windows Server 2016 to Windows Server 2019 or Windows Server 2022, the Domain Functional Level (DFL) and Forest Functional Level (FFL) do not have to be raised1.

    3. W

       wouter0121

       2023-10-06

       3 upvotes

       100% No The functional level of the forest is Windows Server 2012 R2. You can add an windows 2022 DC to a forest running windows 2012R2. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels You cant add it when ur running FRS tho

    4. H

       Hull1

       2025-04-01

       Selected B1 upvote

       Besides that you need to migrate from FRS to DFSR to promote 2022 server to DC, you cannot raise domain or forest functional level to 2016 unless, at minimum, all your domain controllers are on 2016 OS https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels#windows-server-2016-functional-levels

19. Question 19 of 25

    DRAG DROP - Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The functional level of the forest and the domain is Windows Server 2012 R2. The domain contains the domain controllers shown in the following table.

    

    You need to raise the forest functional level to Windows Server 2016. The solution must meet the following requirements: ✑ Ensure that there are three domain controllers after you raises the level. ✑ Minimize how long the FSMO roles are unavailable. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Correct Answers Windows 2012 R2 is not compatible with the Windows Server 2016 functional levels and need to be upgraded.

    Adapted from community discussion by xxxxx85xx · 2022-04-28 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. X

       xxxxx85xx

       2022-04-28

       8 upvotes

       Correct Answers Windows 2012 R2 is not compatible with the Windows Server 2016 functional levels and need to be upgraded.

    2. R

       RJM

       2022-05-23

       6 upvotes

       Funny answer in place upgrades are not considered best practice, even by Microsoft https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers

    3. S

       scribe

       2023-01-13

       3 upvotes

       answer is correct but Microsoft says that is no option to inplace upgrade of Domain Controler - always promote new

    4. S

       syu31svc

       2023-04-30

       2 upvotes

       https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels Windows Server 2016 functional levels Supported domain controller operating systems: Windows Server 2022 Windows Server 2019 Windows Server 2016

20. Question 20 of 25

    You have two file servers named Server1 and Server2 that run Windows Server. Server1 contains a shared folder named Data. Data contains 10 TB of data. You plan to decommission Server1. You need to migrate the files from Data to a new shared folder on Server2. The solution must meet the following requirements: ✑ Ensure that share, file, and folder permissions are copied. ✑ After the initial copy occurs, ensure that changes in \\Server1\Data can be synced to the destination without initiating a full copy. ✑ Minimize administrative effort. What should you use?

    • Axcopy
    • BStorage Replica
    • CStorage Migration Service
    • Dazcopy

    Show answer

    Correct answer: C

    How others answered

    • C75%
    • D25%

    Explanation

    Option A. xcopy is a command-line tool for copying files and directories. While it can copy file and folder permissions, it does not provide automatic syncing of changes or support for large-scale migrations. Option B. Storage Replica is a disaster recovery solution that allows for replication of volumes between servers or clusters. It does not provide support for file server migrations. Option D. azcopy is a command-line tool for copying data to and from Azure storage. It is not designed for on-premises file server migrations. C is the answer

    Adapted from community discussion by syu31svc · 2023-04-26 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. S

       syu31svc

       2023-04-26

       Selected C4 upvotes

       Option A. xcopy is a command-line tool for copying files and directories. While it can copy file and folder permissions, it does not provide automatic syncing of changes or support for large-scale migrations. Option B. Storage Replica is a disaster recovery solution that allows for replication of volumes between servers or clusters. It does not provide support for file server migrations. Option D. azcopy is a command-line tool for copying data to and from Azure storage. It is not designed for on-premises file server migrations. C is the answer

    2. L

       Lu5ck

       2023-01-20

       Selected C4 upvotes

       This is really tricky. XCopy can do sync and preserve NTFS permissions. AZCopy also can do it. Migration server can also do it. The key point come down to "minimized administrative effort". I stand to believe that GUI is simpler than CLI.

    3. C

       cris66

       2023-02-20

       Selected C2 upvotes

       If Microsoft says it's easy with Storage Migration Service have to accept best answer, and it satisfies requirements. Option "Transfer again", copying only files that were updated since the last transfer Is there another version of this question that mentions Azure? Here Azure is not mentioned. Migrate a file server by using Storage Migration Service. https://learn.microsoft.com/en-us/windows-server/storage/storage-migration-service/migrate-data

    4. [

       [Removed]

       2023-11-12

       2 upvotes

       The best choice is Option C: Storage Migration Service. Here's why: 1. Copy Permissions: This service moves all your files and keeps their permissions the same on the new server. 2. Sync Changes Easily: After you move the files, if you make any changes to them on the old server, Storage Migration Service can update these changes on the new server without moving everything all over again. 3. Less Work for You: It's designed to make moving files from one server to another easier, so you don't have to do a lot of manual work. The other options either don't handle permissions well, don't sync changes easily, or need more work from you.

21. Question 21 of 25

    HOTSPOT - You have an Azure Active Directory Domain Services (Azure AD DS) domain named aadds.contoso.com. You have an Azure virtual network named Vnet1. Vnet1 contains two virtual machines named VM1 and VM2 that run Windows Server. VM1 and VM2 are joined to aadds.contoso.com. You create a new Azure virtual network named Vnet2. You add a new server named VM3 to Vnet2. When you attempt to join VM3 to aadds.contoso.com, you get an error message that the domain cannot be found. You need to ensure that you can join VM3 to aadds.contoso.com. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Box 1: Configure virtual network peering between Vnet1 and Vnet2. Connectivity issues for domain-join. If the VM can't find the managed domain, there's usually a network connection or configuration issue. Review the following troubleshooting steps to locate and resolve the issue: 1. Ensure the VM is connected to the same, or a peered, virtual network as the managed domain. If not, the VM can't find and connect to the domain in order to join. If the VM isn't connected to the same virtual network, confirm that the virtual networking peering or VPN connection is Active or Connected to allow the traffic to flow correctly. 2. Try to ping the domain using the domain name of the managed domain, such as ping aaddscontoso.com. * If the ping response fails, try to ping the IP addresses for the domain displayed on the overview page in the portal for your managed domain, such as ping 10.0.0.4. * If you can successfully ping the IP address but not the domain, DNS may be incorrectly configured. Make sure that you've configured the managed domain DNS servers for the virtual network. Box 2: Add a virtual network link to an existing Azure private DNS zone. The private DNS zone already exists. After you create a private DNS zone in Azure, you'll need to link a virtual network to it. Once linked, VMs hosted in that virtual network can access the private DNS zone. Every private DNS zone has a collection of virtual network link child resources. Each one of these resources represents a connection to a virtual network. A virtual network can be linked to private DNS zone as a registration or as a resolution virtual network. Reference: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/troubleshoot-domain-join https://docs.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links

    Adapted from community discussion by jecawi9630 · 2023-07-24 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. J

       jecawi9630

       2023-07-24

       14 upvotes

       for second part, I prefer adding custom DNS to vnet2. All you need to do, is to add the AAD instance's IP address to vnet2. The question did not say anything about already having a private DNS zone in place.

    2. S

       syu31svc

       2023-10-30

       4 upvotes

       https://learn.microsoft.com/en-us/azure/active-directory-domain-services/troubleshoot-domain-join Ensure the VM is connected to the same, or a peered, virtual network as the managed domain. https://learn.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links After you create a private DNS zone in Azure, you'll need to link a virtual network to it Answer is correct

    3. W

       windowsmodulesinstallerworker

       2024-06-09

       1 upvote

       Its, peering & enter dns server on vnet https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-configure-networking#configure-virtual-network-peering You may have an existing Azure virtual network for VMs, or wish to keep your managed domain virtual network separate. To use the managed domain, VMs in other virtual networks need a way to communicate with the Domain Services domain controllers. This connectivity can be provided using Azure virtual network peering. For VMs and applications in the peered virtual network to successfully talk to the managed domain, the DNS settings must be updated. The IP addresses of the Domain Services domain controllers must be configured as the DNS servers on the peered virtual network. There are two ways to configure the domain controllers as DNS servers for the peered virtual network: Configure the Azure virtual network DNS servers to use the Domain Services domain controllers.

    4. A

       ala76nl

       2024-01-23

       4 upvotes

       Second is adding custom dns to vnet2 https://learn.microsoft.com/en-us/azure/active-directory-domain-services/manage-dns

22. Question 22 of 25

    You have five Azure virtual machines. You have a dedicated Azure Storage account to collect performance data. You need to send the collected data directly to the Azure Storage account. What should you install on the virtual machines?

    • Athe Azure Connected Machine agent
    • Bthe Telegraf agent
    • Cthe Dependency agent
    • Dthe Azure Monitor agent
    • Ethe Azure Diagnostics extension

    Show answer

    Correct answer: E

    How others answered

    • E97%

    Explanation

    This is almost literally the same question as in topic 5, question 7. There the Azure Diagnostics Extension was given as the correct answer. I believe that is correct - because the link provided there proves it: https://docs.microsoft.com/en-us/azure/azure-monitor/agents/diagnostics-extension-overview

    Adapted from community discussion by GoforIT21 · 2022-10-09 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. G

       GoforIT21

       2022-10-09

       Selected E12 upvotes

       This is almost literally the same question as in topic 5, question 7. There the Azure Diagnostics Extension was given as the correct answer. I believe that is correct - because the link provided there proves it: https://docs.microsoft.com/en-us/azure/azure-monitor/agents/diagnostics-extension-overview

    2. P

       ProfileX

       2022-09-28

       6 upvotes

       Not sure answer D is correct, possibly E since only the diagnostics extension can send data to Azure Storage: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview

    3. N

       nap61

       2024-08-14

       Selected E1 upvote

       https://learn.microsoft.com/en-us/azure/azure-monitor/agents/diagnostics-extension-overview Comparison to Log Analytics agent The Log Analytics agent in Azure Monitor can also be used to collect monitoring data from the guest operating system of virtual machines. You can choose to use either or both depending on your requirements. For a comparison of the Azure Monitor agents, see Overview of the Azure Monitor agents. The key differences to consider are: Azure Diagnostics Extension can be used only with Azure virtual machines. The Log Analytics agent can be used with virtual machines in Azure, other clouds, and on-premises. Azure Diagnostics extension sends data to Azure Storage, Azure Monitor Metrics (Windows only) and Azure Event Hubs. The Log Analytics agent collects data to Azure Monitor Logs. The Log Analytics agent is required for retired solutions, VM insights, and other services such as Microsoft Defender for Cloud. So, to send [performance] collected data to Storage Account must use Azure Diagnostics Extension.

    4. S

       syu31svc

       2023-04-26

       Selected E4 upvotes

       https://learn.microsoft.com/en-us/azure/azure-monitor/agents/diagnostics-extension-overview Use Azure Diagnostics extension if you need to: Send data to Azure Storage for archiving Answer is E

23. Question 23 of 25

    You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. The subscription contains the storage accounts shown in the following table.

    

    You plan to enable boot diagnostics for VM1. You need to configure storage for the boot diagnostics logs and snapshots. Which storage account should you use?

    • Astorage1
    • Bstorage2
    • Cstorage3
    • Dstorage4

    Show answer

    Correct answer: A

    How others answered

    • A64%
    • B36%

    Only 64% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Should be A, Boot diagnostics doesn't support premium storage accounts or zone redundant storage accounts. If either of these are used for boot diagnostics users will receive an StorageAccountTypeNotSupported error when starting the VM.

    Adapted from community discussion by watson_n · 2023-02-07 · 24 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. W

       watson_n

       2023-02-07

       24 upvotes

       Should be A, Boot diagnostics doesn't support premium storage accounts or zone redundant storage accounts. If either of these are used for boot diagnostics users will receive an StorageAccountTypeNotSupported error when starting the VM.

    2. G

       Goofer

       2023-02-22

       Selected A4 upvotes

       Boot diagnostics doesn't support premium storage accounts (C and D, are not possible) Boot diagnostics doesn't zone redundant storage accounts (B is not possible) Answer is A

    3. S

       SJHCI

       2023-04-12

       Selected A4 upvotes

       the correct answer is A) Pleasem read documentation before answer to question: https://learn.microsoft.com/en-us/azure/virtual-machines/boot-diagnostics#limitations

    4. S

       syu31svc

       2023-04-27

       Selected A3 upvotes

       Taking A as the answer https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/boot-diagnostics The Boot diagnostics feature does not support premium storage account or Zone Redundant Storage Account Types. If you use the premium storage account for Boot diagnostics, you might receive the StorageAccountTypeNotSupported error when you start the VM.

24. Question 24 of 25

    You are planning the deployment of Microsoft Sentinel. Which type of Microsoft Sentinel data connector should you use to meet the security requirements?

    • AThreat Intelligence - TAXII
    • BAzure Active Directory
    • CMicrosoft Defender for Cloud
    • DMicrosoft Defender for Identity

    Show answer

    Correct answer: D

    How others answered

    • D86%

    Explanation

    I think the answer given is correct. B and C are cloud-focused services and this is about on-prem threats. A is about a non-Microsoft tool. I didn't research it further, but given that Defender for Identity does make use of Domain Controller data for it's analysis (and protecting DCs is key for protecting user identities), D does make most sense to me. A rather tentative argumentation for now. Any further insights would be much appreciated!

    Adapted from community discussion by GoforIT21 · 2023-09-28 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. G

       GoforIT21

       2023-09-28

       Selected D9 upvotes

       I think the answer given is correct. B and C are cloud-focused services and this is about on-prem threats. A is about a non-Microsoft tool. I didn't research it further, but given that Defender for Identity does make use of Domain Controller data for it's analysis (and protecting DCs is key for protecting user identities), D does make most sense to me. A rather tentative argumentation for now. Any further insights would be much appreciated!

    2. S

       SuradjBajaj

       2024-03-09

       Selected D3 upvotes

       To meet the security requirement of implementing Microsoft Sentinel as a reporting solution to identify all connections to the domain controllers that use insecure protocols, the appropriate Microsoft Sentinel data connector to use would be D. Microsoft Defender for Identity. Microsoft Defender for Identity (previously known as Azure Advanced Threat Protection) is a cloud-based security solution that leverages user behavioral analytics and machine learning to identify and detect suspicious activities in on-premises Active Directory environments. It can provide insights into the use of insecure protocols like NTLMv1, SMB1, and unsigned LDAP, which can help to identify and prevent security threats. Threat Intelligence - TAXII, Azure Active Directory, and Microsoft Defender for Cloud are other types of data connectors available in Microsoft Sentinel, but they are not directly relevant to the security requirement of identifying all connections to the domain controllers that use insecure protocols.

    3. S

       syu31svc

       2024-05-01

       Selected D3 upvotes

       https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources After you onboard Microsoft Sentinel into your workspace, you can use data connectors to start ingesting your data into Microsoft Sentinel. Microsoft Sentinel comes with many out of the box connectors for Microsoft services, which you can integrate in real time. For example, the Microsoft 365 Defender connector is a service-to-service connector that integrates data from Office 365, Azure Active Directory (Azure AD), Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Answer is D

    4. R

       rimvydukas

       2023-12-21

       4 upvotes

       Threat Intelligence – TAXII data connector The most widely adopted industry standard for CTI transmission is the STIX data format and TAXII protocol. Organizations that get threat indicators from current STIX/TAXII version 2.x solutions can use the Threat Intelligence – TAXII data connector to import their threat indicators into Microsoft Sentinel. The built-in Microsoft Sentinel TAXII client imports threat intelligence from TAXII 2.x servers.

25. Question 25 of 25

    You need to back up Server 4 to meet the technical requirements. What should you do first?

    • ADeploy Microsoft Azure Backup Server (MABS).
    • BConfigure Windows Server Backup.
    • CInstall the Microsoft Azure Recovery Services (MARS) agent.
    • DConfigure Storage Replica.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    The MARS agent Azure Backup uses the MARS agent to back up data from on-premises machines and Azure VMs to a backup Recovery Services vault in Azure. The MARS agent can: Run on on-premises Windows machines so that they can back up directly to a backup Recovery Services vault in Azure. https://learn.microsoft.com/en-us/azure/backup/backup-support-matrix-mars-agent

    Adapted from community discussion by musmas82473 · 2024-07-30 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-801 or CertExamHQ.

    1. M

       musmas82473

       2024-07-30

       Selected C5 upvotes

       The MARS agent Azure Backup uses the MARS agent to back up data from on-premises machines and Azure VMs to a backup Recovery Services vault in Azure. The MARS agent can: Run on on-premises Windows machines so that they can back up directly to a backup Recovery Services vault in Azure. https://learn.microsoft.com/en-us/azure/backup/backup-support-matrix-mars-agent

    2. S

       Sizz

       2024-04-13

       5 upvotes

       You don't need to use MABS for individual workload servers, a MARS agent is fine on its own for the requirements given. https://learn.microsoft.com/en-us/azure/backup/backup-overview - "On-premises - Back up files, folders, system state using the Microsoft Azure Recovery Services (MARS) agent. Or use the DPM or Azure Backup Server (MABS) agent to protect on-premises VMs (Hyper-V and VMware) and other on-premises workloads"

    3. S

       syu31svc

       2024-11-02

       Selected C4 upvotes

       Answer is C https://learn.microsoft.com/en-us/azure/backup/install-mars-agent About the MARS agent Azure Backup uses the MARS agent to back up files, folders, and system state from on-premises machines and Azure VMs.

    4. P

       ProfileX

       2024-03-29

       3 upvotes

       Installing the agent first doesn't seem correct, the question says what should you do first, so the answer might be A. "To protect on-premises workloads, the MABS server must be located on-premises, and connected to a domain". https://learn.microsoft.com/en-us/azure/backup/backup-azure-microsoft-azure-backup

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-801 practice, question 1 of 25