AZ-801: Configuring Windows Server Hybrid Advanced Services Practice Exam

What the AZ-801 exam covers

• Secure Windows Server191 questions
• Implement and Manage Windows Server High Availability136 questions
• Implement Disaster Recovery110 questions
• Migrate Servers and Workloads151 questions
• Monitor and Troubleshoot Windows Server137 questions

Free AZ-801 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 725.

1. Question 1Secure Windows Server

   Which feature protects credentials by isolating LSA secrets using virtualization-based security?

   • AIIS
   • BDHCP
   • CDNS round-robin
   • DCredential GuardCorrect
   ✓ Correct answer: D

   Credential Guard uses virtualization-based security (VBS) to run a trustlet inside an isolated Hyper-V container, moving the secrets normally held by the Local Security Authority into memory that the running operating system cannot read. Because the derived credentials such as NTLM hashes and Kerberos ticket-granting tickets never sit in the standard LSASS process space, tools that scrape LSASS cannot harvest them. This directly defeats pass-the-hash and pass-the-ticket lateral movement even on a host where an attacker has already gained code execution.

   Why the other options are wrong

   • AIIS is a web server role for hosting HTTP applications and has no relationship to secret isolation or the Local Security Authority.
   • BDHCP automatically leases IP addresses to clients and operates entirely at the network configuration layer, so it offers no credential protection.
   • CDNS round-robin distributes client requests across multiple address records for crude load balancing and does nothing to secure or isolate credentials.
2. Question 2Implement Disaster Recovery

   To reduce Azure Backup costs for VMs with infrequent restore needs, which storage redundancy/tier choice lowers spend while keeping data offsite?

   • AStore the backup copies on the source VM's own OS disk
   • BDisable the backup retention policy entirely
   • CUse the archive tier and LRS without geo-redundancyCorrect
   • DAlways use GRS storage with daily full backups only
   ✓ Correct answer: C

   Azure Backup storage costs are driven by the tier (hot, cool, archive) and redundancy level chosen. For VMs with infrequent restore needs, the archive tier offers the lowest cost per gigabyte for long-term retention of recovery points, as archive data is accessed rarely. Additionally, if your workload doesn't require geographic redundancy, using Locally Redundant Storage (LRS) instead of GRS eliminates the cost of data replication to secondary regions. This combination minimizes storage spend while keeping backup data offsite for recovery purposes, directly addressing cost optimization without sacrificing recoverability.

   Why the other options are wrong

   • AStore backups on the source VM's OS disk is incorrect because storing backups locally defeats the purpose of offsite backup and increases local storage costs.
   • BDisable retention entirely is incorrect because eliminating backups removes all recovery capability and violates backup best practices.
   • DAlways use GRS with daily full backups only is incorrect because GRS adds cost and daily full backups are inefficient; selective tiering and redundancy are more cost-effective.
3. Question 3Secure Windows Server

   A design must encrypt a server's OS and data volumes at rest so that the encryption keys are sealed to dedicated hardware and released only after the boot path integrity is verified. Which technology combination is the best practice?

   • ABitLocker with TPMCorrect
   • BEFS with DPAPI
   • CBitLocker with password
   • DSMB encryption
   ✓ Correct answer: A

   BitLocker full-volume encryption combined with a Trusted Platform Module seals the volume master key to the TPM and only releases it after the TPM measures the boot components and confirms integrity, protecting both OS and data volumes at rest. This binds the key to hardware, so the disk cannot be decrypted if moved to another machine.

   Why the other options are wrong

   • BEFS encrypts individual files and folders using per-user keys protected by DPAPI, not whole volumes, and it does not provide a hardware root of trust for boot integrity.
   • CA BitLocker password protector encrypts the volume but stores no key in hardware and performs no boot integrity measurement, so it fails the hardware-root-of-trust requirement.
   • DSMB encryption protects data in transit between client and server shares; it does nothing for data at rest on the volume.
4. Question 4Monitor and Troubleshoot Windows Server

   Which Sysinternals utility provides a real-time, color-coded view of file system, registry, network, and process/thread activity for deep troubleshooting?

   • AProcess Monitor (Procmon)Correct
   • BZoomIt presentation zoom utility
   • CBgInfo desktop info display tool
   • DPsPing network latency test tool
   ✓ Correct answer: A

   Sysinternals Process Monitor is a real-time system monitoring tool that displays file system, registry, network, and process/thread activity in a color-coded view. Procmon allows administrators to capture detailed traces of system calls, filter by process or path, and identify exactly which processes are accessing specific files or registry keys. The color-coded display (green for success, red for errors, yellow for other operations) makes patterns immediately visible. Procmon is invaluable for troubleshooting application failures, permission issues, missing files, and registry access problems that are difficult to diagnose through other means.

   Why the other options are wrong

   • BZoomIt only zooms and annotates the screen for presentations, not system activity.
   • CBgInfo writes system details onto the desktop background and monitors nothing.
   • DPsPing only measures TCP/ICMP latency and bandwidth, not file, registry, or process activity.
5. Question 5Migrate Servers and Workloads

   After migrating a domain-joined file server to Azure with Azure Migrate, users can reach the VM but Kerberos authentication to shares fails while NTLM works. What should you check first?

   • ADNS resolution and time synchronizationCorrect
   • BThe Azure Backup vault retention policy
   • CWhether the migrated VM has a public IP
   • DThe storage account redundancy tier setting
   ✓ Correct answer: A

   Kerberos authentication is highly dependent on time synchronization (clocks must be within 5 minutes) and correct DNS resolution to locate domain controllers. When NTLM works but Kerberos fails, the most common cause is either time drift between the migrated server and the domain controller or the server cannot resolve the domain controller's hostname. These issues are fundamental to Kerberos protocol operation and should be checked first before investigating other aspects.

   Why the other options are wrong

   • BThe Azure Backup retention policy is incorrect because backup policies do not affect authentication protocols.
   • CWhether the VM has a public IP is incorrect because public IPs do not affect Kerberos authentication to shares on the same network.
   • DThe storage account redundancy tier is incorrect because storage redundancy settings are unrelated to file server authentication.
6. Question 6Secure Windows Server

   An organization enables Windows Defender Credential Guard on its domain-joined Windows Server machines. Which underlying platform technology must be present and enabled for Credential Guard to isolate and protect domain credential secrets?

   • ABitLocker Network Unlock over a wired trusted PXE network
   • BVirtualization-based security (VBS) with Secure Boot enabledCorrect
   • CWindows Defender Firewall with Advanced Security rules
   • DRemote Credential Guard configured through Group Policy
   ✓ Correct answer: B

   Windows Defender Credential Guard uses virtualization-based security (VBS) to run an isolated version of the Local Security Authority (LSAIso) inside a hypervisor-protected container. Because secrets such as NTLM hashes and Kerberos ticket-granting-ticket keys live in this isolated memory space, even malware with administrative privileges on the host OS cannot read them, which mitigates pass-the-hash and pass-the-ticket attacks. VBS requires hardware virtualization extensions, UEFI Secure Boot, and is typically combined with IOMMU/TPM, so it must be present and enabled before Credential Guard can function.

   Why the other options are wrong

   • ANetwork Unlock only automates BitLocker disk unlock at boot and does not isolate credential secrets in memory.
   • CThe firewall filters network traffic and provides none of the in-memory isolation Credential Guard depends on.
   • DRemote Credential Guard protects credentials over RDP and is a separate feature, not a prerequisite for Credential Guard.
7. Question 7Implement Disaster RecoverySelect all that apply

   Woodgrove Bank uses Azure Site Recovery to protect Hyper-V VMs. During failover the tiers of a layered application must start in a strict sequence, with a manual approval step and a scripted post-startup task executed automatically. To further shrink data loss to seconds, the team also needs the most critical machines to fail over together to the exact same coordinated point in time. Which TWO should the administrator configure? (Choose two.)

   • AAzure Site Recovery vault for Hyper-V VMs
   • BRecovery plan with Azure Automation runbookCorrect
   • CRecovery time objective (RTO) targets
   • DMulti-VM consistency groupCorrect
   • ERecovery point objective (RPO) targets
   ✓ Correct answer: B, D

   A recovery plan with an integrated Azure Automation runbook lets the team order the tiers, insert a manual approval action, and run automation scripts during failover. A multi-VM consistency group produces coordinated, application-consistent recovery points across related VMs at short intervals so all tiers recover to the same point with minimal data loss. Together they meet the ordered-orchestration and low-data-loss requirements.

   Why the other options are wrong

   • AThe Recovery Services vault is the underlying service, not the ordering or coordination control.
   • CAn RTO is a downtime goal and does not sequence failover or coordinate recovery points.
   • EAn RPO expresses tolerable data loss and is not the mechanism that coordinates recovery points.
8. Question 8Monitor and Troubleshoot Windows ServerSelect all that apply

   You want a Windows Server 2022 file server to forecast future capacity locally using its built-in predictive analytics, without sending telemetry to Azure. Which TWO steps enable System Insights on the server? (Choose TWO)

   • AInstall the System-Insights Windows featureCorrect
   • BDeploy the Azure Monitor Agent to the server
   • CEnable the Data Deduplication role service
   • DConnect the server to a Log Analytics workspace
   • EEnable a forecasting capability and its scheduleCorrect
   ✓ Correct answer: A, E

   System Insights ships as an optional feature that you add with Install-WindowsFeature System-Insights (or Windows Admin Center). Once installed, each predictive capability is off until you enable it and set a run schedule with the Enable-InsightsCapability and Set-InsightsCapabilitySchedule cmdlets (or the Windows Admin Center extension). Its machine-learning models run entirely on the local server, so no Azure connection is needed.

   Why the other options are wrong

   • BThe Azure Monitor Agent forwards data to Azure; System Insights performs its forecasting locally and does not depend on AMA.
   • CData Deduplication reclaims disk space on a volume; it is unrelated to enabling predictive analytics.
   • DSystem Insights runs its models on-box, so a Log Analytics workspace connection is not required and the scenario explicitly avoids sending data to Azure.
9. Question 9Implement and Manage Windows Server High Availability

   A clustered generic application role flaps between nodes because its health check briefly fails during a long startup. You want the cluster to attempt local recovery on the same node before failing the role over. Which resource property should you increase?

   • AThe resource's RestartThreshold (max restarts)Correct
   • BThe cluster's QuorumArbitrationTimeMax setting
   • CThe CrossSubnetThreshold on the cluster network
   • DThe SameSubnetDelay heartbeat frequency setting
   ✓ Correct answer: A

   Each clustered resource has restart policy properties: RestartThreshold (max restarts) and RestartPeriod. When 'If restart is unsuccessful, fail over all resources' is set, exceeding the threshold triggers a node failover. Increasing the threshold (or period) allows more in-place restart attempts on the current node, avoiding unnecessary failover for a slow-starting app.

   Why the other options are wrong

   • BQuorumArbitrationTimeMax governs how long arbitration for quorum may take, not local resource restart behavior.
   • CCrossSubnetThreshold controls how many missed heartbeats across subnets mark a node down; it does not affect resource restart counts.
   • DSameSubnetDelay tunes heartbeat frequency between nodes on the same subnet, unrelated to a resource's restart policy.
10. Question 10Monitor and Troubleshoot Windows Server

    An Azure Windows VM stops responding and you cannot RDP to it. You want to interact with the OS boot loader and a command prompt over a text-based interface without network connectivity to the guest. Which Azure feature provides this?

    • AJust-in-Time VM access opening RDP on a schedule
    • BRun Command executing a custom PowerShell script
    • CAzure Bastion providing browser-based RDP access
    • DSerial Console (requires boot diagnostics enabled)Correct
    ✓ Correct answer: D

    The Serial Console connects to the VM's COM1 serial port through the Azure platform, requiring boot diagnostics (a storage account or managed boot diagnostics) but no guest network connectivity. It lets you reach SAC/cmd on Windows to troubleshoot a hung or unbootable VM. This is the go-to tool when normal remote access is unavailable.

    Why the other options are wrong

    • AJIT opens RDP or SSH ports temporarily but still depends on a working guest network stack for connectivity.
    • BRun Command relies on the guest agent, which is unavailable when the VM is hung or the agent is not running.
    • CBastion offers browser-based RDP/SSH but still requires the guest OS network and RDP service to be functional.

Who this AZ-801 practice exam is for

This practice set is for anyone preparing for the AZ-801: Configuring Windows Server Hybrid Advanced Services exam at the advanced level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AZ-801 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AZ-801 exam.

Related Microsoft resources

• AZ-801 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AZ-900 practice examRelated
• DP-300 practice examRelated
• DP-420 practice examRelated

AZ-801 practice exam FAQ