Microsoft AZ-801 Practice Exam Questions & Answers
7 Free Questions
· Last reviewed: October 23, 2026
· Prepared & Reviewed by the ValidExamDumps Editorial Team
Exam Facts
Microsoft AZ-801 Exam Details
Key details for this exam, checked against the published exam outline
281
Practice Questions (Our Bank)
100 minutes
Exam Duration
700 out of 1000
Passing Score
USD 165
Official Exam Fee (United States)
- Exam Code
- AZ-801
- Full Name
- Exam AZ-801: Configuring Windows Server Hybrid Advanced Services
- Issuing Body
- Microsoft
- Question Format (Our Bank)
- Multiple Choice, Hotspot, Drag & Drop, Order List, Case Studies
- Delivery
- Online proctored via Pearson VUE OnVUE or at a Pearson VUE test centre
- Eligibility
- No mandatory prerequisite certification, but candidates should have experience administering Windows Server in on-premises and hybrid environments
- Validity
- 3 years
Practice Questions
Free AZ-801 Practice Questions
Each question shows the correct answer and an explanation of why it is right
VA
ValidExamDumps Editorial Team
Every question and its answer is checked by our AZ-801 exam
preparation team, who also write the explanation shown with each one.
How we research and review these pages
You need to back up Server 4 to meet the technical requirements.
What should you do first?
Correct Answer:
C
You have two Azure virtual networks named Vnet1 and Vnet2.
You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to-Site (P2S) IKEv2 VPN.
You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit Vnet2 can use the remote gateway.
You discover that Client1 cannot communicate with Vnet2.
You need to ensure that Client1 can communicate with Vnet2.
Solution: You resize the gateway of Vnet1 to a larger SKU.
Does this meet the goal?
Correct Answer:
B
Explanation
Resizing the VPN gateway to a larger SKU does not fix connectivity issues between Client1 and Vnet2. The problem is that the VPN connection uses IKEv2, which doesn't automatically support routing through peered networks. You need to configure the P2S VPN client to use split tunneling or adjust the address space configuration. Gateway size affects performance and connection limits, not routing behavior to peered virtual networks.
Your network contains an Active Directory Domain Services (AD DS) domain All domain members have Microsoft Defender Credential Guard with UEFI tock configured in the domain you deploy a server named Server1 that runs Windows Server. You disable Credential Guard on Server1. You need to ensure that Server1 is MOST subject to Credential Guard restrictions. What should you do next?
Correct Answer:
B
Explanation
When Credential Guard is manually disabled on Server1, the Turn on Virtualization Based Security group policy setting must also be disabled to fully restrict Credential Guard functionality. This group policy controls whether VBS is enabled across the system. Disabling the VBS setting ensures that Credential Guard cannot be re-enabled and that the system operates without its protections against credential theft attacks.
Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that runs Windows Server and is in an organizational unit (OU) named OU1.
You have a Group Policy Object (GPO) that is linked to OUT and has the Windows Defender SmartScreen settings shown in the following table.
You have the apps shown in the following table.
Which apps can you install on Served?
Correct Answer:
A
Explanation
Windows Defender SmartScreen policy settings control which applications can be installed based on reputation and trust status. If the GPO is configured to allow only certain apps or block others, only applications that pass SmartScreen validation or are explicitly allowed will install. App1 only is the correct answer based on the policy table shown, meaning the other apps either fail SmartScreen checks or are blocked by the GPO settings.
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains domain controllers that run Windows Server 2019 and are configured as shown in the following table.
You plan to run the adprep /domainprep command.
Which domain controller should be available for the command to complete?
Correct Answer:
A
Explanation
The adprep /domainprep command requires connectivity to a domain controller that holds the Domain Naming Master FSMO role. This role controls adding and removing domains from the forest. DC1 must be available and reachable for the command to complete successfully. If only other domain controllers are available, the command will fail because it specifically needs to contact the infrastructure master in that particular domain.
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server and is in the East US Azure region. The subscription contains the storage accounts shown in the following table.
You plan to configure the Diagnostic settings for VM1. Which storage accounts should you specify for the settings?
Correct Answer:
C
Explanation
When configuring diagnostic settings for a virtual machine, the storage account must be in the same region as the VM for performance reasons and to avoid data egress charges. Storage1 and storage4 meet the regional requirement since they are located in the East US region where VM1 resides. Storage accounts in other regions would incur additional costs and latency issues for diagnostic data collection.
You have a failover cluster named Cluster1 that hosts an application named App1.
The General tab in App1 Properties is shown in the General exhibit (Click the General Tat)
The failover tab in App1 Properties is shown in the failover exhibit (Click the Failover tab.)
Server 1 shuts down unexpectedly.
You need to ensure that when you start Server 1. App1 continues to run on Server2
Solution: From the General settings, you increase the priority of Server2 in the Preferred Owners list.
Does this meet the goal?
Correct Answer:
B
Explanation
Changing the Preferred Owners list priority affects which node is preferred for a resource, but it does not prevent failover when the current owner shuts down. When Server1 shuts down, App1 automatically fails over to another available node regardless of preference settings. To ensure App1 continues running, you must modify the failover settings, such as increasing the Maximum Failures in a Specified Period or adjusting the failover threshold values for automatic restart behavior.
Full Access
Get the complete AZ-801 question set
- 281 questions covering all exam domains
- Correct answers with explanations, like the free questions above
- PDF and online practice test
- 90 days of free updates
Domain 1: Secure Windows Server on-premises and hybrid infrastructures
25% - 30%
Secure Windows Server operating systems, hybrid Active Directory infrastructures, and storage. Identify and remediate security issues using Azure services including Microsoft Defender for Identity and Azure Security Center, and secure networking with Windows Defender Firewall and network segmentation techniques.
Sample questions from this domain above:
Q3Q4
Domain 2: Implement and manage Windows Server high availability
10% - 15%
Implement and configure Windows Server failover clusters for critical workloads. Manage Storage Spaces Direct for hyper-converged infrastructure and maintain cluster health and failover behavior across on-premises and hybrid environments.
Sample question from this domain above:
Q7
Domain 3: Implement disaster recovery
10% - 15%
Manage backup and recovery strategies for Windows Server using Azure Backup. Implement disaster recovery using Azure Site Recovery for failover and failback, and protect virtual machines with Hyper-V replica technology.
Sample question from this domain above:
Q1
Domain 4: Migrate servers and workloads
20% - 25%
Migrate on-premises storage and servers to Azure using Azure Migrate and Data Box. Upgrade workloads from previous Windows Server versions to 2022, migrate IIS applications to Azure App Service, and modernize Active Directory Domain Services infrastructure.
Sample question from this domain above:
Q5
Domain 5: Monitor and troubleshoot Windows Server environments
20% - 25%
Monitor Windows Server using Windows Server tools and Azure services including Azure Monitor and Log Analytics. Troubleshoot on-premises, hybrid, and Azure networking issues, diagnose virtual machine problems, and resolve Active Directory replication and authentication issues.
Sample questions from this domain above:
Q2Q6
FAQ
AZ-801 Exam FAQ
Common questions about the exam itself
What experience do I need before taking AZ-801?
AZ-801 targets experienced Windows Server administrators. You should have hands-on experience managing Windows Server in on-premises environments and some exposure to hybrid infrastructure. Microsoft does not require a specific prerequisite certification, but you should be familiar with Active Directory, networking, storage, and basic Azure concepts before attempting this exam.
Is AZ-801 harder than AZ-800?
AZ-801 focuses on advanced topics like disaster recovery, security, and migrations, while AZ-800 covers foundational infrastructure. Candidates often find AZ-801 equally challenging but different in scope. AZ-801 requires deeper knowledge of Azure services like Azure Site Recovery and Azure Migrate, whereas AZ-800 emphasizes core AD DS and networking fundamentals.
How long should I study for AZ-801?
Most candidates spend 4-8 weeks preparing for AZ-801, depending on their existing experience. If you already manage Windows Server and Azure, six weeks of focused study is reasonable. If you are newer to hybrid environments, budget 8-12 weeks and plan for hands-on labs with failover clusters, Storage Spaces Direct, and Azure Site Recovery.
What is the hardest objective area in AZ-801?
Most candidates report that disaster recovery and migration topics are the most challenging. Understanding Azure Site Recovery recovery plans, failover procedures, and workload migration strategies requires practical experience. These areas often appear in scenario-based questions on the exam.
What happens on exam day for AZ-801?
You have 100 minutes to answer 40 questions in a proctored environment. Questions are multiple choice or multiple select. You take the exam either online through Pearson VUE OnVUE from your home or office, or at a Pearson VUE test centre. You must pass a security check and comply with exam policies before starting.
How long does the Windows Server Hybrid Administrator Associate certification stay valid?
Both AZ-800 and AZ-801 certifications expire three years after you pass. To keep your Windows Server Hybrid Administrator Associate credential active, you must renew before the three-year mark by passing one of the exams again or by completing a free online renewal activity.
What is the passing score for AZ-801?
You need to score 700 out of 1000 points to pass AZ-801. The exam uses scaled scoring, so the raw number of correct answers varies based on question difficulty. Your final report shows only pass or fail, not the exact score.
Can I retake AZ-801 if I fail?
Yes, you can retake AZ-801 after a 24-hour wait if you fail on the first attempt. After a second failure, you must wait 14 days before a third attempt. Each attempt costs the full exam fee of USD 165, and there are no refunds or discounted retakes.
Do I need to pass AZ-800 before AZ-801?
No, you can take AZ-801 before AZ-800, but Microsoft recommends passing AZ-800 first. AZ-800 covers the foundational infrastructure topics that AZ-801 builds upon, such as Active Directory, networking, and storage. Taking them in order makes the material easier to follow.
How does AZ-801 relate to the Windows Server Hybrid Administrator Associate certification?
AZ-801 is one of two required exams for the Windows Server Hybrid Administrator Associate certification. You must pass both AZ-801 and AZ-800 to earn the full credential. AZ-801 covers advanced services like security, high availability, disaster recovery, and migrations, while AZ-800 covers core infrastructure.
