Microsoft Certification
62 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Microsoft Administering Windows Server Hybrid Core Infrastructure (AZ-800) certification validates professional expertise in Microsoft technologies. This study guide covers all 62 practice questions from our AZ-800 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
You need to configure Windows Admin Center to manage multiple Windows Server instances across different geographical locations. What is the first step you should take?
Windows Admin Center should be installed on a dedicated management machine, not on domain controllers or target servers. It provides a centralized management interface for multiple servers.
Your organization requires audit logs for all administrative actions on Windows Server. Which Event Viewer log category should you monitor to track user logons and logoffs?
The Security event log records authentication events, including user logons, logoffs, and administrative actions. This is essential for compliance and security auditing.
You are configuring Group Policy to enforce password complexity requirements across your hybrid environment. Which Group Policy Object (GPO) setting should you modify?
Password policy settings are found under Computer Configuration > Windows Settings > Security Settings > Account Policies. These settings apply to local user accounts and domain accounts.
Your Windows Server 2019 instance is running low on disk space. You decide to implement Storage Spaces to increase capacity. What is a key requirement before creating a Storage Space?
Storage Spaces require multiple physical disks to be available for pooling, but they don't need to be identical in size. Storage Spaces can work with different disk sizes and editions of Windows Server.
You need to configure a Failover Cluster in your hybrid environment. What is the minimum number of nodes required for a functional Failover Cluster?
A Failover Cluster requires a minimum of two nodes to provide failover capabilities. Although three or more nodes are recommended for better quorum configuration, two is the functional minimum.
You are implementing Azure Hybrid Benefit licensing for Windows Server in your Azure subscription. Which existing licenses qualify for this benefit?
Azure Hybrid Benefit allows organizations with Software Assurance or qualifying volume licensing agreements to use their existing licenses in Azure, reducing overall costs.
Your organization uses Azure Arc to manage on-premises Windows Servers. Which agent must be installed on each on-premises server to enable Azure Arc management?
The Connected Machine Agent (also called Azure Arc agent) must be installed on on-premises servers to enable Azure Arc management and hybrid capabilities.
You need to implement a tiered storage solution that automatically moves files based on access patterns. Which Windows Server feature should you implement?
Storage Tiering within Storage Spaces automatically moves data between faster and slower storage tiers based on access frequency. This optimizes performance and cost.
Your Windows Server deployment requires Network Load Balancing (NLB) for a web application. What is the primary advantage of using NLB over a hardware load balancer?
NLB is a software-based load balancing solution that uses existing Windows Server resources, making it cost-effective for organizations that already have Windows Server infrastructure in place.
You are configuring DNS resolution in a hybrid environment. Your on-premises domain is corp.local and you need to resolve Azure-hosted resources. What DNS forwarding approach should you use?
Conditional forwarding allows on-premises DNS servers to forward queries for specific domains (like Azure resources) to Azure DNS servers, enabling hybrid name resolution.
Your organization needs to implement role-based access control (RBAC) for Windows Server resources. Which Azure service should you integrate with your Windows Servers for this purpose?
Azure AD integration with Windows Server enables RBAC capabilities, allowing you to manage access based on user roles and Azure AD group memberships in a hybrid environment.
You need to back up a critical Windows Server workload to Azure. Which Azure backup solution is specifically designed for virtual machines and physical servers?
Azure Backup with Recovery Services Vault provides comprehensive backup and restore capabilities specifically designed for Windows Servers, both on-premises and in Azure.
You are troubleshooting connectivity issues between an on-premises Windows Server and Azure resources. Which tool should you use to verify network connectivity at the protocol level?
The Test-NetConnection PowerShell cmdlet can verify TCP/IP connectivity to specific hosts and ports, making it ideal for troubleshooting Windows Server connectivity issues.
Your organization requires encryption for data in transit between on-premises and Azure. Which protocol should you implement for secure communication?
IPsec is commonly used for site-to-site VPN connectivity, while TLS/SSL is used for application-level encryption. Both are appropriate depending on your specific security requirements.
You need to configure a hybrid identity solution where on-premises Active Directory is synchronized with Azure AD. Which tool should you deploy on-premises?
Azure AD Connect (or Cloud Sync for simpler scenarios) synchronizes on-premises Active Directory identities with Azure AD, enabling hybrid identity management.
You are implementing Windows Server Update Services (WSUS) in your hybrid environment. What is the primary benefit of WSUS over relying solely on Windows Update?
WSUS enables centralized update management by allowing administrators to test, approve, and schedule updates before they are deployed to client systems, reducing deployment risks.
Your Windows Server is experiencing high CPU utilization. You need to identify which process is consuming the most resources. Which Performance Monitor object should you monitor?
The Processor object's % Processor Time counter shows CPU utilization by process, allowing you to identify resource-hungry applications.
You need to implement BitLocker Drive Encryption on a Windows Server in your data center. What is a prerequisite for enabling BitLocker on the OS drive?
While TPM 2.0 is recommended for secure key storage, BitLocker can function without it using other authentication methods. However, TPM provides the most secure implementation.
You are configuring remote access for Windows Server using Remote Desktop Services (RDS). Which component manages the licensing of RDS connections?
The RD Licensing server manages and issues RDS client access licenses (CALs), which are required for each user or device connecting via Remote Desktop Services.
Your organization needs to implement Shielded VMs in Hyper-V for enhanced security. Which encryption technology protects the VM's virtual hard disk?
Shielded VMs use BitLocker encryption for the virtual disk, Measured Boot with TPM 2.0 for attestation, and other technologies to protect VMs from unauthorized access.
You need to configure Data Deduplication on a Windows Server 2019 volume. Which data type does Data Deduplication work most effectively on?
Data Deduplication is most effective on backup data and archives where duplicate data is common. It's not recommended for active, frequently changing data due to performance impact.
Your Windows Server needs to replicate data to a disaster recovery site. Which feature provides synchronous or asynchronous replication of volumes?
Storage Replica provides block-level volume replication with both synchronous mode (for RPO=0) and asynchronous mode (for longer distances), making it ideal for disaster recovery scenarios.
You are implementing Server Core in your data center environment. What is the primary benefit of Server Core compared to the full Server with Desktop Experience installation?
Server Core reduces system resource requirements (CPU, memory, disk space) and has a smaller attack surface, making it ideal for production environments where efficiency is critical.
Your organization needs to implement just-in-time (JIT) access for privileged accounts on Windows Servers. Which Azure service enables this capability?
Azure Security Center provides JIT VM Access, which allows administrators to request temporary elevated access to servers, reducing the window of exposure for privileged credentials.
You need to configure Windows Defender Exploit Guard on Windows Server to protect against advanced threats. Which component provides memory protection against exploit techniques?
Exploit Protection in Windows Defender Exploit Guard uses mechanisms like DEP, ASLR, and Control Flow Guard to prevent memory-based exploits and zero-day attacks.
You need to deploy Windows Server 2022 on multiple servers in your organization. What is the primary advantage of using Windows Admin Center for deployment compared to traditional Server Manager?
Windows Admin Center is a browser-based management tool that provides unified management across hybrid infrastructures, combining on-premises and cloud resources.
Your organization uses Azure Arc to manage on-premises Windows Servers. Which of the following best describes the primary purpose of Azure Arc integration?
Azure Arc allows you to manage on-premises servers using Azure management tools and policies, treating them as Azure resources without requiring migration.
You are configuring Group Policy Objects (GPOs) for your hybrid environment. A policy setting needs to be applied to computers running Windows Server 2022 in both on-premises Active Directory and Azure AD-joined machines. What challenge might you face?
Azure AD-joined devices don't process traditional GPOs; instead, you must use Intune or other cloud-based management solutions to apply policies to these devices.
You need to implement Network Policy Server (NPS) for VPN access in your organization. When configuring RADIUS accounting, what does the accounting feature primarily track?
RADIUS accounting tracks session details including start/stop times, bytes sent/received, and connection events for auditing and billing purposes.
Your organization needs to configure DirectAccess for remote workers. Which of the following statements is most accurate regarding DirectAccess requirements?
DirectAccess requires specific infrastructure including public IP addresses, DNS proper configuration, and firewall rules, and works best with Windows Pro/Enterprise editions.
You are implementing a hybrid Active Directory infrastructure combining on-premises AD with Azure AD Connect. What is the primary function of Azure AD Connect Sync?
Azure AD Connect Sync synchronizes identities between on-premises AD and Azure AD, enabling hybrid identity and single sign-on capabilities across environments.
You need to manage certificate-based authentication for your hybrid infrastructure. When implementing PKI certificates on Windows Server, what is a critical consideration for certificate renewal?
Automated renewal at 80-90% of certificate lifetime prevents expiration-related service disruptions and is a best practice for certificate management.
You are troubleshooting replication issues in your Active Directory environment. What tool would you use to verify Active Directory replication health across domain controllers?
repadmin and dcdiag are the primary tools for diagnosing AD replication issues, providing detailed information about replication partners and health status.
Your organization is implementing Windows Server Update Services (WSUS) in a hybrid environment. Which statement accurately describes WSUS functionality in hybrid scenarios?
WSUS can manage both on-premises and Azure VM updates when properly configured with network connectivity and Group Policy settings.
You need to configure Storage Spaces Direct (S2D) for a converged infrastructure. What is the minimum number of servers required for a production Storage Spaces Direct cluster?
Storage Spaces Direct requires at least three nodes for production deployments to ensure quorum and maintain availability when a node fails.
When configuring Hyper-V in a hybrid environment, you need to ensure virtual machines can communicate across both on-premises and Azure. Which networking configuration is most appropriate?
External virtual switches with proper VLAN and routing configuration, combined with hybrid connectivity solutions like VPN or ExpressRoute, enable cross-environment communication.
You are implementing DNS security for your hybrid infrastructure. What does DNSSEC primarily protect against?
DNSSEC uses cryptographic signatures to validate that DNS responses are authentic and haven't been tampered with, preventing spoofing and cache poisoning attacks.
Your organization uses Windows Server failover clustering. When configuring cluster validation, what should the pre-deployment validation scan identify?
Cluster validation tests hardware compatibility, network connectivity, storage accessibility, and identifies potential configuration issues before deployment.
You need to implement Shielded VMs in your Hyper-V environment. What primary security feature do Shielded VMs provide that regular VMs do not?
Shielded VMs use encryption, measured boot, and vTPM to protect VM data and configuration from unauthorized access, even by Hyper-V administrators.
When managing file servers in a hybrid environment, you need to implement Data Deduplication. Which workload type is most suitable for deduplication?
Data Deduplication is most effective for backup, archive, file share, and VDI workloads where significant data redundancy exists across multiple files.
You are configuring Windows Defender for Endpoint in your organization. Which statement best describes its scope in a hybrid environment?
Windows Defender for Endpoint provides unified threat protection and monitoring across both on-premises and Azure environments through Microsoft Defender portal.
When implementing Windows Admin Center in your infrastructure, you discover it needs to manage servers that are not domain-joined. What authentication method should you configure for these non-domain-joined servers?
Windows Admin Center can authenticate to non-domain-joined servers using local credentials or certificates, providing flexibility for diverse server environments.
You are implementing IPAM (IP Address Management) for your hybrid infrastructure. What is a primary benefit of IPAM for managing both on-premises and cloud IP resources?
IPAM provides centralized IP address management, discovery, and monitoring across distributed environments, reducing conflicts and improving IP utilization.
Your organization needs to implement Software-Defined Networking (SDN) on Windows Server. Which component is responsible for centralizing network policy management?
Network Controller is the central management component in SDN that manages and orchestrates network infrastructure policies and configurations.
When configuring high availability for a critical application, you need to choose between failover clustering and Network Load Balancing (NLB). Which scenario is most appropriate for Network Load Balancing?
Network Load Balancing is ideal for stateless applications like web servers where requests can be distributed across nodes without requiring shared state or storage.
You are configuring BitLocker for full-disk encryption on your servers. Which prerequisite is necessary for BitLocker functionality on older hardware?
BitLocker works best with TPM 2.0 but can function with TPM 1.2 or without TPM using alternative authentication methods like USB keys or smart cards.
Your organization is implementing Azure File Sync to synchronize on-premises file shares with Azure file storage. What is the primary advantage of this solution?
Azure File Sync provides cloud-backed file sharing with local caching for performance, cloud tiering to reduce local storage, and centralized management.
When implementing Remote Access in Windows Server, you need to support both VPN and DirectAccess simultaneously. What consideration is most important for this hybrid approach?
Supporting both VPN and DirectAccess requires careful planning of security policies, certificate management, and network infrastructure to authenticate both connection types properly.
You need to monitor Windows Server performance in a hybrid environment. Which Performance Monitor counter would indicate potential issues with memory availability?
Memory Available MBytes indicates free physical memory; low values suggest memory pressure that can cause performance issues and require investigation.
Your organization uses Windows Server Update Services (WSUS) with Group Policy to manage patches. What is the primary advantage of using both WSUS and Group Policy together compared to using WSUS alone?
Group Policy provides centralized management of update policies and deadlines, while WSUS manages patch downloads and testing, creating a comprehensive update management solution.
When implementing Hyper-V Replica for disaster recovery, what is the key limitation you must understand about replicated virtual machines?
Hyper-V replicas must be recovered or failed over to become operational; running them simultaneously with primary VMs would cause data consistency issues.
You are configuring Windows Defender Firewall rules for a hybrid environment. When should stateful firewall rules be preferred over stateless rules?
Stateful firewall rules track connection states and automatically allow return traffic, making them more practical and secure for most production scenarios.
You need to configure Windows Server to support hybrid identity scenarios. Which Azure service allows you to synchronize on-premises Active Directory with Azure AD?
Azure AD Connect is the official Microsoft tool that synchronizes on-premises Active Directory objects with Azure AD, enabling hybrid identity management across cloud and on-premises environments.
You are implementing Windows Admin Center to manage both on-premises and Azure-based servers. What authentication method is required to connect to servers in Azure?
Windows Admin Center uses Azure AD credentials to authenticate connections to Azure-based resources, with support for Multi-Factor Authentication as part of Azure's security model.
Your organization uses Kerberos for authentication but plans to implement conditional access policies. Which component must be configured in the hybrid environment to enforce these policies for on-premises servers?
Azure AD Application Proxy with Kerberos constrained delegation allows conditional access policies to be applied to on-premises applications and services by routing authentication through Azure AD.
You need to back up a Hyper-V virtual machine that is critical for business operations. What is the minimum checkpoint requirement before performing a live backup?
Hyper-V live backups use Volume Shadow Copy Service (VSS) integration with the guest OS to create consistent backups without requiring pre-existing checkpoints.
You are configuring certificate-based authentication for a hybrid Windows Server infrastructure. Which certificate store should contain the root CA certificate for Azure services?
Root CA certificates for Azure and cloud services must be installed in the Trusted Root Certification Authorities store on the local computer to establish trusted authentication chains.
Your organization experiences intermittent Azure AD Connect synchronization failures. After investigation, you discover hash synchronization is conflicting with federated authentication attempts. What is the recommended resolution?
When federation is the primary authentication method, password hash synchronization should be disabled to avoid conflicts. Re-running the configuration wizard ensures proper setup of the federation-only scenario.
You deploy Windows Server storage replica between a primary and secondary site for disaster recovery. What is the maximum supported replication distance using asynchronous replication?
Asynchronous replication in Windows Server Storage Replica has no geographic distance limitation, making it suitable for long-distance disaster recovery scenarios unlike synchronous replication which requires lower latency.
You implement Desired State Configuration (DSC) in a hybrid environment with both on-premises and Azure servers. A configuration drift is detected on an Azure VM. What is the most efficient method to remediate the drift automatically?
DSC's Local Configuration Manager in Enforcement mode with auto-correction enabled automatically detects and remediates configuration drift without manual intervention, ideal for hybrid environments.
Your organization requires Multi-Factor Authentication for administrative access to critical servers in a hybrid environment. Which method integrates with Azure AD for cloud-based MFA?
Azure MFA Server or Azure AD MFA integrated with Conditional Access policies provides cloud-based MFA that can enforce requirements across both on-premises and Azure resources in a hybrid environment.
You configure a Hybrid Runbook Worker to execute scripts on on-premises servers from Azure Automation. The runbook fails to authenticate to on-premises resources using a managed identity. What is the most likely cause?
Hybrid Runbook Workers require appropriate local permissions on the on-premises system to execute runbooks and access resources; managed identities alone do not automatically grant these permissions.
You've reviewed all 62 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free