CertArea
All Microsoft exams

Free AZ-800 practice test: 30 questions with answers

30 original questions for Administering Windows Server Hybrid Core Infrastructure, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

AZ-800 exam guide: topics, cost and format

All 30 AZ-800 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (6 questions)

  1. Question 1

    Which FSMO role exists only once in an entire Active Directory forest?

    1. AThe PDC emulator, which handles time synchronization and password change processing for the domain
    2. BThe schema master, which is the only domain controller that can make changes to the forest schema
    3. CThe RID master, which allocates pools of relative identifiers to domain controllers in the domain
    4. DThe infrastructure master, which updates references to objects in other domains of the forest
    Show answer and explanation
    Correct answer: B

    The schema master is a forest-wide role, held by a single domain controller, that is the only place schema changes can be made. The PDC emulator, RID master, and infrastructure master are domain-wide roles that exist once in each domain.

  2. Question 2

    What is the main purpose of a read-only domain controller (RODC)?

    1. ATo host a writable copy of the directory in the head office so that all changes are made at a single central location
    2. BTo replace the global catalog in every site of the forest so that searches across all domains are answered locally
    3. CTo hold a read-only copy of the directory in a branch site with limited physical security, with controlled credential caching
    4. DTo serve as the only domain controller that is allowed to run the DNS server role for the organization's internal zones
    Show answer and explanation
    Correct answer: C

    An RODC holds a read-only directory copy and can be placed in branch offices where physical security is weaker, with a password replication policy controlling which credentials it caches. The other options describe writable head-office copies, the global catalog, and DNS roles that an RODC does not provide.

  3. Question 3

    Which AD DS objects define the replication topology between domain controllers in different geographic locations?

    1. AAD DS sites and site links, which define the physical network locations and the schedule and cost of replication
    2. BSecurity groups, which control access to shared resources by assigning permissions to the members of the group
    3. CGlobal catalog servers, which hold a partial, searchable copy of the objects in every domain of the forest
    4. DOrganizational units, which group objects for the delegation of administration and the application of Group Policy
    Show answer and explanation
    Correct answer: A

    Sites represent network locations and site links define the cost and schedule of inter-site replication. Organizational units, security groups, and global catalog servers serve administration, access control, and searching rather than replication topology.

  4. Question 4

    Which account type is recommended for a service that runs on several servers and needs automatically managed passwords?

    1. AA shared domain administrator account, whose password is written in the operations manual so that every server can use it
    2. BA group managed service account (gMSA), whose password Active Directory rotates automatically for the services that use it
    3. CA local user account on each server, whose password is set once during installation and then never changed afterwards
    4. DA guest account in the domain, which has no password and grants limited access to the resources that the service needs
    Show answer and explanation
    Correct answer: B

    Group managed service accounts have passwords that Active Directory manages and rotates, and they can be used by services on multiple servers. Shared administrator accounts, static local accounts, and guest accounts each add risk or cannot meet the requirement.

  5. Question 5

    Which group provides additional protection for privileged accounts against certain credential caching and delegation weaknesses?

    1. AThe Domain Users group, which contains all standard user accounts in the domain and is applied to every employee
    2. BThe Guests group, which allows temporary access for visitors and contractors who need only limited access to a server
    3. CThe Protected Users group, whose members receive stronger protections such as restrictions on NTLM and credential caching
    4. DThe Print Operators group, which permits members to manage printers on the domain controllers of the organization
    Show answer and explanation
    Correct answer: C

    The Protected Users group applies stronger default protections to its members, including restrictions on NTLM and credential caching. Domain Users, Guests, and Print Operators do not provide that protection for privileged accounts.

  6. Question 6

    What does Microsoft Entra Connect Sync do in a hybrid identity environment?

    1. AIt replaces the on-premises domain controllers with cloud-hosted servers so that no local directory needs to be maintained
    2. BIt synchronizes users, groups, and selected attributes from on-premises AD DS to Microsoft Entra ID for cloud sign-in
    3. CIt monitors the performance of the file servers in each branch office and reports their storage usage to the cloud console
    4. DIt converts Windows Server licences into subscription licences that are billed monthly through the Azure billing account
    Show answer and explanation
    Correct answer: B

    Microsoft Entra Connect Sync copies identity information from on-premises AD DS to Microsoft Entra ID, which supports hybrid sign-in. It does not replace domain controllers, monitor file servers, or convert licences.

Manage storage and file services (6 questions)

  1. Question 7

    What does Data Deduplication do on a Windows Server volume?

    1. AIt copies every file on the volume to a second volume in the same server so that the data is protected against loss
    2. BIt reduces the storage that a volume uses by identifying and storing duplicate chunks of data only once
    3. CIt removes the file names from the volume so that the files can be accessed only by using their numeric identifiers
    4. DIt deletes the files that have not been opened for a year, which frees space for the newer data on the server
    Show answer and explanation
    Correct answer: B

    Data Deduplication removes duplicate chunks of data on a volume so that identical data is stored once, which saves space. Copying files, removing names, and deleting old files are not what deduplication does.

  2. Question 8

    What does a DFS namespace provide for shared folders?

    1. AA list of the printers installed on each server so that users can find the printer nearest to their desks in the office
    2. BA single logical path to shared folders that may be hosted on several file servers, which users reach by one name
    3. CA graphical view of the disk usage of each server so that the administrators can plan the purchase of new hardware
    4. DA record of the passwords used to open each shared folder, which is kept in an encrypted file for emergency recovery
    Show answer and explanation
    Correct answer: A

    A DFS namespace gives users one logical path to folders that may live on several servers. Printer lists, usage graphs, and password records are not DFS namespace functions.

  3. Question 9

    What does Storage Spaces provide in Windows Server?

    1. APooling of physical disks and the creation of virtual disks with resiliency options, such as mirroring or parity
    2. BA backup of the operating system to a cloud storage account, which is performed each night by a scheduled task
    3. CA monitor that displays the temperature of each disk in the server rack, with alerts sent to the operations team
    4. DA web interface for sending files to external partners by email, with a link that expires after a set period
    Show answer and explanation
    Correct answer: D

    Storage Spaces pools physical disks and creates virtual disks with resiliency such as mirroring or parity. Cloud backup, partner file sharing, and temperature monitoring are different services.

  4. Question 10

    What does a File Server Resource Manager (FSRM) quota do?

    1. AIt limits the amount of storage that a folder or volume can use and can send notifications when the limit is approached
    2. BIt sets the number of users who can open a file at the same time, so that the server does not run out of connections
    3. CIt fixes the minimum number of copies of each file that must exist on the server for the file to be considered protected
    4. DIt records the number of times each file has been opened by each user so that the activity can be billed to the department
    Show answer and explanation
    Correct answer: A

    An FSRM quota caps the storage a folder or volume can consume and can notify administrators or users as usage nears the limit. Connection limits, copy counts, and access billing are not quota functions.

  5. Question 11

    Which protocol allows SMB file sharing traffic to be carried over QUIC so that remote clients can reach file servers securely?

    1. ASimple Mail Transfer Protocol, which carries outgoing email messages from the server to the mail servers on the internet
    2. BSMB over NetBIOS, which runs the file sharing traffic over the older naming service that uses broadcast messages
    3. CRemote Desktop Protocol, which provides graphical remote sessions to users who sign in to the server remotely each day
    4. DSMB over QUIC, which tunnels SMB file traffic over the QUIC transport and requires certificate-based encryption
    Show answer and explanation
    Correct answer: A

    SMB over QUIC carries SMB traffic over QUIC with encryption, which lets remote clients reach file servers without a VPN. NetBIOS-based SMB, RDP, and SMTP are different protocols that do not carry SMB over QUIC.

  6. Question 12

    What does cloud tiering do in Azure File Sync?

    1. AIt keeps frequently used files on the local server and replaces less used files with stubs that point to the cloud share
    2. BIt moves every file to the cloud at the end of each week so that the local server holds no data after the weekly sync
    3. CIt assigns each file to a different Azure region based on the colour of the file icon shown in the file explorer window
    4. DIt converts Word documents into PDF files before they are uploaded to the cloud so that they take less space overall
    Show answer and explanation
    Correct answer: B

    Cloud tiering keeps hot data local and leaves cold files as stubs that fetch content from Azure Files on demand. Moving everything weekly, regional assignment by icon, and format conversion are not what tiering does.

Manage virtual machines and containers (6 questions)

  1. Question 13

    Which Hyper-V feature allows a virtual machine to use a physical graphics processor from the host through partitioning?

    1. AEnhanced session mode, which improves the redirection of the local display and devices during a remote session
    2. BShielded VMs, which protect the virtual machine's disks and memory from inspection by the administrators of the host
    3. CDynamic memory, which adjusts the memory assigned to a virtual machine based on the demand from its running workload
    4. DGPU partitioning, which shares a physical graphics processor among virtual machines by assigning partitions to them
    Show answer and explanation
    Correct answer: D

    GPU partitioning assigns parts of a physical graphics processor to virtual machines. Shielded VMs, dynamic memory, and enhanced session mode address security, memory, and remote session features.

  2. Question 14

    Which mechanism does a production checkpoint use to capture the state of a Hyper-V virtual machine?

    1. AThe network packets that the virtual machine sent during the day, which are replayed when the checkpoint is restored
    2. BA copy of the host's processor registers saved to a text file in the root directory of the physical server
    3. CThe guest operating system's backup service, such as Volume Shadow Copy, to create application-consistent state
    4. DA printout of the virtual machine's configuration file, which the administrator stores in the paper archive folder
    Show answer and explanation
    Correct answer: A

    Production checkpoints use the guest's backup service, such as VSS, to make application-consistent checkpoints. Processor register copies, replayed packets, and printouts do not describe how production checkpoints work.

  3. Question 15

    Which Hyper-V feature lets a virtual machine run its own hypervisor so that nested virtual machines can be created inside it?

    1. ANested virtualization, which exposes virtualization extensions to the guest so that it can host its own virtual machines
    2. BResource metering, which records the processor and memory consumption of each virtual machine for the reports
    3. CIntegration services, which provide the host with time synchronization and heartbeat signals from the guest machine
    4. DDiscrete device assignment, which passes a physical PCI device directly to a virtual machine for its exclusive use
    Show answer and explanation
    Correct answer: D

    Nested virtualization exposes the virtualization extensions to a guest so it can run its own hypervisor and virtual machines. Device assignment, integration services, and resource metering provide other capabilities.

  4. Question 16

    What is the purpose of a Windows Server container host?

    1. ATo run Windows containers on the server using its operating system kernel and a container runtime
    2. BTo store the operating system images used to install new physical servers in the data center from the network
    3. CTo act as the domain controller for every container in the environment, so that they can sign in with domain accounts
    4. DTo provide the printers and scanners that the container applications use for their output in the office network
    Show answer and explanation
    Correct answer: D

    A container host runs Windows containers using the host kernel and a container runtime. Image storage for installation, domain controller roles, and printing are separate functions.

  5. Question 17

    Which two statements about Hyper-V high availability are accurate? (Choose two.)

    1. AA failover cluster can restart virtual machines on another node automatically when the host they run on fails
    2. BLive migration moves a running virtual machine from one cluster node to another with little or no downtime
    3. CFailover clustering requires that every virtual machine in the cluster runs on the same node at all times
    4. DLive migration requires the virtual machine to be powered off first, so that its state can be copied safely
    5. EHyper-V replicas are available only on Windows client editions and cannot be used on servers in the data center
    Show answer and explanation
    Correct answer: A, B

    Failover clustering restarts virtual machines on surviving nodes and live migration moves running machines with minimal downtime. Single-node placement, powering off for migration, and client-only replicas are incorrect.

  6. Question 18

    Which protocol provides the session for enhanced session mode when a user connects to a Hyper-V virtual machine?

    1. ASimple Network Management Protocol, which reports the status and counters of network devices to a central monitor
    2. BRemote Desktop Protocol, which provides the graphical session and the device redirection used in enhanced sessions
    3. CNetwork Time Protocol, which synchronizes the clocks of the computers in the domain with a reliable time source
    4. DTrivial File Transfer Protocol, which copies small configuration files between servers without any authentication
    Show answer and explanation
    Correct answer: B

    Enhanced session mode uses Remote Desktop Protocol over the VM bus to provide the session and device redirection. SNMP, NTP, and TFTP serve monitoring, time, and file transfer rather than VM sessions.

Implement and manage an on-premises and hybrid networking infrastructure (6 questions)

  1. Question 19

    What does a DHCP scope define on a DHCP server?

    1. AThe schedule on which the server backs up its database to the storage device, which runs during the night each week
    2. BThe list of the printers that are available to the users on the subnet, together with the names of their drivers
    3. CThe password policy that applies to the user accounts that sign in to the computers on the subnet each working day
    4. DA pool of IP addresses and the options, such as the default gateway and DNS server, that are given to clients on a subnet
    Show answer and explanation
    Correct answer: D

    A DHCP scope is a pool of addresses and configuration options for a subnet. Printer lists, password policies, and backup schedules are not part of a scope.

  2. Question 20

    What does a DNS conditional forwarder do?

    1. AIt forwards queries for a specific domain name to a designated DNS server rather than to the default forwarders
    2. BIt replicates the entire DNS zone to every domain controller in the forest so that each server holds a full copy
    3. CIt blocks all queries from external clients so that the internal DNS zones cannot be seen by anyone on the internet
    4. DIt changes the IP address of each host record automatically whenever the host restarts during the maintenance window
    Show answer and explanation
    Correct answer: C

    A conditional forwarder sends queries for a particular domain to a specific DNS server, which is useful for partner or hybrid zones. Blocking all external queries, replicating zones everywhere, and changing host addresses on restart are not its function.

  3. Question 21

    What is the purpose of IP Address Management (IPAM) in Windows Server?

    1. ATo track and manage the IP address space, along with the DHCP and DNS configuration that relates to it, across the network
    2. BTo store the passwords of the network devices in a secure vault so that the administrators can retrieve them when needed
    3. CTo measure the internet bandwidth consumed by each user of the network during the working hours of the business each day
    4. DTo assign public IP addresses to the users' mobile phones so that the phones can reach the corporate network from anywhere
    Show answer and explanation
    Correct answer: B

    IPAM tracks address space and the DHCP and DNS data associated with it, which supports auditing and planning. Mobile addressing, bandwidth measurement, and password vaults are not IPAM functions.

  4. Question 22

    Which DNS security extension uses digital signatures so that resolvers can verify that DNS responses have not been forged?

    1. ADHCP reservations, which bind a fixed IP address to the hardware address of a specific device on the subnet
    2. BWeb Application Proxy, which publishes internal web applications to remote users through a reverse proxy server
    3. CDNS Security Extensions (DNSSEC), which sign DNS records so that resolvers can validate their authenticity
    4. DNetwork Policy Server, which evaluates connection requests against policies for VPN and wireless network access
    Show answer and explanation
    Correct answer: C

    DNSSEC signs DNS records so resolvers can validate that responses came from the zone owner and were not altered. DHCP reservations, Web Application Proxy, and Network Policy Server address other networking functions.

  5. Question 23

    Which two configurations help provide DHCP high availability? (Choose two.)

    1. ADHCP failover, configured in load balance or hot standby mode between two DHCP servers
    2. BSplit scopes, where each of two DHCP servers holds part of the address pool for the same subnet
    3. CA single DHCP server with a larger scope, so that one server holds every address for the whole site
    4. DTurning off the DHCP service during peak business hours so that the server has more resources to serve users
    5. EUsing static addresses for all clients only at night, so that the DHCP server can be maintained during that time
    Show answer and explanation
    Correct answer: A, B

    DHCP failover and split scopes spread the service across two servers so that clients keep getting addresses if one server fails. A single server with a larger scope, switching the service off at peak times, and night-only static addressing all remove resilience or disrupt service.

  6. Question 24

    What does Azure Private DNS Resolver provide in a hybrid network?

    1. ADNS query forwarding between Azure virtual networks and on-premises DNS servers, so names resolve in both directions
    2. BA public website that displays the domain names of the organization to customers who visit the company's home page
    3. CA cache of the web pages visited by the users of the network so that the pages load faster in the branch offices
    4. DA tool that assigns IP addresses to the mobile phones of the employees and removes them when they leave the company
    Show answer and explanation
    Correct answer: A

    Azure DNS Private Resolver forwards queries between Azure and on-premises DNS, enabling name resolution in both directions. A public website, web cache, and phone addressing do not describe it.

Manage Windows Servers and workloads in a hybrid environment (6 questions)

  1. Question 25

    Which browser-based tool provides a central interface for managing Windows Servers, including servers connected to Azure?

    1. AWindows Admin Center, which manages Windows Server through a browser and can connect to servers that are also in Azure
    2. BThe Windows Event Viewer, which displays the logs of a single server on the local machine and cannot be used remotely
    3. CThe Windows Media Player, which plays audio and video files on the client computer used by the administrator each day
    4. DThe Windows Mail application, which sends and receives email messages for the users who sign in to the workstation
    Show answer and explanation
    Correct answer: C

    Windows Admin Center is the browser-based management tool that also works with Azure-connected servers. Event Viewer is local, while Media Player and Mail are user applications unrelated to server management.

  2. Question 26

    What does Just Enough Administration (JEA) restrict in a PowerShell remoting session?

    1. AThe amount of memory that each user's PowerShell window can use while it runs scripts on the server for the team
    2. BThe number of minutes that a user can stay connected to the server during the working day before the connection is closed
    3. CThe commands and parameters that a remote user can run, so that users receive only the administrative tasks they need
    4. DThe colours used by the PowerShell console when it displays the output of the commands run by each administrator
    Show answer and explanation
    Correct answer: C

    JEA limits the commands and parameters available in a session, which enforces least privilege for administration. Session length, memory use, and console colours are not what JEA controls.

  3. Question 27

    Which two Azure services help manage Windows Servers that run on-premises or in other clouds? (Choose two.)

    1. AAzure Update Manager, which manages and schedules operating system updates across Azure and Arc-enabled servers
    2. BAzure Cosmos DB, which is a globally distributed database service that stores the documents of web applications
    3. CAzure Arc, which extends Azure management and governance to Windows Servers that run outside of Azure
    4. DAzure Front Door, which routes and accelerates web traffic to applications hosted in several regions of the cloud
    5. EAzure Event Grid, which routes events between services so that applications can react to changes in near real time
    Show answer and explanation
    Correct answer: A, C

    Azure Update Manager and Azure Arc manage servers outside Azure through Azure's management plane. Cosmos DB, Front Door, and Event Grid serve data, web traffic, and event routing rather than server management.

  4. Question 28

    Which deployment option allows Windows Admin Center to run as a gateway in Azure for managing servers remotely?

    1. AA local printer that prints the performance reports from Windows Admin Center for the operations team each morning
    2. BAn Azure Cosmos DB database that stores the configuration of each server so that the settings can be replicated
    3. CA Windows Admin Center gateway deployed as an Azure virtual machine that servers connect to through the network
    4. DAn Azure Front Door profile that caches the screenshots of each server so that they load faster in the browser
    Show answer and explanation
    Correct answer: C

    A Windows Admin Center gateway can run as an Azure virtual machine so that servers on-premises or in Azure can be managed through it. Cosmos DB, printers, and Front Door do not provide that gateway function.

  5. Question 29

    Which feature lets an administrator run PowerShell commands on a remote Windows Server by using WinRM?

    1. APowerShell remoting, which runs commands on remote computers over WinRM so that results return to the local session
    2. BThe Windows Media Player, which plays audio files stored in the shared music folder that the team uses for the office
    3. CThe Disk Cleanup utility, which removes temporary files from the system drive of the computer on which it is started
    4. DThe Print Management console, which lists and manages the printers that are connected to the servers in the environment
    Show answer and explanation
    Correct answer: C

    PowerShell remoting runs commands on remote computers over WinRM, which is how remote administration is done. Media playback, printer management, and disk cleanup are not remote command execution features.

  6. Question 30

    Which two actions are part of managing Windows Servers with Azure Automation for hybrid workloads? (Choose two.)

    1. ACreating runbooks that automate routine administrative tasks such as updates, restarts, or configuration checks
    2. BStoring the administrator passwords in plain text inside each runbook so that scripts can run without prompts
    3. CUsing a hybrid runbook worker to run runbooks against servers that are located on the premises of the organization
    4. DTurning off all automation job logs so that the runbook output does not fill the storage of the automation account
    5. EPrinting the runbook output every morning and filing it in the operations cabinet for the monthly review meeting
    Show answer and explanation
    Correct answer: A, C

    Runbooks automate administrative tasks, and hybrid runbook workers let them run against on-premises servers. Plain text passwords, disabled logs, and printed output each weaken security or the record of automation activity.