AZ-800 Practice Questions

For SMB over QUIC, the SMB server must run Windows Server 2022 Datacenter: Azure Edition or any edition of Windows Server 2025, so on Windows Server 2022 the Azure Edition is required. The QUIC tunnel uses TLS 1.3, so the server needs a certificate from a PKI such as AD CS or a trusted third-party CA, with subject alternative names that match the names clients use. The client must be a Windows 11 device. Joining an Active Directory domain is recommended but not required: a workgroup server can use local user accounts with NTLM. Neither Web Application Proxy nor Azure Arc management is a prerequisite.

For SMB over QUIC, the SMB server must run Windows Server 2022 Datacenter: Azure Edition or any edition of Windows Server 2025, so on Windows Server 2022 the Azure Edition is required. The QUIC tunnel uses TLS 1.3, so the server needs a certificate from a PKI such as AD CS or a trusted third-party CA, with subject alternative names that match the names clients use. The client must be a Windows 11 device. Joining an Active Directory domain is recommended but not required: a workgroup server can use local user accounts with NTLM. Neither Web Application Proxy nor Azure Arc management is a prerequisite.

For SMB over QUIC, the SMB server must run Windows Server 2022 Datacenter: Azure Edition or any edition of Windows Server 2025, so on Windows Server 2022 the Azure Edition is required. The QUIC tunnel uses TLS 1.3, so the server needs a certificate from a PKI such as AD CS or a trusted third-party CA, with subject alternative names that match the names clients use. The client must be a Windows 11 device. Joining an Active Directory domain is recommended but not required: a workgroup server can use local user accounts with NTLM. Neither Web Application Proxy nor Azure Arc management is a prerequisite.

In load balancing mode for DHCP failover, the client leases from a scope are distributed evenly between the two servers. The default configuration is a 50/50 split, meaning each server is responsible for handing out half of the available addresses.

Storage Replica is the correct feature for this scenario. It provides block-level, volume-based replication between servers or clusters for disaster recovery. It supports synchronous replication, which is suitable for low-latency networks and ensures zero data loss at the file-system level during a failure. The scenario describes a server-to-server replication setup where a manual failover can be initiated. DFS-R is file-level, Hyper-V Replica is VM-level, and S2D is a hyperconverged solution, not a simple replication feature.

To protect against a datacenter-level failure, you must use Availability Zones. An Availability Zone is a physically separate datacenter within an Azure region. By deploying the VM Scale Set across multiple zones (e.g., Zone 1, 2, and 3), you ensure that if one datacenter goes down, the instances in the other zones remain operational. An Availability Set only protects against hardware failures within a single datacenter (rack or server failure), not a full datacenter outage.

Switch Embedded Teaming (SET) is the recommended technology for teaming NICs in Hyper-V environments running Windows Server 2016 and later. It integrates teaming functionality directly into the Hyper-V Virtual Switch. This approach allows you to create an External switch bound to the SET, providing redundant, load-balanced connectivity for both the virtual machines and the management operating system.

This method, known as a staged RODC installation, is the most secure approach. A member of the Domain Admins group pre-creates the RODC account and specifies which user or group has the permission to attach a server to that account. This delegates the exact permission needed without granting excessive rights like Domain Admin membership. The branch administrator can then complete the installation without needing high-level domain credentials.

Microsoft Entra (Azure AD) Password Protection for AD DS uses two on-premises components. The DC agent (a password filter DLL plus the DC Agent service) must be installed on every domain controller, because the policy is enforced only on DCs that run it; it accepts or rejects each password change locally by using the most recently downloaded policy, which combines Microsoft's global banned password list with the tenant's custom banned password list and is cached in SYSVOL. The proxy service runs on a domain-joined member server and forwards the DC agents' policy download requests to Microsoft Entra ID, so domain controllers never need internet access and clear-text passwords never leave the DC. Password writeback, AD FS, and the Application Proxy connector aren't required.

Microsoft Entra (Azure AD) Password Protection for AD DS uses two on-premises components. The DC agent (a password filter DLL plus the DC Agent service) must be installed on every domain controller, because the policy is enforced only on DCs that run it; it accepts or rejects each password change locally by using the most recently downloaded policy, which combines Microsoft's global banned password list with the tenant's custom banned password list and is cached in SYSVOL. The proxy service runs on a domain-joined member server and forwards the DC agents' policy download requests to Microsoft Entra ID, so domain controllers never need internet access and clear-text passwords never leave the DC. Password writeback, AD FS, and the Application Proxy connector aren't required.

Production checkpoints use the Volume Shadow Copy Service (VSS) inside a Windows guest (File System Freeze on Linux) to create a data-consistent, application-consistent point-in-time image of the VM without capturing memory state, which is appropriate for production workloads and backup scenarios. Standard checkpoints capture the VM's disks together with its memory state, so applications are restored mid-operation; they're intended for development and test and aren't application-consistent. Production is the default checkpoint type (Set-VM -CheckpointType Production, ProductionOnly, Standard, or Disabled). 'Recovery' checkpoints are created internally by backup applications such as DPM rather than chosen by the administrator, and 'Application-Aware Checkpoint' isn't a Hyper-V checkpoint type.

For a performance-sensitive database workload that must survive two simultaneous drive failures, use a three-way mirror space. Microsoft recommends mirroring for all workloads and parity for sequential workloads such as archival. A three-way mirror keeps three copies of the data, tolerates two drive failures, and requires at least five physical disks (twelve are available). Mirror-accelerated parity combines mirror and parity in one ReFS volume, but in Windows Server it's supported only on Storage Spaces Direct and recommended only for archival and backup workloads. Dual parity also tolerates two failures but has much lower random-write performance, and a simple space has no resiliency.

The first step in troubleshooting a conditional forwarder is to verify network connectivity from the on-premises DNS server to the target resolver on the required port. The Test-NetConnection cmdlet is the correct tool for this. It will confirm whether the on-premises DNS server can reach the Azure DNS Private Resolver over port 53 (DNS). If this test fails, the issue is likely a firewall rule, a network security group (NSG) in Azure, or a routing problem over the VPN/ExpressRoute connection.