BEST Verified Microsoft AZ-800 Exam Questions (2023) [Q66-Q84]

admin • December 27, 2023

BEST Verified Microsoft AZ-800 Exam Questions (2023) [Q66-Q84]

Rate this post

BEST Verified Microsoft AZ-800 Exam Questions (2023)

The Best Practice Test Preparation for the AZ-800 Certification Exam

The AZ-800 exam consists of various topics, including hybrid identity, hybrid compute, hybrid networking, and security. Candidates are expected to have a strong understanding of these topics and be able to demonstrate their skills in each area. AZ-800 exam is designed to test the candidate’s ability to configure and manage the hybrid infrastructure in a secure and efficient manner.

Microsoft AZ-800 certification exam is a rigorous and challenging test of your hybrid infrastructure management skills. By earning this certification, you can demonstrate your expertise to potential employers and advance your career in the field of hybrid cloud computing.

Q66. Which three actions should you perform in sequence to meet the security requirements for Webapp1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

1 – Configure the IS application pool to run as Network Service.
2 – Create a group managed service account (gMSA) in Active Directory.
3 – Create the key Distribution Services (KDS) root key in AD DS.

Q67. Your network contains a Active Directory Domain Service (AD DS) forest named contoso.com. The forest root domain contains a server named server1. contoso.com.
A two-way forest trust exists between the contoso.com forest and an AD DS forest named fabrikam.com. The fabrikam.com forest contains 10 child domains.
You need to ensure that only the members of a group named fabrikamGroup1 can authenticate to server1.contoso.com.
What should you do first?

Change the trust to a one-way external trust.

Add fabrikamGroup1 to the local Users group on server1.contoso.com.

Enable SID filtering for the trust.

Enable Selective authentication for the trust.

Q68. You have on-premises file servers that run Windows Server as shown in the following table.

You have the Azure file shares shown in the following table.

You add a Storage Sync Service named Sync1 and an Azure File Sync sync group named Group1. Group1 uses share1 as a cloud endpoint.
You register Server1 and Server2 with Sync1. You add D:Folder1 from Server1 as a server endpoint in Group1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Explanation
Graphical user interface, text, application, email Description automatically generated

Reference:
https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-planning

Q69. You have an Azure virtual machine named Server1 that runs a network management application.
Server1 has the following network configuration:
– Network interface.Nic1
– IP address 10.1.1.1/24
– Connected to: Vnet1/Subnet1
You need connect Server1 to an additional subnet named Vnet1/Subnet2.
What should you do?

Create a private endpoint on Subnet2

Add a network interface to server1.

Modify the IP configurations of Nic1.

Add an IP configuration to Nic1.

First add another network interface to Server1, then connect it to Subnet2.
Virtual network and subnets.
A subnet is a range of IP addresses in the virtual network. You can divide a virtual network into multiple subnets for organization and security. Each NIC in a VM is connected to one subnet in one virtual network. NICs connected to subnets (same or different) within a virtual network can communicate with each other without any extra configuration.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/network-overview

Q70. You have a server named Server1 that runs Windows Server and has the Hyper-V server role installed.
You need 10 limit which Hyper-V module cmdlets helpdesk users can use when administering Server 1 remotely.
You configure Just Enough Administration (JEA) and successfully build the role capabilities and session configuration files.
How should you complete the PowerShell command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Reference:
https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/jea/session-configurations?view=powershell-7.2
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/new-pssessionconfigurationfile?view=powershell-7.2

Q71. You need to meet the technical requirements for VM1.
Which cmdlet should you run first? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Q72. You have five tile servers that run Windows Server.
You need to block users from uploading video files that have the .mov extension to shared folders on the file servers. All other types of files must be allowed. The solution must minimize administrative effort.
What should you create?

a Dynamic Access Control central access policy

a file screen

a Dynamic Access Control central access rule

a data loss prevention (DLP) policy

Q73. You need to sync files from an on premises server named Server1 to Azure by using Azure File Sync.
You have a cloud tiering policy that is configured for 30 percent free space and 70 days.
Volume E on Server1 is 500 GB.
A year ago, you configured E:Data on Server1 to sync by using Azure File Sync. The files that are visible in E:Data are shown in the following table.

Volume E does NOT contain any other files.
Where are File1 and File3 located? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Reference:
https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/azure-file-sync
https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-cloud-tiering-overview

Q74. You have a server named Server1 that hosts Windows containers. You plan to deploy an application that will have multiple containers. Each container will be You need to create a Docker network that supports the deployment of the application. Which type of network should you create?

transparent

I2bridge

NAT

I2tunnel

Reference:
https://docs.microsoft.com/en-us/virtualization/windowscontainers/container-networking/network-drivers-topolo

Q75. Your network contains an Active Directory Domain Services (AD DS) domain.
You have a Group Policy Object (GPO) named GPO1 that contains Group Policy preferences.
You plan to link GPO1 to the domain.
You need to ensure that the preference in GPO1 apply only to domain member servers and NOT to domain controllers or client computers. All the other Group Policy settings in GPO1 must apply to all the computers. The solution must minimize administrative effort.
Which type of item level targeting should you use?

Domain

Operating System

Security Group

Environment Variable

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-
2012/dn789189(v=ws.11)#operating-system-targeting

Q76. You need to configure network communication between the Seattle and New York offices. The solution must meet the networking requirements.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Reference:
https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-expressroute-portal

Q77. You create a new Azure subscription.
You plan to deploy Azure Active Directory Domain Services (Azure AD DS) and Azure virtual machines.
You need to ensure that the virtual machines can join Azure AD DS.
Which three actions should perform in sequence? To answer, move the appropriate actions from the list of action of the answer area and arrange them in the correct order.

1 – Create an Azure virtual network.
2 – Create an Azure AD dS instance.
3 – Modify the settings of the Azure virtual network.

Q78. You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.
You deploy five servers to the domain. You add the servers to a group named iTFarmHosts.
You plan to configure a Network Load Balancing (NIB) cluster named NLBCluster.contoso.com that will contain the five servers.
You need to ensure that the NLB service on the nodes of the cluster can use a group managed service account (gMSA) to authenticate.
Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdiets from the list of cmdlets to the answer area and arrange them in the correct order.

1 – New-ADServiceAccount
2 – Install-ADServiceAccount
3 – Add-ADComputerServiceAccount

Q79. You need to meet the security requirements for passwords.
Where should you configure the components for Azure AD Password Protection? lo answer, drag the appropriate components to the correct locations. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE Each correct selection is worth one point.

Q80. You have an on-premises network that is connected to an Azure virtual network by using a Site- to-Site VPN. Each network contains a subnet that has the same IP address space. The on- premises subnet contains a virtual machine.
You plan to migrate the virtual machine to the Azure subnet.
You need to migrate the on premises virtual machine to Azure without modifying the IP address.
The solution must minim administrative effort.
What should you implement before you perform the migration?

Azure Extended Network

Azure Virtual Network NAT

Azure Application Gateway

Azure virtual network peering

https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/azure- extended-network

Q81. You need to implement a name resolution solution that meets the networking requirements. Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point

Create an Azure private DNS zone named corp.fabhkam.com.

Create a virtual network link in the coip.fabnkam.com Azure private DNS zone.

Create an Azure DNS zone named corp.fabrikam.com.

Configure the DNS Servers settings for Vnet1.

Enable autoregistration in the corp.fabnkam.com Azure private DNS zone.

On DC3, install the DNS Server role.

Configure a conditional forwarder on DC3.

Q82. Your organization uses a hybrid identity model for accessing both Azure-based and on-premises services. The Azure Active Directory Connect (Azure AD Connect) sync service is running on a dedicated server in your on-premises network; however, it has been decided that Active Directory (AD) passwords should not be stored in any form in the cloud.
You need to enable this using the Azure AD Connect application.
What should you do?

Enable Pass-through authentication.

Delete user identities in Azure AD for your organization.

Enable password hash synchronization.

Select Do not configure in the User sign-in options.

You should enable Pass-through authentication. This will allow your organization’s users to use single sign-on (SSO) in order to securely access resources both in your on-premises network as well as in Azure AD. When users try to access Azure AD from the on-premises network, they will never need to enter their passwords. An additional feature of Pass-through authentication is that these passwords are never stored in the cloud, thus meeting the security requirement of the scenario. When configuring Pass-through authentication using the Azure AD Connect application an additional step is to ensure that the Enable single sign-on box has been checked.

Q83. You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant
You have several Windows 10 devices that are Azure AD hybrid-joined.
You need to ensure that when users sign in to the devices, they can use Windows Hello for Business.
Which optional feature should you select in Azure AD Connect?

Device writeback

Group writeback

Password writeback

Directory extension attribute sync

Azure AD app and attribute filtering

Reference:
https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs

Q84. You have a Windows Server container host named Server1 and an Azure subscription.
You deploy an Azure container registry named Registry1 to the subscription.
On Server1, you create a container image named image1.
You need to store imager in Registry1.
Which command should you run on Server1 ? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.