Free AZ-800 sample questions

Correct answer: A Domain Admin must pre-create the RODC computer account in Active Directory and delegate installation rights to the branch office administrator.

This method, known as a staged RODC installation, is the most secure approach. A member of the Domain Admins group pre-creates the RODC account and specifies which user or group has the permission to attach a server to that account. This delegates the exact permission needed without granting excessive rights like Domain Admin membership. The branch administrator can then complete the installation without needing high-level domain credentials.

Correct answers: Azure AD Password Protection proxy service on a member server; Azure AD Password Protection DC agent on all domain controllers

Microsoft Entra (Azure AD) Password Protection for AD DS uses two on-premises components. The DC agent (a password filter DLL plus the DC Agent service) must be installed on every domain controller, because the policy is enforced only on DCs that run it; it accepts or rejects each password change locally by using the most recently downloaded policy, which combines Microsoft's global banned password list with the tenant's custom banned password list and is cached in SYSVOL. The proxy service runs on a domain-joined member server and forwards the DC agents' policy download requests to Microsoft Entra ID, so domain controllers never need internet access and clear-text passwords never leave the DC. Password writeback, AD FS, and the Application Proxy connector aren't required.

Microsoft Entra (Azure AD) Password Protection for AD DS uses two on-premises components. The DC agent (a password filter DLL plus the DC Agent service) must be installed on every domain controller, because the policy is enforced only on DCs that run it; it accepts or rejects each password change locally by using the most recently downloaded policy, which combines Microsoft's global banned password list with the tenant's custom banned password list and is cached in SYSVOL. The proxy service runs on a domain-joined member server and forwards the DC agents' policy download requests to Microsoft Entra ID, so domain controllers never need internet access and clear-text passwords never leave the DC. Password writeback, AD FS, and the Application Proxy connector aren't required.

Correct answer: Production Checkpoint

Production checkpoints use the Volume Shadow Copy Service (VSS) inside a Windows guest (File System Freeze on Linux) to create a data-consistent, application-consistent point-in-time image of the VM without capturing memory state, which is appropriate for production workloads and backup scenarios. Standard checkpoints capture the VM's disks together with its memory state, so applications are restored mid-operation; they're intended for development and test and aren't application-consistent. Production is the default checkpoint type (Set-VM -CheckpointType Production, ProductionOnly, Standard, or Disabled). 'Recovery' checkpoints are created internally by backup applications such as DPM rather than chosen by the administrator, and 'Application-Aware Checkpoint' isn't a Hyper-V checkpoint type.

Correct answer: A three-way mirror space.

For a performance-sensitive database workload that must survive two simultaneous drive failures, use a three-way mirror space. Microsoft recommends mirroring for all workloads and parity for sequential workloads such as archival. A three-way mirror keeps three copies of the data, tolerates two drive failures, and requires at least five physical disks (twelve are available). Mirror-accelerated parity combines mirror and parity in one ReFS volume, but in Windows Server it's supported only on Storage Spaces Direct and recommended only for archival and backup workloads. Dual parity also tolerates two failures but has much lower random-write performance, and a simple space has no resiliency.

Correct answer: `Test-NetConnection -ComputerName -Port 53`

The first step in troubleshooting a conditional forwarder is to verify network connectivity from the on-premises DNS server to the target resolver on the required port. The `Test-NetConnection` cmdlet is the correct tool for this. It will confirm whether the on-premises DNS server can reach the Azure DNS Private Resolver over port 53 (DNS). If this test fails, the issue is likely a firewall rule, a network security group (NSG) in Azure, or a routing problem over the VPN/ExpressRoute connection.

Correct answer: Microsoft Entra Application Proxy

Microsoft Entra application proxy publishes on-premises web applications to remote users without a VPN. Users are pre-authenticated by Microsoft Entra ID, so Conditional Access policies such as MFA apply even when the back-end application doesn't support modern authentication; the private network connector installed on-premises makes only outbound connections and forwards requests to the app, which can use integrated Windows authentication through Kerberos constrained delegation. A point-to-site VPN would give the doctors' devices network-level access, Azure Bastion is for RDP/SSH to Azure VMs, and WAP with AD FS doesn't use Microsoft Entra ID as the identity provider.

Correct answer: VisibleCmdlets

In a JEA role capability file (.psrc), the `VisibleCmdlets` field lists the PowerShell cmdlets that users can run in the JEA session (optionally restricting their parameters and values). To allow starting, stopping, and restarting VMs, you would list `Start-VM`, `Stop-VM`, and `Restart-VM` in this field. `VisibleExternalCommands` is for executables and scripts outside PowerShell, `RoleDefinitions` belongs in the session configuration file (.pssc) where it maps users to role capabilities, and `AllowedCommandlets` isn't a valid field.

Correct answer: True

This statement is true. The Storage Sync Service and the Azure file share it syncs with must be in the same Azure region. While the on-premises servers (server endpoints) can be anywhere in the world, the Azure resources must be co-located in the same region for the sync group to be created.

Correct answer: Azure Policy with a Guest Configuration policy assignment.

Azure Policy's Guest Configuration feature is the ideal solution. You can create a custom Desired State Configuration (DSC) that defines the required state (antivirus service running). This configuration is then packaged and applied via an Azure Policy initiative. The policy can be set to not only audit for compliance but also to deploy a remediation task that automatically starts the service if it's found to be stopped. This provides a scalable, declarative way to enforce and remediate configuration drift across all Arc-enabled servers.

Correct answer: Discrete Device Assignment (DDA)

Discrete Device Assignment (DDA) passes an entire PCIe device, such as a GPU, through to a single virtual machine: the device is dismounted from the host by its PCI location path and assigned to the VM, which then uses the native driver with full access to the GPU. Each physical GPU can accelerate at most one VM, which matches the requirement for dedicated, exclusive access. GPU partitioning (GPU-P, Windows Server 2025) instead shares one GPU among multiple VMs, RemoteFX vGPU has been removed from Windows Server, and Enhanced Session Mode only improves the VMConnect experience.