Pass the Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-800 Questions and answers with ExamsMirror

--> Turn on BranchCache

--> Enable Automatic Hosted Cache Discovery by Service Connection ...

< File1 is deduplicated after the deduplication job runs. – YES

 File3 is deduplicated after the deduplication job runs. – NO

 File4 is deduplicated after the deduplication job runs. – NO

The Administering Windows Server Hybrid Core Infrastructure materials explain that Data Deduplication operates per-volume and only processes files on volumes where the role is enabled. The guide states that deduplication “is applied only to NTFS/ReFS volumes on which the Data Deduplication role is enabled,” and that the General-purpose file server usage type applies default policies for typical data shares. It further specifies the file size limits: “Files smaller than 32 KB are not deduplicated; supported files are 32 KB up to multiple terabytes,” and clarifies that optimization jobs process eligible files during scheduled runs.

Applying those rules:

Volume D has Data Deduplication enabled (General-purpose). After moving File1 (500 KB) from C: to D:, it resides on a deduplicated volume and exceeds the minimum size threshold, so it will be deduplicated by the next optimization job.

File3 (1 MB) is moved off the deduplicated volume (to E:), and dedup only affects enabled volumes; therefore it will not be deduplicated.

File4 is a copy of File2 (10 KB) on D:. Because the file is smaller than the 32-KB minimum, it is not deduplicated even though it is on a deduplicated volume.

Thus the correct outcomes are YES for File1, NO for File3, and NO for File4.

 Yes

 Yes

 No

The Administering Windows Server Hybrid Core Infrastructure materials describe how Azure AD Connect filtering and sign-in methods affect user capabilities. Under Domain/OU filtering, it states that when “Sync selected domains and OUs” is configured, only objects in the selected OUs are synchronized to Azure AD. In the exhibit, OU1 is selected and OU2 is not; therefore User1 (in OU1) is synchronized, and User2 (in OU2) is not synchronized and will not exist in Azure AD for group membership.

For sign-in, the guide explains Pass-through Authentication (PTA): “When you enable Pass-through Authentication and disable Password Hash Synchronization, the user’s sign-in to Microsoft 365 is validated against on-premises Active Directory by the PTA agent contacting domain controllers.” Thus, when User1 signs in to Exchange Online, authentication is performed by on-premises AD DS via PTA.

Regarding Self-Service Password Reset (SSPR), the hybrid password management section specifies: “If Password writeback is enabled in Azure AD Connect, synchronized users can reset or change their passwords in Azure AD and the change is written back to on-premises Active Directory.” Because the configuration shows Enable Password writeback and User1 is synchronized, User1 can use SSPR.

Finally, since User2 is not synchronized (OU2 excluded), User2 does not exist in Azure AD and cannot be added to Group1 in the tenant.

 For User1, \\server2\share maps to drive H.: No

 For User2, \\server1\share maps to drive H.: Yes

 For User3, \\server3\share maps to drive H.: No

The Administering Windows Server Hybrid Core Infrastructure materials explain that Group Policy is processed in the order Local → Site → Domain → OU, with the last applied policy normally taking precedence. Two modifiers change this behavior: Enforced (No override) on a GPO link and Block inheritance on a container/OU. The guide states that an Enforced link “prevents child containers from overriding settings in that GPO,” while Block inheritance “prevents higher-level GPOs from applying except those marked Enforced.”

Applying these rules:

User1 (Contoso\Users) is not in OU1, so GPO2 (drive H to \\server2\share) does not apply. Only domain-level GPOs apply to the Users container; thus, the statement for \\server2\share is No.

User2 (OU1) receives GPO1 (Domain, Enforced) and GPO2 (OU1). Because GPO1 is Enforced, its mapping (H → \\server1\share) cannot be overridden by GPO2, so the statement is Yes.

User3 (OU1\OU2) is in OU2, which has Block inheritance. This blocks higher GPOs except those Enforced, so GPO1 still applies and GPO2 is blocked. Although GPO3 (OU2) also applies, the Enforced domain GPO (GPO1) takes precedence over conflicting lower-level settings, so H: remains \\server1\share, making the statement about \\server3\share No.

In the Administering Windows Server Hybrid Core Infrastructure materials, Web Application Proxy (WAP) is defined as a role service of the Remote Access role that is deployed on servers placed in a perimeter (DMZ) network to publish internal web applications for external users. The guide explains that WAP “acts as a reverse proxy and preauthentication endpoint for published applications” and that it is installed by adding the Remote Access role and selecting the Web Application Proxy role service. It further emphasizes that WAP “integrates with Active Directory Federation Services (AD FS) to provide claims-based preauthentication and single sign-on for applications such as AD FS–protected web apps.” Consequently, to make App1 available externally using least privilege and supported design, you deploy Remote Access (Web Application Proxy) on Server1 in the perimeter, and you ensure the AD FS role is available on the internal network as the federation service that WAP trusts. Other roles listed (for example, Network Policy and Access Services or Active Directory Certificate Services) are not required to stand up WAP publishing itself; certificates are consumed by WAP/AD FS, but the publishing function specifically relies on Remote Access (WAP) with AD FS as its preauthentication partner.

In Windows Server container deployments, the isolation mode determines kernel compatibility between the host and the container image. The Administering Windows Server Hybrid Core Infrastructure materials explain that Windows Server containers using process isolation share the host kernel and therefore require the container image to match the host’s OS version/build. The guide contrasts this with Hyper-V isolation, stating that each container runs inside a lightweight utility VM: “Hyper-V isolated containers do not share the host kernel; they provide a separate kernel instance, allowing containers built on a different Windows build (or earlier Windows Server version) to run on a newer host.”

Because Host1 is Windows Server 2022 and image1 is based on Windows Server 2019, process isolation would fail due to the version mismatch. The documented remediation is to start the container with Hyper-V isolation, which decouples the container from the host’s kernel requirements. The study guide shows this operationally with Docker: “Use docker run … --isolation=hyperv when the container base image version differs from the host.”

Therefore, to successfully start the container on Host1, you must use the Docker CLI with Hyper-V isolation:

Docker run -d --isolation=hyperv image1.

 Hotpatch: VM1 and VM2 only

 SMB over QUIC: VM1 and VM2 only

The Administering Windows Server Hybrid Core Infrastructure guidance for Azure Automanage and Windows Server 2022 features states that Hotpatch is available only for Azure VMs that run Windows Server 2022 Datacenter: Azure Edition. The materials describe Hotpatch as an Azure capability that “applies security updates to Windows Server 2022 Azure Edition without requiring a reboot in most cases,” and clarify that it is supported on both Desktop Experience and Server Core images of Azure Edition used in Azure IaaS. Therefore, only VM1 (Windows Server 2022 Datacenter: Azure Edition) and VM2 (Windows Server 2022 Datacenter: Azure Edition Core) meet the Hotpatch prerequisite. Regular Windows Server 2022 Datacenter (VM3) and Windows Server 2019 Datacenter (VM4) are not eligible for Hotpatch.

For file services, the same exam content explains that SMB over QUIC is a Windows Server 2022 feature limited to Azure Edition when acting as the SMB server endpoint: it “provides SMB encryption and TLS 1.3 over UDP (QUIC) to enable secure, VPN-less access to SMB shares” and is available on Windows Server 2022 Datacenter: Azure Edition. Consequently, only VM1 and VM2 can host SMB over QUIC. Standard Windows Server 2022 Datacenter (VM3) and Windows Server 2019 Datacenter (VM4) do not provide the SMB over QUIC server capability.

Thus, the correct selections are VM1 and VM2 only for both Hotpatch and SMB over QUIC.

The AZ-800 materials explain that enabling Microsoft Entra (Azure AD) sign-in to Windows Server running as an Azure VM is done by deploying the Azure AD Login for Windows VM extension. The study guide states that “for Azure VMs, Microsoft Entra sign-in is enabled by installing the AADLoginForWindows extension; once installed, Entra users and groups granted ‘Virtual Machine User/Login’ roles can sign in using Entra credentials.” The required operation is performed from Azure PowerShell with Set-AzVMExtension, providing the publisher Microsoft.Azure.ActiveDirectory, type AADLoginForWindows, and the target VM. Other options are not applicable: Set-AzVM changes VM properties but does not install extensions; New-ADComputer and Add-ADComputerServiceAccount are AD DS cmdlets unrelated to enabling Entra login on an Azure VM. Therefore, to meet the plan “Enable Microsoft Entra users to sign in to Server1,” you must run Set-AzVMExtension to install the AAD Login extension on Server1.

Comprehensive and Detailed Explanation with all Administering Windows Server Hybrid Core Infrastructure documents: =

In the Administering Windows Server Hybrid Core Infrastructure study materials, Automanage for Azure VMs is described as a service that “onboards supported Azure virtual machines into a curated set of best-practice services automatically.” The guide notes that Automanage supports Azure IaaS VMs running Windows Server (2012 R2 and later) and common Linux distributions (for example Ubuntu/RHEL), while unsupported operating systems such as Windows client SKUs or older Windows Server releases are excluded. The same content emphasizes that Automanage targets “only supported Azure VMs” and does not extend to machines that don’t meet OS prerequisites.

Given the scenario, Server1 (supported Linux server) and Server2 (supported Windows Server) meet Automanage prerequisites, whereas the remaining Azure VMs are not in the supported matrix (client OS or an older/unsupported server release). Therefore, enabling Automanage on Server1 and Server2 only satisfies the technical requirement to “use Azure Automanage on all supported Azure virtual machines.”