Azure AZ-801 flashcards
Azure AZ-801 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Windows LAPS storage
- Managed local administrator passwords are stored in Active Directory (with schema extension) or Entra ID, encrypted with DPAPI-NG so only authorized principals can retrieve them.
- Credential Guard requirement
- Needs virtualization-based security, UEFI with Secure Boot, and VT-x/AMD-V; it isolates LSA secrets but breaks drivers that access LSASS directly.
- Protected Users effect
- Members cannot authenticate with NTLM, Digest, or CredSSP, cannot use unconstrained Kerberos delegation, and receive a non-configurable four-hour TGT lifetime.
- SMB encryption scope
- SMB 3.x encrypts data in transit using AES-GCM or AES-CCM; enable per share or per server, and note that encryption adds CPU overhead.
- JEA components
- A session configuration file (.pssc) pairs with role capability files (.psrc) that list visible cmdlets and parameters; sessions run in constrained language mode.
- Tier 0 assets
- Identity infrastructure such as domain controllers, AD FS, and Entra Connect; administrative credentials for these systems must never be used on lower tiers.
- BitLocker Network Unlock
- Supplies the BitLocker startup key over DHCP during boot for headless servers with TPM, avoiding manual PIN entry while keeping pre-boot protection.
- Cloud witness quorum
- A quorum witness stored in an Azure Storage account; requires internet access and an account key, and replaces file share or disk witness for multisite clusters.
- CSV purpose
- Cluster Shared Volumes give every node simultaneous NTFS access to one volume, which is required for Hyper-V live migration and Scale-Out File Server.
- Live migration prerequisites
- Compatible processors or processor compatibility mode, shared storage or SMB 3.0, identical virtual switch names, and proper delegation or CredSSP configuration.
- Storage Spaces Direct minimum
- Requires at least two nodes, four recommended; RDMA NICs are preferred, and the configuration must pass Test-Cluster validation before enabling.
- NLB affinity options
- None, Single, or Class C; affinity keeps a client's requests on one node, which is needed for stateful TCP services that NLB otherwise cannot preserve.
- Cluster-Aware Updating modes
- Self-updating mode lets the cluster patch itself on a schedule; remote-updating mode pushes updates from an administrator console to the cluster.
- Failover cluster quorum types
- Node Majority, Node and Disk Majority, Node and File Share Majority, and No Majority (Disk Only); choose based on node count and shared storage availability.
- Scale-Out File Server use
- Provides continuously available SMB 3.0 shares with transparent failover for application data such as Hyper-V and SQL, not for user home folders.
- System state contents
- Includes registry, COM+ registration, SYSVOL, Active Directory on DCs, cluster quorum, and IIS metabase; it excludes user data and application files.
- Authoritative AD restore
- After a nonauthoritative restore, run ntdsutil authoritative restore to increment version numbers so restored objects replicate back out to other domain controllers.
- DSRM purpose
- Directory Services Restore Mode boots a domain controller without AD DS so NTDS.dit and SYSVOL can be restored offline from backup.
- Hyper-V Replica recovery points
- Asynchronous replication with configurable recovery points, such as every five minutes plus hourly snapshots; failover can be planned, unplanned, or test.
- Azure Site Recovery role
- Replicates Hyper-V, VMware, and physical servers to Azure or a secondary site; recovery plans define ordered startup and automated scripts.
- MARS agent scope
- The Azure Backup agent backs up files, folders, and system state for Windows Server to a Recovery Services vault; it does not provide application-consistent database backups.
- Forced quorum recovery
- When a cluster loses quorum, start the Cluster service with the /forcequorum switch to bring it online, then repair and reconfigure quorum settings.
- Storage Migration Service flow
- Inventory source servers, transfer data with ACLs, shares, and ownership preserved, then cut over by swapping names and IPs to the destination.
- ADMT SID history
- The Active Directory Migration Tool moves users, groups, and computers between forests and can preserve SID history so old permissions keep working.
- DHCP export and import
- Export-DhcpServer writes scopes, options, and reservations to a file; Import-DhcpServer restores them on the target server with the same configuration.
- AD-integrated DNS migration
- Recreate the zone as AD-integrated on the target; the zone data then replicates through Active Directory rather than requiring a manual file copy.
- Entra Connect staging mode
- A staging server imports and synchronizes but does not export changes; promote it by disabling staging mode and demoting the original server.
- Azure Migrate assessment
- Discovers on-premises servers and evaluates readiness, sizing, and cost; actual replication is performed by Azure Migrate Server Migration or Site Recovery.
- Performance Monitor log formats
- Data collector sets write binary .blg, comma-separated .csv, or tab-separated .tsv; .blg supports circular logging and is the default for counter logs.
- Event forwarding prerequisites
- WinRM must be enabled on sources; the collector's machine account belongs to Event Log Readers, and subscriptions are source-initiated or collector-initiated.
- Disk latency counter
- PhysicalDisk\Avg. Disk sec/Read and /Write measure I/O latency; sustained values above about 10-20 ms indicate a storage bottleneck.
- Bootrec repair options
- /fixmbr, /fixboot, /scanos, and /rebuildbcd repair boot records and the boot configuration store from Windows Recovery Environment.