I85PREP
⌘ K
AZ-802 Windows Server Hybrid Administrator study materials
AZ-802 Windows Server Hybrid Administrator study resources

AZ-802 Windows Server Hybrid Administrator practice questions

One question at a time. Build your AZ-802 Windows Server Hybrid Administrator understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Deploy and manage Windows Server in hybrid environments

A company wants to extend its on-premises Active Directory domain to Azure virtual machines without deploying a new domain controller from scratch. Which approach lets an existing domain controller be moved to an Azure VM while preserving its identity and configuration?

  1. Create a new forest in Azure and establish a forest trust
  2. Deploy Azure AD Domain Services and point clients to it
  3. Promote a new domain controller in an Azure VM and transfer FSMO roles
  4. Use Azure Site Recovery to replicate the domain controller VM to Azure Correct answer.

Explanation

Azure Site Recovery can replicate an existing domain controller virtual machine to Azure, preserving the server identity, computer account, and configuration after failover. This is the supported method for extending a domain by relocating an existing domain controller rather than building a new one.

Question 2Deploy and manage Windows Server in hybrid environments

Which Azure feature provides a managed domain services offering that supports LDAP and Kerberos for cloud workloads without requiring domain controller VMs?

  1. Azure Active Directory Domain Services Correct answer.
  2. Azure VPN Gateway
  3. Azure File Sync
  4. Azure Active Directory Connect

Explanation

Azure Active Directory Domain Services (Azure AD DS) is a managed domain service that provides domain join, LDAP, and Kerberos/NTLM authentication without deploying or managing domain controllers. It is designed for lift-and-shift workloads that depend on legacy authentication protocols.

Question 3Deploy and manage Windows Server in hybrid environments

An administrator must ensure that a Windows Server VM in Azure receives a stable private IP address that persists across reboots and deallocations. What should be configured?

  1. A public IP address with a DNS label
  2. A dynamic private IP on the network interface
  3. A static private IP assigned to the network interface Correct answer.
  4. A reserved IP in the virtual network gateway

Explanation

Assigning a static private IP address to the network interface guarantees the address remains the same across reboots and deallocation. Dynamic private IPs are retained during normal operation but can change when the VM is deallocated.

Question 4Deploy and manage Windows Server in hybrid environments

Which tool should be used to migrate an on-premises Windows Server file server to Azure while keeping the same namespace and minimizing user disruption?

  1. Storage Migration Service Correct answer.
  2. Azure Migrate: Server Assessment
  3. Robocopy with /MIR
  4. Windows Server Backup

Explanation

Storage Migration Service inventories, transfers, and cuts over file servers to a new destination while preserving shares, permissions, and namespace. It is designed to minimize disruption during server migration.

Question 5Deploy and manage Windows Server in hybrid environments

A company needs to synchronize identities from on-premises Active Directory to Azure AD so users can sign in to Microsoft 365 with the same credentials. Which component is required?

  1. Azure AD Application Proxy
  2. Azure AD Connect Correct answer.
  3. Active Directory Federation Services proxy
  4. Azure AD Connect Health

Explanation

Azure AD Connect performs directory synchronization between on-premises Active Directory and Azure AD, enabling users to use the same credentials for Microsoft 365 and other cloud services. It supports password hash sync, pass-through authentication, and federation.

Question 6Deploy and manage Windows Server in hybrid environments

Which Azure hybrid connectivity option provides a site-to-site connection over the public internet with IPsec encryption?

  1. Azure ExpressRoute
  2. Azure VPN Gateway Correct answer.
  3. Azure Virtual WAN hub
  4. Azure Private Link

Explanation

Azure VPN Gateway supports site-to-site IPsec/IKE tunnels over the public internet, connecting on-premises networks to Azure virtual networks. ExpressRoute uses a private dedicated circuit instead of the public internet.

Question 7Deploy and manage Windows Server in hybrid environments

An administrator is configuring Azure Backup for an on-premises Windows Server using the Microsoft Azure Recovery Services agent. Which component must be installed and registered first?

  1. A DPM protection agent
  2. The MARS agent with a Recovery Services vault credential Correct answer.
  3. The Azure File Sync agent
  4. Azure Backup Server

Explanation

The Microsoft Azure Recovery Services (MARS) agent must be installed on the server and registered with a Recovery Services vault using vault credentials before backups can be scheduled. This enables direct backup of files and system state to Azure.

Question 8Deploy and manage Windows Server in hybrid environments

Which Windows Server feature allows administrators to manage servers from a centralized console using PowerShell remoting and WinRM?

  1. Remote Desktop Services
  2. Server Manager local console
  3. Failover Cluster Manager
  4. Windows Admin Center Correct answer.

Explanation

Windows Admin Center is a browser-based management tool that centralizes administration of Windows Servers, including hybrid and Azure-connected servers, using PowerShell remoting and WinRM. It provides a single pane for managing roles, updates, and storage.

Question 9Deploy and manage Windows Server in hybrid environments

A company wants to use Azure Arc-enabled servers to manage an on-premises Windows Server. What must be installed on the server to connect it to Azure?

  1. The Azure AD Connect agent
  2. The Azure Monitor agent only
  3. The Log Analytics agent
  4. The Azure Connected Machine agent Correct answer.

Explanation

Azure Arc-enabled servers require the Azure Connected Machine agent, which establishes the outbound connection to Azure and enables management capabilities such as policy, monitoring, and inventory. Other agents may be added later but are not the connection mechanism.

Question 10Deploy and manage Windows Server in hybrid environments

Which Windows Server capability enables a VM in Azure to use Azure Disk Encryption with BitLocker?

  1. The BitLocker Drive Encryption feature with a key vault Correct answer.
  2. ReFS integrity streams
  3. Shielded VM provisioning
  4. Storage Spaces Direct

Explanation

Azure Disk Encryption for Windows VMs uses the BitLocker feature inside the guest and stores encryption keys in Azure Key Vault. The VM must have the BitLocker feature available and a key vault configured for key escrow.

Question 11Deploy and manage Windows Server in hybrid environments

An administrator needs to join an Azure VM running Windows Server to an on-premises Active Directory domain. Which two requirements must be met? (Choose the best answer.)

  1. Azure AD join and Intune enrollment
  2. A site-to-site VPN and Azure AD DS
  3. A public IP address and an NSG rule allowing LDAP
  4. DNS resolution of domain records and network connectivity to domain controllers Correct answer.

Explanation

Domain join requires the VM to resolve the domain's DNS records and to reach domain controllers over the network for Kerberos and LDAP traffic. Without correct DNS and connectivity, the join operation fails.

Question 12Deploy and manage Windows Server in hybrid environments

Which Azure service should be used to centrally collect security events and performance data from both Azure VMs and on-premises servers?

  1. Azure Service Health
  2. Azure Advisor
  3. Azure Monitor with Log Analytics workspace Correct answer.
  4. Network Watcher

Explanation

Azure Monitor sends metrics and logs from Azure and hybrid servers to a Log Analytics workspace, where they can be queried and alerted on. Agents such as the Azure Monitor agent collect the data from both cloud and on-premises machines.

Question 13Deploy and manage Windows Server in hybrid environments

A company wants to replicate an on-premises file share to Azure and keep it accessible from the local server with cloud tiering. Which service accomplishes this?

  1. Azure File Sync Correct answer.
  2. Azure Blob Storage with SAS tokens
  3. Storage Replica
  4. Azure Data Box

Explanation

Azure File Sync turns a Windows Server into a cache of an Azure file share, providing bi-directional synchronization and cloud tiering so frequently used files remain local. It preserves the local server namespace while extending capacity to Azure.

Question 14Deploy and manage Windows Server in hybrid environments

Which option allows an administrator to apply Azure Policy to on-premises servers enrolled in Azure Arc?

  1. Configure a local Group Policy object
  2. Assign a policy with the Microsoft.HybridCompute/machines resource type Correct answer.
  3. Create an NSG rule referencing the server
  4. Enable Azure Bastion for the server

Explanation

Azure Arc projects on-premises servers into Azure as Microsoft.HybridCompute/machines resources, so Azure Policy assignments scoped to that resource type apply to them. This enables governance and compliance evaluation for hybrid machines.

Question 15Deploy and manage Windows Server in hybrid environments

Which Windows Server feature should be enabled to allow an Azure VM to participate in a Storage Replica stretch cluster across regions?

  1. Windows Server Update Services
  2. Data Deduplication
  3. Storage Replica Correct answer.
  4. BranchCache

Explanation

Storage Replica replicates volumes between servers or clusters, including stretch clusters across sites, enabling disaster recovery scenarios. It is available in Windows Server Datacenter and supports synchronous and asynchronous replication.

Question 16Deploy and manage Windows Server in hybrid environments

An administrator wants to use Azure Bastion to connect to a Windows Server VM without exposing RDP to the internet. What is required?

  1. Azure Bastion deployed in the VM's virtual network and the VM without a public IP Correct answer.
  2. A site-to-site VPN and a jump server
  3. Azure Firewall with DNAT rules for RDP
  4. A public IP on the VM and an NSG rule for RDP

Explanation

Azure Bastion provides RDP and SSH access through the Azure portal over TLS from a dedicated subnet in the virtual network. The target VM does not need a public IP or inbound RDP rules, reducing exposure.

Question 17Deploy and manage Windows Server in hybrid environments

Which command installs the Azure Connected Machine agent on a Windows Server for Azure Arc enrollment when run from the server?

  1. az arc connect
  2. Connect-AzAccount
  3. azcmagent connect Correct answer.
  4. Register-AzResourceProvider

Explanation

The azcmagent connect command registers the server with Azure Arc using a service principal or token and tenant/subscription details. The agent must be installed first, then connected with this command.

Question 18Deploy and manage Windows Server in hybrid environments

Which Windows Server role provides centralized update management for on-premises and Azure VMs in a hybrid environment?

  1. Microsoft Endpoint Configuration Manager
  2. Azure Update Manager Correct answer.
  3. Azure Automation State Configuration
  4. Windows Server Update Services

Explanation

Azure Update Manager provides a cloud-based solution to assess and deploy updates across Azure, on-premises, and multi-cloud servers, including Arc-enabled machines. It reduces dependence on maintaining on-premises update infrastructure.

Question 19Deploy and manage Windows Server in hybrid environments

What is the purpose of the Azure Network Adapter in Windows Admin Center when managing a hybrid server?

  1. It configures an ExpressRoute circuit
  2. It creates a point-to-site VPN connection from the server to an Azure virtual network Correct answer.
  3. It enables Azure File Sync
  4. It assigns a public IP address to the server

Explanation

The Azure Network Adapter in Windows Admin Center creates a point-to-site VPN connection so an on-premises server can reach Azure virtual networks without a site-to-site VPN. It simplifies hybrid connectivity for individual servers.

Question 20Deploy and manage Windows Server in hybrid environments

Which Azure feature allows an on-premises Windows Server to be backed up directly to a Recovery Services vault without additional infrastructure?

  1. Azure Backup Server
  2. Azure Site Recovery
  3. DPM
  4. MARS agent Correct answer.

Explanation

The MARS agent backs up files, folders, and system state from on-premises Windows Servers directly to a Recovery Services vault. It requires no additional backup server infrastructure.

Question 21Deploy and manage Windows Server in hybrid environments

A company needs to ensure that an Azure VM's operating system disk is encrypted at rest using platform-managed keys. Which encryption option satisfies this requirement with the least administrative effort?

  1. Customer-managed keys in a key vault
  2. Encryption at host
  3. Azure Disk Encryption with BitLocker
  4. Server-side encryption with platform-managed keys Correct answer.

Explanation

Azure managed disks are encrypted at rest by default using platform-managed keys, requiring no configuration. This satisfies at-rest encryption requirements with minimal administrative effort.

Question 22Deploy and manage Windows Server in hybrid environments

Which Windows Server feature must be installed to use Windows Admin Center for managing Hyper-V hosts remotely?

  1. Remote Server Administration Tools only
  2. Hyper-V Manager
  3. The Windows Admin Center gateway installed on a server or PC Correct answer.
  4. Failover Clustering

Explanation

Windows Admin Center is a gateway-based tool that must be installed on a Windows Server or Windows client, then accessed through a browser. It then manages remote servers and clusters.

Question 23Deploy and manage Windows Server in hybrid environments

An administrator wants to use Azure Monitor to collect Windows event logs from an on-premises server. Which agent should be deployed?

  1. MARS agent
  2. Dependency agent
  3. Azure Monitor agent Correct answer.
  4. Azure Connected Machine agent only

Explanation

The Azure Monitor agent collects Windows event logs, performance counters, and other telemetry and sends them to a Log Analytics workspace. It supports Azure, on-premises, and Arc-enabled servers.

Question 24Deploy and manage Windows Server in hybrid environments

Which option describes the role of Azure AD Connect Health in a hybrid identity deployment?

  1. It synchronizes passwords between forests
  2. It publishes internal applications externally
  3. It provides LDAP services for Azure VMs
  4. It monitors the health of AD FS, Azure AD Connect, and AD DS agents Correct answer.

Explanation

Azure AD Connect Health monitors the health and performance of identity infrastructure components such as AD FS, Azure AD Connect, and AD DS domain controllers. It surfaces alerts and usage analytics for those agents.

Question 25Deploy and manage Windows Server in hybrid environments

A company wants to migrate on-premises Hyper-V VMs to Azure with minimal downtime. Which Azure Migrate tool should be used?

  1. Azure Migrate: Discovery and Assessment
  2. Azure Site Recovery only
  3. Azure Data Box
  4. Azure Migrate: Server Migration Correct answer.

Explanation

Azure Migrate: Server Migration uses replication to move VMware, Hyper-V, and physical servers to Azure with controlled cutover and minimal downtime. Assessment tools only evaluate readiness and cost.

Question 26Deploy and manage Windows Server in hybrid environments

A company plans to extend its on-premises Active Directory to Azure. Which Windows Server role must be deployed in Azure to provide domain services when a VPN connection to the corporate network is not available?

  1. Active Directory Domain Services on an Azure VM Correct answer.
  2. Active Directory Federation Services on an Azure VM
  3. DNS Server role on an Azure VM
  4. Windows Server Update Services on an Azure VM

Explanation

When no reliable site-to-site link exists, a domain controller role (Active Directory Domain Services) is installed on an Azure virtual machine so the domain remains available in the cloud. AD DS provides authentication and directory services locally within Azure. Other roles add federation or update functions but do not host the domain itself.

Question 27Deploy and manage Windows Server in hybrid environments

An administrator wants on-premises servers to appear in the Azure portal as resources so they can be inventoried and governed alongside Azure VMs. Which service accomplishes this?

  1. Azure Arc-enabled servers Correct answer.
  2. Azure Migrate
  3. Azure Monitor
  4. Azure Backup

Explanation

Azure Arc projects non-Azure machines, including on-premises Windows Servers, into Azure Resource Manager so they appear as resources and can receive policies, tags, and extensions. This makes hybrid servers manageable from the Azure portal. Migrate assesses and moves workloads, Backup protects data, and Monitor collects telemetry.

Question 28Deploy and manage Windows Server in hybrid environments

A company needs to give on-premises users single sign-on to Microsoft 365 while keeping authentication authoritative on-premises. Which approach satisfies this requirement?

  1. Federation with Active Directory Certificate Services
  2. Password hash synchronization with Azure AD Connect Correct answer.
  3. Cloud-only user accounts created directly in Microsoft Entra ID
  4. Azure AD Connect Health without directory synchronization

Explanation

Azure AD Connect with password hash synchronization copies hashed credentials to the cloud so users authenticate with the same on-premises password, keeping the on-premises directory authoritative. It is simpler than federation and requires no additional authentication infrastructure. The other options either bypass on-premises authority or provide no synchronization at all.

Question 29Deploy and manage Windows Server in hybrid environments

An administrator must encrypt the data disks of an Azure VM running Windows Server so that keys are protected by a customer-managed key vault. Which capability should be configured?

  1. BitLocker with a local recovery password stored on the VM
  2. Storage Service Encryption with platform-managed keys
  3. Encrypting File System on each volume
  4. Azure Disk Encryption with Key Vault Correct answer.

Explanation

Azure Disk Encryption integrates BitLocker with Azure Key Vault so the secret protecting the OS and data disks is stored and controlled in a key vault. This enables customer-managed key control for encryption at rest. The other options either keep keys on the guest, use provider-managed keys, or encrypt only files.

Question 30Deploy and manage Windows Server in hybrid environments

A company wants to monitor the health of its on-premises domain controllers and receive alerts about replication problems. Which Azure service should be deployed?

  1. Azure Network Watcher
  2. Azure Service Health
  3. Azure Advisor
  4. Azure AD Connect Health Correct answer.

Explanation

Azure AD Connect Health monitors on-premises identity infrastructure, including domain controllers, and reports replication, performance, and authentication issues with alerts. It is designed specifically for hybrid identity components. The other services report general recommendations, platform incidents, or network diagnostics.

Question 31Deploy and manage Windows Server in hybrid environments

An administrator wants to apply a configuration baseline to both Azure VMs and on-premises servers from a single Azure service. Which service provides this in a hybrid environment?

  1. Windows Server Update Services
  2. Azure Traffic Manager
  3. Azure Automation State Configuration Correct answer.
  4. Local Group Policy on each server

Explanation

Azure Automation State Configuration uses desired state configuration to evaluate and enforce settings on both Azure and on-premises machines that are onboarded to the service. This gives one control plane for configuration drift across the hybrid estate. Local policy, update distribution, and traffic routing do not provide centralized configuration management.

Question 32Deploy and manage Windows Server in hybrid environments

A company needs to ensure that an on-premises file server and an Azure VM always run the same version of a line-of-business application. Which Azure capability supports this without manual scripting?

  1. Manual remote desktop deployment
  2. Azure Policy guest configuration
  3. Azure Site Recovery
  4. Azure Automation Update Management Correct answer.

Explanation

Update Management in Azure Automation schedules and reports software and operating system updates for both Azure and on-premises machines from one workspace. It standardizes patching windows so servers stay at consistent versions. Manual deployment is error-prone, guest configuration audits settings rather than deploying software, and Site Recovery handles replication.

Question 33Deploy and manage Windows Server in hybrid environments

An administrator wants to connect an Azure virtual network to an on-premises network without exposing any internal service to the public internet. Which approach meets this requirement?

  1. Azure VPN Gateway with a site-to-site connection Correct answer.
  2. Azure Front Door
  3. Azure Bastion
  4. A public IP address on each Azure VM

Explanation

A site-to-site VPN Gateway creates an encrypted tunnel between the on-premises network and the Azure virtual network, so internal traffic never traverses the public internet in clear text. Bastion provides browser-based RDP to individual VMs, Front Door is an application delivery service, and public IPs expose the VMs directly.

Question 34Deploy and manage Windows Server in hybrid environments

A company wants to replicate an on-premises Hyper-V virtual machine to Azure so it can fail over during a disaster. Which service should be used?

  1. Azure Migrate
  2. Azure Site Recovery Correct answer.
  3. Azure Backup
  4. Azure File Sync

Explanation

Azure Site Recovery continuously replicates on-premises Hyper-V virtual machines to Azure and orchestrates failover and failback during a disaster. Backup stores recovery points but does not provide near-continuous replication or orchestrated failover. File Sync synchronizes file shares, and Migrate performs one-time moves.

Question 35Deploy and manage Windows Server in hybrid environments

An administrator needs to manage an Azure VM from Windows Admin Center without opening RDP on the public internet. Which configuration should be used?

  1. Windows Admin Center gateway installed on an Azure VM and reached through the Azure portal Correct answer.
  2. Direct RDP from the administrator's workstation to the VM
  3. A public IP address and an open RDP port on the target VM
  4. A jump box with RDP exposed to the internet

Explanation

Windows Admin Center can be deployed on an Azure VM and accessed through the Azure portal, which provides a secure browser-based gateway without exposing management ports. Opening RDP or using an internet-facing jump box increases the attack surface. Direct RDP requires reachable ports on the target.

Question 36Deploy and manage Windows Server in hybrid environments

A company wants to use Azure Monitor to collect performance counters from an on-premises Windows Server without deploying System Center Operations Manager. Which agent should be installed?

  1. The Azure Connected Machine agent alone
  2. The Azure Monitor agent Correct answer.
  3. The Log Analytics gateway
  4. The Dependency agent alone

Explanation

The Azure Monitor agent collects performance counters, event logs, and other telemetry from both Azure and on-premises machines using data collection rules. It replaces the legacy Log Analytics agent for this purpose. The gateway is a proxy, the Dependency agent adds map data, and the Arc agent only enables resource projection.

Question 37Deploy and manage Windows Server in hybrid environments

An administrator needs to grant an on-premises server access to an Azure Storage account without storing a storage account key on the server. Which approach should be used?

  1. Configure the server as an Azure Arc-enabled server and assign a managed identity Correct answer.
  2. Enable anonymous public access on the storage container
  3. Create a shared access signature and email it to the server owner
  4. Copy the storage account key to a text file on the server

Explanation

An Azure Arc-enabled server can be given a system-assigned managed identity, which is then granted a role on the storage account through Azure role-based access control. Applications on the server can request tokens without any secret stored locally. Keys on disk, public access, and emailed signatures all expose credentials.

Question 38Deploy and manage Windows Server in hybrid environments

A company must run a two-node storage cluster across an on-premises site and an Azure site with synchronous replication. Which requirement must be met for this configuration to work?

  1. Both nodes running in the same Azure availability zone
  2. A single shared VHDX stored in Azure Blob Storage
  3. Low-latency network connectivity between the sites Correct answer.
  4. Identical public IP addresses at both sites

Explanation

Storage Replica synchronous replication requires round-trip latency low enough that writes can be acknowledged at both sites, typically within a few milliseconds. Without that, the cluster cannot meet its write quorum and performance degrades. Public addresses, blob storage, and availability zones do not satisfy the latency requirement.

Question 39Deploy and manage Windows Server in hybrid environments

An administrator must ensure that all servers, including on-premises ones enrolled in Azure Arc, have a specific security setting enforced and reported. Which Azure capability should be used?

  1. Azure Cost Management budgets
  2. Azure Policy with guest configuration assignments Correct answer.
  3. Azure role-based access control assignments
  4. Azure Monitor action groups

Explanation

Azure Policy guest configuration audits and enforces operating system settings inside machines, including Arc-enabled servers, and reports compliance in the portal. Role assignments control access, budgets track spending, and action groups route alerts. None of those enforce configuration inside the guest.

Question 40Deploy and manage Windows Server in hybrid environments

A company wants to reduce the cost and complexity of backing up many on-premises Windows Servers to Azure. Which design consideration is most relevant when using the Microsoft Azure Recovery Services agent?

  1. Backups are stored only on local disk until manually uploaded
  2. A single agent installation can protect all servers in the domain
  3. Each server requires its own agent registration to a vault and a locally cached encryption passphrase Correct answer.
  4. The agent requires an Azure VPN Gateway to function

Explanation

The MARS agent is installed per server and each server registers with a Recovery Services vault using vault credentials, while the encryption passphrase must be stored securely and separately. There is no shared agent that protects multiple machines. Uploads occur directly to Azure, and a VPN gateway is not mandatory.

Question 41Implement and manage identity and access in hybrid scenarios

A company wants to reduce the number of passwords users must remember by letting them sign in to Microsoft Entra ID with their existing on-premises Active Directory credentials. Which feature should you enable?

  1. Seamless single sign-on Correct answer.
  2. Self-service password reset
  3. Password hash synchronization
  4. Microsoft Entra Connect cloud sync

Explanation

Seamless single sign-on lets users on domain-joined corporate devices sign in to Microsoft Entra ID automatically using their on-premises Active Directory credentials, so they are not prompted for a separate password. Password hash synchronization and cloud sync both synchronize identity data but do not by themselves remove the credential prompt.

Question 42Implement and manage identity and access in hybrid scenarios

Which Microsoft Entra Connect feature allows users to sign in to Microsoft 365 with their on-premises Active Directory password without storing the password hash in Microsoft Entra ID?

  1. Federation with AD FS
  2. Directory synchronization
  3. Password writeback
  4. Pass-through authentication Correct answer.

Explanation

Pass-through authentication validates user passwords directly against on-premises Active Directory by using lightweight authentication agents, so no password hash is stored in the cloud. Password writeback only supports self-service password reset scenarios, and federation relies on a separate token-issuing service rather than direct validation.

Question 43Implement and manage identity and access in hybrid scenarios

You need to configure hybrid Microsoft Entra join for existing domain-joined Windows devices. Which two components must be in place? (Choose the answer that lists both.)

  1. Microsoft Entra Connect synchronization and a service connection point in AD Correct answer.
  2. A device writeback forest and a read-only domain controller
  3. Microsoft Intune enrollment and a conditional access policy
  4. A public key infrastructure and a VPN gateway

Explanation

Hybrid Microsoft Entra join requires device objects to be synchronized through Microsoft Entra Connect and a service connection point (SCP) published in Active Directory so clients can discover the tenant. Without both, devices cannot register as hybrid joined.

Question 44Implement and manage identity and access in hybrid scenarios

Which Microsoft Entra ID feature should you use to require multi-factor authentication when users access a specific cloud application from an untrusted network?

  1. Access reviews
  2. Conditional Access Correct answer.
  3. Privileged Identity Management
  4. Identity Protection risk detections

Explanation

Conditional Access evaluates signals such as user, device, location, and application, then enforces controls like MFA for matching requests. It is the policy engine that combines conditions with grant controls, whereas the other features detect risk, govern roles, or review access.

Question 45Implement and manage identity and access in hybrid scenarios

A user's account is configured for password hash synchronization. The user changes their on-premises password. How long does it typically take for the new password to be usable in Microsoft Entra ID?

  1. Within about two minutes Correct answer.
  2. After the next full synchronization cycle of 30 days
  3. Only after a manual delta import is run
  4. Immediately, before the on-premises change completes

Explanation

Password hash synchronization uses a background process that synchronizes password changes roughly every two minutes. Full synchronization cycles and manual imports affect directory objects, not the dedicated password change channel.

Question 46Implement and manage identity and access in hybrid scenarios

You must ensure that when a user resets their password in Microsoft Entra ID, the change is written back to on-premises Active Directory. What should you enable?

  1. Directory extension attributes
  2. Group writeback
  3. Password writeback Correct answer.
  4. Device writeback

Explanation

Password writeback is the Microsoft Entra Connect option that sends cloud password changes and resets back to on-premises Active Directory. Group, device, and attribute writeback handle other object types and do not affect credentials.

Question 47Implement and manage identity and access in hybrid scenarios

Which authentication method in Microsoft Entra ID uses a phone app to display a number that the user must enter to approve a sign-in?

  1. FIDO2 security key
  2. Temporary Access Pass
  3. SMS verification code
  4. Microsoft Authenticator number matching Correct answer.

Explanation

Number matching in Microsoft Authenticator displays a number in the sign-in prompt that the user types into the app, which prevents accidental or MFA fatigue approvals. SMS codes, Temporary Access Pass, and FIDO2 keys are separate authentication methods.

Question 48Implement and manage identity and access in hybrid scenarios

An administrator needs to give a contractor temporary access to a privileged role for four hours without permanently assigning the role. Which feature should be used?

  1. A permanent role assignment
  2. An access review
  3. A dynamic membership group
  4. Privileged Identity Management eligible assignments Correct answer.

Explanation

Privileged Identity Management supports eligible assignments in which a user activates a role for a limited duration with optional approval and justification. Permanent assignments grant standing access, and dynamic groups and access reviews do not provide time-bound role activation.

Question 49Implement and manage identity and access in hybrid scenarios

Which Microsoft Entra Connect configuration supports synchronization from multiple on-premises Active Directory forests into a single tenant?

  1. Deploy Microsoft Entra Connect with multiple connectors for each forest Correct answer.
  2. Deploy one tenant per forest and use B2B collaboration
  3. Use Microsoft Entra Connect cloud sync with a single agent
  4. Enable password writeback on each domain controller

Explanation

Microsoft Entra Connect can host multiple Active Directory connectors, one per forest, so objects from several forests synchronize into one tenant. Multiple tenants or a single agent do not provide multi-forest consolidation in the same way.

Question 50Implement and manage identity and access in hybrid scenarios

You configure Microsoft Entra Connect to filter synchronization by using a group. Which object type should be used for group-based filtering?

  1. A Microsoft 365 group in the cloud
  2. A dynamic group in Microsoft Entra ID
  3. A security group in the on-premises forest Correct answer.
  4. A distribution list in the cloud

Explanation

Group-based filtering in Microsoft Entra Connect uses an on-premises security group whose membership determines which objects are synchronized. Cloud groups and distribution lists are not evaluated by the synchronization engine for this purpose.