I85PREP
⌘ K
Azure AZ-800 study materials
Azure AZ-800 study resources

Azure AZ-800 practice questions

One question at a time. Build your Azure AZ-800 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Your forest runs at the Windows Server 2008 R2 forest functional level. You want to promote a new Windows Server 2022 server to a domain controller in an existing domain. What must you do first?

  1. Run adprep /forestprep manually before promotion.
  2. Promote the server; no functional level change is required. Correct answer.
  3. Raise the domain functional level to Windows Server 2012 R2.
  4. Raise the forest functional level to Windows Server 2016.

Explanation

Domain controllers running Windows Server 2016 or later can be added to a forest whose forest and domain functional levels are Windows Server 2008 R2 or higher. The required schema and domain updates run automatically as part of the promotion. Raising functional levels is only necessary when you want to enable newer forest- or domain-wide features.

Question 2Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Which DNS record type allows domain-joined clients to locate a domain controller that offers a specific service such as Kerberos or LDAP?

  1. SRV record Correct answer.
  2. A (host) record
  3. PTR record
  4. CNAME record

Explanation

Domain controllers register SRV records under the _msdcs zone, and DC Locator queries those records to find a domain controller offering the requested service. Host, alias and reverse-lookup records do not advertise service capabilities.

Question 3Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Which operations master role exists only once per forest and must be available when you extend the directory schema?

  1. Infrastructure master
  2. PDC emulator
  3. Schema master Correct answer.
  4. RID master

Explanation

The schema master and the domain naming master are forest-wide roles, while the RID master, PDC emulator and infrastructure master exist once per domain. Schema changes can only be written on the domain controller holding the schema master role.

Question 4Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You are deploying a domain controller to a branch office that has no lockable server room and only intermittent WAN connectivity. Which deployment meets the requirement with the least risk?

  1. A domain controller hosting a new child domain in the branch office.
  2. A member server running the DNS Server role in the branch office.
  3. A read-only domain controller in the branch office. Correct answer.
  4. A writable global catalog server in the branch office.

Explanation

A read-only domain controller holds a read-only directory copy and caches only the credentials permitted by its password replication policy, so a physical compromise exposes limited data. It can still service local logons when the WAN is unavailable if the required credentials are cached.

Question 5Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

When you create a new child domain in an existing Active Directory forest, what trust relationship is created automatically between the child domain and its parent?

  1. A two-way shortcut trust
  2. A transitive two-way trust Correct answer.
  3. A nontransitive one-way trust
  4. A one-way external trust

Explanation

Domains inside the same forest are joined by transitive two-way Kerberos trusts created automatically at promotion, so authentication flows in both directions and passes through the forest. External and shortcut trusts are created manually and behave differently.

Question 6Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Which object do you create to associate a range of client IPv4 addresses with an Active Directory site?

  1. A site link bridge
  2. A subnet object Correct answer.
  3. A connection object
  4. A site link

Explanation

Subnet objects map IP ranges to sites so that DC Locator and replication place clients and servers in the correct site. Clients whose addresses do not map to a defined subnet fall back to random domain controller selection.

Question 7Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You need to immediately replicate pending directory changes from one domain controller to all of its replication partners. Which command do you run?

  1. dcdiag /test:replications
  2. repadmin /syncall Correct answer.
  3. ntdsutil files compact
  4. repadmin /showrepl

Explanation

The /syncall switch of repadmin triggers replication from the local domain controller to its partners. The other commands report status or test replication rather than initiating it, or they act on the directory database files.

Question 8Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Which cmdlet creates a group managed service account in Active Directory?

  1. New-ADUser
  2. Add-ADGroupMember
  3. New-ADServiceAccount Correct answer.
  4. Install-ADServiceAccount

Explanation

New-ADServiceAccount creates the group managed service account object in the directory, and Install-ADServiceAccount is then used on each host that will run the service. Group managed service accounts depend on a KDS root key in the domain.

Question 9Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You are creating the first domain controller of a new forest on a Server Core installation and must automate the promotion from the command line. Which command should you use?

  1. dcpromo /unattend:answerfile.txt
  2. Install-ADDSForest -DomainName contoso.com Correct answer.
  3. Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
  4. Add-ADDomainController -DomainName contoso.com

Explanation

Install-ADDSForest performs an unattended creation of a new forest and domain, including DNS installation when requested. The dcpromo command was deprecated after Windows Server 2008 R2 and removed in later versions.

Question 10Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

How should DNS client settings be configured on a domain controller that also hosts the DNS Server role?

  1. Preferred: a public internet resolver; alternate: its own IP address.
  2. Preferred: its own IP address; no alternate server.
  3. Preferred: another DC that runs DNS; alternate: its own IP. Correct answer.
  4. Preferred: its own IP address; alternate: a public internet resolver.

Explanation

Pointing a domain controller at another DNS server first preserves name resolution if its own DNS service is stopped or starting up, which prevents an islanded domain controller. Listing its own address as an alternate lets it fall back to its local copy of the zone.

Question 11Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

A domain controller that held all five operations master roles has failed permanently and cannot be recovered. What should you do?

  1. Raise the forest functional level so the roles are redistributed.
  2. Seize the roles on a surviving domain controller by using ntdsutil. Correct answer.
  3. Transfer the roles by using the Active Directory Users and Computers console.
  4. Restore the failed domain controller from the most recent backup.

Explanation

A graceful transfer requires the current role holder to be online, so a permanently failed domain controller requires a seizure. Seizing is performed with ntdsutil and must be done only when the original holder will never return, because the old server must never be reconnected.

Question 12Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

A domain controller was disconnected from the network and never demoted. Which action removes its lingering objects from Active Directory?

  1. Perform metadata cleanup with ntdsutil. Correct answer.
  2. Reset the directory services restore mode password on a surviving domain controller.
  3. Delete the domain controller's computer object from Active Directory Users and Computers.
  4. Run adprep /forestprep on the current schema master.

Explanation

Metadata cleanup removes the server object, its NTDS settings object and related replication connections from the directory and from DNS, which a simple object deletion does not accomplish. After cleanup the remaining domain controllers no longer attempt replication with the missing server.

Question 13Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

By default, how does Active Directory replicate a change between domain controllers in different sites?

  1. Compressed and sent immediately after every change.
  2. Compressed and sent on the site link schedule. Correct answer.
  3. Uncompressed and sent immediately after every change.
  4. Uncompressed and sent on the site link schedule.

Explanation

Intersite replication compresses the data and honors the schedule and interval configured on the site link to limit WAN usage. Intrasite replication is uncompressed and notification-based, so changes propagate within seconds.

Question 14Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Users at a branch site log on slowly and logon fails when the WAN link is down. The branch has a domain controller but no global catalog server. What should you enable?

  1. A lower site link cost between the two sites.
  2. Universal group membership caching on the branch DC. Correct answer.
  3. Selective authentication for the branch subnet.
  4. Change notification overrides on the intersite site link.

Explanation

Universal group membership caching stores the universal group memberships of users who have logged on at the site on the local domain controller, so logons do not require a global catalog query across the WAN. The cache is refreshed periodically, and enabling it avoids adding a global catalog server at the branch.

Question 15Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Which trust type provides transitive authentication between two entire Active Directory forests?

  1. A shortcut trust
  2. An external trust
  3. A forest trust Correct answer.
  4. A realm trust

Explanation

A forest trust links two forests and is transitive at the forest level, so authentication can flow between any domain in one forest and any domain in the other. External trusts link single domains and are nontransitive.

Question 16Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You synchronize an on-premises forest to Microsoft Entra ID with Microsoft Entra Connect. Users in one specific OU must never appear in the cloud directory. Where should you configure this?

  1. Clear the users' mail attributes in the on-premises directory.
  2. Block sign-in for the users in the Azure portal.
  3. Configure OU filtering in Microsoft Entra Connect. Correct answer.
  4. Remove the users from every group that is synchronized to Entra ID.

Explanation

OU filtering in Entra Connect scopes synchronization so that objects in excluded OUs are never exported to Entra ID. Removing group membership or blocking sign-in changes access but leaves the user objects present in the cloud directory.

Question 17Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Different password requirements must apply to members of the helpdesk team than to the rest of the domain. What should you create?

  1. An account lockout policy applied through a GPO
  2. A new password setting in the Default Domain Policy
  3. A fine-grained password policy for the group Correct answer.
  4. A new child domain that hosts the helpdesk accounts

Explanation

Fine-grained password policies are stored as password settings objects and can be linked to a user or global security group, overriding the domain password policy for those members. Only one password policy applies to a domain through Group Policy, so a second policy requires a password settings object.

Question 18Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You deploy an additional domain controller to an Azure virtual network. What should you configure on the virtual machine's network adapter?

  1. A static private IP address. Correct answer.
  2. An IPv6 address only, with IPv4 disabled.
  3. A public IP address for replication traffic.
  4. A dynamic private IP address assigned by Azure.

Explanation

Domain controllers must keep stable IP addresses because clients, DNS records and replication partners reference them by address. Configuring a static private address, and pointing the virtual network's DNS settings at the domain controllers, keeps the deployment reliable.

Question 19Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

After you restore a domain controller's system state in Directory Services Restore Mode, you must mark a restored organizational unit as authoritative so other domain controllers accept it. Which command do you run?

  1. repadmin /replicate
  2. dcdiag /fix
  3. ntdsutil authoritative restore Correct answer.
  4. adprep /domainprep

Explanation

The authoritative restore option in ntdsutil increments the version number of the restored objects so that they win conflict resolution and replicate to the other domain controllers. A non-authoritative restore alone would let the newer deletion replicate back and remove the objects again.

Question 20Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You must support a legacy application that requires LDAP binds and domain join, and you do not want to deploy any domain controllers in Azure. Which service should you use?

  1. Azure Files with identity-based authentication
  2. Microsoft Entra Domain Services Correct answer.
  3. Microsoft Entra ID on its own
  4. Microsoft Entra Connect cloud sync

Explanation

Microsoft Entra Domain Services provides a managed domain with LDAP, Kerberos and domain join so legacy workloads can run without domain controller virtual machines. Entra ID itself offers modern authentication but no LDAP or domain join.

Question 21Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You create a forest trust with a partner organization. Only a defined set of partner users may authenticate to specific servers in your forest, and no partner user should be able to authenticate to any other computer. What should you configure?

  1. Kerberos armoring
  2. SID filtering
  3. Selective authentication Correct answer.
  4. Name suffix routing

Explanation

Selective authentication on a trust requires that each user be explicitly granted the Allowed to authenticate permission on the computer or service they access, instead of authenticating to any resource in the trusting forest. SID filtering blocks SIDs from the other forest but does not scope which computers a user can reach.

Question 22Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Two domain controllers modify the same attribute of the same object while they cannot replicate. When replication resumes, how is the conflict resolved?

  1. The domain controller with the lowest objectGUID always wins.
  2. The attribute value is reset to null and re-entered manually.
  3. Highest version, then latest timestamp, then highest GUID. Correct answer.
  4. The domain controller holding the PDC emulator role always wins.

Explanation

Active Directory resolves attribute conflicts by comparing the version number of each originating update, then the originating timestamp if versions are equal, and finally the originating server's GUID as a deterministic tiebreaker. This ensures all domain controllers reach the same result without administrator intervention.

Question 23Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

A domain controller's system state backup is 200 days old and the forest's tombstone lifetime is 180 days. What is the consequence of restoring that backup and reconnecting the domain controller to the network?

  1. The domain controller replicates normally after a non-authoritative restore.
  2. The domain controller enters Directory Services Restore Mode automatically.
  3. The restore raises the forest functional level.
  4. The restore risks reintroducing deleted objects. Correct answer.

Explanation

Backups older than the tombstone lifetime contain objects whose deletions have already been purged from the other domain controllers, so restoring them can create lingering objects and reanimate deleted data. Current versions of Windows block such a restore by default unless an override is configured.

Question 24Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Promotion of the first Windows Server 2022 domain controller into an existing forest fails because the schema operations master cannot be contacted. What must you do to complete the promotion?

  1. Transfer the schema master role to the new server before promoting it.
  2. Bring the schema master online or move the role, then retry. Correct answer.
  3. Run adprep /rodcprep on the new server and retry the promotion.
  4. Raise the forest functional level to Windows Server 2016 and retry.

Explanation

Introducing a domain controller with a newer operating system requires schema updates that can only be written on the schema master, plus domain updates written on the infrastructure master. If either role holder is unreachable, the promotion fails until the role holder is available or the role is moved to a reachable domain controller.

Question 25Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

A domain controller running in an Azure virtual machine keeps drifting from the domain time hierarchy because it synchronizes with the Azure host. What should you do?

  1. Disable host time sync and point the PDC emulator at an NTP source. Correct answer.
  2. Configure all member servers and domain controllers in Azure to synchronize directly with the Azure host.
  3. Point every domain controller in the forest directly at a public NTP server.
  4. Restart the Windows Time service on every domain controller in the forest.

Explanation

Domain controllers should follow the Active Directory hierarchy, in which the PDC emulator of the forest root domain synchronizes with a reliable external source and all other domain controllers derive their time from it. Host-based time synchronization in Azure can shift the domain controller's clock and should be disabled on domain controller virtual machines.

Question 26Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You deploy a read-only domain controller (RODC) at a branch office. A domain user whose credentials are not present in the RODC's password cache attempts to sign in at the branch office while the WAN link to the hub site is unavailable. What is the outcome?

  1. Sign-in succeeds because the RODC holds a cached copy of every domain password hash.
  2. Sign-in fails; the RODC must forward the request to a writable domain controller. Correct answer.
  3. Sign-in fails until the user's account is added to the Domain Admins group at the branch.
  4. Sign-in succeeds, and the user's hash is cached locally for later offline sign-ins.

Explanation

An RODC can only authenticate users whose password hashes are present in its own credential cache. For any other account it forwards the authentication request to a writable domain controller, so with the WAN link down the request cannot be completed and sign-in fails.

Question 27Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You need to restore a deleted user object together with its group memberships and other attributes without performing an authoritative restore. What must be enabled in the forest first?

  1. The tombstone lifetime must be increased to 365 days on every domain controller in the forest.
  2. System state backups must be scheduled on every domain controller in the domain.
  3. The Active Directory Recycle Bin must be enabled for the forest. Correct answer.
  4. The domain functional level must be raised to Windows Server 2016 on every domain.

Explanation

The Active Directory Recycle Bin preserves the attributes and links of deleted objects so that they can be restored with a simple undelete operation. It is enabled once per forest with Enable-ADOptionalFeature, requires a forest functional level of Windows Server 2008 R2 or higher, and cannot be turned off after it is enabled.

Question 28Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

A branch site has its own writable domain controller but no global catalog server. Users at the branch must be able to sign in even when the WAN link to the hub site is unavailable. Which feature should you enable?

  1. Credential roaming implemented with a Group Policy preference.
  2. A read-only domain controller in the branch site.
  3. Universal group membership caching on the branch domain controller. Correct answer.
  4. An additional site link bridge between the branch site and the hub site.

Explanation

Universal group membership caching lets a domain controller that is not a global catalog server cache the universal group memberships of users after their first successful sign-in. Subsequent sign-ins at that site succeed even if a global catalog server cannot be contacted.

Question 29Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Domain-joined clients in a newly configured site cannot locate a domain controller. Which DNS record type stores the location information that clients query for this purpose?

  1. Host (A)
  2. Alias (CNAME)
  3. Service location (SRV) Correct answer.
  4. Text (TXT)

Explanation

Domain controllers register service location (SRV) records under _msdcs, _sites, _tcp, and _udp folders so that clients can locate LDAP and Kerberos services for a domain or site. A missing or incorrectly registered SRV record prevents clients from discovering a domain controller.

Question 30Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Your network uses a hub-and-spoke design in which each branch site has a single IP site link to the hub site and no site link exists between branches. Branch domain controllers are replicating directly with each other. Which configuration change prevents this?

  1. Move all branch domain controllers into the hub site object.
  2. Set the replication interval on the branch site links to 15 minutes.
  3. Clear the Bridge all site links setting for the IP transport. Correct answer.
  4. Assign a much higher cost to each branch-to-hub site link.

Explanation

By default the IP transport has Bridge all site links enabled, which makes the knowledge consistency checker treat all IP site links as transitive and compute paths across them. Clearing that setting forces you to define explicit site link bridges, so only the paths you intend are used for replication.

Question 31Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

A domain still replicates the SYSVOL shared folder by using File Replication Service (FRS). You must migrate SYSVOL replication to DFS Replication. Which command controls the migration state of the domain?

  1. ntdsutil files integrity
  2. adprep /forestprep
  3. dfsrmig /setglobalstate Correct answer.
  4. repadmin /syncall /AdeP

Explanation

The Dfsrmig.exe tool moves the domain through the Prepared, Redirected, and Eliminated states of the SYSVOL migration, and /setglobalstate changes the state for the whole domain. Each state must be set and allowed to replicate to all domain controllers before the next state is applied.

Question 32Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You must join 500 servers to the domain while they are being imaged, before they ever connect to the corporate network. Which approach should you use?

  1. Run Add-Computer with stored credentials after each server is deployed.
  2. Prestage each computer account in Active Directory Users and Computers.
  3. Deploy a Group Policy preference that joins the computer at startup.
  4. Create an offline domain join blob with djoin.exe and apply it during imaging. Correct answer.

Explanation

djoin.exe /provision creates a base64 blob containing the computer account metadata that the domain controller would normally write during a join, and djoin.exe /requestODJ applies that blob to an offline Windows image. This lets the server join at first start without network contact with a domain controller.

Question 33Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You plan to clone a virtualized domain controller. Which requirement must be satisfied by the source domain controller?

  1. It must be shut down while the clone is created.
  2. It must be running on a Generation 1 virtual machine.
  3. The source server must be in the Cloneable Domain Controllers group. Correct answer.
  4. It must hold the PDC emulator operations master role.

Explanation

Domain controller cloning requires the source domain controller's computer account to be a member of the Cloneable Domain Controllers group, and the Default Domain Controllers Policy must not block the required replication permissions. A DCCloneConfig.xml file then supplies the clone-specific settings such as name and IP address.

Question 34Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You configure pass-through authentication in Microsoft Entra Connect. Which on-premises component validates users' passwords during Microsoft Entra ID sign-in?

  1. A Microsoft Entra Connect Health agent installed on a domain controller.
  2. A read-only domain controller published to Microsoft Entra ID.
  3. An Active Directory Federation Services farm deployed in the perimeter network.
  4. An authentication agent installed on an on-premises member server. Correct answer.

Explanation

Pass-through authentication uses one or more lightweight authentication agents, typically installed on member servers, that receive sign-in requests from Microsoft Entra ID and validate the password directly against Active Directory. No password hash is stored in the cloud, and the agents provide resilience when deployed on multiple servers.

Question 35Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You are deploying a domain controller to a remote site across a slow WAN link and want to avoid replicating the entire directory database during promotion. What should you do?

  1. Restore a system state backup taken from an existing domain controller onto the new server.
  2. Assign a lower cost to the site link that connects the remote site.
  3. Create installation media with Ntdsutil and promote from it. Correct answer.
  4. Promote the server by using the -NoRebootOnCompletion parameter.

Explanation

Install from media uses a snapshot of the directory database and SYSVOL created with Ntdsutil so that only changes made since the media was created must cross the WAN link during promotion. The media is supplied through the InstallationMediaPath parameter of the promotion cmdlet.

Question 36Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

Users in the Europe domain of a forest must access resources in the Asia domain of the same forest, and authentication traffic currently flows through domain controllers in the forest root domain. Which trust should you create to shorten the authentication path?

  1. A forest trust between the two domains.
  2. A shortcut trust between the two domains. Correct answer.
  3. An external trust between the two domains.
  4. A realm trust between the two domains.

Explanation

A shortcut trust is a transitive trust created between two domains in the same forest to shorten the referral path between them. Because parent-child trusts already make the two domains members of one forest, the shortcut simply optimizes authentication traffic.

Question 37Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You need domain controller-hosted DNS zones to replicate to every DNS server in the forest, including servers in other domains, while keeping the zone data out of the global catalog. Which zone replication scope should you choose?

  1. All DNS servers in the forest Correct answer.
  2. All DNS servers in the domain
  3. All domain controllers in the domain
  4. All domain controllers in the forest

Explanation

The All DNS servers in the forest scope stores zone data in the ForestDnsZones application partition, which replicates to every DNS server that is also a domain controller in the forest. Application partitions are not replicated to the global catalog, so the data stays out of it.

Question 38Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You revert a virtualized domain controller to a checkpoint taken several days ago. The hypervisor does not expose a VM-Generation ID to the guest. After the machine starts, replication partners stop accepting changes from this domain controller. What is the cause?

  1. The virtual machine lost its Kerberos ticket, so the KDC refused to issue service tickets.
  2. Rolling back the database without changing the invocation ID triggered USN rollback. Correct answer.
  3. The checkpoint restored the wrong site link, so the KCC removed all replication connections.
  4. The restored SYSVOL copy was outdated, so DFS Replication blocked all partner connections.

Explanation

When a domain controller's database is rolled back, it begins issuing update sequence numbers that it has already used, and its invocation ID is unchanged. Partners detect this inconsistency, log a USN rollback event, and stop replicating from the affected domain controller until it is restored from a valid backup or force-demoted and re-promoted.

Question 39Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

You must ensure that members of the administrative team can sign in only to a designated set of servers and cannot authenticate with NTLM. Which feature should you configure?

  1. Authentication policy silos Correct answer.
  2. Fine-grained password policies
  3. Restricted groups configured through Group Policy
  4. The Protected Users security group

Explanation

Authentication policy silos bind a set of user, computer, and service accounts to an authentication policy that can restrict which hosts an account may sign in to and block NTLM authentication. Silos require a domain functional level of Windows Server 2012 R2 or later.

Question 40Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30–35%)

A forest contains two domains, and only some domain controllers in each domain host the global catalog. Where should the infrastructure master role be placed?

  1. On the domain controller that holds the PDC emulator role in the forest root domain.
  2. On a read-only domain controller in a branch site.
  3. On a global catalog server so that cross-domain references are always current.
  4. On a domain controller that does not host the global catalog. Correct answer.

Explanation

The infrastructure master updates references to objects in other domains by comparing its own data with the global catalog. If it runs on a global catalog server while other domain controllers are not global catalogs, it never detects that the references are stale, so cross-domain updates are not replicated correctly.

Question 41Manage Windows Servers and workloads in a hybrid environment (10–15%)

You need to project an on-premises Windows Server into Azure so that it can be governed with Azure Policy and viewed in the Azure portal. Which agent must you install on the server?

  1. The Microsoft Azure Recovery Services agent
  2. The Azure File Sync agent
  3. The Azure Connected Machine agent Correct answer.
  4. The Microsoft Monitoring Agent

Explanation

Azure Arc-enabled servers use the Azure Connected Machine agent (azcmagent) to establish the outbound connection to Azure and create the machine's Azure resource representation. That resource is what Azure Policy, Azure Monitor, and other Azure services target.

Question 42Manage Windows Servers and workloads in a hybrid environment (10–15%)

Which Azure service should you use to replicate on-premises Hyper-V and VMware virtual machines into Azure for disaster recovery?

  1. Azure Site Recovery Correct answer.
  2. Azure Migrate
  3. Azure Backup
  4. Azure File Sync

Explanation

Azure Site Recovery replicates on-premises virtual machines to Azure and orchestrates test failover and failover during a disaster. Migration of workloads is handled by Azure Migrate, and data protection is handled by Azure Backup.

Question 43Manage Windows Servers and workloads in a hybrid environment (10–15%)

Users open the Windows Admin Center gateway in a web browser. Which TCP port does the gateway listen on by default?

  1. TCP 5985
  2. TCP 3389
  3. TCP 80
  4. TCP 443 Correct answer.

Explanation

The Windows Admin Center gateway is a web application that listens on TCP 443 for HTTPS by default. Clients connect with a supported browser rather than with a remote-desktop or WinRM client directly.

Question 44Manage Windows Servers and workloads in a hybrid environment (10–15%)

Which Azure service lets you assess and install Windows updates across Azure Arc-enabled servers at scale from the Azure portal?

  1. Windows Server Update Services
  2. Azure Update Manager Correct answer.
  3. Azure Automation Update Management
  4. Microsoft Intune

Explanation

Azure Update Manager provides agentless-style update assessment and patching for Azure virtual machines and Arc-enabled servers, with schedules defined by maintenance configurations. It is the current patching service for hybrid servers managed through Azure.

Question 45Manage Windows Servers and workloads in a hybrid environment (10–15%)

You must back up files and folders from an on-premises Windows Server to a Recovery Services vault without deploying any additional server infrastructure. Which component should you use?

  1. Microsoft Azure Backup Server
  2. Azure Site Recovery
  3. Azure File Sync
  4. The Microsoft Azure Recovery Services (MARS) agent Correct answer.

Explanation

The MARS agent installs directly on a Windows Server and sends file and folder backups to a Recovery Services vault without requiring a staging server. It also supports system state backup for that server.

Question 46Manage Windows Servers and workloads in a hybrid environment (10–15%)

You want to collect Windows event logs and performance counters from Arc-enabled servers into a Log Analytics workspace. Which agent should you deploy on those servers?

  1. The Azure Monitor Agent Correct answer.
  2. The Azure Connected Machine agent
  3. The Microsoft Monitoring Agent
  4. The Dependency agent

Explanation

The Azure Monitor Agent is the current telemetry agent for Azure Monitor and collects data according to data collection rules. It supersedes the legacy Microsoft Monitoring Agent for both Azure and Arc-enabled machines.

Question 47Manage Windows Servers and workloads in a hybrid environment (10–15%)

Azure Automanage machine best practices can be applied to which set of machines?

  1. Both Azure virtual machines and Arc-enabled servers Correct answer.
  2. Only Azure virtual machines
  3. Only physical servers located in a datacenter
  4. Only Arc-enabled servers

Explanation

Automanage machine best practices onboards both Azure virtual machines and Azure Arc-enabled servers, applying a curated set of Azure service configurations. The same configuration profile can therefore be used across cloud and on-premises machines.

Question 48Manage Windows Servers and workloads in a hybrid environment (10–15%)

You need to synchronize user accounts and password hashes from on-premises Active Directory Domain Services to Microsoft Entra ID. Which tool should you use?

  1. Azure Migrate
  2. Microsoft Entra Connect Sync Correct answer.
  3. Active Directory Federation Services
  4. Windows Admin Center

Explanation

Microsoft Entra Connect Sync synchronizes on-premises directory objects to Microsoft Entra ID and supports password hash synchronization as a sign-in method. It is the standard directory integration tool for hybrid identity.

Question 49Manage Windows Servers and workloads in a hybrid environment (10–15%)

A file server holds 40 TB of data but has only 5 TB of local disk space. You want the full dataset available through the same namespace while keeping only actively used files cached locally. Which Azure File Sync feature should you enable?

  1. Volume Shadow Copy
  2. DFS Replication
  3. Cloud tiering Correct answer.
  4. Storage Replica

Explanation

Cloud tiering keeps frequently accessed files on the local volume and replaces cold files with reparse points that recall data from the Azure file share on demand. This lets a small local volume front a much larger cloud dataset without changing user paths.

Question 50Manage Windows Servers and workloads in a hybrid environment (10–15%)

You are preparing to register a Windows Server with Azure File Sync. Which Azure resource must exist before the server can be registered?

  1. A Recovery Services vault
  2. A Storage Sync Service Correct answer.
  3. A Log Analytics workspace
  4. An Azure Automation account

Explanation

The Storage Sync Service is the top-level Azure resource for Azure File Sync and is the resource to which servers are registered. Sync groups, cloud endpoints, and server endpoints are all created within it.