cert
cert-1
cert-2

Pass Microsoft AZ-801 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-801 Exam - Verified By Experts
AZ-801 Premium Bundle
$29.98

AZ-801 Premium Bundle

$79.99
$109.97
  • Premium File 326 Questions & Answers. Last update: Nov 02, 2026
  • Training Course 122 Video Lectures
  • Study Guide 387 Pages
 
$109.97
$79.99
accept 31 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-801 Exam Training Products Individually
Microsoft AZ-801 Premium File
Premium File 326 Q&A
$76.99$69.99
Microsoft AZ-801 Video Training Course
Training Course 122 Lectures
$21.99 $19.99
Microsoft AZ-801 PDF Study Guide
Study Guide 387 Pages
$21.99 $19.99
Microsoft AZ-801 Practice Test 56

Question 550

A hybrid IT team created a Sentinel workspace but no security events arrive from its Arc-enabled domain controllers. Which administrative configuration or response BEST addresses the primary requirement?

  1. Connect the appropriate Windows security events to a Microsoft Sentinel-enabled Log Analytics workspace using supported collection mechanisms and validated data collection rules.
  2. Create tested connection security rules for domain isolation and required authenticated server-to-server IPsec, with planned exemptions for unmanaged systems.
  3. Install and health-check Microsoft Defender for Identity sensors on supported domain controllers and correlate identity threat detections with actual directory activity.
  4. Plan supported Azure VM disk encryption at rest with managed disks, chosen encryption-at-host or customer-managed keys as required, and a tested Key Vault/recovery process for applicable configurations.

Explanation

Correct Answer

A:

Connect the appropriate Windows security events to a Microsoft Sentinel-enabled Log Analytics workspace using supported collection mechanisms and validated data collection rules. This response targets the system boundary described in the case. A Sentinel workspace alone does not ingest on-premises server logs; collection rules and healthy agents establish the signal path. Before applying it, verify: Inspect Azure Monitor Agent and Arc prerequisites, DCR association, event channel selection, workspace destination, ingestion latency, and KQL query results. Situation: A hybrid IT team created a Sentinel workspace but no security events arrive from its Arc-enabled domain controllers.

Incorrect Answers

B:

Create tested connection security rules for domain isolation and required authenticated server-to-server IPsec, with planned exemptions for unmanaged systems. This would address Windows IPsec connection security and domain isolation, not the controlling issue in this situation. Connection security rules authenticate or protect IP traffic independently of simple port allow rules; endpoints must agree on authentication and policy. The targeted response is: Connect the appropriate Windows security events to a Microsoft Sentinel-enabled Log Analytics workspace using supported collection mechanisms and validated data collection rules. Situation: A hybrid IT team created a Sentinel workspace but no security events arrive from its Arc-enabled domain controllers.

C:

Install and health-check Microsoft Defender for Identity sensors on supported domain controllers and correlate identity threat detections with actual directory activity. This would address Defender for Identity domain controller signals, not the controlling issue in this situation. Defender for Identity detects suspicious directory-related behavior based on collected signals; a silent or disconnected sensor is not proof of a safe domain. The targeted response is: Connect the appropriate Windows security events to a Microsoft Sentinel-enabled Log Analytics workspace using supported collection mechanisms and validated data collection rules. Situation: A hybrid IT team created a Sentinel workspace but no security events arrive from its Arc-enabled domain controllers.

D:

Plan supported Azure VM disk encryption at rest with managed disks, chosen encryption-at-host or customer-managed keys as required, and a tested Key Vault/recovery process for applicable configurations. This would address Azure VM disk encryption keys and recovery, not the controlling issue in this situation. Azure managed disk encryption, encryption at host, and legacy Azure Disk Encryption are distinct capabilities with compatibility and key dependencies; selecting by name alone is unsafe. The targeted response is: Connect the appropriate Windows security events to a Microsoft Sentinel-enabled Log Analytics workspace using supported collection mechanisms and validated data collection rules. Situation: A hybrid IT team created a Sentinel workspace but no security events arrive from its Arc-enabled domain controllers.

Question 551

A privileged service account can obtain Kerberos tickets from ordinary employee workstations despite being intended only for a protected admin tier. Which administrative configuration or response BEST addresses the primary requirement?

  1. Apply minimal Azure Network Security Group rules at the appropriate subnet and network interface scope, and diagnose actual effective security rules and routes before changing access.
  2. Use Windows Defender Firewall with Advanced Security to enforce role-specific inbound rules on the effective domain/private/public profile, keeping administrative ports limited to approved sources.
  3. Inventory NTLM authentication paths and privilege-tier boundaries, enforce authentication policy silos for supported high-value accounts, and phase out unsafe NTLM dependencies after testing.
  4. Deploy Microsoft Entra Password Protection for on-premises AD DS with appropriate proxy/DC agents and a tested audit-to-enforce change, while separating it from Protected Users restrictions.

Explanation

Correct Answer

C:

Inventory NTLM authentication paths and privilege-tier boundaries, enforce authentication policy silos for supported high-value accounts, and phase out unsafe NTLM dependencies after testing. This response targets the system boundary described in the case. A domain-wide NTLM disable without usage discovery can break legacy systems; authentication policy silos narrow where sensitive accounts may authenticate. Before applying it, verify: Review domain controller NTLM audit logs, service account SPNs, Kerberos ticket paths, authentication policy assignments, client OS compatibility, and privileged login locations. Situation: A privileged service account can obtain Kerberos tickets from ordinary employee workstations despite being intended only for a protected admin tier.

Incorrect Answers

A:

Apply minimal Azure Network Security Group rules at the appropriate subnet and network interface scope, and diagnose actual effective security rules and routes before changing access. This would address Azure NSG effective rules for Windows Server VMs, not the controlling issue in this situation. Azure NSG rules are prioritized and applied to virtual network paths; a Windows guest firewall or a different attached NSG can still affect traffic. The targeted response is: Inventory NTLM authentication paths and privilege-tier boundaries, enforce authentication policy silos for supported high-value accounts, and phase out unsafe NTLM dependencies after testing. Situation: A privileged service account can obtain Kerberos tickets from ordinary employee workstations despite being intended only for a protected admin tier.

B:

Use Windows Defender Firewall with Advanced Security to enforce role-specific inbound rules on the effective domain/private/public profile, keeping administrative ports limited to approved sources. This would address Windows Defender Firewall profile and inbound exposure, not the controlling issue in this situation. An inbound rule must match actual profile, direction, ports and source; disabling all profiles to repair one application creates unnecessary exposure. The targeted response is: Inventory NTLM authentication paths and privilege-tier boundaries, enforce authentication policy silos for supported high-value accounts, and phase out unsafe NTLM dependencies after testing. Situation: A privileged service account can obtain Kerberos tickets from ordinary employee workstations despite being intended only for a protected admin tier.

D:

Deploy Microsoft Entra Password Protection for on-premises AD DS with appropriate proxy/DC agents and a tested audit-to-enforce change, while separating it from Protected Users restrictions. This would address Microsoft Entra Password Protection with Protected Users, not the controlling issue in this situation. Password Protection assesses password changes against banned values; Protected Users adds authentication restrictions and does not itself provide a banned-password service. The targeted response is: Inventory NTLM authentication paths and privilege-tier boundaries, enforce authentication policy silos for supported high-value accounts, and phase out unsafe NTLM dependencies after testing. Situation: A privileged service account can obtain Kerberos tickets from ordinary employee workstations despite being intended only for a protected admin tier.

Question 552

A storage team adds a node and expects data distribution to balance immediately without checking repair or rebalance jobs. Before changing the system, which evidence should the administrator examine FIRST?

  1. Review number of nodes, storage resiliency setting, mirror/parity layout, storage fault domains, capacity forecast and rebalance status.
  2. Review cluster validation tests, IP resource dependencies, DNS registration, preferred owner settings, network adapter roles, and application client reconnect logs.
  3. Inspect certified storage and network hardware, disks per node, fault domains, Storage Spaces Direct health, SMB paths, and application disk ownership.
  4. Inspect Get-StoragePool/Get-PhysicalDisk/Get-VirtualDisk health, available capacity, cluster events, repair jobs, and placement/fault-domain warnings.

Explanation

Correct Answer

A:

Review number of nodes, storage resiliency setting, mirror/parity layout, storage fault domains, capacity forecast and rebalance status. This evidence tests the likely failure point before changing production configuration. Two-way and three-way mirroring and parity have different fault tolerance and capacity costs; the best layout depends on eligible node count and workload behavior. The corresponding response is: Select S2D resiliency and volume layout for expected workloads and node count, balancing performance, fault tolerance and capacity before expanding or rebalancing a cluster. Situation: A storage team adds a node and expects data distribution to balance immediately without checking repair or rebalance jobs.

Incorrect Answers

B:

Review cluster validation tests, IP resource dependencies, DNS registration, preferred owner settings, network adapter roles, and application client reconnect logs. This examines Failover cluster roles, client access and network configuration, a different fault or management boundary. For this case the decisive evidence is: Review number of nodes, storage resiliency setting, mirror/parity layout, storage fault domains, capacity forecast and rebalance status. Situation: A storage team adds a node and expects data distribution to balance immediately without checking repair or rebalance jobs.

C:

Inspect certified storage and network hardware, disks per node, fault domains, Storage Spaces Direct health, SMB paths, and application disk ownership. This examines Storage Spaces Direct stretched cluster and file share resilience, a different fault or management boundary. For this case the decisive evidence is: Review number of nodes, storage resiliency setting, mirror/parity layout, storage fault domains, capacity forecast and rebalance status. Situation: A storage team adds a node and expects data distribution to balance immediately without checking repair or rebalance jobs.

D:

Inspect Get-StoragePool/Get-PhysicalDisk/Get-VirtualDisk health, available capacity, cluster events, repair jobs, and placement/fault-domain warnings. This examines S2D storage pool repair and capacity planning, a different fault or management boundary. For this case the decisive evidence is: Review number of nodes, storage resiliency setting, mirror/parity layout, storage fault domains, capacity forecast and rebalance status. Situation: A storage team adds a node and expects data distribution to balance immediately without checking repair or rebalance jobs.

Question 553

A Hyper-V host shows low average CPU yet guest disk transactions stall, so the team needs correlated disk latency and memory data. Which TWO complementary steps provide the appropriate administrative response and its supporting assessment? Select TWO.

  1. Inspect CPU processor queue, memory commit and paging, logical disk latency and queue, network throughput, data collector schedule and workload timing.
  2. Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot.
  3. Use Windows Admin Center, Windows Event Viewer and System Insights to correlate historical server events with predictive local capacity trends and configure practical administrative alerts.
  4. Inspect Recycle Bin enablement and deleted-object lifetime, system-state backups, deletion scope, replication state, and authoritative versus nonauthoritative recovery requirements.
  5. A test Group Policy update reaches intended domain controllers and hybrid identity updates flow to Microsoft Entra ID with no unexplained failures.

Explanation

Correct Answers

A:

Inspect CPU processor queue, memory commit and paging, logical disk latency and queue, network throughput, data collector schedule and workload timing. This evidence tests the likely failure point before changing production configuration. A single instantaneous CPU percentage does not prove the cause of slow application response; performance diagnosis needs aligned counters and load context. The corresponding response is: Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. This is the verification prerequisite half of the pair. Situation: A Hyper-V host shows low average CPU yet guest disk transactions stall, so the team needs correlated disk latency and memory data.

B:

Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. This response targets the system boundary described in the case. A single instantaneous CPU percentage does not prove the cause of slow application response; performance diagnosis needs aligned counters and load context. Before applying it, verify: Inspect CPU processor queue, memory commit and paging, logical disk latency and queue, network throughput, data collector schedule and workload timing. This is the response half of the pair. Situation: A Hyper-V host shows low average CPU yet guest disk transactions stall, so the team needs correlated disk latency and memory data.

Incorrect Answers

C:

Use Windows Admin Center, Windows Event Viewer and System Insights to correlate historical server events with predictive local capacity trends and configure practical administrative alerts. This step is relevant to Windows Admin Center event logs and System Insights but is not one of the complementary steps this case needs. The intended pair is: Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. and Inspect CPU processor queue, memory commit and paging, logical disk latency and queue, network throughput, data collector schedule and workload timing. Situation: A Hyper-V host shows low average CPU yet guest disk transactions stall, so the team needs correlated disk latency and memory data.

D:

Inspect Recycle Bin enablement and deleted-object lifetime, system-state backups, deletion scope, replication state, and authoritative versus nonauthoritative recovery requirements. This step is relevant to AD Recycle Bin versus DSRM directory recovery but is not one of the complementary steps this case needs. The intended pair is: Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. and Inspect CPU processor queue, memory commit and paging, logical disk latency and queue, network throughput, data collector schedule and workload timing. Situation: A Hyper-V host shows low average CPU yet guest disk transactions stall, so the team needs correlated disk latency and memory data.

E:

A test Group Policy update reaches intended domain controllers and hybrid identity updates flow to Microsoft Entra ID with no unexplained failures. This step is relevant to SYSVOL DFSR and hybrid synchronization troubleshooting but is not one of the complementary steps this case needs. The intended pair is: Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. and Inspect CPU processor queue, memory commit and paging, logical disk latency and queue, network throughput, data collector schedule and workload timing. Situation: A Hyper-V host shows low average CPU yet guest disk transactions stall, so the team needs correlated disk latency and memory data.

Question 554

A municipal print server replacement copies spool files but its queues point to deprecated TCP/IP printer ports. Which observed result BEST demonstrates that the intended outcome has been achieved?

  1. The Azure VM starts in the intended network with correct data and app dependencies, and final switchover is tracked without leaving two writable production copies.
  2. Users can access migrated shares with the original intended permissions and file content before old server identity is retired.
  3. Users can access permitted printers or RDS desktops on supported target servers while incompatible drivers and licensing problems are explicitly resolved.
  4. Clients obtain correct leases from the new authorized DHCP server without overlapping scope conflicts, missing reservations or persistent references to the retired service.

Explanation

Correct Answer

C:

Users can access permitted printers or RDS desktops on supported target servers while incompatible drivers and licensing problems are explicitly resolved. This is an observable acceptance condition, not merely evidence that a feature was enabled. Role migration must preserve client-facing connections and role-specific configuration; moving VM disks alone does not validate print drivers or RDS licensing. Situation: A municipal print server replacement copies spool files but its queues point to deprecated TCP/IP printer ports.

Incorrect Answers

A:

The Azure VM starts in the intended network with correct data and app dependencies, and final switchover is tracked without leaving two writable production copies. This tests Azure Migrate test migration and production cutover, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Users can access permitted printers or RDS desktops on supported target servers while incompatible drivers and licensing problems are explicitly resolved. Situation: A municipal print server replacement copies spool files but its queues point to deprecated TCP/IP printer ports.

B:

Users can access migrated shares with the original intended permissions and file content before old server identity is retired. This tests Storage Migration Service inventory and file-share ACL transfer, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Users can access permitted printers or RDS desktops on supported target servers while incompatible drivers and licensing problems are explicitly resolved. Situation: A municipal print server replacement copies spool files but its queues point to deprecated TCP/IP printer ports.

D:

Clients obtain correct leases from the new authorized DHCP server without overlapping scope conflicts, missing reservations or persistent references to the retired service. This tests DHCP Server migration and authorization, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: Users can access permitted printers or RDS desktops on supported target servers while incompatible drivers and licensing problems are explicitly resolved. Situation: A municipal print server replacement copies spool files but its queues point to deprecated TCP/IP printer ports.

Question 555

A security team suppresses identity alerts because a privileged directory synchronization account was not documented as an authorized service identity. Which administrative configuration or response BEST addresses the primary requirement?

  1. Install and health-check Microsoft Defender for Identity sensors on supported domain controllers and correlate identity threat detections with actual directory activity.
  2. Inventory NTLM authentication paths and privilege-tier boundaries, enforce authentication policy silos for supported high-value accounts, and phase out unsafe NTLM dependencies after testing.
  3. Onboard eligible on-premises Windows Servers through Azure Arc and the correct Microsoft Defender for Servers plan, then verify agent health, recommendations and security coverage.
  4. Use Windows Defender Firewall with Advanced Security to enforce role-specific inbound rules on the effective domain/private/public profile, keeping administrative ports limited to approved sources.

Explanation

Correct Answer

A:

Install and health-check Microsoft Defender for Identity sensors on supported domain controllers and correlate identity threat detections with actual directory activity. This response targets the system boundary described in the case. Defender for Identity detects suspicious directory-related behavior based on collected signals; a silent or disconnected sensor is not proof of a safe domain. Before applying it, verify: Review sensor service status, packet and authentication event visibility, domain controller audit configuration, identity correlation, and alert evidence. Situation: A security team suppresses identity alerts because a privileged directory synchronization account was not documented as an authorized service identity.

Incorrect Answers

B:

Inventory NTLM authentication paths and privilege-tier boundaries, enforce authentication policy silos for supported high-value accounts, and phase out unsafe NTLM dependencies after testing. This would address NTLM audit and authentication policy silo hardening, not the controlling issue in this situation. A domain-wide NTLM disable without usage discovery can break legacy systems; authentication policy silos narrow where sensitive accounts may authenticate. The targeted response is: Install and health-check Microsoft Defender for Identity sensors on supported domain controllers and correlate identity threat detections with actual directory activity. Situation: A security team suppresses identity alerts because a privileged directory synchronization account was not documented as an authorized service identity.

C:

Onboard eligible on-premises Windows Servers through Azure Arc and the correct Microsoft Defender for Servers plan, then verify agent health, recommendations and security coverage. This would address Defender for Servers onboarding and Azure Arc posture, not the controlling issue in this situation. Azure Arc provides an Azure management plane for non-Azure servers; Defender for Servers capabilities require correct plan and component enrollment beyond Arc registration. The targeted response is: Install and health-check Microsoft Defender for Identity sensors on supported domain controllers and correlate identity threat detections with actual directory activity. Situation: A security team suppresses identity alerts because a privileged directory synchronization account was not documented as an authorized service identity.

D:

Use Windows Defender Firewall with Advanced Security to enforce role-specific inbound rules on the effective domain/private/public profile, keeping administrative ports limited to approved sources. This would address Windows Defender Firewall profile and inbound exposure, not the controlling issue in this situation. An inbound rule must match actual profile, direction, ports and source; disabling all profiles to repair one application creates unnecessary exposure. The targeted response is: Install and health-check Microsoft Defender for Identity sensors on supported domain controllers and correlate identity threat detections with actual directory activity. Situation: A security team suppresses identity alerts because a privileged directory synchronization account was not documented as an authorized service identity.

Question 556

A remote office demands a five-minute RPO but its Site Recovery policy and measured replication lag do not support the objective. Which TWO complementary steps provide the appropriate administrative response and its supporting assessment? Select TWO.

  1. Enable supported Azure Site Recovery replication for eligible VMs and configure target location, replication policies, storage, networking and test failover isolation according to RPO/RTO needs.
  2. Build an Azure Site Recovery recovery plan that sequences identity, database and application recovery groups with scripts or runbooks where appropriate, and rehearse failover and failback.
  3. Inspect source VM eligibility, replication health, recovery point history, target region, network mappings, IP addressing, and storage replication settings.
  4. Inspect recovery point type, snapshot and vault tiers, encrypted disk keys/Key Vault permissions, VM extensions, destination network, and restore permissions.
  5. Existing SMB UNC client paths resolve to the replacement and source server is safely retired or isolated without simultaneous identity conflicts.

Explanation

Correct Answers

A:

Enable supported Azure Site Recovery replication for eligible VMs and configure target location, replication policies, storage, networking and test failover isolation according to RPO/RTO needs. This response targets the system boundary described in the case. Azure Site Recovery orchestrates replication and failover but application dependencies, DNS and network mapping must be planned separately from raw VM replication. Before applying it, verify: Inspect source VM eligibility, replication health, recovery point history, target region, network mappings, IP addressing, and storage replication settings. This is the response half of the pair. Situation: A remote office demands a five-minute RPO but its Site Recovery policy and measured replication lag do not support the objective.

C:

Inspect source VM eligibility, replication health, recovery point history, target region, network mappings, IP addressing, and storage replication settings. This evidence tests the likely failure point before changing production configuration. Azure Site Recovery orchestrates replication and failover but application dependencies, DNS and network mapping must be planned separately from raw VM replication. The corresponding response is: Enable supported Azure Site Recovery replication for eligible VMs and configure target location, replication policies, storage, networking and test failover isolation according to RPO/RTO needs. This is the verification prerequisite half of the pair. Situation: A remote office demands a five-minute RPO but its Site Recovery policy and measured replication lag do not support the objective.

Incorrect Answers

B:

Build an Azure Site Recovery recovery plan that sequences identity, database and application recovery groups with scripts or runbooks where appropriate, and rehearse failover and failback. This step is relevant to Site Recovery recovery-plan ordering and controlled failover but is not one of the complementary steps this case needs. The intended pair is: Enable supported Azure Site Recovery replication for eligible VMs and configure target location, replication policies, storage, networking and test failover isolation according to RPO/RTO needs. and Inspect source VM eligibility, replication health, recovery point history, target region, network mappings, IP addressing, and storage replication settings. Situation: A remote office demands a five-minute RPO but its Site Recovery policy and measured replication lag do not support the objective.

D:

Inspect recovery point type, snapshot and vault tiers, encrypted disk keys/Key Vault permissions, VM extensions, destination network, and restore permissions. This step is relevant to Azure VM backup and encrypted snapshot recovery but is not one of the complementary steps this case needs. The intended pair is: Enable supported Azure Site Recovery replication for eligible VMs and configure target location, replication policies, storage, networking and test failover isolation according to RPO/RTO needs. and Inspect source VM eligibility, replication health, recovery point history, target region, network mappings, IP addressing, and storage replication settings. Situation: A remote office demands a five-minute RPO but its Site Recovery policy and measured replication lag do not support the objective.

E:

Existing SMB UNC client paths resolve to the replacement and source server is safely retired or isolated without simultaneous identity conflicts. This step is relevant to Storage Migration Service cutover server identity but is not one of the complementary steps this case needs. The intended pair is: Enable supported Azure Site Recovery replication for eligible VMs and configure target location, replication policies, storage, networking and test failover isolation according to RPO/RTO needs. and Inspect source VM eligibility, replication health, recovery point history, target region, network mappings, IP addressing, and storage replication settings. Situation: A remote office demands a five-minute RPO but its Site Recovery policy and measured replication lag do not support the objective.

Question 557

An operator plans a production failover without rehearsing DNS cutover or validating the site's recovery plan group ordering. Which observed result BEST demonstrates that the intended outcome has been achieved?

  1. A requested folder or supported server state restores from a retained recovery point to an authorized location with content and permissions verified.
  2. Affected domain controllers exchange expected directory updates without new replication errors and site convergence is verified after the fix.
  3. A documented test failover starts required dependencies before application tiers and verifies service functionality without disrupting primary production.
  4. A test failover creates a reachable isolated VM at the intended recovery site with correct identity and validated replication point, leaving production running.

Explanation

Correct Answer

C:

A documented test failover starts required dependencies before application tiers and verifies service functionality without disrupting primary production. This is an observable acceptance condition, not merely evidence that a feature was enabled. Successful replication of each VM is not sufficient for multi-tier disaster recovery; orchestrated dependency order and test execution are essential. Situation: An operator plans a production failover without rehearsing DNS cutover or validating the site's recovery plan group ordering.

Incorrect Answers

A:

A requested folder or supported server state restores from a retained recovery point to an authorized location with content and permissions verified. This tests Azure Backup vault policy and MARS agent protection, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: A documented test failover starts required dependencies before application tiers and verifies service functionality without disrupting primary production. Situation: An operator plans a production failover without rehearsing DNS cutover or validating the site's recovery plan group ordering.

B:

Affected domain controllers exchange expected directory updates without new replication errors and site convergence is verified after the fix. This tests AD replication topology and lingering errors, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: A documented test failover starts required dependencies before application tiers and verifies service functionality without disrupting primary production. Situation: An operator plans a production failover without rehearsing DNS cutover or validating the site's recovery plan group ordering.

D:

A test failover creates a reachable isolated VM at the intended recovery site with correct identity and validated replication point, leaving production running. This tests Azure Site Recovery policy and network mapping, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: A documented test failover starts required dependencies before application tiers and verifies service functionality without disrupting primary production. Situation: An operator plans a production failover without rehearsing DNS cutover or validating the site's recovery plan group ordering.

Question 558

A Windows-only .NET Framework application is packaged into a Linux container image and fails to load its required runtime. Which observed result BEST demonstrates that the intended outcome has been achieved?

  1. A staged container runs the intended IIS application with repeatable deployment and external durable state while unsupported system-level dependencies are identified.
  2. Clients obtain correct leases from the new authorized DHCP server without overlapping scope conflicts, missing reservations or persistent references to the retired service.
  3. Users can access migrated shares with the original intended permissions and file content before old server identity is retired.
  4. The App Service-hosted application responds correctly with authenticated users and stable backing data, without writing required persistent content to ephemeral local storage.

Explanation

Correct Answer

A:

A staged container runs the intended IIS application with repeatable deployment and external durable state while unsupported system-level dependencies are identified. This is an observable acceptance condition, not merely evidence that a feature was enabled. Containerizing IIS does not automatically modernize legacy APIs or kernel-dependent components; Windows container versions and host requirements constrain portability. Situation: A Windows-only.NET Framework application is packaged into a Linux container image and fails to load its required runtime.

Incorrect Answers

B:

Clients obtain correct leases from the new authorized DHCP server without overlapping scope conflicts, missing reservations or persistent references to the retired service. This tests DHCP Server migration and authorization, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: A staged container runs the intended IIS application with repeatable deployment and external durable state while unsupported system-level dependencies are identified. Situation: A Windows-only.NET Framework application is packaged into a Linux container image and fails to load its required runtime.

C:

Users can access migrated shares with the original intended permissions and file content before old server identity is retired. This tests Storage Migration Service inventory and file-share ACL transfer, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: A staged container runs the intended IIS application with repeatable deployment and external durable state while unsupported system-level dependencies are identified. Situation: A Windows-only.NET Framework application is packaged into a Linux container image and fails to load its required runtime.

D:

The App Service-hosted application responds correctly with authenticated users and stable backing data, without writing required persistent content to ephemeral local storage. This tests Azure App Service migration for compatible IIS applications, but does not demonstrate that the requested outcome is satisfied. The relevant acceptance test is: A staged container runs the intended IIS application with repeatable deployment and external durable state while unsupported system-level dependencies are identified. Situation: A Windows-only.NET Framework application is packaged into a Linux container image and fails to load its required runtime.

Question 559

A storage team adds a node and expects data distribution to balance immediately without checking repair or rebalance jobs. Which administrative configuration or response BEST addresses the primary requirement?

  1. Select S2D resiliency and volume layout for expected workloads and node count, balancing performance, fault tolerance and capacity before expanding or rebalancing a cluster.
  2. Diagnose Storage Spaces Direct virtual disks, physical disk health and reserve capacity before repairing failed media or adding nodes, respecting resiliency and fault domains.
  3. Perform supported rolling upgrades of Windows Server failover cluster nodes, preserving workload compatibility and deferring cluster functional-level upgrade until rollback requirements are resolved.
  4. Implement supported clustered roles with correctly configured client access points, floating addresses where applicable, network roles, shared storage, and validated failover dependencies.

Explanation

Correct Answer

A:

Select S2D resiliency and volume layout for expected workloads and node count, balancing performance, fault tolerance and capacity before expanding or rebalancing a cluster. This response targets the system boundary described in the case. Two-way and three-way mirroring and parity have different fault tolerance and capacity costs; the best layout depends on eligible node count and workload behavior. Before applying it, verify: Review number of nodes, storage resiliency setting, mirror/parity layout, storage fault domains, capacity forecast and rebalance status. Situation: A storage team adds a node and expects data distribution to balance immediately without checking repair or rebalance jobs.

Incorrect Answers

B:

Diagnose Storage Spaces Direct virtual disks, physical disk health and reserve capacity before repairing failed media or adding nodes, respecting resiliency and fault domains. This would address S2D storage pool repair and capacity planning, not the controlling issue in this situation. A mirrored storage pool needs spare capacity and correct fault-domain placement to rebuild after failure; free logical volume space alone is not enough. The targeted response is: Select S2D resiliency and volume layout for expected workloads and node count, balancing performance, fault tolerance and capacity before expanding or rebalancing a cluster. Situation: A storage team adds a node and expects data distribution to balance immediately without checking repair or rebalance jobs.

C:

Perform supported rolling upgrades of Windows Server failover cluster nodes, preserving workload compatibility and deferring cluster functional-level upgrade until rollback requirements are resolved. This would address Rolling OS upgrade and cluster functional level, not the controlling issue in this situation. A cluster functional-level upgrade changes interoperability and rollback conditions; upgrading one member is not identical to committing the entire cluster to new behavior. The targeted response is: Select S2D resiliency and volume layout for expected workloads and node count, balancing performance, fault tolerance and capacity before expanding or rebalancing a cluster. Situation: A storage team adds a node and expects data distribution to balance immediately without checking repair or rebalance jobs.

D:

Implement supported clustered roles with correctly configured client access points, floating addresses where applicable, network roles, shared storage, and validated failover dependencies. This would address Failover cluster roles, client access and network configuration, not the controlling issue in this situation. Failover clustering manages designated resources and dependencies; healthy nodes alone do not guarantee clients can resolve a virtual name or reach a floating IP. The targeted response is: Select S2D resiliency and volume layout for expected workloads and node count, balancing performance, fault tolerance and capacity before expanding or rebalancing a cluster. Situation: A storage team adds a node and expects data distribution to balance immediately without checking repair or rebalance jobs.

Question 560

A newly promoted domain controller is configured with arbitrary external NTP peers instead of following the intended domain time hierarchy. Which administrative configuration or response BEST addresses the primary requirement?

  1. Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot.
  2. Use Windows Admin Center, Windows Event Viewer and System Insights to correlate historical server events with predictive local capacity trends and configure practical administrative alerts.
  3. Troubleshoot Windows Server network paths and name resolution in sequence using DNS records, client resolver configuration, firewall and routing evidence, and test names rather than assuming service failure.
  4. Diagnose Windows Update scan, delivery and servicing errors together with Windows Time Service hierarchy and Kerberos clock-skew failures before resetting services or changing policy.

Explanation

Correct Answer

D:

Diagnose Windows Update scan, delivery and servicing errors together with Windows Time Service hierarchy and Kerberos clock-skew failures before resetting services or changing policy. This response targets the system boundary described in the case. Domain time skew can break Kerberos independently of update delivery; blindly changing all NTP peers or clearing update caches can conceal root causes. Before applying it, verify: Inspect update service policy, error codes and servicing logs, WSUS or internet endpoint connectivity, w32tm status/peers, time offset, and domain controller time hierarchy. Situation: A newly promoted domain controller is configured with arbitrary external NTP peers instead of following the intended domain time hierarchy.

Incorrect Answers

A:

Use Windows Performance Monitor with reproducible Data Collector Sets to capture counter baselines over representative load and diagnose resource bottlenecks without guessing from one snapshot. This would address Performance Monitor baseline and Data Collector Sets, not the controlling issue in this situation. A single instantaneous CPU percentage does not prove the cause of slow application response; performance diagnosis needs aligned counters and load context. The targeted response is: Diagnose Windows Update scan, delivery and servicing errors together with Windows Time Service hierarchy and Kerberos clock-skew failures before resetting services or changing policy. Situation: A newly promoted domain controller is configured with arbitrary external NTP peers instead of following the intended domain time hierarchy.

B:

Use Windows Admin Center, Windows Event Viewer and System Insights to correlate historical server events with predictive local capacity trends and configure practical administrative alerts. This would address Windows Admin Center event logs and System Insights, not the controlling issue in this situation. System Insights forecasts from collected local performance data, whereas event logs record actual events; prediction is supporting evidence, not incident confirmation. The targeted response is: Diagnose Windows Update scan, delivery and servicing errors together with Windows Time Service hierarchy and Kerberos clock-skew failures before resetting services or changing policy. Situation: A newly promoted domain controller is configured with arbitrary external NTP peers instead of following the intended domain time hierarchy.

C:

Troubleshoot Windows Server network paths and name resolution in sequence using DNS records, client resolver configuration, firewall and routing evidence, and test names rather than assuming service failure. This would address Windows DNS and network connectivity troubleshooting, not the controlling issue in this situation. Name resolution, TCP reachability and application authentication are separate diagnostic layers; a ping success alone is not proof that an application port is open. The targeted response is: Diagnose Windows Update scan, delivery and servicing errors together with Windows Time Service hierarchy and Kerberos clock-skew failures before resetting services or changing policy. Situation: A newly promoted domain controller is configured with arbitrary external NTP peers instead of following the intended domain time hierarchy.

Configuring Windows Server Hybrid Advanced Services (AZ-801) Practice Tests