2026 Updated Verified AZ-800 Q&As - Pass Guarantee or Full Refund [Q50-Q71]

2026 Updated Verified AZ-800 Q&As - Pass Guarantee or Full Refund

[May-2026] AZ-800 Certification with Actual Questions from TroytecDumps

To prepare for the Microsoft AZ-800 exam, candidates should have a good understanding of Windows Server, Azure Arc-enabled servers, and hybrid networking. They should also be familiar with Azure Stack HCI and have experience working with virtualization technologies. Candidates can prepare for the exam by taking online courses, attending training sessions, and practicing with sample questions.

NEW QUESTION # 50
Task 9
You plan to create group managed service accounts (gMSAs).
You need to configure the domain to support the creation of gMSAs.

Answer:

Explanation:
See the solution of this Task below.
Explanation:
To configure the domain to support the creation of gMSAs, you need to perform the following steps:
* On a domain controller or a computer that has the Remote Server Administration Tools (RSAT) installed, open PowerShell as an administrator and run the following command to install the Active Directory module:
Install-WindowsFeature -Name RSAT-AD-PowerShell
* Run the following command to create a Key Distribution Service (KDS) root key, which is required for generating passwords for gMSAs. You only need to do this once per domain:
Add-KdsRootKey -EffectiveImmediately
* Wait for at least 10 hours for the KDS root key to replicate to all domain controllers in the domain.
* Alternatively, you can use the -EffectiveTime parameter to specify a past date and time for the KDS root key, but this is not recommended for security reasons. For more information, see Add-KdsRootKey.
* After the KDS root key is replicated, you can create and configure gMSAs using the New-ADServiceAccount and Set-ADServiceAccount cmdlets. For more information, see Create a gMSA and Configure a gMSA.

NEW QUESTION # 51
You need to meet the security requirements for passwords.
Where should you configure the components for Azure AD Password Protection? lo answer, drag the appropriate components to the correct locations. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE Each correct selection is worth one point.

Answer:

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises

NEW QUESTION # 52
You have an Azure subscription that contains the storage accounts shown in the following table.

In the West US Azure region, you create a storage sync service named SyncA.
You plan to create a sync group named GroupA.
What is the maximum number of cloud endpoints you can use with GroupA?

A. 0
B. 1
C. 2
D. 3

Answer: A

Explanation:
The Azure File Sync section of the Administering Windows Server Hybrid Core Infrastructure materials states that a sync group defines the topology for synchronization and "contains one cloud endpoint and one or more server endpoints." A cloud endpoint is an Azure file share associated with a Storage Sync Service. The guidance also notes that "the Storage Sync Service and the storage account (file share) must reside in the same Azure region" and that "a single Azure file share can be the cloud endpoint for only one sync group." In the scenario, SyncA is in West US, so only file shares in West US (for example, storage1\share1 or storage2\share2) are eligible. However, regardless of how many eligible shares exist, the exam guide is explicit: each sync group supports a maximum of one cloud endpoint. Additional endpoints in the group must be server endpoints on Windows Server volumes. Therefore, the maximum number of cloud endpoints you can use with GroupA is 1, which directly reflects the product's architecture and the documented exam objective requirements.

NEW QUESTION # 53
SIMULATION
You need to monitor the security configuration of DC1 by using Microsoft Defender for Cloud.
The required source files are located in a folder named \\dc1.contoso.com\install.
To complete this task, sign in the required computer or computers.

Answer:

Explanation:
You can connect your non-Azure computers in any of the following ways:
* Onboarding with Azure Arc:
- By using Azure Arc-enabled servers (recommended)
-->By using the Azure portal
* Onboarding directly with Microsoft Defender for Endpoint
Connect on-premises machines by using the Azure portal
After you connect Defender for Cloud to your Azure subscription, you can start connecting your on-premises machines from the Getting started page in Defender for Cloud.
Step 1: Sign in to the Azure portal.
Step 2: Search for and select Microsoft Defender for Cloud.
Step 3: On the Defender for Cloud menu, select Getting started.
Step 4: Select the Get started tab.
Step 5: Find Add non-Azure servers and select Configure.

A list of your Log Analytics workspaces appears.
Step 6: (Optional) If you don't already have a Log Analytics workspace in which to store the data, select Create new workspace, and follow the on-screen guidance.
Step 7: From the list of workspaces, select Upgrade for the relevant workspace to turn on Defender for Cloud paid plans for 30 free days.
Step 8: From the list of workspaces, select Add Servers for the relevant workspace.
On the Agents management page, choose one of the following procedures, depending on the type of machines you're onboarding (Either Windows or Linux) Onboard your Windows server When you add a Windows server, you need to get the information on the Agents management page and download the appropriate agent file (32 bit or 64 bit).
To onboard a Windows server:
Step 1: Select Windows servers.

Step 2: Select the Download Windows Agent link that's applicable to your computer processor type to download the setup file.
Step 3: From the Agents management page, copy the Workspace ID and Primary Key values into Notepad.
Step 4: Copy the downloaded setup file to the target computer and run it.
Step 5: Follow the installation wizard (select Next > I Agree > Next > Next).
Step 6: On the Azure Log Analytics page, paste the Workspace ID and Primary Key values that you copied into Notepad.
Step 7: If the computer should report to a Log Analytics workspace in the Azure Government cloud, select Azure US Government from the Azure Cloud dropdown list.
Step 8: If the computer needs to communicate through a proxy server to the Log Analytics service, select Advanced. Then provide the URL and port number of the proxy server.
Step 9: When you finish entering all of the configuration settings, select Next.
Step 10: On the Ready to Install page, review the settings to be applied and select Install.
Step 11: On the Configuration completed successfully page, select Finish.
When the process is complete, Microsoft Monitoring agent appears in Control Panel. You can review your configuration there and verify that the agent is connected.
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-machines

NEW QUESTION # 54
Which groups can you add to Group3 and Group5? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation
Table Description automatically generated

Reference:
https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-g

NEW QUESTION # 55
Task 4
You need to register SRV1 to sync Azure file shares The registration must use the 34646045 Storage Sync Service.
The required source files are located in a folder named \\dc1.contoso.com\install.
You do NOT need to configure file share synchronization at this time and you do NOT need to update the agent.

Answer:

Explanation:
See the solution of this Task below.
Explanation:
One possible solution to register SRV1 to sync Azure file shares using the 34646045 Storage Sync Service is to use the Register-AzStorageSyncServer cmdlet from the Az.StorageSync module. This cmdlet establishes a trust relationship between the server and the Storage Sync Service, which is required for creating server endpoints and syncing files. Here are the steps to register SRV1 using the cmdlet:
* On SRV1, open PowerShell as an administrator and run the following command to install the Az.StorageSync module if it is not already installed:
Install-Module -Name Az.StorageSync
* Run the following command to import the Az.StorageSync module:
Import-Module -Name Az.StorageSync
* Run the following command to sign in to your Azure account and select the subscription that contains the 34646045 Storage Sync Service:
Connect-AzAccount
Select-AzSubscription -SubscriptionId <your-subscription-id>
* Run the following command to register SRV1 with the 34646045 Storage Sync Service. You need to specify the resource group name and the Storage Sync Service name as parameters:
Register-AzStorageSyncServer -ResourceGroupName <your-resource-group-name>
-StorageSyncServiceName 34646045
* Wait for the registration to complete. You can verify the registration status by checking the Registered servers tab on the Azure portal or by running the following command:
Get-AzStorageSyncServer -ResourceGroupName <your-resource-group-name> -StorageSyncServiceName
34646045
Now, SRV1 is registered with the 34646045 Storage Sync Service and ready to sync Azure file shares. You can create server endpoints on SRV1 and cloud endpoints on the Azure file shares to define the sync topology.

NEW QUESTION # 56
You have two on-premises servers named Server1 and Servet2 that run Windows Server.
You have an Azure Storage account named storage1 that contains a file share named share'. Server1 syncs with share1 by using Azure File Sync You need to configure Server2 to sync with share1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Answer:

Explanation:

1 - On Server2, install the Azure File Sync agent.
2 - Register Server2 with the Storage Sync Service.
3 - Add a server endpoint to the sync group.

NEW QUESTION # 57
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the servers shown in the following table.

You need to create a Distributed File System (DFS) namespace that will contain the following:
* A domain-based namespace named \\contoso.com\Public
* A folder named Finance
Which servers can you configure as folder targets for the Finance folder?

A. Server1, Server2, and Server 3 only
B. Server1 and Server3 only
C. Server2 and Servers only
D. Setver3 only
E. Server1, Server2, Server3, and Server4

Answer: E

Explanation:
In the Administering Windows Server Hybrid Core Infrastructure materials for DFS, Microsoft explains that a DFS Namespace presents a virtual tree of folders, and each folder can have one or more folder targets. A folder target is simply "a UNC path to a shared folder that contains the actual data." The guide emphasizes that folder targets do not need the DFS Namespaces role installed; the role is only required on namespace servers that host the namespace itself. Likewise, DFS Replication (DFSR) is optional-you enable it only when you want to keep the contents of multiple folder targets synchronized. The text states that
"any SMB share on any Windows server (or cluster) can be used as a folder target," and that "DFSR is used to replicate the data between folder targets but is not a prerequisite for configuring a target." Applying this to the scenario: you are creating a domain-based namespace \\contoso.com\Public and a folder Finance. The namespace servers must have the DFS Namespaces role (e.g., Server1/Server3), but folder targets for Finance can reside on any server hosting an SMB share, regardless of whether the DFS Namespaces or DFS Replication roles are installed. Therefore, Server1, Server2, Server3, and Server4 can all be configured as folder targets for the Finance folder.

NEW QUESTION # 58
Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com. The domain contains a server named Server1 and the users shown in the following table.

Server1 contains a folder named D:\Folder1. The advanced security settings for Folder1 are configured as shown in the Permissions exhibit. (Click the Permissions tab.)

Folder1 is shared by using the following configurations:
The share permissions for Share1 are shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

NEW QUESTION # 59
Your network contains a DHCP server.
You plan to add a new subnet and deploy Windows Server to the subnet.
You need to use the server as a DHCP relay agent.
Which role should you install on the server?

A. Network Policy and Access Services
B. Network Controller
C. Remote Access
D. DHCP Server

Answer: C

NEW QUESTION # 60
You need to meet the security requirements for passwords.
Where should you configure the components for Azure AD Password Protection? lo answer, drag the appropriate components to the correct locations. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE Each correct selection is worth one point.

Answer:

Explanation:

Explanation
Graphical user interface Description automatically generated with medium confidence

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises

NEW QUESTION # 61
Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site.
You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1.
You need to recommend a deployment plan that meets the following requirements:
* Ensures that a user named User1 can perform the RODC installation on Server1
* Ensures that you can control the AD DS replication schedule to the Server1
* Ensures that Server1 is in a new site named RemoteSite1
* Uses the principle of least privilege
Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Answer:

Explanation:

Explanation:
Application Description automatically generated with medium confidence

Box 1.
We need to create a site and subnet for the remote site. The new site will be added to the Default IP Site Link so we don't need to create a new site link. You configure the replication schedule on the site link.
Box 2.
When we pre-create an RODC account, we can specify who is allowed to attach the server to the prestaged account. This means that the User1 does not need to be added to the Domain Admins group.
Box3.
User1 can connect the RODC to the prestaged account by running the AD DS installation wizard.
Reference:
https://mehic.se/2018/01/02/how-to-install-and-configure-read-only-domain-controller-rodc-2016/

NEW QUESTION # 62
Hotspot Question
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant.
You have an on-premises web app named WebApp1 that only supports Kerberos authentication.
You need to ensure that users can access WebApp1 by using their Azure AD account. The solution must minimize administrative effort.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on- premises-application

NEW QUESTION # 63
Drag and Drop Question
You have a server named Server1 that runs Windows Server and has the Hyper V server role installed. Server1 hosts a virtual machine named VM1.
Server1 has an NVMe storage device. The device is currently assigned to VM1 by using Discrete Device Assignment.
You need to make the device available to Server1.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Answer:

Explanation:

Explanation:
https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v/deploy/deploying-storage- devices-using-dda

NEW QUESTION # 64
Your network contains an Active Directory Domain Services {AD DS) domain. The domain contains the resources shown in the following table.

You plan to replicate a volume from Server1 to Server2 by using Storage Replica.
You need to configure Storage Replica.
Where should you install Windows Admin Center?

A. Server 1
B. CLIENT1
C. DC1
D. Server2

Answer: B

NEW QUESTION # 65
You have servers that have the DNS Server role installed. The servers are configured as shown in the following table.

All the client computers in the New York office use Server2 as the DNS server.
You need to configure name resolution in the New York office to meet the following requirements:
Ensure that the client computers in New York can resolve names from contoso.com.
Ensure that Server2 forwards all DNS queries for internet hosts to 131. 107.100.200.
The solution must NOT require modifications to Server1.
Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. a conditional forwarder
B. a reverse lookup zone
C. a secondary zone
D. a delegation
E. a forwarder

Answer: A,E

Explanation:
Explanation
A conditional forwarder is required for contoso.com.
A forwarder is required for all other domains.
When you have a conditional forwarder and a forwarder configured, the conditional forwarder will be used for the specified domain.
You could use a secondary zone for contoso.com but that would require a configuration change on Server1.

NEW QUESTION # 66
You have on-premises servers that run Windows Server as shown in the following table.

You have an Azure subscription that contains a virtual machine named VMV You need to ensure that you can manage all the servers by using Azure Arc. The solution must minimize administrative effort.
On which servers should you install the Azure Connected Machine agent?

A. VM2only
B. Server1 and VM2 only
C. VM1 and VM2 only
D. Server1 only
E. Server1, VM1, and VM2
F. VM1 only

Answer: B

NEW QUESTION # 67
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the offices shown in the following table.

You need to deploy a Network Policy Server (NPS) named NPS1 to enforce network access policies for all remote connections.
What is the minimum number of RADIUS clients that you should add to NPS1?

A. 0
B. 1
C. 2
D. 3
E. 4

Answer: B

NEW QUESTION # 68
You have a server named Server1 that runs Windows Server and has the Hyper-V server role installed.
You need 10 limit which Hyper-V module cmdlets helpdesk users can use when administering Server 1 remotely.
You configure Just Enough Administration (JEA) and successfully build the role capabilities and session configuration files.
How should you complete the PowerShell command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation
Graphical user interface, text, application, email Description automatically generated

Reference:
https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/jea/register-jea?view=powershell-7.2

NEW QUESTION # 69
You have an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.
You need to provide an administrator with the ability to manage Group Policy Objects (GPOs).
The solution must use the principle of least privilege.
To which group should you add the administrator?

A. Group Policy Creator Owners
B. Enterprise Admins
C. AAD DC Administrators
D. Schema Admins
E. Domain Admins

Answer: C

Explanation:
Settings for user and computer objects in Azure Active Directory Domain Services (Azure AD DS) are often managed using Group Policy Objects (GPOs).
Azure AD DS includes built-in GPOs for the AADDC Users and AADDC Computers containers.
You can customize these built-in GPOs to configure Group Policy as needed for your environment.
Members of the Azure AD DC administrators group have "Group Policy administration privileges in the Azure AD DS domain, and can also create custom GPOs and organizational units (OUs). "
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy

NEW QUESTION # 70
You have an Azure subscription named sub! and 503 on-premises virtual machines that run Windows Server.
You plan to onboard the on-premises virtual machines to Azure Arc by running the Azure Arc deployment script You need to create an identity that mil be used by the script to authenticate access to sub1. The solution must use the principle of least privilege.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.