Microsoft AZ-800 Exam Actual Questions
Administering Windows Server Hybrid Core Infrastructure (Page 7 )

Updated On: 13-Aug-2026

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain controllers.
You plan to store a DNS zone in a custom Active Directory partition.
You need to create the Active Directory partition for the zone. The partition must replicate to only four of the domain controllers.
What should you use?

  1. Windows Admin Center
  2. DNS Manager
  3. Active Directory Sites and Services
  4. ntdsutil.exe

Answer(s): D

Explanation:

For this question these are the correct answers:
* dnscmd.exe
* ntdsutil.exe
For this question these are the incorrect answers:
* Active Directory Administrative Center
* Active Directory Sites and Services
* DNS Manager
* New-ADObject
* Set-DnsServer
* Windows Admin Center
Explanation for dnscmd.exe: How to create and apply a custom application directory partition on an Active Directory integrated DNS zone
You can create a custom Active Directory partition by using the DnsCmd command.
Create an application directory partition by using the DnsCmd command Use the DnsCmd command to create an application directory partition. To do this, use the following syntax:
DnsCmd ServerName /CreateDirectoryPartition FQDN of partition
To create an application directory partition that is named CustomDNSPartition on a domain controller that is named DC-1, follow these steps:
1. Click Start, click Run, type cmd, and then click OK.
2. Type the following command, and then press ENTER:
dnscmd DC-1 /createdirectorypartition CustomDNSPartition.contoso.com When the application directory partition has been successfully created, the following information appears:
DNS Server DC-1 created directory partition: CustomDNSPartition.contoso.com Command completed successfully.



DRAG DROP (Drag and Drop is not supported)
Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site.
You plan to deploy a read-only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1.
You need to recommend a deployment plan that meets the following requirements:
-Ensures that a user named User1 can perform the RODC installation on Server1
-Ensures that Server1 is in a new site named RemoteSite1
-Uses the principle of least privilege
Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:





Step 1: Pre-create an RODC account. You can deploy RODC using the Staged feature. It consists of pre-creating the RODC computer account in the ADUC console and basic setup.
Step 2: Create a site and a subnet
Step 3: Instruct User1 to run the Active Directory Domain Services installation Wizard on Server1.
The Domain Controller Options page also enables you to choose the appropriate Active Directory logical site name from the forest configuration. By default, it selects the site with the most correct subnet. If there is only one site, it selects that site automatically.
Important: If the server does not belong to an Active Directory subnet and there is more than one Active Directory site, nothing is selected and the Next button is unavailable until you choose a site from the list.
Incorrect:
* Add User1 to the Contoso\Administrators group. This is against the principle of least privilege.


Reference:

https://woshub.com/deploying-read-domain-controller-windows-server-2016/ https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/rodc/install-a-windows-server-2012-active-directory-read-only-domain-controller--rodc---level-200-



Your network contains an Active Directory domain named contoso.com. The domain contains the computers shown in the following table.

On Server3, you create a Group Policy Object (GPO) named GPO1 and link GPO1 to contoso.com. GPO1 includes a shortcut preference named Shortcut1 that has item-level targeting configured as shown in the following exhibit.

To which computer will Shortcut1 be applied?

  1. Server3 only
  2. Computer1 and Server3 only
  3. Server2 and Server3 only
  4. Server1, Server2, and Server3 only

Answer(s): A

Explanation:

You can use item-level targeting to change the scope of individual preference items, so they apply only to selected users or computers. Within a single Group Policy object (GPO), you can include multiple preference items, each customized for selected users or computers and each targeted to apply settings only to the relevant users or computers.
From the exhibit we see operating system targeting with Product being Windows Server 2022 Family. Only Server3 has the Windows Server 2022 Operating System.
Operating System targeting An Operating System targeting item allows a preference item to be applied to computers or users only if the processing computer's operating system's product name, release, edition, or computer role matches those specified in the targeting item.


Reference:

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ dn789189(v=ws.11)



Your network contains a multi-site Active Directory Domain Services (AD DS) forest. Each Active Directory site is connected by using manually configured site links and automatically generated connections.
You need to minimize the latency for changes to Active Directory.
What should you do?

  1. For each site links, modify the site link costs.
  2. Create a site link bridge that contains all the site links.
  3. For each site link, modify the options attribute.
  4. For each site link, modify the replication schedule.

Answer(s): C

Explanation:

Reconfigure the link site option to use notification.
Details: Active Directory – Change Notification (Inter-Site Replication) Since we know Active Directory, we know also that its replication works automatically between the domain controllers. The lowest value of this replication schedule is 15 minutes. You can’t get lower. If there aren’t that many frequent changes, or the active directory site is not large (probably with only one site) then this value should work for you.
But what if your active directory environment is larger? What if you have more than one site, on different locations, with different networks? Or what if you’ve got some remotedesktop services running in your main site and some users working with them in a branch office? What about the “I forgot my password” cases?
Well, there is a solution for you. We can tune-up the Active Directory Inter-Site Replication. The inter-site replication works also automatically, and you can also schedule the replication only for 15 minutes. But there are some settings we can tweak to get the domain controllers pulling the changes made recently.
1. First open “Active Directory Sites and Services” on your primary domain controller (that’s the icon with the blue “building”).
2. Let’s start now with the tuning operation. Expand “Sites” and “Inter-Site Transports” (if you haven’t already). Click on the IP folder.
3. Now right-click (or double-click) on your site link on the right hand side. If you did not rename it, it’s just the DEFAULTIPSITELINK. Then click “Properties”. Then click on the “Attribute Editor” tab.
4. The attribute we should edit is called “options”.
We now have to change this attribute to a specific value which allows us to tweak the inter-site replication.
Value, Explanation 1 USE_NOTIFY (use this setting!) 2 TWOWAY_SYNC 4 DISABLE_COMPRESSION
Incorrect: Not B: Two scenarios in which you need a site link bridge design to control replication flow include controlling replication failover and controlling replication through a firewall.
Not D: The minimal replication schedule is 15 minutes.
When you use manual site link replication interval is set to 15 minutes and cannot be lowered further.


Reference:

https://www.driftar.ch/2016/10/26/active-directory-change-notification-inter-site-replication/



DRAG DROP (Drag and Drop is not supported)
Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. Contoso.com contains three child domains named amer.contoso.com, apac.contoso.com, and emea.contoso.com. Fabrikam.com contains a child domain named apac.fabrikam.com. A bidirectional forest trust exists between contoso.com and fabrikam.com.
You need to provide users in the contoso.com forest with access to the resources in the fabrikam.com forest. The solution must meet the following requirements:
-Users in contoso.com must only be added directly to groups in the contoso.com forest.
-Permissions to access the resources in fabrikam.com must only be granted directly to groups in the fabrikam.com forest.
-The number of groups must be minimized.
Which type of groups should you use to organize the users and to assign permissions? To answer, drag the appropriate group types to the correct requirements. Each group may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Note: Each correct selection is worth one point.
Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: Domain global Users in contoso.com must only be added directly to groups in the contoso.com forest. The number of groups must be minimized. Contoso.com contains three child domains named amer.contoso.com, apac.contoso.com, and emea.contoso.com.
Group Scope Each group in Active Directory has a scope, which determines the types of objects that it can contain and what types of groups it can be a member of. There are three scopes:
* Global Can contain: Users, computers, global groups and domain local groups from the same domain (but NOT universal groups)
Incorrect:
* Universal Can contain: Users, global groups and universal groups from any domain in the forest, regardless of whether trusts have been established between domains
Box 2: Domain local Permissions to access the resources in fabrikam.com must only be granted directly to groups in the fabrikam.com forest. Fabrikam.com contains a child domain named apac.fabrikam.com
* Domain local Can contain: Users, computers, global groups and universal groups from any domain, including domains outside the forest. Domain local groups from the same domain only.
Domain Local Groups Domain local groups are best for managing permissions to domain-specific resources, such as a specific printer. For example, you could create an AD group called US-MarketingPrinter with domain local scope and give it permission to access the printer in the Marketing team’s area. Then you can add multiple global groups to it. This would enable members of those global groups to access the printer.


Reference:

https://blog.netwrix.com/2023/05/09/ad-group-types-universal-groups-global-groups-domain-local-groups/



HOTSPOT (Drag and Drop is not supported)
Your network contains two Active Directory forests and a domain trust as shown in the following exhibit.

The domain trust has the following configurations:
-Name: adatum.com
-Type: External
-Direction: One-way, outgoing
-Outgoing trust authentication level: Domain-wide authentication
The forests contain the users shown in the following table.

The forests contain the network shares shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: Yes Share3 is in east.contoso.com. User1 is in adatum.com. The domain trust allow User1 to access Share3.
Box 2: No Share1 is in adatum.com. User2 is in contoso.com. The domain trust does not allow User2 access to Share1.
Box 3: No The domain trust does not allow User3 access to Share1.



HOTSPOT (Drag and Drop is not supported)
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a child named east.contoso.com and the servers shown in the following table.

You need to create a folder for the Central Store to manage Group Policy template files for the entire forest.
What should you name the folder, and on which server should you create the folder? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: PolicyDefinitions The Central Store To take advantage of the benefits of .admx files, you must create a Central Store in the sysvol folder on a Windows domain controller. The Central Store is a file location that is checked by the Group Policy tools by default. The Group Policy tools use all .admx files that are in the Central Store. The files that are in the Central Store are replicated to all domain controllers in the domain.
We suggest keeping a repository of any ADMX/L files that you have for applications that you may want to use. For example, operating system extensions like Microsoft Desktop optimization Pack (MDOP), Microsoft Office, and also third-party applications that offer Group Policy support.
To create a Central Store for .admx and .adml files, create a new folder named PolicyDefinitions in the following location (for example) on the domain controller:
\\contoso.com\SYSVOL\contoso.com\policies\PolicyDefinitions
Box 2: DC2 DC2 has the PDC emulator role.
Note: PDC Emulator (PDCE) Primary Domain Controller (PDC Emulator or PDCE) is a domain level role; there is one PDC Emulator in each domain in an Active Directory forest. PDC emulator controls authentication such as, Kerberos and NTLM, within the domain.


Reference:

https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/create-and-manage-central-store



HOTSPOT (Drag and Drop is not supported)
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the domain controllers shown in the following table.

You need to configure DC3 to be the authoritative time server for the domain.
Which operations master role should you transfer to DC3, and which console should you use? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: PDC emulator How to configure an authoritative time server in Windows Server To configure the PDC in the root of an Active Directory forest to synchronize with an external time source, follow these steps:
Change the server type to NTP. To do this, follow these steps:
1. Select Start > Run, type regedit, and then select OK.
2. Locate and then select the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters In the pane on the right, right-click Type, and then select Modify. In Edit Value, type NTP in the Value data box, and then select OK.
3. Set AnnounceFlags to 5. To do this, follow these steps: Etc.
Box 2: Active Directory Users and Computers Transfer FSMO Roles Using ADUC GUI Just like PowerShell you need to log into the server that you will be transferring to.
Open the Active Directory Users and Computers console, then right-click on the domain and click on operations masters.

You should now see a screen with three tabs (RID, PDC, and Infrastructure).

To transfer one of these roles just click on the change button. You can’t select which domain controller to transfer the role to, that is why you need to log into the server that you want to transfer to. if I wanted to transfer the RID role to DC3 I would log into that server.


Reference:

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/configure-authoritative-time-server https://activedirectorypro.com/transfer-fsmo-roles



Viewing page 7 of 39
Viewing questions 49 - 56 out of 302 questions


Post your Comments and Discuss Microsoft AZ-800 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!