📘 Free AZ-800 Sample Questions
This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. You need to identify which server is the PDC emulator for the domain.
Solution: From Active Directory Domains and Trusts, you right-click Active Directory Domains and Trusts in the console tree, and then select Operations
Master.
Does this meet the goal?
A
Yes
B
no
Correct Answer:
B. no
Explanation:
B Correct:
Open AD User and Account
Right click and select Operation Master
This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. You need to identify which server is the PDC emulator for the domain.
Solution: From a command prompt, you run netdom.exe query fsmo. Does this meet the goal?
A
yes
B
no
Correct Answer:
A. yes
Explanation:
Correct answer .Netdom.exe, c:\windows\system32. You can use "netdom" or "netdom.exe", and the "query FSMO" will list all FSMO roles, including which server is the PDC.
https://activedirectorypro.com/how-to-check-fsmo-roles/
You have an on premises Active Directory Domain Services (AD DS) domain that syncs with an Azure ActiveDirectory (Azure AD) tenant.
You plan to implement self-service password reset (SSPR) in Azure AD.
You need to ensure that users that reset their passwords by using SSPR can use the new password resources in the AD DS domain.
What should you do?
A
Deploy the Azure AD Password Protection proxy service to the on premises network.
B
Run the Microsoft Azure Active Directory Connect wizard and select Password writeback.
C
Grant the Change password permission for the domain to the Azure AD Connect service account.
D
Grant the impersonate a client after authentication user right to the Azure AD Connect service account
Correct Answer:
B. Run the Microsoft Azure Active Directory Connect wizard and select Password writeback.
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback
You have an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.
You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least privilege.
To which group should you add the administrator?
A
AAD DC Administrators
B
Domain Admins
C
Schema Admins
D
Enterprise Admins
E
Group Policy Creator Owners
Correct Answer:
A. AAD DC Administrators
Explanation:
Settings for user and computer objects in Azure Active Directory Domain Services (Azure AD DS) are often managed using Group Policy Objects (GPOs). Azure AD DS includes built-in GPOs for the AADDC Users and AADDC Computers containers. You can customize these built-in GPOs to configure Group Policy as needed for your environment. ANSWER (A): Members of the Azure AD DC administrators group have "Group Policy administration privileges in the Azure AD DS domain, and can also create custom GPOs and organizational units (OUs). "https://docs.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy
Azure AD DS not AD DS. Azure AD DS doesn't even have enterprise admins.
DRAG DROP -
You create a new Azure subscription.
You plan to deploy Azure Active Directory Domain Services (Azure AD DS) and Azure virtual machines.
You need to ensure that the virtual machines can join to Azure AD DS.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
A
Correct Answer:
A.
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance
HOTSPOT -
You have an Azure Active Directory Domain Services (Azure AD DS) domain. You create a new user named Admin1.
You need Admin1 to deploy custom Group Policy settings to all the computers in the domain. The solution must use the principle of least privilege.
What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point
Hot Area:
A
Correct Answer:
A.
Explanation:
AAD DC Administrators
Modifying AADDC Computers GPO
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/create-ou
DRAG DROP -
Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site.
You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local
Administrators group on Server1.
You need to recommend a deployment plan that meets the following requirements:
Ensures that a user named User1 can perform the RODC installation on Server1
✑ Ensures that you can control the AD DS replication schedule to the Server1
✑ Ensures that Server1 is in a new site named RemoteSite1 Uses the principle of least privilege
Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
A
Correct Answer:
A.
Explanation:
Box 1.
We need to create a site and subnet for the remote site. The new site will be added to the Default IP Site Link so we don't need to create a new site link. You configure the replication schedule on the site link.
Box 2.
When we pre-create an RODC account, we can specify who is allowed to attach the server to the prestaged account. This means that the User1 does not need to be added to the Domain Admins group.
Box3.
User1 can connect the RODC to the prestaged account by running the AD DS installation wizard.
Your network contains an Active Directory Domain Services (AD DS) domain. The network also contains 20 domain controllers, 100 member servers, and 100 client computers.
You have a Group Policy Object (GPO) named GPO1 that contains Group Policy preferences. You plan to link GPO1 to the domain.
You need to ensure that the preference in GPO1 apply only to domain member servers and NOT to domain controllers or client computers. All the other Group
Policy settings in GPO1 must apply to all the computers. The solution must minimize administrative effort.Which type of item level targeting should you use?
A
Domain
B
Operating System
C
Security Group
D
Environment Variable
Correct Answer:
B. Operating System
Explanation:
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789 189(v=ws.11)#operating-system-targeting
DRAG DROP -
You deploy a new Active Directory Domain Services (AD DS) forest named contoso.com. The domain contains three domain controllers named DC1, DC2, and
DC3.
You rename Default-First-Site-Name as Site1.
You plan to ship DC1, DC2, and DC3 to datacenters in different locations.
You need to configure replication between DC1, DC2, and DC3 to meet the following requirements:
✑ Each domain controller must reside in its own Active Directory site.
✑ The replication schedule between each site must be controlled independently.
✑ Interruptions to replication must be minimized.
Which three actions should you perform in sequence in the Active Directory Sites and Services console? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
A
Correct Answer:
A.
Explanation:
create 2 additional sites and move DC2 and DC3.
Create and additional site link between site 2 and site 3 (does this first so as not to disrupt site 1 and site 2)
remove Site 2 from Default sitelink (leaving site 1 and 3 to replicate. by default site-link Bridging is enabled so 1 to 2 and 1 to 3 bridges the link between 2 and 3)
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The root domain contains the domain controllers shown in the following table.
A failure of which domain controller will prevent you from creating application partitions?
A
DC1
B
DC2
C
DC3
D
DC4
E
DC5
Correct Answer:
A. DC1
Explanation:
Initial replication and connectivity requirementsThis FSMO role holder is only active when the role owner has inbound replicated the configuration NC successfully since the Directory Service started.Domain members of the forest only contact the FSMO role holder when they update the cross-references. DCs contact the FSMO role holder when:Domains are added or removed in the forest.New instances of application directory partitions on DCs are added. For example, a DNS server has been enlisted for the default DNS application directory partitions
https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/fsmo-roles
Questions: 1-10 out of 290
Continue Full Practice..
GET ALL 290 QUESTIONS