Microsoft AZ-800 - Administering Windows Server Hybrid Core Infrastructure

The Windows Server DHCP role supports reservations that map a client’s unique identifier (commonly the MAC address) to a specific IPv4 address inside the scope. The AZ-800 study material describes reservations as the mechanism to “ensure that a particular device always receives the same IP address from the DHCP server while still being managed by DHCP.” When a reservation exists, the DHCP server will always offer and lease the reserved address to that client and will not allocate that address to any other client. This meets scenarios such as networked printers, appliances, or servers that require a consistent IP but where you still want centralized lease management (lease tracking, option delivery, and centralized auditing). The content further contrasts reservations with exclusions and options: exclusions remove addresses from the pool and options deliver configuration parameters, neither of which guarantees a stable assignment to a given device. Therefore, creating one DHCP reservation per printer in Scope1 precisely satisfies the requirement that the printers are always assigned the same IP address.

The Azure File Sync design guidance in Administering Windows Server Hybrid Core Infrastructure explains that a sync group defines one sync topology and is anchored by exactly one cloud endpoint (an Azure file share). The material states: “Each sync group contains a single cloud endpoint… Additional Azure file shares must be placed in separate sync groups.” Consequently, after Group1 uses share1 as its cloud endpoint, share2 cannot be added to the same sync group, which makes the first statement No.

For server endpoints, the guide notes: “A server endpoint represents a specific path on a registered Windows Server… A server can host multiple server endpoints, including in the same sync group, provided paths don’t overlap (no parent/child or identical paths).” Because D:\Folder1 is already in Group1, adding E:\Folder2 from the same Server1 is supported and non-overlapping, so the second statement is Yes.

Finally, multi-server synchronization is a core capability: “Multiple servers can be added as server endpoints to the same sync group to enable branch-to-branch and server-to-cloud sync; contents are merged in the Azure file share namespace.” Therefore, adding D:\Data from Server2 as another server endpoint in Group1 is fully supported, making the third statement Yes.

These rules satisfy the scenario: one cloud endpoint per sync group, multiple non-overlapping server endpoints (including multiple from the same server), and multi-server participation in the same group.

According to the official documentation for Administering Windows Server Hybrid Core Infrastructure, using Windows Admin Center (WAC) within the Azure portal to manage virtual machines requires specific network pathing depending on the IP configuration of the target VM. For a virtual machine like VM1 that is configured with only a private IP address, the management traffic originates from the browser on the administrator's local computer and must be able to reach that private IP address directly.

The primary requirement for this scenario is that the management PC must have access to the virtual network (VNet) that is connected to the VM. As specified in the study guides, when managing a VM via its private IP, you must establish a hybrid connectivity solution such as a VPN connection (either Point-to-Site or Site-to-Site) or Azure ExpressRoute. This bridge allows the on-premises Windows 11 computer to route traffic into the Azure Virtual Network's private address space. Without this underlying network connectivity, the browser-based WAC gateway—which is hosted as an extension on the VM—cannot communicate with the portal interface.

While Azure Bastion (Option A) provides secure RDP and SSH access, the Windows Admin Center extension specifically requires network-level routing from the client to the private IP for its portal-integrated management features. Network Security Group (NSG) rules (Option C) are necessary to allow traffic on specific ports (like 443 for the WAC service), but they do not provide the routing necessary to cross the boundary between an on-premises network and an Azure VNet. Similarly, Private Endpoints (Option D) are intended for accessing Azure PaaS services rather than providing a management path for IaaS VMs. Therefore, configuring a VPN connection is the verified mandatory step to satisfy the connectivity requirements for WAC in this hybrid context.

On VM1: Install and configure Routing and Remote Access

In Azure VNets, layer-3 routing between subnets is provided by the platform, but if you want a VM to act as a router (NVA) and forward traffic between subnets, two things are required: the NIC must be allowed to pass traffic not destined to itself, and the guest OS must be configured to perform IP forwarding/routing. The Administering Windows Server Hybrid Core Infrastructure guidance for “Manage and maintain Windows Server IaaS virtual machines” and “Implement on-premises and hybrid networking” explains that Azure requires IP forwarding to be enabled on the NIC for any VM acting as a router or load balancer so that the fabric will deliver transit packets to the VM instead of dropping them. The Windows Server role that provides routing is Routing and Remote Access (RRAS); enabling the LAN routing feature configures the TCP/IP stack to forward packets between interfaces (including forwarding back out the same interface when used with Azure’s virtual switch). The same material notes that adding extra NICs is not mandatory for simple transit scenarios, and that user-defined routes can be used when you need to steer traffic through the router; however, to enable the VM itself to route, the minimal administrative steps are: turn on IP forwarding for the NIC in Azure and install/configure RRAS in the guest. This combination allows VM1 to route traffic between Subnet1 and Subnet3 with the least effort.

In the Administering Windows Server Hybrid Core Infrastructure guidance for name resolution with Azure Private DNS, Microsoft describes the split-horizon scenario where you host contoso.com both as a Public DNS zone and as an Azure Private DNS zone linked to a virtual network. The documentation explains that Azure Private DNS “is resolvable only from within the VNet” and that the special Azure DNS virtual IP 168.63.129.16 is the target used by workloads inside the VNet to resolve private zone records. For hybrid resolution from on-premises, the guidance states that you deploy a DNS forwarder/proxy VM in the VNet (a Windows Server DNS role is acceptable) and configure it with a conditional forwarder for the private zone that forwards to 168.63.129.16. Then, on the on-premises DNS servers, you create a conditional forwarder for the same zone that points to the DNS forwarder VM in Azure across the Site-to-Site VPN. This pattern ensures on-premises queries for contoso.com resolve the private zone records via Azure, while public Internet clients continue to use the public DNS zone. Consequently:

On VNet1, VM1 (DNS server) must forward contoso.com queries to 168.63.129.16.

On the on-premises DNS, configure a conditional forwarder for contoso.com to VM1.Setting VNet DNS to the Azure-provided IP is unnecessary (it’s the default for Azure VMs) and forwarding to the public zone would bypass the private zone, which is not desired.

The hybrid networking module in AZ-800 details Azure Network Adapter (ANA) as a Windows Admin Center (WAC) workflow that creates a point-to-site (P2S) VPN from an on-premises Windows Server to an Azure virtual network. The documentation states that ANA is initiated directly from Windows Admin Center, which automates provisioning of the necessary Azure resources (e.g., VPN gateway configuration and certificates) and installs/configures the VPN client on the server, establishing secure connectivity to the target VNet. The Azure portal does not install or configure the on-premises VPN client for a standalone server; Azure AD Connect is used for identity synchronization and is unrelated to network tunneling; and Device Manager is not used for configuring VPN or Azure connectivity. In practice, you add the server to WAC, open the Network tool, and select Add Azure Network Adapter, sign in to Azure, choose VNet1, and complete the wizard. This is the prescribed, streamlined method for connecting Server1 to VNet1 using Azure Network Adapter, validating Windows Admin Center as the correct choice.

The Administering Windows Server Hybrid Core Infrastructure curriculum (Windows Admin Center and Hybrid Networking objectives) describes Azure Network Adapter (ANA) as a Windows Admin Center feature that “creates a Point-to-Site VPN from a single Windows Server to an Azure virtual network via an Azure VPN gateway.” The documentation stresses that ANA is intended for scenarios where you need to connect just one server (or a small number of servers) to a VNet “without deploying a VPN device,” automating certificate creation, gateway configuration, and client settings on the server. By contrast, a Site-to-Site VPN connects entire on-premises networks (requires a VPN device or RRAS and affects more than one machine). ExpressRoute provides a private dedicated circuit for enterprise network connectivity, not a single-server tunnel. Azure Extended Network is used to stretch on-prem Layer-2 subnets into Azure for VM placement and is not the solution for a lone server’s secure connectivity. Since your requirement is to connect only Server1 to the Azure VNet that already has a virtual network gateway, the documented, streamlined, and supported approach is Azure Network Adapter.