Practice Mode

AZ-800

Loading...

AZ-800 — 20 free practice questions

Preview the exam for free. Unlock all 300 questions →

Question 1

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. You need to identify which server is the PDC emulator for the domain. Solution: From Active Directory Domains and Trusts, you right-click Active Directory Domains and Trusts in the console tree, and then select Operations Master. Does this meet the goal? Options: A. Yes B. No
  • A. Yes
  • B. No Correct

Explanation

The solution described does not meet the goal because to identify the PDC emulator for the domain, one should right-click on the domain in Active Directory Users and Computers rather than Active Directory Domains and Trusts. Selecting 'Operations Masters' from there will correctly display the server holding the PDC role.

Question 2

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. You need to identify which server is the PDC emulator for the domain. Solution: From a command prompt, you run netdom.exe query fsmo. Does this meet the goal? Options: A. Yes B. No
  • A. Yes Correct
  • B. No

Explanation

The command 'netdom query fsmo' from a command prompt can identify the PDC emulator for the domain among other FSMO roles. This meets the goal as specified.

Question 3

You have an on premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. You plan to implement self-service password reset (SSPR) in Azure AD. You need to ensure that users that reset their passwords by using SSPR can use the new password resources in the AD DS domain. What should you do? Options: A. Deploy the Azure AD Password Protection proxy service to the on premises network. B. Run the Microsoft Azure Active Directory Connect wizard and select Password writeback. C. Grant the Change password permission for the domain to the Azure AD Connect service account. D. Grant the impersonate a client after authentication user right to the Azure AD Connect service account.
  • A. Deploy the Azure AD Password Protection proxy service to the on premises network.
  • B. Run the Microsoft Azure Active Directory Connect wizard and select Password writeback. Correct
  • C. Grant the Change password permission for the domain to the Azure AD Connect service account.
  • D. Grant the impersonate a client after authentication user right to the Azure AD Connect service account.

Explanation

Password writeback must be enabled to ensure that password changes made via self-service password reset in Azure AD are synchronized back to the on-premises Active Directory Domain Services (AD DS). This ensures users can use their new passwords for resources within the AD DS domain.

Question 4

Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. You create the resources shown in the following table. | Name | Type | Member of | In organizational unit (OU) | |--------|-----------------|-----------|-----------------------------| | User1 | User | None | Contoso.com\OU1 | | User2 | User | Group1 | Contoso.com\OU1 | | User3 | User | Group1 | Contoso.com\OU2 | | Group1 | Group | None | Contoso.com\OU1 | | Comp1 | Client computer | Group1 | Contoso.com\OU2 | You create the Group Policy Objects (GPOs) shown in the following table. | Name | Linked to | |------|-----------| | GPO1 | OU1 | | GPO2 | OU2 | You configure the Group Policy Preferences shown in the following table. | GPO | Setting | |------|---------| | GPO1 | Computer Configuration: Add a shortcut named Link1 to the desktop<br>User Configuration: Add a shortcut named Link2 to the desktop | | GPO2 | Computer Configuration: Add a shortcut named Link3 to the desktop<br>User Configuration: Add a shortcut named Link4 to the desktop | For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Explanation

Statement 1 (No): The configuration of the Group Policy Preferences does not automatically apply to all users or computers without explicit linking to an Active Directory container. Statement 2 (Yes): If a GPO is linked at the domain level and applies to all users, it will indeed affect every user in that domain unless blocked or overridden by another GPO with higher precedence. Statement 3 (No): Group Policy Preferences do not enforce settings without being correctly configured and linked; they are merely preferences and can be overridden by local policies or other GPOs.

Question 5

You create a new Azure subscription. You plan to deploy Azure Active Directory Domain Services (Azure AD DS) and Azure virtual machines. You need to ensure that the virtual machines can join to Azure AD DS. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Explanation

First, a Virtual Network must be created as Azure AD DS requires a pre-existing VNet for deployment. Next, creating an Azure AD DS instance involves selecting this VNet during setup. Finally, modifying the DNS settings within the VNet ensures that virtual machines can join the Azure AD DS domain.

Question 6

You have an Azure Active Directory Domain Services (Azure AD DS) domain. You create a new user named Admin1. You need Admin1 to deploy custom Group Policy settings to all the computers in the domain. The solution must use the principle of least privilege. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point Hot Area:

Explanation

Add Admin1 to the following group: AAD DC Administrators — In an Azure AD DS managed domain, Microsoft owns and operates the domain controllers, so no tenant account can ever join the true Domain Admins or Enterprise Admins roles; AAD DC Administrators is the delegated administrative group Azure AD DS provides, and it grants exactly the rights needed to manage the two built-in GPOs and the AADDC organizational units. Domain Admins and Group Policy Creator Owners are not available for membership changes in a managed domain, so neither can be used to delegate this task. Instruct Admin1 to apply the custom Group Policy settings by: Modifying AADDC Computers GPO — Azure AD DS pre-creates the AADDC Computers and AADDC Users GPOs linked to the corresponding OUs, and every domain-joined machine is placed in the AADDC Computers OU, so editing that GPO applies the custom settings to all computers in the domain and is the least-privileged option available to a member of AAD DC Administrators. Creating a new GPO and linking it to the domain root is not possible because AAD DC Administrators lacks link and create rights at the domain level, and the Default Domain Policy is managed by the service and cannot be modified by tenant administrators.

Question 7

Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site. You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1. You need to recommend a deployment plan that meets the following requirements: ✑ Ensures that a user named User1 can perform the RODC installation on Server1 ✑ Ensures that you can control the AD DS replication schedule to the Server1 ✑ Ensures that Server1 is in a new site named RemoteSite1 Uses the principle of least privilege Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Explanation

Creating a new site and subnet first ensures that Server1 is correctly located within the network topology. Pre-creating the RODC account allows for configuring replication policies and permissions securely before installation, adhering to least privilege principles. Finally, instructing User1 to run AD DS completes the deployment while ensuring they have the necessary local administrative rights.

Question 8

Your network contains an Active Directory Domain Services (AD DS) domain. The network also contains 20 domain controllers, 100 member servers, and 100 client computers. You have a Group Policy Object (GPO) named GPO1 that contains Group Policy preferences. You plan to link GPO1 to the domain. You need to ensure that the preference in GPO1 apply only to domain member servers and NOT to domain controllers or client computers. All the other Group Policy settings in GPO1 must apply to all the computers. The solution must minimize administrative effort. Which type of item level targeting should you use? Options: A. Domain B. Operating System C. Security Group D. Environment Variable
  • A. Domain
  • B. Operating System
  • C. Security Group Correct
  • D. Environment Variable

Explanation

Using a Security Group for item-level targeting allows you to specifically include only domain member servers in GPO1 preferences, excluding domain controllers and client computers. This approach minimizes administrative effort by leveraging existing or newly created security groups.

Question 9

You deploy a new Active Directory Domain Services (AD DS) forest named contoso.com. The domain contains three domain controllers named DC1, DC2, and DC3. You rename Default-First-Site-Name as Site1. You plan to ship DC1, DC2, and DC3 to datacenters in different locations. You need to configure replication between DC1, DC2, and DC3 to meet the following requirements: ✑ Each domain controller must reside in its own Active Directory site. ✑ The replication schedule between each site must be controlled independently. ✑ Interruptions to replication must be minimized. Which three actions should you perform in sequence in the Active Directory Sites and Services console? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Explanation

Creating separate sites for each domain controller allows independent control over replication schedules. Adding a new site link between specific sites ensures controlled inter-site replication, while removing one of the sites from the default site link prevents unintended replication paths and minimizes interruptions.

Question 10

Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The root domain contains the domain controllers shown in the following table. | Name | FSMO role | |---|---| | DC1 | Domain naming master | | DC2 | RID master | | DC3 | PDC emulator | | DC4 | Schema master | | DC5 | Infrastructure master | A failure of which domain controller will prevent you from creating application partitions? Options: A. DC1 B. DC2 C. DC3 D. DC4 E. DC5
  • A. DC1
  • B. DC2
  • C. DC3
  • D. DC4 Correct
  • E. DC5

Explanation

The Schema master FSMO role holder is responsible for managing changes to the schema, including creating application partitions. Failure of DC4, which holds this role, would prevent the creation of new application partitions.

Question 11

Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the objects shown in the following table. | Name | Type | |---|---| | User1 | User | | Group1 | Universal security group | | Group2 | Domain local security group | | Computer1 | Computer | You plan to sync contoso.com with an Azure Active Directory (Azure AD) tenant by using Azure AD Connect. You need to ensure that all the objects can be used in Conditional Access policies. What should you do? Options: A. Select the Configure Hybrid Azure AD join option. B. Change the scope of Group1 and Group2 to Global. C. Clear the Configure device writeback option. D. Change the scope of Group2 to Universal.
  • A. Select the Configure Hybrid Azure AD join option. Correct
  • B. Change the scope of Group1 and Group2 to Global.
  • C. Clear the Configure device writeback option.
  • D. Change the scope of Group2 to Universal.

Explanation

Selecting the Configure Hybrid Azure AD join option allows on-premises computer accounts to register with Azure AD, enabling their use in Conditional Access policies. This ensures that all objects can be utilized within Azure AD's Conditional Access framework.

Question 12

Your network contains a multi-site Active Directory Domain Services (AD DS) forest. Each Active Directory site is connected by using manually configured site links and automatically generated connections. You need to minimize the convergence time for changes to Active Directory. What should you do? Options: A. For each site link, modify the replication schedule. B. For each site links, modify the site link costs. C. Create a site link bridge that contains all the site links. D. For each site link, modify the options attribute.
  • A. For each site link, modify the replication schedule.
  • B. For each site links, modify the site link costs.
  • C. Create a site link bridge that contains all the site links.
  • D. For each site link, modify the options attribute. Correct

Explanation

Modifying the options attribute for each site link to enable change notification allows domain controllers to immediately notify each other of changes, thereby minimizing convergence time.

Question 13

You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com. You deploy five servers to the domain. You add the servers to a group named ITFarmHosts. You plan to configure a Network Load Balancing (NLB) cluster named NLBCluster.contoso.com that will contain the five servers. You need to ensure that the NLB service on the nodes of the cluster can use a group managed service account (gMSA) to authenticate. Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

Explanation

The Add-KdsRootKey cmdlet is required to create the root key for Key Distribution Service, which is necessary before creating a group managed service account (gMSA). The New-ADServiceAccount cmdlet creates the gMSA in Active Directory. Finally, Install-ADServiceAccount caches and tests the gMSA on each server node.

Question 14

You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. You have several Windows 10 devices that are Azure AD hybrid-joined. You need to ensure that when users sign in to the devices, they can use Windows Hello for Business. Which optional feature should you select in Azure AD Connect? Options: A. Device writeback B. Group writebeack C. Azure AD app and attribute filtering D. Password writeback E. Directory extension attribute sync
  • A. Device writeback Correct
  • B. Group writebeack
  • C. Azure AD app and attribute filtering
  • D. Password writeback
  • E. Directory extension attribute sync

Explanation

Device writeback is necessary for Windows Hello for Business to function correctly on Azure AD hybrid-joined devices. This feature ensures that the on-premises Active Directory Domain Services (AD DS) domain receives information about device registration states from Azure AD, which is essential for Windows Hello for Business.

Question 15

Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a child domain named east.contoso.com. In the contoso.com domain, you create two users named Admin1 and Admin2. You need to ensure that the users can perform the following tasks: ✑ Admin1 can create and manage Active Directory sites. ✑ Admin2 can deploy domain controllers to the east.contoso.com domain. The solution must use the principle of least privilege. To which group should you add each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

Explanation

Admin1: Contoso\Domain Admins — Active Directory sites, subnets, and site links live in the Configuration naming context, which is mastered in the forest root domain (contoso.com), and the root domain's Domain Admins hold the rights over that partition needed to create and manage the site topology. Contoso\Enterprise Admins would also work but violates least privilege, since it grants full control over every domain in the forest; the East groups have no authority over the forest-wide Configuration partition. Admin2: East\Domain Admins — promoting an additional domain controller into an existing domain requires membership in the Domain Admins group of that specific domain, so Admin2 needs Domain Admins in east.contoso.com and nothing broader. Contoso\Enterprise Admins would permit the promotion as well but hands Admin2 forest-wide control, and East\Administrators (the domain's built-in group) is not the membership domain controller promotion validates when adding a DC to an existing domain.

Question 16

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK. You open a new branch office that contains only client computers. You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1. Solution: You create an organization unit (OU) that contains the client computers in the branch office. You configure the Try Next Closest Site Group Policy Object (GPO) setting in a GPO that is linked to the new OU. Does this meet the goal? Options: A. Yes B. No
  • A. Yes
  • B. No Correct

Explanation

The solution does not meet the goal because the new branch office computers are not part of any Active Directory site and thus cannot benefit from the 'Try Next Closest Site' setting without being assigned to a specific AD site. Additionally, with only one default site link, there is no defined cost for determining the next closest site.

Question 17

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK. You open a new branch office that contains only client computers. You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1. Solution: You create a new site named Site4 and associate Site4 to DEFAULTSITELINK. Does this meet the goal? Options: A. Yes B. No
  • A. Yes
  • B. No Correct

Explanation

Creating a new site named Site4 and associating it to DEFAULTIPSITELINK does not ensure that client computers in the new office are primarily authenticated by domain controllers in Site1. A new site link with lower cost between Site4 and Site1 must be created to prioritize authentication from Site1.

Question 18

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK. You open a new branch office that contains only client computers. You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1. Solution: You configure the Try Next Closest Site Group Policy Object (GPO) setting in a GPO that is linked to Site1. Does this meet the goal? Options: A. Yes B. No
  • A. Yes
  • B. No Correct

Explanation

Configuring the Try Next Closest Site GPO setting in a GPO linked to Site1 does not ensure primary authentication by domain controllers in Site1 for clients in a new branch office. This setting only affects client behavior when it fails to locate a DC within its own site, and since all sites are connected via DEFAULTIPSITELINK with equal cost, there is no mechanism to prioritize Site1 for authentication.

Question 19

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. You need to identify which server is the PDC emulator for the domain. Solution: From Active Directory Sites and Services, you right-click Default-First-Site-Name in the console tree, and then select Properties. Does this meet the goal? Options: A. Yes B. No
  • A. Yes
  • B. No Correct

Explanation

The provided solution does not meet the goal because it describes navigating to Active Directory Sites and Services and viewing properties of Default-First-Site-Name, which does not identify the PDC emulator. To correctly identify the PDC emulator, one should use 'Active Directory Users and Computers' and navigate through domain operations masters.

Question 20

Your network contains a single-domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the servers shown in the following exhibit table. You plan to install a line-of-business (LOB) application on Server1. The application will install a custom Windows service. A new corporate security policy states that all custom Windows services must run under the context of a group managed service account (gMSA). You deploy a root key. You need to create, configure, and install the gMSA that will be used by the new application. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point Options: A. On Server1, run the setspn command. B. On DC1, run the New-ADServiceAccount cmdlet. C. On Server1, run the Install-ADServiceAccount cmdlet. D. On Server1, run the Get-ADServiceAccount cmdlet. E. On DC1, run the Set-ADComputer cmdlet. F. On DC1, run the Install-ADServiceAccount cmdlet. | Name | Description | |---|---| | DC1 | Domain controller | | Server1 | Member server |
  • A. On Server1, run the setspn command.
  • B. On DC1, run the New-ADServiceAccount cmdlet. Correct
  • C. On Server1, run the Install-ADServiceAccount cmdlet. Correct
  • D. On Server1, run the Get-ADServiceAccount cmdlet.
  • E. On DC1, run the Set-ADComputer cmdlet.
  • F. On DC1, run the Install-ADServiceAccount cmdlet.

Explanation

To create a group managed service account (gMSA), the New-ADServiceAccount cmdlet must be run on DC1. To install and configure this gMSA on Server1 where the LOB application will reside, the Install-ADServiceAccount cmdlet should be executed.

Verifying access...