CertArea
All Microsoft exams

Free AZ-801 practice test: 30 questions with answers

30 original questions for Configuring Windows Server Hybrid Advanced Services, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

AZ-801 exam guide: topics, cost and format

All 30 AZ-801 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Secure Windows Server on-premises and hybrid infrastructures (6 questions)

  1. Question 1

    Which Windows feature stops unsigned or untrusted applications from running on a server by applying approved policy rules?

    1. ASmartScreen, which warns about downloaded files and websites but does not stop approved code from running on the server
    2. BWindows Defender Application Control, which allows only code that matches the approved policy rules to run
    3. CBitLocker, which encrypts disk volumes at rest and does not control which applications are allowed to run on the system
    4. DWindows Defender Firewall, which filters network traffic and does not control which code is allowed to execute on the server
    Show answer and explanation
    Correct answer: B

    Windows Defender Application Control enforces which code may run through policy. SmartScreen warns rather than blocks code, while BitLocker and the firewall protect data at rest and network traffic respectively.

  2. Question 2

    What does Windows Local Administrator Password Solution (Windows LAPS) do?

    1. AIt shares one local administrator password across all servers, so that administrators need to remember only one value for every machine
    2. BIt sets unique, randomly generated local administrator passwords on each machine, rotates them, and stores them in Entra ID or Active Directory
    3. CIt removes the local administrator account from every server, so that no local administrator can sign in to any of them at all
    4. DIt disables password complexity for local accounts, so that they are easier to type during support calls made by the helpdesk team
    Show answer and explanation
    Correct answer: B

    Windows LAPS gives each machine a unique, rotated local administrator password stored centrally. Shared passwords, removed accounts and weaker complexity each increase risk.

  3. Question 3

    Which Active Directory feature applies stronger protections to members of a privileged group?

    1. AThe Sites and Services console, which displays the physical topology of the network and does not restrict the rights of accounts
    2. BRead-only domain controllers, which hold a copy of the directory and do not change account restrictions for the members of groups
    3. CThe Protected Users group, which applies stronger protections such as blocking NTLM and cached credentials for its members
    4. DDynamic DNS registration, which updates host records and does not restrict the authentication methods used by privileged accounts
    Show answer and explanation
    Correct answer: C

    Protected Users applies stronger restrictions such as blocking NTLM and cached credentials. The other options do not change the authentication protections for privileged accounts.

  4. Question 4

    Which setting audits how much NTLM authentication is used in a domain, so that its use can be reduced over time?

    1. AThe NTLM auditing settings in Group Policy, which log NTLM use so that teams can plan its removal
    2. BThe Windows Admin Center storage dashboard, which shows disk capacity and does not audit the authentication protocols in use
    3. CThe Storage Migration Service, which moves files and shares and does not audit NTLM use in the domain at any point
    4. DAzure Backup reports, which show backup job status and do not audit the authentication protocols that the clients use
    Show answer and explanation
    Correct answer: A

    NTLM auditing policies log NTLM use so that the organisation can plan its reduction. Storage, migration and backup tools do not audit authentication protocols.

  5. Question 5

    Which Microsoft Defender for Identity component is installed on domain controllers to monitor identity traffic?

    1. AThe Azure Monitor agent, which collects performance counters and logs but does not analyse identity traffic in a specific way
    2. BThe Azure Site Recovery agent, which replicates virtual machines to another region and does not monitor identity traffic at all
    3. CThe Defender for Identity sensor, installed on domain controllers to observe identity traffic and detect threats
    4. DThe Windows Admin Center gateway, which manages servers through a browser and does not monitor identity traffic on the network
    Show answer and explanation
    Correct answer: C

    The Defender for Identity sensor runs on domain controllers and observes identity traffic. The other agents and gateways do not monitor identity traffic for threats.

  6. Question 6

    Which Windows feature configures memory and process mitigations such as control-flow guard for applications?

    1. AStorage Spaces, which pools disks into virtual volumes and does not configure any process mitigations for applications at all
    2. BBitLocker, which encrypts drives at rest and does not configure memory or process mitigations for the applications
    3. CExploit Protection, which configures mitigations such as control-flow guard for processes and applications
    4. DNetwork Load Balancing, which spreads traffic across servers and does not configure memory mitigations for the processes
    Show answer and explanation
    Correct answer: C

    Exploit Protection configures process mitigations such as control-flow guard. BitLocker, Storage Spaces and Network Load Balancing do other jobs.

Migrate servers and workloads (6 questions)

  1. Question 7

    Which tool transfers files, file shares and their security settings from an old server to a new one?

    1. AAzure Site Recovery, which replicates VMs for disaster recovery and does not transfer files and shares between servers
    2. BStorage Migration Service, which transfers files, shares and security settings and can cut over to the new server
    3. CWindows Server Backup, which creates backups on a local disk and does not migrate shares to a new server directly at all
    4. DDFS Replication, which keeps folders synchronised across servers but is not a complete migration tool for shares and their security
    Show answer and explanation
    Correct answer: B

    Storage Migration Service migrates files, shares and security settings and supports cut-over. Site Recovery, Windows Server Backup and DFS Replication do not complete that migration.

  2. Question 8

    Which tool discovers, assesses and migrates on-premises servers and workloads to Azure?

    1. AAzure Monitor, which collects metrics and does not discover or assess servers for migration to the cloud in any way
    2. BAzure Backup, which protects data with recovery points and does not discover or assess servers for migration to the cloud
    3. CAzure Migrate, which discovers, assesses and migrates servers, VMs and web apps to Azure
    4. DAzure Update Manager, which applies updates to machines and does not discover or assess them for migration to the cloud at all
    Show answer and explanation
    Correct answer: C

    Azure Migrate is the discovery, assessment and migration hub for servers and workloads. The other services serve backup, monitoring and update purposes.

  3. Question 9

    What is an in-place upgrade of a Windows Server?

    1. AReplacing every application on the server with a cloud service while the operating system itself stays unchanged throughout
    2. BMoving a server to a different datacentre without changing its operating system or any of its applications at all
    3. CDeleting the server and installing a new operating system on new hardware with no data kept from the old installation
    4. DUpgrading the operating system on the same hardware while keeping the existing roles, applications and settings
    Show answer and explanation
    Correct answer: D

    An in-place upgrade updates the OS on the same machine and keeps roles and settings. Moving datacentres, rebuilding and replacing applications are different approaches.

  4. Question 10

    Which server role needs its scopes, leases and options exported and imported carefully during a migration?

    1. AThe Print server role, which holds printer queues and drivers but does not store DHCP scopes or leases of any kind
    2. BThe DHCP server role, whose scopes, leases and options must be exported and imported during migration
    3. CThe Web server role, which hosts websites and does not store DHCP scopes or leases in any form on the server
    4. DThe Remote Access role, which provides VPN connections and does not store DHCP scopes or leases of its own at all
    Show answer and explanation
    Correct answer: B

    DHCP scopes, leases and options must move with the role to keep addressing working. Print, web and remote access roles do not hold DHCP scope data.

  5. Question 11

    Which approach moves an IIS workload to a managed platform without rewriting the application?

    1. AConverting the IIS site to a Windows service without assessment, which keeps it on a VM but removes IIS from the server entirely
    2. BMoving the IIS server to a physical server in a home office with no assessment and no change of platform at all
    3. CStopping the IIS website and leaving it offline during the migration, since the site will be re-created later by the team
    4. DAssessing the IIS workload with Azure Migrate, then migrating it to Azure Web Apps
    Show answer and explanation
    Correct answer: D

    Assessing with Azure Migrate, then migrating to Azure Web Apps, moves IIS workloads to a managed platform. The other options do not assess or move the workload appropriately.

  6. Question 12

    Which two actions are part of migrating an Active Directory forest to a newer version? (Choose two.)

    1. APreparing the schema and domain controllers for the newer version before adding them to the forest
    2. BDemoting all domain controllers at once before any replacement domain controller is in place, so that the forest stays small
    3. CMigrating objects such as users, groups and Group Policies with the AD Migration Tool
    4. DRemoving all DNS zones, so that clients rely only on hosts files during the forest upgrade period that follows the change
    5. EDisabling authentication on the forest, to avoid conflicts during the migration of accounts between the domain controllers
    Show answer and explanation
    Correct answer: A, C

    Schema and domain controller preparation, and object migration with the AD Migration Tool, are core steps. Demoting all controllers at once, removing DNS and disabling authentication each break the forest.

Implement and manage Windows Server high availability (6 questions)

  1. Question 13

    What is the purpose of a quorum in a Windows failover cluster?

    1. ATo assign IP addresses to the cluster nodes as they join the network through DHCP leases issued by the server
    2. BTo balance user logons across the cluster nodes, so that no single node is overloaded during the business hours each day
    3. CTo store the cluster's virtual machine images on shared storage for each node to read when it boots up after a restart
    4. DTo decide which set of nodes has enough votes to keep the cluster running, and to avoid split-brain conditions
    Show answer and explanation
    Correct answer: D

    Quorum determines which partition of nodes can continue, preventing split-brain. Logon balancing, image storage and address assignment are not quorum functions.

  2. Question 14

    Which witness type is recommended to break ties in a two-site cluster that uses Azure?

    1. AA cloud witness in an Azure storage account, which provides a tie-breaking vote for the cluster
    2. BA file share witness hosted in the same datacentre as one of the nodes, which is lost if that site fails
    3. CA disk witness on the same storage as the workload, which cannot break a tie if the storage at the site fails
    4. DNo witness at all, since two-site clusters never need a tie-breaking vote for the quorum to work correctly
    Show answer and explanation
    Correct answer: A

    A cloud witness in Azure gives a tie-breaking vote that survives a site failure. Witnesses located in the failing site or on failing storage cannot provide that vote.

  3. Question 15

    Which feature patches cluster nodes one at a time without downtime by draining workloads to other nodes?

    1. ACluster-Aware Updating, which drains and patches nodes one at a time while workloads move to other nodes
    2. BWindows Update for Business, which schedules updates on single machines but does not coordinate patching across a cluster
    3. CGroup Policy registry settings for update deferral, which delay updates but do not coordinate patching across the nodes
    4. DWindows Server Update Services, which distributes updates but does not drain workloads from the nodes that are being patched
    Show answer and explanation
    Correct answer: A

    Cluster-Aware Updating coordinates node patching while draining workloads, which avoids downtime. The other options distribute or defer updates without coordinating the cluster.

  4. Question 16

    Which storage technology pools local disks across servers to create resilient shared storage for a hyper-converged cluster?

    1. AUSB drives connected to each node, which cannot provide resilient shared storage for a cluster at any meaningful scale
    2. BAn iSCSI target with a single disk on one server, which is a single point of failure for the cluster's storage at all times
    3. CLocal NTFS volumes that are not shared between nodes, which cannot be accessed by the other nodes of the cluster at any point
    4. DStorage Spaces Direct, which pools local disks across cluster nodes into resilient shared storage
    Show answer and explanation
    Correct answer: D

    Storage Spaces Direct pools local disks into resilient shared storage for hyper-converged clusters. Single-disk targets, unshared volumes and USB drives do not provide that resilience.

  5. Question 17

    Which two statements about failover clustering are correct? (Choose two.)

    1. AWorkloads can fail over to another node automatically when a node becomes unavailable
    2. BEach cluster node needs its own separate Active Directory domain for cluster communication to work correctly
    3. CA stretch cluster can span datacentres, using replication to keep storage synchronised between the sites
    4. DCluster nodes must each run a different version of Windows Server to ensure that failover works correctly at all times
    5. EFailover clusters cannot use Azure as a witness and must always use an on-premises file share instead of a cloud witness
    Show answer and explanation
    Correct answer: A, C

    Automatic failover and stretch clusters with synchronised storage are core clustering capabilities. Separate domains per node, mixed versions and the ban on Azure witnesses are incorrect.

  6. Question 18

    Which cluster resource gives a clustered role a stable network name and IP address that clients can use?

    1. AA client access point, which is a network name and IP address resource that clients use to reach the clustered role
    2. BThe cluster shared volume, which holds the data files for workloads and does not provide a network name for clients at all
    3. CThe witness resource, which provides a tie-breaking vote and does not give clients a stable network name to connect to
    4. DThe heartbeat network adapter, which carries cluster communication and does not provide a name for clients to use in any way
    Show answer and explanation
    Correct answer: A

    A client access point gives the role a stable name and address for clients. Cluster shared volumes, witnesses and heartbeat adapters do other jobs.

Monitor and troubleshoot Windows Server environments (6 questions)

  1. Question 19

    Which tool shows performance counters and manages Data Collector Sets on a Windows server?

    1. AAzure Site Recovery, which replicates workloads and does not show performance counters of the server for the team
    2. BThe Windows Admin Center backup page, which manages backup jobs and does not show performance counters for the server
    3. CStorage Migration Service, which moves files and does not show performance counters at any point during its operation
    4. DPerformance Monitor, which shows performance counters and manages Data Collector Sets
    Show answer and explanation
    Correct answer: D

    Performance Monitor shows counters and manages Data Collector Sets. Backup, migration and replication tools do not show performance counters.

  2. Question 20

    Which Azure service collects performance and dependency data from Azure VMs using a monitoring agent?

    1. AAzure Backup, which protects VMs with recovery points and does not collect performance or dependency data at any point
    2. BVM Insights, which collects performance and dependency data from Azure VMs for analysis
    3. CAzure Migrate, which assesses workloads for migration and does not collect performance data continuously from the VMs
    4. DAzure Update Manager, which applies updates and does not collect performance or dependency data from the virtual machines
    Show answer and explanation
    Correct answer: B

    VM Insights collects performance and dependency data from Azure VMs. Backup, Migrate and Update Manager serve other purposes.

  3. Question 21

    Which event log stores audited security events such as successful and failed logons?

    1. AThe Setup event log, which records events from installation and updates and does not hold security audit events at all
    2. BThe Application event log, which records events from applications and does not hold the logon audit events of the system
    3. CThe Security event log, which records audited security events such as logon successes and failures
    4. DThe Forwarded Events log, which stores events forwarded from other computers and is not the local security log of the server
    Show answer and explanation
    Correct answer: C

    The Security log holds audited logon and security events. Application, Setup and Forwarded Events logs hold other kinds of events.

  4. Question 22

    Which command shows the status and time source of the Windows Time service on a domain member?

    1. Aw32tm /query /status, which shows the time source and synchronisation status of the Windows Time service
    2. Bipconfig /all, which shows network adapter settings and does not show the status of the Windows Time service on the machine
    3. Cnetstat -an, which lists open network connections and does not show the status of the time service on the machine at all
    4. Dchkdsk, which checks disk integrity and does not show the status of the Windows Time service on the server for the team
    Show answer and explanation
    Correct answer: A

    w32tm /query /status shows the Windows Time service's source and status. ipconfig, netstat and chkdsk do not show time-service status.

  5. Question 23

    Which feature analyses Windows Server system data to provide predictive capacity and performance insights?

    1. ADevice Manager, which lists hardware devices and drivers but does not analyse system data to provide predictive insights at all
    2. BThe Event Viewer custom views, which filter logs but do not analyse system data to provide predictive insights for capacity
    3. CSystem Insights, which analyses Windows Server system data and provides predictive capacity and performance insights
    4. DTask Scheduler, which runs tasks on a schedule and does not analyse system data or provide any predictive insights for capacity
    Show answer and explanation
    Correct answer: C

    System Insights analyses system data and provides predictive capacity and performance insights. Event Viewer, Device Manager and Task Scheduler do not perform that analysis.

  6. Question 24

    Which tool filters events from one or more logs using criteria such as level or event ID?

    1. AThe Storage Migration Service dashboard, which tracks migration progress and does not filter events across logs at any point
    2. BWindows Defender scans, which detect malware and do not filter events across the logs of the server at any point
    3. CWindows Admin Center's backup extension, which protects servers and does not filter events in the logs of the server
    4. DEvent Viewer custom views, which filter events from one or more logs by criteria such as level or event ID
    Show answer and explanation
    Correct answer: D

    Event Viewer custom views filter events by criteria across logs. The other tools do not filter events in that way.

Implement disaster recovery (6 questions)

  1. Question 25

    Which Azure service provides backup for Azure VMs, with recovery points stored in a vault?

    1. AAzure Backup with a Recovery Services vault, which stores recovery points for VMs and files
    2. BAzure Site Recovery alone, which replicates VMs for failover but is not the backup vault that holds VM recovery points
    3. CAzure Migrate, which assesses and migrates workloads and does not store backup recovery points for virtual machines
    4. DAzure Monitor, which collects metrics and logs and does not hold any backup recovery points for the virtual machines
    Show answer and explanation
    Correct answer: A

    Azure Backup with a Recovery Services vault stores VM recovery points. Site Recovery replicates for failover, and Migrate and Monitor serve other purposes.

  2. Question 26

    Which Azure Site Recovery component defines the order of failover actions across a group of VMs?

    1. AA replication policy, which sets the retention and frequency of replication but does not define the order of failover actions
    2. BA recovery plan, which defines the order of failover actions and the groups of VMs to recover
    3. CA network mapping, which maps the source network to the target network but does not define the order of VM failover
    4. DA Hyper-V replica, which copies one VM to a replica server but does not define the order of failover across many VMs
    Show answer and explanation
    Correct answer: B

    A recovery plan sequences failover across groups of VMs. Replication policies, network mappings and individual replicas each do a different job.

  3. Question 27

    Which Hyper-V feature keeps a replica of a VM on another host, replicating changes on a schedule?

    1. AHyper-V Replica, which replicates VM changes to a replica server asynchronously on a schedule
    2. BLive migration, which moves a running VM between hosts without keeping a replica of it on another host for failover
    3. CStorage Replica, which replicates volumes between sites and is not the Hyper-V feature for replicating individual VMs by name
    4. DFailover clustering, which fails over workloads within a cluster and does not keep an asynchronous replica of a VM elsewhere
    Show answer and explanation
    Correct answer: A

    Hyper-V Replica keeps asynchronous VM replicas on another host. Live migration, Storage Replica and failover clustering do different things.

  4. Question 28

    Which two statements about disaster recovery planning are correct? (Choose two.)

    1. AThe recovery time objective defines how quickly services must be restored after a disaster
    2. BThe recovery point objective defines how much data loss is acceptable, measured as the time since the last recovery point
    3. CBackups are unnecessary when replication is in place, since replicas always contain every change without any delay
    4. DFailover tests are unnecessary if backups succeed each night, since successful backups prove that recovery will work
    5. EThe recovery point and recovery time objectives are the same measure, so only one of them needs to be documented
    Show answer and explanation
    Correct answer: A, B

    RTO defines restore speed and RPO defines acceptable data loss. Replication does not replace backups, backup success does not prove recovery, and RTO and RPO are different measures.

  5. Question 29

    Which Azure Backup component backs up on-premises servers to a Recovery Services vault from a central server?

    1. AWindows Server Backup to a local folder, which does not send backups to the vault in Azure in any form at all
    2. BAzure Site Recovery alone, which replicates workloads for failover and does not back up on-premises servers to the vault
    3. CAzure Backup Server, which backs up on-premises workloads to a Recovery Services vault from a central server
    4. DAzure Migrate, which assesses and migrates workloads and does not back up on-premises servers to the vault at any point
    Show answer and explanation
    Correct answer: C

    Azure Backup Server protects on-premises workloads to a vault from a central server. Site Recovery replicates, Windows Server Backup stays local and Azure Migrate assesses.

  6. Question 30

    What does a replication policy in Azure Site Recovery control?

    1. AThe network mapping between source and target networks, which is configured separately from the replication policy
    2. BThe order in which VMs are failed over, which is set in the recovery plan rather than in the replication policy itself
    3. CThe frequency of recovery points, the retention of recovery points and the app-consistent snapshot interval
    4. DThe colour of the replication status tiles in the portal, which the operator chooses for the dashboard display only
    Show answer and explanation
    Correct answer: C

    A replication policy sets recovery point frequency, retention and app-consistent snapshot interval. Failover order, network mapping and dashboard colour are configured elsewhere.