AZ-800 sample exam questions

OU1 is synced and password writeback is enabled, so User1 can use SSPR. Pass-through authentication validates sign-ins against on-premises DCs. OU2 is not in scope, so User2 never reaches the tenant and cannot be added to Group1. Azure AD Connect is now Microsoft Entra Connect.

Removing an application partition requires the replica holders and the domain naming master to be reachable. Exhibit is missing, so this follows the community answer DC3, presumably the DC that holds a replica of the partition or the domain naming master.

To onboard servers to Azure Arc, the admin needs the Azure Connected Machine Onboarding role, or Contributor, on the target resource group RG1. A script can only be generated and run successfully with that permission. Hybrid join and a cloud account are not required.

A two-way mirror keeps two copies of the data, so it survives one disk failure. With seven or more disks, a Storage Spaces parity space can use dual parity, which survives two simultaneous disk failures, so 10 disks allow a maximum of two.

On-premises 10.0.0.0/23 covers 10.0.0.0 to 10.0.1.255, so it overlaps VNet1's 10.0.1.0/24, and S2S VPN needs non-overlapping ranges. Changing VNet1 to 10.0.2.0/24 removes the overlap. 10.0.1.128/25 is still inside the on-premises range, and Bastion or Extended Network do not solve it.

Write a DSC configuration in a PS1 script and compile it to produce a MOF file. New-GuestConfigurationPackage then bundles the MOF and its required modules into a ZIP file, which is the Azure Machine Configuration package format.

Scope-level delegation across servers is done with IPAM, which uses role-based access control with access scopes and roles so User1 can manage only Scope1 and Scope3. DHCP Administrators group membership grants access to the whole server, and Windows Admin Center does not limit access per scope.

Server2 has a Segment2 address but sits on Segment1. Server1 routes to it via the gateway, which delivers to Segment2, and Server2 tries ARP for Server3 on the wrong segment; both fail. Server4 duplicates the gateway's address, so Windows detects the conflict and adds an APIPA address.

Running Windows containers on Windows Server needs a container runtime, which is Docker (Docker Engine or Mirantis), along with the Containers feature. WSL runs Linux, Windows Admin Center is only a management tool, and Hyper-V is needed only for Hyper-V isolation, not the base setup.

Turn on BranchCache enables the client, and automatic discovery by service connection point lets laptops find the hosted cache server registered in Active Directory for their current site. Travelling users therefore need no per-office server list, which minimizes administrative effort.

A domain controller DC3 in Azure is deployed as an Azure virtual machine running AD DS. Azure AD DS is a managed service and does not provide a real DC you join to the on-premises forest. Administrative units and Application Proxy are unrelated.

Creating and changing AD DS site links requires membership in Enterprise Admins, or delegated rights in the Inter-Site Transports container in the Configuration partition. According to the exhibit only Admin1 has that, so Admin1 only is the community answer.

Azure Arc configuration management (Azure Policy guest configuration, Automanage machine configuration) requires servers to be Arc-enabled. That is done by installing the Azure Connected Machine agent. A hybrid runbook worker, Azure Monitor agent or hybrid join does not onboard servers to Arc.

Enhanced session mode on the Hyper-V host lets a VM use clipboard, drive and device redirection through the Remote Desktop connection. Guest services only copies files, while shielded VMs and Credential Guard are security features that do not provide redirection.

DHCP failover (E) gives two servers shared scope information with load balance or hot standby, and DHCP relay on each office router (B) lets clients in other subnets reach both servers. Split scopes and DHCP clustering are older, more complex approaches not required here.