Free Microsoft AZ-800 Practice Exam with Questions & Answers | Set: 3

The Administering Windows Server Hybrid Core Infrastructure materials explain that Azure AD Password Protection for on-premises AD uses two components : the DC agent and the proxy service . The DC agent is installed on every domain controller because it “ intercepts password set/change operations locally on the DC and evaluates them against the forbidden-password policy .” The guidance further states that to ensure consistent enforcement “ the DC agent should be deployed to all DCs in the forest, since password changes may occur on any DC .” The proxy service is installed on member servers (not necessarily DCs) and “ relays policy downloads and telemetry to Azure AD on behalf of DCs ,” which satisfies envi ronments where “ domain controllers must not directly contact Internet endpoints .” Finally, configuration of the global and custom banned password lists is performed in Azure AD , where administrators “ define tenant-wide custom banned terms; DCs obtain the p olicy via the proxy and cache it for local enforcement .”

Given Fabrikam’s requirement to prevent DCs from accessing the Internet, the proxy must run on non-DC servers ( VM1 and VM2 ). To guarantee enforcement wherever a password is changed, the DC agent must be on all domain controllers . The custom banned password list is configured in the Azure AD tenant and then distributed to on-premises DCs via the proxy.

The exam materials for Administering Windows Server Hybrid Core Infrastructure explain that when replacing private WAN links with Azure, Azure Virtual WAN (vWAN) can be used to centralize connectivity. For private connectivity, ExpressRoute integrates directly with a vWAN hub by deploying an ExpressRoute gateway in the hub. The gateway is the Azure resource that terminates ExpressRoute and enables hub-and-spoke routing to connected VNets (such as Vnet1 ). The guides emphasize: “ In a Virtual WAN hub, use the ExpressRoute gateway to connect ExpressRoute circuits and propagate routes acro ss the hub to your virtual networks .”

On-premises, each site (New York and Seattle) requires an ExpressRoute circuit connection provisioned via a connectivity provider. The circuit is the dedicated private connection from the customer edge to Microsoft’s edge and is what the office sites actually use; it’s then linked to the vWAN hub’s ExpressRoute gateway. The same materials note that Site-to-Site VPN is an alternative transport but is not required when ExpressRoute is mandated. Likewise, Application Gateway is a Layer-7 load balancer for HTTP/S traffic, and on-premises data gateway relates to Power BI/Power Platform hybrid connectivity, neither of which establishes network transport between offices and Azure.

Therefore, to meet the requirement “connect both on-premises offices to Vnet1 by using ExpressRoute,” configure an ExpressRoute gateway on the vWAN hub and ExpressRoute circuit connections in the offices.

In the Administering Windows Server Hybrid Core Infrastructure materials (hybrid security and IaaS management), Just-In-Time (JIT) VM access from Microsoft Defender for Cloud is the prescribed way to require approval-based, time-bound Remote Desktop access to Azure VMs. The guide explains that JIT “locks down inbound traffic to management ports (for example, TCP/3389) and opens them only on request, for a limited time and only from approved source IPs.” Administrators request access; upon approval, Defender for Cloud creates a temporary NSG rule that expires automatically—you specify the maximum allowed window (e.g., 2 hours) and the ports. This matches the requirement: “Ensure that server administ rators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours.” Alternatives don’t meet this: PIM governs Azure roles, not VM RDP port exposure; Azure Bastion provides secure RDP/SSH over TLS without public IPs but doesn’t provide approval/time-boxed gating; the Remote Desktop extension is for classic Cloud Services and not for policy-driven approval windows. JIT is the least-privilege, policy-enforced solution aligned with the exam’s hybrid security objectives.

In Administering Windows Server Hybrid Core Infrastructure , Microsoft states that high availability for DHCP on Windows Server is achieved by using DHCP failover rather than the legacy split-scope (80/20) model. The guidan ce explains that DHCP failover “ synchronizes lease data between two DHCP servers and can be configured in Load Balance or Hot Standby mode on a per-scope basis,” and that you enable it on each DHCP scope to create a partner relationship that automatically replicates scope configuration and active leases. This meets the requirement to keep address assignment available if one DHCP server is down.

The same materials further note that DHCP broadcasts do not traverse routers; therefore, when the partner server i s reachable across a routed boundary (another site/subnet) , you must configure the router as a DHCP relay (IP helper) to forward DHCPDISCOVER messages to the remote DHCP server(s). The text emphasizes: “When clients and DHCP servers are on different subnet s, configure a relay agent on the router to forward requests to the DHCP server IP addresses.”

Applying this to Fabrikam: create DHCP failover between DHCP1 (Scope1) and DHCP2 (Scope2) ( E ) and configure the routers in New York and Seattle as DHCP relays th at forward to both DHCP servers ( B ). You do not use Failover Clustering for DHCP here, and you do not create extra 25% scopes; those are split-scope practices superseded by DHCP failover.

In Azure File Sync architecture (covered in Admin istering Windows Server Hybrid Core Infrastructure under “Implement and manage storage solutions”), the fundamental design points are:

Sync group – “A sync group defines a sync topology. Each sync group contains exactly one cloud endpoint (an Azure file sh are) and one or more server endpoints.” A server endpoint is a folder on a registered Windows Server. A server can participate in multiple sync groups so long as the server endpoints are different paths.

Storage Sync Service – “The Storage Sync Service is the top-level resource that maintains server registrations and houses your sync groups.” A Windows Server registers to one Storage Sync Service at a time, and that service can contain many sync groups and many servers.

Applying these rules to the requirement:

You have three Azure file shares: newyorkfiles, seattlefiles, and companyfiles. Because each sync group maps to one cloud endpoint, you need one sync group per share ⇒ 3 sync groups.

FS1 must sync with newyorkfiles and companyfiles; FS2 must sync with seattlefiles and companyfiles. Since one Storage Sync Service can host multiple sync groups and multiple servers, and a server must be registered to a single service, the most efficient design is a single Storage Sync Service containing all three sync groups and both servers.

In the Administering Windows Server Hybrid Core Infrastructure materials (AZ-800), Microsoft explains that Group Managed Service Accounts (gMSAs) are designed for services running on multi ple servers and “provide automatic password management, simplified SPN management, and the ability to delegate the management to other administrators.” The guidance further states that before you can create any gMSA, “the domain must have a KDS root key so that the Key Distribution Service can generate and rotate strong, unique passwords for gMSAs on a schedule.” After the KDS root key is created, “use New-ADServiceAccount to create the gMSA and grant the computers (e.g., web servers) permission to retrieve the account password.” For IIS, the course notes specify that a gMSA can be used for app pools: “Configure the IIS application pool identity to a custom account and specify the gMSA name (ending with ‘$’) without a password; the password is managed automa tically by AD and rotates by policy (for example, every 30 days).”

Mapping these requirements to the scenario: Webapp1 runs on WEB1 and WEB2 and must use the same service account with an automatic 30-day password change . Therefore, the correct sequence is: create the KDS root key , create the gMSA , and then set the IIS application pool to run under that account. This fulfills the security requirement while allowing both web servers to share the same, automatically-rotated credentials.

The exam materials explain that to add a new domain controller to an existing AD DS forest in Azure, you deploy a Windows Server IaaS VM and then promote it: “To extend on-premises AD DS into Azure, provision a Windows Server VM in Azure and run AD DS to create an additional domain controll er for the existing domain.” Conversely, Azure Active Directory Domain Services (Azure AD DS) provides a managed domain that is separate from and not writable by your on-premises administrators —you “do not get domain admin rights or access to DCs” —so it cannot be used to add a DC (dc3.corp.fabrikam.com) to the existing corp.fabrikam.com forest. Azure AD Application Proxy and Azure AD administrative units are unrelated to deploying DCs. Therefore, the correct implementation is to deploy an Azure virtual machine in Vnet1, install AD DS/DNS, and promote it to become DC3 in the existing domain.

In the Administering Windows Server Hybrid Core Infrastructure guidance for Windows Admin Center (WAC) and Kerberos delegation, resource-based constrained delegation (RBCD) is configur ed on the resource’s computer account , not on the client/gateway. The documentation explains that “resource-based constrained delegation is applied to the target service account; the target’s msDS-AllowedToActOnBehalfOfOtherIdentity attribute contains the security principals (computers or service accounts) that are permitted to act on behalf of users.” It further clarifies that “this model supports cross-domain and cross-forest scenarios when a trust exists; you specify the front-end computer (for example, a WAC gateway) from the trusted forest as an allowed principal on the resource computer in its own domain.”

For WAC, the gateway (Server1 in contoso.com ) must be allowed to delegate to the managed node (Server2 in fabrikam.com ). The study materials show th e exact PowerShell interface: “Use Set-ADComputer with -PrincipalsAllowedToDelegateToAccount to populate the resource’s allowed-to-act list.” Therefore, the Identity parameter must reference the resource computer account (Server2 in fabrikam.com), and the PrincipalsAllowedToDelegateToAccount parameter must reference the gateway computer account (Server1 in contoso.com).

Hence the correct command is:

Set-ADComputer -Identity (Get-ADComputer server2.fabrikam.com) -PrincipalsAllowedToDelegateToAccount (Get-ADC omputer server1.contoso.com)

In the Administering Windows Server Hybrid Core In frastructure materials for managing identity and AD DS, the guidance for creating group Managed Service Accounts (gMSAs) states that you use the New-ADServiceAccount cmdlet to create the account object and define both its service DNS identity and which pri ncipals are permitted to use it. The document explains:

“Use New-ADServiceAccount to create a group managed service account . Specify the service name with -DNSHostName for SPN/DNS association. To control which computers or groups are allowed to run services under the gMSA, provide those principals with -PrincipalsAllowedToRetrieveManagedPassword . These security principals are then authorized to retrieve the managed password and use the account on the member servers.”

And further:

“The -PrincipalsAllowedToRetrieveManagedPassword parameter accepts computer accounts or security groups . Adding a group simplifies delegation—any computer that is a member of that group can use the gMSA without further modification.”

Applying this to the scenar io, to create Account1 and ensure the domain group Group1 can use it, the correct script is:

New-ADServiceAccount " Account1 " -DNSHostName " website.contoso.com " -PrincipalsAllowedToRetrieveManagedPassword " Group1 "

This satisfies the requirement by creating the gMSA and explicitly granting Group1 the right to retrieve and use the managed password on allowed hosts.