AZ-800 Online Practice Questions and Answers

Correct Answer: C

Correct Answer: C

Enable Azure AD users to sign in to Server1.

Sever1 is a Windows Server 2022 Datacenter. Azure Edition server with Trusted launch running in a Virtual machine.

Set-AzVMExtension

Updates extension properties or adds an extension to a virtual machine.

Description

The Set-AzVMExtension cmdlet updates properties for existing Virtual Machine Extensions or adds an extension to a virtual machine.

Note: Enable Azure AD login for a Windows VM in Azure

To use Azure AD login for a Windows VM in Azure, you must:

Enable the Azure AD login option for the VM.

Configure Azure role assignments for users who are authorized to log in to the VM.

There are two ways to enable Azure AD login for your Windows VM:

The Azure portal, when you're creating a Windows VM.

Azure Cloud Shell, when you're creating a Windows VM or using an existing Windows VM.

Install the Azure AD login VM extension to enable Azure AD login for Windows VMs. VM extensions are small applications that provide post-deployment configuration and automation tasks on Azure virtual machines. Use az vm extension set

to install the AADLoginForWindows extension on the VM named myVM in the myResourceGroup resource group.

The following example uses the Azure CLI to install the extension:

AzureCLI

az vm extension set \ --publisher Microsoft.Azure.ActiveDirectory \ --name AADLoginForWindows \ --resource-group myResourceGroup \ --vm-name myVM

Reference: https://learn.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows https://learn.microsoft.com/en-us/powershell/module/az.compute/set-azvmextension

Correct Answer: A

Step 1: Sign in to the Azure portal in the User Administrator role for the organization.

Add a new user

You can create a new user using the Azure Active Directory portal.

To add a new user, follow these steps:

Step 1. Sign in to the Azure portal in the User Administrator role for the organization.

Step 2: Search for and select Azure Active Directory from any page.

Step 3: Select Users, and then select New user.

Step 4: On the User page, enter information for this user:

Name: Admin1

User name: Admin1

Groups. Optional

Groups. Optional: Backup Operator

Step 5: Copy the autogenerated password provided in the Password box. You'll need to give this password to the user to sign in for the first time.

Step 6: Select Create.

The user is created and added to your Azure AD organization.

Note:

Azure Backup provides three built-in roles to control backup management operations.

Backup Operator - This role has permissions to everything a contributor does except removing backup and managing backup policies. This role is equivalent to contributor except it can't perform destructive operations such as stop backup

with delete data or remove registration of on-premises resources.

Incorrect:

Backup Contributor - This role has all permissions to create and manage backup except deleting Recovery Services vault and giving access to others. Imagine this role as admin of backup management who can do every backup management

operation.

Backup Reader - This role has permissions to view all backup management operations. Imagine this role to be a monitoring person.

Reference:

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/add-users-azure-active-directory

https://learn.microsoft.com/en-us/azure/backup/backup-rbac-rs-vault

Correct Answer: A

Create policies The DHCP Policy Configuration Wizard will be used to create a unique policy for SRV1. A policy configured for an individual computer is not typical and is only configured for demonstration purposes. On a corporate network, you can use wildcards and other conditions to match multiple DHCP client devices.

Step 1: In the DHCP console, under Scope, right-click Policies and then click New Policy.

Step 2: Next to Policy Name, type Client1 Policy, and then click Next.

Step 3: On the Configure Conditions for the policy page, click Add.

Step 4: In the Add/Edit Condition dialog box, choose MAC Address next to Criteria, type the MAC address for Client1 next to Value (aabb* ), and then click Add, then click OK.

In our case use: aabb*

Step 5: Click Next, and then in Configure settings for the policy, type 192.168.1.190 next to Start IP address and type 192.168.1.200 next to End IP address.

Step 6: Finish the wizard.

Reference: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831538

Correct Answer: AB

A conditional forwarder is required for contoso.com.

A forwarder is required for all other domains.

When you have a conditional forwarder and a forwarder configured, the conditional forwarder will be used for the specified domain.

You could use a secondary zone for contoso.com but that would require a configuration change on Server1.

Correct Answer: B

Correct Answer:

Step 1: In contoso.com, generate a Key Distribution Services (KDS) Root Key

One-time preparation of Active Directory.

If you have not already created a gMSA in your domain, you'll need to generate the Key Distribution Service (KDS) root key. The KDS is responsible for creating, rotating, and releasing the gMSA password to authorized hosts. When a

container host needs to use the gMSA to run a container, it will contact the KDS to retrieve the current password.

Step 2: On Server, run New-CredentialSpec

Create a credential spec.

A credential spec file is a JSON document that contains metadata about the gMSA account(s) you want a container to use. By keeping the identity configuration separate from the container image, you can change which gMSA the container

uses by simply swapping the credential spec file, no code changes are necessary.

Run the following cmdlet to create the new credential spec file:

# Replace 'WebApp01' with your own gMSA

New-CredentialSpec -AccountName WebApp01

By default, the cmdlet will create a credential spec using the provided gMSA name as the computer account for the container. The file will be saved in the Docker CredentialSpecs directory using the gMSA domain and account name for the

filename.

Step 3: On Server1, install and run ccg.exe.

View the diagram below to follow the steps of the Container Credential Guard process:

1.

Using a CredSpec file as input, the ccg.exe process is started on the node host.

2.

ccg.exe uses information in the CredSpec file to launch a plug-in and then retrieve the account credentials in the secret store associated with the plug-in.

3.

ccg.exe uses the retrieved account credentials to retrieve the gMSA password from AD.

4.

ccg.exe makes the gMSA password available to a container that has requested credentials.

5.

The container authenticates to the domain controller using the gMSA password to get a Kerberos Ticket-Granting Ticket (TGT).

6.

Applications running as Network Service or Local System in the container can now authenticate and access domain resources, such as the gMSA.

Incorrect:

* In contoso.com, create a gMSA and a standard user account.

Note: gMSA architecture and improvements

To address the limitations of the initial implementation of gMSA for Windows containers, new gMSA support for non-domain-joined container hosts uses a portable user identity instead of a host computer account to retrieve gMSA credentials.

Therefore, manually joining Windows worker nodes to a domain is no longer necessary, although it's still supported. The user identity/credentials are stored in a secret store accessible to the container host (for example, as a Kubernetes

secret) where authenticated users can retrieve it.

gMSA support for non-domain-joined container hosts provides the flexibility of creating containers with gMSA without joining the host node to the domain. Starting in Windows Server 2019, ccg.exe is supported which enables a plug-in mechanism to retrieve gMSA credentials from Active Directory. You can use that identity to start the container.

Reference: https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts

Correct Answer:

1.

N - You are not changing a file, it asks if you can create a file with a name that already exists on all endpoints as File2.docx has already been synced from Azure file share (share1) to on-premise endpoints

2.

N - As I understand this is the same scenario. File1 from Server1 has already been synced to all endpoints when you try to create a new file with the same name.

3.

Y - If you add an Azure file share that has an existing set of files as a cloud endpoint to a sync group, the existing files will sync to server endpoints that you add to the same sync group.

Correct Answer:

Box 1: An Azure Automation account

Azure Automation allows you to automate tasks against resources in Azure, on-premises, and with other cloud providers such as Amazon Web Services (AWS).

When you start Azure Automation for the first time, you must create at least one Automation account.

Azure Automation State Configuration

Prerequisites include: An Azure Automation account

Azure Automation State Configuration is an Azure configuration management service that allows you to write, manage, and compile PowerShell Desired State Configuration (DSC) configurations for nodes in any cloud or on-premises

datacenter.

Box 2: Guest configuration in Azure policy

Note: Before you enable Automation State Configuration, we would like you to know that a newer version of DSC is now generally available, managed by a feature of Azure Policy named guest configuration. The guest configuration service

combines features of DSC Extension, Azure Automation State Configuration, and the most commonly requested features from customer feedback. Guest configuration also includes hybrid machine support through Arc-enabled servers.

Reference:

https://learn.microsoft.com/en-us/azure/automation/automation-security-overview

https://learn.microsoft.com/en-us/azure/automation/automation-dsc-overview

Correct Answer:

Group 3 = Group 1, 2 4 and 5 only. Domain-Local groups can contain members from the "forest".

Group 5 = Group 4 only. Global groups can only contain Users, Computers and Global groups from the "same" domain.

Reference:

https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-groups