AZ-800 practice questions 31–40

1. Question 31 · 264 in bank

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the domain controllers shown in the following table.

   

   You need to configure DC3 to be the authoritative time server for the domain. Which operations master role should you transfer to DC3, and which console should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   You can transfer FSMO roles by using the Ntdsutil.exe command-line utility or by using an MMC snap-in tool. Depending on the FSMO role that you want to transfer, you can use one of the following three MMC snap-in tools: Active Directory Schema snap-in Active Directory Domains and Trusts snap-in Active Directory Users and Computers snap-in https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/view-transfer-fsmo-roles

   Source: Adapted from community discussion — Shnash

   References

   • Microsoft Learn

   

   Next question

2. Question 32 · 264 in bank

   DRAG DROP - Your network contains an Active Directory domain named contoso.com. The domain contains group managed service accounts (gMSAs). You have a server named Server1 that runs Windows Server and is in a workgroup. Server1 hosts Windows containers. You need to ensure that the Windows containers can authenticate to contoso.com. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I think: Create a gMSA and a standard user account From a domain-joined computer, cerate a credential spec file and copy the file to Server1 On Server1, install and run ccg.exe https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts#use-case-for-creating-gmsa-account-for-non-domain-joined-container-hosts

   Source: Adapted from community discussion — skycrap

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 33 · 264 in bank

   Your on-premises network contains an Active Directory domain named contoso.com. You have an Azure AD tenant. You plan to sync contoso.com with the Azure AD tenant by using Azure AD Connect cloud sync. You need to create an account that will be used by Azure AD Connect cloud sync. Which type of account should you create?

   • Asystem-assigned managed identity
   • Bgroup managed service account (gMSA)
   • Cuser
   • DInetOrgPerson

   Show answer

   Answer: B

   Explanation

   B. You need the following to use Azure AD Connect cloud sync: Domain Administrator or Enterprise Administrator credentials to create the Azure AD Connect Cloud Sync gMSA (group Managed Service Account) to run the agent service. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-prerequisites?tabs=public-cloud

   Source: Adapted from community discussion — Maup33

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 34 · 264 in bank

   Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server and computers that run Windows. You link a Group Policy Object (GPO) to the domain and set Turn on BranchCache to Enabled. You need to enable BranchCache in BranchCache Distributed Cache mode. What should you configure on the computers?

   • ABackground Intelligent Transfer Service (BITS)
   • BOffline Files
   • CAdvanced sharing settings
   • DWindows Firewall inbound traffic rules

   Show answer

   Answer: D

   Next question

5. Question 35 · 264 in bank

   Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the domain controllers shown in the following table.

   

   You need to ensure that if an attacker compromises the computer account of RODC1, the attacker cannot view the Employee-Number AD DS attribute. Which partition should you modify?

   • Aconfiguration
   • Bglobal catalog
   • Cdomain
   • Dschema

   Show answer

   Answer: D

   Explanation

   Acording to this link https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adls/0afba1a7-ff6b-4878-97d0-f099de319dfb the modifications needs to be done at schema partition. If you scroll up on the left navigation menu and click on 2 Attributes its tells The following sections specify the attributes in the Active Directory Lightweight Directory Services schema.

   Source: Adapted from community discussion — c7d45f4

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 36 · 264 in bank

   Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the servers shown in the following table.

   

   You need to ensure that from Server1, you can use Windows Admin Center to manage the DHCP Server role on Server2. What should you do first?

   • AInstall the DHCP Server Tools feature on Server1.
   • BInstall a Windows Admin Center extension.
   • CInstall the DHCP Server Tools feature on Server2.
   • DModify the PowerShell remoting settings for Server2.

   Show answer

   Answer: B

   Next question

7. Question 37 · 264 in bank

   HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with an Azure AD tenant. The tenant contains a group named Group1 and the users shown in the following table.

   

   Domain/OU filtering in Azure AD Connect is configured as shown in the Filtering exhibit. (Click the Filtering tab.)

   

   You review the Azure AD Connect configurations as shown in the Configure exhibit. (Click the Configure tab.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. [YES] -> Password Write back is enabled. 2. [YES] -> Pass-Through authentication is in use, therefore AD is the Identity Provider. 3. [NO] -> "User2" is under "OU2" which is not syned to the Azure Tenant.

   Source: Adapted from community discussion — MR_Eliot

   

   Next question

8. Question 38 · 264 in bank

   HOTSPOT - Your on-premises network contains an Active Directory Domain Services (AD DS) domain. You plan to sync the domain with an Azure AD tenant by using Azure AD Connect cloud sync. You need to meet the following requirements: • Install the software required to sync the domain and Azure AD. • Enable password hash synchronization. What should you install, and what should you use to enable password hash synchronization? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   It seems that they are asking to use "cloud sync," the answer should be: 1: The Azure AD Connect provisioning agent: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-install 2: The Azure Portal: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/cloud-sync/how-to-configure#:~:text=On%20the%20configuration%20screen%2C%20select%20your%20domain%20and%20whether%20to%20enable%20password%20hash%20sync.%20Click%20Create.

   Source: Adapted from community discussion — Mikepsperu

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 39 · 264 in bank

   HOTSPOT - Your network contains two Active Directory Domain Services (AD DS) forests as shown in the following exhibit.

   

   The forests contain the domain controllers shown in the following table.

   

   You perform the following actions on DC1: • Create a user named User1. • Extend the schema with a new attribute named Attribute1. To which domain controllers are User1 and Attribute1 replicated? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   User1: This is a domain-level object. Since DC1 and DC2 are in the same domain (adatum.com), User1 will be replicated to DC2. DC3 is in a different domain (west.adatum.com), but it is in the same forest. Since it's a Global Catalog (GC) server, it will receive a partial replica of the adatum.com domain, including the newly created User1. DC4 is in a completely different forest (contoso.com) and there is no direct trust relationship between contoso.com and west.adatum.com, so User1 will not be replicated to DC4. Attribute1: This is a schema-level object. The schema is a forest-wide object. The schema master for the adatum.com forest is DC1, so any changes to the schema (such as adding a new attribute) are initially made on DC1. These changes are then replicated to all other domain controllers in the adatum.com forest, which includes DC2 and DC3. However, DC4 is in a different forest, so it will not receive the schema changes made in the adatum.com forest. In summary, User1 and Attribute1 will be replicated to DC2 and DC3

   Source: Adapted from community discussion — Mikepsperu

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 40 · 264 in bank

    Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the resources shown in the following table.

    

    You plan to replicate a volume from Server1 to Server2 by using Storage Replica. You need to configure Storage Replica. Where should you install Windows Admin Center?

    • AServer1
    • BCLIENT1
    • CDC1
    • DServer2

    Show answer

    Answer: B

    Explanation

    B CLient 1 https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/plan/installation-options We don’t recommend using Windows Admin Center for local management of the same server on which it’s installed. - Not A,D. Installing Windows Admin Center on a Domain controller is not supported - Not C

    Source: Adapted from community discussion — RickySmith

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-800 practice, question 31. 264 questions available.