Free Microsoft AZ-800 Practice Exam with Questions & Answers | Set: 4

In the Windows Server DNS guidance within Administering Windows Server Hybrid Core Infrastructure , an Active Directory–integrated zone stores its data in AD DS and replicates based on the replication scope selected in the zone’s properties. The option “All DNS servers in this domain” replicates the zone to the DomainDNSZones application partition of that domain, which is held only on domain controllers that run the DNS Server role in the same domain. The materials emphasize two key points: (1) AD-integrated zones can be hosted only on DNS servers t hat are also domain controllers , and (2) replication scope set to “this domain” does not cross to other domains or child domains .

Given the server list: Server1 and Server2 are DCs with DNS in contoso.com; Server3 is DNS-only (not a DC) in contoso.com; Server4/Server5 are in east.contoso.com (a different domain). Therefore, with the scope set to All DNS servers in this domain, replication targets only the other DNS-enabled DCs in contoso.com. Since you created the zone on Server1, it will replicate to Server2 only; Server3 cannot host AD-integrated zones, and Server4/Server5 are in a different domain and are not in scope.

In the Windows Server hybrid curriculum for AZ-800, running Windows containers on a Windows Server host requires enabling the Containers feature and installing a container runtime , specifically the Docker (Moby) engine . The guide explains that Windows Server supp orts two isolation modes— process and Hyper-V isolation —but in both cases you still need a Docker-compatible runtime to pull images, create, and manage containers. The materials emphasize: container functionality isn’t provided by Windows Admin Center or WS L; Admin Center is only a management tool and WSL targets Linux user-space scenarios, not Windows container runtime services. Likewise, the Hyper-V role is optional and only needed if you choose Hyper-V isolation for containers; it is not, by itself, sufficient to run containers. Therefore, the required installation to “configure Server1 to run containers” is the Docker engine (often referred to in Microsoft’s docs as Docker/Moby), after which you can pull Windows base images and run Windows containers on the host. This aligns with the prescribed steps: enable Containers feature → install Docker → configure isolation as needed → deploy containerized apps.

ProcessA : All the containers and Server1

ProcessB : Container3 and Server1 only

Comprehensive and Detailed Explanation with all Administering Windows Server Hybrid Core Infrastructure documents : =

Understand ing the visibility of processes within Windows Server containers depends entirely on the isolation mode used: Windows Server isolation (Process isolation) or Hyper-V isolation . According to official documents for Administering Windows Server Hybrid Core In frastructure, these two modes determine how the container ' s kernel and processes interact with the host system.

Windows Server Isolation (Process Isolation) : In this mode, containers share the same kernel as the host. Processes running inside the container are essentially standard processes on the host, albeit isolated through namespaces and resource controls. Consequently, a process running in a process-isolated container (like Container1 and Container2 in the exhibit) is visible from the host ' s Task Manag er or Get-Process command, as well as from other containers sharing the same host kernel. Therefore, ProcessA can be verified as running from All the containers and Server1 .

Hyper-V Isolation : This mode provides a more secure and isolated environment by ru nning each container inside its own highly optimized virtual machine (utility VM). Because each container has its own private kernel, the host cannot " see " the internal processes of the container, and containers cannot see into each other. Container3 uses Hyper-V isolation. Therefore, ProcessC is only visible to the internal operating system of Container3 and, at a management level, to Server1 (the host). It is invisible to other containers (Container1, 2, and 4) because they are separated by kernel-level boundaries. Thus, you can verify ProcessC on Container3 and Server1 only .

In the Administering Windows Server Hybrid Core Infrastructure content for identity synchronization and password management, Microsoft specifies that self-servic e password reset (SSPR) for hybrid users requires password writeback through Azure AD Connect . The materials state: “ Password writeback enables Azure AD to write password changes made in the cloud back to your on-premises Active Directory. This feature is required to allow users who reset their passwords using SSPR to use those new passwords when authenticating to on-premises resources. ” The configuration steps emphasize: “ Run the Azure AD Connect wizard and enable Password writeback. ” By contrast, the Azur e AD Password Protection proxy pertains to banned password enforcement and does not perform writeback, and granting extra rights to the sync account does not replace enabling the writeback capability in the connector. Therefore, enabling Password writeback in Azure AD Connect is the correct and required action to ensure SSPR changes are reflected in the on-premises AD DS domain.

In the AZ-800/“Administering Windows Server Hybrid Core Infrastructure” content, Azure AD Connect cloud sync uses a lightweight provisioning agent that reads from on-premises AD DS. The agent runs under a Group Managed Service Account (gMSA) so it can securely obtain and rotate credentials automatically. The implementation guidance states that during agent installation you provide domain admin credentials once so the installer can create and delegate a gMSA for the agent; alternatively, you can pre-create the gMSA and assign it. The documentation emphasizes that cloud sync does not rely on user or computer accounts with static passwords; instead it “deploys a gMSA for the agent service to ensure secure, automatic password management and least-privilege directory access.” System-assigned managed identities apply to Azure resources only (not on-prem AD DS), and InetOrgPerson is an object class for users, not a service identity. A regular user account would introduce password management and rotation issues and is not the recommended nor required identity type for the cloud sync agent. Therefore, to satisfy Azure AD Connect cloud sync prerequisites, you create and use a gMSA.

The Windows Server Hybrid Core Infrastructure materials explain that Windows Hello for Business (WHfB) in a hybrid environment relies on Azure AD registration and corresponding device objects in on-premises AD DS. Azure AD Connect provides the Device writeback optional feature, which “writes Azure AD device objects back to AD DS as msDS-Device objects so on-premises domain controllers and policies can recognize and evaluate the device during authentication.” The guide further notes that for hybrid-joined Windows 10/11 devices, enabling Device writeback “allows on-premises authentication stacks and Conditional Access decisions to use the registered device and its key material (key trust or certificate trust), enabling WHfB sign-in on domain-joined devices.” Other options do not meet the requirement: Password writeback is used for self-service password reset, Group writeback returns Microsoft 365 groups to AD DS, and Directory extension attribute sync simply synchronizes custom attributes. Therefore, to ensure users can sign in with Windows Hello for Business on Azure AD hybrid-joined devices, select Device writeback in Azure AD Connect.

The hybrid identity guidance for Windows Server and Azure emphasizes using Azure AD (Microsoft Entra ID) security groups for unified authorization across Azure Files (Azure Storage with Azure AD-based access control) and on-premises SMB shares—when Group writeback is enabled in Azure AD Connect. The documented pattern is: create the group in Azure AD with assigned membership so you can grant Azure roles/share permissions to storage2\share2 using Azure AD identities. Because Group writeback is enabled, that Azure AD security group is written back to on-premises AD DS as a universal security group, allowing you to use the same group on NTFS/share permissions for Server1\Share1. Members can be synchronized AD DS users; adding them in Azure AD (assigned membership) ensures predictable inclusion for both resources.

Creating the group only in AD DS (Option A) can sync to Azure, but the hybrid guidance highlights Azure-originated groups with writeback when you want one source to drive both cloud and on-prem authorization and to ensure compatibility with Azure Files’ Azure AD-based access checks. Dynamic membership (Option C) is unnecessary here and may not align with file access scenarios. Microsoft 365 groups (Option D) are not intended for file share ACLs/RBAC in this context. Thus, the verified solution is to create an Azure AD security group with assigned membership, taking advantage of group writeback for on-premises use.

The hybrid connectivity chapter explains Azure Relay (Hybrid Connections/WebSockets) as a se rvice that lets on-premises apps be securely exposed without opening inbound firewall ports . The server initiates an outbound connection to Azure Relay, and Internet clients connect to Azure Relay, which relays traffic over WebSockets to the on-premises li stener. The guide emphasizes: “ Azure Relay enables exposing services behind firewalls without inbound port openings, supporting WebSockets for bidirectional communication .” Alternatives either require inbound exposure or additional infrastructure: ARR (rev erse proxy) and Web Application Proxy run on-premises and would need inbound ports. Azure Application Gateway can proxy HTTP(S) and supports WebSockets pass-through, but to reach an on-prem server you’d typically need VPN/ExpressRoute and corresponding inb ound allowances. Since the requirement is to minimize inbound ports on Firewall1 while supporting WebSockets , Azure Relay is the correct solution.

In the Administering Windows Server Hybrid Core Infrastructure guidance on trusts, Microsoft clarifies that a one-way outgoing trust from the local domain means the local domain trusts the specified external domain; therefore, “security principals from the t rusted (specified) domain can be authenticated to access resources in the trusting (local) domain.” Furthermore, external trusts are non-transitive and scoped only to the two domains that participate in the trust; they do not flow through to other domains or forests. The materials also state that parent–child trusts inside a forest are two-way and transitive, allowing authentication to cross between parent and child domains, but this transitivity does not extend across an external trust to another forest.

Applying these rules:

The external one-way outgoing trust is configured on east.contoso.com → adatum.com. Thus, east.contoso.com trusts adatum.com, allowing users from adatum.com to be granted access to resources in east.contoso.com. Therefore, User1 (adatum.com) can be assigned permissions on Share3 (east.contoso.com) ⇒ Yes.

User2 (contoso.com) attempting to access Share1 (adatum.com) relies on a path that would require trust from adatum.com to contoso.com or a transitive hop through east.contoso.com. Because the trust is external and non-transitive, and there’s no trust from adatum.com to contoso.com, permissions cannot be assigned ⇒ No.

User3 (east.contoso.com) to Share1 (adatum.com) would require adatum.com to trust east.contoso.com. The configured direction is the opposite (east → adatum, outgoing), so east users are not trusted by adatum ⇒ No.