Enhance your career with AZ-800 PDF Dumps - True Microsoft Exam Questions

New (2026) Download free AZ-800 PDF for Microsoft Practice Tests

Microsoft AZ-800 certification exam is designed for IT professionals who want to validate their skills and knowledge in administering Windows Server Hybrid Core Infrastructure. AZ-800 exam is ideal for individuals who are responsible for managing and maintaining hybrid environments that include both on-premises and cloud-based resources. AZ-800 exam tests the candidate's ability to deploy, manage, and monitor Windows Server, Azure services, and hybrid solutions.

To pass the AZ-800 exam, candidates must demonstrate their expertise in implementing and managing Windows Server technologies, including Active Directory, Hyper-V, and Storage Spaces Direct. They must also have a deep understanding of Azure services such as Azure Virtual Machines, Azure Storage, and Azure Site Recovery. Additionally, candidates must be familiar with hybrid scenarios and be able to manage and monitor hybrid environments.

 

NEW QUESTION # 131
You need to sync files from an on premises server named Server1 to Azure by using Azure File Sync.
You have a cloud tiering policy that is configured for 30 percent free space and 70 days.
Volume E on Server1 is 500 GB.
A year ago, you configured E:\Data on Server1 to sync by using Azure File Sync. The files that are visible in E:\Data are shown in the following table.

Volume E does NOT contain any other files.
Where are File1 and File3 located? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Reference:
https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/azure-file-sync
https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-cloud-tiering-overview

NEW QUESTION # 132
You have an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.
You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least privilege.
To which group should you add the administrator?

• A. AAD DC Administrators
• B. Group Policy Creator Owners
• C. Enterprise Admins
• D. Schema Admins
• E. Domain Admins

Answer: E

Explanation:
Only the Domain Admins group and the Enterprise Admins group can fully manage GPOs. Members of the Group Policy Creator Owners group can create new GPOs but they can't link the GPOs to sites, the domain or OUs and they cannot manage existing GPOs.

NEW QUESTION # 133
SIMULATION
Task 3
You need to configure SRV1 as a DNS server. SRV1 must be able resolve names from the contoso.com domain by using DC1. All other names must be resolved by using the root hint servers.

Answer:

Explanation:
See the solution of this Task below
Explanation:
One possible solution to configure SRV1 as a DNS server that can resolve names from the contoso.com domain by using DC1 and all other names by using the root hint servers is to use conditional forwarding. Conditional forwarding allows a DNS server to forward queries for a specific domain name to another DNS server, while using the normal forwarding or root hint servers for other queries. Here are the steps to configure conditional forwarding on SRV1:
On SRV1, open DNS Manager from the Administrative Tools menu or by typing dnsmgmt.msc in the Run box.
In the left pane, right-click on Conditional Forwarders and select New Conditional Forwarder.
In the New Conditional Forwarder dialog box, enter contoso.com as the DNS Domain name.
In the IP addresses of the master servers box, enter the IP address of DC1, which is the DNS server for the contoso.com domain. You can also click on Resolve to verify the name resolution of DC1.
Optionally, you can check the box Store this conditional forwarder in Active Directory, and replicate it as follows if you want to store and replicate the conditional forwarder in AD DS. You can also select the replication scope from the drop-down list.
Click OK to create the conditional forwarder.
Now, SRV1 will forward any queries for the contoso.com domain to DC1, and use the root hint servers for any other queries. You can test the name resolution by using the nslookup command on SRV1 or another computer that uses SRV1 as its DNS server. For example, you can run the following commands:
nslookup www.contoso.com
nslookup www.microsoft.com
The first command should return the IP address of www.contoso.com from DC1, and the second command should return the IP address of www.microsoft.com from a root hint server.

NEW QUESTION # 134
You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.
You deploy a server to the domain and configure the server to run a service.
You need to ensure that the service can use a group managed service account (gMSA) to authenticate.
Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

Answer:

Explanation:

Explanation:

The Administering Windows Server Hybrid Core Infrastructure materials explain that group Managed Service Accounts (gMSAs) rely on the Key Distribution Service (KDS) to generate and distribute the managed password. Therefore, the first step in a new forest (or where no key exists yet) is to create a KDS root key:
Add-KdsRootKey. The guide states that "the KDS root key is required once per forest before any gMSA can be created or used," and without it, password material cannot be issued.
Next, you create the gMSA in Active Directory using New-ADServiceAccount. When creating the account, you specify the principals that are allowed to retrieve the managed password (for example, the computer account of Server1 or a group). The study content notes: "Use New-ADServiceAccount with - PrincipalsAllowedToRetrieveManagedPassword to authorize the host computers that will run the service." This removes the need to separately run mapping cmdlets.
Finally, on the target server, you install the gMSA locally using Install-ADServiceAccount. The documentation emphasizes: "After the account is created in AD, the host computer must install the gMSA so the Local Security Authority can obtain and maintain the password automatically." Because authorization is granted at creation time, Add-ADComputerServiceAccount is not required in this minimal, correct sequence.

NEW QUESTION # 135
You have the servers shown in the following tab

Served contains a virtual machine named VM1 that runs Windows Server. Server1 has an external switch named Switch"1. VM1 is connected to Switch1.
You provision containers on VM1.
You need to configure networking for VM1. The solution must meet the following requirements:
* Ensure that Server3 automatically assigns IP addresses to the containers.
* Ensure that the containers can communicate with Server2.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:

NEW QUESTION # 136
You have an Azure subscription that contains the virtual networks shown in the following table.

You deploy a virtual machine named VM1 that runs Windows Server. VM1 is connected to Subnet11.
You plan to add an additional network interface named NIC1 to VM1.
To which subnets can NIC1 be attached?

• A. Subnet11 only
• B. Subnet12 and Subnet21 only
• C. Subnet11 and Subnet12only
• D. Subnet11, Subnet12, Subnet21f and Subnet31
• E. Subnet12 only

Answer: E

NEW QUESTION # 137
You have a server named Server1 that runs Windows Server. The disks on Server1 are configured as shown in the following exhibit.

You need to convert volume E to ReFS. The solution must meet the following requirements:
* Preserve the existing data on volume E.
* Minimize administrative effort.
What should you do first?

• A. Take Disk 2 offline.
• B. Convert Disk 2 to a dynamic disk.
• C. Back up the data on volume E.
• D. Runconvert.exe.

Answer: C

NEW QUESTION # 138
You have an Azure subscription that contains the storage accounts shown in the following table.

In the East US Azure region, you create a storage sync service named Synd.
You need to create a sync group in Synd.
Which storage accounts can you use, and what can you specify as the cloud endpoints? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:

NEW QUESTION # 139
Your company has a main office and 10 branch offices that are connected by using WAN links. The network contains an Active Directory domain.
All users have laptops and regularly travel between offices.
You plan to implement BranchCache in the branch offices.
In each branch office, you install a server that runs Windows Server and the BranchCache feature. You register the servers in Active Directory.
You need to configure the laptops to use the local BranchCache server automatically. The solution must minimize administrative effort.
Which two Group Policy settings should you configure? To answer, select the settings in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
--> Turn on BranchCache
--> Enable Automatic Hosted Cache Discovery by Service Connection ...

NEW QUESTION # 140
You have a server named Server1 that has Windows Admin Center installed. The certificate used by Windows Admin Center was obtained from a certification authority (CA).
The certificate expires.
You need to replace the certificate.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Answer:

Explanation:

1 - From Internet Informaation Services (IIS)...
2 - Copy the certificate thumbprint.
3 - Rerun Windows Admin Center Setup and select Change.
Reference:
https://www.starwindsoftware.com/blog/change-the-windows-admin-center-certificate

NEW QUESTION # 141
Your network contains an Active Directory Domain Services (AD DS) domain named conioso.com.
You need to identify which server is the PDC emulator for the domain.
Solution: from Active Directory Users and Computers, you right-click contoso.com in the console tree, and then select Operations Master
Does this meet the goal?

• A. No
• B. Yes

Answer: B

NEW QUESTION # 142
You have an Azure Active Directory Domain Services (Azure AD DS) domain.
You create a new user named Admin1.
You need Admin1 to deploy custom Group Policy settings to all the computers in the domain. The solution must use the principle of least privilege.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point

Answer:

Explanation:

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy

NEW QUESTION # 143
Your network contains an Active Directory domain, a web app named App1, and a perimeter network. The perimeter network contains a server named Server1 that runs Windows Server.
You plan to provide external access to App1.
You need to implement the Web Application Proxy role service on Server1.
Which role should you add to Server1, and which role should you add to the network? To answer, drag the appropriate roles to the correct targets. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Answer:

Explanation:

Explanation:

In the Administering Windows Server Hybrid Core Infrastructure materials, Web Application Proxy (WAP) is defined as a role service of the Remote Access role that is deployed on servers placed in a perimeter (DMZ) network to publish internal web applications for external users. The guide explains that WAP "acts as a reverse proxy and preauthentication endpoint for published applications" and that it is installed by adding the Remote Access role and selecting the Web Application Proxy role service. It further emphasizes that WAP
"integrates with Active Directory Federation Services (AD FS) to provide claims-based preauthentication and single sign-on for applications such as AD FS-protected web apps." Consequently, to make App1 available externally using least privilege and supported design, you deploy Remote Access (Web Application Proxy) on Server1 in the perimeter, and you ensure the AD FS role is available on the internal network as the federation service that WAP trusts. Other roles listed (for example, Network Policy and Access Services or Active Directory Certificate Services) are not required to stand up WAP publishing itself; certificates are consumed by WAP/AD FS, but the publishing function specifically relies on Remote Access (WAP) with AD FS as its preauthentication partner.

NEW QUESTION # 144
You have servers that have the DNS Server role installed. The servers are configured as shown in the following table.

All the client computers in the New York office use Server2 as the DNS server.
You need to configure name resolution in the New York office to meet the following requirements:
Ensure that the client computers in New York can resolve names from contoso.com.
Ensure that Server2 forwards all DNS queries for internet hosts to 131. 107.100.200.
The solution must NOT require modifications to Server1.
Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

• A. a reverse lookup zone
• B. a secondary zone
• C. a forwarder
• D. a delegation
• E. a conditional forwarder

Answer: C,E

Explanation:
Explanation
A conditional forwarder is required for contoso.com.
A forwarder is required for all other domains.
When you have a conditional forwarder and a forwarder configured, the conditional forwarder will be used for the specified domain.
You could use a secondary zone for contoso.com but that would require a configuration change on Server1.

NEW QUESTION # 145
You have on-premises servers that run Windows Server as shown in the following table.

You have an Azure file share named share1 that stores two files named File2.docx and File3.docx.
You create an Azure File Sync sync group that includes the following endpoints:
share
D:\Folder1 on Server1
D:\Datal on Server2
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
You can create a file named File2.docx in D:\Folder1 on Server1. = No
You can create a file named File1.docx in D:\Data1 on Server2. = No
File3.docx will sync to Server1. = Yes
In the Administering Windows Server Hybrid Core Infrastructure content for Azure File Sync, Microsoft describes Azure File Sync as a multi-master synchronization service where a sync group contains one cloud endpoint (the Azure file share) and one or more server endpoints (paths on Windows Server). The documentation explains that "the namespace is kept consistent across all endpoints in the sync group; files and folders created on any endpoint are synced to the Azure file share and then to all other server endpoints." It also states that "Azure File Sync is bidirectional and uses a last-writer-wins conflict model; the cloud endpoint is the hub that fan-outs changes to all registered server endpoints," and that "existing items in the cloud share will be projected to each server endpoint (with cloud tiering optionally stubbing files) so the same names and paths appear on every endpoint." Applying this:
* Because share1 already contains File2.docx, it will be synced down to D:\Folder1 on Server1, so you cannot create another File2.docx there without overwriting-No.
* File1.docx exists on Server1 and will be uploaded to share1 and then projected to Server2 at D:\Data1, so creating a brand-new File1.docx there would conflict-No.
* File3.docx exists in share1 (and also locally on Server2) and will be synchronized to Server1 at D:
\Folder1-Yes.

NEW QUESTION # 146
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a server named Server1 that has the DFS Namespaces role service installed. Server! hosts a domain-based Distributed File System (DFS) Namespace named Files.
The domain contains a tile server named Server2. Seiver2 contains a shared folder named Share1. Share1 contains a subfolder named Folder 1.
In the Files namespace, you create a folder named Folder! that has a target of
\\Server2.contoso.com\Share1\Folder1.
You need to configure a logon script that will map drive letter M to Folder1. The solution must use the path of the DFS Namespace.
How should you complete the command to map the drive letter? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation
Text Description automatically generated with low confidence

NEW QUESTION # 147
Your network contains an on -premises Active Directory Domain Services (AD DS) domain named contoso.com The domain contains the objects shown in the following table.

You plan to sync contoso.com with an Azure Active Directory (Azure AD) tenant by using Azure AD Connect You need to ensure that all the objects can be used in Conditional Access policies What should you do?

• A. Clear the Configure device writeback option.
• B. Change the scope o' Group1 and Group2 to Global
• C. Select the Configure Hybrid Azure AD join option.
• D. Change the scope of Group2 to Universal

Answer: C

Explanation:
Hybrid Azure AD join needs to be configured to enable Computer1 to be used in Conditional Access Policies.
Synchronized users, universal groups and domain local groups can be used in Conditional Access Policies.

NEW QUESTION # 148
You have a server named Server1 that hosts Windows containers. You plan to deploy an application that will have multiple containers. Each container will be You need to create a Docker network that supports the deployment of the application. Which type of network should you create?

• A. transparent
• B. I2tunnel
• C. NAT
• D. I2bridge

Answer: D

Explanation:
Reference:
https://docs.microsoft.com/en-us/virtualization/windowscontainers/container-networking/network-drivers-topologies

NEW QUESTION # 149
Hotspot Question
You have a server named Server1 that runs Windows Server. Server1 has a just-a-bunch-of- disks (JBOD) enclosure attached.
You plan to create a storage pool on Server1 and a virtual disk that will use a mirror layout.
You are considering whether to use a two-way or a three-way mirror layout.
What is the minimum number of disks required for each type of mirror layout? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Resiliency levels
To create a highly available virtual disk, you need at least one physical disk that satisfies the following requirements:
1.One physical disk is required to create a storage pool.
2.A minimum of two physical disks are required to create a resilient mirror virtual disk.
3.A minimum of three physical disks are required to create a virtual disk with resiliency through parity.
4.Three-way mirroring requires at least five physical disks.
5.Disks must be blank and unformatted. No volume can exist on the disks.
https://learn.microsoft.com/en-us/training/modules/implement-storage-spaces-storage-spaces- direct/2-define-storage-spaces-architecture-components

NEW QUESTION # 150
The IT department in Contoso is deploying a new version of MS Office in their on-premises environment. The administrator desires to configure the settings with GPOs for Office. What should they do?

• A. Download and install new administrative template files and then configure the desired settings in the Administrative in the appropriate GPO.
• B. Download and install new .admx files and then configure the desired settings in the Administrative Templates node GPO.
• C. Download and install new .adml files and then configure the desired settings in the Administrative Templates node GPO.
• D. Copy the content of the Windows\PolicyDefinitions folder to the Central Store.

Answer: A

Explanation:
Administrative templates can be used to control the environment of an operating system(OS) and the user experience. Two available sets of administrative templates are computer-related settings and user-related settings. Administrative template files offer most of the available GPO settings, which change particular registry keys.
References:
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-
2012/dn789186(v=ws.11)
https://docs.microsoft.com/en-us/learn/modules/implement-group-policy-objects/7-define- administrative-templates?

NEW QUESTION # 151
......

Microsoft AZ-800 certification exam is an excellent way to validate your skills and knowledge in administering hybrid core infrastructure environments using Windows Server technologies. By passing AZ-800 exam, you can demonstrate your expertise in managing complex infrastructure environments and increase your chances of landing a job or advancing your career in IT.

 

100% Free AZ-800 Files For passing the exam Quickly: https://testking.braindumpsit.com/AZ-800-latest-dumps.html