FREE AZ 800: Administering Windows Server Hybrid MCQ Questions and Answers

Question 1

An Active Directory Domain Services (AD DS) domain with the name contoso.com is present on your network.
You must determine which server is the domain's PDC emulator.
Solution: You can execute the netdom.exe query fsmo from a command prompt.
Is the objective being met?

Accepted Answer

Yes

Answer

No

Question 2

In Azure AD, you intend to deploy a self-service password reset (SSPR).
You must make sure that users who reset their passwords using SSPR can access the AD DS domain's new password resources.
What ought you to do?

Accepted Answer

Run the Microsoft Azure Active Directory Connect wizard and select Password writeback.

Answer

Grant the impersonate a client after authentication user right to the Azure AD Connect service account.

Answer

Deploy the Azure AD Password Protection proxy service to the on premises network

Answer

Grant the Change password permission for the domain to the Azure AD Connect service account.

Question 3

The domain contoso.com belongs to your Azure Active Directory Domain Services (Azure AD DS) account.
An administrator must be given access to manage Group Policy Objects (GPOs). The least privilege principle must be applied to the solution.
Which group should the administrator be added to?

Accepted Answer

AAD DC Administrators

Answer

Domain Admins

Answer

Enterprise Admins

Answer

Schema Admins

Question 4

An Active Directory Domain Services (AD DS) domain exists on your network. 20 domain controllers, 100 member servers, and 100 client computers are also part of the network.
Group Policy preferences are contained in a Group Policy Object (GPO) called GPO1 that you have.
You want to connect the domain to GPO1.
The preference in GPO1 must ONLY apply to domain member servers and NOT to domain controllers or client computers. Each computer must be affected by all other Group Policy settings in GPO1. The answer must require the least amount of administration.
Which kind of item-level targeting ought to be employed?

Accepted Answer

Operating System

Answer

Environment Variable

Answer

Domain

Answer

Security Group

Question 5

A multi-site Active Directory Domain Services (AD DS) forest exists on your network. Both automatically generated connections and manually set site links are used to connect each Active Directory site.
The convergence time for Active Directory changes needs to be kept to a minimum.
What ought you to do?

Accepted Answer

For each site link, modify the replication schedule.

Answer

Create a site link bridge that contains all the site links

Answer

For each site link, modify the options attribute

Answer

For each site links, modify the site link costs

Question 6

You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory Domain Services (AD DS) domain.
You have a number of Windows 10 devices that are hybrid-joined to Azure AD.
You must make sure that users may use Windows Hello for Business to sign in to the devices.
Which Azure AD Connect optional feature should you choose?

Accepted Answer

Password writeback

Answer

Azure AD app and attribute filtering

Answer

Directory extension attribute sync

Answer

Group writeback

Question 7

Active Directory Domain Services (AD DS) forest contoso.com is a part of your network. A server with the name server1.contoso.com is present in the forest root domain.
There is a two-way forest trust between the contoso.com forest and the fabrikam.com AD DS forest. There are 10 child domains in the fabrikam.com forest.
You must make sure that only those who are a part of the group fabrikamGroup1 are able to log in to server1.contoso.com.
What ought you start with?

Accepted Answer

Enable Selective authentication for the trust

Answer

Change the trust to a one-way external trust

Answer

Enable SID filtering for the trust

Answer

Add fabrikam\Group1 to the local Users group on server1.contoso.com