Microsoft AZ-800 - Administering Windows Server Hybrid Core Infrastructure

The Active Directory replication module explains that inter-site replication defaults to scheduled polling with a 180-minute interval and does not use change notifications. The guide notes: “To reduce replication latency (convergence time) between sites, you can enable inter-site change notifications by setting the site link options attribute. When enabled, a change at one site triggers notifications to partners across the site link, initiating replication promptly rather than waiting for the next schedule.” Adjusting site link cost influences topology selection by the KCC but “does not change the frequency of replication.” Similarly, editing the replication schedule can help, but even an ‘always on’ schedule retains the inter-site polling behavior unless change notification is enabled; the documented fastest method is enabling change notification via the options attribute on each site link. Creating site link bridges is intended for transitivity/topology and does not directly lower latency. Therefore, to minimize convergence time, modify the options attribute on each site link to enable inter-site change notifications.

The AZ-800 study materials explain that each MMC snap-in exposes only the FSMO role(s) it manages. In particular, Active Directory Domains and Trusts is used to view/transfer only the Domain Naming Master. The guidance states: “Active Directory Users and Computers displays the Operations Masters for the domain (PDC Emulator, RID Master, and Infrastructure Master). Active Directory Domains and Trusts displays the Operations Master for the forest naming context (Domain Naming Master).” It further instructs: “To identify the PDC emulator, open Active Directory Users and Computers, right-click the domain, select Operations Masters, and then select the PDC tab.” Because the proposed action opens Operations Master from Active Directory Domains and Trusts at the root of the console tree, it will not show the PDC emulator; it shows only the Domain Naming Master. Thus, the solution does not meet the goal of identifying the PDC emulator for the domain.

Infrastructure documents: =

In Just Enough Administration (JEA), you restrict what remote users can do by creating two artifacts: role capability files (*.psrc) and a session configuration file (*.pssc). The role capability file defines which commands are visible/usable (for example, specific Hyper-V cmdlets via VisibleCmdlets, VisibleFunctions, or VisibleExternalCommands). The session configuration file then maps users or groups to one or more role capabilities using RoleDefinitions.

The Administering Windows Server Hybrid Core Infrastructure material explains that once those files are authored, you must expose a JEA endpoint by registering the session configuration on the target server. This is accomplished with Register-PSSessionConfiguration, pointing to the PS session configuration file (.pssc). Registering the endpoint enforces the role capability restrictions when helpdesk users connect (for example, Enter-PSSession -ConfigurationName HyperVJeaHelpDesk -ComputerName Server1).

New-PSSessionConfigurationFile is used earlier to create the .pssc file, but the prompt states the files are already built. Enter-PSSession only starts a session and does not publish the configuration. Therefore, the correct command to limit which Hyper-V module cmdlets helpdesk users can use is:

Register-PSSessionConfiguration -Path .\HyperVJeaConfig.pssc -Name 'HyperVJeaHelpDesk' -Force.

The Administering Windows Server Hybrid Core Infrastructure guidance for Network Policy Server (NPS) states that NPS processes requests only from configured and enabled RADIUS clients. The documentation explains that a RADIUS client entry must “identify the device by its IP address or DNS name,” and that “requests from devices not defined as RADIUS clients (or clients that are disabled) are discarded.” It also notes that the “shared secret must match on the access server and on the RADIUS client definition,” and that enabling the client is required for NPS to accept authentication from that device.

Applying these rules:

VPN1 (172.16.0.254) matches NPSClient1 by IP, but Enabled: False. Because disabled clients are rejected, users cannot authenticate to VPN1 through NPS1.

VPN2 (131.10.15.254) matches NPSClient2 and is Enabled: True with the correct shared secret. Therefore, users can authenticate successfully to VPN2.

VPN3 (10.10.0.254) does not match any enabled RADIUS client entry. The only similar entry, NPSClient3, is configured for 172.16.1.254 (wrong IP). Since NPS identifies clients by IP/FQDN and rejects unknown devices, users cannot authenticate to VPN3.

Because “all users are allowed to establish VPN connections,” user policy is not the blocker—the RADIUS client configuration (enabled state and correct IP mapping) determines success here.

Disk1 (three-way mirror): 2 disks; Disk2 (parity): 1 disk

\In the Administering Windows Server Hybrid Core Infrastructure materials on Storage Spaces resiliency, Microsoft describes how each resiliency type determines simultaneous disk-failure tolerance. The guide explains that mirror spaces keep multiple copies of data: “Two-way mirror writes two copies and can sustain a single disk failure; three-way mirror writes three copies and can sustain the loss of any two disks without data loss.” It also differentiates parity spaces, which stripe data with parity information: “Parity provides capacity efficiency comparable to RAID-5 and tolerates a single disk failure (use dual parity to withstand two failures).”

Applying these to SSPace1:

Disk1 uses a three-way mirror across eight physical disks. By definition, a three-way mirror survives two concurrent disk failures and remains online, satisfying the “always available” requirement.

Disk2 is configured as parity across twelve physical disks. Standard parity (single parity) is equivalent to RAID-5 and survives one disk failure; only dual parity would allow two, but the configuration provided specifies parity (not dual parity).

Therefore, the maximum simultaneous physical disk failures while maintaining availability are 2 for Disk1 and 1 for Disk2.

According to the Administering Windows Server Hybrid Core Infrastructure (AZ-800) exam study materials, Azure DNS Private Resolver allows bidirectional name resolution between on-premises environments and Azure private DNS zones. The Private DNS Resolver consists of inbound endpoints (to resolve queries from on-premises to Azure) and outbound endpoints (to resolve queries from Azure to on-premises DNS servers). For name resolution to work, private DNS zones must be linked to the virtual network associated with the resolver’s hub network.

In this scenario, the planned configuration specifies:

A Private DNS Resolver named Private1 created in the West US region and linked to VNet1.

An inbound endpoint in SubnetB.

The requirement is to identify which private DNS zones will be available for name resolution through this resolver.

From the details given, only Zone1.com and Zone2.com are linked to VNet1, allowing them to participate in name resolution using the resolver. Zone3.com is not linked to VNet1 (either unlinked or linked to another virtual network), and therefore it cannot be resolved through the DNS Resolver in VNet1.

As emphasized in Microsoft’s hybrid infrastructure documentation:

“Private DNS zones must be linked to the same virtual network that contains the Private DNS Resolver or to peered virtual networks for name resolution to succeed.”

Hence, only Zone1.com and Zone2.com are available for name resolution through the Private DNS Resolver.

✅ Correct Answer: C. Zone1.com and Zone2.com only

The Administering Windows Server Hybrid Core Infrastructure content notes that Microsoft Entra Connect cloud sync uses lightweight agents and supports synchronizing specific OUs from multiple forests into a single tenant. The guide highlights that cloud sync “is designed for multi-forest or cross-organization scenarios and allows scoping to selected OUs and groups,” enabling granular onboarding of just the identities you need. The requirement says “the users in the Marketing OU (in Fabrikam’s forest) must have access to storage1.” Granting access to Azure Files using Entra-based authorization requires that those users exist in the same Entra tenant. Cloud sync enables importing only the Fabrikam Marketing OU into A. Datum’s tenant without establishing full trust for all users. Azure AD Connect in active or staging mode would target the A. Datum forest and isn’t intended for selectively bringing in a separate partner forest OU; AD FS is a federation solution and does not create tenant objects for ACLs on Azure resources like Azure Files. Therefore, implement Microsoft Entra Connect cloud sync and scope it to the Marketing OU to meet the requirement.