Free Practice Questions for Microsoft AZ-800 Exam

In the Administering Windows Server Hybrid Core Infrastructure materials for managing hybrid servers with Azure Arc, Microsoft describes two primary, supported ways to deliver Desired State Configuration at scale: Azure Automation State Configuration and Azure Policy Guest Configuration. For large fleets of Arc-enabled servers, the guidance emphasizes that Guest Configuration uses DSC resources and content that is packaged and then assigned by Azure Policy, removing the need to stand up or manage a pull server. The study content explains that Guest Configuration “audits and (with remediation) configures the inside of machines using DSC resources” and that you deliver it by creating or using a policy definition that references your guest configuration package, so compliance and remediation happen through policy assignment. This approach is highlighted as the lowest-overhead method for Arc servers because policy assignments can be targeted to subscriptions, resource groups, or Arc-enabled machines, providing uniform roll-out and governance with minimal administration.

The same materials note that Automation State Configuration requires onboarding nodes to an Automation account and managing configurations there, which adds extra setup for non-Azure VMs. In contrast, with Arc + Guest Configuration, the DSC content is stored/referenced in the Azure Policy definition and enforced by the Guest Configuration extension, enabling you to apply and remediate configurations at scale with Azure Policy, which best meets the requirement to minimize administrative effort across 500 Arc-enabled Windows Server machines joined to the on-premises domain.

In the Administering Windows Server Hybrid Core Infrastructure materials, the Central Store for Administrative Templates (ADMX/ADML) is a domain-scoped repository located in SYSVOL at: \\\SYSVOL\\Policies\PolicyDefinitions. The guidance states that to standardize the templates used by all Group Policy editors, you create a folder named PolicyDefinitions under the Policies folder in SYSVOL and copy the ADMX/ADML files there. Because the Central Store is per domain (not forest-wide), Group Policy Management Editor loads templates from the Central Store of the domain that contains the GPO being edited. Therefore, in a forest with multiple domains (for example, contoso.com and east.contoso.com), you must create a Central Store in each domain’s SYSVOL so that administrators get a consistent template set regardless of which domain’s GPOs they edit.

The documentation also notes that creating the Central Store on any domain controller in the domain is sufficient because DFS Replication (or FRS in very old deployments) will replicate the PolicyDefinitions contents to all DCs in that domain automatically. Thus, to cover the entire forest shown, you create PolicyDefinitions on DC1 (contoso.com) and DC2 (east.contoso.com). Creating it on Server1 is irrelevant because the Central Store must be in SYSVOL on DCs, not on member servers.

The hybrid networking module in AZ-800 details Azure Network Adapter (ANA) as a Windows Admin Center (WAC) workflow that creates a point-to-site (P2S) VPN from an on-premises Windows Server to an Azure virtual network. The documentation states that ANA is initiated directly from Windows Admin Center, which automates provisioning of the necessary Azure resources (e.g., VPN gateway configuration and certificates) and installs/configures the VPN client on the server, establishing secure connectivity to the target VNet. The Azure portal does not install or configure the on-premises VPN client for a standalone server; Azure AD Connect is used for identity synchronization and is unrelated to network tunneling; and Device Manager is not used for configuring VPN or Azure connectivity. In practice, you add the server to WAC, open the Network tool, and select Add Azure Network Adapter, sign in to Azure, choose VNet1, and complete the wizard. This is the prescribed, streamlined method for connecting Server1 to VNet1 using Azure Network Adapter, validating Windows Admin Center as the correct choice.

The Administering Windows Server Hybrid Core Infrastructure materials explain that BranchCache reduces WAN utilization by caching content that clients request from a remote content server. There are two modes: Hosted Cache and Distributed Cache. Hosted Cache “requires a server in the branch office configured as a hosted cache server,” while Distributed Cache “uses a peer-to-peer cache among Windows clients and does not require any servers in the branch.” For SMB shares, the content server (the file server at the main site) must have the “BranchCache for Network Files” role service installed so that it can advertise hashes and support BranchCache for file content. Client computers in the branch are then configured to Enable BranchCache in Distributed Cache mode so they can cache and retrieve content from each other, minimizing repeated downloads across the WAN.

In this scenario, Montreal has no servers, so Hosted Cache is not suitable. Installing BranchCache for Network Files on Server1 (the Boston file server hosting \\Server1\Apps) and enabling Distributed Cache on the 20 Windows 10 clients in Montreal meets the requirement to reduce WAN saturation during the LOB app deployment and subsequent updates while requiring no additional branch infrastructure.

In the Administering Windows Server Hybrid Core Infrastructure material, the section on Configure and manage Azure AD Password Protection states that Azure AD Password Protection “uses a global and custom banned password list to prevent weak or easily guessed passwords.” Administration is performed in Azure AD: “The custom banned password list is created and maintained in the Azure AD portal and applies to both cloud users and on-premises domains when the proxy and DC agents are deployed.” The guidance further notes that the feature is case-insensitive and blocks substrings: “Words on the custom list are evaluated in all variants and as part of longer strings.”

Operationally, you configure this at Security → Authentication methods → Password protection (Azure AD admin center). From there you add entries such as “contoso” to the Custom banned password list, and set enforcement/audit. The same module clarifies what you don’t use: “Active Directory Users and Computers does not manage Azure AD Password Protection policy,” and tools like Synchronization Service Manager or Windows Admin Center are unrelated to defining the password policy.

Therefore, to prevent users from including Contoso in their passwords in a hybrid (Azure AD Connect) environment, you must configure the custom banned password list in the Azure Active Directory admin center.

The exam materials state that Azure Automation runbooks can be authored in PowerShell and Python (along with Graphical and PowerShell Workflow where noted). The module on “Automate management in hybrid environments” specifies: “Runbooks support PowerShell for Windows-based automation and Python for cross-platform scenarios.” It further explains that these languages integrate with Automation Accounts, modules/packages, credentials, and managed identities to run tasks on Azure or hybrid resources through the Hybrid Runbook Worker. Languages such as Java, JavaScript, or Bicep are not runbook languages (Bicep is used for ARM template deployments, not runbook execution). Accordingly, Task1 can be implemented in PowerShell and Python.

The AZ-800 materials explain that enabling Microsoft Entra (Azure AD) sign-in to Windows Server running as an Azure VM is done by deploying the Azure AD Login for Windows VM extension. The study guide states that “for Azure VMs, Microsoft Entra sign-in is enabled by installing the AADLoginForWindows extension; once installed, Entra users and groups granted ‘Virtual Machine User/Login’ roles can sign in using Entra credentials.” The required operation is performed from Azure PowerShell with Set-AzVMExtension, providing the publisher Microsoft.Azure.ActiveDirectory, type AADLoginForWindows, and the target VM. Other options are not applicable: Set-AzVM changes VM properties but does not install extensions; New-ADComputer and Add-ADComputerServiceAccount are AD DS cmdlets unrelated to enabling Entra login on an Azure VM. Therefore, to meet the plan “Enable Microsoft Entra users to sign in to Server1,” you must run Set-AzVMExtension to install the AAD Login extension on Server1.