AZ-800: Administering Windows Server Hybrid Core Infrastructure — Questions and Answers

Question 1: An ExpressRoute circuit shows 'Circuit status: Enabled' but 'Provider status: Provisioned' and connectivity is still failing. What is the most likely next troubleshooting step?

Enable ExpressRoute Premium
Delete and recreate the circuit
Verify BGP configuration on both the customer edge router and Azure gateway (Correct answer)
Increase the circuit bandwidth

Correct answer: Verify BGP configuration on both the customer edge router and Azure gateway

When both sides show provisioned/enabled, connectivity failures typically indicate BGP misconfiguration on the customer router or missing gateway connection in Azure.

Question 2: When you configure a private endpoint for an Azure Storage Account, what is the primary role of an Azure Private DNS Zone?

To override public DNS resolution and resolve the storage account's FQDN to its private IP address within the VNet. (Correct answer)
To block public DNS queries for the storage account's public endpoint.
To host the public DNS records for all Azure services.
To enable on-premises clients to connect without a VPN or ExpressRoute.

Correct answer: To override public DNS resolution and resolve the storage account's FQDN to its private IP address within the VNet.

For a private endpoint to work seamlessly, clients in the VNet must resolve the service's public FQDN (e.g., `mystorage.blob.core.windows.net`) to the private IP address of the private endpoint. An Azure Private DNS Zone (e.g., `privatelink.blob.core.windows.net`) linked to the VNet is used to host the 'A' record that maps the FQDN to the private IP, overriding the public DNS CNAME record.

Question 3: An Azure Cosmos DB account has a Private Endpoint. A developer queries it from a VM in the same VNet and receives a connection timeout. NSG rules allow port 443 outbound. What should you verify next?

Whether the developer is using the correct SDK version
Whether the VM subnet has a UDR routing traffic away from the private endpoint IP (Correct answer)
Whether the Cosmos DB account tier supports Private Link
Whether the Cosmos DB account has public network access disabled but the private endpoint is in a different subnet

Correct answer: Whether the VM subnet has a UDR routing traffic away from the private endpoint IP

A UDR on the VM's subnet that routes the private endpoint IP to a next hop other than 'None' or the local VNet can cause traffic to miss the private endpoint.

Question 4: A company deploys Application Gateway in two availability zones for high availability. Which SKU is required to support zone redundancy?

WAF v1 with zone pinning
Standard v1 with multiple instances
Any SKU with a zone-redundant VNet
Standard_v2 or WAF_v2 (Correct answer)

Correct answer: Standard_v2 or WAF_v2

Zone redundancy for Application Gateway is only supported on the v2 SKU family (Standard_v2 and WAF_v2).

Question 5: An administrator needs to create an NSG rule that allows a virtual machine to make outbound connections to Azure Storage services in the same region. To ensure the rule is maintainable and automatically updated if Microsoft changes the service IP addresses, which of the following should be used as the destination?

The 'Storage' service tag. (Correct answer)
The FQDN of the storage account.
The 'Internet' service tag.
The public IP address range for the specific Azure region.

Correct answer: The 'Storage' service tag.

A Service Tag represents a group of IP address prefixes for a given Azure service. Using the 'Storage' service tag as the destination ensures that the rule allows traffic to all Azure Storage public endpoints, and Microsoft automatically manages the underlying IP addresses associated with the tag.

Question 6: A company migrating from a hub-and-spoke VNet topology to Virtual WAN wants to reuse existing VNet peerings. What must they do before connecting existing VNets to a Virtual WAN hub?

Delete all existing VNet peerings between the hub and spoke VNets first (Correct answer)
Convert the existing hub VNet into a Virtual WAN hub
Export the existing route tables and import them into Virtual WAN
Upgrade VNet gateway SKUs to VpnGw1 minimum

Correct answer: Delete all existing VNet peerings between the hub and spoke VNets first

Existing VNet peerings between a hub VNet and spoke VNets must be removed before connecting those VNets to a Virtual WAN hub, as Virtual WAN creates its own managed peerings.

Question 7: In Connection Monitor, what metric indicates the percentage of probes that failed to reach the destination?

Jitter (ms)
Checks Failed % (Correct answer)
Throughput (bps)
Latency (ms)

Correct answer: Checks Failed %

Checks Failed % represents the proportion of monitoring probes that did not receive a successful response from the destination endpoint.

Question 8: What is the primary purpose of Azure Bastion in a hybrid networking scenario?

To monitor network traffic with packet capture
To provide secure RDP/SSH access to VMs without exposing them to the public internet (Correct answer)
To replace VPN gateways for site-to-site connectivity
To route traffic between virtual networks

Correct answer: To provide secure RDP/SSH access to VMs without exposing them to the public internet

Azure Bastion provides browser-based RDP and SSH access to Azure VMs directly through the Azure portal without requiring a public IP on the VM.

Question 9: Which exam is required to earn the Windows Server Hybrid Administrator Associate certification?

Exam MB-901 Microsoft Dynamics 365 Fundamentals
Exam Ref AZ-800 Administering Windows Server Hybrid Core Infrastructure (Correct answer)
Exam Ref AZ-700 Identity and Access Administration
Exam AZ-801

Correct answer: Exam Ref AZ-800 Administering Windows Server Hybrid Core Infrastructure

The Windows Server Hybrid Administrator Associate certification requires passing two exams: Exam AZ-800 and Exam AZ-801. Therefore, 'Exam Ref AZ-800 Administering Windows Server Hybrid Core Infrastructure' is one of the essential exams needed to earn this certification. This exam focuses on the core skills required for managing hybrid Windows Server environments.

Question 10: Which Azure Private Link resource type is used by the service CONSUMER rather than the service PROVIDER?

Private Link Service
Private Endpoint (Correct answer)
Azure Private DNS Resolver
Standard Internal Load Balancer

Correct answer: Private Endpoint

The Private Endpoint is deployed in the consumer's VNet to create a private connection to a provider's service; the Private Link Service is the provider-side component.

Question 11: Traffic Manager health probes fail for an endpoint. What does Traffic Manager do with DNS responses for that endpoint?

It redirects traffic to Azure Front Door
It immediately removes the endpoint from the profile
It stops returning that endpoint in DNS responses until it recovers (Correct answer)
It returns the endpoint's IP with a very low TTL

Correct answer: It stops returning that endpoint in DNS responses until it recovers

When an endpoint fails health checks, Traffic Manager excludes it from DNS responses, routing traffic only to healthy endpoints.

Question 12: What is the maximum number of VNet peering connections supported per VNet by default?

1000
500 (Correct answer)
100
250

Correct answer: 500

Azure supports up to 500 VNet peering connections per VNet by default, though this limit can be increased via a support request.

Question 13: Which NSG feature allows you to view all effective rules applied to a NIC, combining both subnet and NIC NSG rules?

Effective security rules view on the NIC (Correct answer)
NSG Diagnostics in Network Watcher
Azure Policy compliance view
Azure Monitor NSG flow logs

Correct answer: Effective security rules view on the NIC

The 'Effective security rules' view on a NIC in the Azure portal displays the merged and prioritized rules from both the NIC NSG and subnet NSG.

Question 14: You need Azure Load Balancer to send all connections from the same client IP to the same backend VM. Which feature should you enable?

Session persistence (source IP affinity) (Correct answer)
HA Ports rule
Floating IP (Direct Server Return)
Health probe override

Correct answer: Session persistence (source IP affinity)

Session persistence configured as 'Client IP' or 'Client IP and protocol' ensures the load balancer routes all flows from a given client to the same backend instance.

Question 15: Which Azure service provides the 'Effective Routes' feature to view all routes applied to a specific network interface?

Azure Policy
Network Watcher (Correct answer)
Azure Monitor
Azure Advisor

Correct answer: Network Watcher

Azure Network Watcher provides the Effective Routes feature, displaying all system routes and UDRs currently applied to a network interface.

Question 16: Which subnet-level policy must be enabled to apply NSG rules or UDRs to Private Endpoint network interfaces?

Subnet Delegation Policies
Service Endpoint Policies
Private Endpoint Network Policies (Correct answer)
Network Intent Policies

Correct answer: Private Endpoint Network Policies

By default, NSGs and UDRs are bypassed for Private Endpoint NICs; enabling 'Private Endpoint Network Policies' on the subnet allows NSG and UDR enforcement.

Question 17: You want Azure DNS to resolve names for a private virtual network without exposing the zone to the internet. What should you create?

A DNS forwarder VM
A public DNS zone
A private DNS zone linked to the VNet (Correct answer)
An Azure Firewall DNS proxy

Correct answer: A private DNS zone linked to the VNet

Azure Private DNS zones are linked to one or more VNets and are not resolvable from the public internet.

Question 18: You need an NSG rule to allow traffic from multiple non-contiguous IP addresses (10.1.0.0/24 and 192.168.5.0/24) in a single rule. How do you configure this?

Create an Application Security Group and assign both CIDRs
It is not possible; create two separate rules
Use a service tag that includes those ranges
Use a comma-separated list of CIDRs in the source field (Correct answer)

Correct answer: Use a comma-separated list of CIDRs in the source field

NSG rules support comma-separated IP address prefixes in the source or destination field, allowing multiple CIDRs in a single rule.

Question 19: Network Watcher's Next Hop feature returns 'None' for a destination IP. What does this indicate?

There is no matching route and packets will be dropped (Correct answer)
Traffic is sent to a network virtual appliance
The destination is on the same subnet
The VM has no public IP

Correct answer: There is no matching route and packets will be dropped

A Next Hop result of 'None' means no route matches the destination, so Azure will drop the packets.

Question 20: A spoke VNet is peered to a hub VNet with 'Use remote gateways' enabled. The hub VNet has an Azure VPN Gateway. What effect does deleting the hub's VPN Gateway have on the spoke peering?

The spoke VNet's peering enters a 'Disconnected' state and 'Use remote gateways' must be disabled before re-enabling it (Correct answer)
No effect — spoke VMs automatically reroute via the Azure backbone
The peering connection is automatically deleted and must be re-created
The peering remains connected but the spoke loses on-premises connectivity

Correct answer: The spoke VNet's peering enters a 'Disconnected' state and 'Use remote gateways' must be disabled before re-enabling it

When the remote gateway is deleted, the peering with 'Use remote gateways' enters a 'Disconnected' state; you must disable and re-enable the option once a new gateway is provisioned.

Question 21: A health probe is configured with a timeout of 30 seconds and an interval of 10 seconds. After how many consecutive probe failures does Application Gateway mark the backend as unhealthy by default?

1
2
5
3 (Correct answer)

Correct answer: 3

The default unhealthy threshold for Application Gateway health probes is 3 consecutive failures before a backend is marked unhealthy.

Question 22: You need to configure ExpressRoute Global Reach to allow two on-premises networks to communicate through Azure. What is a prerequisite for this configuration?

Both circuits must be in the same ExpressRoute peering location
Both circuits must have Azure private peering configured (Correct answer)
Both circuits must use the same bandwidth SKU
Both circuits must be connected to the same ExpressRoute provider

Correct answer: Both circuits must have Azure private peering configured

ExpressRoute Global Reach requires Azure private peering to be configured on both circuits before it can be enabled.

Question 23: You need to configure a VPN gateway with a 99.99% SLA. What configuration is required?

Single gateway in active-standby mode
Two separate VPN gateways in different regions
VPN gateway with ExpressRoute failover
Zone-redundant gateway across availability zones (Correct answer)

Correct answer: Zone-redundant gateway across availability zones

Zone-redundant VPN gateways deployed across Azure Availability Zones provide the 99.99% SLA guarantee.

Question 24: What does the AZ-800 exam test for?

Knowledge of cloud security measures
Ability to code in Python
Ability to manage and maintain hybrid Windows Server environments (Correct answer)
Experience working with Linux servers

Correct answer: Ability to manage and maintain hybrid Windows Server environments

The AZ-800 exam, 'Administering Windows Server Hybrid Core Infrastructure,' specifically tests a candidate's ability to manage and maintain Windows Server environments that span both on-premises and Azure cloud infrastructure. This includes core server workloads, identity, storage, and networking within a hybrid context, making it crucial for hybrid administrators.

Question 25: An application gateway in a dedicated subnet requires an NSG. Which inbound rule is mandatory for the application gateway to function?

Allow port 443 from Internet
Allow ports 65200-65535 from GatewayManager (Correct answer)
Allow all traffic from VirtualNetwork
Allow port 80 from AzureLoadBalancer

Correct answer: Allow ports 65200-65535 from GatewayManager

Azure Application Gateway requires an inbound NSG rule allowing ports 65200-65535 from the GatewayManager service tag for its infrastructure communication.

Question 26: Which Azure Firewall Policy feature allows you to define a reusable set of IP addresses that can be referenced across multiple rules without duplication?

FQDN Tags
IP Groups (Correct answer)
Custom DNS
Service Tags

Correct answer: IP Groups

IP Groups let you group and name a set of IP addresses or ranges that can be referenced in firewall policy rules across multiple rule collections.

Question 27: What is the purpose of an alias record in Azure DNS?

Points to an Azure resource and updates automatically when the resource IP changes (Correct answer)
Maps a domain to an on-premises IP
Delegates a subdomain to a different DNS zone
Creates a wildcard DNS entry

Correct answer: Points to an Azure resource and updates automatically when the resource IP changes

Azure DNS alias records automatically track changes to an Azure resource's IP address, eliminating dangling DNS pointers.

Question 28: A Traffic Manager profile uses Geographic routing. Which behavior occurs if no geographic mapping covers a user's region?

Traffic falls back to a weighted distribution
Traffic is routed to the nearest endpoint
Traffic is routed to the lowest-priority endpoint
The request fails with a DNS NXDOMAIN response (Correct answer)

Correct answer: The request fails with a DNS NXDOMAIN response

With Geographic routing, if no mapping matches the user's location, Traffic Manager returns NXDOMAIN, so every region must be explicitly mapped.

Question 29: A CNAME record in Azure DNS cannot be created at the zone apex. What record type must you use instead for apex domain aliasing?

PTR record
SOA record
Alias (A) record (Correct answer)
NS record

Correct answer: Alias (A) record

Azure DNS supports alias records at the zone apex to point to Azure resources like Traffic Manager profiles or CDN endpoints.

Question 30: An Application Gateway is configured with URL path-based routing. Requests to '/images/*' should go to Pool-A and all other requests to Pool-B. Which Application Gateway component defines these path-to-pool mappings?

Routing Rule
Backend Pool
HTTP Settings
URL Path Map (Correct answer)

Correct answer: URL Path Map

A URL Path Map defines which URL path patterns route to which backend pools in path-based routing scenarios.

Question 31: You are managing a three-tier application with multiple VMs in the web tier. You need to create a single NSG rule that allows inbound traffic on port 443 from the internet to all web-tier VMs, even as you add or remove VMs from that tier. Which feature should you use as the destination in your NSG rule?

A custom Route Table
A list of the private IP addresses of the web-tier VMs
A Service Tag
An Application Security Group (ASG) (Correct answer)

Correct answer: An Application Security Group (ASG)

Application Security Groups (ASGs) allow you to group virtual machines and define network security policies based on those groups. By assigning the web-tier VMs' network interfaces to an ASG, you can then use that ASG as the destination in an NSG rule, simplifying management as the group of VMs changes.

Question 32: What record type should you create in Azure DNS to delegate a subdomain zone to another set of name servers?

NS (Correct answer)
PTR
SOA
A

Correct answer: NS

An NS (Name Server) record delegates authority for a subdomain to the specified name servers.

Question 33: You need to allow traffic on both TCP and UDP port 53 for DNS. How many NSG rules are required?

Two rules — one for TCP 53 and one for UDP 53
One rule per protocol per direction, totaling four rules
Three rules — TCP, UDP, and ICMP for DNS
One rule using protocol 'Any' and port 53 (Correct answer)

Correct answer: One rule using protocol 'Any' and port 53

Setting the protocol to 'Any' in a single NSG rule with port 53 covers both TCP and UDP traffic on that port.

Question 34: Which exam focuses on more specialized responsibilities such as workload migration and disaster recovery?

AZ-900
AZ-204
AZ-801 (Correct answer)
AZ-104

Correct answer: AZ-801

The AZ-801 exam, officially titled 'Configuring Windows Server Hybrid Advanced Services,' focuses on more specialized and advanced responsibilities within hybrid Windows Server environments. These include implementing and managing advanced hybrid networking, storage, security, high availability, disaster recovery, and workload migration, distinguishing it from the core infrastructure focus of AZ-800.

Question 35: Azure Traffic Manager operates at which layer of the OSI model to route client requests?

Layer 4 (TCP/UDP)
Layer 3 (IP routing)
Layer 2 (Ethernet)
DNS layer (Layer 7 application, DNS-based) (Correct answer)

Correct answer: DNS layer (Layer 7 application, DNS-based)

Azure Traffic Manager uses DNS-based load balancing, responding to DNS queries with the IP of the selected endpoint.

Question 36: What is the maximum number of routes allowed per Azure route table?

1000
200
400 (Correct answer)
100

Correct answer: 400

Azure route tables support a maximum of 400 routes per table, as documented in Azure's subscription limits and quotas.

Question 37: Traffic Analytics identifies a large volume of malicious flows from a specific external IP. What is the fastest remediation using native Azure tools?

Add a deny rule to the NSG blocking that source IP (Correct answer)
Delete the affected VNet
Restart the target VM
Disable flow logs to stop recording

Correct answer: Add a deny rule to the NSG blocking that source IP

Adding a deny inbound rule to the NSG for the malicious source IP immediately blocks traffic without service disruption.

Question 38: Decommissioning the member hosts from an existing server farm is the duty you have been given. You have to remove group Managed Service Account (gMSA) after removing the member host as part of the procedure. In PowerShell, which of the following cmdlets would you use?

Uninstall-gMSAAccount
Remove -gMSAAccount
Remove-ADServiceAccount
Uninstall-ADServiceAccount (Correct answer)

Correct answer: Uninstall-ADServiceAccount

Group Managed Service Accounts (gMSAs) are a type of Active Directory service account. To remove a gMSA from a server after decommissioning, the `Uninstall-ADServiceAccount` PowerShell cmdlet is the correct tool. This cmdlet is specifically designed for managing the installation and uninstallation of AD service accounts on member servers, ensuring proper cleanup.

Question 39: After creating a Private Endpoint for Azure Service Bus, which private DNS zone name should be used?

privatelink.namespace.servicebus.net
privatelink.servicebus.azure.com
privatelink.servicebus.windows.net (Correct answer)
privatelink.azure.servicebus.net

Correct answer: privatelink.servicebus.windows.net

Azure Service Bus uses the private DNS zone 'privatelink.servicebus.windows.net' for Private Endpoint DNS resolution.

Question 40: Which network policy must be DISABLED on a subnet before you can deploy a Private Endpoint into it?

Service endpoint policies
Route table UDR policies
Private endpoint network policies (Correct answer)
Network security group flow logs

Correct answer: Private endpoint network policies

The 'privateEndpointNetworkPolicies' property on the subnet must be set to Disabled because NSG and UDR enforcement on private endpoint NICs is not supported by default.

Question 41: Which of the following is a primary benefit of using Azure Virtual Network Peering to connect two VNets in the same region?

It allows virtual networks with overlapping IP address spaces to be peered.
Traffic between the peered VNets is automatically encrypted with IPsec.
It provides a low-latency, high-bandwidth connection using the Microsoft backbone. (Correct answer)
It extends the broadcast domain across the two virtual networks.

Correct answer: It provides a low-latency, high-bandwidth connection using the Microsoft backbone.

A key benefit of VNet peering is that it creates a direct, private connection between virtual networks using the Microsoft backbone infrastructure. This results in a low-latency, high-bandwidth connection for resources in the peered networks. Traffic is not automatically encrypted (though it is private), it does not extend the broadcast domain, and you cannot peer virtual networks with overlapping IP address spaces.

Question 42: A company deploys Virtual WAN with multiple hubs and needs to isolate spoke VNets so they can only communicate with on-premises, not with other spokes. Which feature enables this isolation?

Custom route tables with propagation control (Correct answer)
Hub peering policies
Azure Firewall DNAT rules
Network security groups on spoke VNets

Correct answer: Custom route tables with propagation control

Custom route tables with selective propagation allow spoke VNets to communicate only with specific connections like on-premises while being isolated from other spokes.

Question 43: To modify a deployed VM's configuration, you must execute an Azure VM extension. In order to run Azure VM extensions, which of the following platforms would you choose?

ARM Templates
Azure CLI
Any of the above (Correct answer)
PowerShell

Correct answer: Any of the above

Azure VM extensions can be deployed and managed using a variety of Azure management tools. These include declarative methods like Azure Resource Manager (ARM) Templates, command-line interfaces such as Azure CLI, and scripting environments like PowerShell. All these platforms provide the necessary capabilities to execute and manage VM extensions, offering flexibility in how they are implemented.

Question 44: A Network Watcher Topology view shows a disconnected VNet. What is the most likely cause?

The VNet uses IPv6
The VNet is in a different subscription
The VNet has no subnets
Network Watcher is not enabled in that VNet's region (Correct answer)

Correct answer: Network Watcher is not enabled in that VNet's region

Topology view requires Network Watcher to be enabled in the same region as the VNet; without it, the topology cannot be discovered.

Question 45: Which Traffic Manager routing method routes requests based on the source IP subnet of the client?

Performance
Weighted
Subnet (Correct answer)
Geographic

Correct answer: Subnet

Subnet routing maps specific client IP address ranges to designated endpoints, enabling ISP or office-based routing.

Question 46: What kind of questions are included in the AZ-800 exam?

True/False questions
Scenarios, single answer questions, multiple choice questions, arrange in correct sequence questions, drag and drop questions, mark review questions (Correct answer)
Fill-in-the-blanks questions
Essay questions

Correct answer: Scenarios, single answer questions, multiple choice questions, arrange in correct sequence questions, drag and drop questions, mark review questions

The AZ-800 exam, like many Microsoft certification exams, includes a variety of question formats to comprehensively assess a candidate's skills. These formats range from scenario-based questions that test practical application to multiple-choice, drag-and-drop, and sequence ordering questions. This diverse approach ensures a thorough evaluation of knowledge and problem-solving abilities.

Question 47: Which Traffic Manager health check protocol can be used to verify the health of HTTPS endpoints?

HTTP only
ICMP
HTTP and HTTPS (Correct answer)
TCP only

Correct answer: HTTP and HTTPS

Traffic Manager supports HTTP, HTTPS, and TCP protocols for endpoint health probing.

Question 48: Which exam is required to earn Microsoft's Windows Server Hybrid Administrator Associate certification?

AZ-803
AZ-801
AZ-800 (Correct answer)
AZ-802

Correct answer: AZ-800

To earn Microsoft's Windows Server Hybrid Administrator Associate certification, candidates must pass two specific exams: AZ-800 and AZ-801. The AZ-800 exam, titled 'Administering Windows Server Hybrid Core Infrastructure,' is one of the two foundational exams required. It focuses on core Windows Server administration tasks in hybrid environments.

Question 49: Which Traffic Manager routing method directs all traffic to a single primary endpoint and fails over to a secondary only when the primary is unavailable?

Performance routing
Weighted routing
Geographic routing
Priority routing (Correct answer)

Correct answer: Priority routing

Priority routing assigns a priority number to each endpoint; Traffic Manager always sends traffic to the highest-priority (lowest number) healthy endpoint.

Question 50: A company needs to implement VPN gateway transit so that spoke VNets peered to a hub VNet can communicate with on-premises networks via the hub's VPN gateway. Which settings must be enabled?

Configure UDRs in each spoke pointing to the hub VPN gateway
Enable gateway transit on the hub VNet peering and use remote gateways on spoke VNet peerings (Correct answer)
Enable BGP on all spoke VNets and advertise routes to the hub
Enable Global Peering between all spoke VNets and the hub

Correct answer: Enable gateway transit on the hub VNet peering and use remote gateways on spoke VNet peerings

Gateway transit requires 'Allow Gateway Transit' on the hub side of the peering and 'Use Remote Gateways' on the spoke side of each peering.

Question 51: An Azure Firewall Policy is associated with two hub virtual networks in different regions using Azure Firewall Manager. What is a key limitation of this configuration?

IP Groups cannot be referenced when a policy spans multiple regions
The policy cannot contain NAT rule collections when used with multiple hubs
Child policies cannot be used with hub virtual networks
A single policy can only be associated with one hub virtual network at a time (Correct answer)

Correct answer: A single policy can only be associated with one hub virtual network at a time

Each Azure Firewall instance (hub VNet or Virtual WAN hub) requires its own policy association; a single policy object can be associated with multiple firewalls but each firewall has one active policy.

Question 52: Which Azure CLI command correctly creates a Private Endpoint for an Azure SQL server named 'mysqlserver' in resource group 'myRG'?

az network vnet subnet update --name mySubnet --disable-private-endpoint-network-policies true
az network private-endpoint create --connection-name myConn --private-connection-resource-id /subscriptions/.../servers/mysqlserver --group-id sqlServer (Correct answer)
az sql server private-endpoint create --server-name mysqlserver --subnet mySubnet
az network private-link-service create --name myPLS --lb-frontend-ip-configs myFrontend

Correct answer: az network private-endpoint create --connection-name myConn --private-connection-resource-id /subscriptions/.../servers/mysqlserver --group-id sqlServer

The 'az network private-endpoint create' command with --private-connection-resource-id and --group-id is the correct syntax to create a Private Endpoint for an Azure SQL server.

Question 53: You configure ExpressRoute private peering with a /29 subnet for the primary link. Azure uses the first usable IP and your router uses the second. What subnet size does Microsoft actually recommend for these links?

/32 point-to-point links
/30 subnets (Correct answer)
/27 subnets
/28 subnets

Correct answer: /30 subnets

Microsoft recommends /30 subnets for ExpressRoute primary and secondary link configurations, providing exactly two usable host addresses.

Question 54: What is the maximum number of VNet connections supported per Virtual WAN hub?

500
1000
100
250 (Correct answer)

Correct answer: 250

A single Virtual WAN hub supports up to 500 virtual network connections, providing large-scale connectivity for enterprise deployments.

Question 55: Active Directory Domain Services (AD DS) forest contoso.com is a part of your network. A server with the name server1.contoso.com is present in the forest root domain.<br> There is a two-way forest trust between the contoso.com forest and the fabrikam.com AD DS forest. There are 10 child domains in the fabrikam.com forest. <br> You must make sure that only those who are a part of the group fabrikamGroup1 are able to log in to server1.contoso.com. <br> What ought you start with?

Enable Selective authentication for the trust (Correct answer)
Add fabrikam\Group1 to the local Users group on server1.contoso.com
Change the trust to a one-way external trust
Enable SID filtering for the trust

Correct answer: Enable Selective authentication for the trust

To restrict users from a trusted forest (fabrikam.com) to log in only to specific resources in the trusting forest (contoso.com), 'Selective authentication' must be enabled on the trust. With selective authentication, administrators in the trusting forest must explicitly grant the 'Allowed to Authenticate' permission to users or groups from the trusted forest on the specific resources (like server1.contoso.com) they are permitted to access.

Question 56: Which Azure Front Door feature caches content at edge locations to reduce latency for static assets?

Health probes
Azure CDN integration / built-in caching (Correct answer)
Rules Engine
WAF policies

Correct answer: Azure CDN integration / built-in caching

Azure Front Door Standard and Premium have built-in content caching at edge PoPs that reduces origin load and response latency for static content.

Question 57: Which Azure Load Balancer feature enables a single load balancing rule to forward all ports and protocols to backend pool members, commonly used with NVAs?

Floating IP
NAT rules
HA Ports (Correct answer)
Outbound rules

Correct answer: HA Ports

HA Ports load balancing rules distribute all TCP and UDP flows across all ports to backend pool members, ideal for Network Virtual Appliances.

AZ-800: Administering Windows Server Hybrid Core Infrastructure

The AZ-800 exam validates skills in administering Windows Server hybrid core infrastructure, covering Active Directory Domain Services, hybrid server workloads, virtual machines and containers, on-premises and hybrid networking, and storage and file services.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds