AZ-800 Cheat Sheet 2026

The 30 highest-yield AZ-800 facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. You need to host a private DNS zone that resolves names for resources inside a virtual network without exposing it publicly. Which Azure service should you use? → Azure Private DNS Zones
2. What are the two tiers of Azure DDoS Protection? → DDoS Network Protection and DDoS IP Protection
3. Which Traffic Manager routing method allows you to map specific IP address ranges to specific endpoints? → Subnet routing
4. Which Azure service provides the 'Effective Routes' feature to view all routes applied to a specific network interface? → Network Watcher
5. A global e-commerce company wants Traffic Manager to send users to the endpoint with the lowest network latency. Which routing method should they configure? → Performance routing
6. A backend VM must receive the real client IP address through an Azure Standard Load Balancer. What must you enable? → Floating IP (Direct Server Return)
7. What skills are tested in the AZ-800 exam? → Managing and implementing hybrid cloud solutions
8. Which exam is required to earn the Windows Server Hybrid Administrator Associate certification? → Exam Ref AZ-800 Administering Windows Server Hybrid Core Infrastructure
9. Which feature allows you to use Service Endpoint Policies to restrict a subnet's Service Endpoint access to only specific Azure Storage accounts? → Service Endpoint Policies for Azure Storage
10. What type of Azure Load Balancer rule distributes all ports and protocols with a single rule for high-availability appliances? → HA Ports rule
11. Which Azure Front Door feature caches content at edge locations to reduce latency for static assets? → Azure CDN integration / built-in caching
12. Which Azure Load Balancer health probe setting determines how many consecutive failures mark a backend as unhealthy? → Unhealthy threshold
13. What is the purpose of an alias record in Azure DNS? → Points to an Azure resource and updates automatically when the resource IP changes
14. Which Azure DNS record type is used to map a hostname to an IPv4 address? → A record
15. Traffic Manager health probes fail for an endpoint. What does Traffic Manager do with DNS responses for that endpoint? → It stops returning that endpoint in DNS responses until it recovers
16. What is the primary purpose of User-Defined Routes (UDRs) in Azure Virtual Networks? → To override Azure's default system routes and control traffic flow
17. Which DDoS Protection tier is automatically applied to all Azure public IP addresses at no extra cost? → Default (infrastructure-level) DDoS protection
18. What network security recommendation should be applied to the AzureBastionSubnet NSG to allow the Bastion control plane? → Allow inbound from GatewayManager service tag on port 443
19. Which Traffic Manager endpoint type is used to route traffic to a service hosted outside of Azure? → External endpoint
20. A CNAME record in Azure DNS cannot be created at the zone apex. What record type must you use instead for apex domain aliasing? → Alias (A) record
21. What is the default load-balancing algorithm used by Azure Load Balancer? → 5-tuple hash
22. Which of the following correctly lists the three RFC 1918 private address ranges used in Azure VNet planning? → 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
23. You want VMs in a virtual network to automatically register their DNS names in a private DNS zone. What must you configure? → Enable autoregistration when linking the VNet to the private DNS zone
24. What is the maximum number of routes allowed per Azure route table? → 400
25. Which Azure DNS record type is used to map a hostname to an IPv4 address? → A
26. You want Azure Front Door to send traffic to a secondary origin group only when the primary origin group is unhealthy. What feature enables this? → Origin group failover with priority
27. What Azure feature allows you to use your own custom domain name for an Azure Public DNS zone? → Delegating your domain's NS records to Azure DNS name servers
28. Azure Load Balancer health probes mark a backend instance as unhealthy after how many consecutive probe failures by default? → 2 consecutive failures
29. What happens to a route table when the subnet it is associated with is deleted? → The route table remains but the association is removed
30. Which Azure Load Balancer SKU supports availability zones and global load balancing? → Standard SKU