AZ-800 Questions and Answers

n the Administering Windows Server Hybrid Core Infrastructure guidance for managing AD DS, Microsoft emphasizes using OU-level delegation to satisfy administrative needs while adhering to the principle of least privilege. The documentation explains that the Delegate Control wizard on an OU lets you grant a user or group only the specific permissions required for common tasks, including “Modify the membership of a group”. This grants the write permission to the member attribute on group objects contained in that OU, without giving broader account-management rights across the domain.

By contrast, placing a user in Account Operators or Server Operators provides elevated, domain-wide capabilities far beyond what is required. Account Operators can create, delete, and modify many account types across the domain (except for protected admin accounts), which violates least-privilege for a task that only needs to change group membership in one OU. Server Operators is unrelated to group membership and is intended for server administration tasks. Creating a delegation at the domain root would similarly be excessive because it applies broadly to all containers and OUs.

Therefore, to meet the requirement “Ensure that User1 can manage the membership of all the groups in Contoso\OU3,” you should delegate control on OU3 and assign the built-in task “Modify the membership of a group” to User1, achieving the minimal permissions necessary.

In Windows Server AD DS, group scope determines which groups/accounts can be members. The AZ-800 study materials summarize: “Domain Local groups can include accounts, Global groups, and Universal groups from any domain and Domain Local groups from the same domain only. Global groups can include accounts and other Global groups from the same domain only. Universal groups can include *accounts, Global groups, and Universal groups from any domain.” In addition, distribution vs. security does not change the scope membership rules; it only affects whether the group can be assigned permissions.

Applying the rules: Group3 is a Domain Local security group in contoso.com. Therefore it can contain Universal (Group1), Global from any domain (Group2 in contoso.com and Group4/Group5 in canada.contoso.com), but cannot contain a Domain Local from another domain (Group6 in canada.contoso.com). Hence: Group1, Group2, Group4, and Group5 only.

Group5 is a Global distribution group in canada.contoso.com. A Global group can only contain accounts or Global groups from the same domain. From the list, only Group4 (Global distribution, canada.contoso.com) fits. It cannot contain Group1 (Universal), Group2 (Global but different domain), or Group6 (Domain Local). Therefore: Group4 only.

In the Administering Windows Server Hybrid Core Infrastructure materials under Hyper-V management, Microsoft specifies that Enhanced Session Mode changes VMConnect from a raw console attach to a connection that uses Remote Desktop Protocol (RDP) to the guest. The guide states that Enhanced Session Mode “uses RDP to establish the VMConnect session so the user must supply credentials for a logon to the guest operating system,” and further that it “prevents a second administrator from inheriting an already signed-in console session” because the connection is treated as a new interactive sign-in. In contrast, the default basic console session “attaches directly to the active console without prompting for credentials,” which is exactly the current problem described for VM2.

The same objective area clarifies that other options do not meet the requirement: Guest Services integration only enables file copy and certain host-guest interactions; Credential Guard protects secrets inside Windows by isolating LSASS but does not affect Hyper-V console connection behavior; Shielded VMs provide fabric-level protections and encryption but are not required merely to force credential prompts for VMConnect.

Therefore, to force users to provide credentials when they connect to VM2 and to eliminate inherited console sessions, you should enable Enhanced Session Mode on the Hyper-V host (and ensure the guest supports RDP).

The AZ-800 content covering Active Directory Sites and Services clarifies that site, subnet, and site-link objects live in the Configuration partition. The guides emphasize that administration of the Configuration naming context is restricted to Enterprise Admins and to Domain Admins of the forest-root domain. In the context of changing replication topology parameters—such as editing the replication schedule on site links—the documentation notes: “Only Enterprise Admins or administrators in the forest-root Domain Admins group have default permissions to modify site and site-link objects,” because these objects affect replication forest-wide.

Applying this to the scenario:

Contoso\Admin1 (Enterprise Admins) has forest-wide rights to modify site links.

Contoso\Admin2 (Domain Admins in contoso.com, the forest-root domain) also has the required rights to change site-link schedules.

Canada\Admin3 (Domain Admins in canada.contoso.com) does not have default permissions in the Configuration partition for forest-wide site-link administration.

Thus, to meet the technical requirement to change all site links to a 30-minute schedule, the users who can perform the task are Admin1 and Admin2.

In the Windows Server Hybrid Core Infrastructure objectives for Active Directory group design, group scope and type determine valid membership and usage. The study guidance for group scopes states that a Domain Local group is used to assign permissions in its own domain and “can contain accounts, computer objects, global groups from any domain, and universal groups; it can also contain other domain local groups from the same domain only.” Security-type restrictions also apply: “Security groups can contain only security principals; distribution groups cannot be nested into security groups for access control.”

Applying these rules to Group3 (contoso.com Domain Local Security): it can accept security groups of compatible scopes. From the lists, Group1 (contoso.com Universal Security) and Group2 (contoso.com Global Security) are valid. Distribution groups (Group4, Group5, Group6) are not valid members of a security group used for authorization. Therefore, Group3 ⇒ Group1 and Group2 only.

For Group5 (canada.contoso.com Global Distribution), the scope rule for Global groups is: “Global groups can include user accounts and other global groups from the same domain only; they cannot include universal or domain local groups.” Hence, the only eligible group from the same domain and scope is Group4 (canada.contoso.com Global Distribution). Group6 is domain local (invalid), and cross-domain globals (Group2) are not permitted. Therefore, Group5 ⇒ Group4 only.

No

Yes

Yes

In Administering Windows Server Hybrid Core Infrastructure, Microsoft states that the domain password policy for domain user accounts is determined by the GPO that wins at the domain root (commonly the Default Domain Policy). GPOs linked to OUs do not change the domain password policy for user accounts in those OUs; they only affect local accounts on computers within those OUs unless Fine-Grained Password Policies (PSOs) are used and scoped to users/groups. The case shows Default Domain Policy in contoso.com sets Minimum password length = 10. Therefore, both Admin1 (a domain user in Contoso\OU1) and User1 (in Contoso\OU3) fall under the 10-character minimum; the OU-linked GPO1 (14) does not override the domain password policy for their domain accounts → Admin1: No, User1: Yes.

For member servers and local accounts, the documentation explains that password policy settings in a GPO linked to the OU containing the computer apply to that computer’s local Security Accounts Manager (SAM). In the scenario, Server1 resides in Member Servers and GPO2 linked to Member Servers specifies Minimum password length = 8. Thus, when Admin1 creates a local account on Server1, the enforced minimum is 8 characters → Yes. This approach follows least privilege and standard precedence: domain-level for domain accounts, OU-linked GPOs for local accounts, unless PSOs are explicitly defined.

Server1 - Set-Item

Server4 - Enable-PSRemoting

In the Administering Windows Server Hybrid Core Infrastructure objectives for managing Hyper-V, enabling nested virtualization is the required step when you must “run virtual machines inside a virtual machine.” The referenced guidance states that Hyper-V on a VM is supported only when the host exposes hardware virtualization features to the guest. The prescriptive step is: “Turn off the VM and run Set-VMProcessor -VMName <VMName> -ExposeVirtualizationExtensions $true to enable nested virtualization.” The module further notes that this action “passes through Intel VT-x/AMD-V to the guest so the guest OS can install the Hyper-V role and create VMs.” It also clarifies that “the setting is applied on the parent host for the target VM and requires the VM to be powered off before the change is committed.”

Because the technical requirement says “Ensure that you can run virtual machines on VM1”, VM1 must be able to host Hyper-V while itself running as a VM on Server2. The first and essential cmdlet is therefore Set-VMProcessor with the -ExposeVirtualizationExtensions switch set to $true against VM1. Other optional settings (for example, MAC spoofing on the vNIC or static memory) may be configured later if needed, but exposing virtualization extensions is the enabling prerequisite that satisfies the requirement.

In the AZ-800 “Administering Windows Server Hybrid Core Infrastructure” objectives for Active Directory, server promotion is governed by forest/domain administrative roles. The materials state that promoting a member server to a domain controller in a given domain requires membership in either the Enterprise Admins group or the Domain Admins group of the target domain. The Configuration and Domain naming contexts that DCPromo touches (NTDS settings, SYSVOL/DFS-R readiness, DC computer account, and associated service SPNs) are protected so that “Enterprise Admins have full rights forest-wide, and Domain Admins have full rights within their respective domain.”

In this case, the requirement is to promote Server1 to a domain controller in canada.contoso.com. From the identities table:

Contoso\Admin1 is a member of Enterprise Admins (forest-wide authority).

Canada\Admin3 is a member of Canada\Domain Admins (authority within canada.contoso.com).

Contoso\Admin2 is Domain Admins (contoso.com) only, which does not grant administrative authority in the canada.contoso.com child domain.

Therefore, the users who can currently perform the required task for Server1 are Admin1 and Admin3.

In the Windows Server exam materials for Administering Windows Server Hybrid Core Infrastructure (AZ-800), Microsoft documents that Data Deduplication is supported only on data volumes and specifically on NTFS-formatted volumes, and it cannot be enabled on the system or boot volume. The study text states: “Data Deduplication is applied at the volume level and supports NTFS data volumes. You cannot enable deduplication on the system or boot volume.” It further clarifies unsupported targets: “ReFS volumes and FAT/exFAT volumes are not supported for Data Deduplication in general-purpose server scenarios,” and emphasizes that deduplication is “not available for the operating system volume.”

Applying these rules to VM3:

C: NTFS but it is the OS/system volume → not eligible.

D: NTFS data volume → eligible.

E: ReFS → not supported for general-purpose dedup in this context.

F: exFAT → not supported.

Therefore, the only volume on which you can enable Data Deduplication to meet the requirement is volume D.

To create a group-managed service account (gMSA) named gMSA1 and make it available on SRV1, you can follow these steps:

Step 1: Create the Key Distribution Services Root Key First, you need to create the KDS Root Key, which is required for the gMSA to function. You can do this with the following PowerShell command:

Add-KdsRootKey –EffectiveTime ((get-date).addhours(-10))

Note: The -EffectiveTime parameter is set to 10 hours in the past to ensure immediate effect.

Step 2: Create the gMSA Next, use the New-ADServiceAccount cmdlet to create the gMSA:

New-ADServiceAccount -Name gMSA1 -DNSHostName gmsa1.domain.com -PrincipalsAllowedToRetrieveManagedPassword SRV1$

Replace domain.com with your actual domain name.

Step 3: Install the gMSA on SRV1 Now, you need to install the gMSA on the server SRV1. Run the following command on SRV1:

Install-ADServiceAccount -Identity gMSA1

Step 4: Test the gMSA To ensure that the gMSA is installed correctly and ready for use, perform a test using:

Test-ADServiceAccount -Identity gMSA1

If the test returns True, the gMSA is correctly installed and ready for use on SRV1.

Step 5: Configure the Service to Use the gMSA Finally, configure the service that requires the gMSA to use gMSA1 by setting the service’s logon account to domain\gMSA1$ and leave the password field blank.

This will create and make the gMSA gMSA1 available on SRV1. Ensure that you have the necessary permissions and that SRV1 is properly joined to the domain before proceeding with these steps123.

Step-by-Step Guide: Seizing/Transferring the Schema Master Role to DC2

✅ Step 1: Log in to DC2

Use an account that is a member of the Schema Admins, Enterprise Admins, and Domain Admins groups.

✅ Step 2: Register the Schema Snap-in

The Schema snap-in is not loaded by default.

Open Command Prompt as Administrator.

Type the following command to register the schema management DLL:

powershell

Copy

regsvr32 schmmgmt.dll

✅ Step 3: Open MMC (Microsoft Management Console)

Press Windows + R, type mmc, and hit Enter.

In MMC, go to File > Add/Remove Snap-in.

Select Active Directory Schema, then click Add > OK.

✅ Step 4: Connect to DC2

In the Active Directory Schema console, right-click Active Directory Schema and select Change Active Directory Domain Controller.

In the dialog box, select DC2 and click OK.

This will connect the console to DC2.

✅ Step 5: Transfer the Schema Master Role

Right-click Active Directory Schema again and select Operations Master.

In the Change Schema Master dialog box, confirm that DC2 is shown as the target.

Click the Change button to transfer the Schema Master role to DC2.

Click Yes when prompted to confirm the transfer.

✅ Step 6: Verify the Transfer

In the same dialog box, ensure that DC2 is now listed as the Schema Master.

Optionally, run the following command in PowerShell to verify:

netdom query fsmo

The Schema Master should now be DC2.

One possible solution to ensure that all DHCP clients that get an IP address from SRV1 will be configured to use DC1 as a DNS server is to use the DHCP scope options. DHCP scope options are settings that apply to all DHCP clients that obtain an IP address from a specific scope. You can use the DHCP scope options to specify the DNS server IP address, as well as other parameters such as the default gateway, the domain name, and the DNS suffix. Here are the steps to configure the DHCP scope options on SRV1:

On SRV1, open DNS Manager from the Administrative Tools menu or by typing dnsmgmt.msc in the Run box.

In the left pane, expand your DHCP server and click on IPv4.

In the right pane, right-click on the scope that you want to configure and select Properties.

In the Scope Properties dialog box, click on the DNS tab.

Check the box Enable DNS dynamic updates according to the settings below. This option allows the DHCP server to register and update the DNS records for the DHCP clients.

Select the option Always dynamically update DNS records. This option ensures that the DHCP server updates both the A and PTR records for the DHCP clients, regardless of whether they request or support dynamic updates.

Check the box Discard A and PTR records when lease is deleted. This option allows the DHCP server to delete the DNS records for the DHCP clients when their leases expire or are released.

Check the box Dynamically update DNS records for DHCP clients that do not request updates. This option allows the DHCP server to update the DNS records for the DHCP clients that do not support dynamic updates, such as legacy or non-Windows clients.

In the DNS servers section, click on the Add button to add a new DNS server IP address.

In the Add Server dialog box, enter the IP address of DC1, which is the DNS server that you want to use for the DHCP clients, and click Add.

Click OK to close the Add Server dialog box and return to the Scope Properties dialog box.

Click OK to apply the changes and close the Scope Properties dialog box.

Now, all DHCP clients that get an IP address from SRV1 will be configured to use DC1 as a DNS server. You can verify the DNS configuration by using the ipconfig /all command on a DHCP client computer and checking the DNS Servers entry. You can also check the DNS records for the DHCP clients by using the DNS Manager console on DC1.

One possible solution to ensure that you can manage DC1 by using Windows Admin Center on SRV1 is to install Windows Admin Center on SRV1 and add DC1 as a managed server. Windows Admin Center is a web-based management tool that allows you to manage servers, clusters, Windows PCs, and Azure virtual machines (VMs) from a single interface. Here are the steps to install Windows Admin Center on SRV1 and add DC1 as a managed server:

On SRV1, open a web browser and go to the folder named \dc1.contoso.com\install. Download the Windows Admin Center installer file (WindowsAdminCenter.msi) and save it to a local folder, such as C:\Temp.

Run the Windows Admin Center installer file and follow the installation wizard. You can choose to install Windows Admin Center as a desktop app or as a service. For more information on how to install Windows Admin Center, see Install Windows Admin Center.

After the installation is complete, launch Windows Admin Center from the Start menu or the desktop shortcut. If you installed Windows Admin Center as a service, you can access it from a web browser by using the URL https://localhost:6516 or https:// :6516, where is the name or IP address of SRV1.

On the Windows Admin Center dashboard, click Add to add a new connection. Select Server as the connection type and enter the name or IP address of DC1 in the Server name field. Optionally, you can specify the display name, description, and tags for the connection. Click Submit to add DC1 as a managed server.

On the Windows Admin Center dashboard, you should see DC1 listed under the Servers section. Click on DC1 to open the server overview page. From here, you can manage various aspects of DC1, such as roles and features, certificates, devices, events, files, firewall, processes, registry, services, and more. For more information on how to use Windows Admin Center to manage servers, see Manage servers with Windows Admin Center.

Now, you can manage DC1 by using Windows Admin Center on SRV1. You can also add more servers or other types of connections to Windows Admin Center and manage them from the same interface

The exam materials state that Azure Automation runbooks can be authored in PowerShell and Python (along with Graphical and PowerShell Workflow where noted). The module on “Automate management in hybrid environments” specifies: “Runbooks support PowerShell for Windows-based automation and Python for cross-platform scenarios.” It further explains that these languages integrate with Automation Accounts, modules/packages, credentials, and managed identities to run tasks on Azure or hybrid resources through the Hybrid Runbook Worker. Languages such as Java, JavaScript, or Bicep are not runbook languages (Bicep is used for ARM template deployments, not runbook execution). Accordingly, Task1 can be implemented in PowerShell and Python.

According to the Administering Windows Server Hybrid Core Infrastructure (AZ-800) exam study materials, Azure DNS Private Resolver allows bidirectional name resolution between on-premises environments and Azure private DNS zones. The Private DNS Resolver consists of inbound endpoints (to resolve queries from on-premises to Azure) and outbound endpoints (to resolve queries from Azure to on-premises DNS servers). For name resolution to work, private DNS zones must be linked to the virtual network associated with the resolver’s hub network.

In this scenario, the planned configuration specifies:

A Private DNS Resolver named Private1 created in the West US region and linked to VNet1.

An inbound endpoint in SubnetB.

The requirement is to identify which private DNS zones will be available for name resolution through this resolver.

From the details given, only Zone1.com and Zone2.com are linked to VNet1, allowing them to participate in name resolution using the resolver. Zone3.com is not linked to VNet1 (either unlinked or linked to another virtual network), and therefore it cannot be resolved through the DNS Resolver in VNet1.

As emphasized in Microsoft’s hybrid infrastructure documentation:

“Private DNS zones must be linked to the same virtual network that contains the Private DNS Resolver or to peered virtual networks for name resolution to succeed.”

Hence, only Zone1.com and Zone2.com are available for name resolution through the Private DNS Resolver.

✅ Correct Answer: C. Zone1.com and Zone2.com only

The AZ-800 materials explain that enabling Microsoft Entra (Azure AD) sign-in to Windows Server running as an Azure VM is done by deploying the Azure AD Login for Windows VM extension. The study guide states that “for Azure VMs, Microsoft Entra sign-in is enabled by installing the AADLoginForWindows extension; once installed, Entra users and groups granted ‘Virtual Machine User/Login’ roles can sign in using Entra credentials.” The required operation is performed from Azure PowerShell with Set-AzVMExtension, providing the publisher Microsoft.Azure.ActiveDirectory, type AADLoginForWindows, and the target VM. Other options are not applicable: Set-AzVM changes VM properties but does not install extensions; New-ADComputer and Add-ADComputerServiceAccount are AD DS cmdlets unrelated to enabling Entra login on an Azure VM. Therefore, to meet the plan “Enable Microsoft Entra users to sign in to Server1,” you must run Set-AzVMExtension to install the AAD Login extension on Server1.

Disk1 (three-way mirror): 2 disks; Disk2 (parity): 1 disk

\In the Administering Windows Server Hybrid Core Infrastructure materials on Storage Spaces resiliency, Microsoft describes how each resiliency type determines simultaneous disk-failure tolerance. The guide explains that mirror spaces keep multiple copies of data: “Two-way mirror writes two copies and can sustain a single disk failure; three-way mirror writes three copies and can sustain the loss of any two disks without data loss.” It also differentiates parity spaces, which stripe data with parity information: “Parity provides capacity efficiency comparable to RAID-5 and tolerates a single disk failure (use dual parity to withstand two failures).”

Applying these to SSPace1:

Disk1 uses a three-way mirror across eight physical disks. By definition, a three-way mirror survives two concurrent disk failures and remains online, satisfying the “always available” requirement.

Disk2 is configured as parity across twelve physical disks. Standard parity (single parity) is equivalent to RAID-5 and survives one disk failure; only dual parity would allow two, but the configuration provided specifies parity (not dual parity).

Therefore, the maximum simultaneous physical disk failures while maintaining availability are 2 for Disk1 and 1 for Disk2.

The Administering Windows Server Hybrid Core Infrastructure content notes that Microsoft Entra Connect cloud sync uses lightweight agents and supports synchronizing specific OUs from multiple forests into a single tenant. The guide highlights that cloud sync “is designed for multi-forest or cross-organization scenarios and allows scoping to selected OUs and groups,” enabling granular onboarding of just the identities you need. The requirement says “the users in the Marketing OU (in Fabrikam’s forest) must have access to storage1.” Granting access to Azure Files using Entra-based authorization requires that those users exist in the same Entra tenant. Cloud sync enables importing only the Fabrikam Marketing OU into A. Datum’s tenant without establishing full trust for all users. Azure AD Connect in active or staging mode would target the A. Datum forest and isn’t intended for selectively bringing in a separate partner forest OU; AD FS is a federation solution and does not create tenant objects for ACLs on Azure resources like Azure Files. Therefore, implement Microsoft Entra Connect cloud sync and scope it to the Marketing OU to meet the requirement.

Comprehensive and Detailed Explanation with all Administering Windows Server Hybrid Core Infrastructure documents: =

In the Administering Windows Server Hybrid Core Infrastructure study materials, Automanage for Azure VMs is described as a service that “onboards supported Azure virtual machines into a curated set of best-practice services automatically.” The guide notes that Automanage supports Azure IaaS VMs running Windows Server (2012 R2 and later) and common Linux distributions (for example Ubuntu/RHEL), while unsupported operating systems such as Windows client SKUs or older Windows Server releases are excluded. The same content emphasizes that Automanage targets “only supported Azure VMs” and does not extend to machines that don’t meet OS prerequisites.

Given the scenario, Server1 (supported Linux server) and Server2 (supported Windows Server) meet Automanage prerequisites, whereas the remaining Azure VMs are not in the supported matrix (client OS or an older/unsupported server release). Therefore, enabling Automanage on Server1 and Server2 only satisfies the technical requirement to “use Azure Automanage on all supported Azure virtual machines.”

To meet the requirement that VM3 be configured for per-folder quotas, the Windows Server file services module directs you to install File Server Resource Manager (FSRM). The course content explains: “FSRM provides quota management, file screening, and storage reporting. Quotas can be applied to volumes and to specific folders, enabling administrators to control the space consumed.” None of the other features listed deliver folder-level quota capability: Enhanced Storage and Windows Standards-Based Storage Management relate to storage management/SMI-S, and iSNS Server concerns iSCSI discovery services. Therefore, the first step is to install FSRM on VM3; after installation, you can create per-folder quota templates and assignments to enforce the desired limits.

The exam content for Group Policy processing stresses User Group Policy loopback processing for session hosts (RDS/AVD): “In environments like Remote Desktop Session Host (or Azure Virtual Desktop), enable loopback processing on the OU that contains the session host computers so that user settings from that GPO apply when users log on to those computers, regardless of the user’s own OU.” The requirement states: “Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer.” The idle-lock is a user configuration setting that must apply when users sign in to the session hosts, not to their personal devices. Therefore, enable loopback processing (Merge/Replace) in GPO4, which is linked to the VirtualDesktops OU containing the session hosts. Using security filtering or Enforced cannot make user settings in GPO4 override the user’s own OU without loopback. Loopback ensures the AVD hosts impose the 10-minute lock for sessions, while leaving users free to set their own client device policies independently—fulfilling least-impact design.

The Windows Server hybrid core administration guidance describes the classic cross-forest/group nesting model as AGUDLP: “Accounts → Global (or Universal) → Domain Local → Permissions.” For resource access that spans forests, the documentation stresses two points: (1) Put user accounts into groups that exist only in their own forest, and (2) Grant ACL permissions only to groups that exist in the resource forest. It further explains that Universal groups are forest-wide and “can contain users and global groups from any domain in the same forest and can be used across forest trusts,” which minimizes the number of groups when users come from multiple child domains. By contrast, Domain Global groups are limited to membership from a single domain, which would require separate globals per child domain and thus more groups. For assigning permissions at the resource side, the guidance states that Domain Local groups are intended to “receive permissions on resources within their own domain and can contain members from trusted forests,” which satisfies the requirement that permissions in fabrikam.com be granted only to groups in that forest. Therefore, to meet all constraints and minimize group count: place contoso.com users in a Universal group (in contoso.com) and add that group to a Domain Local group (in fabrikam.com) that is granted the required permissions.

In the Administering Windows Server Hybrid Core Infrastructure material, the section on Configure and manage Azure AD Password Protection states that Azure AD Password Protection “uses a global and custom banned password list to prevent weak or easily guessed passwords.” Administration is performed in Azure AD: “The custom banned password list is created and maintained in the Azure AD portal and applies to both cloud users and on-premises domains when the proxy and DC agents are deployed.” The guidance further notes that the feature is case-insensitive and blocks substrings: “Words on the custom list are evaluated in all variants and as part of longer strings.”

Operationally, you configure this at Security → Authentication methods → Password protection (Azure AD admin center). From there you add entries such as “contoso” to the Custom banned password list, and set enforcement/audit. The same module clarifies what you don’t use: “Active Directory Users and Computers does not manage Azure AD Password Protection policy,” and tools like Synchronization Service Manager or Windows Admin Center are unrelated to defining the password policy.

Therefore, to prevent users from including Contoso in their passwords in a hybrid (Azure AD Connect) environment, you must configure the custom banned password list in the Azure Active Directory admin center.

 You can add User1 to Group1. Yes

 You can add User2 to Group3. No

 You can grant Group2 permissions to the resources in the fabrikam.com domain. No

The Administering Windows Server Hybrid Core Infrastructure materials describe how group scopes and forest trusts determine where you can add members and where you can assign permissions. For Domain Local groups: “Domain local groups are intended to secure resources in the local domain and can include accounts and groups from any trusted domains or forests.” With a two-way forest trust between contoso.com and adatum.com, a user from east.contoso.com (User1) can therefore be added to Group1, a domain local group in west.adatum.com → Yes.

For Universal groups, the guide states: “Universal groups are replicated to the global catalog and can contain users and groups from any domain in the same forest; they are designed for cross-domain (in-forest) membership.” Because User2 is in fabrikam.com (a different forest), they cannot be added to Group3 (a Universal group in east.contoso.com) → No.

On assigning permissions across forests, the materials clarify: “A security principal can be granted access only where a trust exists with its account forest. Forest trusts are not transitive to other forests.” Since fabrikam.com trusts adatum.com but has no trust with contoso.com, you cannot grant Group2 (Universal in contoso.com) permissions on fabrikam.com resources → No.

In Windows Server deployments that use Hyper-V with Switch Embedded Teaming (SET) and SMB Direct (RDMA), Microsoft’s guidance in Administering Windows Server Hybrid Core Infrastructure is to validate the end-to-end Data Center Bridging (DCB) and RDMA prerequisites with Validate-DCB. The DCB validation covers the exact Windows Server settings RDMA depends on: Priority-based Flow Control (PFC), Enhanced Transmission Selection (ETS), QoS policies for SMB (priority tagging), and RDMA enablement on the relevant physical adapters. The study materials emphasize that while tools such as Server Manager, Failover Cluster Manager, or basic adapter inventory (e.g., Get-NetAdapter) can show device status or general configuration, they do not verify the complete, lossless fabric requirements for RDMA over Converged Ethernet used with Hyper-V/SET.

The prescribed approach is to run Validate-DCB against the host NICs participating in the SET team to confirm:

RDMA is enabled on the interfaces used for SMB Direct.

PFC is enabled for the SMB priority.

ETS bandwidth reservations are correctly applied.

QoS policies align across adapters so SMB traffic is lossless.

The cmdlet produces pass/fail diagnostics and remediation guidance, providing a single authoritative validation for “RDMA and all required Windows Server settings” on each server. Accordingly, the correct choice for verifying the configuration in this scenario is Validate-DCB.

When building Windows container images, the base image determines both compatibility and image size. The hybrid core curriculum emphasizes that Nano Server is the smallest Windows base image, intended for headless, app-only workloads such as .NET (/.NET Core) applications. .NET Core’s modular, self-contained approach enables it to run on Nano Server images designed for Windows containers, yielding significantly smaller images and faster pull/start times than Server Core or Windows Server (Full) bases. Server Core includes additional components (GUI-less but still broad OS surface) and is used when you need APIs or frameworks not present in Nano. “Windows” or “Windows Server (Full)” are not container base images for modern Windows containers and would produce unnecessarily large layers. To meet the requirement “the image must be as small as possible” for a .NET Core app, the guidance is to select Nano Server as the base (for matching architecture and Windows version), then layer the .NET runtime or self-contained app on top. This choice aligns with best practices for minimizing footprint, improving density, and reducing network transfer during CI/CD.

In the Administering Windows Server Hybrid Core Infrastructure materials for storage and file systems, BitLocker Drive Encryption is described as a volume-level encryption technology that operates below the file system. The guides explain that BitLocker can be applied to operating system volumes (which must be NTFS) and to fixed data volumes. For data volumes, BitLocker supports encryption regardless of whether the volume is formatted with NTFS or ReFS, because encryption occurs at the block level; only the boot/OS volume requirement mandates NTFS. Therefore, on Server1, BitLocker can be used on C (NTFS), D (NTFS), and E (ReFS).

For quotas, the same coursework clarifies two quota mechanisms: NTFS disk quotas and FSRM quotas. The built-in NTFS disk quota feature is tied to the NTFS file system and enforces per-user limits based on file ownership on NTFS volumes only. ReFS does not implement NTFS disk quotas. (FSRM quotas, while more flexible, are also documented as being supported for NTFS volumes, and the exam objective commonly tests recognition that “NTFS disk quotas apply only to NTFS volumes.”) Consequently, disk quotas can be configured on C and D (both NTFS), but not on E (ReFS).

Thus, per the Windows Server administration guidance:

BitLocker: C, D, and E

Disk quotas: C and D only.

In the Administering Windows Server Hybrid Core Infrastructure content for File Services, Microsoft describes File Server Resource Manager (FSRM) as the feature used to control the types of files that users can store on file servers. The guide explains that a file screen “prevents users from saving unauthorized file types on a volume or in a folder by applying a file group (such as Audio and Video) or custom file name patterns (for example, *.mp4).” It further clarifies that file screening “does not affect access permissions to other files and folders and allows permitted file types to be stored without restriction.” By contrast, NTFS permissions govern access (read/write/modify) and “cannot filter by file extension,” and NTFS quotas and File Management Tasks address capacity and automated tasks, not content blocking. Therefore, to stop users from storing .MP4 while allowing all other files, you create a File Screen on the path to Share1 and block either the built-in Audio and Video file group or a custom pattern *.mp4. This aligns precisely with the exam guide’s directive that FSRM File Screening is the supported and intended method to restrict file types on Windows file shares while leaving other file operations unaffected.

ProcessA: All the containers and Server1

ProcessB: Container3 and Server1 only

Comprehensive and Detailed Explanation with all Administering Windows Server Hybrid Core Infrastructure documents: =

Understanding the visibility of processes within Windows Server containers depends entirely on the isolation mode used: Windows Server isolation (Process isolation) or Hyper-V isolation. According to official documents for Administering Windows Server Hybrid Core Infrastructure, these two modes determine how the container's kernel and processes interact with the host system.

Windows Server Isolation (Process Isolation): In this mode, containers share the same kernel as the host. Processes running inside the container are essentially standard processes on the host, albeit isolated through namespaces and resource controls. Consequently, a process running in a process-isolated container (like Container1 and Container2 in the exhibit) is visible from the host's Task Manager or Get-Process command, as well as from other containers sharing the same host kernel. Therefore, ProcessA can be verified as running from All the containers and Server1.

Hyper-V Isolation: This mode provides a more secure and isolated environment by running each container inside its own highly optimized virtual machine (utility VM). Because each container has its own private kernel, the host cannot "see" the internal processes of the container, and containers cannot see into each other. Container3 uses Hyper-V isolation. Therefore, ProcessC is only visible to the internal operating system of Container3 and, at a management level, to Server1 (the host). It is invisible to other containers (Container1, 2, and 4) because they are separated by kernel-level boundaries. Thus, you can verify ProcessC on Container3 and Server1 only.

An address exclusion in a DHCP scope simply removes one or more IP addresses (or a range) from the scope’s available lease pool so the DHCP server will never hand out those addresses to any client. The AZ-800/Windows Server Hybrid Core Infrastructure guidance explains: “Use exclusions to prevent specific addresses in a scope from being leased,” noting that exclusions are commonly used to protect addresses that are statically configured on devices or reserved for other purposes. Crucially, exclusions do not associate a particular address with a particular client; they only withhold those addresses from automatic allocation. If you created exclusions “for each printer,” the server would not lease those IPs at all, and the printers would not automatically receive them. To provide deterministic assignment while still using DHCP, you must configure DHCP reservations that bind each printer’s MAC address to its intended IP. Thus, exclusions alone do not meet the requirement that the printers are always assigned the same IP address by DHCP.

The AZ-800 materials emphasize Windows Admin Center (WAC) as the unified, browser-based management tool for Windows Server features including Storage Replica. The guidance explains two common installation modes: desktop mode (install WAC on a management workstation) and gateway mode (install on a management server). In either case, WAC remotely manages target servers (Server1/Server2) over WinRM/PowerShell—WAC does not need to be installed on the source or destination file servers to configure replication partnerships, volumes, or test failover. Best practice in the study content is to install WAC on a management computer and add the servers as managed nodes, then use the Storage Replica tool in WAC to create a partnership, select source/target volumes, and monitor replication health. Installing WAC on a domain controller is discouraged, and installing it directly on the file servers is unnecessary. Consequently, to configure Storage Replica between Server1 and Server2, you should install Windows Admin Center on the client management computer (CLIENT1) and use it to manage and configure the replication on both servers remotely.

In the Administering Windows Server Hybrid Core Infrastructure (AZ-800) study domain for Storage Spaces, Microsoft specifies that storage tiers are created within a single storage pool that contains two classes of media: a fast tier (typically SSD) and a standard/capacity tier (HDD). The guide states that storage tiers “use SSDs for frequently accessed (‘hot’) data and HDDs for less frequently accessed (‘cold’) data within the same storage pool,” and that tiering is available only when the pool includes both SSD and HDD devices. It further clarifies that different HDD spindle speeds (e.g., 7,200 vs 10,000 RPM) do not constitute different media types for tiering—they are all HDDs.

Applying these rules to the table:

Pool1 contains only HDDs (7,200-RPM and 10,000-RPM) and no SSDs, so it cannot host a tiered virtual disk.

Pool2 contains HDDs (10,000-RPM) and SSDs, satisfying the requirement for both media types; it can create a tiered virtual disk.

Pool3 contains HDDs (7,200-RPM) and SSDs, also satisfying the requirement; it can create a tiered virtual disk.

Therefore, only Pool2 and Pool3 support creating VDisk1 with storage tiers, making option A correct.

In the Administering Windows Server Hybrid Core Infrastructure materials, the Central Store for Administrative Templates (ADMX/ADML) is a domain-scoped repository located in SYSVOL at: \\\SYSVOL\\Policies\PolicyDefinitions. The guidance states that to standardize the templates used by all Group Policy editors, you create a folder named PolicyDefinitions under the Policies folder in SYSVOL and copy the ADMX/ADML files there. Because the Central Store is per domain (not forest-wide), Group Policy Management Editor loads templates from the Central Store of the domain that contains the GPO being edited. Therefore, in a forest with multiple domains (for example, contoso.com and east.contoso.com), you must create a Central Store in each domain’s SYSVOL so that administrators get a consistent template set regardless of which domain’s GPOs they edit.

The documentation also notes that creating the Central Store on any domain controller in the domain is sufficient because DFS Replication (or FRS in very old deployments) will replicate the PolicyDefinitions contents to all DCs in that domain automatically. Thus, to cover the entire forest shown, you create PolicyDefinitions on DC1 (contoso.com) and DC2 (east.contoso.com). Creating it on Server1 is irrelevant because the Central Store must be in SYSVOL on DCs, not on member servers.

The Hyper-V networking section of the Administering Windows Server Hybrid Core Infrastructure material explains that Hyper-V provides three virtual switch types: External, Internal, and Private. It states: “An External switch is bound to a physical NIC and can optionally connect the management OS; an Internal switch connects VMs to each other and to the host only; a Private switch connects VMs to each other only (no host access).” The guide further clarifies limits on external switches: “A single physical adapter can be bound to only one External virtual switch at a time (unless using NIC Teaming). Additional External switches require additional physical adapters.”

In the exhibit, Server1 has a single NIC already bound to vSwitch3, and the tree shows ‘Microsoft Hyper-V Network Adapter’, indicating the management OS shares the adapter. Therefore, you cannot add another External switch with the lone NIC; you can still create Internal and Private switches.

Regarding host connectivity, the guide specifies: “The management OS can communicate with VMs attached to an Internal switch and to an External switch (when the management OS is connected). The host cannot communicate with VMs on a Private switch.” Consequently, Server1 can access network shares only from VMs on vSwitch2 (Internal) or vSwitch3 (External with management OS), but not from VMs on vSwitch1 (Private).

The Administering Windows Server Hybrid Core Infrastructure learning path explains that onboarding Windows Server machines to Azure Monitor hinges on a Log Analytics workspace as the data store for logs and metrics, and an agent on the machine to collect and send data. The guide states that “Azure Monitor collects telemetry from Windows Server machines into a Log Analytics workspace,” and that for current deployments you should “install the Azure Monitor agent (AMA) on each computer and associate it with a workspace.” It further notes that “the AMA replaces the legacy Log Analytics agent” and “uses data collection rules (DCRs) to define which data to collect and to which Log Analytics workspace to send it.” Storage accounts, SQL databases, or analytics gateways are not required to onboard a standalone Windows Server to Azure Monitor. Likewise, Device Health Attestation is unrelated to Azure Monitor onboarding.

In short, to monitor an on-premises Windows Server from Azure you create a Log Analytics workspace in the subscription and install the Azure Monitor agent on the server. (In practice, you then configure a DCR to route data from the AMA to the workspace, but no additional Azure resources like SQL or Blob/Azure Files are needed for basic monitoring.)

In the context of Windows Server Hybrid Core Infrastructure and container networking, choosing the correct network driver is critical for application deployment. According to official documentation, the l2bridge (Layer 2 Bridge) network mode is used when container hosts are connected to the same IP subnet. In this configuration, each container is assigned an IP address from the same prefix as the container host. All container traffic is bridged to the physical network through an external Hyper-V Virtual Switch. Because the containers share the same underlying network infrastructure as the host, they are visible to the rest of the physical network without requiring Network Address Translation (NAT).

The documentation specifies that for multi-node clusters or deployments where containers must be directly reachable on the physical network via their own IP addresses, l2bridge is the standard choice. This differs from NAT, which uses a private internal IP range and translates traffic through the host's IP, and Transparent mode, which is often used for individual hosts where the container is directly connected to the physical network but can have complexities in virtualized environments. l2tunnel is specifically used for Microsoft Cloud Stack (Azure Stack HCI) and SDN scenarios, typically involving encapsulation, which is not the standard requirement for a general multi-container application deployment on a single server unless specified. Therefore, for a high-performance, direct-access network that bridges traffic at Layer 2, l2bridge is the verified architectural choice for Windows containers.

In Hyper-V, access to local devices such as a USB hard drive connected to the management computer (Server1) from within a VM session (VM1) is provided only when using Enhanced Session Mode through the Virtual Machine Connection (vmconnect) client. The AZ-800/“Administering Windows Server Hybrid Core Infrastructure” materials emphasize that Enhanced Session Mode “enables redirection of local resources (audio, clipboard, printers, drives, and supported Plug and Play devices) to a guest when connecting with Virtual Machine Connection.” To use it, you must first enable it on the host and then select the device in vmconnect before establishing the session.

Accordingly, you should:

Enable Enhanced Session on the host: In Hyper-V Manager → Host1 → Hyper-V Settings → Enhanced Session Mode Policy, select Allow enhanced session mode (and optionally Use enhanced session mode under User settings). This satisfies option A.

Choose the USB drive in the vmconnect UI: When launching the connection to VM1, click Show Options → Local Resources → More…, and select Drives or the specific USB device so it is redirected into the guest. This matches option D.

Options B and E relate to host Disk Management operations and do not provide guest redirection of a USB attached to Server1. Option C (“switch to a basic session”) explicitly disables the RDP-based redirection channel that Enhanced Session Mode relies upon, preventing USB/drive passthrough. Therefore, the correct pair is A and D.