AZ-800 practice questions 201–210

1. Question 201 · 264 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are planning the deployment of DNS to a new network. You have three internal DNS servers as shown in the following table.

   

   The contoso.local zone contains zone delegations for east.conloso.local and west.contoso.local. All the DNS servers use root hints. You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts. Solution: On Server2 and Server3, you configure a conditional forwarder for contoso.local. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   I say NO because it's not sufficient; You *do* need to have S1 as a conditional forwarder for S2 and S3... but S2 and S3 also need to be set up as cond. forwarders for EACHOTHER, otherwise they wont be able to find eachother. S2 and S3 would NOT be able to find eachother via S1 as a result of delegation.. In fact, delegation prevents it; Since they are delegates of S1, they are authoritative for their own domains.. contoso.locol/S1 is no longer authoritative over them, so it could not help S2 find S3 or vice versa. Please correct me if needed.

   Source: Adapted from community discussion — 51007

   References

   • Microsoft Learn

   Next question

2. Question 202 · 264 in bank

   Select 2

   You have servers that have the DNS Server role installed. The servers are configured as shown in the following table.

   

   All the client computers in the New York office use Server2 as the DNS server. You need to configure name resolution in the New York office to meet the following requirements: ✑ Ensure that the client computers in New York can resolve names from contoso.com. ✑ Ensure that Server2 forwards all DNS queries for internet hosts to 131. 107.100.200. The solution must NOT require modifications to Server1. Which two components should you configure on Server2? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Aa forwarder
   • Ba conditional forwarder
   • Ca delegation
   • Da secondary zone
   • Ea reverse lookup zone

   Show answer

   Answer: AB

   Explanation

   to answer the question you have to know where the zones are delegated. i am assuming the ny is a child domain . - then you have to also assume the delegation is domain zone- then the answer would be #2 below most likely A and B would be true then--- https://blogs.msmvps.com/acefekay/2010/10/01/dns-parent-child-dns-delegation-how-to-create-a-dns-delegation/ *Delegation can only be set in a parent domain zone • NS record to any dns zone domain or forest *conditional forwarder take precedent over global *Global forwarder hands query off to find external domains #1 Centralize -Forrest root DNS Zone replication requires: - Setup all DNS as forest wide Delegation - a child folder for the child domain name will be created under the parent zone name in DNS #2 Decentralize -Domain root DNS replication scope- requires - New delegation (NS) Domain zone from parent zone to child - New DNS forward zone in child - Conditional Forwarder from child to parent (for internal names) - Forwarder, to the root domain #3 Decentralized - Forest Root DNS Servers (same as #2 but no delegation )

   Source: Adapted from community discussion — johosofat

   Next question

3. Question 203 · 264 in bank

   You have an Azure virtual machine named VM1 that runs Windows Server. You need to configure the management of VM1 to meet the following requirements: ✑ Require administrators to request access to VM1 before establishing a Remote Desktop connection. ✑ Limit access to VM1 from specific source IP addresses. ✑ Limit access to VM1 to a specific management port. What should you configure?

   • Aa network security group (NSG)
   • BAzure Active Directory (Azure AD) Privileged Identity Management (PIM)
   • CMicrosoft Defender for Cloud
   • DAzure Front Door

   Show answer

   Answer: C

   Explanation

   Microsoft Defender for Cloud’s Just-in-Time (JIT) VM access feature1 indeed meets all the requirements listed: It requires administrators to request access to VM1 before establishing a Remote Desktop connection. It allows you to limit access to VM1 from specific source IP addresses. It enables you to limit access to VM1 to a specific management port. So, the correct answer should be: C. Microsoft Defender for Cloud https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage

   Source: Adapted from community discussion — Krayzr

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 204 · 264 in bank

   Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a DNS server named Server1. Server1 hosts a DNS zone named fabrikam.com that was signed by DNSSEC. You need to ensure that all the member servers in the domain perform DNSSEC validation for the fabrikam.com namespace. What should you do?

   • AOn Server1, run the Add-DnsServerTrustAnchor cmdlet.
   • BOn each member server, run the Add-DnsServerTrustAnchor cmdlet.
   • CFrom a Group Policy Object (GPO), add a rule to the Name Resolution Policy Table (NRPT).
   • DFrom a Group Policy Object (GPO), modify the Network List Manager policies.

   Show answer

   Answer: C

   Explanation

   NRPT The Name Resolution Policy Table (NRPT) is a table that contains rules you can configure to specify DNS settings or special behavior for names or namespaces. The NRPT can be configured using Group Policy or by using the Windows Registry. When performing DNS name resolution, the DNS Client service checks the NRPT before sending a DNS query. If a DNS query or response matches an entry in the NRPT, it is handled according to settings in the policy. Queries and responses that do not match an NRPT entry are processed normally. You can use the NRPT to require that the DNS Client service perform DNSSEC validation of DNS responses for the namespaces that you specify.

   Source: Adapted from community discussion — AvoKikinha

   References

   • Microsoft Learn

   Next question

5. Question 205 · 264 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are planning the deployment of DNS to a new network. You have three internal DNS servers as shown in the following table.

   

   The contoso.local zone contains zone delegations for east.contoso.local and west.contoso.local. All the DNS servers use root hints. You need to ensure that all the DNS servers can resolve the names of all the internal namespaces and internet hosts. Solution: On Server2, you create a conditional forwarder for contoso.local and west.contoso.local. On Server3, you create a conditional forwarder for contoso.local and east.contoso.local. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   YES- Delegation tells S1 how to find S2 and S3. Cond forward from S2 to S1/S3 and from S2 to S1/S3 allows all internals to resolve. And they can all find internet hosts because theyre using root hints. Please correct me if needed.

   Source: Adapted from community discussion — 51007

   References

   • Microsoft Learn

   Next question

6. Question 206 · 264 in bank

   HOTSPOT - You have on-premises file servers that run Windows Server as shown in the following table.

   

   You have the Azure file shares shown in the following table.

   

   You add a Storage Sync Service named Sync1 and an Azure File Sync sync group named Group1. Group1 uses share1 as a cloud endpoint. You register Server1 and Server2 with Sync1. You add D:\Folder1 from Server1 as a server endpoint in Group1. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-planning

   Source: Adapted from community discussion — prepper666

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 207 · 264 in bank

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com. The domain contains a server named Server1 and the users shown in the following table.

   

   Server1 contains a folder named D:\Folder1. The advanced security settings for Folder1 are configured as shown in the Permissions exhibit. (Click the Permissions tab.)

   

   Folder1 is shared by using the following configurations:

   

   The share permissions for Share1 are shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   To access files in a shared folder, you need to be granted permissions on the folder (NTFS permissions) AND permissions on the share. The most restrictive permission of the folder permissions and share permissions apply. Box 1: Yes - Group1 has Read access to Folder1 and Change access to Share1. Therefore, User1 can read the files in Share1. Box 2: No - Group3 has Full Control access to Share1. However, Group3 has no permissions configured Folder1. Therefore, User3 cannot access the files in Share1. Box 3: Yes - Group2 has write permission to Folder1. However, Group2 has no permission on Share1. Therefore, users in Group2 cannot access files in the shared folder. Access Based Enumeration when enabled hides files and folders that users do not have permission to access. However, Access Based Enumeration is not enabled on Share1. This is indicated by the FolderEnumerationMode ג€" Unrestricted setting. Therefore, the share will be visible to User2 even though User2 cannot access the shared folder.

   Source: Adapted from community discussion — johosofat

   

   Next question

8. Question 208 · 264 in bank

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a server named Server1 that has the DFS Namespaces role service installed. Server1 hosts a domain-based Distributed File System (DFS) Namespace named Files. The domain contains a file server named Server2. Server2 contains a shared folder named Share1. Share1 contains a subfolder named Folder1. In the Files namespace, you create a folder named Folder1 that has a target of \\Server2.contoso.com\Share1\Folder1. You need to configure a logon script that will map drive letter M to Folder1. The solution must use the path of the DFS Namespace. How should you configure the command to map the drive letter? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   https://learn.microsoft.com/en-us/windows-server/storage/dfs-namespaces/dfs-overview Close… look at the question again. in the Files namespace (\\contoso\files), you create a folder named Folder1 that has a target… - so the full namespace is \\contoso\files\folder1 the files and folder1 add to the root namespace contoso.com the target is added to the folder1 as a folder target, but we need none of that information to anwer the question

   Source: Adapted from community discussion — johosofat

   References

   • Microsoft Learn

   

   Next question

9. Question 209 · 264 in bank

   DRAG DROP - You have two on-premises servers named Server1 and Server2 that run Windows Server. You have an Azure Storage account named storage1 that contains a file share named share1. Server1 syncs with share1 by using Azure File Sync. You need to configure Server2 to sync with share1. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-server-registration https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-server-endpoint-create?tabs=azure-portal

   Source: Adapted from community discussion — syu31svc

   References

   • Microsoft Learn

   

   Next question

10. Question 210 · 264 in bank

    You have a server named Server1 that runs Windows Server. Server1 has the storage pools shown in the following table.

    

    You plan to create a virtual disk named VDisk1 that will use storage tiers. Which pools can you use to create VDisk1?

    • APool2 only
    • BPool1 only
    • CPool1, Pool2, and Pool3
    • DPool1 and Pool2 only
    • EPool3 only
    • FPool2 and Pool3 only
    • GPool1 and Pool3 only

    Show answer

    Answer: F

    Explanation

    https://learn.microsoft.com/en-us/azure/virtual-machines/disks-pools Only premium SSD managed disks and standard SSDs, or ultra disks can be added to a disk pool F is correct

    Source: Adapted from community discussion — syu31svc

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-800 practice, question 201. 264 questions available.