Azure AZ-800 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Schema Master FSMO role

Forest-wide FSMO role held by exactly one domain controller per forest. It is the only DC that can modify the schema and must be online to run adprep /forestprep.

PDC Emulator

Domain-wide FSMO role that acts as the authoritative time source for the domain, receives priority replication of password changes, and is the default target for Group Policy edits.

Tombstone lifetime

Number of days deleted objects remain in the directory before permanent removal; the default in current forests is 180 days. It must exceed the longest replication outage.

Group Managed Service Account

Active Directory account whose password is generated and rotated by Windows and retrieved by servers listed in PrincipalsAllowedToRetrieveManagedPassword; creation requires a KDS root key in the forest.

Password hash synchronization

Azure AD Connect sign-in method that copies a hash of the on-premises password hash to Microsoft Entra ID so authentication can happen in the cloud; changes are processed about every two minutes.

Pass-through authentication

Azure AD Connect sign-in method in which Microsoft Entra ID validates credentials against on-premises Active Directory through lightweight authentication agents, so no password hashes are stored in the cloud.

Fine-grained password policy

A Password Settings Object that overrides domain password and account lockout settings for a single user or a global security group. A PSO linked directly to a user takes precedence.

Read-only domain controller

Domain controller holding a read-only copy of the domain that receives one-way replication; it caches user credentials only for accounts permitted by its Password Replication Policy.

AD Recycle Bin

Optional forest-wide feature that preserves deleted objects and their attributes for the deleted object lifetime so they can be restored with Restore-ADObject; once enabled it cannot be disabled.

Domain controller cloning

Deploying a new domain controller from a virtualized source DC. The source must be in the Cloneable Domain Controllers group and have DCCloneConfig.xml on its system disk.

Azure Arc-enabled servers

Service that connects non-Azure Windows and Linux machines to Azure with the Connected Machine agent, extending Azure Policy, Update Manager, and Defender for Cloud to those machines.

Windows Admin Center

Browser-based management gateway for Windows Servers, failover clusters, Azure VMs, and Azure Stack HCI; it is installed on a Windows machine and reached over HTTPS port 443.

MARS agent

Microsoft Azure Recovery Services agent used by Azure Backup to protect files, folders, and system state on Windows servers; it supports up to three scheduled backups per day.

Azure File Sync cloud tiering

Feature that keeps frequently accessed files on the local Windows server while moving colder files to Azure Files, based on volume free space percentage or date policies.

Azure Monitor Agent

Monitoring agent that replaces the legacy Log Analytics Microsoft Monitoring Agent and collects performance and event data according to data collection rules defined in Azure Monitor.

Machine configuration

Azure Policy guest configuration capability that audits or configures settings inside the operating system of Azure virtual machines and Azure Arc-enabled servers.

Generation 2 virtual machine

Hyper-V VM that uses UEFI firmware with Secure Boot and virtual TPM support and boots the operating system from a SCSI controller; Generation 1 uses BIOS and IDE instead.

Production checkpoint

Checkpoint type that uses VSS inside the guest to capture a consistent disk state without saving memory contents; it is the default checkpoint type for Windows virtual machines.

Nested virtualization

Running Hyper-V inside a Hyper-V virtual machine. The parent VM's virtual network adapter must have MAC address spoofing enabled so inner virtual machines can use their own MAC addresses.

Hyper-V Replica

Asynchronous replication of a running VM to a replica server at 30-second, 5-minute, or 15-minute frequency, optionally chained to a third server through extended replication.

Process isolation

Windows container mode in which the container shares the host kernel, so the container image OS version must match the host; it has lower overhead than Hyper-V isolation.

Hyper-V isolation

Windows container mode in which each container runs inside a lightweight optimized virtual machine, allowing image OS versions that differ from the host and providing stronger isolation.

DHCP failover load balance

Failover mode in which both partner servers actively serve the same scope, splitting addresses by an administrative weight that defaults to 50:50, governed by Maximum Client Lead Time.

Stub zone

DNS zone that contains only the NS, SOA, and glue records for a namespace and stays current through zone transfers, letting the server resolve that namespace without forwarding.

Conditional forwarder

DNS server setting that forwards queries for a specified domain name to designated IP addresses rather than resolving them through root hints or full recursion.

IPAM server

Windows Server feature that discovers, manages, and audits DNS zones, DHCP scopes, and IP address space; managed servers are added manually or provisioned through Group Policy.

SMB over QUIC

SMB transport that runs over UDP port 443 using TLS 1.3 and certificate-based server authentication, allowing secure file share access without a VPN connection.

Storage Replica synchronous mode

Block-level replication that acknowledges a write only after the partner server commits it; it requires roughly 5 ms round-trip latency and dedicated log volumes on both servers.

Access-based enumeration

SMB share setting that hides files and folders from users who do not have Read permission on them, so users see only the content they can open.

FSRM hard quota

File Server Resource Manager quota that blocks further writes once the configured limit is reached, and can log events or send notifications when thresholds are crossed.

DFS Replication last-writer-wins

Conflict rule in which the file with the most recent last-write time replaces the older copy; DFS Replication also uses Remote Differential Compression to transfer only changed blocks.

Storage Spaces resiliency

Simple uses striping with no redundancy, Mirror keeps two or three copies of data, and Parity uses single or dual parity with striping for capacity-efficient fault tolerance.