AZ-801 practice questions 21–30

1. Question 21 · 239 in bank

   You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains the resources shown in the following table.

   

   Sub1 has Microsoft Defender for Servers enabled. You are assigned the Contributor role for Sub1. You need to implement just-in-time (JIT) VM access for VM1. What should you do first?

   • ACreate a network security group (NSG).
   • BEnable enhanced security in Microsoft Defender for Cloud.
   • CRequest the Owner role for Sub1.
   • DCreate an application security group.

   Show answer

   Answer: A

   Explanation

   "JIT requires an NSG to be configured or a Firewall configuration (or both)" From here: https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage There's no mention of Azure Firewall in the question, so an NSG would be required.

   Source: Adapted from community discussion — NotThatGuy242

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 22 · 239 in bank

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains an organizational unit (OU) named OU1. OU1 contains servers that run sensitive workloads. You plan to add connection security rules that meet the following requirements: • The servers in OU1 must only accept connections from domain-joined • The servers in OU1 must only be able to communicate with domain-joined You create a Group Policy Object (GPO) named GPO1 and link GPO1 to contoso.com. You need to configure a connection security rule in GPO1 by using Windows Defender Firewall with Advanced Security. How should you configure the rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The given answer is Correct. Rule type: Isolation Isolation rules are used to enforce authentication for network traffic. (Authentication exemption rules are used to specify traffic that should be exempt from the authentication requirements. And Tunnel rules are used to secure traffic between endpoints , typically used for VPN) Requirements: Require authentication for inbound and outbound connections This is being stressed in this certification, the difference between required and requested. Authentication Method: Computer (Kerberos V5) This will ensure that only domain-joined computers (which use Kerberos for authentication) can communicate with the servers.

   Source: Adapted from community discussion — NilsAbrahamsson

   

   Next question

3. Question 23 · 239 in bank

   You have an on-premises virtual machine named VM1 that runs Windows Server. You have an Azure subscription. You plan to use an Azure Site Recovery replication policy to replicate VM1 to Azure. You need to ensure that changes on VM1 are replicated as often as possible. To what should you set the Copy frequency setting for the policy?

   • A15 Seconds
   • B30 Seconds
   • C1 Minute
   • D5 Minutes

   Show answer

   Answer: B

   Next question

4. Question 24 · 239 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a server named Server1 that runs Windows Server. You need to ensure that only specific applications can modify the data in protected folders on Server1. Solution: From App & browser control, you configure the Exploit protection settings. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Exploit protection helps protect devices from malware that uses exploits to spread and infect other devices. Mitigation can be applied to either the operating system or to an individual app

   Source: Adapted from community discussion — nyashac

   References

   • Microsoft Learn

   Next question

5. Question 25 · 239 in bank

   DRAG DROP - You have a Windows Server 2022 failover cluster named Cluster that contains the Cluster Shared Volumes (CSV) shown in the following table.

   

   All the nodes in Cluster1 have BitLocker Drive Encryption (BitLocker) installed. You need to use PowerShell to enable BitLocker on Volume1. In which order should you run the commands? To answer, drag the appropriate commands to the correct order. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I had step 2 and 4 mixed up initially, but when reading step 3, I noticed the parameter set in 3 was used in what I thought was step 2 so I swapped 2 and 4 and that was correct. Hope they do this on the exam too, free loot boys

   Source: Adapted from community discussion — Vallion

   

   Next question

6. Question 26 · 239 in bank

   You have an on-premises server named Server1 that runs Windows Server 2022 Standard. You have an Azure subscription that contains the virtual machines shown in the following table.

   

   The subscription contains a Microsoft Sentinel instance named Sentinel1 in the Central US Azure region. You need to implement the Windows Firewall connector. Which servers can send Windows Firewall logs to Sentinel1?

   • AVM1 only
   • BVM2 only
   • CVM1 and Server1 only
   • DVM1, VM2, and VM3 only
   • EVM1, VM2, and Server1 only
   • FVM1, VM2, VM3, and Server1

   Show answer

   Answer: E

   Explanation

   Azure Virtual Machines: VM1 (Windows Server 2022 Datacenter: Azure Edition) is fully compatible with the Windows Firewall connector due to its Azure-specific capabilities and integration with Azure services. VM2 (Windows Server 2019 Datacenter) is also compatible with the Windows Firewall connector, as it's a recent Windows Server version. On-premises Server: Server1 (Windows Server 2022 Standard) can also send Windows Firewall logs to Sentinel1 using the Windows Firewall Connector. This requires an agent to be installed on the on-premises server. VM3 Incompatibility: VM3 (Windows Server 2016 Datacenter) is not directly compatible with the Windows Firewall connector. While it's possible to use third-party solutions or custom scripts to extract and send firewall logs to Sentinel1, it's not a straightforward and officially supported method. Therefore, the correct answer is E. VM1, VM2, and Server1 only.

   Source: Adapted from community discussion — kenda1535

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 27 · 239 in bank

   Select 2

   You have two servers named Server1 and Server2 that run Windows Server and have the Hyper-V role installed. You plan to deploy Hyper-V Replica between Server1 and Server2. The deployment will use certificate based authentication. You need to configure the prerequisites for the Hyper-V Replica deployment. Which two actions should you perform on each server? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point.

   • ACreate a self-signed certificate.
   • BEnable the Hyper-V Replica HTTP Listener (TCP-In) firewall rule.
   • CEnable the Hyper-V Replica HTTPS Listener (TCP-In) firewall rule.
   • DInstall a trusted user certificate.
   • EInstall a trusted computer certificate.

   Show answer

   Answer: CE

   Next question

8. Question 28 · 239 in bank

   HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains the servers shown in the following table.

   

   Server1 has the connection security rule as shown in the Server exhibit. (Click the Server1 tab.)

   

   Server2 has the connection security rule as shown in the Server2 exhibit. (Click the Server2 tab.)

   

   Server1 has the inbound firewall rules as shown in the Server1 inbound rules exhibit. (Click the Server1 inbound rules tab.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

9. Question 29 · 239 in bank

   You have an Azure subscription. The subscription contains virtual machines that run Windows Server as shown in the following table.

   

   You plan to implement Azure Site Recovery. Which virtual machines can be replicated by using Site Recovery?

   • AVM1 only
   • BVM1 and VM2 only
   • CVM1, VM2, and VM3 only
   • DVM1, VM2, and VM4 only
   • EVM1, VM2, VM3, and VM4

   Show answer

   Answer: C

   Next question

10. Question 30 · 239 in bank

    You have an on-premises server named Server1 that runs Windows Server. Server1 has the Web Server (IIS) server role installed and hosts an ASP.NET web app named App1. You have an Azure subscription. You plan to migrate App1 to a container in Azure. You need to export App1 to a ZIP file. What should you install on Server1?

    • Athe Windows Server Migration Tools feature
    • Bthe IIS Management Scripts and Tools role service
    • CWeb Deploy
    • DDocker Enterprise

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-801 practice, question 21. 239 questions available.