AZ-800 practice questions 251–260

1. Question 251 · 264 in bank

   You have five file servers that run Windows Server. You need to block users from uploading video files that have the .mov extension to shared folders on the file servers. All other types of files must be allowed. The solution must minimize administrative effort. What should you create?

   • Aa Dynamic Access Control central access policy
   • Ba data loss prevention (DLP) policy
   • Ca Dynamic Access Control central access rule
   • Da file screen

   Show answer

   Answer: D

   Explanation

   On the File Screening Management node of the File Server Resource Manager MMC snap-in, you can perform the following tasks: Create file screens to control the types of files that users can save, and generate notifications when users attempt to save unauthorized files. Define file screening templates that can be applied to new volumes or folders and that can be used across an organization. Create file screening exceptions that extend the flexibility of the file screening rules.

   Source: Adapted from community discussion — AvoKikinha

   Next question

2. Question 252 · 264 in bank

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com. The domain contains a file server named Server1 and three users named User1, User2, and User3. Server1 contains a shared folder named Share1 that has the following configurations:

   

   The share permissions for Share1 are configured as shown in the Share Permissions exhibit.

   

   Share1 contains a file named File1.bxt. The advanced security settings for File1.txt are configured as shown in the File Permissions exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   WOW, read the question!!!! Box 1: No. User 1 share permission in Change (domain users), NTFS = Full Control, most restrictive applies when combining permissions Box 2: Yes. User 2 has Read NTFS and Change (share) Read wins Box 3: Yes. User 3 has Write NTFS and Change (share) Write wins

   Source: Adapted from community discussion — prepper666

   

   Next question

3. Question 253 · 264 in bank

   DRAG DROP - You have a server named Server1. You plan to use Storage Spaces to expand the storage available to Server1. You attach eight physical disks to Server1. Four disks are HDDs and four are SSDs. You need to create a volume on Server1 that will use the storage on all the new disks. The solution must provide the fastest read performance for frequently used files. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://redmondmag.com/articles/2018/07/31/storage-spaces-windows-server-2016-1.aspx https://redmondmag.com/articles/2018/08/02/storage-spaces-windows-server-2016-2.aspx

   Source: Adapted from community discussion — NazerRazer

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 254 · 264 in bank

   You need to configure the Group Policy settings to ensure that the Azure Virtual Desktop session hosts meet the security requirements. What should you configure?

   • Aloopback processing in GPO4
   • Bsecurity filtering for the link of GPO1
   • Cloopback processing in GPO1
   • Dthe Enforced property for the link of GPO4
   • Ethe Enforced property for the link of GPO1
   • Fsecurity filtering for the link of GPO4

   Show answer

   Answer: A

   Explanation

   There is some complexity around this choice- for eample the VMS are hybrid-joined and this opens the door to other policies coming into play- but in a very narrow band- i did find that loopback processing is common for VDI deployments- i decided to just go for that basic answer and move on- but this may need a more detailed explanation - https://anthonyfontanez.com/index.php/2021/10/11/group-policy-loopback-processing-done-correctly/

   Source: Adapted from community discussion — johosofat

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 255 · 264 in bank

   What should you implement for the deployment of DC3?

   • AAzure Active Directory Domain Services (Azure AD DS)
   • Ban Azure virtual machine
   • Can Azure AD administrative unit
   • DAzure AD Application Proxy

   Show answer

   Answer: B

   Explanation

   Selecting a VM for this has certain rules that go along with it https://learn.microsoft.com/en-us/azure/active-directory/devices/howto-device-identity-virtual-desktop-infrastructure may come in handy for other questions sourced from this doc - https://learn.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan

   Source: Adapted from community discussion — johosofat

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 256 · 264 in bank

   DRAG DROP - Which three actions should you perform in sequence to meet the security requirements for Webapp1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview

   Source: Adapted from community discussion — Leocan

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 257 · 264 in bank

   DRAG DROP - You need to meet the security requirements for passwords. Where should you configure the components for Azure AD Password Protection? To answer, drag the appropriate components to the correct locations. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises

   Source: Adapted from community discussion — syu31svc

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 258 · 264 in bank

   You need to meet the technical requirements for Server1. Which users can currently perform the required tasks?

   • AAdmin3 only
   • BAdmin1 and Admin3 only
   • CAdmin1 only
   • DAdmin1, Admin2, and Admin3

   Show answer

   Answer: B

   Explanation

   I think B is correct. Because Admin1 is in Enterprise Admins group. Which are then part of the Administrators group in all the domains in the forest, including Canada. Therefore both Admin1 and Admin3 perform the task.

   Source: Adapted from community discussion — spike8384

   Next question

9. Question 259 · 264 in bank

   You need to meet the technical requirements for the site links. Which users can perform the required tasks?

   • AAdmin1, Admin2, and Admin3
   • BAdmin1 and Admin3 only
   • CAdmin1 only
   • DAdmin1 and Admin2 only
   • EAdmin3 only

   Show answer

   Answer: C

   Explanation

   I experienced this is the real world. My account in the toplevel domain was unable to do any changes in this. Because I was domain admin in the toplevel domain, i was able to grant myself enterprise admin access. Then I was able to do the change in sites and services. So I go for enterprise admin only

   Source: Adapted from community discussion — kijken

   Next question

10. Question 260 · 264 in bank

    You need to meet the technical requirements for User1. The solution must use the principle of least privilege. What should you do?

    • AAdd Users1 to the Server Operators group in contoso.com.
    • BCreate a delegation on contoso.com.
    • CAdd Users1 to the Account Operators group in contoso.com.
    • DCreate a delegation on OU3.

    Show answer

    Answer: D

    Explanation

    https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/delegating-administration-by-using-ou-objects You can use organizational units (OUs) to delegate the administration of objects, such as users or computers, within the OU to a designated individual or group "principle of least privilege" so answer is D

    Source: Adapted from community discussion — syu31svc

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-800 practice, question 251. 264 questions available.