AZ-800 Sample Questions With Full Explanations
Here are 8 multiple-choice questions designed to mirror the difficulty, style, and domain coverage of the AZ-800 (Administering Windows Server Hybrid Core Infrastructure) exam. The questions focus on scenario-based decision-making, which is the hallmark of this certification.
Intro: These questions target key skills measured by the AZ-800 exam, including hybrid identity, networking, security, and storage. Pay close attention to the specific constraints in each scenario (e.g., "no line-of-sight," "least privilege," "no additional hardware") as these are the primary drivers for the correct answers.
Question 1
You are deploying a new Windows Server 2022 workload to Azure. The server needs to authenticate users against your on-premises Active Directory Domain Services (AD DS) environment. However, the network team has informed you that there is no line-of-sight to the on-premises domain controllers, and they cannot establish a site-to-site VPN or ExpressRoute in the next month. You need to ensure the workload can authenticate users immediately. What should you do?
A. Deploy a new domain controller in Azure and configure it as a global catalog server.
B. Set up a new Active Directory site in Azure and link it to your on-premises site.
C. Deploy the server to a VNet peered with your on-premises network.
D. Configure the server to use Azure AD Domain Services (Azure AD DS).
Answer: D
Explanation: Azure AD DS provides managed domain services (LDAP, Kerberos, NTLM) without requiring a line-of-sight to on-premises controllers, making it the only viable option given the lack of connectivity. Option A requires a VPN/ExpressRoute to replicate; Option B requires network connectivity; Option C requires a connection to the on-premises network.
Question 2
You manage a hybrid environment with Windows Server 2019 and Windows Server 2022 servers. You need to implement a central management solution that allows you to apply consistent security baselines and compliance settings across both on-premises servers and Azure VMs. The solution must minimize administrative overhead. What should you use?
A. Microsoft Defender for Cloud (formerly Azure Security Center)
B. Azure Policy with guest configuration
C. Group Policy Management Console (GPMC) with Security Templates
D. Windows Admin Center with PowerShell Desired State Configuration (DSC)
Answer: B
Explanation: Azure Policy's guest configuration extension can audit and apply settings inside VMs (both on-prem and Azure) and integrates with Azure Arc, providing centralized compliance reporting. Option A is for security posture/threat detection, not granular OS baselines; Option C only works on-premises; Option D requires more manual orchestration than Policy-based management.
Question 3
Your on-premises network uses a traditional VLAN-based architecture. You have a Windows Server 2022 server that you plan to use as a virtual machine host. You need to implement virtual networking to isolate tenant traffic while maximizing performance and reducing the administrative burden of VLAN configuration. What should you implement?
A. Hyper-V Virtual Switch with an external binding.
B. Set up a Hyper-V Virtual Switch with a private binding.
C. Implement a Software Defined Networking (SDN) infrastructure with Network Controller.
D. Configure a Hyper-V Virtual Switch with an internal binding.
Answer: C
Explanation: SDN with Network Controller enables dynamic, policy-based virtual networks (VXLAN/NVGRE) that abstract from the physical VLANs, reducing manual configuration and providing tenant isolation. Option A (external) requires VLAN tagging per port; Option B and D do not provide external connectivity or isolation for multiple tenants.
Question 4
You have an Azure file share that is used by several on-premises Windows Servers. The servers are joined to an on-premises Active Directory domain. You need to configure access so that users can access the share using their existing AD credentials, without storing passwords in Azure. You want to enforce granular NTFS permissions. What should you configure?
A. Enable identity-based authentication for the Azure file share using AD DS.
B. Create a shared access signature (SAS) token for the file share.
C. Map a drive on the servers using the storage account key.
D. Mount the file share using the net use command with the storage account key.
Answer: A
Explanation: Identity-based authentication for Azure Files allows you to grant access based on on-premises AD DS identities, enabling NTFS ACL enforcement against the share. Options B, C, and D use the storage account key (shared key), which provides full control to the entire account and bypasses granular user-level permissions.
Question 5
You are planning to migrate a legacy line-of-business application to Azure. The application requires Kerberos authentication against your on-premises domain. You have already established an ExpressRoute connection. You want to minimize latency and ensure the application can authenticate even if the ExpressRoute link fails temporarily. What is the most effective strategy?
A. Deploy a Read-Only Domain Controller (RODC) in the Azure VNet.
B. Join the application VMs to an Azure AD DS managed domain.
C. Deploy a writable domain controller in the Azure VNet.
D. Use Azure AD Application Proxy to publish the application.
Answer: C
Explanation: A writable domain controller in the Azure VNet allows the application to authenticate locally, reducing latency and providing resilience if the WAN link fails. An RODC (A) cannot process write operations (like password changes) but can authenticate; however, a writable DC is the standard for resilience. Azure AD DS (B) doesn't support direct Kerberos trust for legacy apps in the same way. Application Proxy (D) is for HTTP-based apps, not Kerberos.
Question 6
You have Windows Admin Center installed on a management machine. You need to manage a server that is located in a perimeter network (DMZ) that is not domain-joined and does not have a trust relationship with your internal domain. The server is accessible via a specific IP address. You need to manage this server securely using Windows Admin Center. What is the best way to configure the connection?
A. Add the server to Windows Admin Center using the IP address and ensure WinRM over HTTPS is enabled.
B. Add the server to Windows Admin Center using its DNS name and select "Use my Windows account".
C. Create a gateway in the DMZ and install Windows Admin Center on the target server.
D. Deploy a dedicated AD DS domain controller in the DMZ and join the server to it.
Answer: A
Explanation: Windows Admin Center can manage non-domain-joined servers by connecting via IP address, provided WinRM (HTTP or HTTPS) is configured. Using the IP address bypasses DNS/domain resolution issues. Option B fails because "Use my Windows account" requires Kerberos (domain trust). Option C is overkill. Option D is unnecessary complexity.
Question 7
You are configuring Azure AD Connect to sync identities. You have a strict security policy that requires users to use Multi-Factor Authentication (MFA) for all cloud resources. You need to ensure that on-premises Active Directory password changes are immediately reflected in Azure AD, even if the user is locked out due to failed MFA attempts. Which feature must you enable?
A. Password writeback
B. Password hash synchronization (PHS)
C. Pass-through authentication (PTA)
D. Seamless Single Sign-On (SSO)
Answer: B
Explanation: Password Hash Synchronization (PHS) synchronizes the hash of the on-premises password to Azure AD automatically, typically within minutes, ensuring the cloud password matches. Password writeback (A) is for cloud-to-on-prem resets. PTA (C) validates passwords on-prem but does not sync hashes, meaning a locked account on-prem could block auth; PHS is independent of on-prem account lockout status.
Question 8
You have Windows Server 2022 servers that are part of a failover cluster. You need to implement a storage solution that provides high availability and can be used by multiple cluster nodes simultaneously. You have no SAN hardware available. What should you configure?
A. Storage Replica
B. Storage Spaces Direct (S2D)
C. Distributed File System Replication (DFSR)
D. Volume Shadow Copy Service (VSS)
Answer: B
Explanation: Storage Spaces Direct (S2D) uses local disks on the cluster nodes to create a highly available, software-defined storage volume that can be accessed by all nodes concurrently. Storage Replica (A) is for block-level replication, not shared access. DFSR (C) is for file replication, not block-level shared storage. VSS (D) is for snapshots, not high availability.
Closing: These questions cover the core hybrid scenarios you’ll face in the exam. Remember to focus on the "why" behind each answer, as the AZ-800 exam heavily tests your ability to justify your design choices based on constraints like connectivity, security, and cost.
When you continue studying, you can get a schedule that fits your time and a quick check of weak topics with the free study plans and readiness checks.
Validate your knowledge with Administering Windows Server Hybrid Core Infrastructure (AZ-800) mock exam that cover every domain the exam blueprint lists.