The AZ-800 exam validates your ability to administer Windows Server infrastructure across hybrid environments, combining on-premises and cloud resources. This credential, Windows Server Hybrid Administrator Associate, demonstrates competency in deploying, managing, and securing Windows Server workloads at enterprise scale. If you manage Active Directory, virtual machines, networking, or storage across hybrid infrastructures, this exam confirms your expertise. This page outlines the exam structure, core topics, and practical preparation strategies to help you succeed.
Use this topic map to guide your study for Microsoft AZ-800 (Administering Windows Server Hybrid Core Infrastructure) within the Windows Server Hybrid Administrator Associate path.
The AZ-800 exam measures both technical knowledge and practical decision-making through varied question types that reflect real-world scenarios.
Questions progress in difficulty and emphasize practical application, so study should include both conceptual understanding and lab-based practice.
Efficient preparation maps topics to a structured study schedule, balances theory with hands-on practice, and builds confidence through realistic mock exams. Dedicate 4-6 weeks to cover all domains thoroughly, with weekly focus areas and regular progress checks.
Explore other Microsoft certifications: view all Microsoft exams.
Strengthen your preparation with up-to-date resources from validexamdumps.com. These materials align to AZ-800 and cover practical scenarios with clear explanations.
Visit the exam page to download the PDF, Online Practice Test, or get a bundle discount for both formats: Administering Windows Server Hybrid Core Infrastructure.
Active Directory Domain Services and hybrid networking typically account for a significant portion of exam content, as they form the foundation of enterprise infrastructure. Server management and storage also appear frequently. Review the official exam skills outline to confirm current weighting, and allocate study time proportionally.
In practice, AD DS manages authentication and authorization across on-premises and cloud resources, networking enables secure communication between environments, and storage provides the foundation for data availability. A typical scenario involves setting up Azure AD Connect, configuring hybrid DNS, and implementing Storage Replica for disaster recovery, all working together to support business continuity.
Hands-on experience is valuable for building confidence and understanding how concepts work in practice. Prioritize labs on Hyper-V VM deployment, AD DS configuration, Windows Server role installation, and basic networking tasks. Even 20-30 hours of practical work alongside study materials significantly improves retention and exam performance.
Candidates often confuse on-premises and cloud-specific tools, overlook hybrid authentication requirements, or miss the nuance of when to use replication versus backup. Another frequent error is misunderstanding network topology in hybrid scenarios. Carefully read scenario details, note whether the context is on-premises, cloud, or hybrid, and review explanations for every practice question.
In the final week, shift focus from new content to review and practice tests. Complete one full-length timed mock exam, review all incorrect answers, and spend 1-2 hours daily drilling weak topics. Avoid cramming new material; instead, reinforce concepts you already understand and build test-day rhythm and confidence.
You have an Active Directory Domain Services (AD DS) domain. The domain contains three servers named Server 1, Server2, and Server3 that run Windows Server.
You sign in to Server1 by using a domain account and start a remote PowerShell session to Server2. From the remote PowerShell session, you attempt to access a resource on Server3. but access to the resource is denied.
You need to ensure that your credentials are passed from Server1 to Server3. The solution must minimize administrative effort. What should you do?
In the Administering Windows Server Hybrid Core Infrastructure material under Windows Remote Management/PowerShell Remoting and authentication, Microsoft describes the classic ''second-hop'' issue: when you start a remote session to Server2 using Kerberos and then try to reach a resource on Server3, ''your delegated credentials are not forwarded by default.'' The guide explains that Kerberos ''does not allow delegation unless it is explicitly configured,'' and the recommended domain-based solution is Kerberos constrained delegation (KCD). With KCD you ''permit a specific computer account to delegate a user's Kerberos credentials only to explicitly listed services,'' for example allowing Server2 (the WinRM/HTTP endpoint you connect to) to delegate to CIFS on Server3 so file or other resource access succeeds during the second hop.
The docs contrast this with alternatives: CredSSP can work but ''is broader in exposure and requires enabling a less restrictive credential delegation mechanism,'' while JEA limits what commands can be run and does not solve credential delegation. Selective authentication applies to forest trusts, and Enforce user logon restrictions relates to KDC validation and is not a remedy for second-hop delegation. Because the requirement is to pass credentials from Server1 Server2 Server3 with minimal administrative touch and preserve security boundaries, configuring Kerberos constrained delegation on Server2's computer account for the target services on Server3 is the correct approach.
You have an on-premises server named Server1 that runs Windows Server. You have an Azure virtual network that contains an Azure virtual network gateway. You need to connect only Server1 to the Azure virtual network. What should you use?
The Administering Windows Server Hybrid Core Infrastructure curriculum (Windows Admin Center and Hybrid Networking objectives) describes Azure Network Adapter (ANA) as a Windows Admin Center feature that ''creates a Point-to-Site VPN from a single Windows Server to an Azure virtual network via an Azure VPN gateway.'' The documentation stresses that ANA is intended for scenarios where you need to connect just one server (or a small number of servers) to a VNet ''without deploying a VPN device,'' automating certificate creation, gateway configuration, and client settings on the server. By contrast, a Site-to-Site VPN connects entire on-premises networks (requires a VPN device or RRAS and affects more than one machine). ExpressRoute provides a private dedicated circuit for enterprise network connectivity, not a single-server tunnel. Azure Extended Network is used to stretch on-prem Layer-2 subnets into Azure for VM placement and is not the solution for a lone server's secure connectivity. Since your requirement is to connect only Server1 to the Azure VNet that already has a virtual network gateway, the documented, streamlined, and supported approach is Azure Network Adapter.
SIMULATION
Task 6
You need to ensure that you can manage DC1 by using Windows Admin Center on SRV1.
The required source files are located in a folder named \\dc1.contoso.com\install.
One possible solution to ensure that you can manage DC1 by using Windows Admin Center on SRV1 is to install Windows Admin Center on SRV1 and add DC1 as a managed server. Windows Admin Center is a web-based management tool that allows you to manage servers, clusters, Windows PCs, and Azure virtual machines (VMs) from a single interface. Here are the steps to install Windows Admin Center on SRV1 and add DC1 as a managed server:
On SRV1, open a web browser and go to the folder named \dc1.contoso.com\install. Download the Windows Admin Center installer file (WindowsAdminCenter.msi) and save it to a local folder, such as C:\Temp.
Run the Windows Admin Center installer file and follow the installation wizard. You can choose to install Windows Admin Center as a desktop app or as a service. For more information on how to install Windows Admin Center, seeInstall Windows Admin Center.
After the installation is complete, launch Windows Admin Center from the Start menu or the desktop shortcut. If you installed Windows Admin Center as a service, you can access it from a web browser by using the URL https://localhost:6516 or https://<SRV1>:6516, where <SRV1> is the name or IP address of SRV1.
On the Windows Admin Center dashboard, clickAddto add a new connection. SelectServeras the connection type and enter the name or IP address of DC1 in the Server name field. Optionally, you can specify the display name, description, and tags for the connection. ClickSubmitto add DC1 as a managed server.
On the Windows Admin Center dashboard, you should see DC1 listed under the Servers section. Click on DC1 to open the server overview page. From here, you can manage various aspects of DC1, such as roles and features, certificates, devices, events, files, firewall, processes, registry, services, and more. For more information on how to use Windows Admin Center to manage servers, seeManage servers with Windows Admin Center.
Now, you can manage DC1 by using Windows Admin Center on SRV1. You can also add more servers or other types of connections to Windows Admin Center and manage them from the same interface
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server. You plan to manage VM1 by using a PowerShell runbook.
You need to create the runbook. What should you create first?
In the Administering Windows Server Hybrid Core Infrastructure objectives for automating management of Windows Server IaaS VMs, Microsoft specifies that runbooks reside in and are executed from an Azure Automation account. The Automation account is the management boundary that contains your runbooks, modules (Az PowerShell), credentials/variables, schedules, and identities. The guide explains that before you can create or publish a PowerShell or PowerShell 7 runbook, an Automation account must exist in the target subscription and region. After the account is created, you author the runbook, import any required Az modules, and grant permissions (commonly through the Automation account's managed identity) so the runbook can manage resources such as an Azure VM (VM1). While a Log Analytics workspace can be linked for job logs and update management, it is not required to create the runbook itself. Likewise, Power Automate is a separate service for workflow orchestration and Azure Workbooks are for monitoring/visualization; neither is the container for runbooks. Therefore, the first prerequisite to manage VM1 with a PowerShell runbook is to create an Azure Automation account, and then create the runbook within that account, assign permissions, and schedule or start it as needed.
You have an Azure virtual machine named VM1 that runs Windows Server. You perform the following actions on VM1:
* Create a folder named Folder1 on volume C
* Create a folder named Folder2 on volume D.
* Add a new data disk to VM1 and create a new volume that is assigned drive letter E.
* Install an app named App1 on volume E.
You plan to resize VM1.
Which objects will present after you resize VM1?
In the Windows Server hybrid IaaS guidance for AZ-800 (Administering Windows Server Hybrid Core Infrastructure), resizing an Azure VM changes compute characteristics only (vCPU/memory/size family). The learning path on managing Windows Server IaaS VMs states that the VM's OS and any attached data disks persist across stop/deallocate and resize operations, and that drive letters and file data remain intact once the VM starts again. Applications installed on those persistent disks continue to function because the underlying VHDs are unchanged. The only disk that may be transient is the temporary (ephemeral) OS cache or D: temporary disk provided by some sizes; however, managed OS disk (C:) and any managed data disks (such as D: and the newly added E:) retain their contents. Consequently, the folders created on C: and D: remain, the additional data disk that was initialized as volume E remains attached with the same drive letter, and App1 installed on E: is still present after the resize. Therefore, after resizing VM1 you will still have Folder1, Folder2, volume E, and App1, making option D correct.
