Azure AZ-801 Practice Test

AZ-801 practice test: what's covered

• Configuring Windows Server Hybrid Advanced Services

Free AZ-801 sample questions

1. An administrator must block a domain controller from running any executable that is not signed by the organization's code-signing certificate or a Microsoft-trusted publisher, enforcing kernel and user-mode code integrity. Which feature should be deployed?

   • A. Windows Defender Firewall outbound application blocking rules
   • B. AppLocker publisher rules scoped through a Group Policy Object
   • C. Windows Defender Application Control (WDAC) with a signer-based policy
   • D. Microsoft Defender Antivirus real-time protection in block mode
   Show answer

   Correct: C. WDAC enforces hardware-rooted code integrity for both kernel and user mode using signer, hash, or path rules, so only trusted publishers run. AppLocker is incorrect because it is a softer, easily bypassed user-mode allowlist and is not the recommended modern control. Firewall rules only govern network traffic, not code execution, whereas Defender Antivirus detects known malware but does not enforce an allowlist of trusted signers.

2. After a pass-the-hash incident, you must protect derived domain credentials cached in LSASS on Windows Server 2022 member servers. Which prerequisites or facts apply to enabling Windows Defender Credential Guard? (Choose TWO)

   • A. Virtualization-based security (VBS) with Secure Boot must be enabled
   • B. It isolates NTLM hashes and Kerberos TGTs in a VBS-protected container
   • C. It must be installed and configured on every domain controller first
   • D. It encrypts the contents of all NTFS volumes on the server at rest
   • E. It replaces the need to ever rotate or reset privileged account passwords
   Show answer

   Correct: A and B. Credential Guard depends on VBS and Secure Boot to run the isolated LSA process (LSAIso) that holds NTLM hashes and Kerberos tickets, defeating Mimikatz-style theft. It is not a domain controller feature because DCs cannot use it (they hold the credential store itself). It does not encrypt volumes at rest, which is BitLocker's job, and it does not eliminate password rotation hygiene, so those options are incorrect.

3. Your security baseline requires that the local Administrator password on hundreds of domain-joined Windows servers be unique per machine, rotated automatically, and recoverable by helpdesk staff through Active Directory. Which solution meets this requirement?

   • A. A scheduled task running a fixed net user password script
   • B. Windows Local Administrator Password Solution (Windows LAPS)
   • C. Group Policy Preferences storing the password in the GPO XML
   • D. Manually documenting each password in a shared spreadsheet
   Show answer

   Correct: B. Windows LAPS automatically randomizes and rotates each machine's local admin password, storing it in AD or Microsoft Entra ID with access-controlled retrieval. A fixed scripted password is incorrect because every machine shares the same secret. Group Policy Preferences passwords are deprecated and decryptable by any authenticated user, whereas a spreadsheet provides no rotation, no uniqueness, and no auditable recovery.

4. A junior operator needs to restart a specific service and view event logs on production servers but must never gain full administrator rights or run arbitrary cmdlets. Which Windows Server capability enforces this least-privilege boundary?

   • A. Adding the operator to the local Administrators group temporarily
   • B. Granting the operator Domain Admins membership during business hours
   • C. Sharing a privileged service account password through a vault
   • D. Just Enough Administration (JEA) with a constrained role capability file
   Show answer

   Correct: D. JEA exposes a constrained PowerShell endpoint where role capability files whitelist only specific cmdlets and parameters, running under a virtual account so the operator never holds standing admin rights. Adding to local Administrators grants full control and is incorrect. Domain Admins is far broader than needed, whereas sharing a privileged password defeats least privilege and accountability entirely.

5. You enable Microsoft Defender for Servers Plan 2 on Azure Arc-enabled Windows servers. Which capabilities does Plan 2 provide that Plan 1 does not? (Choose THREE)

   • A. Just-in-time VM access to reduce exposed management ports
   • B. File integrity monitoring of critical OS and application files
   • C. Agentless vulnerability assessment and security recommendations
   • D. The Microsoft Defender for Endpoint EDR sensor integration
   • E. Automatic deletion of all detected malware without any logging
   Show answer

   Correct: A and B and C. Plan 2 adds posture-management features such as just-in-time VM access, file integrity monitoring, and vulnerability assessment on top of the EDR sensor. The Defender for Endpoint integration is included in both Plan 1 and Plan 2, so it does not distinguish the tiers. Automatic silent deletion of malware with no logging is not a real product behavior, because all detections are recorded for investigation.

Last updated: 2026-10-19

AZ-801 practice test FAQ

Related practice tests

• Azure AZ-800 practice test
• Azure AZ-104 practice test
• Azure AZ-140 practice test
• Microsoft MD-102 practice test
• Azure AZ-305 practice test
• Azure AZ-700 practice test