AZ-800 practice test

1. Question 1 · 1

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. You need to identify which server is the PDC emulator for the domain. Solution: From Active Directory Domains and Trusts, you right-click Active Directory Domains and Trusts in the console tree, and then select Operations Master. Does this meet the goal?

   Choose one answer.

   • Yes
   • No

2. Question 2 · 1

   Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The root domain contains the domain controllers shown in the following table. A failure of which domain controller will prevent you from creating application partitions?

   Choose one answer.

   

   • DC1
   • DC2
   • DC3
   • DC4
   • DC5

3. Question 3 · 1

   Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the objects shown in the following table. You plan to sync contoso.com with an Azure Active Directory (Azure AD) tenant by using Azure AD Connect. You need to ensure that all the objects can be used in Conditional Access policies. What should you do?

   Choose one answer.

   

   • Select the Configure Hybrid Azure AD join option.
   • Change the scope of Group1 and Group2 to Global.
   • Clear the Configure device writeback option.
   • Change the scope of Group2 to Universal.

4. Question 4 · 1

   Your network contains a multi-site Active Directory Domain Services (AD DS) forest. Each Active Directory site is connected by using manually configured site links and automatically generated connections. You need to minimize the convergence time for changes to Active Directory. What should you do?

   Choose one answer.

   • For each site link, modify the replication schedule.
   • For each site links, modify the site link costs.
   • Create a site link bridge that contains all the site links.
   • For each site link, modify the options attribute.

5. Question 5 · 1

   You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. You have several Windows 10 devices that are Azure AD hybrid-joined. You need to ensure that when users sign in to the devices, they can use Windows Hello for Business. Which optional feature should you select in Azure AD Connect?

   Choose one answer.

   • Device writeback
   • Group writebeack
   • Azure AD app and attribute filtering
   • Password writeback
   • Directory extension attribute sync

6. Question 6 · 1

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK. You open a new branch office that contains only client computers. You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1. Solution: You create an organization unit (OU) that contains the client computers in the branch office. You configure the Try Next Closest Site Group Policy Object (GPO) setting in a GPO that is linked to the new OU. Does this meet the goal?

   Choose one answer.

   • Yes
   • No

7. Question 7 · 1

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK. You open a new branch office that contains only client computers. You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1. Solution: You create a new site named Site4 and associate Site4 to DEFAULTSITELINK. Does this meet the goal?

   Choose one answer.

   • Yes
   • No

8. Question 8 · 1

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK. You open a new branch office that contains only client computers. You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1. Solution: You configure the Try Next Closest Site Group Policy Object (GPO) setting in a GPO that is linked to Site1. Does this meet the goal?

   Choose one answer.

   • Yes
   • No

9. Question 9 · 1

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. You need to identify which server is the PDC emulator for the domain. Solution: From Active Directory Sites and Services, you right-click Default-First-Site-Name in the console tree, and then select Properties. Does this meet the goal?

   Choose one answer.

   • Yes
   • No

10. Question 10 · 1

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. You need to identify which server is the PDC emulator for the domain. Solution: From a command prompt, you run netdom.exe query fsmo. Does this meet the goal?

    Choose one answer.

    • Yes
    • No

11. Question 11 · 1

    Your network contains a single-domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the servers shown in the following exhibit table. You plan to install a line-of-business (LOB) application on Server1. The application will install a custom Windows service. A new corporate security policy states that all custom Windows services must run under the context of a group managed service account (gMSA). You deploy a root key. You need to create, configure, and install the gMSA that will be used by the new application. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point

    Choose all answers that apply.

    

    • On Server1, run the setspn command.
    • On DC1, run the New-ADServiceAccount cmdlet.
    • On Server1, run the Install-ADServiceAccount cmdlet.
    • On Server1, run the Get-ADServiceAccount cmdlet.
    • On DC1, run the Set-ADComputer cmdlet.
    • On DC1, run the Install-ADServiceAccount cmdlet.

12. Question 12 · 1

    Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest root domain contains a server named server1.contoso.com. A two-way forest trust exists between the contoso.com forest and an AD DS forest named fabrikam.com. The fabrikam.com forest contains 10 child domains. You need to ensure that only the members of a group named fabrikam\Group1 can authenticate to server1.contoso.com. What should you do first?

    Choose one answer.

    • Add fabrikam\Group1 to the local Users group on server1.contoso.com.
    • Enable SID filtering for the trust.
    • Enable Selective authentication for the trust.
    • Change the trust to a one-way external trust.

13. Question 13 · 1

    Your network contains an Active Directory forest. The forest contains two domains named contoso.com and east.contoso.com and the servers shown in the following table. Contoso.com contains a user named User1. You add User1 to the built-in Backup Operators group in contoso.com. Which servers can User1 back up?

    Choose one answer.

    

    • DC1 only
    • Server1 only
    • DC1 and DC2 only
    • DC1 and Server1 only
    • DC1, DC2, Server1, and Server2

14. Question 14 · 1

    HOTSPOT - Your network contains an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com. You need to configure a password policy for the local user accounts on the Azure virtual machines joined to contoso.com. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    Choose an option for each prompt.

    

    Sign in by using a user account that is a member of the:

    • • AAD DC Administrators group
    • • Administrators group
    • • Domain Admins group

    Use a Group Policy Object (GPO) linked to the:

    • • AADDC Computers organizational unit (OU)
    • • AADDC Users organizational unit (OU)
    • • Computers container

15. Question 15 · 1

    You have an on premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. You plan to implement self-service password reset (SSPR) in Azure AD. You need to ensure that users that reset their passwords by using SSPR can use the new password resources in the AD DS domain. What should you do?

    Choose one answer.

    • Deploy the Azure AD Password Protection proxy service to the on premises network.
    • Run the Microsoft Azure Active Directory Connect wizard and select Password writeback.
    • Grant the Change password permission for the domain to the Azure AD Connect service account.
    • Grant the impersonate a client after authentication user right to the Azure AD Connect service account.

Paid access to all 184 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.