Pass the Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-800 Questions and answers with ValidTests

The Failover Clustering content in AZ-800 explains that Cluster Shared Volumes (CSV) allow multiple cluster nodes to simultaneously access the same NTFS/ReFS volume, making them the standard storage layout for highly available Hyper-V virtual machines and enabling features like Live Migration and Quick Migration. CSVs present a consistent namespace across nodes (e.g., C:\ClusterStorage\VolumeX) and are specifically recommended for storing VHDX files and configuration data for clustered VMs. By contrast, DFS Replication is not supported for virtual machine storage due to file-locking and consistency constraints; storage pools pertain to Storage Spaces, not an iSCSI LUN already presented to both hosts; and a mirrored volume on a single node does not provide cluster-wide, concurrent access. The guidance is explicit that when using a shared LUN (such as iSCSI) for clustered Hyper-V workloads, you should add the disk to the cluster, enable CSV, and place VMs on the CSV to support continuous availability and Live Migration without downtime. Thus, the correct storage resource is Cluster Shared Volumes (CSV).

The Administering Windows Server Hybrid Core Infrastructure materials explain that BranchCache reduces WAN utilization by caching content that clients request from a remote content server. There are two modes: Hosted Cache and Distributed Cache. Hosted Cache “requires a server in the branch office configured as a hosted cache server,” while Distributed Cache “uses a peer-to-peer cache among Windows clients and does not require any servers in the branch.” For SMB shares, the content server (the file server at the main site) must have the “BranchCache for Network Files” role service installed so that it can advertise hashes and support BranchCache for file content. Client computers in the branch are then configured to Enable BranchCache in Distributed Cache mode so they can cache and retrieve content from each other, minimizing repeated downloads across the WAN.

In this scenario, Montreal has no servers, so Hosted Cache is not suitable. Installing BranchCache for Network Files on Server1 (the Boston file server hosting \\Server1\Apps) and enabling Distributed Cache on the 20 Windows 10 clients in Montreal meets the requirement to reduce WAN saturation during the LOB app deployment and subsequent updates while requiring no additional branch infrastructure.

The Azure File Sync design guidance in Administering Windows Server Hybrid Core Infrastructure explains that a sync group defines one sync topology and is anchored by exactly one cloud endpoint (an Azure file share). The material states: “Each sync group contains a single cloud endpoint… Additional Azure file shares must be placed in separate sync groups.” Consequently, after Group1 uses share1 as its cloud endpoint, share2 cannot be added to the same sync group, which makes the first statement No.

For server endpoints, the guide notes: “A server endpoint represents a specific path on a registered Windows Server… A server can host multiple server endpoints, including in the same sync group, provided paths don’t overlap (no parent/child or identical paths).” Because D:\Folder1 is already in Group1, adding E:\Folder2 from the same Server1 is supported and non-overlapping, so the second statement is Yes.

Finally, multi-server synchronization is a core capability: “Multiple servers can be added as server endpoints to the same sync group to enable branch-to-branch and server-to-cloud sync; contents are merged in the Azure file share namespace.” Therefore, adding D:\Data from Server2 as another server endpoint in Group1 is fully supported, making the third statement Yes.

These rules satisfy the scenario: one cloud endpoint per sync group, multiple non-overlapping server endpoints (including multiple from the same server), and multi-server participation in the same group.

The Administering Windows Server Hybrid Core Infrastructure materials explain that group Managed Service Accounts (gMSAs) rely on the Key Distribution Service (KDS) to generate and distribute the managed password. Therefore, the first step in a new forest (or where no key exists yet) is to create a KDS root key: Add-KdsRootKey. The guide states that “the KDS root key is required once per forest before any gMSA can be created or used,” and without it, password material cannot be issued.

Next, you create the gMSA in Active Directory using New-ADServiceAccount. When creating the account, you specify the principals that are allowed to retrieve the managed password (for example, the computer account of Server1 or a group). The study content notes: “Use New-ADServiceAccount with -PrincipalsAllowedToRetrieveManagedPassword to authorize the host computers that will run the service.” This removes the need to separately run mapping cmdlets.

Finally, on the target server, you install the gMSA locally using Install-ADServiceAccount. The documentation emphasizes: “After the account is created in AD, the host computer must install the gMSA so the Local Security Authority can obtain and maintain the password automatically.”

Because authorization is granted at creation time, Add-ADComputerServiceAccount is not required in this minimal, correct sequence.

In the Administering Windows Server Hybrid Core Infrastructure materials for AD DS operations, the time service hierarchy is tied to FSMO roles. The guide states that “the domain controller holding the PDC Emulator role acts as the authoritative time source for the domain; other DCs in the domain synchronize time from the PDC emulator, and domain members synchronize from their logon DCs.” For multi-domain forests, it further clarifies that “the PDC Emulator in the forest root domain is the authoritative source for the forest and should be configured to sync with an external, reliable NTP source.”

Regarding management tools, the exam guide specifies that “domain-wide FSMO roles (RID, PDC Emulator, and Infrastructure) are transferred by using Active Directory Users and Computers: right-click the domain, choose Operations Masters, and select the relevant tab.” By contrast, “Schema Master is managed with the Active Directory Schema snap-in and Domain Naming Master with Active Directory Domains and Trusts.”

Therefore, to make DC3 the authoritative time server for the domain, you must transfer the PDC Emulator role to DC3 and perform the transfer using Active Directory Users and Computers (ADUC) via the Operations Masters dialog.

To manage Microsoft updates on an on-premises server via Azure Arc, you must leverage the Azure Update Management solution. According to official Administering Windows Server Hybrid Core Infrastructure study guides, Azure Arc-enabled servers allow you to manage your non-Azure Windows and Linux machines as if they were native Azure resources. To facilitate update management, the infrastructure relies on a connection between the machine, an Azure Automation account, and a Log Analytics workspace.

First, you must install the Azure Monitor agent (or the Legacy Log Analytics agent, though AMA is the current standard) on Server1. This agent is responsible for collecting inventory data and the status of available updates, then sending that metadata to the Log Analytics workspace. Azure Arc simplifies this deployment by allowing the agent to be installed as an extension directly from the Azure portal.

Second, you must enable Update Management from the Automation account. The Update Management solution uses the data collected by the agent to assess the update status of the server. Once enabled, you can create update deployments to schedule the installation of updates during defined maintenance windows. This integrated approach ensures that hybrid servers—those residing on-premises but managed via Azure Arc—receive the same governance and patching consistency as cloud-native virtual machines. Option A is incorrect as Sentinel is for security orchestration, and Option D is incorrect because Arc-enabled servers are not connected through the "Virtual machines" data source used for native Azure VMs.

Infrastructure documents: =

In the Windows Server container objectives of Administering Windows Server Hybrid Core Infrastructure, image creation is performed from a Dockerfile by using the build workflow. The guide explains that a Dockerfile is a “text manifest of instructions that define how to assemble an image.” To produce the actual image, you run docker build against a build context, optionally specifying the Dockerfile name and the image tag. The study text notes: “Use docker build to compile a container image from a Dockerfile; the command processes each instruction (FROM, COPY, RUN, EXPOSE, etc.) and writes the resulting layers to a new image.” Other commands serve different purposes: docker exec runs a command inside an existing container; docker create prepares a container from an already-built image without starting it; docker images merely lists images. Therefore, to generate an image from df1, you would run a command such as docker build -f df1 -t contoso/app:1.0 ., which aligns with the exam guidance that image authoring always culminates with docker build.

In AD DS, site, subnet, and site-link objects live in the Configuration partition and are forest-wide. The Administering Windows Server Hybrid Core Infrastructure materials explain that permissions to create and manage these Configuration objects are held by default by Enterprise Admins and also by Domain Admins of the forest-root domain. Because we must apply the principle of least privilege, adding Admin1 to Contoso\Domain Admins (the forest-root domain’s Domain Admins) is sufficient to create/manage AD sites without granting the broader, higher-risk Enterprise Admins role.

For promoting a server to a domain controller in an existing domain, the guide states that you must be a member of the Domain Admins group in that target domain (or have equivalent delegated rights). Enterprise Admins is only required for forest-wide tasks or when creating the first DC in a new domain. Since Admin2 needs to deploy DCs to the existing child domain east.contoso.com, the least-privilege assignment is East\Domain Admins. This grants the necessary rights to run AD DS installation, create the NTDS settings/server objects, and replicate, without unnecessary forest-level privileges.

The Windows Server DHCP role supports reservations that map a client’s unique identifier (commonly the MAC address) to a specific IPv4 address inside the scope. The AZ-800 study material describes reservations as the mechanism to “ensure that a particular device always receives the same IP address from the DHCP server while still being managed by DHCP.” When a reservation exists, the DHCP server will always offer and lease the reserved address to that client and will not allocate that address to any other client. This meets scenarios such as networked printers, appliances, or servers that require a consistent IP but where you still want centralized lease management (lease tracking, option delivery, and centralized auditing). The content further contrasts reservations with exclusions and options: exclusions remove addresses from the pool and options deliver configuration parameters, neither of which guarantees a stable assignment to a given device. Therefore, creating one DHCP reservation per printer in Scope1 precisely satisfies the requirement that the printers are always assigned the same IP address.

--> Turn on BranchCache

--> Enable Automatic Hosted Cache Discovery by Service Connection ...