cert
cert-1
cert-2

Pass Microsoft AZ-801 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-801 Exam - Verified By Experts
AZ-801 Premium Bundle
$29.98

AZ-801 Premium Bundle

$79.99
$109.97
  • Premium File 326 Questions & Answers. Last update: Nov 02, 2026
  • Training Course 122 Video Lectures
  • Study Guide 387 Pages
 
$109.97
$79.99
accept 31 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-801 Exam Training Products Individually
Microsoft AZ-801 Premium File
Premium File 326 Q&A
$76.99$69.99
Microsoft AZ-801 Video Training Course
Training Course 122 Lectures
$21.99 $19.99
Microsoft AZ-801 PDF Study Guide
Study Guide 387 Pages
$21.99 $19.99
Microsoft AZ-801 Practice Test 5

Question 40

After domain isolation deployment, an unmanaged printer cannot reach its spooler and staff need a narrow exemption rather than disabling isolation globally. Which observed result BEST demonstrates that the intended outcome has been achieved?

  1. Eligible domain members establish authenticated traffic where required while untrusted machines cannot silently join the isolated zone.
  2. An Azure Windows VM serves only intended ports from approved networks while exposed management ports and unintended bypass paths are blocked.
  3. Selected Windows security events arrive with correct host, event IDs and timestamps and relevant detections work without collecting unnecessary sensitive logs.
  4. An unsigned test executable is denied under the enforced policy while documented critical workloads and approved updates still start normally.

Explanation

Correct Answer

A:

Eligible domain members establish authenticated traffic where required while untrusted machines cannot silently join the isolated zone. This is an observable acceptance condition, not merely evidence that a feature was enabled. Connection security rules authenticate or protect IP traffic independently of simple port allow rules; endpoints must agree on authentication and policy. Situation: After domain isolation deployment, an unmanaged printer cannot reach its spooler and staff need a narrow exemption rather than disabling isolation globally.

Incorrect Answers

B:

An Azure Windows VM serves only intended ports from approved networks while exposed management ports and unintended bypass paths are blocked. This tests Azure NSG effective rules for Windows Server VMs, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Eligible domain members establish authenticated traffic where required while untrusted machines cannot silently join the isolated zone. Situation: After domain isolation deployment, an unmanaged printer cannot reach its spooler and staff need a narrow exemption rather than disabling isolation globally.

C:

Selected Windows security events arrive with correct host, event IDs and timestamps and relevant detections work without collecting unnecessary sensitive logs. This tests Microsoft Sentinel Windows security-event ingestion, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Eligible domain members establish authenticated traffic where required while untrusted machines cannot silently join the isolated zone. Situation: After domain isolation deployment, an unmanaged printer cannot reach its spooler and staff need a narrow exemption rather than disabling isolation globally.

D:

An unsigned test executable is denied under the enforced policy while documented critical workloads and approved updates still start normally. This tests Windows Defender Application Control trust policy, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Eligible domain members establish authenticated traffic where required while untrusted machines cannot silently join the isolated zone. Situation: After domain isolation deployment, an unmanaged printer cannot reach its spooler and staff need a narrow exemption rather than disabling isolation globally.

Question 41

A Windows Server VM backup shows an available instant restore point but the recovered encrypted disk cannot open after a Key Vault policy change. Which observed result BEST demonstrates that the intended outcome has been achieved?

  1. A requested folder or supported server state restores from a retained recovery point to an authorized location with content and permissions verified.
  2. A selected Azure VM point-in-time backup restores to an isolated test VM that boots, decrypts correctly and passes application validation.
  3. The Azure Windows VM disk is protected under the approved key policy, unauthorized key access fails, and an encrypted recovery test succeeds.
  4. A documented test failover starts required dependencies before application tiers and verifies service functionality without disrupting primary production.

Explanation

Correct Answer

B:

A selected Azure VM point-in-time backup restores to an isolated test VM that boots, decrypts correctly and passes application validation. This is an observable acceptance condition, not merely evidence that a feature was enabled. Instant restore can accelerate recovery using snapshots but retention and encrypted VM restore dependencies must still be tested; a backup policy does not guarantee a working guest application. Situation: A Windows Server VM backup shows an available instant restore point but the recovered encrypted disk cannot open after a Key Vault policy change.

Incorrect Answers

A:

A requested folder or supported server state restores from a retained recovery point to an authorized location with content and permissions verified. This tests Azure Backup vault policy and MARS agent protection, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: A selected Azure VM point-in-time backup restores to an isolated test VM that boots, decrypts correctly and passes application validation. Situation: A Windows Server VM backup shows an available instant restore point but the recovered encrypted disk cannot open after a Key Vault policy change.

C:

The Azure Windows VM disk is protected under the approved key policy, unauthorized key access fails, and an encrypted recovery test succeeds. This tests Azure VM disk encryption keys and recovery, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: A selected Azure VM point-in-time backup restores to an isolated test VM that boots, decrypts correctly and passes application validation. Situation: A Windows Server VM backup shows an available instant restore point but the recovered encrypted disk cannot open after a Key Vault policy change.

D:

A documented test failover starts required dependencies before application tiers and verifies service functionality without disrupting primary production. This tests Site Recovery recovery-plan ordering and controlled failover, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: A selected Azure VM point-in-time backup restores to an isolated test VM that boots, decrypts correctly and passes application validation. Situation: A Windows Server VM backup shows an available instant restore point but the recovered encrypted disk cannot open after a Key Vault policy change.

Question 42

A team wants Windows Server 2025 domain controllers but an older controller and FRS-based SYSVOL configuration remain in the forest. Before changing the system, which evidence should the administrator examine FIRST?

  1. Inspect forest/domain functional levels, SYSVOL DFSR migration status, domain controller versions, dcdiag/repadmin health, FSMO roles and recovery backups.
  2. Inspect forest trust health, DNS name resolution, user/group membership, SIDHistory privileges and auditing, ADMT compatibility, and application ACL references.
  3. Review printer drivers and port mappings, Print Management exports, RDS collection settings, user profiles, license server activation, host versions and login tests.
  4. Inspect replication health, source disk change rate, destination VM configuration, test migration network isolation, DNS cutover plan and postmigration agent status.

Explanation

Correct Answer

A:

Inspect forest/domain functional levels, SYSVOL DFSR migration status, domain controller versions, dcdiag/repadmin health, FSMO roles and recovery backups. This evidence tests the likely failure point before changing production configuration. Raising an AD functional level is a compatibility decision separate from upgrading the Windows Server OS on a member server; unhealthy replication amplifies changes. The corresponding response is: Upgrade an existing Active Directory forest through supported domain controller replacement and schema/functional-level procedures, checking replication and SYSVOL readiness before raising functional levels. Situation: A team wants Windows Server 2025 domain controllers but an older controller and FRS-based SYSVOL configuration remain in the forest.

Incorrect Answers

B:

Inspect forest trust health, DNS name resolution, user/group membership, SIDHistory privileges and auditing, ADMT compatibility, and application ACL references. This examines New AD forest restructuring with ADMT and SIDHistory, a different fault or management boundary. For this case the decisive evidence is: Inspect forest/domain functional levels, SYSVOL DFSR migration status, domain controller versions, dcdiag/repadmin health, FSMO roles and recovery backups. Situation: A team wants Windows Server 2025 domain controllers but an older controller and FRS-based SYSVOL configuration remain in the forest.

C:

Review printer drivers and port mappings, Print Management exports, RDS collection settings, user profiles, license server activation, host versions and login tests. This examines Print and Remote Desktop Services host migration, a different fault or management boundary. For this case the decisive evidence is: Inspect forest/domain functional levels, SYSVOL DFSR migration status, domain controller versions, dcdiag/repadmin health, FSMO roles and recovery backups. Situation: A team wants Windows Server 2025 domain controllers but an older controller and FRS-based SYSVOL configuration remain in the forest.

D:

Inspect replication health, source disk change rate, destination VM configuration, test migration network isolation, DNS cutover plan and postmigration agent status. This examines Azure Migrate test migration and production cutover, a different fault or management boundary. For this case the decisive evidence is: Inspect forest/domain functional levels, SYSVOL DFSR migration status, domain controller versions, dcdiag/repadmin health, FSMO roles and recovery backups. Situation: A team wants Windows Server 2025 domain controllers but an older controller and FRS-based SYSVOL configuration remain in the forest.

Question 43

A virtualization team upgrades the first two nodes of a cluster and tries to raise the cluster functional level while older nodes are still operational. Before changing the system, which evidence should the administrator examine FIRST?

  1. Inspect Get-StoragePool/Get-PhysicalDisk/Get-VirtualDisk health, available capacity, cluster events, repair jobs, and placement/fault-domain warnings.
  2. Review cluster validation tests, IP resource dependencies, DNS registration, preferred owner settings, network adapter roles, and application client reconnect logs.
  3. Inspect current and target server versions, cluster node mixed-version support, VM configuration compatibility, workload ownership, and functional-level state.
  4. Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events.

Explanation

Correct Answer

C:

Inspect current and target server versions, cluster node mixed-version support, VM configuration compatibility, workload ownership, and functional-level state. This evidence tests the likely failure point before changing production configuration. A cluster functional-level upgrade changes interoperability and rollback conditions; upgrading one member is not identical to committing the entire cluster to new behavior. The corresponding response is: Perform supported rolling upgrades of Windows Server failover cluster nodes, preserving workload compatibility and deferring cluster functional-level upgrade until rollback requirements are resolved. Situation: A virtualization team upgrades the first two nodes of a cluster and tries to raise the cluster functional level while older nodes are still operational.

Incorrect Answers

A:

Inspect Get-StoragePool/Get-PhysicalDisk/Get-VirtualDisk health, available capacity, cluster events, repair jobs, and placement/fault-domain warnings. This examines S2D storage pool repair and capacity planning, a different fault or management boundary. For this case the decisive evidence is: Inspect current and target server versions, cluster node mixed-version support, VM configuration compatibility, workload ownership, and functional-level state. Situation: A virtualization team upgrades the first two nodes of a cluster and tries to raise the cluster functional level while older nodes are still operational.

B:

Review cluster validation tests, IP resource dependencies, DNS registration, preferred owner settings, network adapter roles, and application client reconnect logs. This examines Failover cluster roles, client access and network configuration, a different fault or management boundary. For this case the decisive evidence is: Inspect current and target server versions, cluster node mixed-version support, VM configuration compatibility, workload ownership, and functional-level state. Situation: A virtualization team upgrades the first two nodes of a cluster and tries to raise the cluster functional level while older nodes are still operational.

D:

Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events. This examines Cluster-Aware Updating and maintenance orchestration, a different fault or management boundary. For this case the decisive evidence is: Inspect current and target server versions, cluster node mixed-version support, VM configuration compatibility, workload ownership, and functional-level state. Situation: A virtualization team upgrades the first two nodes of a cluster and tries to raise the cluster functional level while older nodes are still operational.

Question 44

A SOC wants to capture failed logon and privilege changes without sending every verbose Windows event from hundreds of file servers. Before changing the system, which evidence should the administrator examine FIRST?

  1. Review sensor service status, packet and authentication event visibility, domain controller audit configuration, identity correlation, and alert evidence.
  2. Inspect Azure Monitor Agent and Arc prerequisites, DCR association, event channel selection, workspace destination, ingestion latency, and KQL query results.
  3. Review domain controller NTLM audit logs, service account SPNs, Kerberos ticket paths, authentication policy assignments, client OS compatibility, and privileged login locations.
  4. Review NIC/subnet NSG association, priority ordering, service tags, ASG references, effective security rules, and Network Watcher connectivity evidence.

Explanation

Correct Answer

B:

Inspect Azure Monitor Agent and Arc prerequisites, DCR association, event channel selection, workspace destination, ingestion latency, and KQL query results. This evidence tests the likely failure point before changing production configuration. A Sentinel workspace alone does not ingest on-premises server logs; collection rules and healthy agents establish the signal path. The corresponding response is: Connect the appropriate Windows security events to a Microsoft Sentinel-enabled Log Analytics workspace using supported collection mechanisms and validated data collection rules. Situation: A SOC wants to capture failed logon and privilege changes without sending every verbose Windows event from hundreds of file servers.

Incorrect Answers

A:

Review sensor service status, packet and authentication event visibility, domain controller audit configuration, identity correlation, and alert evidence. This examines Defender for Identity domain controller signals, a different fault or management boundary. For this case the decisive evidence is: Inspect Azure Monitor Agent and Arc prerequisites, DCR association, event channel selection, workspace destination, ingestion latency, and KQL query results. Situation: A SOC wants to capture failed logon and privilege changes without sending every verbose Windows event from hundreds of file servers.

C:

Review domain controller NTLM audit logs, service account SPNs, Kerberos ticket paths, authentication policy assignments, client OS compatibility, and privileged login locations. This examines NTLM audit and authentication policy silo hardening, a different fault or management boundary. For this case the decisive evidence is: Inspect Azure Monitor Agent and Arc prerequisites, DCR association, event channel selection, workspace destination, ingestion latency, and KQL query results. Situation: A SOC wants to capture failed logon and privilege changes without sending every verbose Windows event from hundreds of file servers.

D:

Review NIC/subnet NSG association, priority ordering, service tags, ASG references, effective security rules, and Network Watcher connectivity evidence. This examines Azure NSG effective rules for Windows Server VMs, a different fault or management boundary. For this case the decisive evidence is: Inspect Azure Monitor Agent and Arc prerequisites, DCR association, event channel selection, workspace destination, ingestion latency, and KQL query results. Situation: A SOC wants to capture failed logon and privilege changes without sending every verbose Windows event from hundreds of file servers.

Question 45

A file-server cluster's maintenance window allows only a short failover interruption and needs an evidence-based node update order. Before changing the system, which evidence should the administrator examine FIRST?

  1. Inspect cluster logs, Get-ClusterNode and Get-ClusterGroup results, heartbeat/network events, shared disk access, and role move history.
  2. Review number of nodes, storage resiliency setting, mirror/parity layout, storage fault domains, capacity forecast and rebalance status.
  3. Inspect certified storage and network hardware, disks per node, fault domains, Storage Spaces Direct health, SMB paths, and application disk ownership.
  4. Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events.

Explanation

Correct Answer

D:

Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events. This evidence tests the likely failure point before changing production configuration. Installing Windows updates on all failover cluster nodes simultaneously defeats redundancy; Cluster-Aware Updating coordinates planned node-by-node servicing. The corresponding response is: Use Cluster-Aware Updating to drain, update, reboot, validate and return nodes in a supported sequence with a service continuity plan. Situation: A file-server cluster's maintenance window allows only a short failover interruption and needs an evidence-based node update order.

Incorrect Answers

A:

Inspect cluster logs, Get-ClusterNode and Get-ClusterGroup results, heartbeat/network events, shared disk access, and role move history. This examines Drain roles and recover failed cluster nodes, a different fault or management boundary. For this case the decisive evidence is: Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events. Situation: A file-server cluster's maintenance window allows only a short failover interruption and needs an evidence-based node update order.

B:

Review number of nodes, storage resiliency setting, mirror/parity layout, storage fault domains, capacity forecast and rebalance status. This examines S2D resilient volume layout and safe node expansion, a different fault or management boundary. For this case the decisive evidence is: Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events. Situation: A file-server cluster's maintenance window allows only a short failover interruption and needs an evidence-based node update order.

C:

Inspect certified storage and network hardware, disks per node, fault domains, Storage Spaces Direct health, SMB paths, and application disk ownership. This examines Storage Spaces Direct stretched cluster and file share resilience, a different fault or management boundary. For this case the decisive evidence is: Inspect node patch baselines, CAU role/configuration, cluster health, available workload capacity, live migration settings, and update failure events. Situation: A file-server cluster's maintenance window allows only a short failover interruption and needs an evidence-based node update order.

Question 46

A regional office requires local fast access to large files while storing a central cloud copy and preserving familiar SMB shares. Which administrative configuration or response BEST addresses the primary requirement?

  1. Choose supported migration to Azure file shares or Azure File Sync for SMB data and preserve access semantics, domain identity, performance and cache needs across on-premises and Azure destinations.
  2. Execute a planned Storage Migration Service cutover, optionally transferring the legacy server name and IP to its replacement after final synchronization and an approved maintenance window.
  3. Upgrade an existing Active Directory forest through supported domain controller replacement and schema/functional-level procedures, checking replication and SYSVOL readiness before raising functional levels.
  4. Migrate DHCP configurations, leases and reservations with supported export/import approaches, confirm AD authorization where required, and avoid simultaneous unauthorized lease offers.

Explanation

Correct Answer

A:

Choose supported migration to Azure file shares or Azure File Sync for SMB data and preserve access semantics, domain identity, performance and cache needs across on-premises and Azure destinations. This response targets the system boundary described in the case. An Azure file share and an Azure File Sync cached on-premises endpoint solve different access and performance needs; identity and file ACLs must be verified end-to-end. Before applying it, verify: Inspect share protocol and identity integration, Azure storage account security, network path, Azure File Sync sync group, cloud tiering policy, and SMB ACL compatibility. Situation: A regional office requires local fast access to large files while storing a central cloud copy and preserving familiar SMB shares.

Incorrect Answers

B:

Execute a planned Storage Migration Service cutover, optionally transferring the legacy server name and IP to its replacement after final synchronization and an approved maintenance window. This would address Storage Migration Service cutover server identity, not the controlling issue in this situation. Optional SMS cutover can retain familiar host identity, but both source and target must not claim the same active name or IP simultaneously. The targeted response is: Choose supported migration to Azure file shares or Azure File Sync for SMB data and preserve access semantics, domain identity, performance and cache needs across on-premises and Azure destinations. Situation: A regional office requires local fast access to large files while storing a central cloud copy and preserving familiar SMB shares.

C:

Upgrade an existing Active Directory forest through supported domain controller replacement and schema/functional-level procedures, checking replication and SYSVOL readiness before raising functional levels. This would address In-place AD DS forest upgrade and SYSVOL prerequisite checks, not the controlling issue in this situation. Raising an AD functional level is a compatibility decision separate from upgrading the Windows Server OS on a member server; unhealthy replication amplifies changes. The targeted response is: Choose supported migration to Azure file shares or Azure File Sync for SMB data and preserve access semantics, domain identity, performance and cache needs across on-premises and Azure destinations. Situation: A regional office requires local fast access to large files while storing a central cloud copy and preserving familiar SMB shares.

D:

Migrate DHCP configurations, leases and reservations with supported export/import approaches, confirm AD authorization where required, and avoid simultaneous unauthorized lease offers. This would address DHCP Server migration and authorization, not the controlling issue in this situation. DHCP scope migration requires network relay and authority changes as well as configuration copy; two active uncontrolled responders can create address conflicts. The targeted response is: Choose supported migration to Azure file shares or Azure File Sync for SMB data and preserve access semantics, domain identity, performance and cache needs across on-premises and Azure destinations. Situation: A regional office requires local fast access to large files while storing a central cloud copy and preserving familiar SMB shares.

Question 47

A domain-joined server has correct credentials but Kerberos sign-in intermittently fails after its clock drifts several minutes away from the domain. Which observed result BEST demonstrates that the intended outcome has been achieved?

  1. Time-series evidence isolates the constrained resource and shows whether a tested change improves application throughput without creating another bottleneck.
  2. The affected server boots or extension provisions with required services verified, and the original failure has a documented cause and safe rollback.
  3. Updates install successfully from the approved source and domain clients maintain reliable clock synchronization for authentication and event correlation.
  4. The intended AD objects or directory service recover with correct attributes and replication without resurrecting unrelated old state across the forest.

Explanation

Correct Answer

C:

Updates install successfully from the approved source and domain clients maintain reliable clock synchronization for authentication and event correlation. This is an observable acceptance condition, not merely evidence that a feature was enabled. Domain time skew can break Kerberos independently of update delivery; blindly changing all NTP peers or clearing update caches can conceal root causes. Situation: A domain-joined server has correct credentials but Kerberos sign-in intermittently fails after its clock drifts several minutes away from the domain.

Incorrect Answers

A:

Time-series evidence isolates the constrained resource and shows whether a tested change improves application throughput without creating another bottleneck. This tests Performance Monitor baseline and Data Collector Sets, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Updates install successfully from the approved source and domain clients maintain reliable clock synchronization for authentication and event correlation. Situation: A domain-joined server has correct credentials but Kerberos sign-in intermittently fails after its clock drifts several minutes away from the domain.

B:

The affected server boots or extension provisions with required services verified, and the original failure has a documented cause and safe rollback. This tests Boot, storage and Azure Arc extension failures, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Updates install successfully from the approved source and domain clients maintain reliable clock synchronization for authentication and event correlation. Situation: A domain-joined server has correct credentials but Kerberos sign-in intermittently fails after its clock drifts several minutes away from the domain.

D:

The intended AD objects or directory service recover with correct attributes and replication without resurrecting unrelated old state across the forest. This tests AD Recycle Bin versus DSRM directory recovery, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Updates install successfully from the approved source and domain clients maintain reliable clock synchronization for authentication and event correlation. Situation: A domain-joined server has correct credentials but Kerberos sign-in intermittently fails after its clock drifts several minutes away from the domain.

Question 48

A regulatory customer requires customer-managed keys for its Azure Windows Server managed disks but key access has not been tested. Which TWO complementary steps provide the appropriate administrative response and its supporting assessment? Select TWO.

  1. Inspect computer identity certificates or Kerberos eligibility, IPsec rule scope, security associations, network path, exemptions, and connection security logs.
  2. Selected Windows security events arrive with correct host, event IDs and timestamps and relevant detections work without collecting unnecessary sensitive logs.
  3. Encrypt supported Windows Server volumes with managed BitLocker protectors, escrow recovery information, and test safe recovery procedures before changing boot configuration.
  4. Check the VM operating system and disk encryption method, disk encryption set and key permissions, Key Vault reachability, rotation policy, and restore prerequisites.
  5. Plan supported Azure VM disk encryption at rest with managed disks, chosen encryption-at-host or customer-managed keys as required, and a tested Key Vault/recovery process for applicable configurations.

Explanation

Correct Answers

D:

Check the VM operating system and disk encryption method, disk encryption set and key permissions, Key Vault reachability, rotation policy, and restore prerequisites. This evidence tests the likely failure point before changing production configuration. Azure managed disk encryption, encryption at host, and legacy Azure Disk Encryption are distinct capabilities with compatibility and key dependencies; selecting by name alone is unsafe. The corresponding response is: Plan supported Azure VM disk encryption at rest with managed disks, chosen encryption-at-host or customer-managed keys as required, and a tested Key Vault/recovery process for applicable configurations. This is the verification prerequisite half of the pair. Situation: A regulatory customer requires customer-managed keys for its Azure Windows Server managed disks but key access has not been tested.

E:

Plan supported Azure VM disk encryption at rest with managed disks, chosen encryption-at-host or customer-managed keys as required, and a tested Key Vault/recovery process for applicable configurations. This response targets the system boundary described in the case. Azure managed disk encryption, encryption at host, and legacy Azure Disk Encryption are distinct capabilities with compatibility and key dependencies; selecting by name alone is unsafe. Before applying it, verify: Check the VM operating system and disk encryption method, disk encryption set and key permissions, Key Vault reachability, rotation policy, and restore prerequisites. This is the response half of the pair. Situation: A regulatory customer requires customer-managed keys for its Azure Windows Server managed disks but key access has not been tested.

Incorrect Answers

A:

Inspect computer identity certificates or Kerberos eligibility, IPsec rule scope, security associations, network path, exemptions, and connection security logs. This step is relevant to Windows IPsec connection security and domain isolation but is not one of the complementary steps this case needs. The intended pair is: Plan supported Azure VM disk encryption at rest with managed disks, chosen encryption-at-host or customer-managed keys as required, and a tested Key Vault/recovery process for applicable configurations. and Check the VM operating system and disk encryption method, disk encryption set and key permissions, Key Vault reachability, rotation policy, and restore prerequisites. Situation: A regulatory customer requires customer-managed keys for its Azure Windows Server managed disks but key access has not been tested.

B:

Selected Windows security events arrive with correct host, event IDs and timestamps and relevant detections work without collecting unnecessary sensitive logs. This step is relevant to Microsoft Sentinel Windows security-event ingestion but is not one of the complementary steps this case needs. The intended pair is: Plan supported Azure VM disk encryption at rest with managed disks, chosen encryption-at-host or customer-managed keys as required, and a tested Key Vault/recovery process for applicable configurations. and Check the VM operating system and disk encryption method, disk encryption set and key permissions, Key Vault reachability, rotation policy, and restore prerequisites. Situation: A regulatory customer requires customer-managed keys for its Azure Windows Server managed disks but key access has not been tested.

C:

Encrypt supported Windows Server volumes with managed BitLocker protectors, escrow recovery information, and test safe recovery procedures before changing boot configuration. This step is relevant to BitLocker recovery and protector escrow but is not one of the complementary steps this case needs. The intended pair is: Plan supported Azure VM disk encryption at rest with managed disks, chosen encryption-at-host or customer-managed keys as required, and a tested Key Vault/recovery process for applicable configurations. and Check the VM operating system and disk encryption method, disk encryption set and key permissions, Key Vault reachability, rotation policy, and restore prerequisites. Situation: A regulatory customer requires customer-managed keys for its Azure Windows Server managed disks but key access has not been tested.

Question 49

A migration dashboard shows source replication healthy, yet the operator claims users have moved before DNS and identity cutover has occurred. Which administrative configuration or response BEST addresses the primary requirement?

  1. Migrate Windows print queues/drivers or RDS session-host services using supported role-specific tools and compatibility assessment, with user mapping and licensing checks.
  2. Plan a supported cross-forest identity migration or restructure with coexistence trust, SIDHistory authorization where justified, mapped GPO/security dependencies and phased validation.
  3. Replicate supported on-premises virtual or physical servers to Azure using Azure Migrate, run an isolated test migration, and complete a planned production cutover with client and rollback validation.
  4. Deploy a supported Azure Migrate appliance to discover on-premises machines, analyze performance and dependencies, and use an assessment to size Azure targets and identify migration blockers.

Explanation

Correct Answer

C:

Replicate supported on-premises virtual or physical servers to Azure using Azure Migrate, run an isolated test migration, and complete a planned production cutover with client and rollback validation. This response targets the system boundary described in the case. A test migration checks cloud readiness without declaring a final source cutover; validation must include application connectivity and platform-specific settings. Before applying it, verify: Inspect replication health, source disk change rate, destination VM configuration, test migration network isolation, DNS cutover plan and postmigration agent status. Situation: A migration dashboard shows source replication healthy, yet the operator claims users have moved before DNS and identity cutover has occurred.

Incorrect Answers

A:

Migrate Windows print queues/drivers or RDS session-host services using supported role-specific tools and compatibility assessment, with user mapping and licensing checks. This would address Print and Remote Desktop Services host migration, not the controlling issue in this situation. Role migration must preserve client-facing connections and role-specific configuration; moving VM disks alone does not validate print drivers or RDS licensing. The targeted response is: Replicate supported on-premises virtual or physical servers to Azure using Azure Migrate, run an isolated test migration, and complete a planned production cutover with client and rollback validation. Situation: A migration dashboard shows source replication healthy, yet the operator claims users have moved before DNS and identity cutover has occurred.

B:

Plan a supported cross-forest identity migration or restructure with coexistence trust, SIDHistory authorization where justified, mapped GPO/security dependencies and phased validation. This would address New AD forest restructuring with ADMT and SIDHistory, not the controlling issue in this situation. A cross-forest account move is not a domain functional-level upgrade; legacy ACLs and identity mapping must be handled before decommissioning the source forest. The targeted response is: Replicate supported on-premises virtual or physical servers to Azure using Azure Migrate, run an isolated test migration, and complete a planned production cutover with client and rollback validation. Situation: A migration dashboard shows source replication healthy, yet the operator claims users have moved before DNS and identity cutover has occurred.

D:

Deploy a supported Azure Migrate appliance to discover on-premises machines, analyze performance and dependencies, and use an assessment to size Azure targets and identify migration blockers. This would address Azure Migrate discovery and dependency assessment, not the controlling issue in this situation. An Azure Migrate assessment is a planning artifact, not proof that a workload has been moved or that application behavior will be compatible after cutover. The targeted response is: Replicate supported on-premises virtual or physical servers to Azure using Azure Migrate, run an isolated test migration, and complete a planned production cutover with client and rollback validation. Situation: A migration dashboard shows source replication healthy, yet the operator claims users have moved before DNS and identity cutover has occurred.

Question 50

An administrator migrates a privileged group with SIDHistory enabled globally and never reviews the trust and identity exposure introduced. Which TWO complementary steps provide the appropriate administrative response and its supporting assessment? Select TWO.

  1. Plan a supported cross-forest identity migration or restructure with coexistence trust, SIDHistory authorization where justified, mapped GPO/security dependencies and phased validation.
  2. Inspect web application framework/runtime version, authentication, Windows-specific dependencies, on-premises database connections, environment settings and certificates.
  3. Inspect forest trust health, DNS name resolution, user/group membership, SIDHistory privileges and auditing, ADMT compatibility, and application ACL references.
  4. Users can access permitted printers or RDS desktops on supported target servers while incompatible drivers and licensing problems are explicitly resolved.
  5. Upgrade an existing Active Directory forest through supported domain controller replacement and schema/functional-level procedures, checking replication and SYSVOL readiness before raising functional levels.

Explanation

Correct Answers

A:

Plan a supported cross-forest identity migration or restructure with coexistence trust, SIDHistory authorization where justified, mapped GPO/security dependencies and phased validation. This response targets the system boundary described in the case. A cross-forest account move is not a domain functional-level upgrade; legacy ACLs and identity mapping must be handled before decommissioning the source forest. Before applying it, verify: Inspect forest trust health, DNS name resolution, user/group membership, SIDHistory privileges and auditing, ADMT compatibility, and application ACL references. This is the response half of the pair. Situation: An administrator migrates a privileged group with SIDHistory enabled globally and never reviews the trust and identity exposure introduced.

C:

Inspect forest trust health, DNS name resolution, user/group membership, SIDHistory privileges and auditing, ADMT compatibility, and application ACL references. This evidence tests the likely failure point before changing production configuration. A cross-forest account move is not a domain functional-level upgrade; legacy ACLs and identity mapping must be handled before decommissioning the source forest. The corresponding response is: Plan a supported cross-forest identity migration or restructure with coexistence trust, SIDHistory authorization where justified, mapped GPO/security dependencies and phased validation. This is the verification prerequisite half of the pair. Situation: An administrator migrates a privileged group with SIDHistory enabled globally and never reviews the trust and identity exposure introduced.

Incorrect Answers

B:

Inspect web application framework/runtime version, authentication, Windows-specific dependencies, on-premises database connections, environment settings and certificates. This step is relevant to Azure App Service migration for compatible IIS applications but is not one of the complementary steps this case needs. The intended pair is: Plan a supported cross-forest identity migration or restructure with coexistence trust, SIDHistory authorization where justified, mapped GPO/security dependencies and phased validation. and Inspect forest trust health, DNS name resolution, user/group membership, SIDHistory privileges and auditing, ADMT compatibility, and application ACL references. Situation: An administrator migrates a privileged group with SIDHistory enabled globally and never reviews the trust and identity exposure introduced.

D:

Users can access permitted printers or RDS desktops on supported target servers while incompatible drivers and licensing problems are explicitly resolved. This step is relevant to Print and Remote Desktop Services host migration but is not one of the complementary steps this case needs. The intended pair is: Plan a supported cross-forest identity migration or restructure with coexistence trust, SIDHistory authorization where justified, mapped GPO/security dependencies and phased validation. and Inspect forest trust health, DNS name resolution, user/group membership, SIDHistory privileges and auditing, ADMT compatibility, and application ACL references. Situation: An administrator migrates a privileged group with SIDHistory enabled globally and never reviews the trust and identity exposure introduced.

E:

Upgrade an existing Active Directory forest through supported domain controller replacement and schema/functional-level procedures, checking replication and SYSVOL readiness before raising functional levels. This step is relevant to In-place AD DS forest upgrade and SYSVOL prerequisite checks but is not one of the complementary steps this case needs. The intended pair is: Plan a supported cross-forest identity migration or restructure with coexistence trust, SIDHistory authorization where justified, mapped GPO/security dependencies and phased validation. and Inspect forest trust health, DNS name resolution, user/group membership, SIDHistory privileges and auditing, ADMT compatibility, and application ACL references. Situation: An administrator migrates a privileged group with SIDHistory enabled globally and never reviews the trust and identity exposure introduced.

Configuring Windows Server Hybrid Advanced Services (AZ-801) Practice Tests