AZ-800 Practice Questions

The most appropriate and efficient solution is to use the File Server Resource Manager (FSRM) role service. FSRM includes a feature called file screening, which is specifically designed to control the types of files users can save on a file server. You can create a file group that includes the .mov extension and then apply a file screen to the relevant shared folders. This directly blocks the specified file type. To minimize administrative effort across the five servers, a file screen template can be created and applied consistently, ensuring a centralized and straightforward management approach.

A. a Dynamic Access Control central access policy: This controls access based on user, device, and resource properties (claims), not file extensions.

C. a Dynamic Access Control central access rule: This is a component of a DAC policy and is also not designed for filtering files by type.

D. a data loss prevention (DLP) policy: DLP is primarily used to identify and protect sensitive data based on its content, not just its file extension.

1. Microsoft Learn

File Server Resource Manager (FSRM) overview. This document introduces FSRM as the toolset for managing and classifying data on file servers

explicitly mentioning file screening as a key capability. See the "Features" section.

Source: https://learn.microsoft.com/en-us/windows-server/storage/fsrm/fsrm-overview

2. Microsoft Learn

File Screening Management. This document details the file screening functionality. It states

"File screening allows you to control the types of files that user can store on a file server." It describes creating file groups (for extensions like .mov) and file screens to block them.

Source: https://learn.microsoft.com/en-us/windows-server/storage/fsrm/file-screening-management

3. Microsoft Learn

Create a File Screen. This guide provides the step-by-step procedure for implementing a file screen. Step 4 specifically covers selecting a file group to block

which would contain the .mov extension in this scenario.

Source: https://learn.microsoft.com/en-us/windows-server/storage/fsrm/create-file-screen

In an Azure Active Directory Domain Services (Azure AD DS) managed domain, the AAD DC Administrators group is specifically designed to delegate administrative tasks. Members of this group are granted permissions to perform domain administration, which includes creating, editing, and linking Group Policy Objects (GPOs) for custom Organizational Units (OUs). Assigning the administrator to this group provides the necessary permissions to manage GPOs without granting excessive privileges, thereby adhering to the principle of least privilege. Privileges for groups like Domain Admins and Enterprise Admins are reserved by the service and cannot be assigned to users.

B. Domain Admins: In Azure AD DS, users cannot be added to the Domain Admins group, as these permissions are reserved for the managed service to operate the domain.

C. Schema Admins: This group has permissions to modify the Active Directory schema, which is far beyond what is needed for GPO management and is a restricted group in Azure AD DS.

D. Enterprise Admins: Similar to Domain Admins, users cannot be added to the Enterprise Admins group in Azure AD DS; these elevated permissions are reserved for the service.

E. Group Policy Creator Owners: This group can create GPOs but can only manage the GPOs they create. It lacks the broader permissions to manage all GPOs or link them, which is required for full administration.

1. Microsoft Learn. (2023). Administer Group Policy on an Azure Active Directory Domain Services managed domain. In "Tutorials > Identity > Azure AD Domain Services". Retrieved from https://learn.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy.

Reference Point: In the "Before you begin" section

it explicitly states: "To create and configure GPOs

you need to be signed in to a user account that's a member of the AAD DC Administrators group in your Azure AD tenant."

2. Microsoft Learn. (2023). Administration concepts for an Azure Active Directory Domain Services managed domain. In "Concepts > Security". Retrieved from https://learn.microsoft.com/en-us/azure/active-directory-domain-services/concepts-delegation.

Reference Point: Under the "AAD DC Administrators group" section

it lists the privileges for members

including: "Create and administer Group Policy Objects (GPOs) in the custom GPO container."

3. Microsoft Learn. (2023). Frequently asked questions (FAQs) about Azure Active Directory Domain Services. In "Troubleshoot". Retrieved from https://learn.microsoft.com/en-us/azure/active-directory-domain-services/faqs.

Reference Point: Under the "Administration and operations" section

the FAQ "Can I get domain administrator or enterprise administrator privileges for the managed domain that Azure AD DS creates?" is answered with: "No. You aren't granted domain administrator or enterprise administrator permissions on the managed domain." This confirms options B and D are incorrect.

Changing the size of an Azure virtual machine (VM) requires a restart. When you resize a VM, Azure may need to move it to a different physical host or cluster that has the resources available for the new size. This process involves stopping the VM on the current host, re-provisioning it with the new size on a new host, and then starting it again. This sequence of events constitutes downtime for the virtual machine. In contrast, both attaching a new data disk and detaching an existing one are "hot" operations that can be performed on a running Windows Server VM without requiring a reboot.

A. Detaching the data disk only and adding a new standard SSD.

These are both online operations. Azure supports hot-adding and hot-detaching data disks for running Windows VMs, so no downtime is required for these actions.

B. Detaching the data disk only.

Detaching a data disk from a running Windows VM is a supported online operation and does not necessitate downtime.

D. Adding a new standard SSD only.

Adding (attaching) a new data disk to a running Windows VM is a supported "hot-add" operation and does not require downtime.

1. Microsoft Learn. (2023). Resize a virtual machine. Azure Virtual Machines documentation. Retrieved from https://learn.microsoft.com/en-us/azure/virtual-machines/resize-vm.

Reference Section: Resize a VM. The document states

"If the VM is currently running

changing its size will cause it to be restarted." This explicitly confirms that resizing requires downtime.

2. Microsoft Learn. (2023). Detach a data disk from a Windows virtual machine. Azure Virtual Machines documentation. Retrieved from https://learn.microsoft.com/en-us/azure/virtual-machines/windows/detach-disk.

Reference Section: Detach a data disk using the portal. The first paragraph states

"You can detach a data disk from a Windows virtual machine while it's running." This confirms detaching a disk is an online operation.

3. Microsoft Learn. (2023). Attach a managed disk to a Windows VM. Azure Virtual Machines documentation. Retrieved from https://learn.microsoft.com/en-us/azure/virtual-machines/windows/attach-managed-disk-portal.

Reference Section: Find

attach

and initialize a new data disk. The procedure described does not require the VM to be stopped

confirming that attaching a disk is a "hot-add" or online operation.

The L2bridge network driver is the correct choice for this scenario. It connects all containers on a single host to the same network subnet as the container host itself. Each container is assigned a unique IP address from the same prefix as the host, allowing them to communicate as if they are on the same Layer 2 network segment. This driver uses Layer 2 address translation (MAC re-write), which is highly compatible with virtualized environments where security policies might block the MAC spoofing required by the transparent driver.

A. transparent: While this driver also connects containers to the host's network subnet, it requires MAC spoofing, which is often disabled on virtual switches for security reasons, making it less suitable.

C. NAT: This driver creates an internal, private network for the containers. Containers receive IP addresses from a separate subnet and are isolated from the host's network, which does not meet the requirement.

D. l2tunnel: This is a specialized driver for multi-host networking, typically used in cloud environments like Azure Stack HCI. It is not intended for networking containers on a single host.

1. Microsoft Learn. (2023). Windows container networking. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/virtualization/windowscontainers/container-networking/network-drivers-topologies.

Section: L2bridge Network Driver: "With the l2bridge driver

container network traffic will have the same MAC address as the host because it undergoes layer-2 address translation (MAC re-write) on both ingress and egress... This driver is recommended when your container host is virtualized and you need to connect your containers to the same VLAN as the VM."

Section: Transparent Network Driver: "Use of this driver requires caution

as you will need to ensure that there are no MAC address conflicts on your network."

Section: Network Address Translation (NAT) Network: "By default

containers running on Windows receive an IP address from an internal

private IP prefix (e.g. 172.16.0.0/12)."

Section: L2tunnel Network Driver: "This driver should be used with a Microsoft Cloud Stack... This driver is used for workloads running on a network fabric..."

In a hybrid environment where an on-premises Active Directory domain is extended to Azure, the recommended practice for name resolution is to use Active Directory-integrated DNS servers running on domain controller virtual machines (VMs) in Azure.

First, a server (DC3) intended to act as a domain controller and DNS server in the Azure virtual network must have the DNS Server role installed (F). This is a prerequisite for it to handle DNS queries for the corp.fabrikam.com domain.

Second, the Azure virtual network (Vnet1) must be configured to use this new DNS server. By changing the VNet's DNS server settings to the private IP address of DC3 (D), all VMs within that VNet will automatically use DC3 for name resolution, enabling them to resolve on-premises resources and locate domain controllers for domain-join operations.

A. Creating an Azure private DNS zone with the same name as an on-premises AD domain creates a "split-brain" DNS scenario, which is more complex to manage and not the recommended primary solution for AD integration.

B. This action is dependent on creating an Azure private DNS zone (Option A). Since A is not the best practice for this scenario, this subsequent step is also incorrect.

C. An Azure DNS zone is for public, internet-facing name resolution, which is not suitable for resolving internal, private hostnames in a hybrid Active Directory environment.

E. This action is also dependent on creating an Azure private DNS zone (Option A) and is therefore part of a less-recommended solution for this specific scenario.

G. Configuring a conditional forwarder is a secondary step, typically performed after the primary DNS infrastructure is established, to resolve names in other specific domains (e.g., forwarding Azure-specific queries).

1. Microsoft Learn

Azure Architecture Center. Extend an on-premises Active Directory domain to Azure. Under the "Networking recommendations" section

it states

"Deploy at least two domain controllers as Azure VMs... These VMs must run the DNS Server role." This supports option F. It also recommends

"Configure the DNS server settings for the virtual network... to reference the private IP addresses of the domain controller VMs." This supports option D.

2. Microsoft Learn. Name resolution for resources in Azure virtual networks. In the section "Name resolution that uses your own DNS server

" the documentation outlines the process for using custom DNS servers (like a domain controller) in a VNet. It specifies

"When you use your own DNS servers

you can specify multiple DNS servers per virtual network

" which directly corresponds to performing action D. The entire scenario presumes the existence of a configured DNS server

which requires the role to be installed (action F).

3. Microsoft Learn. Deploy AD DS in an Azure virtual network. In the "Configure the virtual network" section

step 4 states: "Change the DNS server for the virtual network... to use the static IP address assigned to the first domain controller." This validates action D. The preceding steps involve creating the domain controller VM

which includes installing the AD DS and DNS Server roles

validating action F.

Windows Admin Center (WAC) is a web-based management portal. When installed in gateway mode on a Windows Server operating system, the default configuration uses TCP port 443 for HTTPS communication. Administrators connect to the WAC gateway using a web browser from their workstations. In this scenario, administrators in the main office need to access the WAC gateway in the branch office. Therefore, the branch office firewall must be configured to allow inbound traffic on the port the WAC gateway is listening on, which, by default on Windows Server, is TCP port 443.

B. 3389: This port is used for Remote Desktop Protocol (RDP) connections, not for accessing the main Windows Admin Center web interface.

C. 5985: This is the default port for Windows Remote Management (WinRM) over HTTP, which WAC uses to communicate with managed servers, not for the initial browser-to-gateway connection.

D. 6516: This is the default port used when Windows Admin Center is installed on a Windows client OS (like Windows 10/11), not on a Windows Server.

1. Microsoft Learn

Install Windows Admin Center. Under the "Installation type" section

it states: "When you install Windows Admin Center on Windows Server

it uses port 443 by default... When you install Windows Admin Center on Windows 10

it uses port 6516 by default." This directly confirms that for a server installation

443 is the default.

2. Microsoft Learn

Windows Admin Center frequently asked questions (FAQ). In the "General" section

the question "Which port does Windows Admin Center use?" is answered with: "Windows Admin Center gateway uses port 443 by default on Windows Server

but you can specify a different port during installation." This corroborates the default port for the scenario.

3. Microsoft Learn

Planning for Windows Admin Center. The "Gateway" section describes the architecture: "The Windows Admin Center gateway... lets you connect to and manage your servers from anywhere with a... browser." This confirms the browser-based access model

which relies on HTTPS (typically on port 443).

In environments like Azure Virtual Desktop (AVD), it is crucial to apply a consistent set of user settings to anyone who logs onto a specific session host, regardless of where the user's account is located in Active Directory. The standard Group Policy processing applies user settings based on the user object's location.

Group Policy loopback processing changes this default behavior. When enabled on a GPO linked to an Organizational Unit (OU) containing computer objects (the AVD session hosts), it forces the system to also apply the User Configuration settings from GPOs associated with the computer. This ensures that the required security settings are applied to every user session on those hosts, fulfilling the security requirements.

A. security filtering for the link of GPO4: This restricts which computers or users the GPO applies to but does not alter the fundamental user policy processing behavior required for this scenario.

B. security filtering for the link of GPO1: This restricts which computers or users the GPO applies to but does not alter the fundamental user policy processing behavior required for this scenario.

D. the Enforced property for the link of GPO1: This prevents policy settings from being overridden by GPOs at a lower level in the AD hierarchy but does not change which user policies are applied.

E. loopback processing in GPO1: This would be incorrect if GPO1 is not the policy object linked to the OU containing the AVD session hosts where the setting is required.

F. the Enforced property for the link of GPO4: This prevents policy settings from being overridden by GPOs at a lower level in the AD hierarchy but does not change which user policies are applied.

1. Microsoft Learn. "Configure user Group Policy loopback processing mode." This document details the loopback processing feature. It states

"This setting directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this setting." This is the core mechanism needed for AVD session hosts. The setting is located at Computer Configuration\Policies\Administrative Templates\System\Group Policy.

2. Microsoft Learn. "Loopback processing of Group Policy." This article explains the two modes (Merge and Replace) and explicitly calls out its use for "Remote Desktop Session Host servers

" which is the technology underpinning AVD session hosts. It clarifies that loopback is designed for scenarios where user settings must be determined by the computer being used.

3. Microsoft Learn. "Recommended GPO settings for VDI desktops." In the section "User Group Policy loopback processing mode

" this performance tuning guide for VDI (a similar technology) recommends enabling loopback processing to ensure user experience and security settings are applied from the VDI host's GPO

not the user's.

To manage an Azure virtual machine using the Windows Admin Center (WAC) extension in the Azure portal, the browser on the management computer must have direct network connectivity to the target VM's IP address. Since the VM in this scenario only has a private IP address, a connection must be established between the on-premises network and the Azure virtual network. A site-to-site VPN or an ExpressRoute circuit provides this required network path, allowing the on-premises computer's browser to resolve and connect to the VM's private IP address, thereby enabling management through the WAC portal interface.

A. an Azure Bastion host on the virtual network that contains VM1.

Azure Bastion provides secure RDP and SSH connectivity to VMs through the Azure portal. It does not facilitate the web-based traffic required for the Windows Admin Center extension.

C. a network security group (NSG) rule that allows inbound traffic on port 443.

An NSG rule only filters traffic; it does not create a network path. Since the VM has no public IP, a rule for internet traffic is ineffective.

D. a private endpoint on the virtual network that contains VM1.

A private endpoint is used to securely connect to Azure PaaS services from within a virtual network, not to provide external management access to a VM.

1. Microsoft Learn. "Use Windows Admin Center in the Azure portal to manage a Windows Server VM". Windows Server Documentation. Under the "Connectivity" section

it states

"To connect to a VM

your browser needs to be able to reach its private IP address... If you're connecting over the private IP address

you'll need a VPN connection to the virtual network of the VM."

2. Microsoft Learn. "What is VPN Gateway?". Azure Documentation. This document explains that Azure VPN Gateway extends on-premises networks to Azure virtual networks over a site-to-site VPN tunnel

which provides the necessary connectivity for this scenario.

3. Microsoft Learn. "What is Azure Bastion?". Azure Documentation. This source clarifies that Azure Bastion is a PaaS service for secure RDP/SSH access

confirming it is not the correct tool for enabling WAC connectivity.

4. Microsoft Learn. "What is a private endpoint?". Azure Documentation. This document details the function of private endpoints

confirming they are used for inbound connections to PaaS services

not for IaaS VM management from an external location.

To grant on-premises Active Directory users access to Azure resources, their identities must first be synchronized to Microsoft Entra ID. Microsoft Entra Connect cloud sync is a modern, lightweight agent designed for this purpose. It allows for targeted synchronization, which can be scoped to specific Organizational Units (OUs). By configuring cloud sync to synchronize only the "Marketing OU," the required user objects are provisioned in Microsoft Entra ID. These identities can then be granted access to the storage1 Azure Storage Account using Role-Based Access Control (RBAC), directly meeting the technical requirement.

B. Active Directory Federation Services (AD FS): AD FS is a federation service for handling authentication requests. It does not synchronize user or group objects to Microsoft Entra ID, which is required for assigning permissions.

C. Microsoft Entra Connect in staging mode: A server in staging mode is a passive backup. It reads data but does not write or export any changes to Microsoft Entra ID, so it cannot provision users.

D. Microsoft Entra Connect in active mode: While the traditional Entra Connect sync can also filter by OU, cloud sync is a more modern, lightweight solution better suited for targeted, OU-based synchronization from the cloud.

1. Microsoft Learn. (2023). What is Microsoft Entra Connect cloud sync?. In the "Key benefits" section

it explicitly lists the capability to "Scope synchronization to specific OUs." Retrieved from https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/what-is-cloud-sync

2. Microsoft Learn. (2023). Microsoft Entra Connect: Staging server and disaster recovery. The "Staging mode" section states

"A server in staging mode does not run any export operations

" confirming it does not write to Microsoft Entra ID. Retrieved from https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-staging-server

3. Microsoft Learn. (2023). What is federation with Microsoft Entra ID?. This document clarifies that federation is an authentication mechanism

distinct from the synchronization of identity objects needed for authorization. Retrieved from https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/whatis-fed

4. Microsoft Learn. (2023). Compare cloud sync and Connect sync. This table highlights that both solutions support "Sync a specific OU

" but positions cloud sync as the lightweight agent solution. Retrieved from https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/what-is-cloud-sync#comparison-between-microsoft-entra-connect-and-cloud-sync

Azure Extended Network is a feature designed specifically to stretch an on-premises subnet into Azure. This creates a Layer 2 network extension, allowing on-premises virtual machines to be migrated to Azure while retaining their original private IP addresses. This is crucial for scenarios where applications are hard-coded with IP addresses or when re-IPing is not feasible. The feature directly addresses the core requirements of the question: migrating a VM to an overlapping subnet in Azure without changing its IP address and with minimal administrative effort, as it avoids any network reconfiguration on the migrated VM.

B. Azure Virtual Network NAT: This service simplifies outbound-only internet connectivity for virtual networks. It does not facilitate network extension from on-premises or resolve overlapping IP address space issues for migration.

C. Azure Application Gateway: This is a Layer 7 web traffic load balancer. It manages HTTP/S traffic to web applications and is not designed for Layer 2/3 network extension or VM migration.

D. Azure virtual network peering: This connects two Azure virtual networks. A fundamental requirement for VNet peering is that the connected networks must have non-overlapping IP address spaces, which contradicts the scenario described.

1. Microsoft Learn

Azure Extended Network for Windows Admin Center. This document explicitly states

"Extended network is a feature that allows you to stretch an on-premises subnet to Azure to allow on-premises virtual machines to keep their original on-premises private IP addresses when migrating to Azure."

Source: Microsoft Learn. Section: "Overview of Azure Extended Network for Windows Admin Center".

2. Microsoft Learn

What is Virtual Network NAT? This document defines the purpose of VNet NAT. "Virtual Network NAT (network address translation) simplifies outbound-only internet connectivity for virtual networks... With a NAT gateway

VMs without public IP addresses can connect to the internet."

Source: Microsoft Learn. Section: "What is Virtual Network NAT?".

3. Microsoft Learn

Azure virtual network peering. This document outlines the constraints of VNet peering. "The virtual networks you peer must have non-overlapping IP address spaces."

Source: Microsoft Learn. Section: "Virtual network peering - Requirements and constraints".