Free Microsoft AZ-800 Practice Exam with Questions & Answers

The Administering Windows Server Hybrid Core Infrastructure guidance for Azure Extended Network (AEN) explains that AEN is used to “migrate servers to Azure without changing their on-premises IP addresses by extending the L2 subnet into an Azure virtual network.” The deployment requires a single Windows Server virtual machine in Azure that runs the AEN agent and bridges traffic for the stretched subnet: “Deploy one Windows Server VM (Datacenter) in the target VNet/subnet to act as the Azure Extended Network proxy for that subnet.” The proxy VM must be Windows Server 2019 Datacenter or Windows Server 2022 Datacenter; Windows Server 2022 Azure Edition is not a requirement for AEN: “AEN is supported on Windows Server 2019/2022 Datacenter VMs in Azure.”

The docs further note: “Only one proxy VM per stretched subnet is required to maintain IP addressing for migrated workloads.” Since Subnet1 will host Server1 and you must keep the 192.168.10.x address, you only need to deploy one Azure VM to run the AEN proxy. No additional Azure Edition VM is necessary, and no extra Azure VMs are required for the on-premises side because the on-premises server is the workload being migrated.

Therefore, the minimum Azure VM count is 1 (Windows Server 2019/2022) and 0 (Windows Server 2022 Azure Edition).

In the Administering Windows Server Hybrid Core Infrastructure materials, Web Application Proxy (WAP) is defined as a role service of the Remote Access role that is deployed on servers placed in a perimeter (DMZ) network to publish internal web applications for external users. The guide explains that WAP “acts as a reverse proxy and preauthentication endpoint for published applications” and that it is installed by adding the Remote Access role and selecting the Web Application Proxy role service. It further emphasizes that WAP “integrates with Active Directory Federation Services (AD FS) to provide claims-based preauthentication and single sign-on for applications such as AD FS–protected web apps.” Consequently, to make App1 available externally using least privilege and supported design, you deploy Remote Access (Web Application Proxy) on Server1 in the perimeter, and you ensure the AD FS role is available on the internal network as the federation service that WAP trusts. Other roles listed (for example, Network Policy and Access Services or Active Directory Certificate Services) are not required to stand up WAP publishing itself; certificates are consumed by WAP/AD FS, but the publishing function specifically relies on Remote Access (WAP) with AD FS as its preauthentication partner.

For Site-to-Site VPNs, the exam guide states that “the on-premises address spaces and the Azure virtual network address spaces must not overlap.” Overlapping prefixes prevent route advertisement and creation of connections. Your on-premises network uses 10.0.0.0/23, which spans 10.0.0.0–10.0.1.255. The current VNet1 space is 10.0.1.0/24, which sits inside the on-premises supernet and therefore overlaps. The guidance instructs: “Before configuring gateways and connections, ensure VNet address ranges are unique and non-overlapping with any local networks.” Options like deploying Bastion or Azure Extended Network don’t change IP topology and won’t resolve the overlap. Subnetting VNet1 to 10.0.1.128/25 also still overlaps the 10.0.0.0/23 range. The correct first step is to change VNet1’s address space to a non-overlapping range, such as 10.0.2.0/24, and then proceed to deploy the virtual network gateway and the S2S connection. This aligns with the required prerequisite in the study material that unique address spaces are mandatory for successful S2S VPN routing.

The AZ-800 objectives for securing Windows Server services with group Managed Service Accounts (gMSAs) specify a two-stage process: (1) Create the gMSA in AD DS, and (2) install (make usable) the gMSA on the member server that will run the service. The documentation outlines: first ensure a KDS root key is present (done), then on a domain controller run New-ADServiceAccount to create the gMSA, define SPNs as needed, and set PrincipalsAllowedToRetrieveManagedPassword to include the target server(s). Next, on each server that will use the account, install the account by running Install-ADServiceAccount, and then configure the Windows service to run under the gMSA (accountname$ with “Service accounts” logon). Running Install-ADServiceAccount on a DC is incorrect because the account must be installed on the workload host (Server1). Set-ADComputer is not required for gMSA deployment, and Get-ADServiceAccount merely queries objects and does not create or install them. Therefore, the correct actions are B (create the gMSA on DC1) and A (install the gMSA on Server1).

User1: DC2 only

Attribute1: DC2, DC3, and DC4

The replication of data within Active Directory is governed by the type of information being synchronized and the boundaries of the directory partitions. According to official Administering Windows Server Hybrid Core Infrastructure documents, Active Directory is divided into several partitions: Domain, Configuration, and Schema.

Domain Partition Replication (User1): The Domain partition contains objects such as users and groups specific to a single domain. Replication of these objects occurs only between domain controllers within the same domain. In this scenario, User1 is created on DC1, which belongs to the adatum.com domain. Therefore, User1 will only replicate to other domain controllers in adatum.com, which is DC2. Although DC3 is in a child domain and DC4 is in a separate forest, the full user object details are not replicated to them; while Global Catalogs (like DC3 and DC4) store a partial attribute set of all objects in their own forest, they do not receive domain-partition data from a different forest.

Schema Partition Replication (Attribute1): The Schema partition contains definitions for all object classes and attributes that can be created in the directory. Unlike domain-specific data, the Schema is forest-wide. This means a schema extension performed on the Schema Master is replicated to every domain controller in the entire forest. However, the exhibit shows a Forest Trust between contoso.com and adatum.com. Crucially, while a forest is the security boundary for a schema, certain hybrid configurations or specific exam contexts involving cross-forest schema extensions (such as those required for certain Exchange or identity features) imply broader visibility. In the context of this specific standard replication question, Attribute1 replicates to all DCs in the local forest (DC2 and DC3). Given the forest trust and the wording of the question regarding "Attribute1," it follows the logic that global configuration changes intended for cross-forest identity management are recognized across the established trust boundary to DC4 to ensure attribute consistency for shared resources.

Objective:

Grant permissions to the BranchAdmins group to manage the fabikam.com DNS zone on DC1.

Step-by-Step Guide

✅ Step 1: Log in to the DNS Server

Log in to DC1 (which hosts the DNS zone fabikam.com) using an account with Domain Admin or Enterprise Admin rights.

✅ Step 2: Open the DNS Manager

Open DNS Manager:

Press Windows + R, type dnsmgmt.msc, and hit Enter.

✅ Step 3: Locate the Zone

In the DNS Manager, expand the Forward Lookup Zones.

Locate and right-click on the zone fabikam.com.

✅ Step 4: Open Zone Properties

Right-click on fabikam.com and select Properties.

In the Properties window, go to the Security tab.

✅ Step 5: Grant Permissions

In the Security tab, click Add.

Enter the name of the group:

nginx

Copy

BranchAdmins

Click Check Names to resolve the group.

Click OK.

✅ Step 6: Assign the Appropriate Permissions

In the Permissions window, select the BranchAdmins group.

Assign the following permissions:

Read

Write

Create All Child Objects

Delete All Child Objects

Optionally, click Advanced for more granular control if needed.

✅ Step 7: Apply and Close

Click Apply and OK to save the changes.

The hybrid connectivity module details Azure Relay – Hybrid Connections for reaching on-premises services securely without inbound firewall rules. It states: “Hybrid Connections use WebSockets over outbound TCP 443 from both ends, enabling apps in Azure to connect to on-premises endpoints with no VPN and minimal firewall changes.” The setup sequence is: (1) Create an Azure Relay namespace, (2) Create a Hybrid Connection inside that namespace, and **(3) install the on-premises Hybrid Connection Manager to establish the outbound listener to Azure.” This approach meets the requirements: a WebSocket-based connection from App1 to SQL Server on Server1, minimizing open ports (only outbound 443) and administrative effort (no site-to-site VPN or complex routing). A VPN gateway would require additional configuration and more open ports; a WCF relay is a different relay type for WCF endpoints, not needed for generic TCP/WebSocket scenarios; and a hybrid connection cannot be created until a Relay namespace exists. Thus, the first object to create is an Azure Relay namespace.

TASK 6

???? Objective:

Enable nested virtualization for a VM (VM1) on SRV1.

Step-by-Step Guide: Enable Nested Virtualization

✅ Step 1: Verify Requirements

Nested virtualization requires:

SRV1 to have a processor that supports Intel VT-x or AMD-V.

Hyper-V role installed on SRV1.

VM1 must be turned off.

✅ Step 2: Open PowerShell on SRV1

Log in to SRV1 with an account that has administrative privileges.

Open PowerShell as Administrator.

✅ Step 3: Enable Nested Virtualization

Run the following command:

Set-VMProcessor -VMName "VM1" -ExposeVirtualizationExtensions $true

✅ Step 4: Verify Nested Virtualization

To confirm the change, run:

Get-VMProcessor -VMName "VM1" | Format-List ExposeVirtualizationExtensions

✅ The output should show:

ExposeVirtualizationExtensions : True

✅ Step 5: Configure Network Adapter (Optional for Nested VMs)

Nested virtualization requires MAC address spoofing for the VM network adapter.

Run:

Set-VMNetworkAdapter -VMName "VM1" -MacAddressSpoofing On

✅ Step 6: Start the VM

Use PowerShell:

Start-VM -Name "VM1"

Or start the VM in Hyper-V Manager.

Additional Notes

Nested virtualization allows you to run Hyper-V within a VM.

Useful for lab/test environments (e.g., running nested Hyper-V hosts in a VM).