Azure AZ-800 cheat sheet

Forest-wide FSMO roles are Schema Master and Domain Naming Master; domain-wide FSMO roles are RID Master, PDC Emulator, and Infrastructure Master.

Windows Server 2016 is the highest domain and forest functional level available when all domain controllers run Windows Server 2016, 2019, or 2022.

Default replication timing: intrasite change notification every 15 seconds; intersite IP site-link replication interval is 180 minutes, with a minimum of 15 minutes.

Tombstone lifetime defaults to 180 days; enabling the AD Recycle Bin is forest-wide and cannot be reversed once enabled.

Azure AD Connect runs a default synchronization cycle of 30 minutes, while password hash synchronization applies password changes roughly every 2 minutes.

A group Managed Service Account requires a KDS root key created with Add-KdsRootKey; the key becomes usable 10 hours after creation unless -EffectiveTime is backdated.

Fine-grained password policies (Password Settings Objects) target a single user or a global security group and override the domain password and lockout settings.

Domain controller cloning requires the source DC to be a member of Cloneable Domain Controllers and a DCCloneConfig.xml placed at the root of the source DC system disk; it applies only to virtualized DCs.

repadmin /showrepl reports replication status per naming context, while dcdiag /test:dns validates DC locator and service record registration.

Azure Arc-enabled servers installs the Connected Machine agent on non-Azure machines and extends Azure Policy, Update Manager, and Defender for Cloud to them.

Windows Admin Center is a gateway-based tool reached over HTTPS 443 or WinRM that manages physical servers, failover clusters, Azure VMs, and Azure Stack HCI.

The MARS (Azure Recovery Services) agent backs up files, folders, and system state and supports up to three scheduled backups per day.

Azure File Sync uses one Storage Sync Service with sync groups that support up to 100 server endpoints each; cloud tiering is driven by volume free space percentage and date policies.

Azure Update Manager replaces the legacy Automation Update Management solution and requires Azure Arc enrollment for servers outside Azure.

Azure Monitor Agent replaces the legacy Microsoft Monitoring Agent and collects data according to data collection rules.

Machine configuration (guest configuration) policies audit or configure settings inside the operating system of Azure VMs and Arc-enabled servers.

Generation 2 Hyper-V VMs use UEFI firmware with Secure Boot and virtual TPM support and boot from a SCSI controller; Generation 1 uses BIOS and IDE.

Production checkpoints use VSS inside the guest and are the default for Windows VMs; standard checkpoints capture memory state and do not use VSS.

Nested virtualization requires MAC address spoofing to be enabled on the parent VM's virtual network adapter.

Hyper-V Replica frequencies are 30 seconds, 5 minutes, and 15 minutes; extended replication adds a third server to the replica chain.

Live migration between non-clustered hosts without shared storage requires CredSSP or constrained delegation to authenticate to the destination host.

Process-isolated Windows containers share the host kernel and require an image OS version that matches the host; Hyper-V-isolated containers run in a lightweight VM.

Windows container network modes are NAT (default), transparent, l2bridge, l2tunnel, and overlay, with overlay requiring Software Defined Networking.

Dynamic memory uses Startup, Minimum, and Maximum RAM plus a buffer; Smart Paging is used only when a VM restarts and host memory is insufficient.

DHCP failover requires both servers to be authorized in AD DS and joined to the same domain; modes are Load Balance (default 50:50 weight) and Hot Standby.

Maximum Client Lead Time (MCLT) defaults to 1 hour and controls how far a partner server may extend a lease beyond its known partner state.

DNS aging and scavenging defaults: no-refresh interval 7 days, refresh interval 7 days, scavenging period 7 days; scavenging must be enabled on both the zone and the server.

Conditional forwarders send queries for a named domain to specified servers; stub zones hold only NS, SOA, and glue records and are refreshed by zone transfer.

IPAM discovers DNS and DHCP servers through manual entry or Group Policy provisioning; built-in roles include IPAM administrator, IPAM ASM administrator, IPAM MSM administrator, and IPAM IP audit administrator.

SMB over QUIC runs over UDP 443 with TLS 1.3 and requires certificate-based server authentication.

Network Load Balancing supports up to 32 cluster hosts and operates in unicast or multicast mode.

Always On VPN device tunnels use IKEv2 and connect before user sign-in; RADIUS authentication is provided by Network Policy Server.

Storage Replica synchronous replication requires roughly 5 ms round-trip latency and dedicated log volumes; asynchronous replication has no latency requirement.

Data Deduplication is a role service supported on NTFS volumes only, not on ReFS volumes.

FSRM hard quotas block writes once the limit is reached, soft quotas only generate notifications, and file screens allow or block files by file group.

Access-based enumeration hides files and folders from users who lack Read permission and is configured per SMB share.

SMB 3.1.1 adds pre-authentication integrity and AES-128-GCM/AES-256-GCM encryption; encryption can be enabled per share or per server.

DFS Replication uses Remote Differential Compression to transfer only changed blocks and resolves conflicts with last-writer-wins.

Storage Spaces resiliency options: Simple (striped, no redundancy), Mirror (two or three copies), and Parity (single or dual parity).

Storage QoS policies define maximum and minimum IOPS on virtual disks and are typically applied to Hyper-V virtual machines.

Domain-based DFS Namespaces require AD DS and present a single \domain\root path whose folders point to multiple folder targets.