AZ-800 practice questions 21–30

1. Question 21 · 264 in bank

   SIMULATION - You plan to promote a domain controller named DC3 in a site in Seattle. You need to ensure that DC3 only replicates with DC1 and DC2 between 8 PM and 6 AM. To complete this task, sign in the required computer or computers.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Open - Active Directory Sites and services 2. Goto - DC3 (DC3 only replicates with DC1 and DC2) 3. Klik - NTDS Settings 4. Edit Link - Tab General - Change Schedule (between 8PM and 6AM) - Edit only the links to DC1 and DC2

   Source: Adapted from community discussion — Goofer

   

   Next question

2. Question 22 · 264 in bank

   SIMULATION - You need to ensure that DC2 is the schema master for contoso.com. To complete this task, sign in the required computer or computers.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   This answer describes seizing the Schema role. The role can be transferred by registering schmmgmt.dll (regsvr32 schmmgmt.dll) and using the Active Directory Schema console.

   Source: Adapted from community discussion — BJack

   

   Next question

3. Question 23 · 264 in bank

   You have an on premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. You plan to implement self-service password reset (SSPR) in Azure AD. You need to ensure that users that reset their passwords by using SSPR can use the new password resources in the AD DS domain. What should you do?

   • ADeploy the Azure AD Password Protection proxy service to the on premises network.
   • BRun the Microsoft Azure Active Directory Connect wizard and select Password writeback.
   • CGrant the Change password permission for the domain to the Azure AD Connect service account.
   • DGrant the impersonate a client after authentication user right to the Azure AD Connect service account.

   Show answer

   Answer: B

   Explanation

   Enable Password Writeback: Password writeback allows password changes made in the cloud (via SSPR) to be written back to the on-premises AD DS directory in real time. This feature ensures that the updated passwords are synchronized to the on-premises environment. You can enable password writeback using either Microsoft Azure AD Connect or Azure AD Connect cloud sync. When users change or reset their passwords using SSPR in the cloud, the updated passwords are also written back to the on-premises AD DS environment. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-writeback Guide: https://sites.google.com/view/learnmicrosoftcomenustrainingm/home

   Source: Adapted from community discussion — bipinmikeeeyis

   References

   • Microsoft Learn

   Next question

4. Question 24 · 264 in bank

   Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain controllers. You plan to store a DNS zone in a custom Active Directory partition. You need to create the Active Directory partition for the zone. The partition must replicate to only four of the domain controllers. What should you use?

   • AWindows Admin Center
   • BDNS Manager
   • CActive Directory Sites and Services
   • Dntdsutil.exe

   Show answer

   Answer: D

   Explanation

   This questions appeared four times, of which ntdsutil.exe and DNS Manager both appeared two times. ntdsutil.exe is the correct answer for the other question. The suggested answers are contradicting.

   Source: Adapted from community discussion — tfulanchan

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 25 · 264 in bank

   DRAG DROP - Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site. You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1. You need to recommend a deployment plan that meets the following requirements: • Ensures that a user named User1 can perform the RODC installation on Server1 • Ensures that Server1 is in a new site named RemoteSite1 • Uses the principle of least privilege Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer should be: - Create a site and a subnet - Pre-create RODC account - Instruct User 1 The site needs to be there when the RODC account gets created because it needs to be placed into the new site.

   Source: Adapted from community discussion — LauLauLauw

   References

   • Microsoft Learn

   

   Next question

6. Question 26 · 264 in bank

   Your network contains an Active Directory domain named contoso.com. The domain contains the computers shown in the following table.

   

   On Server3, you create a Group Policy Object (GPO) named GPO1 and link GPO1 to contoso.com. GPO1 includes a shortcut preference named Shortcut1 that has item-level targeting configured as shown in the following exhibit.

   

   To which computer will Shortcut1 be applied?

   • AServer3 only
   • BComputer1 and Server3 only
   • CServer2 and Server3 only
   • DServer1, Server2, and Server3 only

   Show answer

   Answer: A

   Explanation

   Sadly Azzy above here is right, tested this... all windows version get the shortcut! This has to do with the version, 2016/2019/2022 all are version 10.0 Make you own WMI and add the buildnr to make this work: SELECT * FROM Win32_OperatingSystem WHERE Version LIKE "10.0.%" AND ProductType = "3" AND BuildNumber = "20348" 14393 → Windows Server 2016 17763 → Windows Server 2019 20348 → Windows Server 2022 Windows 11: SELECT * FROM Win32_OperatingSystem WHERE Version LIKE "10.0.%" AND ProductType = "1" AND BuildNumber >= "22000"

   Source: Adapted from community discussion — ltkiller

   Next question

7. Question 27 · 264 in bank

   Your network contains a multi-site Active Directory Domain Services (AD DS) forest. Each Active Directory site is connected by using manually configured site links and automatically generated connections. You need to minimize the latency for changes to Active Directory. What should you do?

   • AFor each site links, modify the site link costs.
   • BCreate a site link bridge that contains all the site links.
   • CFor each site link, modify the options attribute.
   • DFor each site link, modify the replication schedule.

   Show answer

   Answer: C

   Explanation

   In the Attribute Editor tab, double click on Options. If the Value(s) box shows , type 1. There is one caveat however. Change notification will fail with manual connection objects. If your connection objects are not created by the KCC the change notification setting is meaningless. If it's a manual connection object, it will NOT inherit the Options bit from the Site Link. Enjoy your 15 minute replication latency.

   Source: Adapted from community discussion — Duks

   References

   • Microsoft Learn

   Next question

8. Question 28 · 264 in bank

   DRAG DROP - Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. Contoso.com contains three child domains named amer.contoso.com, apac.contoso.com, and emea.contoso.com. Fabrikam.com contains a child domain named apac.fabrikam.com. A bidirectional forest trust exists between contoso.com and fabrikam.com. You need to provide users in the contoso.com forest with access to the resources in the fabrikam.com forest. The solution must meet the following requirements: • Users in contoso.com must only be added directly to groups in the contoso.com forest. • Permissions to access the resources in fabrikam.com must only be granted directly to groups in the fabrikam.com forest. • The number of groups must be minimized. Which type of groups should you use to organize the users and to assign permissions? To answer, drag the appropriate group types to the correct requirements. Each group may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Organize users would be Universal groups. There are child domains that would need to have users added to the groups. It speaks about users/groups in the forest (not just the domain).

   Source: Adapted from community discussion — mrmichael1389

   References

   • Microsoft Learn

   

   Next question

9. Question 29 · 264 in bank

   HOTSPOT - Your network contains two Active Directory forests and a domain trust as shown in the following exhibit.

   

   The domain trust has the following configurations: • Name: adatum.com • Type: External • Direction: One-way, outgoing • Outgoing trust authentication level: Domain-wide authentication The forests contain the users shown in the following table.

   

   The forests contain the network shares shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I think the answer is correct. Since Share3 trusts User1, so User1 can assign permission for Share3. As per Microsoft: "A one-way trust is a unidirectional authentication path created between two domains (trust flows in one direction, and access flows in the other). This means that in a one-way trust between a trusted domain and a trusting domain, users or computers in the trusted domain can access resources in the trusting domain. However, users in the trusting domain cannot access resources in the trusted domain. Some one-way trusts can be either nontransitive or transitive, depending on the type of trust being created." https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc759554(v=ws.10)?redirectedfrom=MSDN

   Source: Adapted from community discussion — AlexKL

   References

   • Microsoft Learn

   

   Next question

10. Question 30 · 264 in bank

    HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a child named east.contoso.com and the servers shown in the following table.

    

    You need to create a folder for the Central Store to manage Group Policy template files for the entire forest. What should you name the folder, and on which server should you create the folder? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Correct answer should be: PolicyDefinitions DC1 and DC2 * Policy definitions are domain-specific and are not shared between domains. Therefore Contoso and East Contoso would need to have their own set of Policies. https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/create-and-manage-central-store

    Source: Adapted from community discussion — DonChevoDeLaPaca

    References

    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-800 practice, question 21. 264 questions available.