Microsoft AZ-800 Practice Exams

Last updated on Mar 31,2025

Exam Code: AZ-800
Exam Name: Administering Windows Server Hybrid Core Infrastructure
Certification Provider: Microsoft
Latest update: Mar 31,2025

Question #1

SIMULATION

Task 7

You need to monitor the security configuration of DC1 by using Microsoft Defender for Cloud.

The required source files are located in a folder named \dc1.contoso.cominstall.

Reveal Solution Hide Solution

Correct Answer: One possible solution to monitor the security configuration of DC1 by using Microsoft Defender for Cloud is to use the Guest Configuration feature. Guest Configuration is a service that audits settings inside Linux and Windows virtual machines (VMs) to assess their compliance with your organization’s security policies. You can use Guest Configuration to monitor the security baseline settings for Windows Server in the Microsoft Defender for Cloud portal by following these steps:

On DC1, open a web browser and go to the folder named dc1.contoso.cominstall. Download the Guest Configuration extension file (GuestConfiguration.msi) and save it to a local folder, such as C:Temp.

Run the Guest Configuration extension file and follow the installation wizard. You can choose to install the extension for all users or only for the current user. For more information on how to install the Guest Configuration extension, see Install the Guest Configuration extension. After the installation is complete, sign in to the Microsoft Defender for Cloud portal (2).

In the left pane, select Security Center and then Recommendations.

In the recommendations list, find and select Vulnerabilities in security configuration on your Windows machines should be remediated (powered by Guest Configuration).

In the Remediate Security Configurations page, you can see the compliance status of your Windows VMs, including DC1, based on the Azure Compute Benchmark. The Azure Compute Benchmark is a set of rules that define the desired configuration state of your VMs. You can also see the number of failed, passed, and skipped rules for each VM. For more information on the Azure Compute Benchmark, see Microsoft cloud security benchmark: Azure compute benchmark is now available. To view the details of the security configuration of DC1, click on the VM name and then select View details. You can see the list of rules that apply to DC1 and their compliance status. You can also see the severity, description, and remediation steps for each rule. For example, you can see if DC1 has the latest security updates installed, if the firewall is enabled, if the password policy is enforced, and so on.

To monitor the security configuration of DC1 over time, you can use the Compliance over time chart, which shows the trend of compliance status for DC1 in the past 30 days. You can also use the Compliance breakdown chart, which shows the distribution of compliance status for DC1 by rule severity.

By using Guest Configuration, you can monitor the security configuration of DC1 by using Microsoft Defender for Cloud and ensure that it meets your organization’s security standards. You can also use Guest Configuration to monitor the security configuration of other Windows and Linux VMs in your Azure environment.

Question #2

DRAG DROP

You have a server named Server1 that has Windows Admin Center installed. The certificate used by Windows Admin Center was obtained from a certification authority (CA).

The certificate expires.

You need to replace the certificate.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal Solution Hide Solution

Question #3

SIMULATION

Task 6

You need to use Azure File Sync 10 replicate the contents of C:app on SRV1 to an Azure file share named sharel1.

The required source files are located in a folder named \dc1.contoso.cominstall.

Reveal Solution Hide Solution

Correct Answer: To use Azure File Sync to replicate the contents of C:app on SRV1 to an Azure file share named sharel1, with the source files located in \dc1.contoso.cominstall, follow these steps:

Step 1: Prepare Windows Server for Azure File Sync Ensure that SRV1 meets the prerequisites for Azure File Sync, such as having a supported version of Windows Server and PowerShell 5.1 or later1. Step 2: Deploy the Storage Sync Service In the Azure portal, deploy the Storage Sync Service in the same region as your Azure file share1.

Step 3: Create an Azure File Share Create an Azure file share named sharel1 in your storage account1.

Step 4: Install the Azure File Sync Agent Download and install the Azure File Sync agent on SRV11. Step 5: Register SRV1 with the Storage Sync Service After installing the agent, register SRV1 with the Storage Sync Service using the Azure portal1.

Step 6: Create a Sync Group and Server Endpoint In the Azure portal, go to your Storage Sync Service and create a new sync group. Add a server endpoint with the path C:app on SRV12.

Step 7: Configure Cloud Endpoint Add the Azure file share sharel1 as the cloud endpoint to the sync group2.

Step 8: Initiate the Sync Process The initial sync will start automatically after the cloud endpoint and server endpoint are added to the sync group. Ensure that the Azure File Sync agent is running on SRV11.

Step 9: Monitor the Sync Status Monitor the sync status in the Azure portal to ensure that the files are being replicated correctly from C:app on SRV1 to the Azure file share sharel11.

Note: Make sure that the network connectivity between SRV1 and the Azure file share is established and that the necessary ports are open. Also, verify that the SMB security settings allow for the required SMB protocol version and authentication methods1.

By following these steps, you should be able to replicate the contents of C:app on SRV1 to the Azure file share sharel1 using Azure File Sync. Ensure that you have the necessary permissions to perform these actions and that SRV1 is properly configured to communicate with Azure services.

Question #4

You have an Azure virtual machine named VM1 that has a private IP address only.

You configure the Windows Admin Center extension on VM1.

You have an on-premises computer that runs Windows 11. You use the computer for server management.

You need to ensure that you can use Windows Admin Center from the Azure portal to manage VM1.

What should you configure?

A . an Azure Bastion host on the virtual network that contains VM1.
B . a VPN connection to the virtual network that contains VM1.
C . a network security group 1NSG) rule that allows inbound traffic on port 443.
D . a private endpoint on the virtual network that contains VM1.

Reveal Solution Hide Solution

Question #5

DRAG DROP

You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.

You deploy five servers to the domain. You add the servers to a group named iTFarmHosts.

You plan to configure a Network Load Balancing (NIB) cluster named NLBCluster.contoso.com that will contain the five servers.

You need to ensure that the NLB service on the nodes of the cluster can use a group managed service account (gMSA) to authenticate.

Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdiets from the list of cmdlets to the answer area and arrange them in the correct order.

Reveal Solution Hide Solution

Question #6

You have an on-premises network that is connected to an Azure virtual network by using a Site-to-Site VPN. Each network contains a subnet that has the same IP address space. The on-premises subnet contains a virtual machine.

You plan to migrate the virtual machine to the Azure subnet.

You need to migrate the on premises virtual machine to Azure without modifying the IP address. The solution must minim administrative effort.

What should you implement before you perform the migration?

A . Azure Extended Network
B . Azure Virtual Network NAT
C . Azure Application Gateway
D . Azure virtual network peering

Reveal Solution Hide Solution

Question #7

HOTSPOT

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Question #8

DRAG DROP

You have an on-premises server named Server 1 that runs Windows Server. Server 1 contains a file share named Share 1.

You have an Azure subscription.

You perform the following actions:

• Deploy Azure File Sync

• Install the Azure File Sync agent on Server1.

• Register Server1 with Azure File Sync

You need to ensure that you can add Share1 as an Azure File Sync server endpoint.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal Solution Hide Solution

Question #9

You need to ensure that Automanage meets the technical requirements.

On which Azure virtual machines should you enable Automanage?

A . Server1 only
B . Server2 only
C . Server1 and Server2 only
D . Server2 and Server3 only
E . Server1 and Server4 only

Reveal Solution Hide Solution

Question #10

You have an Azure virtual machine named Server1 that runs a network management application.

Server1 has the following network configuration.

* Network interface.Nic1

* IP address 10.1.1.1/24

* Connected to: Vnet1/Subnet1

You need connect Server1 to an additional subnet named Vnet1/Subnet2.

What should you do?

A . Create a private endpoint on Subnet2
B . Add a network interface to server1.
C . Modify the IP configurations of Nic1.
D . Add an IP configuration to Nic1.

Reveal Solution Hide Solution

Next Questions

Free Microsoft AZ-800 Practice Exams

Microsoft AZ-800 Practice Exams