AZ-800: Windows Server Hybrid Administrator Practice Exam

What the AZ-800 exam covers

• Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments219 questions
• Manage Windows Servers and workloads in a hybrid environment117 questions
• Manage virtual machines and containers138 questions
• Implement and manage an on-premises and hybrid networking infrastructure113 questions
• Manage storage and file services139 questions

Free AZ-800 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 726.

1. Question 1Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments

   Which role provides centralized identity, authentication, and group policy in a Windows Server environment?

   • AInternet Information Services (IIS) web server
   • BActive Directory Domain Services (AD DS)Correct
   • CDHCP Server for IP address lease assignment
   • DPrint Server for shared printer management
   ✓ Correct answer: B

   AD DS is the directory service that stores all user, computer, and group objects in a hierarchical forest and domain structure, and it is the authority that authenticates logons through Kerberos and NTLM. Because every domain-joined machine queries domain controllers for security tokens, AD DS becomes the single point at which identity and access decisions are enforced. Group Policy is delivered through AD DS, letting administrators push configuration and security settings to thousands of accounts and machines from one place. In hybrid deployments this same directory is synchronized to Microsoft Entra ID, so AD DS remains the on-premises root of trust.

   Why the other options are wrong

   • AStill the IIS web server; added descriptive detail, meaning unchanged.
   • CStill only leases IP addresses; added detail, meaning unchanged.
   • DStill manages shared printers; added detail, meaning unchanged.
2. Question 2Manage Windows Servers and workloads in a hybrid environment

   To reduce Azure compute costs for predictable, long-running Arc-enabled and Azure VM workloads, which purchasing option offers the largest discount in exchange for a 1- or 3-year commitment?

   • Adev/Test pricing only
   • BPay-as-you-go pricing
   • CSpot VMs
   • DAzure Reservations (Reserved VM Instances)Correct
   ✓ Correct answer: D

   Azure Reservations offer the largest discounts (up to 72% for a 3-year commitment and up to 55% for 1-year) for predictable, long-running workloads compared to pay-as-you-go pricing. Reservations work with both Azure VMs and Arc-enabled servers, making them ideal for stable, sustained workloads. The commitment period ensures consistent cost savings across the entire term.

   Why the other options are wrong

   • Adev/Test pricing only is incorrect because Dev/Test pricing applies only to development and testing environments and offers smaller discounts than Reservations.
   • BPay-as-you-go pricing is incorrect because it is the most expensive option with no discount.
   • CSpot VMs is incorrect because Spot VMs offer discounts but are intended for interruptible workloads, not mission-critical long-running services.
3. Question 3Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments

   You are designing an AD DS site topology for an organization with a datacenter and several branch offices connected by slow WAN links. What is the best-practice reason to define sites and site links?

   • ATo force full replication of the entire directory partition to every branch on each cycle
   • BTo control replication scheduling/compression and direct clients to the nearest domain controllerCorrect
   • CTo automatically promote a read-only domain controller in each branch subnet
   • DTo place all branch domain controllers into a single bridgehead server pool
   ✓ Correct answer: B

   Active Directory sites and site links define the physical topology of the network and enable fine-grained control over replication behavior. Defining sites allows AD to compress replication traffic over slow WAN links, schedule replication during off-peak hours, and ensure that clients authenticate with the nearest domain controller. This optimization reduces WAN bandwidth consumption and improves logon performance for branch office users.

   Why the other options are wrong

   • ASites do the opposite of forcing full replication; they compress and schedule delta replication to conserve WAN bandwidth rather than pushing the whole partition each cycle.
   • CDefining sites and site links does not promote domain controllers; RODC deployment is a separate installation and promotion decision independent of site topology.
   • DSites do not consolidate DCs into one bridgehead pool; the KCC selects a bridgehead per site, and site links govern inter-site connectivity rather than pooling all branch DCs together.
4. Question 4Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments

   To capture AD account logon events, which Group Policy setting must be configured on the domain controllers?

   • AAdvanced Audit Policy Account Logon subcategoriesCorrect
   • BThe DNS zone scavenging and refresh interval setting
   • CDHCP scope options for client network settings
   • DBranchCache content hash publication settings
   ✓ Correct answer: A

   To capture Active Directory account logon events, the Advanced Audit Policy Configuration must be configured on domain controllers with specific subcategories enabled. The "Audit Logon" and "Audit Account Logon" subcategories under "Logon/Logoff" and "Account Logon" policies respectively must be set to audit both Success and Failure events. These policies are configured through Group Policy Editor (gpedit.msc) under Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration, or via auditpol command-line utility. Enabling these audit policies causes the Security event log to record logon attempts with Event ID 4624 (success) and 4625 (failure). Standard Windows audit policies are superseded by Advanced Audit Policy when both are configured, giving fine-grained control over what authentication events are captured.

   Why the other options are wrong

   • BDNS scavenging interval is incorrect because DNS scavenging manages stale DNS records and is unrelated to audit policy configuration.
   • CDHCP scope options is incorrect because DHCP scope options are network configuration parameters not related to authentication auditing.
   • DBranchCache hash publication is incorrect because BranchCache is a WAN optimization technology and does not relate to audit policies.
5. Question 5Manage virtual machines and containers

   After enabling a vTPM on a VM and turning on BitLocker inside the guest, you can no longer restore the VM on a different Hyper-V host. What is the cause?

   • AThe vTPM key protector is fabric-specific, so the new host needs HGS authorizationCorrect
   • BBitLocker on the guest unexpectedly disabled the VM's network adapter at boot
   • CThe VHDX must be converted to a fixed-size disk to support vTPM
   • DThe VM needs additional vCPUs assigned to handle the decryption
   ✓ Correct answer: A

   When a VM with a vTPM has BitLocker enabled, the BitLocker recovery key is protected by the vTPM's key material, which is derived from the host or fabric. This makes the VM host-locked: it cannot be restored on a different Hyper-V host unless that host is part of the same Host Guardian Service (HGS) fabric and is authorized to unseal the vTPM. Simply moving the VHDX to a new host will fail because the new host cannot decrypt the vTPM's key material. To support VM mobility, the destination host must either be part of the same HGS-guarded fabric or the BitLocker encryption must be temporarily suspended before migration. This is a security feature that prevents unauthorized VMs from running on non-guarded hosts.

   Why the other options are wrong

   • BBitLocker encrypts volumes and does not disable virtual network adapters.
   • CvTPM key protection is independent of whether the VHDX is dynamic or fixed size.
   • DvCPU count does not affect vTPM unsealing or BitLocker decryption on another host.
6. Question 6Manage Windows Servers and workloads in a hybrid environment

   Contoso wants to use Azure Update Manager to assess and deploy operating system updates to 60 on-premises Windows servers from the Azure portal. What must be in place before those servers appear as manageable machines in Azure Update Manager?

   • AEnroll them in Intune
   • BInstall the Log Analytics agent
   • COnboard them to Azure ArcCorrect
   • DJoin them to Microsoft Entra
   ✓ Correct answer: C

   Azure Update Manager natively manages Azure VMs, but non-Azure machines must be connected through Azure Arc-enabled servers. Once the Connected Machine agent projects each on-premises server into Azure, Update Manager can run assessments and deployments against it without a Log Analytics workspace.

   Why the other options are wrong

   • AIntune manages client devices and mobile endpoints; it is not the enrollment path for server patching in Update Manager.
   • BThe Log Analytics (MMA) agent was required by the legacy Automation Update Management solution, not by Azure Update Manager, which relies on Arc.
   • DJoining a server to Microsoft Entra handles identity, not the Azure resource projection that Update Manager needs.
7. Question 7Manage virtual machines and containersSelect all that apply

   Datum runs a Hyper-V cluster and wants tenant VMs to run their own nested Hyper-V hosts for a lab, and it wants running production VMs to move between cluster nodes without downtime during maintenance. Which TWO Hyper-V capabilities should the administrator enable? (Choose two.)

   • ANested virtualization on the VMs that will host guestsCorrect
   • BLive migration between cluster nodesCorrect
   • CQuick migration between cluster nodes
   • DDiscrete device assignment for the tenant VMs
   • EDynamic Memory on the host partition
   ✓ Correct answer: A, B

   Nested virtualization exposes the virtualization extensions to a VM so it can itself run Hyper-V and host guest VMs, enabling the lab requirement. Live migration transfers a running VM's memory and state to another cluster node with no perceptible downtime, which is what maintenance without interrupting production workloads requires.

   Why the other options are wrong

   • CQuick migration saves and restores VM state, causing a brief outage, so it does not meet the no-downtime requirement.
   • DDiscrete device assignment passes a physical device directly to a VM but does not enable nested Hyper-V or non-disruptive migration.
   • EDynamic Memory adjusts memory allocation to VMs and is unrelated to nesting hypervisors or live-migrating running VMs.
8. Question 8Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments

   A Group Policy Object that maps a network drive is failing for some users. You confirm the GPO is linked to the correct OU and enabled, but its security filtering lists only a group those users do not belong to. What is the most likely cause that the GPO does not apply to them?

   • ASecurity filtering limits it to a group the users are not in, denying Apply Group PolicyCorrect
   • BThe GPO link order places it below another conflicting GPO linked to the OU
   • CThe Group Policy Central Store has not yet been created in the domain SYSVOL share
   • DThe users' client computers are missing the latest Windows cumulative update rollup
   ✓ Correct answer: A

   A GPO applies only to security principals that have both Read and Apply Group Policy permissions, which is what security filtering controls. If the filtered group does not include the affected users, the GPO is correctly linked but never processed for them.

   Why the other options are wrong

   • BLink order affects which setting wins in a conflict, but it would not prevent a non-conflicting drive-map GPO from applying at all to users who pass filtering.
   • CThe Central Store only stores ADMX templates for editing policies; its absence does not stop existing GPO settings from applying.
   • DA missing cumulative update would not selectively block one drive-map GPO based on group membership; the filtering mismatch is the direct cause.
9. Question 9Manage virtual machines and containersSelect all that apply

   A Hyper-V VM named LEGACY1 runs an older guest OS, and you notice degraded clock sync, no copy-paste of files, and stale heartbeat data. Which TWO actions help restore proper guest-host integration? (Choose TWO)

   • AInstall or update the Hyper-V Integration Services / integration components in the guestCorrect
   • BVerify the relevant Integration Services (such as Guest Services, Time Synchronization, Heartbeat) are enabled in the VM settingsCorrect
   • CConvert the VM from Generation 1 to Generation 2 in place to refresh drivers
   • DEnable Dynamic Memory to force the integration components to reload
   ✓ Correct answer: A, B

   Integration Services provide drivers and services for time synchronization, heartbeat, data exchange, and guest file copy (Guest Services). Older guests may need the components installed/updated, and the corresponding services must be checked/enabled in the VM's Integration Services settings to restore proper integration behavior.

   Why the other options are wrong

   • CYou cannot convert a VM's generation in place; Generation is fixed at creation, so this is not a valid remediation.
   • DDynamic Memory governs memory allocation and does not reload or fix integration components; it is unrelated to clock sync or file copy.
10. Question 10Implement and manage an on-premises and hybrid networking infrastructureSelect all that apply

    Which TWO statements accurately describe the Windows Admin Center Azure Network Adapter? (Choose TWO)

    • AConnects one server via P2S VPNCorrect
    • BUses a VPN gateway in the VNetCorrect
    • CKeeps a migrated server's IP
    • DNeeds an on-prem VPN appliance
    ✓ Correct answer: A, B

    The Azure Network Adapter configures a point-to-site VPN on one server, and that tunnel terminates on a VPN gateway in the target virtual network (Windows Admin Center provisions the gateway if one is absent). It is a per-server, software-based connection that needs no dedicated hardware on-premises. This makes it a lightweight way to give an individual Windows Server access to Azure.

    Why the other options are wrong

    • CPreserving a migrated server's IP is the job of Azure Extended Network, not the Azure Network Adapter.
    • DThe Azure Network Adapter uses a software point-to-site client and specifically does not require an on-premises VPN appliance.

Related Microsoft resources

• AZ-800 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

AZ-800 practice exam FAQ