6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

- Expert Verified, Online, Free.

 Custom View Settings

Topic 1 - Question Set 1

Question #1 Topic 1

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
You need to identify which server is the PDC emulator for the domain.
Solution: From Active Directory Domains and Trusts, you right-click Active Directory Domains and Trusts in the console tree, and then select
Operations
Master.
Does this meet the goal?

A. Yes

B. No

Question #2 Topic 1

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
You need to identify which server is the PDC emulator for the domain.
Solution: From a command prompt, you run netdom.exe query fsmo.
Does this meet the goal?

A. Yes

B. No

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 1/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #3 Topic 1

You have an on premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant.
You plan to implement self-service password reset (SSPR) in Azure AD.
You need to ensure that users that reset their passwords by using SSPR can use the new password resources in the AD DS domain.
What should you do?

A. Deploy the Azure AD Password Protection proxy service to the on premises network.

B. Run the Microsoft Azure Active Directory Connect wizard and select Password writeback.

C. Grant the Change password permission for the domain to the Azure AD Connect service account.

D. Grant the impersonate a client after authentication user right to the Azure AD Connect service account.

Question #4 Topic 1

You have an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.
You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least
privilege.
To which group should you add the administrator?

A. AAD DC Administrators

B. Domain Admins

C. Schema Admins

D. Enterprise Admins

E. Group Policy Creator Owners

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 2/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #5 Topic 1

DRAG DROP -
You create a new Azure subscription.
You plan to deploy Azure Active Directory Domain Services (Azure AD DS) and Azure virtual machines.
You need to ensure that the virtual machines can join to Azure AD DS.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and
arrange them in the correct order.
Select and Place:

Question #6 Topic 1

HOTSPOT -
You have an Azure Active Directory Domain Services (Azure AD DS) domain.
You create a new user named Admin1.
You need Admin1 to deploy custom Group Policy settings to all the computers in the domain. The solution must use the principle of least
privilege.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 3/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #7 Topic 1

DRAG DROP -
Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active
Directory site.
You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the
local
Administrators group on Server1.
You need to recommend a deployment plan that meets the following requirements:
✑ Ensures that a user named User1 can perform the RODC installation on Server1
✑ Ensures that you can control the AD DS replication schedule to the Server1
✑ Ensures that Server1 is in a new site named RemoteSite1
Uses the principle of least privilege

Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the
answer area and arrange them in the correct order.
Select and Place:

Question #8 Topic 1

Your network contains an Active Directory Domain Services (AD DS) domain. The network also contains 20 domain controllers, 100 member
servers, and 100 client computers.
You have a Group Policy Object (GPO) named GPO1 that contains Group Policy preferences.
You plan to link GPO1 to the domain.
You need to ensure that the preference in GPO1 apply only to domain member servers and NOT to domain controllers or client computers. All the
other Group
Policy settings in GPO1 must apply to all the computers. The solution must minimize administrative effort.
Which type of item level targeting should you use?

A. Domain

B. Operating System

C. Security Group

D. Environment Variable

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 4/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #9 Topic 1

DRAG DROP -
You deploy a new Active Directory Domain Services (AD DS) forest named contoso.com. The domain contains three domain controllers named
DC1, DC2, and
DC3.
You rename Default-First-Site-Name as Site1.
You plan to ship DC1, DC2, and DC3 to datacenters in different locations.
You need to configure replication between DC1, DC2, and DC3 to meet the following requirements:
✑ Each domain controller must reside in its own Active Directory site.
✑ The replication schedule between each site must be controlled independently.
✑ Interruptions to replication must be minimized.
Which three actions should you perform in sequence in the Active Directory Sites and Services console? To answer, move the appropriate actions
from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 5/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #10 Topic 1

Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The root domain contains the domain controllers
shown in the following table.

A failure of which domain controller will prevent you from creating application partitions?

A. DC1

B. DC2

C. DC3

D. DC4

E. DC5

Question #11 Topic 1

Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the objects
shown in the following table.

You plan to sync contoso.com with an Azure Active Directory (Azure AD) tenant by using Azure AD Connect.
You need to ensure that all the objects can be used in Conditional Access policies.
What should you do?

A. Select the Configure Hybrid Azure AD join option.

B. Change the scope of Group1 and Group2 to Global.

C. Clear the Configure device writeback option.

D. Change the scope of Group2 to Universal.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 6/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #12 Topic 1

Your network contains a multi-site Active Directory Domain Services (AD DS) forest. Each Active Directory site is connected by using manually
configured site links and automatically generated connections.
You need to minimize the convergence time for changes to Active Directory.
What should you do?

A. For each site link, modify the replication schedule.

B. For each site links, modify the site link costs.

C. Create a site link bridge that contains all the site links.

D. For each site link, modify the options attribute.

Question #13 Topic 1

DRAG DROP -
You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.
You deploy five servers to the domain. You add the servers to a group named ITFarmHosts.
You plan to configure a Network Load Balancing (NLB) cluster named NLBCluster.contoso.com that will contain the five servers.
You need to ensure that the NLB service on the nodes of the cluster can use a group managed service account (gMSA) to authenticate.
Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area
and arrange them in the correct order.
Select and Place:

Question #14 Topic 1

You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant.
You have several Windows 10 devices that are Azure AD hybrid-joined.
You need to ensure that when users sign in to the devices, they can use Windows Hello for Business.
Which optional feature should you select in Azure AD Connect?

A. Device writeback

B. Group writebeack

C. Azure AD app and attribute filtering

D. Password writeback

E. Directory extension attribute sync

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 7/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #15 Topic 1

HOTSPOT -
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a child domain named
east.contoso.com.
In the contoso.com domain, you create two users named Admin1 and Admin2.
You need to ensure that the users can perform the following tasks:
✑ Admin1 can create and manage Active Directory sites.
✑ Admin2 can deploy domain controllers to the east.contoso.com domain.
The solution must use the principle of least privilege.
To which group should you add each user? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Question #16 Topic 1

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2,
and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK.
You open a new branch office that contains only client computers.
You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.
Solution: You create an organization unit (OU) that contains the client computers in the branch office. You configure the Try Next Closest Site
Group Policy Object
(GPO) setting in a GPO that is linked to the new OU.
Does this meet the goal?

A. Yes

B. No

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 8/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #17 Topic 1

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2,
and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK.
You open a new branch office that contains only client computers.
You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.
Solution: You create a new site named Site4 and associate Site4 to DEFAULTSITELINK.
Does this meet the goal?

A. Yes

B. No

Question #18 Topic 1

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2,
and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK.
You open a new branch office that contains only client computers.
You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.
Solution: You configure the Try Next Closest Site Group Policy Object (GPO) setting in a GPO that is linked to Site1.
Does this meet the goal?

A. Yes

B. No

Question #19 Topic 1

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
You need to identify which server is the PDC emulator for the domain.
Solution: From Active Directory Sites and Services, you right-click Default-First-Site-Name in the console tree, and then select Properties.
Does this meet the goal?

A. Yes

B. No

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 9/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #20 Topic 1

Your network contains a single-domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the servers
shown in the following exhibit table.

You plan to install a line-of-business (LOB) application on Server1. The application will install a custom Windows service.
A new corporate security policy states that all custom Windows services must run under the context of a group managed service account (gMSA).
You deploy a root key.
You need to create, configure, and install the gMSA that will be used by the new application.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point

A. On Server1, run the setspn command.

B. On DC1, run the New-ADServiceAccount cmdlet.

C. On Server1, run the Install-ADServiceAccount cmdlet.

D. On Server1, run the Get-ADServiceAccount cmdlet.

E. On DC1, run the Set-ADComputer cmdlet.

F. On DC1, run the Install-ADServiceAccount cmdlet.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 10/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #21 Topic 1

HOTSPOT -
Your network contains three Active Directory Domain Services (AD DS) forests as shown in the following exhibit.

The network contains the users shown in the following table.

The network contains the security groups shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise. select No.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 11/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #22 Topic 1

Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest root domain contains a server named
server1.contoso.com.
A two-way forest trust exists between the contoso.com forest and an AD DS forest named fabrikam.com. The fabrikam.com forest contains 10
child domains.
You need to ensure that only the members of a group named fabrikam\Group1 can authenticate to server1.contoso.com.
What should you do first?

A. Add fabrikam\Group1 to the local Users group on server1.contoso.com.

B. Enable SID filtering for the trust.

C. Enable Selective authentication for the trust.

D. Change the trust to a one-way external trust.

Question #23 Topic 1

Your network contains an Active Directory forest. The forest contains two domains named contoso.com and east.contoso.com and the servers
shown in the following table.

Contoso.com contains a user named User1.

You add User1 to the built-in Backup Operators group in contoso.com.

Which servers can User1 back up?

A. DC1 only

B. Server1 only

C. DC1 and DC2 only

D. DC1 and Server1 only

E. DC1, DC2, Server1, and Server2

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 12/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #24 Topic 1

HOTSPOT
-

Your network contains an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.

You need to configure a password policy for the local user accounts on the Azure virtual machines joined to contoso.com.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Question #25 Topic 1

SIMULATION
-

You need to create a user named Admin1 in contoso.com. Admin1 must be able to back up and restore files on SRV1. The solution must use
principle of the least privilege.

To complete this task, sign in the required computer or computers.

Question #26 Topic 1

SIMULATION
-

You need to ensure that the minimum password length for members of the BranchAdmins group is 12 characters. The solution must affect only
the BranchAdmins group.

To complete this task, sign in the required computer or computers.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 13/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #27 Topic 1

SIMULATION
-

You need to configure a Group Policy preference to ensure that users in the organizational unit (OU) named Server Admins have a shortcut to a
folder named \\srv1.contoso.com\data on their desktop when they sign in to the computers in the domain.

To complete this task, sign in the required computer or computers.

Question #28 Topic 1

SIMULATION
-

You plan to promote a domain controller named DC3 in a site in Seattle.

You need to ensure that DC3 only replicates with DC1 and DC2 between 8 PM and 6 AM.

To complete this task, sign in the required computer or computers.

Question #29 Topic 1

SIMULATION
-

You need to ensure that DC2 is the schema master for contoso.com.

To complete this task, sign in the required computer or computers.

Question #30 Topic 1

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain
controllers.

You plan to store a DNS zone in a custom Active Directory partition.

You need to create the Active Directory partition for the zone. The partition must replicate to only four of the domain controllers.

What should you use?

A. Windows Admin Center

B. DNS Manager

C. Active Directory Sites and Services

D. ntdsutil.exe

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 14/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #31 Topic 1

DRAG DROP
-

Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active
Directory site.

You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the
local Administrators group on Server1.

You need to recommend a deployment plan that meets the following requirements:

• Ensures that a user named User1 can perform the RODC installation on Server1
• Ensures that Server1 is in a new site named RemoteSite1
• Uses the principle of least privilege

Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the
answer area and arrange them in the correct order.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 15/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #32 Topic 1

Your network contains an Active Directory domain named contoso.com. The domain contains the computers shown in the following table.

On Server3, you create a Group Policy Object (GPO) named GPO1 and link GPO1 to contoso.com. GPO1 includes a shortcut preference named
Shortcut1 that has item-level targeting configured as shown in the following exhibit.

To which computer will Shortcut1 be applied?

A. Server3 only

B. Computer1 and Server3 only

C. Server2 and Server3 only

D. Server1, Server2, and Server3 only

Question #33 Topic 1

Your network contains a multi-site Active Directory Domain Services (AD DS) forest. Each Active Directory site is connected by using manually
configured site links and automatically generated connections.

You need to minimize the latency for changes to Active Directory.

What should you do?

A. For each site links, modify the site link costs.

B. Create a site link bridge that contains all the site links.

C. For each site link, modify the options attribute.

D. For each site link, modify the replication schedule.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 16/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #34 Topic 1

DRAG DROP
-

Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. Contoso.com contains three
child domains named amer.contoso.com, apac.contoso.com, and emea.contoso.com. Fabrikam.com contains a child domain named
apac.fabrikam.com. A bidirectional forest trust exists between contoso.com and fabrikam.com.

You need to provide users in the contoso.com forest with access to the resources in the fabrikam.com forest. The solution must meet the
following requirements:

• Users in contoso.com must only be added directly to groups in the contoso.com forest.
• Permissions to access the resources in fabrikam.com must only be granted directly to groups in the fabrikam.com forest.
• The number of groups must be minimized.

Which type of groups should you use to organize the users and to assign permissions? To answer, drag the appropriate group types to the correct
requirements. Each group may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view
content.

NOTE: Each correct selection is worth one point.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 17/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #35 Topic 1

HOTSPOT
-

Your network contains two Active Directory forests and a domain trust as shown in the following exhibit.

The domain trust has the following configurations:

• Name: adatum.com
• Type: External
• Direction: One-way, outgoing
• Outgoing trust authentication level: Domain-wide authentication

The forests contain the users shown in the following table.

The forests contain the network shares shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 18/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #36 Topic 1

HOTSPOT
-

Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a child named
east.contoso.com and the servers shown in the following table.

You need to create a folder for the Central Store to manage Group Policy template files for the entire forest.

What should you name the folder, and on which server should you create the folder? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 19/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #37 Topic 1

HOTSPOT
-

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the domain controllers shown in the following
table.

You need to configure DC3 to be the authoritative time server for the domain.

Which operations master role should you transfer to DC3, and which console should you use? To answer, select the appropriate options in the
answer area.

NOTE: Each correct selection is worth one point.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 20/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #38 Topic 1

DRAG DROP
-

Your network contains an Active Directory domain named contoso.com. The domain contains group managed service accounts (gMSAs). You
have a server named Server1 that runs Windows Server and is in a workgroup. Server1 hosts Windows containers.

You need to ensure that the Windows containers can authenticate to contoso.com.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and
arrange them in the correct order.

Question #39 Topic 1

Your on-premises network contains an Active Directory domain named contoso.com. You have an Azure AD tenant.

You plan to sync contoso.com with the Azure AD tenant by using Azure AD Connect cloud sync.

You need to create an account that will be used by Azure AD Connect cloud sync.

Which type of account should you create?

A. system-assigned managed identity

B. group managed service account (gMSA)

C. user

D. InetOrgPerson

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 21/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 2 - Question Set 2

Question #1 Topic 2

HOTSPOT -
You have 10 on-premises servers that run Windows Server.
You plan to use Azure Network Adapter to connect the servers to the resources in Azure.
Which prerequisites do you require on-premises and in Azure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Question #2 Topic 2

DRAG DROP -
You have a server named Server1 that has Windows Admin Center installed. The certificate used by Windows Admin Center was obtained from a
certification authority (CA).
The certificate expires.
You need to replace the certificate.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and
arrange them in the correct order.
Select and Place:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 22/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #3 Topic 2

HOTSPOT -
You have an on-premises server named Server1 that runs Windows Server and has internet connectivity.
You have an Azure subscription.
You need to monitor Server1 by using Azure Monitor.
Which resources should you create in the subscription, and what should you install on Server1? To answer, select the appropriate options in the
answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Question #4 Topic 2

You have an on premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. The
domain contains two servers named Server1 and Server2.
A user named Admin1 is a member of the local Administrators group on Server1 and Server2.
You plan to manage Server1 and Server2 by using Azure Arc. Azure Arc objects will be added to a resource group named RG1.
You need to ensure that Admin1 can configure Server1 and Server2 to be managed by using Azure Arc.
What should you do first?

A. From the Azure portal, generate a new onboarding script.

B. Assign Admin1 the Azure Connected Machine Onboarding role for RG1.

C. Hybrid Azure AD join Server1 and Server2.

D. Create an Azure cloud-only account for Admin1.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 23/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #5 Topic 2

HOTSPOT -
Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. A two-way forest trust
exists between the forests. Each forest contains a single domain.
The domains contain the servers shown in the following table.

You need to configure resource based constrained delegation so that the users in contoso.com can use Windows Admin Center on Server1 to
connect to Server2.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 24/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #6 Topic 2

HOTSPOT -
You have a server named Server1 that runs Windows Server and has the Hyper-V server role installed.
You need to limit which Hyper-V module cmdlets helpdesk users can use when administering Server1 remotely.
You configure Just Enough Administration (JEA) and successfully build the role capabilities and session configuration files.
How should you complete the PowerShell command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Question #7 Topic 2

You have an Azure virtual machine named VM1 that runs Windows Server.
You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You need to ensure that you can use the Azure Policy guest configuration feature to manage VM1.
What should you do?

A. Add the PowerShell Desired State Configuration (DSC) extension to VM1.

B. Configure VM1 to use a user-assigned managed identity.

C. Configure VM1 to use a system-assigned managed identity.

D. Add the Custom Script Extension to VM1.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 25/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #8 Topic 2

HOTSPOT -
You have an Azure subscription named sub1 and 500 on-premises virtual machines that run Windows Server.
You plan to onboard the on-premises virtual machines to Azure Arc by running the Azure Arc deployment script.
You need to create an identity that will be used by the script to authenticate access to sub1. The solution must use the principle of least privilege.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Question #9 Topic 2

You have an Azure virtual machine named VM1 that has a private IP address only.
You configure the Windows Admin Center extension on VM1.
You have an on-premises computer that runs Windows 11. You use the computer for server management.
You need to ensure that you can use Windows Admin Center from the Azure portal to manage VM1.
What should you configure?

A. an Azure Bastion host on the virtual network that contains VM1.

B. a VPN connection to the virtual network that contains VM1.

C. a private endpoint on the virtual network that contains VM1.

D. a network security group (NSG) rule that allows inbound traffic on port 443.

Question #10 Topic 2

Your company has a main office and a branch office. The two offices are connected by using a WAN link. Each office contains a firewall that filters
WAN traffic.
The network in the branch office contains 10 servers that run Windows Server. All servers are administered from the main office only.
You plan to manage the servers in the branch office by using a Windows Admin Center gateway.
On a server in the branch office, you install the Windows Admin Center gateway by using the defaults settings.
You need to configure the firewall in the branch office to allow the required inbound connection to the Windows Admin Center gateway.
Which inbound TCP port should you allow?

A. 443

B. 3389

C. 5985

D. 6516

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 26/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #11 Topic 2

You have an Azure subscription that contains the following resources.

✑ An Azure Log Analytics workspace
✑ An Azure Automation account
✑ Azure Arc
You have an on-premises server named Server1 that is onboarded to Azure Arc.
You need to manage Microsoft updates on Server1 by using Azure Arc.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. From the Automation account, enable Update Management for Server1.

B. From the Virtual machines data source of the Log Analytics workspace, connect Server1.

C. On Server1, install the Azure Monitor agent

D. Add Microsoft Sentinel to the Log Analytics workspace

Question #12 Topic 2

HOTSPOT -
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant.
You have an on-premises web app named WebApp1 that only supports Kerberos authentication.
You need to ensure that users can access WebApp1 by using their Azure AD account. The solution must minimize administrative effort.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 27/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #13 Topic 2

SIMULATION
-

You need to collect errors from the System event log of SRV1 to a Log Analytics workspace.

The required source files are located in a folder named \\dc1.contoso.com\install.

To complete this task, sign in the required computer or computers.

Question #14 Topic 2

HOTSPOT
-

Your on-premises network contains an Active Directory domain named contoso.com and 500 servers that run Windows Server. All the servers are
Azure Arc-enabled and joined to contoso.com.

You need to implement PowerShell Desired State Configuration (DSC) on all the servers. The solution must minimize administrative effort.

Where should you store the DSC scripts, and what should you use to apply DSC to the servers? To answer, select the appropriate options in the
answer area.

NOTE: Each correct selection is worth one point.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 28/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 3 - Question Set 3

Question #1 Topic 3

You have a server named Host1 that has the Hyper-V server role installed. Host1 hosts a virtual machine named VM1.
You have a management server named Server1 that runs Windows Server. You remotely manage Host1 from Server1 by using Hyper-V Manager.
You need to ensure that you can access a USB hard drive connected to Server1 when you connect to VM1 by using Virtual Machine Connection.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. From the Hyper-V Settings of Host1, select Allow enhanced session mode.

B. From Virtual Machine Connection, select Show Options, and then select the USB hard drive.

C. From Virtual Machine Connection, switch to a basic session.

D. From Disk Management on Host1, select Rescan Disks.

E. From Disk Management on Host1, attach a virtual hard disk.

Question #2 Topic 3

You have a Windows Server container host named Server1 and a container image named image1.
You need to start a container from image1. The solution must run the container on a Hyper-V virtual machine.
Which parameter should you specify when you run the docker run command?

A. --expose

B. --privileged

C. --runtime

D. --isolation

E. --entrypoint

Question #3 Topic 3

You plan to deploy a containerized application that requires .NET Core.

You need to create a container image for the application. The image must be as small as possible.
Which base image should you use?

A. Windows Server

B. Nano Server

C. Windows

D. Server Core

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 29/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #4 Topic 3

You have an Azure virtual machine named VM1 that runs Windows Server.
You perform the following actions on VM1:
✑ Create a folder named Folder1 on volume C.
✑ Create a folder named Folder2 on volume D.
✑ Add a new data disk to VM1 and create a new volume that is assigned drive letter E.
✑ Install an app named App1 on volume E.
You plan to resize VM1.
Which objects will present after you resize VM1?

A. Folder1, volume E, and App1 only

B. Folder1 only

C. Folder1 and Folder2 only

D. Folder1, Folder2, App1, and volume E

Question #5 Topic 3

You have an Azure virtual machine named VM1 that runs Windows Server and has the following configurations:
✑ Size: D2s_v4
✑ Operating system disk: 127-GiB standard SSD
✑ Data disk 128-GiB standard SSD
✑ Virtual machine generation: Gen 2
You plan to perform the following changes to VM1:
✑ Change the virtual machine size to D4s_v4.
✑ Detach the data disk.
✑ Add a new standard SSD.
Which changes require downtime for VM1?

A. Detaching the data disk only and adding a new standard SSD.

B. Detaching the data disk only.

C. Changing the virtual machine size only.

D. Adding a new standard SSD only.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 30/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #6 Topic 3

HOTSPOT -
You have a Windows Server container host named Server1 that has a single disk.
On Server1, you plan to start the containers shown in the following table.

Which isolation mode can you use for each container? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 31/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #7 Topic 3

DRAG DROP -
You have a server named Server1 that runs Windows Server and has the Hyper V server role installed. Server1 hosts a virtual machine named
VM1.
Server1 has an NVMe storage device. The device is currently assigned to VM1 by using Discrete Device Assignment.
You need to make the device available to Server1.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and
arrange them in the correct order.
Select and Place:

Question #8 Topic 3

You have a server named Server1 that hosts Windows containers.

You plan to deploy an application that will have multiple containers. Each container will be on the same subnet. Each container requires a separate
MAC address and IP address. Each container must be able to communicate by using its IP address.
You need to create a Docker network that supports the deployment of the application.
Which type of network should you create?

A. NAT

B. transparent

C. I2bridge

D. I2tunnel

Question #9 Topic 3

You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant.
You plan deploy 100 new Azure virtual machines that will run Windows Server.
You need to ensure that each new virtual machine is joined to the AD DS domain.
What should you use?

A. an Azure Resource Manager (ARM) template

B. a Group Policy Object (GPO)

C. Azure AD Connect

D. an Azure management group

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 32/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #10 Topic 3

Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains three servers
that run
Windows Server and have the Hyper-V server role installed. Each server has a Switch Embedded Teaming (SET) team.
You need to verify that Remote Direct Memory Access (RDMA) and all the required Windows Server settings are configured properly on each server
to support an
Azure Stack HCI cluster.
What should you use?

A. Server Manager

B. the Get-NetAdapter cmdlet

C. Failover Cluster Manager

D. the Validate-DCB cmdlet

Question #11 Topic 3

HOTSPOT -
You plan to deploy an Azure virtual machine that will run Windows Server.
You need to ensure that an Azure Active Directory (Azure AD) user named [email protected] can connect to the virtual machine by using the
Azure Serial
Console.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 33/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #12 Topic 3

HOTSPOT -
You have a Windows Server container host named Server1 and an Azure subscription.
You deploy an Azure container registry named Registry1 to the subscription.
On Server1, you create a container image named image1.
You need to store image1 in Registry1.
Which command should you run on Server1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Question #13 Topic 3

HOTSPOT -
You plan to deploy an Azure virtual machine that will run Windows Server. The virtual machine will host an Active Directory Domain Services (AD
DS) domain controller and a drive named F: on a new virtual disk.
You need to configure storage for the virtual machine. The solution must meet the following requirements:
* Maximize resiliency for AD DS.
* Prevent accidental data loss.
How should you configure the storage? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 34/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #14 Topic 3

DRAG DROP -
You create an Azure virtual machine named Server1 that runs Windows Server.
Server1 has the disk configurations shown in the following exhibit.

You need to create a new 100-GB volume on Server1.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and
arrange them in the correct order.
Select and Place:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 35/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #15 Topic 3

You have an Azure virtual machine named Server1 that runs a network management application. Server1 has the following network configurations:
* Network interface: Nic1
* IP address: 10.1.1.1/24
* Connected to: Vnet1/Subnet1
You need to connect Server1 to an additional subnet named Vnet1/Subnet2.
What should you do?

A. Modify the IP configurations of Nic1.

B. Add an IP configuration to Nic1.

C. Add a network interface to Server1.

D. Create a private endpoint on Subnet2.

Question #17 Topic 3

SIMULATION
-

You need to enable nested virtualization for a virtual machine named VM1 on SRV1.

To complete this task, sign in the required computer or computers.

Question #18 Topic 3

SIMULATION
-

SRV1 contains a virtual machine named VM1.

You need attach c:\vhds\Disk1.vhdx to VM1. The solution must ensure that Disk1 can be expanded dynamically when VM1 runs.

To complete this task, sign in the required computer or computers.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 36/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #19 Topic 3

You have an Azure subscription that contains the virtual networks shown in the following table.

You deploy a virtual machine named VM1 that runs Windows Server. VM1 is connected to Subnet11.

You plan to add an additional network interface named NIC1 to VM1.

To which subnets can NIC1 be attached?

A. Subnet11 only

B. Subnet12 only

C. Subnet11 and Subnetl2 only

D. Submet12 and Subnet21 only

E. Subnet11, Subnet12, Subnet21, and Subnet31

Question #20 Topic 3

DRAG DROP
-

You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. VM1 contains a 128-GB
operating system disk.

You need to increase the size of volume C on VM1 to 250 GB.

Which four actions should you perform in sequence.

To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 37/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #21 Topic 3

You have an Azure subscription that contains a virtual machine named VM1 as shown in the following exhibit.

The subscription has the disks shown in the following table.

Which disks can you attach as data disks to VM1?

A. Disk2 only

B. Disk4 only

C. Disk1 and Disk2 only

D. Disk2 and Disk4 only

E. Disk1, Disk3, and Disk4 only

F. Disk1, Disk2, Disk3, and Disk4

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 38/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #22 Topic 3

HOTSPOT
-

Your on-premises network contains a server named Server1 and uses an IP address space of 192.168.10.0/24.

You have an Azure virtual network that contains a subnet named Subnet1. Subnet1 uses an IP address space of 192.168.10.0/24.

You need to migrate Server1 to Subnet1. You must use Azure Extended Network to maintain the existing IP address of Server1.

What is the minimum number of virtual machines that you should deploy? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 39/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #23 Topic 3

HOTSPOT
-

You have a server named Server1 that has the Hyper-V server role installed. Server1 hosts the virtual machines shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

NOTE: Each correct selection is worth one point.

Question #24 Topic 3

You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server.

You build an app named App1.

You need to configure continuous integration and continuous deployment (CI/CD) of App1 to VM1.

What should you create first?

A. an App Service Environment

B. an Azure DevOps organization

C. a managed identity

D. an Azure Automation account

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 40/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #25 Topic 3

HOTSPOT
-

You have a Windows Server container host named Server1.

You start the containers on Server1 as shown in the following table.

You need to validate the status of ProcessA and ProcessC.

Where can you verify that ProcessA and ProcessC are in a running state? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 41/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 4 - Question Set 4

Question #1 Topic 4

HOTSPOT -
Your network contains two VLANs for client computers and one VLAN for a datacenter. Each VLAN is assigned an IPv4 subnet. Currently, all the
client computers use static IP addresses.
You plan to deploy a DHCP server to the VLAN in the datacenter.
You need to use the DHCP server to provide IP configurations to all the client computers.
What is the minimum number of scopes and DHCP relays you should create? To answer, select the appropriate option the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Question #2 Topic 4

You have a server that runs Windows Server and has the DHCP Server role installed. The server has a scope named Scope1 that has the following
configurations:
✑ Address range: 192.168.0.2 to 192. 168.1.254
✑ Mask: 255.255.254.0
✑ Router: 192.168.0.1
✑ Lease duration: 3 days

DNS server: 172.16.0.254 -

You have 50 Microsoft Teams Phone devices from the same vendor. All the devices have MAC addresses within the same range.
You need to ensure that all the Teams Phone devices that receive a lease from Scope1 have IP addresses in the range of 192.168.1.100 to
192.168.1.200. The solution must NOT affect other DHCP clients that receive IP configurations from Scope1.
What should you create?

A. a scope

B. a filter

C. scope options

D. a policy

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 42/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #3 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are planning the deployment of DNS to a new network.
You have three internal DNS servers as shown in the following table.

The contoso.local zone contains zone delegations for east.contoso.local and west.contoso.local. All the DNS servers use root hints.
You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.
Solution: You configure Server2 and Server3 to forward DNS requests to 10.0.1.10.
Does this meet the goal?

A. Yes

B. No

Question #4 Topic 4

You have an on-premises network that is connected to an Azure virtual network by using a Site-to-Site VPN. Each network contains a subnet that
has the same IP address space. The on-premises subnet contains a virtual machine.
You plan to migrate the virtual machine to the Azure subnet.
You need to migrate the on premises virtual machine to Azure without modifying the IP address. The solution must minim administrative effort.
What should you implement before you perform the migration?

A. Azure Extended Network

B. Azure Virtual Network NAT

C. Azure Application Gateway

D. Azure virtual network peering

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 43/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #5 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are planning the deployment of DNS to a new network.
You have three internal DNS servers as shown in the following table.

The contoso.local zone contains zone delegations for east.conloso.local and west.contoso.local. All the DNS servers use root hints.
You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.
Solution: On Server2 and Server3, you configure a conditional forwarder for contoso.local.
Does this meet the goal?

A. Yes

B. No

Question #6 Topic 4

You have servers that have the DNS Server role installed. The servers are configured as shown in the following table.

All the client computers in the New York office use Server2 as the DNS server.
You need to configure name resolution in the New York office to meet the following requirements:
✑ Ensure that the client computers in New York can resolve names from contoso.com.
✑ Ensure that Server2 forwards all DNS queries for internet hosts to 131. 107.100.200.
The solution must NOT require modifications to Server1.
Which two components should you configure on Server2? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. a forwarder

B. a conditional forwarder

C. a delegation

D. a secondary zone

E. a reverse lookup zone

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 44/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #7 Topic 4

You have an Azure virtual machine named VM1 that runs Windows Server.
You need to configure the management of VM1 to meet the following requirements:
✑ Require administrators to request access to VM1 before establishing a Remote Desktop connection.
✑ Limit access to VM1 from specific source IP addresses.
✑ Limit access to VM1 to a specific management port.
What should you configure?

A. a network security group (NSG)

B. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)

C. Microsoft Defender for Cloud

D. Azure Front Door

Question #8 Topic 4

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a DNS server named
Server1. Server1 hosts a DNS zone named fabrikam.com that was signed by DNSSEC.
You need to ensure that all the member servers in the domain perform DNSSEC validation for the fabrikam.com namespace.
What should you do?

A. On Server1, run the Add-DnsServerTrustAnchor cmdlet.

B. On each member server, run the Add-DnsServerTrustAnchor cmdlet.

C. From a Group Policy Object (GPO), add a rule to the Name Resolution Policy Table (NRPT).

D. From a Group Policy Object (GPO), modify the Network List Manager policies.

Question #9 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are planning the deployment of DNS to a new network.
You have three internal DNS servers as shown in the following table.

The contoso.local zone contains zone delegations for east.contoso.local and west.contoso.local. All the DNS servers use root hints.
You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.
Solution: On Server2, you create a conditional forwarder for contoso.local and west.contoso.local. On Server3, you create a conditional forwarder
for contoso.local and east.contoso.local.
Does this meet the goal?

A. Yes

B. No

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 45/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #10 Topic 4

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains 10 servers that run Windows Server. The
servers have static
IP addresses.
You plan to use DHCP to assign IP addresses to the servers.
You need to ensure that each server always receives the same IP address.
Which type of identifier should you use to create a DHCP reservation for each server?

A. NetBIOS name

B. MAC address

C. fully qualified domain name (FQDN)

D. universally unique identifier (UUID)

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 46/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #11 Topic 4

HOTSPOT -
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the VPN servers shown in
the following table.

You have a server named NPS1 that has Network Policy Server (NPS) installed. NPS1 has the following RADIUS clients:

VPN1, VPN2, and VPN3 use NPS1 for RADIUS authentication. All the users in contoso.com are allowed to establish VPN connections.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 47/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #12 Topic 4

You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. The on-
premises network is connected to Azure by using a Site-to-Site VPN.
You have the DNS zones shown in the following table.

You need to ensure that names from fabrikam.com can be resolved from the on-premises network.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Create a stub zone for fabrikam.com on DC1.

B. Create a conditional forwarder for fabrikam.com on DC1.

C. Create a secondary zone for fabrikam.com on DC1.

D. Deploy an Azure virtual machine that runs Windows Server. Modify the DNS Servers settings for the virtual network.

E. Deploy an Azure virtual machine that runs Windows Server. Configure the virtual machine as a DNS forwarder.

Question #13 Topic 4

You have an on-premises server named Server1 that runs Windows Server.
You have an Azure virtual network that contains an Azure virtual network gateway.
You need to connect only Server1 to the Azure virtual network.
What should you use?

A. a Site-to-Site VPN

B. Azure Network Adapter

C. an ExpressRoute circuit

D. Azure Extended Network

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 48/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #14 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are planning the deployment of DNS to a new network.
You have three internal DNS servers as shown in the following table.

The contoso.local zone contains zone delegations for east.contoso.local and west.contoso.local. All the DNS servers use root hints.
You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.
Solution: On Server2, you create a conditional forwarder for west.contoso.local. On Server3, you create a conditional forwarder for
east.contoso.local.
Does this meet the goal?

A. Yes

B. No

Question #15 Topic 4

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain
controllers.
You plan to store a DNS zone in a custom Active Directory partition.
You need to create the Active Directory partition for the zone. The partition must replicate to only four of the domain controllers.
What should you use?

A. Active Directory Administrative Center

B. Set-DnsServer

C. New-ADObject

D. ntdsutil.exe

Question #16 Topic 4

SIMULATION
-

You need to replicate a read-only copy of a DNS zone named contoso.com D to SRV2.

To complete this task, sign in the required computer or computers.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 49/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #17 Topic 4

SIMULATION
-

You plan to delegate the management of a DNS zone named fabrikam.com located on DC1 to the BranchAdmins group.

You need to ensure that you can grant permissions to the fabikam.com zone.

To complete this task, sign in the required computer or computers.

Question #18 Topic 4

SIMULATION
-

You need to ensure that SRV1 only leases IP addresses from the range of 192.168.1.190 to 192.168.1.200 to computers that have a MAC address
that starts with aabb.

To complete this task, sign in the required computer or computers.

Question #19 Topic 4

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains 10 servers that run Windows Server. The
servers have static IPv4 addresses.

You plan to use DHCP to assign IPv4 addresses to the servers.

You need to ensure that each server always receives the same IPv4 address.

Which type of identifier should you use to create a DHCP reservation for each server?

A. fully qualified domain name (FQDN)

B. universally unique identifier (UUID)

C. NetBIOS name

D. MAC address

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 50/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #20 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are planning the deployment of DNS to a new network.

You have three internal DNS servers as shown in the following table.

The contoso.local zone contains zone delegations for east.contoso.local and west.contoso.local. All the DNS servers use root hints.

You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts.

Solution: On Server2, you create a conditional forwarder for contoso.local and west.contoso.local. On Server3, you create a conditional forwarder
for contoso.local and east.contoso.local.

Does this meet the goal?

A. Yes

B. No

Question #21 Topic 4

You have an on-premises server named Server1 that runs Windows Server.

You have an Azure subscription that contains a virtual network named VNet1.

You need to connect Server1 to VNet1 by using Azure Network Adapter.

What should you use?

A. the Azure portal

B. Azure AD Connect

C. Device Manager

D. Windows Admin Center

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 51/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #22 Topic 4

DRAG DROP
-

Your network contains an Active Directory domain, a web app named App1, and a perimeter network. The perimeter network contains a server
named Server1 that runs Windows Server.

You plan to provide external access to App1.

You need to implement the Web Application Proxy role service on Server1.

Which role should you add to Server1, and which role should you add to the network? To answer, drag the appropriate roles to the correct targets.
Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Question #23 Topic 4

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a user named User1 and the servers shown in
the following table.

You need to ensure that User1 can manage only Scope1 and Scope3.

What should you do?

A. Add User1 to the DHCP Administrators group on Server1 and Server2.

B. Implement IP Address Management (IPAM).

C. Add User1 to the DHCP Administrators domain local group.

D. Implement Windows Admin Center and add connections to Server1 and Server2.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 52/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 5 - Question Set 5

Question #1 Topic 5

HOTSPOT -
You have on-premises file servers that run Windows Server as shown in the following table.

You have the Azure file shares shown in the following table.

You add a Storage Sync Service named Sync1 and an Azure File Sync sync group named Group1. Group1 uses share1 as a cloud endpoint.
You register Server1 and Server2 with Sync1. You add D:\Folder1 from Server1 as a server endpoint in Group1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 53/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #2 Topic 5

HOTSPOT -
You need to sync files from an on premises server named Server1 to Azure by using Azure File Sync.
You have a cloud tiering policy that is configured for 30 percent free space and 70 days.
Volume E on Server1 is 500 GB.
A year ago, you configured E:\Data on Server1 to sync by using Azure File Sync. The files that are visible in E:\Data are shown in the following
table.

Volume E does NOT contain any other files.

Where are File1 and File3 located? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 54/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #3 Topic 5

HOTSPOT -
You have on-premises servers that run Windows Server as shown in the following table.

You have an Azure file share named share1 that stores two files named File2.docx and File3.docx.
You create an Azure File Sync sync group that includes the following endpoints:
✑ share1
✑ D:\Folder1 on Server1
✑ D:\Data1 on Server2
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 55/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #4 Topic 5

HOTSPOT -
You have a file server named Server1 that runs Windows Server and contains the volumes shown in the following table.

On which volumes can you use BitLocker Drive Encryption (BitLocker) and disk quotas? To answer, select the appropriate options in the answer
area.
NOTE: Each correct selection is worth one point.
Hot Area:

Question #5 Topic 5

You have a server that runs Windows Server and contains a shared folder named UserData.
You need to limit the amount of storage space that each user can consume in UserData.
What should you use?

A. Storage Spaces

B. Work Folders

C. Distributed File System (DFS) Namespaces

D. File Server Resource Manager (FSRM)

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 56/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #6 Topic 5

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains two servers named
Server1 and Server2.
Server1 contains a disk named Disk2. Disk2 contains a folder named UserData. UserData is shared to the Domain Users group. Disk2 is configured
for deduplication. Server1 is protected by using Azure Backup.
Server1 fails.
You connect Disk2 to Server2.
You need to ensure that you can access all the files on Disk2 as quickly as possible.
What should you do?

A. Create a storage pool.

B. Restore files from Azure Backup.

C. Install the File Server Resource Manager server role.

D. Install the Data Deduplication server role.

Question #7 Topic 5

You have five file servers that run Windows Server.

You need to block users from uploading video files that have the .mov extension to shared folders on the file servers. All other types of files must
be allowed. The solution must minimize administrative effort.
What should you create?

A. a Dynamic Access Control central access policy

B. a data loss prevention (DLP) policy

C. a Dynamic Access Control central access rule

D. a file screen

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 57/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #8 Topic 5

HOTSPOT -
Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com. The domain contains a file server named Server1
and three users named User1, User2, and User3.
Server1 contains a shared folder named Share1 that has the following configurations:

The share permissions for Share1 are configured as shown in the Share Permissions exhibit.

Share1 contains a file named File1.bxt. The advanced security settings for File1.txt are configured as shown in the File Permissions exhibit.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 58/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 59/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #9 Topic 5

DRAG DROP -
You have a server named Server1.
You plan to use Storage Spaces to expand the storage available to Server1. You attach eight physical disks to Server1. Four disks are HDDs and
four are SSDs.
You need to create a volume on Server1 that will use the storage on all the new disks. The solution must provide the fastest read performance for
frequently used files.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and
arrange them in the correct order.
Select and Place:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 60/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #10 Topic 5

HOTSPOT -
Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com. The domain contains a server named Server1
and the users shown in the following table.

Server1 contains a folder named D:\Folder1. The advanced security settings for Folder1 are configured as shown in the Permissions exhibit. (Click
the
Permissions tab.)

Folder1 is shared by using the following configurations:

The share permissions for Share1 are shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 61/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

NOTE: Each correct selection is worth one point.

Hot Area:

Question #11 Topic 5

HOTSPOT -
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a server named Server1
that has the
DFS Namespaces role service installed. Server1 hosts a domain-based Distributed File System (DFS) Namespace named Files.
The domain contains a file server named Server2. Server2 contains a shared folder named Share1. Share1 contains a subfolder named Folder1.
In the Files namespace, you create a folder named Folder1 that has a target of \\Server2.contoso.com\Share1\Folder1.
You need to configure a logon script that will map drive letter M to Folder1. The solution must use the path of the DFS Namespace.
How should you configure the command to map the drive letter? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 62/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #12 Topic 5

DRAG DROP -
You have two on-premises servers named Server1 and Server2 that run Windows Server.
You have an Azure Storage account named storage1 that contains a file share named share1. Server1 syncs with share1 by using Azure File Sync.
You need to configure Server2 to sync with share1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and
arrange them in the correct order.
Select and Place:

Question #13 Topic 5

You have a server named Server1 that runs Windows Server. Server1 has the storage pools shown in the following table.

You plan to create a virtual disk named VDisk1 that will use storage tiers.
Which pools can you use to create VDisk1?

A. Pool2 only

B. Pool1 only

C. Pool1, Pool2, and Pool3

D. Pool1 and Pool2 only

E. Pool3 only

F. Pool2 and Pool3 only

G. Pool1 and Pool3 only

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 63/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #14 Topic 5

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain
controllers.
You plan to store a DNS zone in a custom Active Directory partition.
You need to create the Active Directory partition for the zone. The partition must replicate to only four of the domain controllers.
What should you use?

A. ntdsutil.exe

B. Active Directory Sites and Services

C. Set-DnsServer

D. DNS Manager

Question #15 Topic 5

You have two severs that have the Hyper-V server role installed. The servers are joined to a failover cluster. Both servers can connect to the same
disk on an iSCSI storage device.
You plan to use the iSCSI storage to store highly available Hyper-V virtual machines that will. support live migration functionally.
You need to configure a storage resource in the failover cluster to store the virtual machines.
What should you configure?

A. Cluster Shared Volumes (CSV)

B. Distributed File System (DFS) Replication

C. a storage pool

D. a mirrored volume

Question #16 Topic 5

You have a server named Server1 that runs Windows Server.

You plan to host applications in Windows containers.
You need to configure Server1 to run containers.
What should you install?

A. Windows Admin Center

B. Docker

C. the Windows Subsystem for Linux

D. Hyper-V

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 64/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #17 Topic 5

HOTSPOT -
You have a server named Server1 that runs Windows Server. Server1 has a just-a-bunch-of-disks (JBOD) enclosure attached.
You plan to create a storage pool on Server1 and a virtual disk that will use a mirror layout.
You are considering whether to use a two-way or a three-way mirror layout.
What is the minimum number of disks required for each type of mirror layout? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 65/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #18 Topic 5

HOTSPOT -
Your company has offices in Boston and Montreal. The offices are connected by using a 10-Mbps WAN link that is often saturated.
The office in Boston contains the following:
✑ An Active Directory Domain Services (AD DS) domain controller named DC1
✑ A server named Server1 that runs Windows Server and has the File Server role installed
The office in Montreal contains 20 client computers that run Windows 10. Montreal does NOT have any servers.
The company plans to deploy a new line-of-business (LOB) application to all the client computers. The installation source files for the application
are in \\Server1
\Apps.
You need to make the installation source files available to the client computers in the Montreal office by using the minimum amount of WAN
bandwidth possible.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Question #19 Topic 5

You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. Group
writeback is enabled in Azure AD Connect.
The AD DS domain contains a server named Server1. Server1 contains a shared folder named share1.
You have an Azure Storage account named storage2 that uses Azure AD-based access control. The storage2 account contains a share named
share2.
You need to create a security group that meets the following requirements:
✑ Can contain users from the AD DS domain
✑ Can be used to authorize user access to share1 and share2
What should you do?

A. In the Azure AD tenant, create a security group that has assigned membership.

B. In the AD DS domain, create a universal security group.

C. In the Azure AD tenant, create a security group that has dynamic membership.

D. In the Azure AD tenant, create a Microsoft 365 group.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 66/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #20 Topic 5

HOTSPOT -
You have a Group Policy Object (GPO) named GPO1 that contains user settings only.
You plan to apply GPO1 to a global security group named Group1.
You link GPO1 to the domain, and you remove all the permissions granted to the Authenticated Users group.
You need to configure permissions for GPOI to meet the following requirements:
✑ GPO1 must apply only to the users in Group1.
✑ The solution must use the principle of least privilege.
Which permissions should you grant to Group1 and the Domain Computers group? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 67/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #21 Topic 5

HOTSPOT -
Your network contains a two-domain on-premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the
domain controllers shown in the following table.

All domain controllers are backed up by using Azure Backup.

You create an Active Directory site named Site3. Site1, Site2, and Site3 each has a dedicated site link to the Hub site.
In Site3, you install a new server named Server1.
You need to promote Server1 to an RODC in child.contoso.com by using the Install from Media (IFM) option. The solution must minimize network
traffic.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 68/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #22 Topic 5

DRAG DROP -
You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.
You deploy a server to the domain and configure the server to run a service.
You need to ensure that the service can use a group managed service account (gMSA) to authenticate.
Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area
and arrange them in the correct order.
Select and Place:

Question #23 Topic 5

HOTSPOT -
You have an on-premises DNS server named Server1 that runs Windows Server. Server1 hosts a DNS zone named fabnkam.com.
You have an Azure subscription that contains the resources shown in the following table.

You need to design a solution that will automatically resolve the names of any PaaS resources for which you configure private endpoints in Vnet1.
How should you configure the name resolution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 69/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #24 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
You need to identify which server is the PDC emulator for the domain.
Solution: From Active Directory Users and Computers, you right-click contoso.com in the console tree, and then select Operations Master.
Does this meet the goal?

A. Yes

B. No

Question #25 Topic 5

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain
controllers.
You plan to store a DNS zone in a custom Active Directory partition.
You need to create the Active Directory partition for the zone. The partition must replicate to only four of the domain controllers.
What should you use?

A. dnscmd.exe

B. Active Directory Sites and Services

C. Set-DnsServer

D. DNS Manager

Question #26 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2,
and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK.
You open a new branch office that contains only client computers.
You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.
Solution: You create a new subnet object that is associated to Site1.
Does this meet the goal?

A. Yes

B. No

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 70/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #27 Topic 5

HOTSPOT -
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
The network contains the servers shown in the following table.

You plan to implement IP Address Management (IPAM).

You need to use the Group Policy based provisioning method for managed servers. The solution must support server discovery.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 71/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #28 Topic 5

HOTSPOT
-

Your company has a main office and 10 branch offices that are connected by using WAN links. The network contains an Active Directory domain.

All users have laptops and regularly travel between offices.

You plan to implement BranchCache in the branch offices.

In each branch office, you install a server that runs Windows Server and the BranchCache feature. You register the servers in Active Directory.

You need to configure the laptops to use the local BranchCache server automatically. The solution must minimize administrative effort.

Which two Group Policy settings should you configure? To answer, select the settings in the answer area.

NOTE: Each correct selection is worth one point.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 72/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #29 Topic 5

HOTSPOT
-

You have an Azure subscription that contains the storage accounts shown in the following table.

In the East US Azure region, you create a storage sync service named Sync1.

You need to create a sync group in Sync1.

Which storage accounts can you use, and what can you specify as the cloud endpoints. To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 73/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #30 Topic 5

You have a server named Server1 that runs Windows Server and contains two drives named C and D. Server1 hosts multiple file shares.

You enable Data Deduplication on drive D and select the General purpose file server workload.

You need to minimize the space consumed by files that were recently modified or deleted.

What should you do?

A. Run the Set-DedupVolume cmdlet and configure the Scrubbing job.

B. Run the Set-DedupSchedule cmdlet and configure a GarbageCollection job.

C. Run the Set-DedupVolume cmdlet and configure the InputOutputScale settings.

D. Run the Set-DedupSchedule cmdlet and configure the Optimization job.

Question #31 Topic 5

HOTSPOT
-

You have a server named Server1 that runs Windows Server and contains three volumes named C, D, and E.

Files are stored on Server1 as shown in the following table.

For volume D, Data Deduplication is enabled and set to General purpose file server.

You perform the following actions:

• Move File1 to volume D.

• Copy File2 to volume D and name the copy File4.
• Move File3 to volume E.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 74/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #32 Topic 5

You have an Active Directory domain that contains a file server named Server1. Server1 runs Windows Server and includes the file shares shown in
the following table.

When users login to the network they receive the following network drive mappings.

• H: maps to \\server1\users\%UserName%
• G: maps to \\server1\%Department%

You need to limit the amount of space consumed by user’s on Server1. The solution must meet the following requirements:

• Prevent users using more than 5GB of space on their H: drive

• Prevent Accounts department users from using more than 10GB of space on the G: drive
• Prevent Marketing department users from using more than 15GB of space on the G: drive
• Prevent Customer Service department users from using more than 2GB of space on the G: drive
• Minimize administrative effort

What should you use?

A. File Server Resource Manager (FSRM) quotas

B. Storage tiering

C. NTFS Disk quotas

D. Group Policy Preferences

Question #33 Topic 5

You have an Azure subscription that contains the storage accounts shown in the following table.

In the West US Azure region, you create a storage sync service named SyncA.

You plan to create a sync group named GroupA.

What is the maximum number of cloud endpoints you can use with GroupA?

A. 1

B. 2

C. 3

D. 4

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 75/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 6 - Testlet 1

Question #1 Topic 6

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.

Existing Environment -

On-premises Servers -
The on-premises network contains servers that run Windows Server as shown in the following table.

DC1 hosts all the operation master roles.

VM1 and VM2 are connected to the internet.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 76/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

On-premises Network -
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses
for the Seattle office.

Identity Infrastructure -
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service
accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.

Requirements -

Planned Changes -
Fabrikam identifies the following planned changes:
Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be
connected to Vnet1 by using ExpressRoute.
Create three Azure file shares named newyorkfiles, seattlefiles, and companyfiles.
Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined.
License all servers for Microsoft Defender for servers.
Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.

Networking Requirements -
Fabrikam identifies the following networking requirements:
Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over
ExpressRoute.
If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease.
Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.

Security Requirements -
Fabrikam identifies the following security requirements:
Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes.
Users must be able to control the lockout time manually from their client computer.
Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the
request is approved, the connection must be established within two hours.
Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|.
Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30
days.
Prevent domain controllers from directly contacting hosts on the internet.
https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 77/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

File Sharing Requirements -

You need to configure the synchronization of Azure files to meet the following requirements:
Ensure that seattlefiles syncs to FS2.
Ensure that newyorkfiles syncs to FS1.
Ensure that companyfiles syncs to both FS1 and FS2.

Question
You need to configure the Group Policy settings to ensure that the Azure Virtual Desktop session hosts meet the security requirements.
What should you configure?

A. loopback processing in GPO4

B. security filtering for the link of GPO1

C. loopback processing in GPO1

D. the Enforced property for the link of GPO4

E. the Enforced property for the link of GPO1

F. security filtering for the link of GPO4

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 78/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #2 Topic 6

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.

Existing Environment -

On-premises Servers -
The on-premises network contains servers that run Windows Server as shown in the following table.

DC1 hosts all the operation master roles.

VM1 and VM2 are connected to the internet.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.

On-premises Network -
The New York and Seattle offices are connected by using redundant WAN links.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 79/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses
for the Seattle office.

Identity Infrastructure -
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service
accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.

Requirements -

Planned Changes -
Fabrikam identifies the following planned changes:
Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be
connected to Vnet1 by using ExpressRoute.
Create three Azure file shares named newyorkfiles, seattlefiles, and companyfiles.
Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined.
License all servers for Microsoft Defender for servers.
Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.

Networking Requirements -
Fabrikam identifies the following networking requirements:
Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over
ExpressRoute.
If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease.
Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.

Security Requirements -
Fabrikam identifies the following security requirements:
Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes.
Users must be able to control the lockout time manually from their client computer.
Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the
request is approved, the connection must be established within two hours.
Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|.
Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30
days.
Prevent domain controllers from directly contacting hosts on the internet.

File Sharing Requirements -

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 80/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

You need to configure the synchronization of Azure files to meet the following requirements:
Ensure that seattlefiles syncs to FS2.
Ensure that newyorkfiles syncs to FS1.
Ensure that companyfiles syncs to both FS1 and FS2.

Question
What should you implement for the deployment of DC3?

A. Azure Active Directory Domain Services (Azure AD DS)

B. an Azure virtual machine

C. an Azure AD administrative unit

D. Azure AD Application Proxy

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 81/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #3 Topic 6

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.

Existing Environment -

On-premises Servers -
The on-premises network contains servers that run Windows Server as shown in the following table.

DC1 hosts all the operation master roles.

VM1 and VM2 are connected to the internet.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.

On-premises Network -
The New York and Seattle offices are connected by using redundant WAN links.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 82/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses
for the Seattle office.

Identity Infrastructure -
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service
accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.

Requirements -

Planned Changes -
Fabrikam identifies the following planned changes:
Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be
connected to Vnet1 by using ExpressRoute.
Create three Azure file shares named newyorkfiles, seattlefiles, and companyfiles.
Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined.
License all servers for Microsoft Defender for servers.
Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.

Networking Requirements -
Fabrikam identifies the following networking requirements:
Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over
ExpressRoute.
If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease.
Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.

Security Requirements -
Fabrikam identifies the following security requirements:
Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes.
Users must be able to control the lockout time manually from their client computer.
Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the
request is approved, the connection must be established within two hours.
Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|.
Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30
days.
Prevent domain controllers from directly contacting hosts on the internet.

File Sharing Requirements -

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 83/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

You need to configure the synchronization of Azure files to meet the following requirements:
Ensure that seattlefiles syncs to FS2.
Ensure that newyorkfiles syncs to FS1.
Ensure that companyfiles syncs to both FS1 and FS2.

Question
DRAG DROP -
Which three actions should you perform in sequence to meet the security requirements for Webapp1? To answer, move the appropriate actions
from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 84/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #4 Topic 6

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.

Existing Environment -

On-premises Servers -
The on-premises network contains servers that run Windows Server as shown in the following table.

DC1 hosts all the operation master roles.

VM1 and VM2 are connected to the internet.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.

On-premises Network -
The New York and Seattle offices are connected by using redundant WAN links.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 85/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses
for the Seattle office.

Identity Infrastructure -
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service
accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.

Requirements -

Planned Changes -
Fabrikam identifies the following planned changes:
Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be
connected to Vnet1 by using ExpressRoute.
Create three Azure file shares named newyorkfiles, seattlefiles, and companyfiles.
Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined.
License all servers for Microsoft Defender for servers.
Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.

Networking Requirements -
Fabrikam identifies the following networking requirements:
Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over
ExpressRoute.
If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease.
Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.

Security Requirements -
Fabrikam identifies the following security requirements:
Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes.
Users must be able to control the lockout time manually from their client computer.
Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the
request is approved, the connection must be established within two hours.
Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|.
Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30
days.
Prevent domain controllers from directly contacting hosts on the internet.

File Sharing Requirements -

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 86/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

You need to configure the synchronization of Azure files to meet the following requirements:
Ensure that seattlefiles syncs to FS2.
Ensure that newyorkfiles syncs to FS1.
Ensure that companyfiles syncs to both FS1 and FS2.

Question
DRAG DROP -
You need to meet the security requirements for passwords.
Where should you configure the components for Azure AD Password Protection? To answer, drag the appropriate components to the correct
locations. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view
content.
NOTE: Each correct selection is worth one point.
Select and Place:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 87/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 7 - Testlet 2

Question #1 Topic 7

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent labs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.

Existing Environment -

AD DS Environment -
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains
named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.

All the domain controllers are global catalog servers.

Server infrastructure -
The network contains the servers shown in the following table.

A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 88/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Group Policies -
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.

Existing Identities -
The forest contains the users shown in the following table.

The forest contains the groups shown in the following table.

Current Problems -
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without
signing out, another administrator can connect to the console session as the currently signed in user.

Requirements -

Technical Requirements -
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.

Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 89/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Ensure that you can run virtual machines on VM1.

Force users to provide credentials when they connect to VM2.
On VM3, ensure that Data Deduplication on all volumes is possible.

Question
You need to meet the technical requirements for Server1.
Which users can currently perform the required tasks?

A. Admin3 only

B. Admin1 and Admin3 only

C. Admin1 only

D. Admin1, Admin2, and Admin3

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 90/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #2 Topic 7

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent labs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.

Existing Environment -

AD DS Environment -
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains
named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.

All the domain controllers are global catalog servers.

Server infrastructure -
The network contains the servers shown in the following table.

A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 91/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Group Policies -
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.

Existing Identities -
The forest contains the users shown in the following table.

The forest contains the groups shown in the following table.

Current Problems -
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without
signing out, another administrator can connect to the console session as the currently signed in user.

Requirements -

Technical Requirements -
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.

Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 92/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Ensure that you can run virtual machines on VM1.

Force users to provide credentials when they connect to VM2.
On VM3, ensure that Data Deduplication on all volumes is possible.

Question
You need to meet the technical requirements for the site links.
Which users can perform the required tasks?

A. Admin1, Admin2, and Admin3

B. Admin1 and Admin3 only

C. Admin1 only

D. Admin1 and Admin2 only

E. Admin3 only

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 93/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #3 Topic 7

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent labs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.

Existing Environment -

AD DS Environment -
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains
named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.

All the domain controllers are global catalog servers.

Server infrastructure -
The network contains the servers shown in the following table.

A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 94/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Group Policies -
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.

Existing Identities -
The forest contains the users shown in the following table.

The forest contains the groups shown in the following table.

Current Problems -
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without
signing out, another administrator can connect to the console session as the currently signed in user.

Requirements -

Technical Requirements -
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.

Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 95/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Ensure that you can run virtual machines on VM1.

Force users to provide credentials when they connect to VM2.
On VM3, ensure that Data Deduplication on all volumes is possible.

Question
You need to meet the technical requirements for User1. The solution must use the principle of least privilege.
What should you do?

A. Add Users1 to the Server Operators group in contoso.com.

B. Create a delegation on contoso.com.

C. Add Users1 to the Account Operators group in contoso.com.

D. Create a delegation on OU3.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 96/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #4 Topic 7

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent labs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.

Existing Environment -

AD DS Environment -
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains
named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.

All the domain controllers are global catalog servers.

Server infrastructure -
The network contains the servers shown in the following table.

A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 97/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Group Policies -
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.

Existing Identities -
The forest contains the users shown in the following table.

The forest contains the groups shown in the following table.

Current Problems -
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without
signing out, another administrator can connect to the console session as the currently signed in user.

Requirements -

Technical Requirements -
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.

Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 98/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Ensure that you can run virtual machines on VM1.

Force users to provide credentials when they connect to VM2.
On VM3, ensure that Data Deduplication on all volumes is possible.

Question
HOTSPOT -
Which groups can you add to Group3 and Group5? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 99/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #5 Topic 7

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent labs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.

Existing Environment -

AD DS Environment -
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains
named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.

All the domain controllers are global catalog servers.

Server infrastructure -
The network contains the servers shown in the following table.

A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 100/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Group Policies -
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.

Existing Identities -
The forest contains the users shown in the following table.

The forest contains the groups shown in the following table.

Current Problems -
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without
signing out, another administrator can connect to the console session as the currently signed in user.

Requirements -

Technical Requirements -
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.

Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 101/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Ensure that you can run virtual machines on VM1.

Force users to provide credentials when they connect to VM2.
On VM3, ensure that Data Deduplication on all volumes is possible.

Question
You need to meet the technical requirements for Server3.
Which users can perform the required tasks?

A. Admin3 only

B. Admin1 and Admin3 only

C. Admin1 only

D. Admin1, Admin2, and Admin3

E. Admin1 and Admin2 only

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 102/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 8 - Testlet 3

Question #1 Topic 8

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.

Existing Environment -

On-premises Servers -
The on-premises network contains servers that run Windows Server as shown in the following table.

DC1 hosts all the operation master roles.

VM1 and VM2 are connected to the internet.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 103/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

On-premises Network -
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses
for the Seattle office.

Identity Infrastructure -
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service
accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.

Requirements -

Planned Changes -
Fabrikam identifies the following planned changes:
Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be
connected to Vnet1 by using ExpressRoute.
Create three Azure file shares named newyorkfiles, seattlefiles, and companyfiles.
Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined.
License all servers for Microsoft Defender for servers.
Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.

Networking Requirements -
Fabrikam identifies the following networking requirements:
Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over
ExpressRoute.
If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease.
Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.

Security Requirements -
Fabrikam identifies the following security requirements:
Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes.
Users must be able to control the lockout time manually from their client computer.
Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the
request is approved, the connection must be established within two hours.
Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|.
Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30
days.
Prevent domain controllers from directly contacting hosts on the internet.
https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 104/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

File Sharing Requirements -

You need to configure the synchronization of Azure files to meet the following requirements:
Ensure that seattlefiles syncs to FS2.
Ensure that newyorkfiles syncs to FS1.
Ensure that companyfiles syncs to both FS1 and FS2.

Question
You are planning the implementation Azure Arc to support the planned changes.
You need to configure the environment to support configuration management policies.
What should you do?

A. Create a hybrid runbook worker in Azure Automation.

B. Deploy the Azure Monitor agent to all the servers.

C. Deploy the Azure Connected Machine agent to all the servers.

D. Hybrid Azure AD join all the serves.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 105/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 9 - Testlet 4

Question #1 Topic 9

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent labs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.

Existing Environment -

AD DS Environment -
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains
named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.

All the domain controllers are global catalog servers.

Server infrastructure -
The network contains the servers shown in the following table.

A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 106/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Group Policies -
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.

Existing Identities -
The forest contains the users shown in the following table.

The forest contains the groups shown in the following table.

Current Problems -
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without
signing out, another administrator can connect to the console session as the currently signed in user.

Requirements -

Technical Requirements -
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.

Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 107/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Ensure that you can run virtual machines on VM1.

Force users to provide credentials when they connect to VM2.
On VM3, ensure that Data Deduplication on all volumes is possible.

Question
HOTSPOT -
You need to meet the technical requirements for Server4.
Which cmdlets should you run on Server1 and Server4? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 108/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 10 - Testlet 5

Question #1 Topic 10

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent labs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.

Existing Environment -

AD DS Environment -
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains
named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.

All the domain controllers are global catalog servers.

Server infrastructure -
The network contains the servers shown in the following table.

A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 109/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Group Policies -
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.

Existing Identities -
The forest contains the users shown in the following table.

The forest contains the groups shown in the following table.

Current Problems -
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without
signing out, another administrator can connect to the console session as the currently signed in user.

Requirements -

Technical Requirements -
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.

Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 110/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Ensure that you can run virtual machines on VM1.

Force users to provide credentials when they connect to VM2.
On VM3, ensure that Data Deduplication on all volumes is possible.

Question
HOTSPOT -
You need to meet the technical requirements for VM1.
Which cmdlet should you run first? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 111/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #2 Topic 10

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent labs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.

Existing Environment -

AD DS Environment -
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains
named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.

All the domain controllers are global catalog servers.

Server infrastructure -
The network contains the servers shown in the following table.

A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 112/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Group Policies -
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.

Existing Identities -
The forest contains the users shown in the following table.

The forest contains the groups shown in the following table.

Current Problems -
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without
signing out, another administrator can connect to the console session as the currently signed in user.

Requirements -

Technical Requirements -
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.

Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 113/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Ensure that you can run virtual machines on VM1.

Force users to provide credentials when they connect to VM2.
On VM3, ensure that Data Deduplication on all volumes is possible.

Question
You need to meet the technical requirements for VM2.
What should you do?

A. Implement shielded virtual machines.

B. Enable the Guest services integration service.

C. Implement Credential Guard.

D. Enable enhanced session mode.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 114/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 11 - Testlet 6

Question #1 Topic 11

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.

Existing Environment -

On-premises Servers -
The on-premises network contains servers that run Windows Server as shown in the following table.

DC1 hosts all the operation master roles.

VM1 and VM2 are connected to the internet.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 115/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

On-premises Network -
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses
for the Seattle office.

Identity Infrastructure -
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service
accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.

Requirements -

Planned Changes -
Fabrikam identifies the following planned changes:
Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be
connected to Vnet1 by using ExpressRoute.
Create three Azure file shares named newyorkfiles, seattlefiles, and companyfiles.
Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined.
License all servers for Microsoft Defender for servers.
Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.

Networking Requirements -
Fabrikam identifies the following networking requirements:
Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over
ExpressRoute.
If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease.
Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.

Security Requirements -
Fabrikam identifies the following security requirements:
Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes.
Users must be able to control the lockout time manually from their client computer.
Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the
request is approved, the connection must be established within two hours.
Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|.
Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30
days.
Prevent domain controllers from directly contacting hosts on the internet.
https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 116/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

File Sharing Requirements -

You need to configure the synchronization of Azure files to meet the following requirements:
Ensure that seattlefiles syncs to FS2.
Ensure that newyorkfiles syncs to FS1.
Ensure that companyfiles syncs to both FS1 and FS2.

Question
You need to implement a name resolution solution that meets the networking requirements.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Configure the DNS Servers settings for Vnet1.

B. On DC3, install the DNS Server role.

C. Create a virtual network link in the corp.fabrikam.com Azure private DNS zone.

D. Configure a conditional forwarder on DC3.

E. Enable autoregistration in the corp.fabrikam.com Azure private DNS zone.

F. Create an Azure private DNZ zone named corp.fabrikam.com.

G. Create an Azure DNZ zone named corp.fabrikam.com.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 117/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #2 Topic 11

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.

Existing Environment -

On-premises Servers -
The on-premises network contains servers that run Windows Server as shown in the following table.

DC1 hosts all the operation master roles.

VM1 and VM2 are connected to the internet.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.

On-premises Network -
The New York and Seattle offices are connected by using redundant WAN links.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 118/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses
for the Seattle office.

Identity Infrastructure -
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service
accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.

Requirements -

Planned Changes -
Fabrikam identifies the following planned changes:
Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be
connected to Vnet1 by using ExpressRoute.
Create three Azure file shares named newyorkfiles, seattlefiles, and companyfiles.
Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined.
License all servers for Microsoft Defender for servers.
Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.

Networking Requirements -
Fabrikam identifies the following networking requirements:
Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over
ExpressRoute.
If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease.
Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.

Security Requirements -
Fabrikam identifies the following security requirements:
Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes.
Users must be able to control the lockout time manually from their client computer.
Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the
request is approved, the connection must be established within two hours.
Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|.
Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30
days.
Prevent domain controllers from directly contacting hosts on the internet.

File Sharing Requirements -

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 119/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

You need to configure the synchronization of Azure files to meet the following requirements:
Ensure that seattlefiles syncs to FS2.
Ensure that newyorkfiles syncs to FS1.
Ensure that companyfiles syncs to both FS1 and FS2.

Question
HOTSPOT -
You need to configure network communication between the Seattle and New York offices. The solution must meet the networking requirements.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 120/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #3 Topic 11

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.

Existing Environment -

On-premises Servers -
The on-premises network contains servers that run Windows Server as shown in the following table.

DC1 hosts all the operation master roles.

VM1 and VM2 are connected to the internet.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.

On-premises Network -
The New York and Seattle offices are connected by using redundant WAN links.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 121/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses
for the Seattle office.

Identity Infrastructure -
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service
accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.

Requirements -

Planned Changes -
Fabrikam identifies the following planned changes:
Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be
connected to Vnet1 by using ExpressRoute.
Create three Azure file shares named newyorkfiles, seattlefiles, and companyfiles.
Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined.
License all servers for Microsoft Defender for servers.
Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.

Networking Requirements -
Fabrikam identifies the following networking requirements:
Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over
ExpressRoute.
If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease.
Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.

Security Requirements -
Fabrikam identifies the following security requirements:
Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes.
Users must be able to control the lockout time manually from their client computer.
Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the
request is approved, the connection must be established within two hours.
Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|.
Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30
days.
Prevent domain controllers from directly contacting hosts on the internet.

File Sharing Requirements -

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 122/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

You need to configure the synchronization of Azure files to meet the following requirements:
Ensure that seattlefiles syncs to FS2.
Ensure that newyorkfiles syncs to FS1.
Ensure that companyfiles syncs to both FS1 and FS2.

Question
You need to configure remote administration to meet the security requirements.
What should you use?

A. an Azure Bastion host

B. Azure AD Privileged Identity Management (PIM)

C. the Remote Desktop extension for Azure Cloud Services

D. just in time (JIT) VM access

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 123/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #4 Topic 11

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.

Existing Environment -

On-premises Servers -
The on-premises network contains servers that run Windows Server as shown in the following table.

DC1 hosts all the operation master roles.

VM1 and VM2 are connected to the internet.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.

On-premises Network -
The New York and Seattle offices are connected by using redundant WAN links.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 124/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses
for the Seattle office.

Identity Infrastructure -
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service
accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.

Requirements -

Planned Changes -
Fabrikam identifies the following planned changes:
Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be
connected to Vnet1 by using ExpressRoute.
Create three Azure file shares named newyorkfiles, seattlefiles, and companyfiles.
Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined.
License all servers for Microsoft Defender for servers.
Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.

Networking Requirements -
Fabrikam identifies the following networking requirements:
Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over
ExpressRoute.
If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease.
Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.

Security Requirements -
Fabrikam identifies the following security requirements:
Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes.
Users must be able to control the lockout time manually from their client computer.
Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the
request is approved, the connection must be established within two hours.
Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|.
Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30
days.
Prevent domain controllers from directly contacting hosts on the internet.

File Sharing Requirements -

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 125/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

You need to configure the synchronization of Azure files to meet the following requirements:
Ensure that seattlefiles syncs to FS2.
Ensure that newyorkfiles syncs to FS1.
Ensure that companyfiles syncs to both FS1 and FS2.

Question
You need to implement an availability solution for DHCP that meets the networking requirements.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. On DHCP1, create a scope that contains 25 percent of the IP addresses from Scope2.

B. On the router in each office, configure a DHCP relay.

C. DHCP2, configure a scope that contains 25 percent of the IP addresses from Scope1.

D. On each DHCP server, install the Failover Clustering feature and add the DHCP cluster role.

E. On each DHCP scope, configure DHCP failover.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 126/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 12 - Testlet 7

Question #1 Topic 12

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Fabrikam, Inc is a manufacturing company that has a main office in New York and a branch office in Seattle.

Existing Environment -

On-premises Servers -
The on-premises network contains servers that run Windows Server as shown in the following table.

DC1 hosts all the operation master roles.

VM1 and VM2 are connected to the internet.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 127/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

On-premises Network -
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP1 contains a scope named Scope1 that has addresses for the New York office, DHCP2 contains a scope named Scope2 that has addresses
for the Seattle office.

Identity Infrastructure -
The network contains a single on-premises Active Directory Domain Services (AD DS) domain named corp.falbrikam.com. Currently, all the service
accounts use individual domain user accounts.
All domain controllers have the DNS Server role installed and host a copy of the Active Directory integrated DNS zone of corp.fabrikam.com.
The corp.fabrikam.com AD DS domain syncs with an Azure Active Directory (Azure AD) tenant.
Group Policy Objects (GPOs)
The corp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.

Requirements -

Planned Changes -
Fabrikam identifies the following planned changes:
Create a single Azure subscription named Sub1 that will contain a single Azure virtual network named Vnet1.
Replace the WAN links between the Seattle and New York offices by using Azure Virtual WAN and FxpressRoute. Both on premises offices will be
connected to Vnet1 by using ExpressRoute.
Create three Azure file shares named newyorkfiles, seattlefiles, and companyfiles.
Create a domain controller named dc3.corp.fabrikam.com in Vnet1.
Deploy an Azure Virtual Desktop host pool to Vnet1. The Azure Virtual Desktop session hosts will be hybrid Azure AD-joined.
License all servers for Microsoft Defender for servers.
Use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises.

Networking Requirements -
Fabrikam identifies the following networking requirements:
Implement Virtual WAN and ensure that all the network traffic between the sites uses Virtual WAN. All communications must occur over
ExpressRoute.
If a DHCP server fails, ensure that the client computers can continue to receive their dynamic IP address and renew their existing lease.
Ensure that the resources in Vnet1 can resolve the names of the on-premises servers in the corp.fabrikam.com domain.

Security Requirements -
Fabrikam identifies the following security requirements:
Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual Desktop user sessions lock after being idle for 10 minutes.
Users must be able to control the lockout time manually from their client computer.
Ensure that server administrators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the
request is approved, the connection must be established within two hours.
Prevent user passwords from containing all or part of words that are based on the company name, such as Fab, f@br1kAm or fabr!|.
Ensure that all instances of Webapp1 use the same service account. The password of the service account must change automatically every 30
days.
Prevent domain controllers from directly contacting hosts on the internet.
https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 128/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

File Sharing Requirements -

You need to configure the synchronization of Azure files to meet the following requirements:
Ensure that seattlefiles syncs to FS2.
Ensure that newyorkfiles syncs to FS1.
Ensure that companyfiles syncs to both FS1 and FS2.

Question
HOTSPOT -
You need to configure Azure File Sync to meet the file sharing requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 129/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Topic 13 - Testlet 8

Question #1 Topic 13

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent labs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.

Existing Environment -

AD DS Environment -
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains
named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.

All the domain controllers are global catalog servers.

Server infrastructure -
The network contains the servers shown in the following table.

A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 130/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Group Policies -
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.

Existing Identities -
The forest contains the users shown in the following table.

The forest contains the groups shown in the following table.

Current Problems -
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without
signing out, another administrator can connect to the console session as the currently signed in user.

Requirements -

Technical Requirements -
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.

Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 131/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Ensure that you can run virtual machines on VM1.

Force users to provide credentials when they connect to VM2.
On VM3, ensure that Data Deduplication on all volumes is possible.

Question
You need to meet the technical requirements for VM3.
On which volumes can you enable Data Deduplication?

A. C and D only

B. D only

C. C, D, E, and F

D. D and E only

E. D, E, and F only

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 132/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #2 Topic 13

Introductory Info
Case Study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent labs. When you are ready to answer a question, click the Question button to return to the question.

Overview -
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.

Existing Environment -

AD DS Environment -
The network contains an on premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains
named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.

All the domain controllers are global catalog servers.

Server infrastructure -
The network contains the servers shown in the following table.

A server named Server4 runs Windows Server and is in a workgroup. Windows Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 133/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Group Policies -
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.

Existing Identities -
The forest contains the users shown in the following table.

The forest contains the groups shown in the following table.

Current Problems -
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without
signing out, another administrator can connect to the console session as the currently signed in user.

Requirements -

Technical Requirements -
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.

Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 134/135
6/30/23, 9:01 PM AZ-800 Exam – Free Actual Q&As, Page 1 | ExamTopics

Ensure that you can run virtual machines on VM1.

Force users to provide credentials when they connect to VM2.
On VM3, ensure that Data Deduplication on all volumes is possible.

Question
HOTSPOT -
For each of the following statements, select Yes if the statement is true. Otherwise. select No.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-800/custom-view/ 135/135