AZ-801 practice questions 201–210

1. Question 201 · 239 in bank

   Your network contains an Active Directory Domain Services (AD DS) domain. All domain members have Microsoft Defender Credential Guard with UEFI lock configured. In the domain, you deploy a server named Server1 that runs Windows Server. You disable Credential Guard on Server1. You need to ensure that Server1 is NOT subject to Credential Guard restrictions. What should you do next?

   • ADisable the Turn on Virtualization Based Security group policy setting.
   • BRun dism and specify the /Disable-Feature and /FeatureName:IsolatedUserMode parameters.
   • CRun the Device Guard and Credential Guard hardware readiness tool.

   Show answer

   Answer: A

   Explanation

   https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage If Windows Defender Credential Guard was enabled via Group Policy without UEFI Lock, Windows Defender Credential Guard should be disabled via Group Policy. Answer is A

   Source: Adapted from community discussion — syu31svc

   References

   • Microsoft Learn

   Next question

2. Question 202 · 239 in bank

   You have an Azure virtual machine named VM1 that has the Web Server (IIS) server role installed. VM1 hosts a critical line-of-business (LOB) application. After the security team at your company deploys a new security baseline to VM1, users begin reporting that the application is unresponsive. You suspect that the security baseline has caused networking issues. You need to perform a network trace on VM1. What should you do?

   • AFrom VM1, run netstat.
   • BFrom Performance Monitor on VM1, create a Data Collector Set.
   • CFrom the Azure portal, configure the Diagnostics settings for VM1.
   • DFrom the Azure portal, configure the Performance diagnostics settings for VM1.

   Show answer

   Answer: D

   Explanation

   Yes, correct. The link provided says that Performance Analysis let's you do an Azure Files Analysis, which includes a network trace: "Azure Files analysis Includes all checks in the performance analysis, and captures a network trace and SMB counters."

   Source: Adapted from community discussion — GoforIT21

   Next question

3. Question 203 · 239 in bank

   You have three servers named Server1, Server2, and Server3 that run Windows Server. The servers have the Hyper-V server role installed and are configured in a Storage Spaces Direct cluster named Cluster1. Cluster1 hosts a virtual machine named VM1 that has Windows Admin Center installed. You manage all servers and clusters by using Windows Admin Center. You purchase an Azure subscription. You need to configure email alerts in Azure Monitor for the following: ✑ Disk Capacity Utilization Over 80 % for 10 Minutes ✑ Any critical alert in the cluster system event log ✑ Memory Utilization over 95 % for 10 Minutes ✑ Heartbeat fewer than 5 beats for 5 Minutes ✑ CPU Utilization over 85 % for 10 Minutes ✑ Any health service faults for the cluster The solution must use the minimum amount of administrative effort. What should you do?

   • AFrom the Azure portal, configure Azure Monitor and onboard Cluster1 by using Azure Arc.
   • BFrom Windows Admin Center, configure Azure Monitor and onboard Cluster1.
   • CConfigure Azure Monitor and manually install the Microsoft Monitoring Agent on Server1 Server2, and Server3

   Show answer

   Answer: B

   Explanation

   B) The solution must use the minimum amount of administrative effort. Windows Admin Center is capable of meeting these requirements and least amount of effort compared to A. https://www.virtualizationhowto.com/2019/06/manage-storage-spaces-direct-with-windows-admin-center/ https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/azure-monitor

   Source: Adapted from community discussion — DesolateMarauder

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 204 · 239 in bank

   You have three servers named Server1, Server2, and Server3 that run Windows Server and have the Hyper-V server role installed. Server1 hosts an Azure Migrate appliance named Migrate1. You plan to migrate virtual machines to Azure. You need to ensure that any new virtual machines created on Server1, Server2, and Server3 are available in Azure Migrate. What should you do?

   • AOn the network that has Migrate1 deployed, deploy a WINS server.
   • BOn Migrate1, set the Startup Type of the Computer Browser service to Automatic.
   • COn the DNS server used by Migrate1, create a GlobalName zone.
   • DOn Migrate1, add a discovery source.

   Show answer

   Answer: D

   Explanation

   Option A is incorrect because deploying a WINS server is not necessary for this scenario. Option B is incorrect because setting the Startup Type of the Computer Browser service to Automatic will not ensure that new virtual machines are automatically discovered and added to Azure Migrate. Option C is incorrect because creating a GlobalName zone on the DNS server used by Migrate1 is not necessary for this scenario. A discovery source specifies the Hyper-V hosts that Azure Migrate will discover and assess for migration. When you add a discovery source, Azure Migrate automatically detects and adds any new virtual machines that are created on the specified Hyper-V hosts. D is correct

   Source: Adapted from community discussion — syu31svc

   References

   • Microsoft Learn

   Next question

5. Question 205 · 239 in bank

   You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. The subscription contains the storage accounts shown in the following table.

   

   You plan to enable boot diagnostics for VM1. You need to configure storage for the boot diagnostics logs and snapshots. Which storage account should you use?

   • Astorage1
   • Bstorage2
   • Cstorage3
   • Dstorage4

   Show answer

   Answer: A

   Explanation

   Should be A, Boot diagnostics doesn't support premium storage accounts or zone redundant storage accounts. If either of these are used for boot diagnostics users will receive an StorageAccountTypeNotSupported error when starting the VM.

   Source: Adapted from community discussion — watson_n

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 206 · 239 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft Sentinel instance. You add the Windows Firewall data connector in Microsoft Sentinel. You need to ensure that Microsoft Sentinel can collect Windows Firewall logs from Server1. Solution: You install the Log Analytics agent on Server1. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 207 · 239 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft Sentinel instance. You add the Windows Firewall data connector in Microsoft Sentinel. You need to ensure that Microsoft Sentinel can collect Windows Firewall logs from Server1. Solution: You onboard Server1 to Microsoft Defender for Endpoint. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

8. Question 208 · 239 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft Sentinel instance. You add the Windows Firewall data connector in Microsoft Sentinel. You need to ensure that Microsoft Sentinel can collect Windows Firewall logs from Server1. Solution: You install the Microsoft Integration Runtime on Server1. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Next question

9. Question 209 · 239 in bank

   You have an Azure virtual machine named VM1 that runs Windows Server. The operating system on VM1 fails to fully initialize its network stack, and you cannot establish a network connection. You need to establish an interactive shell session. What should you use?

   • AAzure Bastion
   • BSerial console
   • Cjust-in-time (JIT) VM access

   Show answer

   Answer: B

   Explanation

   A and C are wrong because of the following: A. Azure Bastion: Azure Bastion provides secure RDP and SSH connectivity to virtual machines through the Azure portal over SSL. However, it requires the VM to have a functional network stack to establish a connection, which is not the case in this scenario where the network stack fails to initialize. C. Just-in-time (JIT) VM access: JIT VM access is a feature that allows controlled access to VMs by opening up inbound network connectivity for a limited period of time. Similar to Azure Bastion, it relies on the VM having a functional network stack, which is not possible when the network stack fails to initialize. therefore option B is the correct answer the Serial Console provides direct access to the VM's console without relying on a functional network stack, which is essential in this scenario where the network stack fails to initialize.

   Source: Adapted from community discussion — NazerRazer

   Next question

10. Question 210 · 239 in bank

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft Sentinel instance. You add the Windows Firewall data connector in Microsoft Sentinel. You need to ensure that Microsoft Sentinel can collect Windows Firewall logs from Server1. Solution: You install the Azure Connected Machine agent on Server1. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-801 practice, question 201. 239 questions available.