AZ-801 practice questions 11–20

1. Question 11 · 239 in bank

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that runs Windows Server. You run Get-BitLockerVolume -MountPoint C,D | fl *, which generates the following output.

   

   

   You need to ensure that volume D will be unlocked automatically when Server1 restarts. How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Add-BitLockerKeyProtector From the exhibit we see for volume D that AutoUnlockEnabled is False, and AutoUnlockKeyStored is empty. The Add-BitLockerKeyProtector cmdlet adds a protector for the volume key of the volume protected with BitLocker Drive Encryption. Example: The following example adds an ADAccountOrGroup protector to the previously encrypted operating system volume using the SID of the account: Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup S-1-5-21-3651336348-8937238915-291003330-500 Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. Box 2: Service - The -Service parameter indicates that the system account for this computer unlocks the encrypted volume. Add-BitLockerKeyProtector syntax with use of the ADAccountOrGroupProtector parameter: Add-BitLockerKeyProtector - [-MountPoint] <String[]> [-ADAccountOrGroupProtector] [-ADAccountOrGroup] <String> [-Service] [-WhatIf] [-Confirm] [<CommonParameters>] Incorrect: * Enable-BitLockerAutoUnlock The Enable-BitLockerAutoUnlock cmdlet enables automatic unlocking for a volume protected by BitLocker Disk Encryption. The command has no -ADAccountOrGroupProtector parameter. Syntax: Enable-BitLockerAutoUnlock - [-MountPoint] <String[]> [-WhatIf] [-Confirm] [<CommonParameters>] * The Clear-BitLockerAutoUnlock cmdlet removes all automatic unlocking keys used by BitLocker Drive Encryption. BitLocker stores these keys for the fixed data drives of a system on a volume that hosts a BitLocker-enabled operating system volume so that it can automatically unlock the fixed and removable data volumes in a system. This makes it easier for users to access data volumes. Syntax: Clear-BitLockerAutoUnlock [] Reference: https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker https://docs.microsoft.com/en-us/powershell/module/bitlocker/add-bitlockerkeyprotector

   References

   • Microsoft Learn

   

   Next question

2. Question 12 · 239 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a server named Server1 that runs Windows Server. You need to ensure that only specific applications can modify the data in protected folders on Server1. Solution: From Virus & threat protection, you configure Tamper Protection Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Tamper Protection in Windows Security helps prevent malicious apps from changing important Microsoft Defender Antivirus settings, including real-time protection and cloud-delivered protection.

   Source: Adapted from community discussion — nyashac

   References

   • Microsoft Learn

   Next question

3. Question 13 · 239 in bank

   HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the accounts shown in the following table.

   

   The domain is configured to store BitLocker recovery keys in Active Directory. Admin1 and Admin2 perform the following configurations: 1. Admin1 turns on BitLocker Drive Encryption (BitLocker) for volume C on Server1. 2. Admin1 moves Server1 to OU1. 3. Admin2 turns on BitLocker for removable volume E on Server2. 4. Admin2 moves removable volume E from Server2 to Server1 and unlocks the volume. On which Active Directory object can you view each BitLocker recovery key? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Server1 - You can configure Group Policies in your domain so that when encrypting any drive with BitLocker, the computer will save the recovery key in its computer object account in AD (like storing a local computer administrator password generated using LAPS). Box 2: Server2 - Reference: http://woshub.com/store-bitlocker-recovery-keys-active-directory/

   Source: Adapted from community discussion — cris66

   References

   • Microsoft Learn

   

   Next question

4. Question 14 · 239 in bank

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server as shown in the following table.

   

   Server1 has the connection security rules shown in the following table.

   

   Server2 has the connection security rules shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/change-rules-from-request-to-require-mode

   Source: Adapted from community discussion — Lu5ck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 15 · 239 in bank

   You have an Azure subscription that contains a user named User1 and the resources shown in the following table.

   

   User1 has a computer named Computer1 that runs Windows 11. User1 works from home and establishes a Point-to-Site (P2S) connection to GW1 to access AppSvr1. You deploy the resources shown in the following table.

   

   User1 cannot access AppSvr2. You need to ensure that User1 can access AppSvr2. What should you do?

   • AOn Computer1, download and reinstall the VPN client.
   • BCreate a route table and associate the table with GatewaySubnet on VNet1.
   • COn Computer1, modify the Windows Defender Firewall settings.
   • DAdd a service endpoint to VNet2.

   Show answer

   Answer: A

   Explanation

   https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview For peered virtual networks, resources in either virtual network can directly connect with resources in the peered virtual network. The traffic between virtual machines in peered virtual networks is routed directly through the Microsoft backbone infrastructure, not through a gateway or over the public Internet. Full connectivity is the default option. So, just reinstall the client.

   Source: Adapted from community discussion — Kurko

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 16 · 239 in bank

   HOTSPOT - You have a generation 1 Azure virtual machine named VM1 that runs Windows Server and is joined to an Active Directory domain. You plan to enable BitLocker Drive Encryption (Bit-Locker) on volume C of VM1. You need to ensure that the BitLocker recovery key for VM1 is stored in Active Directory. Which two Group Policy settings should you configure first? To answer, select the settings in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Good read: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-overview We need: Allow BitLocker without a compatible TPM and Require additional authentication at startup "If BitLocker needs to be used on a computer without a TPM, select Allow BitLocker without a compatible TPM. In this mode, a password or USB drive is required for startup. The USB drive stores the startup key that is used to encrypt the drive. When the USB drive is inserted, the startup key is authenticated, and the operating system drive is accessible. If the USB drive is lost or unavailable, BitLocker recovery is required to access the drive."

   Source: Adapted from community discussion — phi3nix

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 17 · 239 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a server named Server1 that runs Windows Server. You need to ensure that only specific applications can modify the data in protected folders on Server1. Solution: From App & browser control, you configure Reputation-based protection. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

8. Question 18 · 239 in bank

   DRAG DROP - You have an Azure subscription that contains an Azure key vault named Vault1. You plan to deploy a virtual machine named VM1 that will run Windows Server. You need to enable encryption at host for VM1. The solution must use customer-managed keys. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The answer is wrong. The correct answer is: 1- Create a disk encryption set and generate RSA keys. 2- Grant Vault1 the managed identity permission for the disk encryption ser. 3- Create VM1 and associate the disks of the virtual machine with the disk encryption https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal?tabs=azure-powershell

   Source: Adapted from community discussion — alzdashti

   References

   • Microsoft Learn

   

   Next question

9. Question 19 · 239 in bank

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains three servers named Server1, Server2, and Server3 that run Windows Server. All the servers are on the same network and have network connectivity. On Server1, Windows Defender Firewall has a connection security rule that has the following settings: • Rule Type: Server-to-server • Endpoint 1: Any IP address • Endpoint 2: Any IP address • Requirements: Require authentication for inbound connections and request authentication for outbound connections • Authentication Method: Computer (Kerberos V5) • Profile: Domain, Private, Public • Name: Rule1 Server2 has no connection security rules. On Server3, Windows Defender Firewall has a connection security rule that has the following settings: • Rule Type: Server-to-server • Endpoint 1: Any IP address • Endpoint 2: Any IP address • Requirements: Request authentication for inbound and outbound connections • Authentication Method: Computer (Kerberos V5) • Profile: Domain, Private, Public • Name: Rule1 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answers are N, Y, Y To your second point, Server3 REQUESTS Kerberos v5 and Server2 cannot provide it. A connection can still happen on a REQUEST, but not on a REQUIRE. Only Server1 REQUIRES authentication. So, given answer is correct. - N, Y, Y

   Source: Adapted from community discussion — smith288

   

   Next question

10. Question 20 · 239 in bank

    Your network contains an Active Directory Domain Services (AD DS) forest. The forest functional level is Windows Server 2012 R2. The forest contains the domains shown in the following table.

    

    You create a user named Admin1. You need to ensure that Admin1 can add a new domain controller that runs Windows Server 2022 to the east.contoso.com domain. The solution must follow the principle of least privilege. To which groups should you add Admin1?

    • AEAST\Domain Admins only
    • BCONTOSO\Enterprise Admins only
    • CCONTOSO\Schema Admins and EAST\Domain Admins
    • DCONTOSO\Enterprise Admins and CONTOSO\Schema Admins

    Show answer

    Answer: A

    Explanation

    I'm not so sure. As shown in this link, there are no forest-wide updates, domain-wide updates, or schema updates required to install a 2022 DC in a domain that already has a 2019 DC. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/adprep/changes-made-by-adprep Therefore, Domain Admins in the target domain should suffice.

    Source: Adapted from community discussion — NotThatGuy242

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-801 practice, question 11. 239 questions available.