AZ-801: Configuring Windows Server Hybrid Advanced Services Practice Exam

What the AZ-801 exam covers

• Secure Windows Server185 questions
• Implement and Manage Windows Server High Availability131 questions
• Implement Disaster Recovery106 questions
• Migrate Servers and Workloads146 questions
• Monitor and Troubleshoot Windows Server132 questions

Free AZ-801 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 700.

1. Question 1Secure Windows Server

   Which feature protects credentials by isolating LSA secrets using virtualization-based security?

   • AIIS
   • BDHCP
   • CDNS round-robin
   • DCredential GuardCorrect
   ✓ Correct answer: D

   Credential Guard uses virtualization-based security (VBS) to run a trustlet inside an isolated Hyper-V container, moving the secrets normally held by the Local Security Authority into memory that the running operating system cannot read. Because the derived credentials such as NTLM hashes and Kerberos ticket-granting tickets never sit in the standard LSASS process space, tools that scrape LSASS cannot harvest them. This directly defeats pass-the-hash and pass-the-ticket lateral movement even on a host where an attacker has already gained code execution.

   Why the other options are wrong

   • AIIS is a web server role for hosting HTTP applications and has no relationship to secret isolation or the Local Security Authority.
   • BDHCP automatically leases IP addresses to clients and operates entirely at the network configuration layer, so it offers no credential protection.
   • CDNS round-robin distributes client requests across multiple address records for crude load balancing and does nothing to secure or isolate credentials.
2. Question 2Secure Windows Server

   Which server benefits most from Just Enough Administration (JEA)?

   • AJMP01 - restrict admin actions after RDPCorrect
   • BAll equally
   • CWEB01 - restrict IIS management
   • DSQL01 - restrict SQL administration
   ✓ Correct answer: A

   Just Enough Administration constrains what a connected operator can do by exposing only a curated set of cmdlets and parameters through constrained PowerShell endpoints under a temporary virtual identity. A jump host is the natural place to enforce this because every administrator funnels through it to reach the rest of the estate, so capping the actions available there limits blast radius for the entire environment. JEA also removes the need to grant standing local administrator rights on that pivot point. The other servers can use JEA, but none consolidates administrative access the way the jump server does.

   Why the other options are wrong

   • BTreating all servers equally ignores that the jump host is the central access pivot, so it is not the strongest candidate for prioritizing JEA.
   • CWEB01 restricting IIS management is a valid use of JEA, but a single web server is a narrower target than the jump host through which all administration flows.
   • DSQL01 restricting SQL administration is also legitimate, yet database role-scoping is typically handled by SQL's own permissions, and it does not protect the central access path the way locking down the jump server does.
3. Question 3Secure Windows Server

   You are designing a tiered administration model. Where should Tier 0 assets such as domain controllers be administered from to best limit credential exposure?

   • AInternet-facing jump servers with cached domain credentials
   • BDedicated Privileged Access Workstations (PAWs) used only for Tier 0 tasksCorrect
   • CAny domain-joined user workstation with RDP enabled
   • DPersonal laptops with local admin rights
   ✓ Correct answer: B

   In a tiered administration model, Tier 0 assets such as domain controllers must be managed only from hardened, single-purpose Privileged Access Workstations. PAWs isolate privileged credentials from everyday activities like email and web browsing, ensuring domain controller administration never occurs from a system that could be compromised by malware or lateral movement, which directly limits credential exposure.

   Why the other options are wrong

   • AInternet-facing jump servers with cached domain credentials are incorrect because internet exposure makes them prime attack targets and caching domain credentials on them leaves high-value secrets recoverable by an attacker.
   • CAny domain-joined user workstation with RDP enabled is incorrect because ordinary user workstations are routinely exposed to lower-tier threats and malware, making them unsafe for Tier 0 administration.
   • DPersonal laptops with local admin rights are incorrect because personal, unmanaged devices fall outside organizational control and lack the hardening, monitoring, and isolation required for Tier 0 work.
4. Question 4Monitor and Troubleshoot Windows Server

   You need an alert that fires when a KQL query returns more than 5 matching rows over a 15-minute window. Which alert type should you create?

   • AA service health alert rule
   • BAn activity log alert rule
   • CA log search alert ruleCorrect
   • DA metric alert rule
   ✓ Correct answer: C

   A log search alert rule runs a Kusto query against a Log Analytics workspace on a schedule and evaluates the result against a threshold, which is exactly what is needed to alert on a row count returned by a query over a defined window. Because the condition is expressed as query logic rather than a single platform metric, only the log-based alert type can count matching rows. You configure the threshold as greater than five and the evaluation period as 15 minutes. The other alert types react to platform metrics, subscription activity, or service health and cannot evaluate arbitrary query output.

   Why the other options are wrong

   • AA service health alert rule reacts to Azure service incidents and maintenance notifications, not to the output of a custom KQL query.
   • BAn activity log alert rule fires on subscription-level management operations and cannot evaluate the row count of a log query.
   • DA metric alert rule monitors numeric platform metrics against a threshold and cannot run a KQL query or count matching rows.
5. Question 5Implement and Manage Windows Server High Availability

   A Storage Spaces Direct (S2D) cluster shows degraded virtual disks and reduced performance after one node was removed for hardware repair for several days. What is the correct expectation/action?

   • ALet repair jobs rebalance data once the node returnsCorrect
   • BDelete the entire storage pool and recreate it from scratch
   • CDisable the cluster network to speed up repair
   • DConvert the pool to a single-disk simple space
   ✓ Correct answer: A

   When a node is removed from a Storage Spaces Direct cluster for several days, the remaining nodes cannot repair data because the node is offline (it is a 3-way mirror scenario without quorum if more nodes are lost). Once the node returns and rejoins, storage repair jobs automatically detect missing capacity and begin rebalancing data across all nodes. If the failed node is permanently lost, new capacity must be added to restore full resiliency. This is expected behavior and does not require drastic action.

   Why the other options are wrong

   • BDelete the storage pool and recreate it from scratch is incorrect because data would be lost and this is unnecessary; the repair process is automatic.
   • CDisable the cluster network to speed up repair is incorrect because the cluster network is required for repair communication and resynchronization.
   • DConvert the pool to a single-disk simple space is incorrect because this removes data protection; resiliency is restored by allowing the automatic repair process to complete.
6. Question 6Secure Windows Server

   You must ensure that clients resolving records in your company's internal zone can cryptographically verify that the responses were produced by the authoritative server and were not altered in transit. Which Windows DNS feature should you deploy?

   • ADNS over HTTPS
   • BDNSSECCorrect
   • CCache locking
   • DSocket pool
   ✓ Correct answer: B

   DNSSEC signs zone records with private keys and lets validating resolvers verify the digital signatures against trust anchors, proving the data originated from the authoritative zone and was not tampered with. This provides origin authentication and integrity for DNS responses.

   Why the other options are wrong

   • ADNS over HTTPS encrypts the transport channel for confidentiality and cannot prove that the answer data itself is authentic or unaltered by the answering server.
   • CCache locking prevents cached entries from being overwritten before their TTL expires; it protects the resolver's cache but does not authenticate record data.
   • DThe socket pool randomizes outbound query source ports to resist spoofing, but it adds no cryptographic validation of the responses.
7. Question 7Implement and Manage Windows Server High Availability

   You deploy a SQL Server Always On availability group on a two-node Windows Server failover cluster with no shared storage. You require automatic failover between the primary and one secondary replica. What must be configured on that secondary replica?

   • AIt uses asynchronous commit
   • BIt is a read-scale replica
   • CIt shares the primary's storage
   • DIt is set to synchronous commitCorrect
   ✓ Correct answer: D

   Automatic failover in an availability group requires the primary and the target secondary to both be in synchronous-commit availability mode with failover mode set to Automatic. Synchronous commit guarantees the secondary is fully hardened before failover, so the cluster can promote it with no data loss.

   Why the other options are wrong

   • AAsynchronous-commit replicas support only forced manual failover, which risks data loss, not automatic failover.
   • BA read-scale availability group has no cluster and provides no automatic failover at all.
   • CAvailability group replicas each keep their own local storage; they do not share the primary's storage.
8. Question 8Migrate Servers and Workloads

   You are migrating a DHCP server from Windows Server 2012 R2 to Windows Server 2022 and must preserve all scopes, reservations, and active leases on the new server. Which method should you use?

   • AManually recreate each DHCP scope
   • BExport-DhcpServer then Import-DhcpServerCorrect
   • CInstall the DHCP role on the target only
   • DCopy dhcp.mdb with robocopy while running
   ✓ Correct answer: B

   The Export-DhcpServer and Import-DhcpServer PowerShell cmdlets move the full DHCP configuration, including scopes, reservations, options, and leases, to the new server in a supported way. This is the standard method for migrating a DHCP server.

   Why the other options are wrong

   • AManually recreating scopes is error prone and loses existing reservations and active leases.
   • CInstalling the role alone gives an empty configuration with no scopes or leases migrated.
   • DCopying the live Jet database file with robocopy while the service runs is unsupported and can corrupt the data.
9. Question 9Implement and Manage Windows Server High Availability

   You are performing a Cluster OS Rolling Upgrade to move a Hyper-V failover cluster from Windows Server 2019 to Windows Server 2022 without taking the workload offline. While the cluster contains a mix of 2019 and 2022 nodes, in what state does the cluster functional level operate?

   • AThe cluster runs at the higher 2022 functional level immediately after the first node is upgraded
   • BThe cluster runs at the lower 2019 functional level until you run Update-ClusterFunctionalLevelCorrect
   • CThe cluster is suspended and accepts no role failovers until all nodes are upgraded
   • DEach node independently runs at its own functional level with no cluster-wide level
   ✓ Correct answer: B

   Cluster OS Rolling Upgrade keeps the cluster operating at the functional level of the previous OS version while nodes run a mix of old and new operating systems, which lets you roll back to the older OS if needed. Only after every node is upgraded do you commit the change by running Update-ClusterFunctionalLevel, which is a one-way operation that enables new 2022 features.

   Why the other options are wrong

   • AThe level is intentionally held at the lower version during the mixed-mode window to preserve rollback, not raised after the first node.
   • CThe whole point of rolling upgrade is zero downtime; roles continue to fail over normally throughout the process.
   • DA failover cluster has a single cluster-wide functional level, not per-node levels.
10. Question 10Migrate Servers and Workloads

    You attempt an in-place upgrade of a domain controller from Windows Server 2016 to Windows Server 2022. Best practice for migrating Active Directory Domain Services to a new OS version recommends which approach instead of an in-place OS upgrade on the existing DC?

    • ARun dcpromo /forceremoval before upgrading the OS in place
    • BAdd a new Server 2022 DC, replicate AD, transfer FSMO, then demote the old DCCorrect
    • CExport the SYSVOL share and restore it on a freshly installed server
    • DDetach the NTDS.dit file and copy it to the new server's system volume
    ✓ Correct answer: B

    Microsoft's recommended practice for moving AD DS to a newer Windows Server version is to add a new domain controller running the new OS, allow normal multi-master replication to populate it, transfer the FSMO roles to it, and then gracefully demote the legacy DC. This avoids the risks of in-place OS upgrades on a DC and preserves directory integrity.

    Why the other options are wrong

    • Adcpromo /forceremoval forcibly removes AD without proper metadata cleanup and is a recovery action, not a migration method.
    • CManually copying SYSVOL does not migrate the directory database or roles and breaks replication consistency.
    • DDetaching and copying NTDS.dit between servers is unsupported and will corrupt the directory; AD is migrated via replication, not file copy.

Related Microsoft resources

• AZ-801 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

AZ-801 practice exam FAQ