AZ-800 Exam Dumps - Microsoft Certified: Windows Server Hybrid Administrator Associate Questions and Answers

The Windows Server Hybrid Core Infrastructure curriculum explains that AD DS clients and DCs are site-aware and their placement is governed by site and subnet objects. To place a new RODC in a specific datacenter and ensure it belongs to a new site, you must first create the site and associate the correct IP subnet. The guide states that “subnet-to-site mapping determines the site membership of domain controllers and clients,” ensuring Server1 is in RemoteSite1 after promotion. Next, to control replication, the guidance under “Configure sites, subnets, and site links” specifies that inter-site replication schedules and costs are configured on site links; adjusting the site link gives you granular control over when the hub site (your existing site) replicates with RemoteSite1. Finally, to meet the principle of least privilege and allow a non-Domain Admin to install an RODC, the module “Deploy and manage RODCs” describes pre-staging (pre-creating) an RODC account and delegating installation to a designated user. It notes that “an RODC can be pre-created and an installer account assigned so that a local administrator at the branch can run the AD DS installation wizard without requiring domain-wide administrative rights.” With these three steps—site/subnet, site link, and pre-created RODC with delegated installer—User1 can promote Server1 to an RODC in RemoteSite1 while you retain control of replication and adhere to least privilege.

According to the Administering Windows Server Hybrid Core Infrastructure (AZ-800) exam study materials, Azure DNS Private Resolver allows bidirectional name resolution between on-premises environments and Azure private DNS zones. The Private DNS Resolver consists of inbound endpoints (to resolve queries from on-premises to Azure) and outbound endpoints (to resolve queries from Azure to on-premises DNS servers). For name resolution to work, private DNS zones must be linked to the virtual network associated with the resolver’s hub network.

In this scenario, the planned configuration specifies:

A Private DNS Resolver named Private1 created in the West US region and linked to VNet1.

An inbound endpoint in SubnetB.

The requirement is to identify which private DNS zones will be available for name resolution through this resolver.

From the details given, only Zone1.com and Zone2.com are linked to VNet1, allowing them to participate in name resolution using the resolver. Zone3.com is not linked to VNet1 (either unlinked or linked to another virtual network), and therefore it cannot be resolved through the DNS Resolver in VNet1.

As emphasized in Microsoft’s hybrid infrastructure documentation:

“Private DNS zones must be linked to the same virtual network that contains the Private DNS Resolver or to peered virtual networks for name resolution to succeed.”

Hence, only Zone1.com and Zone2.com are available for name resolution through the Private DNS Resolver.

✅ Correct Answer: C. Zone1.com and Zone2.com only

The AZ-800 materials explain that enabling Microsoft Entra (Azure AD) sign-in to Windows Server running as an Azure VM is done by deploying the Azure AD Login for Windows VM extension. The study guide states that “for Azure VMs, Microsoft Entra sign-in is enabled by installing the AADLoginForWindows extension; once installed, Entra users and groups granted ‘Virtual Machine User/Login’ roles can sign in using Entra credentials.” The required operation is performed from Azure PowerShell with Set-AzVMExtension, providing the publisher Microsoft.Azure.ActiveDirectory, type AADLoginForWindows, and the target VM. Other options are not applicable: Set-AzVM changes VM properties but does not install extensions; New-ADComputer and Add-ADComputerServiceAccount are AD DS cmdlets unrelated to enabling Entra login on an Azure VM. Therefore, to meet the plan “Enable Microsoft Entra users to sign in to Server1,” you must run Set-AzVMExtension to install the AAD Login extension on Server1.

In the Administering Windows Server Hybrid Core Infrastructure materials, Microsoft emphasizes using Microsoft Defender for Cloud – Just-in-time (JIT) VM access to control administrative access to Azure VMs. The guide explains that JIT “locks down inbound traffic to management ports (for example, RDP 3389) by updating the VM’s NSG/Azure Firewall so they’re blocked by default. When access is needed, an authorized user submits a JIT request in Defender for Cloud specifying the port(s), source IP, and time window. If approved, Defender for Cloud temporarily opens the rule and automatically reverts it when the window expires.” This delivers a request/approval workflow before a Remote Desktop session can be established and minimizes exposure of management ports.

The same objectives note that while Azure AD Privileged Identity Management (PIM) controls role activation/elevation, it does not provide the network gate required to force a request prior to RDP connectivity. Similarly, an NSG by itself can allow/deny traffic but offers no on-demand request workflow. Azure Front Door is for HTTP(S) applications and is not used for RDP. Therefore, to ensure administrators must request access prior to connecting via RDP to VM1, you configure Defender for Cloud JIT VM access, which enforces time-bound, IP-scoped openings of port 3389 and automatically closes them, aligning with the exam guidance for securing Windows Server IaaS VMs.

In a cloud-sync deployment, Microsoft’s hybrid identity guidance for Administering Windows Server Hybrid Core Infrastructure specifies that you do not install the full Microsoft Entra (Azure AD) Connect server. Instead, cloud sync “uses a lightweight agent—called the Microsoft Entra Connect provisioning agent—installed on one or more Windows Server computers that can reach your AD DS domain controllers.” The agent handles directory read operations and securely communicates with the cloud provisioning service. The study material further states that all configuration—including creating sync configurations, scoping filters, and enabling features such as Password Hash Synchronization (PHS)—is performed in the Microsoft Entra admin experience: “Cloud sync is configured in the Azure portal; you create a cloud sync configuration, select the on-premises AD forest, and enable password hash synchronization so password hashes are synchronized to Microsoft Entra ID.”

Because you are using Microsoft Entra Connect cloud sync, the correct software to install on-premises is the Microsoft Entra Connect provisioning agent (not the full Microsoft Entra Connect server or ADFS tools). And to enable PHS for cloud sync, you use the Azure portal (Microsoft Entra admin center) to turn on Password hash synchronization within the cloud sync configuration. This meets both requirements: installing the proper agent for cloud sync and enabling PHS centrally in the portal.

According to the official documentation for Administering Windows Server Hybrid Core Infrastructure, using Windows Admin Center (WAC) within the Azure portal to manage virtual machines requires specific network pathing depending on the IP configuration of the target VM. For a virtual machine like VM1 that is configured with only a private IP address, the management traffic originates from the browser on the administrator's local computer and must be able to reach that private IP address directly.

The primary requirement for this scenario is that the management PC must have access to the virtual network (VNet) that is connected to the VM. As specified in the study guides, when managing a VM via its private IP, you must establish a hybrid connectivity solution such as a VPN connection (either Point-to-Site or Site-to-Site) or Azure ExpressRoute. This bridge allows the on-premises Windows 11 computer to route traffic into the Azure Virtual Network's private address space. Without this underlying network connectivity, the browser-based WAC gateway—which is hosted as an extension on the VM—cannot communicate with the portal interface.

While Azure Bastion (Option A) provides secure RDP and SSH access, the Windows Admin Center extension specifically requires network-level routing from the client to the private IP for its portal-integrated management features. Network Security Group (NSG) rules (Option C) are necessary to allow traffic on specific ports (like 443 for the WAC service), but they do not provide the routing necessary to cross the boundary between an on-premises network and an Azure VNet. Similarly, Private Endpoints (Option D) are intended for accessing Azure PaaS services rather than providing a management path for IaaS VMs. Therefore, configuring a VPN connection is the verified mandatory step to satisfy the connectivity requirements for WAC in this hybrid context.

< File1 is deduplicated after the deduplication job runs. – YES

 File3 is deduplicated after the deduplication job runs. – NO

 File4 is deduplicated after the deduplication job runs. – NO

The Administering Windows Server Hybrid Core Infrastructure materials explain that Data Deduplication operates per-volume and only processes files on volumes where the role is enabled. The guide states that deduplication “is applied only to NTFS/ReFS volumes on which the Data Deduplication role is enabled,” and that the General-purpose file server usage type applies default policies for typical data shares. It further specifies the file size limits: “Files smaller than 32 KB are not deduplicated; supported files are 32 KB up to multiple terabytes,” and clarifies that optimization jobs process eligible files during scheduled runs.

Applying those rules:

Volume D has Data Deduplication enabled (General-purpose). After moving File1 (500 KB) from C: to D:, it resides on a deduplicated volume and exceeds the minimum size threshold, so it will be deduplicated by the next optimization job.

File3 (1 MB) is moved off the deduplicated volume (to E:), and dedup only affects enabled volumes; therefore it will not be deduplicated.

File4 is a copy of File2 (10 KB) on D:. Because the file is smaller than the 32-KB minimum, it is not deduplicated even though it is on a deduplicated volume.

Thus the correct outcomes are YES for File1, NO for File3, and NO for File4.

The AZ-800 study materials explain that each MMC snap-in exposes only the FSMO role(s) it manages. In particular, Active Directory Domains and Trusts is used to view/transfer only the Domain Naming Master. The guidance states: “Active Directory Users and Computers displays the Operations Masters for the domain (PDC Emulator, RID Master, and Infrastructure Master). Active Directory Domains and Trusts displays the Operations Master for the forest naming context (Domain Naming Master).” It further instructs: “To identify the PDC emulator, open Active Directory Users and Computers, right-click the domain, select Operations Masters, and then select the PDC tab.” Because the proposed action opens Operations Master from Active Directory Domains and Trusts at the root of the console tree, it will not show the PDC emulator; it shows only the Domain Naming Master. Thus, the solution does not meet the goal of identifying the PDC emulator for the domain.

In the Windows Server hybrid IaaS guidance for AZ-800 (Administering Windows Server Hybrid Core Infrastructure), resizing an Azure VM changes compute characteristics only (vCPU/memory/size family). The learning path on managing Windows Server IaaS VMs states that the VM’s OS and any attached data disks persist across stop/deallocate and resize operations, and that drive letters and file data remain intact once the VM starts again. Applications installed on those persistent disks continue to function because the underlying VHDs are unchanged. The only disk that may be transient is the temporary (ephemeral) OS cache or D: temporary disk provided by some sizes; however, managed OS disk (C:) and any managed data disks (such as D: and the newly added E:) retain their contents. Consequently, the folders created on C: and D: remain, the additional data disk that was initialized as volume E remains attached with the same drive letter, and App1 installed on E: is still present after the resize. Therefore, after resizing VM1 you will still have Folder1, Folder2, volume E, and App1, making option D correct.

The Azure File Sync section of the Administering Windows Server Hybrid Core Infrastructure materials states that a sync group defines the topology for synchronization and “contains one cloud endpoint and one or more server endpoints.” A cloud endpoint is an Azure file share associated with a Storage Sync Service. The guidance also notes that “the Storage Sync Service and the storage account (file share) must reside in the same Azure region” and that “a single Azure file share can be the cloud endpoint for only one sync group.” In the scenario, SyncA is in West US, so only file shares in West US (for example, storage1\share1 or storage2\share2) are eligible. However, regardless of how many eligible shares exist, the exam guide is explicit: each sync group supports a maximum of one cloud endpoint. Additional endpoints in the group must be server endpoints on Windows Server volumes. Therefore, the maximum number of cloud endpoints you can use with GroupA is 1, which directly reflects the product’s architecture and the documented exam objective requirements.