AZ-800 Exam Dumps - Microsoft Certified: Windows Server Hybrid Administrator Associate Questions and Answers

In the Windows Server hybrid administrator objectives for AD DS, application directory partitions (also called “naming contexts”) are forest-wide objects whose creation and deletion are controlled by the Domain Naming Master FSMO. The AZ-800 materials explain that operations which “add or remove naming contexts in the forest” must be performed on, or reachable by, the DC that holds the Domain Naming Master ; if that role holder is unavailable, the operation fails until connectivity is restored or the role is transferred/seized. Because your custom application partition belongs to the forest schema of naming contexts, removing it requires contacting th e Domain Naming Master. From the table, DC3 holds the Domain naming master role. Therefore, a failed attempt to delete the partition indicates the Domain Naming Master is not available, which points to DC3 being unavailable.

In the Administering Windows Server Hybrid Core Infrastructure objectives for publishing on-premises apps to cloud identities, Azure AD Application Proxy is the prescribed solution for exposing internal, Kerberos-based web apps to Azure AD users with minimal changes. The guidance explains that Application Proxy is a cloud service in Azure AD which publishes internal HTTP/HTTPS applications and supports Kerberos Constrained Delegation (KCD) so that “users authenticate with Azure AD and the service performs single sign-on to the on-premises app using Kerberos.” To enable it, you turn on the Application Proxy service in the Azure AD tenant and configure the application object for passthrough/Pre-Auth and KCD. The on-premises requirement is to install the Azure AD Application Proxy connector on a domain-joined Windows Server that can reach the internal application; the connector establishes outbound-only connections to the service, avoiding inbound firewall changes and minimizing administrative effort. The materials also contrast this with Web Application Proxy (WAP) for AD FS publishing, which requires additional infrastructure and does not leverage Azure AD cloud pre-authentication. Therefore, to let Azure AD accounts reach an on-premises Kerberos-only app with least effort, configure the Azure AD Application Proxy service (in Azure AD) and deploy the Azure AD Application Proxy connector (on-premises), then enable KCD for the published app.

In Administering Windows Server Hybrid Core Infrastructure , Microsoft states that high availability for DHCP on Windows Server is achieved by using DHCP failover rather than the legacy split-scope (80/20) model. The guidan ce explains that DHCP failover “ synchronizes lease data between two DHCP servers and can be configured in Load Balance or Hot Standby mode on a per-scope basis,” and that you enable it on each DHCP scope to create a partner relationship that automatically replicates scope configuration and active leases. This meets the requirement to keep address assignment available if one DHCP server is down.

The same materials further note that DHCP broadcasts do not traverse routers; therefore, when the partner server i s reachable across a routed boundary (another site/subnet) , you must configure the router as a DHCP relay (IP helper) to forward DHCPDISCOVER messages to the remote DHCP server(s). The text emphasizes: “When clients and DHCP servers are on different subnet s, configure a relay agent on the router to forward requests to the DHCP server IP addresses.”

Applying this to Fabrikam: create DHCP failover between DHCP1 (Scope1) and DHCP2 (Scope2) ( E ) and configure the routers in New York and Seattle as DHCP relays th at forward to both DHCP servers ( B ). You do not use Failover Clustering for DHCP here, and you do not create extra 25% scopes; those are split-scope practices superseded by DHCP failover.

The Administering Windows Server Hybrid Core Infrastructure guidance for Azure Extended Network (AEN) explains that AEN is used to “migrate servers to Azure without changing their on-premise s IP addresses by extending the L2 subnet into an Azure virtual network.” The deployment requires a single Windows Server virtual machine in Azure that runs the AEN agent and bridges traffic for the stretched subnet: “Deploy one Windows Server VM (Datacent er) in the target VNet/subnet to act as the Azure Extended Network proxy for that subnet.” The proxy VM must be Windows Server 2019 Datacenter or Windows Server 2022 Datacenter ; Windows Server 2022 Azure Edition is not a requirement for AEN: “AEN is suppor ted on Windows Server 2019/2022 Datacenter VMs in Azure.”

The docs further note: “Only one proxy VM per stretched subnet is required to maintain IP addressing for migrated workloads.” Since Subnet1 will host Server1 and you must keep the 192.168.10.x address, you only need to deploy one Azure VM to run the AEN proxy. No additional Azure Edition VM is necessary, and no extra Azure VMs are required for the on-premises side because the on-premises server is the workload being migrated.

Therefore, the mini mum Azure VM count is 1 (Windows Server 2019/2022) and 0 (Windows Server 2022 Azure Edition).

The exam materials state that Azure Automation runbooks can be authored in PowerShell and Python (along with Graphical and PowerShell Workflow where noted). The module on “Automate management in hybrid environments” specifies: “Runbooks support PowerShell for Windows-based automation and Python for cross-platform scenarios.” It further explains that these languages integrate with Automation Accounts, modules/packages, credentials, and managed identities to run tasks on Azure or hybrid resources through the Hybrid Runbook Worker. Languages such as Java, JavaScript, or Bicep are not runbook languages (Bicep is used for ARM template deployments, not runbook execution). Accordingly, Task1 can be implemented in PowerShell and Python.

In the Windows Server exam materials for Administering Windows Server Hybrid Core Infrastructure (AZ-800) , Microsoft documents that Data Deduplication is supported only on data volumes and specifically on NTFS-formatted volumes , and it cannot be enabled on the system or boot volume . The study text states: “Data Deduplication is applied at the volume level and supports NTFS data volumes. You cannot enable deduplication on the system or boot volume.” It further clarifies unsupported targets: “ReFS volumes and FAT/exFAT volumes are not supported for Data Deduplication in general-purpose server scenarios,” and emphasizes that deduplication is “not available for the operating s ystem volume.”

Applying these rules to VM3:

C: NTFS but it is the OS/system volume → not eligible .

D: NTFS data volume → eligible .

E: ReFS → not supported for general-purpose dedup in this context.

F: exFAT → not supported .

Therefore, the only volume on which you can enable Data Deduplication to meet the requirement is volume D .

The AZ-800 content covering Active Directory Sites and Services clarifies that site, subnet, and site-link objects live in the Configuration partition. The guides emphasize that administration of the Configuration naming context is restricted to Enterprise Admins and to Domain Admins of the forest-root domain. In the context of changing replication topology parameters—such as editing the replication schedule on site links—the documentation notes: “Only Enterprise Admins or administrators in the forest-root Domain Admins group have default permissions to modify site and site-link objects,” because these objects affect replication forest-wide.

Applying this to the scenario:

Contoso\Admin1 (Enterprise Admins) has forest-wide rights to modify site links.

Contoso\Admin2 (Domain Admins in contoso.com, the forest-root domain) also has the required rights to change site-link schedules.

Canada\Admin3 (Domain Admins in canada.contoso.com) does not have default permissions in the Configuration partition for forest-wide site-link administration.

Thus, to meet the technical requirement to change all site links to a 30-minute schedule, the users who can perform the task are Admin1 and Admin2.

In Windows Server AD DS, group scope determines which groups/accounts can be members. The AZ-800 study materials summarize: “Domain Local groups can include accounts, Global groups, and Universal groups from any domain and Domain Local groups from the same domain only. Global groups can include accounts and other Global groups from the same domain only. Universal groups can include *accounts, Global groups, and Universal groups from any domain.” In addition, distribution vs. security does not change the scope membership rules; it only affects whether the group can be assigned permis sions.

Applying the rules: Group3 is a Domain Local security group in contoso.com . Therefore it can contain Universal (Group1), Global from any domain (Group2 in contoso.com and Group4/Group5 in canada.contoso.com), but cannot contain a Domain Local from a nother domain (Group6 in canada.contoso.com). Hence: Group1, Group2, Group4, and Group5 only .

Group5 is a Global distribution group in canada.contoso.com . A Global group can only contain accounts or Global groups from the same domain . From the list, only G roup4 (Global distribution, canada.contoso.com) fits. It cannot contain Group1 (Universal), Group2 (Global but different domain), or Group6 (Domain Local). Therefore: Group4 only .

The Administering Windows Server Hybrid Core Infrastructure guidance explains two Windows container isolation modes: process isolation (Windows Server containers) and Hyper-V isolation. With process isolation, containers share the host’s kernel , so they run as ordinary processes on the host. With Hyper-V isolation, each container runs inside a lightweight VM with its o wn kernel ; this provides a hard isolation boundary and prevents kernel sharing with other containers. The curriculum further notes that Linux containers on Windows require Hyper-V isolation because they cannot share the Windows kernel.

Applying these rules:

Container1 “must NOT share a kernel with other containers.” The only mode that prevents kernel sharing is Hyper-V isolation, so Container1 must use Hyper-V isolation.

Container2 is a Linux container. On a Windows Server container host, Linux containers are run via a utility VM and therefore require Hyper-V isolation.

Container3 is a Windows container that needs a static IP address. The networking modules describe that Windows containers can obtain static IPs when you use supported networks (for example, l2bridge/transparent) regardless of isolation mode; therefore a Windows workload like a database can run in either process or Hyper-V isolation, depending on the isolation/security you want.

Thus, the correct selections are: Hyper-V isolation only for Container1 and Container2, and Hyper-V isolation or process isolation for Container3.