At ValidExamDumps, we consistently monitor updates to the Microsoft AZ-800 exam questions by Microsoft. Whenever our team identifies changes in the exam questions,exam objectives, exam focus areas or in exam requirements, We immediately update our exam questions for both PDF and online practice exams. This commitment ensures our customers always have access to the most current and accurate questions. By preparing with these up to date and 100% exam domain coverage questions, our customers can successfully pass the Microsoft Administering Windows Server Hybrid Core Infrastructure exam on their first attempt without needing additional materials or study guides.
Other certification materials providers often include outdated or removed questions by Microsoft in their Microsoft AZ-800 exam. These outdated questions lead to customers failing their Microsoft Administering Windows Server Hybrid Core Infrastructure exam. In contrast, we ensure our questions bank includes only precise and up-to-date questions. Our main priority is your success in the Microsoft AZ-800 exam, not profiting from selling obsolete exam questions in PDF or Online Practice Test.
Your network contains an Active Directory Domain Services (AD DS) domain.
You have a Group Policy Object (GPO) named GPO1 that contains Group Policy preferences.
You plan to link GPO1 to the domain.
You need to ensure that the preference in GPO1 apply only to domain member servers and NOT to domain controllers or client computers. All the other Group Policy settings in GPO1 must apply to all the computers. The solution must minimize administrative effort.
Which type of item level targeting should you use?
In the Windows Server hybrid administration curriculum, Group Policy Preferences (GPP) support Item-level Targeting (ILT), which lets you apply a preference only when specific conditions are met, while the remainder of the GPO (regular policy settings) continues to apply wherever the GPO is linked. The guide explains that ILT can evaluate many attributes, including Operating System, where you can match by version, architecture, and crucially Product type. The product type values distinguish Workstation, Server, and Domain Controller. Using the Operating System targeting item to set Product type = Server ensures the preference applies to member servers only, because domain controllers report a different product type (Domain Controller) and client computers report Workstation.
This approach satisfies the requirement to link GPO1 at the domain level so that ''all the other Group Policy settings in GPO1 apply to all computers,'' while constraining only the GPP items to servers. It also meets the ''minimize administrative effort'' goal because it requires no OU restructuring and no additional security groups or WMI filters. In short, configure ILT on the specific GPP items within GPO1 using Operating System Product type: Server; DCs and clients will not meet the targeting condition, so the preferences won't apply to them, but the rest of the GPO will.
You haw an Azure virtual machine named VM1 that runs Windows Server
You need to configure the management of VM1 to meet the following requirements:
* Require administrators to request access to VM1 before establishing a Remote Desktop connection.
* Limit access to VM1 from specific source IP addresses.
* Limit access to VMI to a specific management port
What should you configure?
The exam objectives around managing Windows Server IaaS VMs in Azure highlight Just-In-Time (JIT) VM access, a capability surfaced through Microsoft Defender for Cloud, to harden management ports. JIT enforces that administrators request time-bound access before RDP/SSH is opened, and, when approved, Defender for Cloud programmatically updates the NSG to (1) open only the specified management port, (2) for a limited time window, and (3) restricted to approved source IP addresses. This exactly satisfies: ''require administrators to request access before RDP,'' ''limit access from specific source IPs,'' and ''limit to a specific management port.'' While NSGs themselves can restrict ports and source IPs, they cannot implement the approval workflow and automatic time-bound opening/closure. Azure AD PIM manages role elevation, not per-VM port exposure. Azure Front Door is for web/app delivery and does not govern RDP ingress. Therefore, configuring JIT VM access in Microsoft Defender for Cloud is the prescribed solution in the hybrid core guidance for secure, just-in-time RDP to Windows Server VMs.
Your network contains an Active Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain controllers.
You plan to store a DNS zone in a custom active Directory partition.
You need to create the Active Directory partition for the zone. The partition replicate to only four of the domain controllers.
What should you use?
In the Windows Server hybrid administration guidance for DNS, Microsoft describes that DNS zones stored in Active Directory can use application directory partitions to customize replication scope beyond the default domain- or forest-wide options. The study materials state that ''custom application directory partitions allow DNS data to replicate only to the DNS servers that are explicitly enlisted in that partition.'' They further emphasize that while DNS Manager lets you pick among built-in scopes or select an existing application partition, ''creating a new application directory partition is performed with command-line tools (dnscmd) or Windows PowerShell.''
The documented procedure is: ''Use dnscmd /CreateDirectoryPartition <FQDN-of-partition> to create the custom partition, then dnscmd /EnlistDirectoryPartition on each DNS server that should host and replicate the data.'' Because you must have the partition replicate to only four of the domain controllers, you first create the partition, and then enlist only those four DNS servers. Tools such as Active Directory Sites and Services or Active Directory Administrative Center do not create DNS application directory partitions, and DNS Manager cannot create a new custom partition; it can only use an existing one. Therefore, the correct tool to meet the requirement is dnscmd.exe, after which you enlist just the selected four DNS servers into that partition.
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant
You have several Windows 10 devices that are Azure AD hybrid-joined.
You need to ensure that when users sign in to the devices, they can use Windows Hello for Business.
Which optional feature should you select in Azure AD Connect?
The Windows Server Hybrid Core Infrastructure materials explain that Windows Hello for Business (WHfB) in a hybrid environment relies on Azure AD registration and corresponding device objects in on-premises AD DS. Azure AD Connect provides the Device writeback optional feature, which ''writes Azure AD device objects back to AD DS as msDS-Device objects so on-premises domain controllers and policies can recognize and evaluate the device during authentication.'' The guide further notes that for hybrid-joined Windows 10/11 devices, enabling Device writeback ''allows on-premises authentication stacks and Conditional Access decisions to use the registered device and its key material (key trust or certificate trust), enabling WHfB sign-in on domain-joined devices.'' Other options do not meet the requirement: Password writeback is used for self-service password reset, Group writeback returns Microsoft 365 groups to AD DS, and Directory extension attribute sync simply synchronizes custom attributes. Therefore, to ensure users can sign in with Windows Hello for Business on Azure AD hybrid-joined devices, select Device writeback in Azure AD Connect.
You have two servers that have the Hyper-V server role installed. The servers are joined to a failover cluster both servers can connect to the same disk on an iSCSi storage device. You plan to use the iSCSI storage to store highly available Hyper-V virtual machines that will support live migration functionality. You need to configure a storage resource in the failover cluster to store the virtual machines.
What should you configure?
The Failover Clustering content in AZ-800 explains that Cluster Shared Volumes (CSV) allow multiple cluster nodes to simultaneously access the same NTFS/ReFS volume, making them the standard storage layout for highly available Hyper-V virtual machines and enabling features like Live Migration and Quick Migration. CSVs present a consistent namespace across nodes (e.g., C:\ClusterStorage\VolumeX) and are specifically recommended for storing VHDX files and configuration data for clustered VMs. By contrast, DFS Replication is not supported for virtual machine storage due to file-locking and consistency constraints; storage pools pertain to Storage Spaces, not an iSCSI LUN already presented to both hosts; and a mirrored volume on a single node does not provide cluster-wide, concurrent access. The guidance is explicit that when using a shared LUN (such as iSCSI) for clustered Hyper-V workloads, you should add the disk to the cluster, enable CSV, and place VMs on the CSV to support continuous availability and Live Migration without downtime. Thus, the correct storage resource is Cluster Shared Volumes (CSV).
