cert
cert-1
cert-2

Pass Microsoft AZ-801 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-801 Exam - Verified By Experts
AZ-801 Premium Bundle
$29.98

AZ-801 Premium Bundle

$79.99
$109.97
  • Premium File 326 Questions & Answers. Last update: Nov 02, 2026
  • Training Course 122 Video Lectures
  • Study Guide 387 Pages
 
$109.97
$79.99
accept 31 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-801 Exam Training Products Individually
Microsoft AZ-801 Premium File
Premium File 326 Q&A
$76.99$69.99
Microsoft AZ-801 Video Training Course
Training Course 122 Lectures
$21.99 $19.99
Microsoft AZ-801 PDF Study Guide
Study Guide 387 Pages
$21.99 $19.99
Microsoft AZ-801 Practice Test 10

Question 90

An administrator schedules a Data Collector Set that runs under an account lacking access to required counters and reports an empty log. Which administrative configuration or response BEST addresses the primary requirement?

  1. Diagnose Active Directory replication using repadmin, dcdiag, DNS SRV records, site/subnet mappings, and per-partition error codes before forcing topology changes.
  2. Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot.
  3. Troubleshoot startup and storage failures using boot-state evidence, disk and encryption health, and Azure Arc or Azure VM extension instance logs while preserving a recoverable path.
  4. Configure Azure Monitor Agent and appropriate data collection rules for Azure and Arc-connected Windows servers, enable VM Insights as supported, and use measured alerts with right scope.

Explanation

Correct Answer

B:

Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. This response targets the system boundary described in the case. A single instantaneous CPU percentage does not prove the cause of slow application response; performance diagnosis needs aligned counters and load context. Before applying it, verify: Inspect CPU processor queue, memory commit and paging, logical disk latency and queue, network throughput, data collector schedule and workload timing. Situation: An administrator schedules a Data Collector Set that runs under an account lacking access to required counters and reports an empty log.

Incorrect Answers

A:

Diagnose Active Directory replication using repadmin, dcdiag, DNS SRV records, site/subnet mappings, and per-partition error codes before forcing topology changes. This would address AD replication topology and lingering errors, not the controlling issue in this situation. An AD DC can authenticate local users while replicated attributes are stale; replication success must be checked across partitions and site links, not inferred from a simple logon. The targeted response is: Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. Situation: An administrator schedules a Data Collector Set that runs under an account lacking access to required counters and reports an empty log.

C:

Troubleshoot startup and storage failures using boot-state evidence, disk and encryption health, and Azure Arc or Azure VM extension instance logs while preserving a recoverable path. This would address Boot, storage and Azure Arc extension failures, not the controlling issue in this situation. A boot loader fault, an encrypted volume locked without a protector, and an Azure extension permission problem require different remedies despite a generic failure status. The targeted response is: Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. Situation: An administrator schedules a Data Collector Set that runs under an account lacking access to required counters and reports an empty log.

D:

Configure Azure Monitor Agent and appropriate data collection rules for Azure and Arc-connected Windows servers, enable VM Insights as supported, and use measured alerts with right scope. This would address Azure Monitor data collection rules and VM Insights, not the controlling issue in this situation. A data collection rule must be correctly associated with the source machine and destination; adding a Log Analytics workspace alone does not begin metric/log collection. The targeted response is: Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. Situation: An administrator schedules a Data Collector Set that runs under an account lacking access to required counters and reports an empty log.

Question 91

A line-of-business server slows every afternoon but its dashboard captures only a five-second CPU snapshot after the issue subsides. Which administrative configuration or response BEST addresses the primary requirement?

  1. Configure Azure Monitor Agent and appropriate data collection rules for Azure and Arc-connected Windows servers, enable VM Insights as supported, and use measured alerts with right scope.
  2. Select a supported AD Recycle Bin object restore for eligible accidental deletions or use Directory Services Restore Mode and system-state recovery for more extensive database damage, preserving directory consistency.
  3. Troubleshoot Windows Server network paths and name resolution in sequence using DNS records, client resolver configuration, firewall and routing evidence, and test names rather than assuming service failure.
  4. Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot.

Explanation

Correct Answer

D:

Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. This response targets the system boundary described in the case. A single instantaneous CPU percentage does not prove the cause of slow application response; performance diagnosis needs aligned counters and load context. Before applying it, verify: Inspect CPU processor queue, memory commit and paging, logical disk latency and queue, network throughput, data collector schedule and workload timing. Situation: A line-of-business server slows every afternoon but its dashboard captures only a five-second CPU snapshot after the issue subsides.

Incorrect Answers

A:

Configure Azure Monitor Agent and appropriate data collection rules for Azure and Arc-connected Windows servers, enable VM Insights as supported, and use measured alerts with right scope. This would address Azure Monitor data collection rules and VM Insights, not the controlling issue in this situation. A data collection rule must be correctly associated with the source machine and destination; adding a Log Analytics workspace alone does not begin metric/log collection. The targeted response is: Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. Situation: A line-of-business server slows every afternoon but its dashboard captures only a five-second CPU snapshot after the issue subsides.

B:

Select a supported AD Recycle Bin object restore for eligible accidental deletions or use Directory Services Restore Mode and system-state recovery for more extensive database damage, preserving directory consistency. This would address AD Recycle Bin versus DSRM directory recovery, not the controlling issue in this situation. AD Recycle Bin restores eligible deleted objects but does not replace a backup for destroyed AD databases; DSRM restores require careful replication and authoritative-restore decisions. The targeted response is: Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. Situation: A line-of-business server slows every afternoon but its dashboard captures only a five-second CPU snapshot after the issue subsides.

C:

Troubleshoot Windows Server network paths and name resolution in sequence using DNS records, client resolver configuration, firewall and routing evidence, and test names rather than assuming service failure. This would address Windows DNS and network connectivity troubleshooting, not the controlling issue in this situation. Name resolution, TCP reachability and application authentication are separate diagnostic layers; a ping success alone is not proof that an application port is open. The targeted response is: Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. Situation: A line-of-business server slows every afternoon but its dashboard captures only a five-second CPU snapshot after the issue subsides.

Question 92

A branch application stops receiving TCP traffic because its server unexpectedly changes from Domain to Public firewall profile. Which TWO complementary steps provide the appropriate administrative response and its supporting assessment? Select TWO.

  1. Use Windows Defender Firewall with Advanced Security to enforce role-specific inbound rules on the effective domain/private/public profile, keeping administrative ports limited to approved sources.
  2. Check the VM operating system and disk encryption method, disk encryption set and key permissions, Key Vault reachability, rotation policy, and restore prerequisites.
  3. Inspect active network profile, effective GPO firewall rules, listener ports, remote address filters, dropped packet logs, and policy precedence.
  4. Create tested connection security rules for domain isolation and required authenticated server-to-server IPsec, with planned exemptions for unmanaged systems.
  5. A stolen disk remains encrypted at rest and an authorized recovery operator can unlock the intended volume using a protected and recorded recovery process.

Explanation

Correct Answers

A:

Use Windows Defender Firewall with Advanced Security to enforce role-specific inbound rules on the effective domain/private/public profile, keeping administrative ports limited to approved sources. This response targets the system boundary described in the case. An inbound rule must match actual profile, direction, ports and source; disabling all profiles to repair one application creates unnecessary exposure. Before applying it, verify: Inspect active network profile, effective GPO firewall rules, listener ports, remote address filters, dropped packet logs, and policy precedence. This is the response half of the pair. Situation: A branch application stops receiving TCP traffic because its server unexpectedly changes from Domain to Public firewall profile.

C:

Inspect active network profile, effective GPO firewall rules, listener ports, remote address filters, dropped packet logs, and policy precedence. This evidence tests the likely failure point before changing production configuration. An inbound rule must match actual profile, direction, ports and source; disabling all profiles to repair one application creates unnecessary exposure. The corresponding response is: Use Windows Defender Firewall with Advanced Security to enforce role-specific inbound rules on the effective domain/private/public profile, keeping administrative ports limited to approved sources. This is the verification prerequisite half of the pair. Situation: A branch application stops receiving TCP traffic because its server unexpectedly changes from Domain to Public firewall profile.

Incorrect Answers

B:

Check the VM operating system and disk encryption method, disk encryption set and key permissions, Key Vault reachability, rotation policy, and restore prerequisites. This step is relevant to Azure VM disk encryption keys and recovery but is not one of the complementary steps this case needs. The intended pair is: Use Windows Defender Firewall with Advanced Security to enforce role-specific inbound rules on the effective domain/private/public profile, keeping administrative ports limited to approved sources. and Inspect active network profile, effective GPO firewall rules, listener ports, remote address filters, dropped packet logs, and policy precedence. Situation: A branch application stops receiving TCP traffic because its server unexpectedly changes from Domain to Public firewall profile.

D:

Create tested connection security rules for domain isolation and required authenticated server-to-server IPsec, with planned exemptions for unmanaged systems. This step is relevant to Windows IPsec connection security and domain isolation but is not one of the complementary steps this case needs. The intended pair is: Use Windows Defender Firewall with Advanced Security to enforce role-specific inbound rules on the effective domain/private/public profile, keeping administrative ports limited to approved sources. and Inspect active network profile, effective GPO firewall rules, listener ports, remote address filters, dropped packet logs, and policy precedence. Situation: A branch application stops receiving TCP traffic because its server unexpectedly changes from Domain to Public firewall profile.

E:

A stolen disk remains encrypted at rest and an authorized recovery operator can unlock the intended volume using a protected and recorded recovery process. This step is relevant to BitLocker recovery and protector escrow but is not one of the complementary steps this case needs. The intended pair is: Use Windows Defender Firewall with Advanced Security to enforce role-specific inbound rules on the effective domain/private/public profile, keeping administrative ports limited to approved sources. and Inspect active network profile, effective GPO firewall rules, listener ports, remote address filters, dropped packet logs, and policy precedence. Situation: A branch application stops receiving TCP traffic because its server unexpectedly changes from Domain to Public firewall profile.

Question 93

A remote domain controller serves old group memberships because replication over a newly configured site link has been broken for days. Before changing the system, which evidence should the administrator examine FIRST?

  1. Inspect agent/extension deployment, DCR associations and transform rules, Log Analytics destination, heartbeat, VM Insights dependencies and alert action group routing.
  2. Inspect update service policy, error codes and servicing logs, WSUS or internet endpoint connectivity, w32tm status/peers, time offset, and domain controller time hierarchy.
  3. Inspect Recycle Bin enablement and deleted-object lifetime, system-state backups, deletion scope, replication state, and authoritative versus nonauthoritative recovery requirements.
  4. Review inbound/outbound replication partners, last success times, DNS and RPC reachability, Directory Service event IDs, and USN or lingering object warnings.

Explanation

Correct Answer

D:

Review inbound/outbound replication partners, last success times, DNS and RPC reachability, Directory Service event IDs, and USN or lingering object warnings. This evidence tests the likely failure point before changing production configuration. An AD DC can authenticate local users while replicated attributes are stale; replication success must be checked across partitions and site links, not inferred from a simple logon. The corresponding response is: Diagnose Active Directory replication using repadmin, dcdiag, DNS SRV records, site/subnet mappings, and per-partition error codes before forcing topology changes. Situation: A remote domain controller serves old group memberships because replication over a newly configured site link has been broken for days.

Incorrect Answers

A:

Inspect agent/extension deployment, DCR associations and transform rules, Log Analytics destination, heartbeat, VM Insights dependencies and alert action group routing. This examines Azure Monitor data collection rules and VM Insights, a different fault or management boundary. For this case the decisive evidence is: Review inbound/outbound replication partners, last success times, DNS and RPC reachability, Directory Service event IDs, and USN or lingering object warnings. Situation: A remote domain controller serves old group memberships because replication over a newly configured site link has been broken for days.

B:

Inspect update service policy, error codes and servicing logs, WSUS or internet endpoint connectivity, w32tm status/peers, time offset, and domain controller time hierarchy. This examines Windows Update and Time Service troubleshooting, a different fault or management boundary. For this case the decisive evidence is: Review inbound/outbound replication partners, last success times, DNS and RPC reachability, Directory Service event IDs, and USN or lingering object warnings. Situation: A remote domain controller serves old group memberships because replication over a newly configured site link has been broken for days.

C:

Inspect Recycle Bin enablement and deleted-object lifetime, system-state backups, deletion scope, replication state, and authoritative versus nonauthoritative recovery requirements. This examines AD Recycle Bin versus DSRM directory recovery, a different fault or management boundary. For this case the decisive evidence is: Review inbound/outbound replication partners, last success times, DNS and RPC reachability, Directory Service event IDs, and USN or lingering object warnings. Situation: A remote domain controller serves old group memberships because replication over a newly configured site link has been broken for days.

Question 94

A compliance team needs weekly file recovery points kept longer than the currently configured short Azure Backup policy retention. Before changing the system, which evidence should the administrator examine FIRST?

  1. Inspect DFSR event logs and backlog, SYSVOL and NETLOGON shares, GPO version consistency, Entra Connect export/import errors, sync scope and sign-in method health.
  2. Inspect last synchronized recovery points, test VM network isolation, failover role, original VM power state, resynchronization status, and available storage.
  3. Inspect vault registration, MARS agent health, encryption passphrase custody, schedule/retention policy, recovery point availability, and job failures.
  4. Inspect recovery point type, snapshot and vault tiers, encrypted disk keys/Key Vault permissions, VM extensions, destination network, and restore permissions.

Explanation

Correct Answer

C:

Inspect vault registration, MARS agent health, encryption passphrase custody, schedule/retention policy, recovery point availability, and job failures. This evidence tests the likely failure point before changing production configuration. A completed backup job proves data was sent but not that administrators can recover the right data; agent passphrases and retention choices are critical to restoration. The corresponding response is: Configure a supported Recovery Services vault backup policy and Microsoft Azure Recovery Services agent where appropriate for on-premises file/folder or system-state protection, with a verified recovery path. Situation: A compliance team needs weekly file recovery points kept longer than the currently configured short Azure Backup policy retention.

Incorrect Answers

A:

Inspect DFSR event logs and backlog, SYSVOL and NETLOGON shares, GPO version consistency, Entra Connect export/import errors, sync scope and sign-in method health. This examines SYSVOL DFSR and hybrid synchronization troubleshooting, a different fault or management boundary. For this case the decisive evidence is: Inspect vault registration, MARS agent health, encryption passphrase custody, schedule/retention policy, recovery point availability, and job failures. Situation: A compliance team needs weekly file recovery points kept longer than the currently configured short Azure Backup policy retention.

B:

Inspect last synchronized recovery points, test VM network isolation, failover role, original VM power state, resynchronization status, and available storage. This examines Hyper-V Replica test failover and reverse replication, a different fault or management boundary. For this case the decisive evidence is: Inspect vault registration, MARS agent health, encryption passphrase custody, schedule/retention policy, recovery point availability, and job failures. Situation: A compliance team needs weekly file recovery points kept longer than the currently configured short Azure Backup policy retention.

D:

Inspect recovery point type, snapshot and vault tiers, encrypted disk keys/Key Vault permissions, VM extensions, destination network, and restore permissions. This examines Azure VM backup and encrypted snapshot recovery, a different fault or management boundary. For this case the decisive evidence is: Inspect vault registration, MARS agent health, encryption passphrase custody, schedule/retention policy, recovery point availability, and job failures. Situation: A compliance team needs weekly file recovery points kept longer than the currently configured short Azure Backup policy retention.

Question 95

A simple ASP.NET website is considered for Azure App Service but its database remains behind a private network with no connectivity design. Which observed result BEST demonstrates that the intended outcome has been achieved?

  1. The App Service-hosted application responds correctly with authenticated users and stable backing data, without writing required persistent content to ephemeral local storage.
  2. Existing SMB UNC client paths resolve to the replacement and source server is safely retired or isolated without simultaneous identity conflicts.
  3. Users can access permitted printers or RDS desktops on supported target servers while incompatible drivers and licensing problems are explicitly resolved.
  4. A staged container runs the intended IIS application with repeatable deployment and external durable state while unsupported system-level dependencies are identified.

Explanation

Correct Answer

A:

The App Service-hosted application responds correctly with authenticated users and stable backing data, without writing required persistent content to ephemeral local storage. This is an observable acceptance condition, not merely evidence that a feature was enabled. Azure App Service is a managed web runtime, not a general Windows Server VM; applications requiring unsupported native services may need refactoring or a different target. Situation: A simple ASP.NET website is considered for Azure App Service but its database remains behind a private network with no connectivity design.

Incorrect Answers

B:

Existing SMB UNC client paths resolve to the replacement and source server is safely retired or isolated without simultaneous identity conflicts. This tests Storage Migration Service cutover server identity, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: The App Service-hosted application responds correctly with authenticated users and stable backing data, without writing required persistent content to ephemeral local storage. Situation: A simple ASP.NET website is considered for Azure App Service but its database remains behind a private network with no connectivity design.

C:

Users can access permitted printers or RDS desktops on supported target servers while incompatible drivers and licensing problems are explicitly resolved. This tests Print and Remote Desktop Services host migration, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: The App Service-hosted application responds correctly with authenticated users and stable backing data, without writing required persistent content to ephemeral local storage. Situation: A simple ASP.NET website is considered for Azure App Service but its database remains behind a private network with no connectivity design.

D:

A staged container runs the intended IIS application with repeatable deployment and external durable state while unsupported system-level dependencies are identified. This tests Container migration decision for IIS workloads, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: The App Service-hosted application responds correctly with authenticated users and stable backing data, without writing required persistent content to ephemeral local storage. Situation: A simple ASP.NET website is considered for Azure App Service but its database remains behind a private network with no connectivity design.

Question 96

An intranet IIS app connects to SQL Server using its application pool identity, and that identity loses database access on the new host. Which TWO complementary steps provide the appropriate administrative response and its supporting assessment? Select TWO.

  1. Migrate existing IIS site configuration, application pools, identity, bindings and TLS certificates to a supported Windows Server target; test application runtime compatibility before switching traffic.
  2. Inspect SMS inventory findings, share mapping, file ownership, NTFS and share ACLs, open-file behavior, transfer logs and destination space.
  3. Inspect IIS site bindings, host headers, certificate/private key access, application pool identity and .NET runtime, external dependencies and HTTP response traces.
  4. Migrate DHCP configurations, leases and reservations with supported export/import approaches, confirm AD authorization where required, and avoid simultaneous unauthorized lease offers.
  5. A staged container runs the intended IIS application with repeatable deployment and external durable state while unsupported system-level dependencies are identified.

Explanation

Correct Answers

A:

Migrate existing IIS site configuration, application pools, identity, bindings and TLS certificates to a supported Windows Server target; test application runtime compatibility before switching traffic. This response targets the system boundary described in the case. Copying a website directory does not transfer its IIS bindings, application pool identity or private-key permissions; the web runtime and dependencies need validation. Before applying it, verify: Inspect IIS site bindings, host headers, certificate/private key access, application pool identity and.NET runtime, external dependencies and HTTP response traces. This is the response half of the pair. Situation: An intranet IIS app connects to SQL Server using its application pool identity, and that identity loses database access on the new host.

C:

Inspect IIS site bindings, host headers, certificate/private key access, application pool identity and.NET runtime, external dependencies and HTTP response traces. This evidence tests the likely failure point before changing production configuration. Copying a website directory does not transfer its IIS bindings, application pool identity or private-key permissions; the web runtime and dependencies need validation. The corresponding response is: Migrate existing IIS site configuration, application pools, identity, bindings and TLS certificates to a supported Windows Server target; test application runtime compatibility before switching traffic. This is the verification prerequisite half of the pair. Situation: An intranet IIS app connects to SQL Server using its application pool identity, and that identity loses database access on the new host.

Incorrect Answers

B:

Inspect SMS inventory findings, share mapping, file ownership, NTFS and share ACLs, open-file behavior, transfer logs and destination space. This step is relevant to Storage Migration Service inventory and file-share ACL transfer but is not one of the complementary steps this case needs. The intended pair is: Migrate existing IIS site configuration, application pools, identity, bindings and TLS certificates to a supported Windows Server target; test application runtime compatibility before switching traffic. and Inspect IIS site bindings, host headers, certificate/private key access, application pool identity and.NET runtime, external dependencies and HTTP response traces. Situation: An intranet IIS app connects to SQL Server using its application pool identity, and that identity loses database access on the new host.

D:

Migrate DHCP configurations, leases and reservations with supported export/import approaches, confirm AD authorization where required, and avoid simultaneous unauthorized lease offers. This step is relevant to DHCP Server migration and authorization but is not one of the complementary steps this case needs. The intended pair is: Migrate existing IIS site configuration, application pools, identity, bindings and TLS certificates to a supported Windows Server target; test application runtime compatibility before switching traffic. and Inspect IIS site bindings, host headers, certificate/private key access, application pool identity and.NET runtime, external dependencies and HTTP response traces. Situation: An intranet IIS app connects to SQL Server using its application pool identity, and that identity loses database access on the new host.

E:

A staged container runs the intended IIS application with repeatable deployment and external durable state while unsupported system-level dependencies are identified. This step is relevant to Container migration decision for IIS workloads but is not one of the complementary steps this case needs. The intended pair is: Migrate existing IIS site configuration, application pools, identity, bindings and TLS certificates to a supported Windows Server target; test application runtime compatibility before switching traffic. and Inspect IIS site bindings, host headers, certificate/private key access, application pool identity and.NET runtime, external dependencies and HTTP response traces. Situation: An intranet IIS app connects to SQL Server using its application pool identity, and that identity loses database access on the new host.

Question 97

A failed rollout requires returning some nodes to their former OS, yet the team already committed a higher functional level without validation. Which TWO complementary steps provide the appropriate administrative response and its supporting assessment? Select TWO.

  1. Inspect certified storage and network hardware, disks per node, fault domains, Storage Spaces Direct health, SMB paths, and application disk ownership.
  2. Perform supported rolling upgrades of Windows Server failover cluster nodes, preserving workload compatibility and deferring cluster functional-level upgrade until rollback requirements are resolved.
  3. A failed disk is replaced and data repair completes with virtual disks healthy and documented resilience against the next expected fault.
  4. Use Cluster-Aware Updating to drain, update, reboot, validate and return nodes in a supported sequence with a service continuity plan.
  5. Inspect current and target server versions, cluster node mixed-version support, VM configuration compatibility, workload ownership, and functional-level state.

Explanation

Correct Answers

B:

Perform supported rolling upgrades of Windows Server failover cluster nodes, preserving workload compatibility and deferring cluster functional-level upgrade until rollback requirements are resolved. This response targets the system boundary described in the case. A cluster functional-level upgrade changes interoperability and rollback conditions; upgrading one member is not identical to committing the entire cluster to new behavior. Before applying it, verify: Inspect current and target server versions, cluster node mixed-version support, VM configuration compatibility, workload ownership, and functional-level state. This is the response half of the pair. Situation: A failed rollout requires returning some nodes to their former OS, yet the team already committed a higher functional level without validation.

E:

Inspect current and target server versions, cluster node mixed-version support, VM configuration compatibility, workload ownership, and functional-level state. This evidence tests the likely failure point before changing production configuration. A cluster functional-level upgrade changes interoperability and rollback conditions; upgrading one member is not identical to committing the entire cluster to new behavior. The corresponding response is: Perform supported rolling upgrades of Windows Server failover cluster nodes, preserving workload compatibility and deferring cluster functional-level upgrade until rollback requirements are resolved. This is the verification prerequisite half of the pair. Situation: A failed rollout requires returning some nodes to their former OS, yet the team already committed a higher functional level without validation.

Incorrect Answers

A:

Inspect certified storage and network hardware, disks per node, fault domains, Storage Spaces Direct health, SMB paths, and application disk ownership. This step is relevant to Storage Spaces Direct stretched cluster and file share resilience but is not one of the complementary steps this case needs. The intended pair is: Perform supported rolling upgrades of Windows Server failover cluster nodes, preserving workload compatibility and deferring cluster functional-level upgrade until rollback requirements are resolved. and Inspect current and target server versions, cluster node mixed-version support, VM configuration compatibility, workload ownership, and functional-level state. Situation: A failed rollout requires returning some nodes to their former OS, yet the team already committed a higher functional level without validation.

C:

A failed disk is replaced and data repair completes with virtual disks healthy and documented resilience against the next expected fault. This step is relevant to S2D storage pool repair and capacity planning but is not one of the complementary steps this case needs. The intended pair is: Perform supported rolling upgrades of Windows Server failover cluster nodes, preserving workload compatibility and deferring cluster functional-level upgrade until rollback requirements are resolved. and Inspect current and target server versions, cluster node mixed-version support, VM configuration compatibility, workload ownership, and functional-level state. Situation: A failed rollout requires returning some nodes to their former OS, yet the team already committed a higher functional level without validation.

D:

Use Cluster-Aware Updating to drain, update, reboot, validate and return nodes in a supported sequence with a service continuity plan. This step is relevant to Cluster-Aware Updating and maintenance orchestration but is not one of the complementary steps this case needs. The intended pair is: Perform supported rolling upgrades of Windows Server failover cluster nodes, preserving workload compatibility and deferring cluster functional-level upgrade until rollback requirements are resolved. and Inspect current and target server versions, cluster node mixed-version support, VM configuration compatibility, workload ownership, and functional-level state. Situation: A failed rollout requires returning some nodes to their former OS, yet the team already committed a higher functional level without validation.

Question 98

A file-server cluster's maintenance window allows only a short failover interruption and needs an evidence-based node update order. Which TWO complementary steps provide the appropriate administrative response and its supporting assessment? Select TWO.

  1. A controlled move of the clustered role preserves data consistency and reconnects clients through its expected service identity and endpoint.
  2. Use Cluster-Aware Updating to drain, update, reboot, validate and return nodes in a supported sequence with a service continuity plan.
  3. Recover a failed node by identifying its hardware, cluster service, network and storage state, then move or drain roles safely and validate ownership on surviving nodes.
  4. Inspect Get-StoragePool/Get-PhysicalDisk/Get-VirtualDisk health, available capacity, cluster events, repair jobs, and placement/fault-domain warnings.
  5. Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events.

Explanation

Correct Answers

B:

Use Cluster-Aware Updating to drain, update, reboot, validate and return nodes in a supported sequence with a service continuity plan. This response targets the system boundary described in the case. Installing Windows updates on all failover cluster nodes simultaneously defeats redundancy; Cluster-Aware Updating coordinates planned node-by-node servicing. Before applying it, verify: Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events. This is the response half of the pair. Situation: A file-server cluster's maintenance window allows only a short failover interruption and needs an evidence-based node update order.

E:

Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events. This evidence tests the likely failure point before changing production configuration. Installing Windows updates on all failover cluster nodes simultaneously defeats redundancy; Cluster-Aware Updating coordinates planned node-by-node servicing. The corresponding response is: Use Cluster-Aware Updating to drain, update, reboot, validate and return nodes in a supported sequence with a service continuity plan. This is the verification prerequisite half of the pair. Situation: A file-server cluster's maintenance window allows only a short failover interruption and needs an evidence-based node update order.

Incorrect Answers

A:

A controlled move of the clustered role preserves data consistency and reconnects clients through its expected service identity and endpoint. This step is relevant to Failover cluster roles, client access and network configuration but is not one of the complementary steps this case needs. The intended pair is: Use Cluster-Aware Updating to drain, update, reboot, validate and return nodes in a supported sequence with a service continuity plan. and Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events. Situation: A file-server cluster's maintenance window allows only a short failover interruption and needs an evidence-based node update order.

C:

Recover a failed node by identifying its hardware, cluster service, network and storage state, then move or drain roles safely and validate ownership on surviving nodes. This step is relevant to Drain roles and recover failed cluster nodes but is not one of the complementary steps this case needs. The intended pair is: Use Cluster-Aware Updating to drain, update, reboot, validate and return nodes in a supported sequence with a service continuity plan. and Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events. Situation: A file-server cluster's maintenance window allows only a short failover interruption and needs an evidence-based node update order.

D:

Inspect Get-StoragePool/Get-PhysicalDisk/Get-VirtualDisk health, available capacity, cluster events, repair jobs, and placement/fault-domain warnings. This step is relevant to S2D storage pool repair and capacity planning but is not one of the complementary steps this case needs. The intended pair is: Use Cluster-Aware Updating to drain, update, reboot, validate and return nodes in a supported sequence with a service continuity plan. and Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events. Situation: A file-server cluster's maintenance window allows only a short failover interruption and needs an evidence-based node update order.

Question 99

After tightening domain authentication, a batch process fails and logs show NTLM fallback rather than a Kerberos ticket to the intended SPN. Which observed result BEST demonstrates that the intended outcome has been achieved?

  1. Only authorized branch users can authenticate during a temporary WAN disruption and privileged domain passwords are not stored on the RODC.
  2. Approved Kerberos authentication succeeds on designated hosts while disallowed NTLM or privileged sign-ins are logged and rejected under the tested policy.
  3. An unsigned test executable is denied under the enforced policy while documented critical workloads and approved updates still start normally.
  4. The required application port is reachable only from permitted subnets while unapproved inbound administrative traffic is denied and logged.

Explanation

Correct Answer

B:

Approved Kerberos authentication succeeds on designated hosts while disallowed NTLM or privileged sign-ins are logged and rejected under the tested policy. This is an observable acceptance condition, not merely evidence that a feature was enabled. A domain-wide NTLM disable without usage discovery can break legacy systems; authentication policy silos narrow where sensitive accounts may authenticate. Situation: After tightening domain authentication, a batch process fails and logs show NTLM fallback rather than a Kerberos ticket to the intended SPN.

Incorrect Answers

A:

Only authorized branch users can authenticate during a temporary WAN disruption and privileged domain passwords are not stored on the RODC. This tests RODC password replication policy in branch offices, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Approved Kerberos authentication succeeds on designated hosts while disallowed NTLM or privileged sign-ins are logged and rejected under the tested policy. Situation: After tightening domain authentication, a batch process fails and logs show NTLM fallback rather than a Kerberos ticket to the intended SPN.

C:

An unsigned test executable is denied under the enforced policy while documented critical workloads and approved updates still start normally. This tests Windows Defender Application Control trust policy, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Approved Kerberos authentication succeeds on designated hosts while disallowed NTLM or privileged sign-ins are logged and rejected under the tested policy. Situation: After tightening domain authentication, a batch process fails and logs show NTLM fallback rather than a Kerberos ticket to the intended SPN.

D:

The required application port is reachable only from permitted subnets while unapproved inbound administrative traffic is denied and logged. This tests Windows Defender Firewall profile and inbound exposure, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Approved Kerberos authentication succeeds on designated hosts while disallowed NTLM or privileged sign-ins are logged and rejected under the tested policy. Situation: After tightening domain authentication, a batch process fails and logs show NTLM fallback rather than a Kerberos ticket to the intended SPN.

Question 100

A storage server reports encryption is suspended indefinitely after an OS update, leaving the team assuming data is protected as before. Before changing the system, which evidence should the administrator examine FIRST?

  1. Inspect RODC allowed and denied replication groups, cached password list, delegated local administration, replication sources, and site connectivity.
  2. Inspect active network profile, effective GPO firewall rules, listener ports, remote address filters, dropped packet logs, and policy precedence.
  3. Inspect protector types, TPM health, recovery key escrow/access audit, suspension state, drive encryption status, and recovery environment prerequisites.
  4. Check the VM operating system and disk encryption method, disk encryption set and key permissions, Key Vault reachability, rotation policy, and restore prerequisites.

Explanation

Correct Answer

C:

Inspect protector types, TPM health, recovery key escrow/access audit, suspension state, drive encryption status, and recovery environment prerequisites. This evidence tests the likely failure point before changing production configuration. BitLocker protects local volume data at rest; loss of the TPM state or recovery material can make legitimate restoration impossible. The corresponding response is: Encrypt supported Windows Server volumes with managed BitLocker protectors, escrow recovery information, and test safe recovery procedures before changing boot configuration. Situation: A storage server reports encryption is suspended indefinitely after an OS update, leaving the team assuming data is protected as before.

Incorrect Answers

A:

Inspect RODC allowed and denied replication groups, cached password list, delegated local administration, replication sources, and site connectivity. This examines RODC password replication policy in branch offices, a different fault or management boundary. For this case the decisive evidence is: Inspect protector types, TPM health, recovery key escrow/access audit, suspension state, drive encryption status, and recovery environment prerequisites. Situation: A storage server reports encryption is suspended indefinitely after an OS update, leaving the team assuming data is protected as before.

B:

Inspect active network profile, effective GPO firewall rules, listener ports, remote address filters, dropped packet logs, and policy precedence. This examines Windows Defender Firewall profile and inbound exposure, a different fault or management boundary. For this case the decisive evidence is: Inspect protector types, TPM health, recovery key escrow/access audit, suspension state, drive encryption status, and recovery environment prerequisites. Situation: A storage server reports encryption is suspended indefinitely after an OS update, leaving the team assuming data is protected as before.

D:

Check the VM operating system and disk encryption method, disk encryption set and key permissions, Key Vault reachability, rotation policy, and restore prerequisites. This examines Azure VM disk encryption keys and recovery, a different fault or management boundary. For this case the decisive evidence is: Inspect protector types, TPM health, recovery key escrow/access audit, suspension state, drive encryption status, and recovery environment prerequisites. Situation: A storage server reports encryption is suspended indefinitely after an OS update, leaving the team assuming data is protected as before.

Configuring Windows Server Hybrid Advanced Services (AZ-801) Practice Tests