Free AZ-801 exam questions in PDF & AI Tutor

QUESTION: 36 Exam Topic: Secure Windows Server on-premises and hybrid infrastructures (Question Set 3)

You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains the resources shown in the following table.

Sub1 has Microsoft Defender for Servers enabled. You are assigned the Contributor role for Sub1.

You need to implement just-in-time (JIT) VM access for VM1.

What should you do first?

Create a network security group (NSG).
Enable enhanced security in Microsoft Defender for Cloud.
Request the Owner role for Sub1.
Create an application security group.

Answer(s): A

Show Answer Next Question

QUESTION: 37 Exam Topic: Secure Windows Server on-premises and hybrid infrastructures (Question Set 3)

HOTSPOT (Drag and Drop is not supported)

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains an organizational unit (OU) named OU1. OU1 contains servers that run sensitive workloads.

You plan to add connection security rules that meet the following requirements:

The servers in OU1 must only accept connections from domain-joined

The servers in OU1 must only be able to communicate with domain-joined

You create a Group Policy Object (GPO) named GPO1 and link GPO1 to contoso.com.

You need to configure a connection security rule in GPO1 by using Windows Defender Firewall with Advanced Security.

How should you configure the rule? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

Hot Area:

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: Isolation
Rule Type

There are five different types of connection security rules that you can create:

* Isolation--allows you to restrict communication to only those hosts that can authenticate using specific credentials. For example, you can allow communications only to computers that are joined to an Active Directory domain.

Incorrect:
* Authentication exemption--allows you to configure exemptions to the isolation rules, such as an exemption that would allow connections to a DNS server without the requirement to authenticate.

* Tunnel--allows you to create rules that work in the same way as server-to-server rules but are implemented through tunnels (site-to-site connections).

Box 2: Require authentication for inbound and outbound connections Requirements:

Box 3: Computer (Kerberos V5)
Authentication method:

You have four choices here:

* You can choose Default and use the authentication methods that are defined in the IPsec settings.

* You can choose Computer and User to use Kerberos v5 and restrict communications to connections from domain-joined users and computers only.

*-> You can choose Computer to use Kerberos v5 and restrict communications to connections from domain- joined computers only.

* You can choose the Advanced option and specify custom settings for first and second authentication methods.

Reference:

https://www.sciencedirect.com/topics/computer-science/connection-security-rule

Show Answer Next Question

QUESTION: 38 Exam Topic: Secure Windows Server on-premises and hybrid infrastructures (Question Set 3)

DRAG DROP (Drag and Drop is not supported)

You have a Windows Server failover cluster named Cluster1 that contains the Cluster Shared Volumes (CSV) shown in the following table.

All the nodes in Cluster1 have BitLocker Drive Encryption (BitLocker) installed.

You need to use PowerShell to enable BitLocker on Volume1.

In which order should you run the commands? To answer, drag the appropriate commands to the correct order. You may need to drag the split bar between panes or scroll to view content.

Note: Each correct selection is worth one point.

Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Step 1: Get-ClusterSharedVolume -Name "Volume1" | Suspend-ClusterResource

Use BitLocker with Cluster Shared Volumes (CSV)
Encrypt using a recovery key
Encrypting the drives using a recovery key will allow a BitLocker recovery key to be created and added into the Cluster database. As the drive is coming online, it only needs to consult the local cluster hive for the recovery key.

(Move the disk resource to the node where BitLocker encryption will be enabled:

Get-ClusterSharedVolume -Name "Cluster Disk 1" | Move-ClusterSharedVolume Resource -Node Node1)

Put the disk resource into Maintenance Mode:

Get-ClusterSharedVolume -Name "Cluster Disk 1" | Suspend-ClusterResource [Step 1]

A dialog box will pop up that says:

Suspend-ClusterResource

Are you sure that you want to turn on maintenance for Cluster Shared Volume `Cluster Disk 1'? Turning on maintenance will stop all clustered roles that use this volume and will interrupt client access.

Step 2: Enable-BitLocker -MountPoint "C:\\ClusterStorage\\Volume1" -RecoveryPasswordProtector

To enable BitLocker encryption, run:
Enable-BitLocker -MountPoint "C:\\ClusterStorage\\Volume1" -RecoveryPasswordProtector

Once entering the command, a warning appears and provides a numeric recovery password. Save the password in a secure location as it is also needed in an upcoming step. The warning looks similar to this:

Step 3 $KeyProtectorID = (Get-BitlockerVolume - MountPoint .. To get the BitLocker protector information for the volume, the following command can be run:

(Get-BitlockerVolume -MountPoint "C:\\ClusterStorage\\Volume1").KeyProtector

Step 4: Get-ClusterSharedVolume "Volume1" | Set-ClusterParameter -Name BitLockerProtectorInfo -Value ...

-Create

The key protector ID and recovery password will be needed and saved into a new physical disk private property called BitLockerProtectorInfo. This new property will be used when the resource comes out of Maintenance Mode. The format of the protector will be a string where the protector ID and the password are separated by a
":".

Get-ClusterSharedVolume "Cluster Disk 1" | Set-ClusterParameter -Name BitLockerProtectorInfo -Value "{26935AC3-8B17-482D-BA3F-D373C7954D29}:271733-258533-688985-480293-713394-034012-061963- 682044" -Create

Step 5: Get-ClusterSharedVolume -Name "Volume1" Resume-ClusterResource Now that the information is present, the disk can be brought out of maintenance mode once the encryption process is completed.

Get-ClusterSharedVolume -Name "Cluster Disk 1" | Resume-ClusterResource

If the resource fails to come online, it could be a storage issue, an incorrect recovery password, or some issue. Verify the BitlockerProtectorInfo key has the proper information. If it doesn't, the commands previously given should be run again. If the problem isn't with this key, we recommended getting with the proper group within your organization or the storage vendor to resolve the issue.

Reference:

https://learn.microsoft.com/en-us/windows-server/failover-clustering/bitlocker-on-csv-in-ws-2022

Show Answer Next Question

QUESTION: 39 Exam Topic: Secure Windows Server on-premises and hybrid infrastructures (Question Set 3)

You have an on-premises server named Server1 that runs Windows Server 2022 Standard.

You have an Azure subscription that contains the virtual machines shown in the following table.

The subscription contains a Microsoft Sentinel instance named Sentinel1 in the Central US Azure region.

You need to implement the Windows Firewall connector.

Which servers can send Windows Firewall logs to Sentinel1?

VM1 only
VM2 only
VM1 and Server1 only
VM1, VM2, and VM3 only
VM1, VM2, and Server1 only
VM1, VM2, VM3, and Server1

Answer(s): E

Explanation:

VM1 and VM2 are located in Azure regions (West US and Central US), and since Microsoft Sentinel (Sentinel1) is in the Central US region, both of these virtual machines can send their Windows Firewall logs to Sentinel1. This includes VM1 with Windows Server 2022 Datacenter: Azure Edition and VM2 with Windows
Server 2019 Datacenter.
Server1, which runs Windows Server 2022 Standard on-premises, can also send logs to Sentinel1 since it can be connected to Microsoft Sentinel through agents that enable on-premises servers to integrate with Azure Sentinel.
VM3, although located in the Central US region, runs Windows Server 2016 Datacenter, which may not support some of the required integration features out of the box without additional configuration or updates.
Therefore, it is less likely to send logs to Sentinel1 unless further steps are taken.

Show Answer Next Question

QUESTION: 40 Exam Topic: Secure Windows Server on-premises and hybrid infrastructures (Question Set 3)

HOTSPOT (Drag and Drop is not supported)

Your network contains an on-premises Active Directory Domain Services (AD DS) domain.

The domain contains the servers shown in the following table.

Server1 has the connection security rule as shown in the Server exhibit. (Click the Server1 tab.)

Server2 has the connection security rule as shown in the Server2 exhibit. (Click the Server2 tab.)

Server1 has the inbound firewall rules as shown in the Server1 inbound rules exhibit. (Click the Server1 inbound rules tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Hot Area:

See Explanation section for answer.

Answer(s): A

Explanation:

Server2 can ping Server1 successfully: Yes.
The inbound firewall rules on Server1 allow ICMP traffic for both ICMPv4 and ICMPv6 (the protocols used for ping). This means that Server2 should be able to ping Server1 successfully.

Server2 can connect to a file share on Server1: Yes.
The inbound rules on Server1 allow SMB (Server Message Block) traffic, which is used for file sharing, so Server2 can connect to file shares on Server1.

Server3 can connect to a file share on Server1: Yes.
The same inbound rules on Server1 that allow file sharing via SMB apply to Server3 as well, meaning Server3 should be able to connect to file shares on Server1.

Show Answer Next Question

var builder = WebApplication.CreateBuilder(args); builder.Services.Configure<TelemetryConfiguration>(telemetryConfiguration => { var builder = telemetryConfiguration.DefaultTelemetrySink.TelemetryProcessorChainBuilder; double fixedSamplingPercentage = 10; // 10% sampling builder.UseSampling(fixedSamplingPercentage); }); builder.Services.AddApplicationInsightsTelemetry(new ApplicationInsightsServiceOptions { EnableAdaptiveSampling = false }); var app = builder.Build();

What the AZ-801 Exam Tests and How to Pass It

The AZ-801: Configuring Windows Server Hybrid Advanced Services exam is designed for IT professionals who are responsible for managing and maintaining Windows Server workloads in hybrid environments. This certification validates the technical skills required to secure, monitor, and troubleshoot Windows Server infrastructures, as well as the ability to implement high availability and disaster recovery solutions. Organizations hiring for roles such as Windows Server Administrator, Hybrid Cloud Administrator, or Infrastructure Engineer prioritize this certification because it demonstrates a candidate's proficiency in bridging on-premises server environments with Microsoft Azure services. By passing this exam, professionals prove they can handle complex migration scenarios and maintain operational continuity across diverse, modern IT landscapes.

What the AZ-801 Exam Covers

The exam evaluates your ability to manage critical infrastructure components, starting with the foundational requirement to secure Windows Server on-premises and hybrid infrastructures against modern threats. Candidates must demonstrate proficiency in implementing and managing Windows Server high availability, which involves configuring failover clustering and storage replication to ensure service uptime. Furthermore, the exam tests your knowledge of disaster recovery strategies, requiring you to plan for and execute recovery operations effectively. You will also be assessed on your capability to migrate servers and workloads, a task that demands a deep understanding of both legacy on-premises configurations and cloud-native migration tools. Finally, the ability to monitor and troubleshoot Windows Server environments is essential, as you must be able to identify performance bottlenecks and resolve connectivity issues using native Microsoft tools, all of which are covered extensively in our practice questions.

Among these domains, implementing and managing Windows Server high availability often proves to be the most technically demanding area for many candidates. This section requires more than just theoretical knowledge; it necessitates a practical understanding of how quorum configurations, cluster networking, and storage spaces direct interact within a production environment. You must be able to troubleshoot complex cluster failures and understand the nuances of implementing disaster recovery solutions that span across hybrid boundaries. Success in this area relies on your ability to synthesize information about network latency, storage throughput, and service dependencies, making it a critical focus for your exam preparation.

Are These Real AZ-801 Exam Questions?

Our platform provides practice questions that are sourced and verified by the community, ensuring they reflect the types of challenges you will encounter on the actual Microsoft certification exam. Because our content is community-verified, it is shaped by IT professionals and recent test-takers who have sat for the exam and understand the specific technical hurdles involved. If you've been searching for AZ-801 exam dumps or braindump files, our community-verified practice questions offer something more valuable, each question is verified and explained by IT professionals who recently passed the exam. We do not provide leaked or confidential content; instead, our questions reflect what appears on the real exam because they are sourced from the community's collective experience and understanding of the official exam objectives.

The community verification process is a collaborative effort where users actively participate in refining the accuracy of the study material. When a user encounters a question, they can discuss the answer choices, flag potentially incorrect information, and provide context based on their own recent exam experience. This peer-review mechanism ensures that the explanations remain current and technically accurate, which is vital for a certification exam that covers evolving hybrid technologies. By engaging with these discussions, you gain insights into the logic behind the correct answers, which is far more effective than simply memorizing patterns.

How to Prepare for the AZ-801 Exam

Effective exam preparation for the AZ-801 requires a balanced approach that combines hands-on experience with rigorous study of official Microsoft documentation. You should prioritize setting up a sandbox environment where you can practice configuring failover clusters, testing disaster recovery scenarios, and performing workload migrations to Azure. Understanding the underlying concepts is far more important than rote memorization, as the exam is designed to test your ability to apply knowledge to specific, scenario-based problems. Every practice question includes a free AI Tutor explanation that breaks down the reasoning behind the correct answer, so you understand the concept, not just the answer. Building a consistent study schedule that allocates time for both reading technical documentation and working through practice questions will help you retain complex information more effectively.

A common mistake candidates make is relying solely on theoretical study without ever touching the actual Windows Server or Azure interfaces. This approach often leads to failure because the AZ-801 exam frequently presents scenario-based questions that require you to identify the most efficient solution among several technically viable options. Another pitfall is poor time management during the exam, which can be mitigated by using our practice questions to simulate the pressure of a timed environment. By focusing on understanding the "why" behind each configuration step, you will be better equipped to handle the nuanced questions that appear on the actual Microsoft certification exam.

What to Expect on Exam Day

On the day of your exam, you should be prepared for a variety of question formats designed to test your practical application of Windows Server hybrid services. Microsoft certification exams typically include multiple-choice questions, scenario-based questions that require you to select the best solution for a given infrastructure problem, and potentially drag-and-drop or interactive elements. The exam is administered through a secure testing environment, often via Pearson VUE, where you will be monitored to ensure the integrity of the testing process. You will have a set amount of time to complete the exam, so it is important to pace yourself carefully, especially when encountering complex scenarios that require detailed analysis. Familiarizing yourself with the interface and the types of questions beforehand will help reduce anxiety and allow you to focus entirely on demonstrating your technical expertise.

Who Should Use These AZ-801 Practice Questions

These practice questions are intended for IT professionals who have experience managing Windows Server environments and are looking to validate their skills in hybrid cloud management. Typically, candidates for this certification exam have at least a few years of experience in server administration, networking, and virtualization, and are now seeking to formalize their expertise in Microsoft's hybrid ecosystem. Whether you are an administrator looking to advance your career or an engineer tasked with modernizing your organization's infrastructure, this exam preparation will help you identify knowledge gaps. Passing the AZ-801 is a significant milestone that demonstrates your ability to handle the advanced, real-world challenges of modern hybrid IT operations.

To get the most out of these practice questions, treat each one as a learning opportunity rather than a simple test of your current knowledge. Do not just read the answer; engage with the AI Tutor explanation to understand the underlying logic, and read the community discussions to see how other professionals approach the same problem. If you get a question wrong, flag it and revisit it later to ensure you have mastered the concept. Browse the questions above and use the community discussions and AI Tutor to build real exam confidence.

Microsoft AZ-801 Exam Actual Questions Configuring Windows Server Hybrid Advanced Services (Page 9 )

QUESTION: 36 Exam Topic: Secure Windows Server on-premises and hybrid infrastructures (Question Set 3)

QUESTION: 37 Exam Topic: Secure Windows Server on-premises and hybrid infrastructures (Question Set 3)

Explanation:

Reference:

QUESTION: 38 Exam Topic: Secure Windows Server on-premises and hybrid infrastructures (Question Set 3)

Explanation:

Reference:

QUESTION: 39 Exam Topic: Secure Windows Server on-premises and hybrid infrastructures (Question Set 3)

Explanation:

QUESTION: 40 Exam Topic: Secure Windows Server on-premises and hybrid infrastructures (Question Set 3)

Explanation:

What the AZ-801 Exam Tests and How to Pass It

What the AZ-801 Exam Covers

Are These Real AZ-801 Exam Questions?

How to Prepare for the AZ-801 Exam

What to Expect on Exam Day

Who Should Use These AZ-801 Practice Questions

Microsoft AZ-801 Exam Actual Questions
Configuring Windows Server Hybrid Advanced Services (Page 9 )