AZ-801 sample exam questions

A connection security rule requiring encryption blocks unencrypted inbound traffic such as ICMP from tracert. Configuring IPsec exemptions under IPsec Settings exempts ICMP from the requirement, so Server1 can reply. An outbound ICMP rule or disabling the profile does not fit.

Rule1 on Server1 applies only to TCP, so ICMP pings are allowed by the Echo Request rule without IPsec. Server2 has a matching Kerberos rule, so its SMB (TCP 445) connection authenticates. Server3 has no connection security rule, so it cannot satisfy Server1's required inbound authentication for TCP.

The exhibit shows no preferred owners selected and the Up and Down buttons disabled, so increasing Server2's priority cannot be done as described. The community answer is A, but the correct mechanism is Prevent failback, so treat this as a weak yes.

Server2 is not configured as a router, so Server1 reaches only its own NIC and NIC2 on the same subnet. NIC3 and NIC4 share the duplicate address 192.168.15.1, so Server2 cannot reach NIC4. Server2 has no default gateway, so NIC5 is unreachable.

Floating IP addresses in a cluster on SDN rely on Software Load Balancer, which is part of the Network Controller role. So deploy Network Controller and SLB. NLB is a separate feature, and MultiPoint Services and Host Guardian Service are unrelated.

The AD DS database can only be restored offline, so boot into DSRM and restore the system state on that same DC. Ntdsutil then marks OU1 authoritative before the normal restart, so its higher version numbers replicate out to Server2.

A 3 TB data disk is within the supported disk size for Azure Migrate server migration, so shrinking it is unnecessary. The actual blocker in this series is elsewhere in the server configuration, so this solution does not meet the goal.

Data Box Gateway is a virtual appliance managed from an Azure resource. Create the resource, which provides the image download and activation key, then build a VM from that image on the Hyper-V host HV1, and finally activate the device with the key.

The Active Directory Replication Status Tool checks replication health and shows whether changes reach other domain controllers. It has since been retired; repadmin /replsummary or Get-ADReplicationPartnerMetadata do the same today. Sites and Services does not report status.

Subscription1 forwards only Warning and Information events from the Application, Security, and Setup logs, so critical System events from Server2 never arrive. View1 reads only the Application, System, and Forwarded Events logs, excluding Setup on Server1. Information events in Server2's Application log match the subscription filter.

Case study answer: the firewall risks are on on-premises Windows servers, so a GPO that configures Windows Defender Firewall rules centrally fits. Adaptive network hardening, NSGs and Azure Firewall policy all apply to Azure resources, not to domain-joined on-premises servers.

A two-node failover cluster needs one IP per node, one for the cluster name (CNO) and one for the clustered file server role, giving 4. Votes were split with B, but the role-name address is needed in addition to the cluster and node addresses.

To back up a single server directly to Azure, first install the Microsoft Azure Recovery Services (MARS) agent and register it with a Recovery Services vault. MABS is for larger workloads such as SQL or Hyper-V, Windows Server Backup is local only, and Storage Replica is replication, not backup.

Storage Migration Service is the supported tool for migrating file shares, permissions and server identity to a newer server or Azure. FSRM is for quotas and file screening, and Windows Server Migration Tools do not migrate file shares well. There is no product named File Server Migration Toolkit today.

Case study answer: the community choice is Domain Admins, the group that gives the broad rights the technical requirement for User1 describes. Account Operators and Backup Operators have limited rights, and Schema Admins only allows schema changes.