AZ-801 practice questions 191–200

1. Question 191 · 239 in bank

   You have an on-premises network and an Azure virtual network. You establish a Site-to-Site VPN connection from the on-premises network to the Azure virtual network, but the connection frequently disconnects. You need to debug the IPsec tunnel from Azure. Which Azure VPN Gateway diagnostic log should you review?

   • AGatewayDiagnosticLog
   • BRouteDiagnosticLog
   • CIKEDiagnosticLog
   • DTunnelDiagnosticLog

   Show answer

   Answer: C

   Explanation

   Correct Answer "TunnelDiagnosticLog Contains tunnel state change events. Tunnel connect/disconnect events have a summarized reason for the state change if applicable."

   Source: Adapted from community discussion — xxxxx85xx

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 192 · 239 in bank

   You have a Site-to-Site VPN between an on-premises network and an Azure VPN gateway. BGP is disabled for the Site-to-Site VPN. You have an Azure virtual network named Vnet1 that contains a subnet named Subnet1. Subnet1 contains a virtual machine named Server1. You can connect to Server1 from the on-premises network. You extend the address space of Vnet1. You add a subnet named Subnet2 to Vnet1. Subnet2 uses the extended address space. You deploy an Azure virtual machine named Server2 to Subnet2. You cannot connect to Server2 from the on-premises network. Server1 can connect to Server2. You need to ensure that you can connect to Subnet2 from the on-premises network. What should you do?

   • AAdd an additional Site-to-Site VPN between the on-premises network and Vnet1.
   • BAdd a private endpoint to Subnet2.
   • CTo Subnet2, add a route table that contains a user-defined route.
   • DUpdate the routing information on the on-premises routers.

   Show answer

   Answer: D

   Explanation

   By default, Azure VPN gateway advertises the virtual network address space to the on-premises VPN device using the Border Gateway Protocol (BGP). However, in this scenario, BGP is disabled for the Site-to-Site VPN. Therefore, you need to manually update the on-premises VPN device with the new extended address space of Vnet1 and create a new route for it. Answer is D

   Source: Adapted from community discussion — syu31svc

   Next question

3. Question 193 · 239 in bank

   DRAG DROP - You have an Azure virtual machine named VM1 that runs Windows Server. VM1 has boot diagnostics configured to use a managed storage account. You are troubleshooting connectivity issue on VM1. You need to run a PowerShell cmdlet on VM1 by using the Azure Serial Console. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/troubleshoot/azure/virtual-machines/serial-console-overview https://docs.microsoft.com/en-us/troubleshoot/azure/virtual-machines/serial-console-windows

   Source: Adapted from community discussion — syu31svc

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 194 · 239 in bank

   HOTSPOT - You have an on-premises server named Server1 and a Microsoft Sentinel instance. You plan to collect Windows Defender Firewall events from Server1 and analyze the event data by using Microsoft Sentinel. What should you install on Server1, and which information should you provide during the installation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Azure Monitor agent - The Azure Monitor agent supports Log Analytics, Metrics explorer, and Microsoft Sentinel. Note: The Azure Monitor agent is meant to replace the Log Analytics agent, Azure Diagnostic extension and Telegraf agent for both Windows and Linux machines. It can send data to both Azure Monitor Logs and Azure Monitor Metrics and uses Data Collection Rules (DCR) which provide a more scalable method of configuring data collection and destinations for each agent. Use the Azure Monitor agent if you need to: * Collect guest logs and metrics from any machine in Azure, in other clouds, or on-premises. (Azure Arc-enabled servers required for machines outside of Azure.) * Manage data collection configuration centrally, using data collection rules and use Azure Resource Manager (ARM) templates or policies for management overall. * Send data to Azure Monitor Logs and Azure Monitor Metrics (preview) for analysis with Azure Monitor. * Use Windows event filtering or multi-homing for logs on Windows and Linux. Box 2: The Azure Log Analytics workspace ID and workspace key The Azure Monitor agent sends data to Azure Monitor Metrics (preview) or a Log Analytics workspace supporting Azure Monitor Logs. Enable Microsoft Defender for Cloud monitoring of on-premises Windows computers. 1. In the Azure portal on the Defender for Cloud - Overview blade, select the Get Started tab. 2. Select Configure under Add new non-Azure computers. A list of your Log Analytics workspaces displays, and should include the Defender for Cloud- SentinelWorkspace. 3. Select this workspace. The Direct Agent blade opens with a link for downloading a Windows agent and keys for your workspace identification (ID) to use when you configure the agent. 4. Select the Download Windows Agent link applicable to your computer processor type to download the setup file. 5. To the right of Workspace ID, select Copy, and then paste the ID into Notepad. 6. To the right of Primary Key, select Copy, and then paste the key into Notepad. Reference: https://docs.microsoft.com/en-us/azure/architecture/hybrid/hybrid-security-monitoring https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview

   Source: Adapted from community discussion — syu31svc

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 195 · 239 in bank

   Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains three domain controllers named DC1, DC2, and DC3. You connect a Microsoft Defender for Identity instance to the domain. You need to onboard all the domain controllers to Defender for Identity. What should you run on the domain controllers?

   • AAzure ATP Sensor Setup.exe
   • BAzureConnectedMachineAgent.msi
   • CMARSAgentInstaller.exe
   • DMMASetup-AMD64.exe

   Show answer

   Answer: A

   References

   • Microsoft Learn

   Next question

6. Question 196 · 239 in bank

   HOTSPOT - You have an Azure Active Directory Domain Services (Azure AD DS) domain named aadds.contoso.com. You have an Azure virtual network named Vnet1. Vnet1 contains two virtual machines named VM1 and VM2 that run Windows Server. VM1 and VM2 are joined to aadds.contoso.com. You create a new Azure virtual network named Vnet2. You add a new server named VM3 to Vnet2. When you attempt to join VM3 to aadds.contoso.com, you get an error message that the domain cannot be found. You need to ensure that you can join VM3 to aadds.contoso.com. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Configure virtual network peering between Vnet1 and Vnet2. Connectivity issues for domain-join. If the VM can't find the managed domain, there's usually a network connection or configuration issue. Review the following troubleshooting steps to locate and resolve the issue: 1. Ensure the VM is connected to the same, or a peered, virtual network as the managed domain. If not, the VM can't find and connect to the domain in order to join. If the VM isn't connected to the same virtual network, confirm that the virtual networking peering or VPN connection is Active or Connected to allow the traffic to flow correctly. 2. Try to ping the domain using the domain name of the managed domain, such as ping aaddscontoso.com. * If the ping response fails, try to ping the IP addresses for the domain displayed on the overview page in the portal for your managed domain, such as ping 10.0.0.4. * If you can successfully ping the IP address but not the domain, DNS may be incorrectly configured. Make sure that you've configured the managed domain DNS servers for the virtual network. Box 2: Add a virtual network link to an existing Azure private DNS zone. The private DNS zone already exists. After you create a private DNS zone in Azure, you'll need to link a virtual network to it. Once linked, VMs hosted in that virtual network can access the private DNS zone. Every private DNS zone has a collection of virtual network link child resources. Each one of these resources represents a connection to a virtual network. A virtual network can be linked to private DNS zone as a registration or as a resolution virtual network. Reference: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/troubleshoot-domain-join https://docs.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links

   Source: Adapted from community discussion — jecawi9630

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 197 · 239 in bank

   You have five Azure virtual machines. You have a dedicated Azure Storage account to collect performance data. You need to send the collected data directly to the Azure Storage account. What should you install on the virtual machines?

   • Athe Azure Connected Machine agent
   • Bthe Telegraf agent
   • Cthe Dependency agent
   • Dthe Azure Monitor agent
   • Ethe Azure Diagnostics extension

   Show answer

   Answer: E

   Explanation

   This is almost literally the same question as in topic 5, question 7. There the Azure Diagnostics Extension was given as the correct answer. I believe that is correct - because the link provided there proves it: https://docs.microsoft.com/en-us/azure/azure-monitor/agents/diagnostics-extension-overview

   Source: Adapted from community discussion — GoforIT21

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 198 · 239 in bank

   Select 2

   You have an Azure virtual machine named VM1 that runs Windows Server. When you attempt to install the Azure Performance Diagnostics extension on VM1, the installation fails. You need to identify the cause of the installation failure. What are two possible ways to achieve the goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • ASign in to VM1 and verify the MonitoringAgent.log file.
   • BSign in to VM1 and verify the WaAppAgent.log file.
   • CFrom the Azure portal, view the alerts for VM1.
   • DFrom the Azure portal, view the activity log for VM1.

   Show answer

   Answer: BD

   Explanation

   Doesn't the MonitoringAgent.log file have to do with Azure Monitoring Agent? If so, there is no reference to the monitoring agent being installed on the VM, so A cannot be part of the answer. Am I missing something?

   Source: Adapted from community discussion — MiMojo

   Next question

9. Question 199 · 239 in bank

   Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains 20 Active Directory sites. All user management is performed from a central site. You add users to a group. You discover that group changes do NOT appear on a domain controller in a remote site. You need to identify whether the group changes appear on other domain controllers. What should you use?

   • AActive Directory Sites and Services
   • BActive Directory Replication Status Tool
   • CMicrosoft Support and Recovery Assistant
   • DFile Replication Service (FRS) Status Viewer

   Show answer

   Answer: B

   Explanation

   Answer is correct. BUT --> As of June 2nd, 2023, the Active Directory Replication Status Tool is no longer available for download. The following article is provided for historical purposes only. https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/get-use-active-directory-replication-status-tool

   Source: Adapted from community discussion — tomasek88

   References

   • Microsoft Learn

   Next question

10. Question 200 · 239 in bank

    You have an Azure virtual machine named VM1 that runs Windows Server. You plan to deploy a new line-of-business (LOB) application to VM1. You need to prevent the application from creating child processes. What should you configure on VM1?

    • AMicrosoft Defender Credential Guard
    • BMicrosoft Defender Application Control
    • CMicrosoft Defender SmartScreen
    • DExploit protection

    Show answer

    Answer: D

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-801 practice, question 191. 239 questions available.