AZ-800: Windows Server Hybrid Administrator Practice Exam

What the AZ-800 exam covers

• Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments226 questions
• Manage Windows Servers and workloads in a hybrid environment121 questions
• Manage virtual machines and containers143 questions
• Implement and manage an on-premises and hybrid networking infrastructure117 questions
• Manage storage and file services143 questions

Free AZ-800 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 750.

1. Question 1Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments

   Which role provides centralized identity, authentication, and group policy in a Windows Server environment?

   • AInternet Information Services (IIS) web server
   • BActive Directory Domain Services (AD DS)Correct
   • CDHCP Server for IP address lease assignment
   • DPrint Server for shared printer management
   ✓ Correct answer: B

   AD DS is the directory service that stores all user, computer, and group objects in a hierarchical forest and domain structure, and it is the authority that authenticates logons through Kerberos and NTLM. Because every domain-joined machine queries domain controllers for security tokens, AD DS becomes the single point at which identity and access decisions are enforced. Group Policy is delivered through AD DS, letting administrators push configuration and security settings to thousands of accounts and machines from one place. In hybrid deployments this same directory is synchronized to Microsoft Entra ID, so AD DS remains the on-premises root of trust.

   Why the other options are wrong

   • AStill the IIS web server; added descriptive detail, meaning unchanged.
   • CStill only leases IP addresses; added detail, meaning unchanged.
   • DStill manages shared printers; added detail, meaning unchanged.
2. Question 2Manage Windows Servers and workloads in a hybrid environment

   Which Azure service applies and reports patch compliance across Azure and Arc-enabled servers without deploying WSUS, helping control patching operational overhead?

   • AAzure DNS
   • BAzure Update ManagerCorrect
   • CAzure Front Door
   • DAzure CDN
   ✓ Correct answer: B

   Azure Update Manager is a unified service for applying and reporting on patch compliance across both Azure VMs and Arc-enabled on-premises servers. It eliminates the need to deploy and manage WSUS (Windows Server Update Services) in your environment while providing centralized patch management, compliance reporting, and scheduling capabilities. It integrates with Azure Arc for hybrid patch management.

   Why the other options are wrong

   • AAzure DNS is incorrect because DNS is a naming service for domain resolution, not a patch management solution.
   • CAzure Front Door is incorrect because Front Door is a global load-balancing service; it does not manage patches.
   • DAzure CDN is incorrect because CDN is a content delivery network for distributing content globally; it is not related to patch management.
3. Question 3Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments

   When designing group management for resource access across a domain, which strategy is the recommended best practice for scalability?

   • AUse only local SAM accounts defined on each individual server
   • BPut every user into one universal group and grant it Full Control on every resource everywhere in the forest
   • CAssign permissions directly to individual user accounts on every resource in the domain
   • DAGDLP: nest accounts into global groups, global groups into domain local groups, and assign permissions thereCorrect
   ✓ Correct answer: D

   The AGDLP strategy (Account Global Domain Local Permissions) is the recommended best practice for scalable group management. This nesting structure allows administrators to assign permissions once to domain local groups and then modify group membership by updating global groups, avoiding the need to modify ACLs when team membership changes. This approach also respects domain boundaries: global groups apply domain-wide, while domain local groups remain local to the resource location, enabling predictable cross-domain access management.

   Why the other options are wrong

   • AUse only local SAM accounts on each server is incorrect because it prevents domain-based access control, requires per-server account management, and does not scale across multiple resources.
   • BPut every user into a single universal group and grant it Full Control everywhere is incorrect because it grants excessive privilege to all users and violates the principle of least privilege.
   • CAssign permissions directly to individual user accounts on each resource is incorrect because it creates administrative overhead when users change roles and does not scale across multiple resources.
4. Question 4Manage storage and file servicesSelect all that apply

   Which TWO tools can monitor the health and capacity of Storage Spaces Direct (S2D) clusters? (Choose TWO)

   • AThe Print Management console for spooler and driver monitoring
   • BWindows Admin Center cluster dashboard (with performance history)Correct
   • CThe DHCP MMC console showing scope leases and address reservations
   • DPowerShell Get-StoragePool / Get-PhysicalDisk and Get-StorageJobCorrect
   ✓ Correct answer: B, D

   Both Windows Admin Center and PowerShell cmdlets provide robust monitoring for Storage Spaces Direct clusters. Windows Admin Center offers a visual cluster dashboard with integrated performance history tracking for capacity, health, and performance metrics across the entire S2D cluster. PowerShell cmdlets including Get-StoragePool, Get-PhysicalDisk, and Get-StorageJob enable programmatic monitoring and integration with custom scripts, allowing administrators to query pool status, physical disk health, and active repair jobs directly.

   Why the other options are wrong

   • APrint Management tracks print queues, spoolers, and drivers, not storage cluster health.
   • CThe DHCP console manages IP scope leases and reservations, not Storage Spaces Direct capacity.
5. Question 5Manage storage and file services

   An Azure File Sync server's cloud tiering is enabled, but the local volume keeps filling up and tiering does not free space. Which setting most directly controls how aggressively files are tiered?

   • AThe DHCP scope's configured lease duration setting value
   • BThe volume free space (and date) policy on the server endpointCorrect
   • CThe DNS server's stale-record scavenging refresh interval
   • DThe Hyper-V VM's processor compatibility mode configuration
   ✓ Correct answer: B

   Azure File Sync cloud tiering uses policies to determine when files should be tiered (moved to the cloud and replaced with stubs on the local volume). The primary policies are the volume free space policy (which maintains a minimum percentage of local free space by tiering older files) and the date policy (which tiers files not accessed for a specified number of days). If cloud tiering is enabled but the volume is filling up without tiering, the volume free space policy threshold is likely set incorrectly or too conservatively, or the date policy is not aggressive enough. Adjusting these policies to tier more aggressively will free up local space and allow new files to be downloaded as needed.

   Why the other options are wrong

   • ADHCP lease duration governs IP address renewal and has no effect on File Sync cloud tiering.
   • CDNS scavenging removes stale resource records and does not control how files are tiered to Azure.
   • DProcessor compatibility mode enables live migration across CPU generations, unrelated to tiering thresholds.
6. Question 6Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environmentsSelect all that apply

   Contoso wants a single Active Directory forest to trust identities from a partner Active Directory forest so that partner users can access selected resources, while limiting authentication so it applies only to specific servers rather than the whole forest. Which TWO should the administrator configure? (Choose two.)

   • AA forest trust between the two forestsCorrect
   • BSelective authentication on the trustCorrect
   • CA shortcut trust within a single forest
   • DSID filtering quarantine on the trust
   • EAn external trust between two domains
   ✓ Correct answer: A, B

   A forest trust establishes a trust relationship between two entire AD forests so users in one forest can be granted access to resources in the other. Enabling selective authentication on that trust means partner users are not authenticated forest-wide by default; the administrator must grant the Allowed to Authenticate right on specific computers, meeting the requirement to limit authentication to chosen servers.

   Why the other options are wrong

   • CA shortcut trust shortens authentication paths inside one forest and cannot link two separate forests.
   • DSID filtering quarantine is a security hardening setting on a trust, not the mechanism that scopes access to specific servers.
   • EAn external trust connects individual domains, not whole forests, so it fails the forest-to-forest requirement.
7. Question 7Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments

   An administrator configures Hyper-V Replica to replicate a virtual machine from a primary host to a replica host for disaster recovery. By default, over which protocol and method is replication traffic sent between the two hosts?

   • ASMB over TCP port 445 using a continuously available file share
   • BHTTP over TCP port 80 using Kerberos authenticationCorrect
   • CiSCSI over TCP port 3260 to a shared target
   • DRDP over TCP port 3389 between the hosts
   ✓ Correct answer: B

   Hyper-V Replica asynchronously replicates a VM's changes from a primary host to a replica host independently of shared storage or clustering. By default it sends replication traffic over HTTP on TCP port 80 using Kerberos (integrated) authentication when both hosts are domain-joined. For untrusted environments or to encrypt the traffic, you can instead configure HTTPS on TCP port 443 with certificate-based authentication. Replication is host-to-host and does not depend on container orchestration or shared storage.

   Why the other options are wrong

   • AHyper-V Replica does not use SMB file shares to transport replication; it uses HTTP/HTTPS endpoints.
   • CiSCSI on port 3260 is for block storage access, not for Hyper-V Replica traffic.
   • DRDP on port 3389 is for remote desktop sessions and is not used for replication.
8. Question 8Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments

   You are setting up a one-way external trust so that users in your forest can access resources in a vendor's separate forest, but you want to limit which of your users can authenticate in the trusted forest rather than allowing all of them. Which trust authentication setting should you configure?

   • AForest-wide authentication
   • BSID filtering quarantine disabled
   • CTransitive trust
   • DSelective authenticationCorrect
   ✓ Correct answer: D

   With selective authentication, no users are automatically granted the Allowed to Authenticate right on resources in the trusting domain; you must explicitly grant that right on the specific computers or resources, limiting access to chosen users. This contrasts with forest-wide (or domain-wide) authentication, which permits all users to authenticate.

   Why the other options are wrong

   • AForest-wide authentication grants all users in the trusted forest the ability to authenticate, which is the opposite of the requirement.
   • BDisabling SID filtering quarantine weakens security and does not limit which users authenticate.
   • CTransitivity controls how a trust flows to other domains and does not restrict which individual users can authenticate to resources.
9. Question 9Implement and manage an on-premises and hybrid networking infrastructure

   On a Server Core DNS server you must create a new forward lookup zone named sales.contoso.com for which this server is authoritative and which stores its data in a locally editable zone file. Which PowerShell cmdlet creates it?

   • AAdd-DnsServerSecondaryZone
   • BAdd-DnsServerStubZone
   • CAdd-DnsServerPrimaryZoneCorrect
   • DSet-DnsServerForwarder
   ✓ Correct answer: C

   Add-DnsServerPrimaryZone with the -ZoneName and -ZoneFile parameters creates an authoritative, writable zone whose data is kept in a standard file, exactly matching the requirement on a GUI-less Server Core host. Adding -DynamicUpdate or -ReplicationScope would adjust its behavior, but the base cmdlet establishes the primary zone. It is the counterpart to creating a primary zone in the DNS Manager console.

   Why the other options are wrong

   • AAdd-DnsServerSecondaryZone creates a read-only replica fed by zone transfer, so the server would not be the writable authority.
   • BAdd-DnsServerStubZone creates a zone that holds only NS and SOA records for another zone, not a full authoritative zone.
   • DSet-DnsServerForwarder configures upstream forwarding addresses and does not create any zone.
10. Question 10Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments

    An RODC at a branch office replicates most directory data. A line-of-business application stores a sensitive custom attribute on user objects that must never be present on that branch server, even in read-only form. What do you configure so the attribute is excluded from replication to any RODC?

    • APassword Replication Policy
    • BRODC filtered attribute setCorrect
    • CConfidentiality bit only
    • DSelective authentication
    ✓ Correct answer: B

    The filtered attribute set lets you mark specific attributes so they are never replicated to any Read-Only Domain Controller, keeping sensitive data off physically less-secure branch servers. Attributes added to the FAS are commonly also flagged confidential so read access is restricted; the FAS is what blocks the replication itself.

    Why the other options are wrong

    • APassword Replication Policy governs which account secrets (credentials) an RODC may cache, not which general attributes replicate to it.
    • CSetting only the confidentiality bit restricts who can read an attribute but by itself does not stop the attribute from replicating to an RODC.
    • DSelective authentication is a trust property controlling which cross-forest users may access resources; it has nothing to do with attribute replication.

Who this AZ-800 practice exam is for

This practice set is for anyone preparing for the AZ-800: Windows Server Hybrid Administrator exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AZ-800 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AZ-800 exam.

Related Microsoft resources

• AZ-800 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AZ-900 practice examRelated
• DP-300 practice examRelated
• DP-420 practice examRelated

AZ-800 practice exam FAQ