Azure AZ-800 Practice Test

AZ-800 practice test: what's covered

• Windows Server Hybrid Administrator Associate

Free AZ-800 sample questions

1. Your company runs Azure VMs that need Kerberos and LDAP authentication against the corporate AD identities without managing any domain controllers in Azure. Which service should you deploy?

   • A. Microsoft Entra Domain Services synchronized from the corporate Entra tenant
   • B. A single Microsoft Entra ID tenant with security defaults enabled
   • C. Azure Key Vault configured with managed HSM-backed certificates
   • D. Microsoft Entra ID Protection with conditional access policies
   Show answer

   Correct: A. Entra Domain Services provides a managed domain supporting Kerberos, NTLM, and LDAP without you patching or replicating domain controllers, so Azure VMs can domain-join and authenticate. Plain Entra ID is a cloud directory that does not offer Kerberos/LDAP, which is why it is incorrect. Key Vault stores secrets and Entra ID Protection handles risk-based access, so neither provides directory authentication for VMs.

2. A domain controller holding multiple FSMO roles has suffered an unrecoverable hardware failure and will never return to service. Which actions are appropriate to restore those roles? (Choose TWO)

   • A. Use ntdsutil to seize the orphaned FSMO roles onto a healthy domain controller
   • B. Perform a metadata cleanup to remove the failed DC from the directory
   • C. Run Move-ADDirectoryServerOperationMasterRole to gracefully transfer the roles
   • D. Power the failed server back on later and let it reclaim its roles automatically
   • E. Lower the forest functional level to release the operations master roles
   Show answer

   Correct: A and B. Seizing with ntdsutil (or Move-ADDirectoryServerOperationMasterRole -Force) assigns the roles to a healthy DC, and metadata cleanup removes the dead DC so it never tries to reclaim them. A graceful transfer requires the source DC online, so it is not possible here. A seized DC must never be brought back, and lowering the functional level does not move FSMO roles, so those options are incorrect.

3. A GPO linked at the domain sets a screen-lock timeout, but a conflicting GPO linked to the Sales OU sets a different value. By default, which setting applies to users in the Sales OU and why?

   • A. The Sales OU GPO wins because OU links are processed last in LSDOU order
   • B. The domain GPO wins because higher-level links always override child links
   • C. Both settings merge and the most restrictive timeout is enforced
   • D. Neither applies until Block Inheritance is enabled on the OU
   Show answer

   Correct: A. Group Policy processes Local, then Site, then Domain, then OU (LSDOU), and the last-applied setting wins, so the OU-linked GPO overrides the domain GPO by default. Higher links do not automatically override lower ones unless Enforced is set, so that option is wrong. Conflicting settings do not merge to the most restrictive value, and Block Inheritance stops higher GPOs rather than disabling all policy, making those incorrect.

4. You are deploying a domain controller to a small branch office where the server room cannot be physically secured. You want to limit the credentials exposed if the server is stolen. What should you deploy?

   • A. A read-only domain controller with a configured Password Replication Policy
   • B. A writable domain controller promoted using Install From Media
   • C. A member server running the Active Directory Web Services role
   • D. A global catalog server placed in the headquarters site
   Show answer

   Correct: A. An RODC holds a read-only copy of AD and, via the Password Replication Policy, caches only approved branch accounts, so theft exposes minimal credentials. A writable DC stores all password hashes and is the exact risk you are avoiding, so it is wrong. A member server with ADWS is not a domain controller, and placing a GC at headquarters does nothing for the branch, making both incorrect.

5. An administrator wants to apply Azure Policy, onboard to Microsoft Defender for Cloud, and run guest configuration against on-premises Windows Server machines that are not in Azure. What must be deployed on those servers first?

   • A. The Azure Connected Machine agent to onboard them as Azure Arc-enabled servers
   • B. The Azure Monitor Agent forwarding to a Log Analytics workspace only
   • C. The Microsoft Monitoring Agent connected to System Center Operations Manager
   • D. The Windows Admin Center gateway installed in service mode in Azure
   Show answer

   Correct: A. The Connected Machine agent projects each on-prem server into Azure Resource Manager as an Arc-enabled server, which is the prerequisite for Azure Policy, Defender for Cloud, and guest configuration. The Azure Monitor Agent only ships telemetry and does not create an Arc resource, so it is insufficient. The legacy MMA/SCOM agent and a WAC gateway provide monitoring or admin UI, not Arc projection, so both are incorrect.

Last updated: 2026-10-19

AZ-800 practice test FAQ

Related practice tests

• Azure AZ-801 practice test
• Azure AZ-104 practice test
• Azure AZ-140 practice test
• Microsoft MD-102 practice test
• Azure AZ-305 practice test
• Azure AZ-700 practice test