Microsoft AZ-800 Actual Free Exam Questions & Community Discussion
Which groups can you add lo Group3 and Groups? To answer, select the appropriate options in the answer area. NOTE Each correct selection is worth one p oint.
Correct Answer:
Explanation:
In the Windows Server Hybrid Core Infrastructure objectives for Active Directory group design, group scope and type determine valid membership and usage. The study guidance for group scopes states that a Domain Local group is used to assign permissions in its own domain and "can contain accounts, computer objects, global groups from any domain, and universal groups; it can also contain other domain local groups from the same domain only." Security-type restrictions also apply: "Security groups can contain only security principals; distribution groups cannot be nested into security groups for access control." Applying these rules to Group3 (contoso.com Domain Local Security): it can accept security groups of compatible scopes. From the lists, Group1 (contoso.com Universal Security) and Group2 (contoso.com Global Security) are valid. Distribution groups (Group4, Group5, Group6) are not valid members of a security group used for authorization. Therefore, Group3 # Group1 and Group2 only.
For Group5 (canada.contoso.com Global Distribution), the scope rule for Global groups is: "Global groups can include user accounts and other global groups from the same domain only; they cannot include universal or domain local groups." Hence, the only eligible group from the same domain and scope is Group4 (canada.
contoso.com Global Distribution). Group6 is domain local (invalid), and cross-domain globals (Group2) are not permitted. Therefore, Group5 # Group4 only.
You have an Azure subscripti on. The subscription contains a virtual machine named VM1 that runs Windows Server.
You build an app named App1.
You need to configure continuous integration and continuous deployment (CI/CD) of App1 to VM1.
What should you create first?
You build an app named App1.
You need to configure continuous integration and continuous deployment (CI/CD) of App1 to VM1.
What should you create first?
Correct Answer: D
Vote an answer
Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com. The domain contains a file server named Server1 and three users named User1, User2, and User3.
Server1 contains a shared folder named Share1 that has the following configurations:
The share permissions for Share1 are configured as shown in the Share Permissions exhibit.
Share1 contains a file named File1.bxt. The share settings for File1.txt are configured as shown in the File Permissions exhibit.
For each of the following statements, select Yes if t he statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Server1 contains a shared folder named Share1 that has the following configurations:
The share permissions for Share1 are configured as shown in the Share Permissions exhibit.
Share1 contains a file named File1.bxt. The share settings for File1.txt are configured as shown in the File Permissions exhibit.
For each of the following statements, select Yes if t he statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
When User1 connects to \https://www.google.com/search?q=Server1.adatum.com\Share1, the user can take ownership of File1.txt. : Yes When User2 connects to \https://www.google.com/search?q=Server1.adatum.com\Share1, File1.txt is visible. : Yes When User3 connects to \https://www.google.com/search?q=Server1.adatum.com\Share1, File1.txt is visible. : No In Windows Server Hybrid environments, access to files over a network is governed by the intersection of Share Pe rmissions , NTFS (File) Permissions , and Access-Based Enumeration (ABE) .
* Ownership Rights : User1 has Full Control in the NTFS permissions for File1.txt. In Windows security, the Full Control right inherently includes the " Take Ownership " and " Change Permissions " rights. While the Share permission for " Domain Users " is set to Change , which normally restricts permission changes over the wire, a user with NTFS Full Control can still perform ownership operations if they have sufficient effective rights. T herefore, User1 can take ownership.
* File Visibility and ABE : The exhibit for Share1 shows that FolderEnumerationMode is set to AccessBased . Access-Based Enumeration (ABE) ensures that users only see the files and folders for which they have at least Read ( or equivalent) NTFS permissions.
* User2 : The NTFS permissions grant User2 Read access to File1.txt. Since User2 has read access, ABE will allow the file to be visible when the user browses the share.
* User3 : The NTFS permissions grant User3 Write access but not Read access. ABE specifically requires the " Read " permission for a file to be visible in a directory listing. Because User3 lacks the Read permission, File1.txt will be hidden from their view, even though they have Write rights to the underlying file.
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a user named User1 and the servers shown in the following table.
You need to ensure that User1 can manage only Scope1 and Scope3. What should you do?
You need to ensure that User1 can manage only Scope1 and Scope3. What should you do?
Correct Answer: D
Vote an answer
Explanation: Only visible for EduDump members. You can sign-up / login (it's free).
You have an on-premises server named Server1 tha t runs Windows Server. You have an Azure virtual network that contains an Azure virtual network gateway. You need to connect only Server1 to the Azure virtual network. What should you use?
Correct Answer: A
Vote an answer
Explanation: Only visible for EduDump members. You can sign-up / login (it's free).
You have an Azure subscription that contains the storage accounts shown in the following table.
In the West US Azure region, you create a storage sync service named SyncA.
You plan to create a sync group named GroupA.
What is the maximum number of cloud endpoints you can use with GroupA?
In the West US Azure region, you create a storage sync service named SyncA.
You plan to create a sync group named GroupA.
What is the maximum number of cloud endpoints you can use with GroupA?
Correct Answer: D
Vote an answer
Explanation: Only visible for EduDump members. You can sign-up / login (it's free).
You have two on-premises servers named Server1 and Servet2 that run Windows Server.
You have an Azure Storage account named storage1 that contains a file share named share ' . Server1 syncs with share1 by using Azure File Sync You need to configure Server2 to sync with share1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the lis t of actions to the answer area and arrange them in the correct order.
You have an Azure Storage account named storage1 that contains a file share named share ' . Server1 syncs with share1 by using Azure File Sync You need to configure Server2 to sync with share1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the lis t of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation:
In the Administering Windows Server Hybrid Core Infrastructure guidance for Azure File Sync, the workflow to onboard an additional Windows Server to an existing sync topology is explicit. Once a Storage Sync Service, sync group, and cloud endpoint (the Azure file share) already exist and are syncing with another server (Server1 in this case), you only need to prepare and join the new server (Server2) to that configuration.
The documented sequence is: (1) install the Azure File Sync agent on the Windows Server you want to add; (2) use the agent to register the server with the correct Storage Sync Service resource; and (3) in the existing sync group, add a server endpoint that points to the local path on the newly registered server. The materials emphasize that creating a new Storage Sync Service or adding another cloud endpoint is unnecessary when the Azure file share is already in the sync group. The "server endpoint" binds the on-premises path to the already defined cloud endpoint in the sync group, enabling bi-directional sync. Therefore, the correct order is:
Install agent on Server2 # Register Server2 with the Storage Sync Service # Add a server endpoint to the sync group.
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains two domains named contoso.com and east.contoso.com. Contoso.com contains two users named CONTOSO
\User1 and EAST\User2.
You need to ensure that the users can perform the following tasks:
* User1 must deploy an additional domain controller to eastcontoso.com.
* User2 must deploy a new domain controller that will host a domain named west.contoso.com.
The solution must follow the principle of least privilege.
To which group should you add each user? To an swer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
\User1 and EAST\User2.
You need to ensure that the users can perform the following tasks:
* User1 must deploy an additional domain controller to eastcontoso.com.
* User2 must deploy a new domain controller that will host a domain named west.contoso.com.
The solution must follow the principle of least privilege.
To which group should you add each user? To an swer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
The Administering Windows Server Hybrid Core Infrastructure guidance for AD DS promotion and forest operations states that adding a new domain controller to an existing domain requires credentials that " are a member of Domain Admins in the target domain (o r equivalent delegated rights) ." This is the minimum built-in role permitted to run AD DS installation and write to the domain's configuration containers for DC promotion. Therefore, to add an additional DC in east.contoso.com , the least-privilege group fo r User1 is EAST\Domain Admins .
For creating a new domain (child domain or new tree) in an existing forest, the exam materials specify that this is a forest-wide operation handled by the Domain Naming Master and requires enterprise-level permissions: " to cr eate or remove domains in a forest, you must use an account that is a member of the Enterprise Admins group ." Domain Admins in a single domain are insufficient because the task modifies forest-level naming contexts. Thus, to deploy the first DC for west.co ntoso.com , the least-privilege role that satisfies the requirement for User2 is CONTOSO\Enterprise Admins .
These selections follow the principle of least privilege: User1 is scoped to the child domain's administration only, while User2 receives the forest- level rights necessary to add a new domain.
Your network contains a multi-site Active Directory Domain Services (AD DS) forest. Each Active Dir ectory site is connected by using manually configured site links and automatically generated connections.
You need to minimize the convergence time for changes to Active Directory.
What should you do?
You need to minimize the convergence time for changes to Active Directory.
What should you do?
Correct Answer: B
Vote an answer
Explanation: Only visible for EduDump members. You can sign-up / login (it's free).
Your on-premises network contains a single-domain Active Directory Domain Services (AD DS) forest. You have an Azure AD tenant named contoso.com. The AD DS forest syncs with the Azure AD tenant by using Azure AD Connect.
You need to ensure that users in the forest that have a custom attribute of NoSync are excluded from synchronization.
How should you configure the Azure AD Connect cloudFiltered attribute, a nd which tool should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You need to ensure that users in the forest that have a custom attribute of NoSync are excluded from synchronization.
How should you configure the Azure AD Connect cloudFiltered attribute, a nd which tool should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
In Azure AD Connect-based hybrid identity, object filtering can be enforced with the built-in cloudFiltered metaverse flag. The Administering Windows Server Hybrid Core Infrastructure materials explain that
"cloudFiltered is a Boolean in the metaverse that determines whether an object is eligible for export to Azure AD; when set to True, the connector space object is ex cluded from synchronization to Azure AD." The recommended approach for attribute-based fil tering is to create a custom inbound synchronization rule that scopes the users you want to exclude and flows a constant value of True into cloudFiltered . The guide states: "Use the Synchronization Rules Editor to define an inbound rule from Active Directory to the metaverse. Add a scoping filter (for example, a custom attribute equals 'NoSync') and configure an attribute flow mapping cloudFiltered # Constant(True). Objects matching the scope will not be exported." Because you need to exclude any user whose custom attribute eq uals NoSync , you create an inbound rule targeting user objects, add the scoping filter on that custom attribute, and then set cloudFiltered = True (constant). This is done with the Synchronization Rules Editor , not ADSI Edit or the Azure AD Connect wizard, since the wizard doesn't author custom attribute flows and ADSI Edit doesn't manage sync rules.
Which two languages can you use for Task1? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
NOTE: Each correct selection is worth one point.
Correct Answer: B,C
Vote an answer
Explanation: Only visible for EduDump members. You can sign-up / login (it's free).
You have an Azure subscription named sub1 and 500 on-premises virtual machines that run Windows Server.
You plan to onboard the on-premises virtual machines to Azure Arc by running the Az ure Arc deployment script You need to create an identity that mil be used by the script to authenticate access to sub1. The solution must use the principle of least privilege.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You plan to onboard the on-premises virtual machines to Azure Arc by running the Az ure Arc deployment script You need to create an identity that mil be used by the script to authenticate access to sub1. The solution must use the principle of least privilege.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Reference:
In the Administering Windows Serve r Hybrid Core Infrastructure objectives for managing Azure Arc- enabled servers, Microsoft specifies that onboarding non-Azure machines with the scripted onboarding method requires an Azure AD application/service principal with the least-privileged built-in role expressly created for Arc onboarding. The study guide states that: "For scripted onboarding at scale, create an Azure AD service principal and assign the Azure Connected Machine Onboarding role at the required scope (subscription or resource group). This role grants only the permissions necessary for the connect operation and agent registration; it does not confer general virtual machine management rights." The PowerShell guidance in the same module explains that a service principal can be created and granted a role in one step using New-AzADServicePrincipal , providing a display name and a role assignment: "Use New-AzADServicePrincipal with the -DisplayName parameter to create the application identity and the -Role (and optionally -Scope ) parameters to assign the built-in role needed for onboarding." It also contrasts other cmdlets: " New-AzADAppCredential updates credentials for an existing application only; New- AzUserAssignedIdentity creates a managed identity resource and is not used for Arc scripted onboarding." Because the question asks for an identity used by the Azure Arc deployment script and to follow the principle of least privilege, the correct command is to create a service principal and assign the minimal role: New- AzADServicePrincipal -Displ ayName ' arc-for-servers ' -Role ' Azure Connected Machine Onboarding
' . Other roles such as Virtual Machine Contributor or Virtual Machine User Login exceed what Arc onboarding requires and therefore violate least-privilege guidance.
0
0
0
10