Latest [Jul 21, 2026] Microsoft AZ-800 Real Exam Dumps PDF
AZ-800 Practice Test Questions Updated 269 Questions
NEW QUESTION # 36
You have downloaded a software from the Internet and you want to check this software against vendor-provided file hashes to make sure that it is not tampered with by unauthorized third parties. Which of the following commands can help you?
- A. Filematch.exe command
- B. Hashmatch.exe command
- C. Matchutil.exe command
- D. certutil.exe command
Answer: D
Explanation:
certutil.exe command, built into the Windows operating system, can be used to compare a downloaded file with the hash file that has been provided by the vendor.
Reference:
https://docs.microsoft.com/en-us/learn/modules/manage-advanced-features-of-ad-ds/3- implement-esae-forests
NEW QUESTION # 37
Case Study 1 - Fabrikam, Inc
Overview
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.
Existing Environment
On-premises Servers
The on-premises network contains servers that run Windows Server as shown in the following table.
DC1 hosts all the operation master roles.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.
On-premises Network
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.
Identity Infrastructure
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.
Requirements
Planned Changes
Fabrikam identifies the following planned changes:
Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be connected to Vnet1 by using ExpressRoute.
Create three Azure file shares named newyorkhiles, seattlefiles, and companyfiles.
Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined.
License all servers for Microsoft Defender for servers.
Use Azure Policy to enforce configuration management policies on the servers in Azure and on- premises.
Networking Requirements
Fabrikam identifies the following networking requirements:
Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over ExpressRoute.
If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease.
Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.
Security Requirements
Fabrikam identifies the following security requirements:
Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer.
Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours.
Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|.
Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30 days.
Prevent domain controllers from directly contacting hosts on the internet.
File Sharing Requirements
You need to configure the synchronization of Azure files to meet the following requirements:
Ensure that seattlefiles syncs to FS2.
Ensure that newyorkfiles syncs to FS1.
Ensure that companyfiles syncs to both FS1 and FS2.
Question
You need to implement an availability solution for DHCP that meets the networking requirements.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. On each DHCP scope, configure DHCP failover.
- B. On DHCP1, create a scope that contains 25 percent of the IP addresses from Scope2.
- C. DHCP2, configure a scope that contains 25 percent of the IP addresses from Scope1.
- D. On the router in each office, configure a DHCP relay.
- E. On each DHCP server, install the Failover Clustering feature and add the DHCP cluster role.
Answer: A,D
Explanation:
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-
2012/hh831385(v=ws.11)
NEW QUESTION # 38
SIMULATION
Task 9
You need to replicate a read-only copy of a DNS zone named contosoxom to SRV2.
Answer:
Explanation:
See the solution of this Task below
Explanation:
Objective:
Create a read-only copy of the DNS zone contoso.com on SRV2.
Step-by-Step Guide: Using a Secondary Zone
✅ Step 1: Log in to SRV2
Log in to SRV2 (where you want to host the secondary zone) using an account with local administrative privileges.
✅ Step 2: Open DNS Manager
Press Windows + R, type dnsmgmt.msc, and press Enter.
✅ Step 3: Create a Secondary Zone
In the DNS Manager, expand the server node for SRV2.
Right-click Forward Lookup Zones and select New Zone.
The New Zone Wizard opens.
✅ Step 4: Configure the Secondary Zone
Zone Type:
Select Secondary zone and click Next.
Zone Name:
Type contoso.com and click Next.
Master DNS Servers:
Enter the IP address of the master DNS server that hosts the primary zone (e.g., SRV1's IP).
Click Next.
Finish:
Review the settings and click Finish.
✅ Step 5: Allow Zone Transfers on the Primary Server
On SRV1 (or the DNS server hosting the primary zone):
Open DNS Manager.
Right-click the contoso.com zone and select Properties.
Go to the Zone Transfers tab.
Check Allow zone transfers.
Specify SRV2's IP address (or allow to any server if needed).
✅ Step 6: Verify Zone Replication
On SRV2, refresh the Forward Lookup Zones in DNS Manager.
The contoso.com zone should now appear as a Secondary zone.
Check the Zone Transfer status to ensure it successfully replicated.
NEW QUESTION # 39
SIMULATION
You need to configure a Group Policy preference to ensure that users in the organizational unit (OU) named Server Admins have a shortcut to a folder named \\srv1.contoso.com\data on their desktop when they sign in to the computers in the domain.
To complete this task, sign in the required computer or computers.
Answer:
Explanation:
Create Desktop Shortcuts on Domain Computers via GPO.
Step 1: Open the Group Policy Management Console (gpmc.msc).
Step 2: Right-click an AD container (Organizational Unit) you want to apply a shortcut creation policy. In this case right-click on the OU Server Admins.
Step 3: Select Create a GPO in this domain, and Link it here..
Step 4: Go to the Group Policy Preferences section: User Configuration -> Preferences -> Windows Settings -> Shortcuts. Click it and select New -> Shortcut;
Step 5: Create a new shortcut item with the following settings:
Name: Something
Target Type: File System Object (you can select a URL or a Shell object here) Location: Desktop Target Path: \\srv1.contoso.com\data Reference:
http://woshub.com/create-desktop-shortcuts-group-policy/
NEW QUESTION # 40
You have an Azure virtual machine named VM1 that contains the drives shown in the following table.
On VM1, you plan to install an app named App1. The data for App1 must be stored on a persistent data disk assigned to drive D.
You need assign the data disk to drive D.
What should you do on VM1 first?
- A. Expand the Temporary Storage drive.
- B. Change the drive letter of the Temporary Storage drive to F.
- C. Stop (deallocate) VM1.
- D. Move pagefile.sys to the Operating System drive.
Answer: D
Explanation:
First you need to move pagefile.sys and then change the drive letter.
https://learn.microsoft.com/en-us/azure/virtual-machines/windows/change-drive-letter
NEW QUESTION # 41
Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site.
You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1.
You need to recommend a deployment plan that meets the following requirements:
Ensures that a user named User1 can perform the RODC installation on Server1 Ensures that you can control the AD DS replication schedule to the Server1 Ensures that Server1 is in a new site named RemoteSite1 Uses the principle of least privilege Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
Explanation
Application Description automatically generated with medium confidence
Box 1.
We need to create a site and subnet for the remote site. The new site will be added to the Default IP Site Link so we don't need to create a new site link. You configure the replication schedule on the site link.
Box 2.
When we pre-create an RODC account, we can specify who is allowed to attach the server to the prestaged account. This means that the User1 does not need to be added to the Domain Admins group.
Box3.
User1 can connect the RODC to the prestaged account by running the AD DS installation wizard.
Reference:
https://mehic.se/2018/01/02/how-to-install-and-configure-read-only-domain-controller-rodc-2016/
NEW QUESTION # 42
You have a server named Server1 that runs Windows Server. Server1 has the storage pools shown in the following table.
You plan to create a virtual disk named VDisk1 that will use storage tiers. Which pools can you use to create VDisk1 ?
- A. Pool1 and Pool3 only
- B. Pool1 and Pool2 only
- C. Pool2 and Pool3 only
- D. Pool3 only
- E. Pool, Pool2, and Pool3
- F. Pool 2only
- G. Pool only
Answer: B
NEW QUESTION # 43
You have a server named Server1 that runs Windows Server and has the Hyper V server role installed. Server1 hosts a virtual machine named VM1.
Server1 has an NVMe storage device. The device is currently assigned to VM1 by using Discrete Device Assignment.
You need to make the device available to Server1.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
1 - From Server1, stop VM1.
2 - From Server1, run the Remove-VMAssignableDevice cmdlet.
3 - From Server1, run the Mount-VMHostassignableDevice cmdlet.
4 - From Server1, enable the device by using Device Manager.
Reference:
https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v/deploy/deploying-storage-devices-using-dda
NEW QUESTION # 44
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the servers shown in the following table.
You need to create a Distributed File System (DFS) namespace that will contain the following:
* A domain-based namespace named \\contoso.com\Public
* A folder named Finance
Which servers can you configure as folder targets for the Finance folder?
- A. Server2 and Servers only
- B. Setver3 only
- C. Server1, Server2, Server3, and Server4
- D. Serve r1, Server2, and Server 3 only
- E. Server1 and Server3 only
Answer: C
Explanation:
In the Administering Windows Server Hybrid Core Infrastructure materials for DFS, Microsoft explains that a DFS Namespace presents a virtual tree of folders, and each folder can have one or more folder targets . A folder target is simply " a UNC path to a shared folder that contains the actual data ." The guide emphasizes that folder targets do not need the DFS Namespaces role installed ; the role is only required on namespace servers that host the namespace itself. Likewise, DFS Replication (DFSR) is optional -you enable it only when you want to keep the contents of multiple folder targets synchronized.
The text states that " any SMB share on any Windows server (or cluster) can be used as a folder target ," and that " DFSR is used to replicate the data between folder targets but is not a prerequisite for configuring a target ." Applying this to the scenario: you are creating a domain-based namespace \\contoso.com\Public and a folder Finance . The namespace servers must have the DFS Namespaces role (e.g., Server1/Server3), but folder targets for Finance can reside on any server hosting an SMB share , regardless of whether the DFS Namespaces or DFS Replication roles are inst alled. Therefore, Server1, Server2, Server3, and Server4 can all be configured as folder targets for the Finance folder.
NEW QUESTION # 45
You have an Azure virtual machine named VM1 that runs Windows Server.
You need to configure the management of VM1 to meet the following requirements:
Require administrators to request access to VM1 before establishing a Remote Desktop connection.
Limit access to VM1 from specific source IP addresses.
Limit access to VM1 to a specific management port.
What should you configure?
- A. Azure Front Door
- B. a network security group (NSG)
- C. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
- D. Microsoft Defender for Cloud
Answer: D
Explanation:
https://docs.microsoft.com/en-us/azure/defender-fo
NEW QUESTION # 46
Your network contains a two-domain on-premises Active Directory Domain Services (AD DS) forest named Contoso.com. The forest contains the domain controllers shown in the following table.
You create an Active Directory site named Site3. Site1, Site2 and Site3 each has a dedicated site link to the Hub site.
In Site3, you install a new server named Server1.
You need to promote Server1 to an ROOC in child.contoso.com by using the install from Media (IFM) option.
The solution must minimize network traffic.
What should you do? To answer select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 47
Your network contains three Active Directory Domain Services (AD DS) forest as shown in the following exhibit.
The network contains the users shown in the following table.
The network contains the security groups shown in the following table.
For each of the following statements, select Yes if the statement is true, Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
NEW QUESTION # 48
You need to meet the security requirements for passwords.
Where should you configure the components for Azure AD Password Protection? lo answer, drag the appropriate components to the correct locations. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises
NEW QUESTION # 49
You have two on-premises servers named Server1 and Servet2 that run Windows Server.
You have an Azure Storage account named storage1 that contains a file share named share'. Server1 syncs with share1 by using Azure File Sync You need to configure Server2 to sync with share1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
1 - On Server2, install the Azure File Sync agent.
2 - Register Server2 with the Storage Sync Service.
3 - Add a server endpoint to the sync group.
NEW QUESTION # 50
You need to implement an availability solution for DHCP that meets the networking requirements.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. On each DHCP scope, configure DHCP failover.
- B. On each DHCP server, install the Failover Clustering feature and add the DHCP cluster role.
- C. On the router in each office, configure a DHCP relay.
- D. DHCP2. configure a scope that contains 25 percent of the IP addresses from Scope 1 .
- E. On DHCP1. create a scope that contains 25 percent of the IP addresses from Scope2.
Answer: A,B
Explanation:
Reference:
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831385(v=ws.11)
NEW QUESTION # 51
Your network contains an Active Directory domain named contoso.com. The domain contains group managed service accounts (gMSAs). You have a server named Server1 that runs Windows Server and is in a workgroup. Server! hosts Windows containers.
You need to ensure that the Windows containers can authenticate to contoso.com.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
1 - In contoso.com, generate a Key Distribution Service (KDS) root key.
2 - In contoso,com, create a gMSA and standard user account.
3 - From a domain-joined computer, create a credential spec file and copy the file to Server1.
NEW QUESTION # 52
You have an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with Azure AD by using Azure AD Connect.
You enable password protection for contoso.com.
You need to prevent users from including the word Contoso as part of their password.
What should you use?
- A. Active Directory Users and Comp uters
- B. Windows Admin Center
- C. the Azure Active Directory admin center
- D. Synchronization Service Manager
Answer: C
Explanation:
In the Administering Windows Server Hybrid Core Infrastructure material, the section on Configure and manage Azure AD Password Protection states that Azure AD Password Protection " uses a global and custom banned password list to prevent weak or easily guessed passwords ." Administration is performed in Azure AD : " The custom banned password list is created and maintained in the Azure AD portal and applies to both cloud users and on-premises domains when the proxy and DC agents are deployed.
" The guidance further notes that the feature is case-insensitive and blocks substrings: " Words on the custom list are evaluated in all variants and as part of longer strings. " O perationally, you configure this at Security # Authentication methods # Password protection (Azure AD admin center). From there you add entries such as "contoso" to the Custom banned password list , and set enforcement/audit. The same module clarifies what you don't use: " Active Directory Users and Computers does not manage Azure AD Password Protection policy ," and tools like Synchronization Service Manager or Windows Admin Center are unrelated to defining the password policy.
Therefore, to prevent users fro m including Contoso in their passwords in a hybrid (Azure AD Connect) environment, you must configure the custom banned password list in the Azure Active Directory admin center .
NEW QUESTION # 53
You have a server named Server1 that runs Windows Serv er. Server1 has a single network interface and the Hyper-V virtual switches shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each co rrect selection is worth one point.
Answer:
Explanation:
Explanation:
The Hyper-V networking section of the Administering Windows Server Hybrid Core Infrastructure material explains that Hyper-V provides three virtual switch types: External, Internal, and Private . It states: "An External switch is bound to a physical NIC and can optionally connect the management OS; an Internal switch connects VM s to each other and to the host only; a Private switch connects VMs to each other only (no host access)." The guide further clarifies limits on external switches: "A single physical adapter can be bound to only one External virtual switch at a time (unless using NIC Teaming). Additional External switches require additional physical adapters." In the exhibit, Server1 has a single NIC already bound to vSwitch3 , and the tree shows 'Microsoft Hyper-V Network Adapter' , indicating the management OS shares the ada pter. Therefore, you cannot add another External switch with the lone NIC; you can still create Internal and Private switches.
Regarding host connectivity, the guide specifies: "The management OS can communicate with VMs attached to an Internal switch and to an External switch (when the management OS is connected). The host cannot communicate with VMs on a Private switch." Consequently, Server1 can access network shares only from VMs on vSwitch2 (Internal) or vSwitch3 (External with management OS) , but not from VMs on vSwitch1 (Private) .
NEW QUESTION # 54
You need to implement an availability solution for DHCP that meets the networking requirements.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. On each DHCP scope, configure DHCP failover.
- B. DHCP2. configure a scope that contains 25 percent of the IP addresses from Scope 1 .
- C. On DHCP1. create a scope that contains 25 percent of the IP addresses from Scope2.
- D. On the router in each office, configure a DHCP relay.
- E. On each DHCP server, install the Failover Clustering feature and add the DHCP cluster role.
Answer: A,D
Explanation:
Reference:
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831385(v=ws.11)
Topic 3, Datum Corporation
Overview
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
The on-premises network of A. Datum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.
The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
The adatum.com domain contains the servers shown in the following table.
HyperV1 contains the virtual machines shown in the following table.
All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.
The subscription contains the virtual networks shown in the following table.
The subscription contains the Azure Private DNS zones shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
* Sync Data1 to share1.
* Configure an Azure runbook named Task1.
* Enable Microsoft Entra users to sign in to Server1.
* Create an Azure DNS Private Resolver that has the following configurations:
o Name: Private1
o Region: West US
o Virtual network: VNet1
o Inbound endpoint: SubnetB
* Enable users in the adatum.com domain to access the resources in the south.fabrikam.com domain.
* The data on SSPace1 must be available always.
* DC2 must become the schema master if DC1 fails.
* VMS must be configured to enable per-folder quotas.
* Trusts must allow access to only the required resources.
* The users in the Marketing OU must have access to storage!
* Azure Automanage must be used on all supported Azure virtual machines.
* A direct SSH session must be used to manage all the supported virtual machines on HyperV1.
NEW QUESTION # 55
Hotspot Question
Your network contains a Microsoft Entra Domain Services domain named
sk230128outlook.onmicrosoft.com. The domain contains a server named Server1 that runs Windows Server.
You have the users shown in the following table.
The domain contains the Group Policy Objects (GPOs) shown in the following exhibit.
The minimum password length for each GPO is configured as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: Yes
User1 is a domain user in the AADDC Users organizational unit (OU).
The AADDC Users GPO has the minimum password length set to 10.
Box 2: No
User2 is a local user on Server1.
The AADDC Computers GPO has a minimum password length of 7, but it does not apply to local users in a server in the domain.
The default Domain Policy has a minimum password length of 9 will be applied.
Note:
In an Entra Domain Services managed domain, the AADDC Computers GPO minimum password length policy primarily applies to users created directly within the managed domain.
Box 3: Yes
User3 is a domain user in an organizational unit (OU) named OU1.
GPO1 is linked to OU1.
GPO1 is configured with a minimum password length of 13.
Reference:
https://learn.microsoft.com/en-us/entra/identity/domain-services/password-policy
NEW QUESTION # 56
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the servers shown in the following table.
You need to create a Distributed File System (DFS) namespace that will contain the following:
* A domain-based namespace named \\contoso.com\Public
* A folder named Finance
Which servers can you configure as folder targets for the Finance folder?
- A. Server1, Server2, Server3, and Server4
- B. Server2 and Servers only
- C. Setver3 only
- D. Server1 and Server3 only
- E. Server1, Server2, and Server 3 only
Answer: B
NEW QUESTION # 57
......
Why it is important to take the Microsoft AZ-800 Certification Exam
Nowadays, the companies are looking for professionals who are experts in designing and configuring hybrid infrastructures consisting of a physical facts center and Azure resources like Azure Virtual appliance, Azure Storage, SQL Database, and Batch, on-premises services such as System Center unit Manager, and online services such as Office 365 and Azure AD. This certification will be a valuable asset for you as it will make you eligible for the Windows Server Hybrid Core Infrastructure (beta) Certification. AZ-800 exam dumps will help you to prepare for the exam in the best possible way.
It is a Microsoft-authorized certification for IT professionals who have experience in designing and configuring hybrid infrastructures consisting of a physical info center and Azure resources like Azure appliance, Azure Storage, SQL Database, and Batch, services such as System Center device Manager, and online services such as Office 365 and Azure AD. The Microsoft AZ-800 Certification Exam objectives are the most important thing to know before you take the exam. If you don't know what the exam objectives are, you can't prepare for the exam properly.
Microsoft AZ-800 Dumps - Secret To Pass in First Attempt: https://www.exam-killer.com/AZ-800-valid-questions.html
AZ-800 Dumps - Grab Out For [NEW-2026] Microsoft Exam: https://drive.google.com/open?id=1bVcSVznZzwbtN5COpFS1o28FlwJOSPbp
