AZ-800 practice questions 71–80

1. Question 71 · 264 in bank

   SIMULATION - You need to create a Group Policy Object (GPO) named GPO1 that only applies to a group named MemberServers. To complete this task, sign in the required computer or computers.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Could you tell me how to answer this question? In the exam, do we have to connect to another PC to run the exercise like a laboratory? Thanks.

   Source: Adapted from community discussion — smorar

   

   Next question

2. Question 72 · 264 in bank

   Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the domain controllers shown in the following table.

   

   You have a partner organization that has an AD DS forest named fabrikam.com. You create a trust relationship between contoso.com and fabrikam.com. You need to configure selective authentication for the trust relationship. Which domain controller should be granted permissions to fabrikam.com?

   • ADC1
   • BDC2
   • CDC3
   • DDC4

   Show answer

   Answer: D

   References

   • Microsoft Learn

   Next question

3. Question 73 · 264 in bank

   You have a Microsoft Entra Domain Services domain named contoso.com. You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least privilege. To which group should you add the administrator?

   • AAAD DC Administrators
   • BDomain Admins
   • CSchema Admins
   • DEnterprise Admins
   • EGroup Policy Creator Owners

   Show answer

   Answer: A

   Explanation

   Please do your research by if my analysis is right: The question is talking about Entra DS, not on-prim, so if I am not mistake there no group as GP Creator Owner there, the the Answer should be A

   Source: Adapted from community discussion — SunRise

   Next question

4. Question 74 · 264 in bank

   HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. Contoso.com contains an organizational unit (OU) named OU1. You have an Azure subscription that is linked to a Microsoft Entra tenant named fabrikam.com. You need to sync contoso.com with fabrikam.com. The solution must meet the following requirements: • Support Windows Hello for Business by using a hybrid certificate deployment. • Ensure that the passwords in contoso.com do NOT sync to fabnkam.com. Which Microsoft Entra Connect feature should you use for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Support Windows Hello for Business by using a hybrid certificate deployment: Device writeback. This feature is necessary for hybrid certificate trust deployments as it allows devices to be registered in Microsoft Entra ID. https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization Ensure that the passwords in contoso.com do NOT sync with fabrikam.com: Pass-through authentication. This feature allows users to authenticate using their on-premises passwords without syncing the password hashes to Microsoft Entra ID. https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta

   Source: Adapted from community discussion — Krayzr

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 75 · 264 in bank

   Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two servers named Server1 and Server2 and the users shown in the following table.

   

   Which users can establish a PowerShell remoting session from Server1 to Server2?

   • AUser1 and User3 only
   • BUser2 and User4 only
   • CUser3 and User4 only
   • DUser1, User3, and User4 only
   • EUser1, User2, User3, and User4

   Show answer

   Answer: A

   Explanation

   https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#remote-management-users Use the Remote Management Users group to allow users to manage servers through the Server Manager console. Use the WinRMRemoteWMIUsers\_ group to allow users to remotely run Windows PowerShell commands.

   Source: Adapted from community discussion — zuzmo483

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 76 · 264 in bank

   HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. Contoso.com contains an organizational unit (OU) named OU1. You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named fabrikam.com. Fabrikam.com syncs with contoso.com. In Sub1, you create a Microsoft Entra Domain Services domain configured as shown in the following table.

   

   In domain1.onmicrosoft.com, you create two OUs named OU1 and OU2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Y N Y Yes. Users in the on-premises AD DS domain (contoso.com) that are synchronized to Microsoft Entra ID (fabrikam.com) will be synchronized to the AADDC Users OU in the managed domain (domain1.onmicrosoft.com) No. Synchronization in Microsoft Entra Domain Services is one-way from Microsoft Entra ID to the managed domain. Users created in the managed domain (domain1.onmicrosoft.com) do not sync back to Microsoft Entra ID (fabrikam.com). Yes. Users created in Microsoft Entra ID (fabrikam.com) will be synchronized to the managed domain (domain1.onmicrosoft.com) and placed in the AADDC Users OU1. https://learn.microsoft.com/en-us/entra/identity/domain-services/synchronization

   Source: Adapted from community discussion — Krayzr

   References

   • Microsoft Learn

   

   Next question

7. Question 77 · 264 in bank

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. You have a Microsoft Entra tenant. You need to implement Microsoft Entra Connect Sync. The solution must meet the following requirements: • Prevent the password hashes of contoso.com from being synced to the Microsoft Entra tenant. • Minimize user effort when authenticating to Microsoft Entra registered apps. • Minimize the number of on-premises infrastructure components. What should you include in the solution for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   **Prevent the password hashes of contoso.com from being synced to the Microsoft Entra tenant: Pass-through authentication. This method allows users to authenticate using their on-premises passwords without syncing the password hashes to Microsoft Entra ID1. **Minimize user effort when authenticating to Microsoft Entra registered apps: Single sign-on (SSO). This feature allows users to sign in once and gain access to all their applications without needing to re-enter their credentials2. https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/choose-ad-authn

   Source: Adapted from community discussion — Krayzr

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 78 · 264 in bank

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. You create the resources shown in the following table.

   

   You create the Group Policy Objects (GPOs) shown in the following table.

   

   You configure the Group Policy Preferences shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Mm, correct! The answer is NNN: - Computer configuration settings override user configuration settings - Since Comp1 is in OU2, GPO2's computer configuration (Link3) will override any user configuration settings (Link2 or Link4) regardless of which user logs in.

   Source: Adapted from community discussion — stonwall12

   

   Next question

9. Question 79 · 264 in bank

   DRAG DROP - Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site. You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1. You need to recommend a deployment plan that meets the following requirements: ✑ Ensures that a user named User1 can perform the RODC installation on Server1 ✑ Ensures that you can control the AD DS replication schedule to the Server1 ✑ Ensures that Server1 is in a new site named RemoteSite1 Uses the principle of least privilege

   

   Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1. We need to create a site and subnet for the remote site. The new site will be added to the Default IP Site Link so we don't need to create a new site link. You configure the replication schedule on the site link. Box 2. When we pre-create an RODC account, we can specify who is allowed to attach the server to the prestaged account. This means that the User1 does not need to be added to the Domain Admins group. Box3. User1 can connect the RODC to the prestaged account by running the AD DS installation wizard. Reference: https://mehic.se/2018/01/02/how-to-install-and-configure-read-only-domain-controller-rodc-2016/

   Source: Adapted from community discussion — tfulanchan

   

   Next question

10. Question 80 · 264 in bank

    Your network contains an Active Directory Domain Services (AD DS) domain. The network also contains 20 domain controllers, 100 member servers, and 100 client computers. You have a Group Policy Object (GPO) named GPO1 that contains Group Policy preferences. You plan to link GPO1 to the domain. You need to ensure that the preference in GPO1 apply only to domain member servers and NOT to domain controllers or client computers. All the other Group Policy settings in GPO1 must apply to all the computers. The solution must minimize administrative effort. Which type of item level targeting should you use?

    • ADomain
    • BOperating System
    • CSecurity Group
    • DEnvironment Variable

    Show answer

    Answer: B

    Explanation

    I want to correct this answer, I did some testing, and the operating system option has a computer role option in it. You can set that to member server. So this is a valid option. Security group is also possible, but requires more overhead. You should always choose the best option. Same for D, which would also be a possibility. Domain is rubish So B is correct

    Source: Adapted from community discussion — kijken

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-800 practice, question 71. 264 questions available.