Azure AZ-800 key terms

The top-level Active Directory container that holds one or more domains sharing a common schema, configuration, and global catalog. Trust relationships between domains in the same forest are automatic and transitive.

A logical AD DS boundary that groups objects such as users, computers, and groups and holds its own copy of the directory database. It defines an administrative and security boundary for account policies.

A container inside a domain used to organize objects and delegate administration. Group Policy objects and permissions are commonly linked to or applied at this level.

A set of well-connected IP subnets used to describe network topology for replication, authentication, and service location. Clients prefer to authenticate against domain controllers in their own site.

A server that hosts a writable copy of the AD DS database and the SYSVOL share, and that authenticates users and computers and answers directory queries.

Five specialized domain controller responsibilities: Schema Master, Domain Naming Master, RID Master, PDC Emulator, and Infrastructure Master. Each role is held by exactly one domain controller in the forest or domain.

A domain controller that holds a read-only copy of the directory database and does not store most credentials by default. It is typically deployed in branch offices with limited physical security.

A relationship that lets users in one domain or forest be authenticated by another. Direction and transitivity settings determine which side trusts the other and how far the trust extends.

A managed domain account whose password is generated and rotated automatically by AD DS. Services running on multiple authorized hosts can use it without an administrator knowing the password.

A password and lockout policy stored in AD DS that applies to specific users or global security groups rather than the whole domain. It requires a Windows Server 2008 domain functional level or later.

A Microsoft tool installed on a Windows server that synchronizes on-premises AD DS objects to Microsoft Entra ID, optionally including password hashes, and enables hybrid identity scenarios.

A sign-in method in which a hash of the on-premises password is synchronized to Microsoft Entra ID so users can authenticate in the cloud with the same credentials they use locally.

A hybrid sign-in method where Microsoft Entra ID validates credentials by passing them to an on-premises authentication agent, so no password hash is stored in the cloud.

A Microsoft-managed domain service in Azure that provides LDAP, Kerberos, and domain join for cloud workloads without requiring you to deploy, patch, or maintain domain controllers yourself.

A device state in which a Windows device is joined to on-premises AD DS and also registered with Microsoft Entra ID, enabling both domain-based and cloud-based management and single sign-on.

A browser-based management console for Windows Servers that can administer servers, clusters, Hyper-V hosts, and Azure services from a single gateway, including Server Core installations without a GUI.

A service that connects non-Azure Windows and Linux machines to Azure so you can apply policies, extensions, monitoring, and update management to servers running outside Azure.

An Azure service that assesses and deploys operating system and software updates to Azure virtual machines, Arc-enabled servers, and other registered machines on a schedule and with reporting.

An Azure Automanage capability that audits and enforces desired settings on Arc-enabled servers and Azure VMs by assigning PowerShell DSC or custom script configurations through Azure Policy.

A software-based Layer 2 switch created in Hyper-V that connects virtual machines to each other, to the host, and to external networks through virtual network adapters.

A point-in-time snapshot of a virtual machine's state, disks, and optionally memory that can be reverted to. Production checkpoints use Volume Shadow Copy for application-consistent results.

Moving a running virtual machine between Hyper-V hosts with little or no downtime. It requires shared storage, storage migration, or a cluster with shared or replicated storage.

Running Hyper-V inside a Hyper-V virtual machine so the guest can host its own virtual machines. It requires exposing virtualization extensions to the guest and a supported configuration.

An isolated process or Hyper-V-isolated environment that runs a Windows application using a shared or dedicated kernel, built from a layered container image.

A container isolation mode in which each container runs inside a lightweight utility virtual machine with its own kernel, providing a stronger security boundary than process isolation.

A Hyper-V virtual machine whose disks, state, and live migration traffic are encrypted and that can start only on a host attested as healthy by the Host Guardian Service.

A role that issues and validates attestation and key-protection certificates so shielded virtual machines can start only on trusted guarded hosts, typically deployed as its own cluster.

A Windows Server feature that pairs two DHCP servers in hot standby or load-balancing mode so lease and scope settings replicate and clients continue to receive addresses if one server fails.

A Windows Server feature for discovering, tracking, and managing IP address space, DHCP scopes, and DNS zones across an organization from a central console.

A VPN connection that links an on-premises VPN gateway to an Azure VPN gateway so resources on both networks can communicate over an encrypted tunnel across the internet.

A private, dedicated connection from an on-premises network to Azure through a connectivity provider, offering higher reliability and more predictable latency than internet-based VPN links.

A DNS server setting that forwards queries for one specific domain name to designated name servers, often used to resolve names between on-premises, Azure, and other forests.

A feature that pools locally attached drives across servers in a cluster into software-defined storage with caching, tiering, and fault tolerance for Hyper-V and Azure Stack HCI workloads.

A Windows Server feature that replicates volumes synchronously or asynchronously between servers, clusters, or sites for disaster recovery and stretched-cluster scenarios.

A service that keeps Windows Server file shares in sync with an Azure file share, enabling cloud tiering, multi-site access, and cloud-based backup of on-premises files.

A virtual folder tree that groups shared folders hosted on multiple servers under one path, so users can reach files through a stable, location-independent name.

A multimaster replication engine that synchronizes folders between servers using a WAN-efficient protocol, commonly used behind DFS Namespaces and for branch office data.

A folder or volume made available to network clients over the Server Message Block protocol, with access controlled by a combination of share permissions and NTFS permissions.

A limit configured in File Server Resource Manager that restricts how much space a folder or volume can consume, using soft or hard enforcement with optional notification actions.

A Windows Server role service that reduces storage use by keeping duplicate chunks of data only once and referencing them, with optional compression of cold files.