Administering Windows Server Hybrid Core Infrastructure
576 Reviews
Exam Code
AZ-800
Exam Name
Administering Windows Server Hybrid Core Infrastructure
Questions
266 Questions Answers With Explanation
Update Date
July 16, 2026
Price
Was :
$81
Today :
$45
Was :
$99
Today :
$55
Was :
$117
Today :
$65
What Is the AZ-800 Certification Exam?
The AZ-800 certification exam is a standardized assessment designed to measure a candidate's knowledge, competencies, and practical understanding within a defined professional field. It serves as the primary requirement for earning the Microsoft Certified: Windows Server Hybrid Administrator Associate, a credential that represents a recognized level of proficiency in its respective industry. Depending on the field, this may involve theoretical knowledge, applied problem-solving, regulatory understanding, or hands-on procedural competence.
The exam is typically developed and maintained by an accrediting body or professional organization that sets the standards for the Microsoft Certified: Windows Server Hybrid Administrator Associate. This ensures that anyone who earns the credential has met a consistent benchmark, regardless of where they studied or gained their experience. For many professionals, the AZ-800 Certification Exam represents a formal checkpoint in their career, one that confirms readiness to take on greater responsibility within their chosen field.
Why the Microsoft Certified: Windows Server Hybrid Administrator Associate Certification Matters?
Certifications like the Microsoft Certified: Windows Server Hybrid Administrator Associate exist because industries need a reliable way to verify competence beyond a resume or a job title. Earning this credential signals to employers, clients, and colleagues that a professional has invested time in building a structured foundation of knowledge and has been evaluated against an established standard.
Beyond individual recognition, the Microsoft Certified: Windows Server Hybrid Administrator Associate certification often supports broader professional development. It can influence hiring decisions, contribute to internal advancement, or serve as a prerequisite for more specialized roles within the field. In many industries, certifications also help standardize expectations across organizations, making it easier for professionals to move between employers or sectors while carrying a credential that is widely understood and respected.
Who Should Take the AZ-800 Exam?
The AZ-800 exam is generally relevant to individuals who are either entering a field or looking to formalize skills they have already developed through experience. This can include early-career professionals seeking a credential to support their first steps into the industry, as well as experienced practitioners who want official recognition of knowledge gained on the job.
Students preparing to enter the workforce may also pursue the AZ-800 exam as a way to strengthen their qualifications before graduating or applying for their first roles. In some fields, employers actively encourage or require staff to pursue this certification as part of ongoing professional development, particularly in industries where standards, safety, or compliance play a significant role in daily responsibilities.
Knowledge and Skills Evaluated in the Administering Windows Server Hybrid Core Infrastructure
The Administering Windows Server Hybrid Core Infrastructure is built to evaluate both foundational knowledge and the practical judgment needed to apply that knowledge in real situations. Candidates are generally expected to understand core principles and terminology relevant to their field, along with the reasoning behind established procedures, standards, or best practices.
Depending on the industry, this may include understanding regulatory requirements, following established protocols, applying analytical or technical methods, or exercising sound judgment in situations that require careful decision-making. Rather than testing isolated facts in a vacuum, the Administering Windows Server Hybrid Core Infrastructure tends to reward candidates who can connect concepts to realistic scenarios, reflecting the kind of thinking expected in day-to-day professional practice.
AZ-800 Exam Preparation Resources
Preparing for the AZ-800 certification exam becomes more effective when using high-quality and up-to-date study materials. MyCertsHub provides resources designed to help candidates build knowledge, practice consistently, and become familiar with the actual exam format.
Effective preparation for the AZ-800 certification exam usually begins with a clear understanding of the exam's objectives and structure. Reviewing official guidelines or documentation published by the certifying body provides the most accurate picture of what will be covered and how heavily different areas are weighted.
From there, many candidates benefit from building a structured study plan that breaks preparation into manageable sections over a set period of time. A well-organized AZ-800 Study Guide can help sequence this material logically, especially for those approaching a topic for the first time. Consistent review, paired with realistic practice, tends to produce better retention than concentrated last-minute studying.
Practical experience, where applicable to the field, also plays an important role in preparation. Working through AZ-800 Practice Questions and a AZ-800 practice test can help candidates identify gaps in their understanding and become familiar with the format and pacing of the actual exam. In fields where hands-on skill is assessed, supplementing study with real-world practice or supervised experience often makes the difference between recognizing correct information and genuinely understanding it.
Benefits of Earning the Microsoft Certified: Windows Server Hybrid Administrator Associate Certification
Successfully earning the Microsoft Certified: Windows Server Hybrid Administrator Associate certification offers benefits that extend well beyond passing a single exam. It provides documented proof of competence that can be referenced on a resume, professional profile, or internal performance review, offering a clear, third-party validation of skill and knowledge.
The credential can also strengthen professional credibility when working with clients, patients, stakeholders, or colleagues who may not be positioned to evaluate technical or specialized knowledge directly. Over time, this recognition often contributes to expanded career opportunities, whether through new responsibilities, higher-level roles, or eligibility for additional certifications that build on this foundational credential.
Prepare for the AZ-800 Exam with MyCertsHub
Preparing for the AZ-800 exam is a process that benefits from organized, consistent effort rather than rushed, last-minute review. MyCertsHub is designed to support that process by offering study resources, practice materials, and educational content that help candidates understand what the Administering Windows Server Hybrid Core Infrastructure covers and how to approach their preparation thoughtfully.
Whether someone is just beginning to explore the Microsoft Certified: Windows Server Hybrid Administrator Associate or is in the final stages of reviewing material before their exam date, MyCertsHub aims to serve as a dependable resource throughout that journey. Every candidate's path to certification looks a little different, and the goal remains the same: to provide clear, genuinely useful information that supports real understanding of the subject matter.
Microsoft AZ-800 Sample Question Answers
Question # 1
Task 11
You need to ensure that all DHCP clients that get an IP address from SRV1 will be
configured to use DC1 as a DNS server.
Answer: See the solution of this Task below.
Explanation:
One possible solution to ensure that all DHCP clients that get an IP address from SRV1 will
be configured to use DC1 as a DNS server is to use the DHCP scope options. DHCP
scope options are settings that apply to all DHCP clients that obtain an IP address from a
specific scope. You can use the DHCP scope options to specify the DNS server IP
address, as well as other parameters such as the default gateway, the domain name, and
the DNS suffix. Here are the steps to configure the DHCP scope options on SRV1:
On SRV1, open DNS Manager from the Administrative Tools menu or by
typing dnsmgmt.msc in the Run box.
In the left pane, expand your DHCP server and click on IPv4.
In the right pane, right-click on the scope that you want to configure and
select Properties.
In the Scope Properties dialog box, click on the DNS tab.
Check the box Enable DNS dynamic updates according to the settings below. This
option allows the DHCP server to register and update the DNS records for the
DHCP clients.
Select the option Always dynamically update DNS records. This option ensures
that the DHCP server updates both the A and PTR records for the DHCP clients,
regardless of whether they request or support dynamic updates.
Check the box Discard A and PTR records when lease is deleted. This option
allows the DHCP server to delete the DNS records for the DHCP clients when their
leases expire or are released. Check the box Dynamically update DNS records for DHCP clients that do not
request updates. This option allows the DHCP server to update the DNS records
for the DHCP clients that do not support dynamic updates, such as legacy or nonWindows clients.
In the DNS servers section, click on the Add button to add a new DNS server IP
address.
In the Add Server dialog box, enter the IP address of DC1, which is the DNS
server that you want to use for the DHCP clients, and click Add.
Click OK to close the Add Server dialog box and return to the Scope
Properties dialog box.
Click OK to apply the changes and close the Scope Properties dialog box.
Now, all DHCP clients that get an IP address from SRV1 will be configured to use DC1 as
a DNS server. You can verify the DNS configuration by using the ipconfig /all command on
a DHCP client computer and checking the DNS Servers entry. You can also check the
DNS records for the DHCP clients by using the DNS Manager console on DC1.
Question # 2
Your network contains an Active Directory Domain Services (AD DS) forest. The forest
contains three domains. Each domain contains 10 domain controllers. You plan to store a DNS zone in a custom Active Directory partition.You need to create the Active Directory partition for the zone. The partition must replicate
to only four of the domain controllers.What should you use?
A. DNS Manager B. New-ADObjett C. dnscnd.exe D. Windows Admin Center
Answer: D
Question # 3
Task2
You need to ensure that the Azure file share named share1 can sync to on-premises
servers.
The required source files are located in a folder named \\dc1.contoso.com\install.
You do NOT need to specify the on-premises servers at this time.
Answer: See the solution of this Task below.
Explanation:
One possible solution to ensure that the Azure file share named share1 can sync to onpremises servers is to use Azure File Sync. Azure File Sync allows you to centralize your
file shares in Azure Files without giving up the flexibility, performance, and compatibility of
an on-premises file server. It does this by transforming your Windows Servers into a quick
cache of your Azure file share. You can use any protocol available on Windows Server to
access your data locally (including SMB, NFS, and FTPS) and you can have as many
caches as you need across the world1.
Here are the steps to configure Azure File Sync for the Azure file share named share1 and
the source files located in a folder named \dc1.contoso.com\install:
On the Azure portal, create a Storage Sync Service in the same region as your
storage account that contains the Azure file share named share1. For more
information on how to create a Storage Sync Service, see How to deploy Azure
File Sync.
On the on-premises server that hosts the folder named \dc1.contoso.com\install,
install the Azure File Sync agent. For more information on how to install the Azure
File Sync agent, see Install the Azure File Sync agent.
On the on-premises server, register the server with the Storage Sync Service that
you created in the first step. For more information on how to register a server with
a Storage Sync Service, see Register/unregister a server with Storage Sync
Service. On the Azure portal, create a sync group that defines the sync topology for a set of
files. In the sync group, select the Azure file share named share1 as the cloud
endpoint and the folder named \dc1.contoso.com\install as the server endpoint.
For more information on how to create a sync group, see Create a sync group and
a cloud endpoint and Create a server endpoint.
Wait for the initial sync to complete. You can monitor the sync progress on the
Azure portal or on the on-premises server. For more information on how to monitor
sync progress, see [Monitor sync progress].
Once the initial sync is complete, you can add more on-premises servers to the same sync
group to sync and cache the content locally. You can also enable cloud tiering to optimize
the storage space on the on-premises servers by tiering infrequently accessed or older files
to Azure Files.
Question # 4
Task 12
You need to create a Group Policy Object (GPO) named GPO1 that only applies to a group
named MemberServers.
Answer: See the solution of this Task below.
Explanation:
To create a GPO named GPO1 that only applies to a group named MemberServers, you
can follow these steps:
On a domain controller or a computer that has the Remote Server Administration
Tools (RSAT) installed, open Group Policy Management from the Administrative
Tools menu or by typing gpmc.msc in the Run box.
In the left pane, expand your domain and right-click on Group Policy Objects.
Select New to create a new GPO.
In the New GPO dialog box, enter GPO1 as the Name of the new GPO and
click OK. You can also optionally select a source GPO to copy the settings from.
Right-click on the new GPO and select Edit to open the Group Policy Management
Editor. Here, you can configure the settings that you want to apply to the group
under the Computer Configuration and User Configuration nodes. For more
information on how to edit a GPO, see Edit a Group Policy Object.
Close the Group Policy Management Editor and return to the Group Policy
Management console. Right-click on the new GPO and select Scope. Here, you
can specify the scope of management for the GPO, such as the links, security
filtering, and WMI filtering.
Under the Security Filtering section, click on Authenticated Users and then click
on Remove. This will remove the default permission granted to all authenticated
users and computers to apply the GPO.
Click on Add and then type the name of the group that you want to apply the GPO
to, such as MemberServers. Click OK to add the group to the security filter. You
can also click on Advanced to browse the list of groups available in the domain.
Optionally, you can also configure the WMI Filtering section to further filter the
GPO based on the Windows Management Instrumentation (WMI) queries. For
more information on how to use WMI filtering, see Filter the scope of a GPO by
using WMI filters.
To link the GPO to an organizational unit (OU) or a domain, right-click on the OU
or the domain in the left pane and select Link an Existing GPO. Select the GPO
that you created, such as GPO1, and click OK. You can also change the order of
preference by using the Move Up and Move Down buttons.
Wait for the changes to replicate to other domain controllers. You can also force
the update of the GPO by using the gpupdate /force command on the domain
controller or the client computers. For more information on how to update a GPO, see Update a Group Policy Object.
Now, you have created a GPO named GPO1 that only applies to a group named
MemberServers. You can verify the GPO application by using the gpresult /r command on
a member server and checking the Applied Group Policy Objects entry. You can also use
the Group Policy Results wizard in the Group Policy Management console to generate a
report of the GPO application for a specific computer or user. For more information on how
to use the Group Policy Results wizard, see Use the Group Policy Results Wizard.
Question # 5
You have an Azure virtual machine named VM1 that runs Windows Server. You perform
the following actions on VM1:• Create a folder named Folder1 on volume C• Create a folder named Folder2 on volume D.• Add a new data disk to VM1 and create a new volume that is assigned drive letter E.• Install an app named App1 on volume E.You plan to resize VM1.Which objects will present after you resize VM1?
A. Folded and Folder2 only B. Folder1, volume E, and App1 only C. Folder1 only D. Folded. Folder2. App1, and volume E
Answer: D
Question # 6
You have an Active Directory Domain Services (AD DS) domain. The domain contains
three servers named Server 1, Server2, and Server3 that run Windows Server.You sign in to Server1 by using a domain account and start a remote PowerShell session
to Server2. From the remote PowerShell session, you attempt to access a resource on
Server3. but access to the resource is denied.You need to ensure that your credentials are passed from Server1 to Server3. The solution
must minimize administrative effort. What should you do?
A. Configure Kerberos constrained delegation. B. Configure Just Enough Administration (JEA). C. Configure selective authentication for the domain. D. Disable the Enforce user logon restrictions policy setting for the domain.
Answer: A
Question # 7
Task 1
You need to prevent domain users from saving executable files in a share named
\\SRVl\Data. The users must be able to save other files to the share.
Answer: See the solution of this Task below.
Explanation:
One possible solution to prevent domain users from saving executable files in a share
named \SRVl\Data is to use file screening on the file server. File screening allows you to
block certain files from being saved based on their file name extension. Here are the steps
to configure file screening:
On the file server, open File Server Resource Manager from the Administrative
Tools menu.
In the left pane, expand File Screening Management and click on File Groups.
Right-click on File Groups and select Create File Group.
In the File Group Properties dialog box, enter a name for the file group, such
as Executable Files.
In the Files to include box, enter the file name extensions that you want to block,
such as .exe, .bat, .cmd, .com, .msi, .scr. You can use wildcards to specify multiple
extensions, such as *.exe.
Click OK to create the file group.
In the left pane, click on File Screen Templates.
Right-click on File Screen Templates and select Create File Screen Template.
In the File Screen Template Properties dialog box, enter a name for the template,
such as Block Executable Files.
On the Settings tab, select the option Active screening: Do not allow users to save
unauthorized files.
On the File Groups tab, check the box next to the file group that you created, such
as Executable Files.
On the Notification tab, you can configure how to notify users and administrators
when a file screening event occurs, such as sending an email, logging an event, or
running a command or script. You can also customize the message that users see
when they try to save a blocked file.
Click OK to create the file screen template.
In the left pane, click on File Screens.
Right-click on File Screens and select Create File Screen.
In the Create File Screen dialog box, enter the path of the folder that you want to
apply the file screening to, such as \SRVl\Data.
Select the option Derive properties from this file screen template
(recommended) and choose the template that you created, such as Block
Executable Files.
Click Create to create the file screen.
Now, domain users will not be able to save executable files in the share named
\SRVl\Data. They will be able to save other files to the share.
Question # 8
Task 8
You need to create an Active Directory Domain Services (AD DS) site named Site2 that is
associated to an IP address range of 192.168.2.0 to 192.168.2.255.
Answer: See the solution of this Task below.
Explanation:
To create an AD DS site named Site2 that is associated to an IP address range of
192.168.2.0 to 192.168.2.255, you can follow these steps:
On a domain controller or a computer that has the Remote Server Administration
Tools (RSAT) installed, open Active Directory Sites and Services from
the Administrative Tools menu or by typing dssite.msc in the Run box.
In the left pane, right-click on Sites and select New Site.
In the New Object - Site dialog box, enter Site2 as the Name of the new site.
Select a site link to associate the new site with, such as DEFAULTIPSITELINK,
and click OK. You can also create a new site link if you want to customize the
replication frequency and schedule between the sites. For more information on
how to create a site link, see Create a Site Link.
In the left pane, right-click on Subnets and select New Subnet.
In the New Object - Subnet dialog box, enter 192.168.2.0/24 as the Prefix of the
subnet. This notation represents the IP address range of 192.168.2.0 to
192.168.2.255 with a subnet mask of 255.255.255.0. Select Site2 as the Site
object to associate the subnet with, and click OK.
Wait for the changes to replicate to other domain controllers. You can verify the
site and subnet creation by checking the Sites and Subnets containers in Active
Directory Sites and Services.
Now, you have created an AD DS site named Site2 that is associated to an IP address
range of 192.168.2.0 to 192.168.2.255. You can add domain controllers to the new site and
configure the site links and site link bridges to optimize the replication topology.
Question # 9
Your network contains a DHCP server.You plan to add a new subnet and deploy Windows Server to the subnet.You need to use the server as a DHCP relay agent.Which role should you install on the server?
A. Network Policy and Access Services B. Remote Access C. Network Controller D. DHCP Server
Answer: B
Question # 10
Task 7
You need to monitor the security configuration of DC1 by using Microsoft Defender for
Cloud.
The required source files are located in a folder named \\dc1.contoso.com\install
Answer: See the solution of this Task below.
Explanation:
One possible solution to monitor the security configuration of DC1 by using Microsoft
Defender for Cloud is to use the Guest Configuration feature. Guest Configuration is a
service that audits settings inside Linux and Windows virtual machines (VMs) to assess
their compliance with your organization’s security policies. You can use Guest
Configuration to monitor the security baseline settings for Windows Server in the Microsoft
Defender for Cloud portal by following these steps:
On DC1, open a web browser and go to the folder named \dc1.contoso.com\install.
Download the Guest Configuration extension file (GuestConfiguration.msi) and
save it to a local folder, such as C:\Temp.
Run the Guest Configuration extension file and follow the installation wizard. You
can choose to install the extension for all users or only for the current user. For
more information on how to install the Guest Configuration extension, see Install
the Guest Configuration extension.
After the installation is complete, sign in to the Microsoft Defender for Cloud portal
(2).
In the left pane, select Security Center and then Recommendations.
In the recommendations list, find and select Vulnerabilities in security configuration
on your Windows machines should be remediated (powered by Guest
Configuration).
In the Remediate Security Configurations page, you can see the compliance status
of your Windows VMs, including DC1, based on the Azure Compute Benchmark.
The Azure Compute Benchmark is a set of rules that define the desired
configuration state of your VMs. You can also see the number of failed, passed,
and skipped rules for each VM. For more information on the Azure Compute
Benchmark, see Microsoft cloud security benchmark: Azure compute benchmark
is now available.
To view the details of the security configuration of DC1, click on the VM name and
then select View details. You can see the list of rules that apply to DC1 and their
compliance status. You can also see the severity, description, and remediation
steps for each rule. For example, you can see if DC1 has the latest security
updates installed, if the firewall is enabled, if the password policy is enforced, and
so on.
To monitor the security configuration of DC1 over time, you can use
the Compliance over time chart, which shows the trend of compliance status for
DC1 in the past 30 days. You can also use the Compliance breakdown chart, which shows the distribution of compliance status for DC1 by rule severity.
By using Guest Configuration, you can monitor the security configuration of DC1 by using
Microsoft Defender for Cloud and ensure that it meets your organization’s security
standards. You can also use Guest Configuration to monitor the security configuration of
other Windows and Linux VMs in your Azure environment.
Question # 11
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs
with a Microsoft Entra tenant.
You deploy an app that adds custom attributes to the domain.
From Azure Cloud Shell, you discover that you cannot query the custom attributes of users.
You need to ensure that the custom attributes are available in Microsoft Entra ID.
Which task should you perform from Microsoft Entra Connect first?
A. Refresh directory schema B. Configure device options C. Customize synchronization options D. Manage federation
Answer: C
Question # 12
You have a server that runs Windows Server and has the DHCP Server role installed. The
server has a scope named Scope! that has the following configurations: • Address range: 192.168.0.2 to 192.16B.1.2M . Mask 255.255.254.0• Router: 192.168.0.1• Lease duration: 3 days• DNS server 172.16.0.254
You have 50 Microsoft Teams Phone devices from the same vendor. All the devices have
MAC addresses within the same range.You need to ensure that all the Teams Phone devices that receive a lease from Scope1
have IP addresses in the range of 192.168.1.100 to 192.168.1.200. The solution must NOT
affect other DHCP clients that receive IP configurations from Scope1.
What should you create?
A. a policy B. a scope C. a fitter D. scope options
Task 5
You need to ensure that a DHCP scope named scope! on SRV1 can service client
requests.
Answer: See the solution of this Task below. Explanation:
One possible solution to ensure that a DHCP scope named scope1 on SRV1 can service
client requests is to activate the scope on the DHCP server. A scope must be activated
before it can assign IP addresses to DHCP clients. To activate a DHCP scope on SRV1,
perform the following steps:
On SRV1, open DNS Manager from the Administrative Tools menu or by
typing dnsmgmt.msc in the Run box.
In the left pane, expand your DHCP server and click on IPv4.
In the right pane, right-click on the scope that you want to activate, such
as scope1, and select Activate.
Wait for the scope to be activated. You can verify the activation status by checking
the icon next to the scope name. A green arrow indicates that the scope is active,
while a red arrow indicates that the scope is inactive.
Now, the DHCP scope named scope1 on SRV1 can service client requests and lease IP
addresses to DHCP clients. You can test the DHCP service by using the ipconfig
/renew command on a DHCP client computer that is connected to the same subnet as the
scope.
Question # 14
Task 3
You need to configure SRV1 as a DNS server. SRV1 must be able resolve names from the
contoso.com domain by using DC1. All other names must be resolved by using the root
hint servers
Answer: See the solution of this Task below. Explanation:
Directory, and replicate it as follows if you want to store and replicate the
conditional forwarder in AD DS. You can also select the replication scope from the
drop-down list.
Click OK to create the conditional forwarder.
Now, SRV1 will forward any queries for the contoso.com domain to DC1, and use the root
hint servers for any other queries. You can test the name resolution by using
the nslookup command on SRV1 or another computer that uses SRV1 as its DNS server.
For example, you can run the following commands:
nslookup www.contoso.com
nslookup www.microsoft.com
The first command should return the IP address of www.contoso.com from DC1, and the
second command should return the IP address of www.microsoft.com from a root hint
server. One possible solution to configure SRV1 as a DNS server that can resolve names from the
contoso.com domain by using DC1 and all other names by using the root hint servers is to
use conditional forwarding. Conditional forwarding allows a DNS server to forward queries
for a specific domain name to another DNS server, while using the normal forwarding or
root hint servers for other queries. Here are the steps to configure conditional forwarding on
SRV1:
On SRV1, open DNS Manager from the Administrative Tools menu or by
typing dnsmgmt.msc in the Run box.
In the left pane, right-click on Conditional Forwarders and select New Conditional
Forwarder.
In the New Conditional Forwarder dialog box, enter contoso.com as the DNS
Domain name.
In the IP addresses of the master servers box, enter the IP address of DC1, which
is the DNS server for the contoso.com domain. You can also click on Resolve to
verify the name resolution of DC1.
Optionally, you can check the box Store this conditional forwarder in Active Directory, and replicate it as follows if you want to store and replicate the
conditional forwarder in AD DS. You can also select the replication scope from the
drop-down list.
Click OK to create the conditional forwarder.
Now, SRV1 will forward any queries for the contoso.com domain to DC1, and use the root
hint servers for any other queries. You can test the name resolution by using
the nslookup command on SRV1 or another computer that uses SRV1 as its DNS server.
For example, you can run the following commands:
nslookup www.contoso.com
nslookup www.microsoft.com
The first command should return the IP address of www.contoso.com from DC1, and the
second command should return the IP address of www.microsoft.com from a root hint
server.
Question # 15
You have an on premises Active Directory Domain Services (AD DS) domain that syncs
with an Azure Active Directory (Azure AD) tenant. The domain contains two servers named
Server1 and Server2.A user named Admin1 is a member of the local Administrators group on Server1 and
Server2.You plan to manage Server1 and Server2 by using Azure Arc. Azure Arc objects will be
added to a resource group named RG1.You need to ensure that Admin1 can configure Server1 and Server2 to be managed by
using Azure Arc.
What should you do first?
A. From the Azure portal, generate a new onboarding script. B. Assign Admin1 the Azure Connected Machine Onboarding role for RG1. C. Hybrid Azure AD join Server1 and Server2. D. Create an Azure cloud-only account for Admin1.
You need to implement the planned changes for the Azure DNS Private Resolver.
Which private DNS zones can you use for name resolution?
A. Zone1.com only
B. Zone2.com only C. Zone1.com and Zone2.com only D. Zone2.com and Zone3.com only E. Zone1.com, Zone2.com, and Zone3.com
Answer: A
Question # 17
Your network contains an Active Directory Domain Services (AD DS) domain.
You have a Group Policy Object (GPO) named GPO1 that contains Group Policy
preferences.
You plan to link GPO1 to the domain.
You need to ensure that the preference in GPO1 apply only to domain member servers and
NOT to domain controllers or client computers. All the other Group Policy settings in GPO1
must apply to all the computers. The solution must minimize administrative effort.
Which type of item level targeting should you use?
A. Domain B. Operating System C. Security Group D. Environment Variable
You have an Azure virtual machine named VM1 that runs Windows Server.
You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You need to ensure that you can use the Azure Policy guest configuration feature to
manage VM1.
What should you do?
A. Add the PowerShell Desired State Configuration (DSC) extension to VM1. B. Configure VM1 to use a user-assigned managed identity. C. Configure VM1 to use a system-assigned managed identity. D. Add the Custom Script Extension to VM1.
You need to ensure that VM3 meets the technical requirements.What should you install first?
A. Enhanced Storage B. File Server Resource Manager (FSRM) C. Windows Standards-Based Storage Management D. the iSNS Server service
Answer: B
Question # 20
You need to ensure that access to storage1 for the Marketing OU users meets the
technical requirements.What should you implement?
A. Microsoft Entra Connect cloud sync B. Active Directory Federation Services (AD FS) C. Microsoft Entra Connect in staging mode D. Microsoft Entra Connect in active mode
Answer: A
Question # 21
You need to ensure that Automanage meets the technical requirements.On which Azure virtual machines should you enable Automanage?
A. Server1 only B. Server2 only C. Server1 and Server2 only D. Server2 and Server3 only E. Server1 and Server4 only
Answer: D
Question # 22
Note: This question is part of a series of questions that present the same scenario.
Each question in the series contains a unique solution that might meet the stated
goals. Some question sets might have more than one correct solution, while others
might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a
result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) forest. The forest
contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two
domain controllers. The sites are connected by using DEFAULTIPSITELINK.
You open a new branch office that contains only client computers.
You need to ensure that the client computers in the new office are primarily authenticated
by the domain controllers in Site1.
Solution: You create an organization unit (OU) that contains the client computers in the
branch office. You configure the Try Next Closest Site Group Policy Object (GPO) setting in
a GPO that is linked to the new OU.Does this meet the goal?
A. Yes B. No
Answer: B
Question # 23
You have a server named Server1 that runs Windows Server and contains two drives
named C and D. Server1 hosts multiple file shares.
You enable Data Deduplication on drive D and select the General purpose file server
workload.
You need to minimize the space consumed by files that were recently modified or deleted.
What should you do?
A. Run the set-dedupvolume cmdlet and configure the scrubbing job. B. Run the Set-DedupSchedule Cmdlet and configure a GarbageCollection job. C. Run the set-Dedupvoiume cmdlet and configure the InputOutputScale settings. D. Run the Set-DedupSchedule cmdlet and configure the optimization job.
Answer: B
Question # 24
You need to implement the planned changes for Microsoft Entra users to sign in to
Server1.Which PowerShell cmdlet should you run?
A. Add-ADComputerServiceAccount B. Set-AzVM C. Set-AzVMExtension D. New-ADComputer
Answer: C
Question # 25
Which two languages can you use for Task1? Each correct answer presents a complete
solution.NOTE: Each correct selection is worth one point.
A. Java B. Bicep C. JavaScript D. Python E. PowerShell
Answer: D,E
Feedback That Matters: Reviews of Our Microsoft AZ-800 Dumps
Caleb BrooksJul 18, 2026
I had no idea hybrid environments could be so challenging. MyCertsHub made the difference for me. I was able to connect the theory to the actual configurations I work with thanks to their scenario-based practice. This wasn’t just memorization – it was mindset training.
Cole WoodsJul 17, 2026
Studying for AZ-800 while juggling my job was rough, but the layout of MyCertsHub made it doable. I’d squeeze in 30 minutes during lunch using their mobile view. Passed last week and already prepping for AZ-801!
Kaiden PerkinsJul 17, 2026
Although I used a few different resources, MyCertsHub's content was the most pertinent. The best part? Not only did they give me scores, but their mock tests also taught me why certain answers were correct or incorrect. That depth was extremely helpful.
Joshua VoigtJul 16, 2026
Sincerely, a team project led me to AZ-800 by accident. I'm still learning, but the labs and walkthroughs here helped me understand the difference between hybrid and on-premises solutions. Felt like I was getting mentored, not just quizzed.
Hudson MitchellJul 16, 2026
Who Self-Taught There is no formal IT degree; all you need is hustle. MyCertsHub's guides broke things down without simplifying them, so they didn't assume I knew everything. The boost in self-assurance was real. Cleared the cert, now eyeing my next one.
Kevin HarrisJul 15, 2026
Along with my coursework, I used MyCertsHub, which filled in a lot of the gaps. Especially the PowerShell and identity questions – those weren’t covered in class. Although I still don't like DNS, at least now I understand it!
Fardeen MasterJul 15, 2026
For over a decade, I hadn't taken a certification exam. Thought I’d be rusty, but the structure on MyCertsHub helped me pace myself. No hype, just practical content. sounded like it was built by IT professionals.
Caleb Brooks
Joshua Voigt
Hudson Mitchell
Kevin Harris
Fardeen Master