Pass the Microsoft Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-800 Questions and answers with CertsForce

When Windows Server is used as a DHCP Relay Agent, the feature is delivered through Routing and Remote Access Service (RRAS). The AZ-800 content explains: “The DHCP Relay Agent is a component of RRAS and is installed by adding the Remote Access role and enabling the Routing role service.” After installation, admins configure the relay interface(s) and specify the IP addresses of one or more DHCP servers to which broadcast DHCPDISCOVER messages are forwarded. The documentation further notes: “Network Policy and Access Services (NPS) provides RADIUS and policy evaluation, not DHCP relay; the DHCP Server role offers DHCP lease services, not relay.” Thus, to prepare the server that sits on the new subnet to forward DHCP requests, you must install the Remote Access role (and within it, the Routing role service), then add the DHCP Relay Agent in the RRAS console or via PowerShell. QUESTION NO: 162

You have an on-premises server named Server! that runs Windows Server.

You have an Azure subscription that contains a virt ual network named VNet1.

You need to connect Server1 to VNet1 by using Azure Network Adapter.

What should you use?

A. Azure AD Connect

B. Device Manager

C. the Azure portal

D. Windows Admin Center

Answer: D

The Administering Windows Server H ybrid Core Infrastructure study guides describe Azure Network Adapter (ANA) as “a Windows Admin Center (WAC) workflow that creates a point-to-site VPN from an on-premises Windows Server to an Azure virtual network.” The guidance emphasizes: “ANA is initiated and configured exclusively from Windows Admin Center; it automates creation of the Azure VPN gateway side and the client configuration on the server.” The Azure portal does not expose an “ANA” button for a standalone server, Device Manager has no role, and Azure AD Connect is for directory synchronization, not networking. The steps include registering WAC with Azure, selecting Add > Azure Network Adapter on the target server, choosing the subscription/resource group/VNet (e.g., VNet1), and letting WAC provision the P2S configuration and Windows VPN client profile. Therefore, to connect Server1 to VNet1 using Azure Network Adapter, you must use Windows Admin Center.

n the Administering Windows Server Hybrid Core Infrastructure guidance for managing AD DS, Microsoft emphasizes using OU-level delegation to satisfy administrative needs while adhering to the principle of least privilege. The documentation explains that the Delegate Control wizard on an OU lets you grant a user or group only the specific permissions required for common tasks, including “Modify the membership of a group”. This grants the write permission to the member attribute on group objects contained in that OU, without giving broader account-management rights across the domain.

By contrast, placing a user in Account Operators or Server Operators provides elevated, domain-wide capabilities far beyond what is required. Account Operators can create, delete, and modify many account types across the domain (except for protected admin accounts), which violates least-privilege for a task that only needs to change group membership in one OU. Server Operators is unrelated to group membership and is intended for server administration tasks. Creating a delegation at the domain root would similarly be excessive because it applies broadly to all containers and OUs.

Therefore, to meet the requirement “Ensure that User1 can manage the membership of all the groups in Contoso\OU3,” you should delegate control on OU3 and assign the built-in task “Modify the membership of a group” to User1, achieving the minimal permissions necessary.

In the Administering Windows Server Hybrid Core Infrastructure content for File Services, Microsoft describes File Server Resource Manager (FSRM) as the feature used to control the types of files that users can store on file servers. The guide explains that a file screen “prevents users from saving unauthorized file types on a volume or in a folder by applying a file group (such as Audio and Video) or custom file name patterns (for example, *.mp4).” It further clarifies that file screening “does not affect access permissions to other files and folders and allows permitted file types to be stored without restriction.” By contrast, NTFS permissions govern access (read/write/modify) and “cannot filter by file extension,” and NTFS quotas and File Management Tasks address capacity and automated tasks, not content blocking. Therefore, to stop users from storing .MP4 while allowing all other files, you create a File Screen on the path to Share1 and block either the built-in Audio and Video file group or a custom pattern *.mp4. This aligns precisely with the exam guide’s directive that FSRM File Screening is the supported and intended method to restrict file types on Windows file shares while leaving other file operations unaffected.

The Administering Windows Server Hybrid Core Infrastructure materials state the placement and provisioning requirements for IP Address Management (IPAM). Specifically:

“The IPAM server must be installed on a domain member computer . You cannot install the IPAM server feature on a domain controller .”

“IPAM manages and discovers domain controllers, DHCP servers, and DNS servers in the domain. Servers in a workgroup are not supported as managed servers.”

“When you choose Group Policy–based provisioning , IPAM creates and links GPOs that configure the required settings on managed DC/DHCP/DNS servers so that IPAM can perform inventory, event collection, and address space management.”

Applying these rules:

Server2 is a domain-joined Windows Server Core member with no conflicting roles, satisfying the guidance to avoid installing IPAM on a DC and aligning with the recommendation to place IPAM on a dedicated member server. DC1 is a domain controller (and DNS), so it must not host IPAM. Server1 (DHCP) could host IPAM but best practice is to use a dedicated server. Server3 is in a workgroup, so it cannot host IPAM or be managed by it.

For GPO-based provisioning and server discovery, the managed servers that must be provisioned are the infrastructure role holders: DC1 (AD DS/DNS) and Server1 (DHCP). These are exactly the servers IPAM discovers and manages via the created GPOs.

In Azure A D Domain Services (Azure AD DS), administrative tasks for the managed domain—such as DNS and Group Policy—are performed by users who belong to the AAD DC Administrators group. The AZ-800 study guidance explains that Azure AD DS does not expose traditional Domain Admins or Enterprise Admins ; instead, membership in AAD DC Administrators grants rights to create and edit GPOs, manage DNS, and perform domain-joined VM administration within the managed domain . The same guidance notes that Azure AD DS provides two writable OUs by default: AADDC Computers and AADDC Users . You manage computer settings (including local security options and password policies that affect the local SAM of domain-joined Windows VMs) by linking GPOs to the AADDC Computers OU .

The Group Pol icy path to configure local password policy is Computer Configuration \ Windows Settings \ Security Settings \ Account Policies \ Password Policy . Because these are computer-level policies , they must be applied to computer objects, which in Azure AD DS res ide under AADDC Computers . Therefore, to configure a password policy for local accounts on Azure VMs joined to the managed domain, you (1) sign in with an account in AAD DC Administrators , and (2) create/link the GPO to the AADDC Computers OU so the policy applies to those VMs.

In Windows Admin Center (WAC), “gateway access” is controlled by the Allowed groups list on the gateway. The AZ-800 materials explain that membership in the local Administrators group on the WAC gateway still permits sign-in unless you explicitly scope access to specific groups in the Allowed groups list . The guidance further states that to restrict who can sign in to the WAC gateway, you must populate Allowed groups with one or more security groups (for example, a domain group) and remove broad principals (like BUILTIN\Users). Until you add at least one explicit group, existing administrators can continue to authenticate, which is why “everyone” appears able to sign in after only removing BUILTIN\Users. By adding a dedicated security group to Allowed groups, only members of that group can authenticate to the gateway UI; non-members are denied. Settings such as Performance profile or Require manage-as sessions to re-authenticate affect performance and remote management prompts, not gateway sign-in. Proxy bypass lists control outbound connectivity, not access control. Therefore, to prevent unauthorized sign-ins, configure Allowed groups with a specific security group and manage membership there.

The hybrid identity guidance for Windows Server and Azure emphasizes using Azure AD (Microsoft Entra ID) security groups for unified authorization across Azure Files (Azure Storage with Azure AD-based access control) and on-premises SMB shares—when Group writeback is enabled in Azure AD Connect. The documented pattern is: create the group in Azure AD with assigned membership so you can grant Azure roles/share permissions to storage2\share2 using Azure AD identities. Because Group writeback is enabled, that Azure AD security group is written back to on-premises AD DS as a universal security group, allowing you to use the same group on NTFS/share permissions for Server1\Share1. Members can be synchronized AD DS users; adding them in Azure AD (assigned membership) ensures predictable inclusion for both resources.

Creating the group only in AD DS (Option A) can sync to Azure, but the hybrid guidance highlights Azure-originated groups with writeback when you want one source to drive both cloud and on-prem authorization and to ensure compatibility with Azure Files’ Azure AD-based access checks. Dynamic membership (Option C) is unnecessary here and may not align with file access scenarios. Microsoft 365 groups (Option D) are not intended for file share ACLs/RBAC in this context. Thus, the verified solution is to create an Azure AD security group with assigned membership, taking advantage of group writeback for on-premises use.

Within the Administering Windows Server Hybrid Core Infrastructure content for AD DS deployment, Microsoft specifies that Install From Media (IFM) for promoting a domain controller—especially a Read-Only Domain Con troller (RODC) —must be created from a writable domain controller in the same target domain . The guide explains that IFM “pre-stages the AD DS database so that the promotion consumes far less replication traffic,” and it emphasizes: “RODC IFM cannot be gene rated from an RODC; it must be created on a writable DC of the destination domain.” It also clarifies tool choice: “Use ntdsutil ifm to generate media for a writable DC or an RODC. The media is then used during promotion to avoid full initial replication a cross the network.”

Applied here: the server to be promoted (Server1) will be an RODC in child.contoso.com . The only writable DC in that domain shown is DC2 (Domain-wide FSMO holder for child. contoso.com ), making it the correct and traffic-efficient source . DC1 and RODC3 are in contoso.com (parent domain), so neither meets the requirement; additionally, an RODC cannot be used as an IFM source . Regarding tooling, the documentation notes that Windows Server Backup is for system-state backup/restore and is not the supported method to generate IFM media ; the prescribed tool is Ntdsutil.exe with the IFM context . Therefore, to minimize network traffic and satisfy Azure/AD DS best practices, create the IFM media on DC2 using Ntdsutil.exe and then promote Server1 wi th that media.

-- > Turn on BranchCache

-- > Enable Automatic Hosted Cache Di scovery by Service Connection ...

The Azure File Sync section of the Administering Windows Server Hybrid Core Infrastructure materials states that a sync group defines the topology for synchronization and “contains one cloud endpoint and one or more server endpoints.” A cloud endpoint is an Azure file share associated with a Storage Sync Service. The guidance also notes that “the Storage Sync Service and the storage account (file share) must reside in the same Azure region” and that “a single Azure file share can be the cloud endpoint for only one sync group.” In the scenario, SyncA is in West US, so only file shares in West US (for example, storage1\share1 or storage2\share2) are eligible. However, regardless of how many eligible shares exist, the exam guide is explicit: each sync group supports a maximum of one cloud endpoint. Additional endpoints in the group must be server endpoints on Windows Server volumes. Therefore, the maximum number of cloud endpoints you can use with GroupA is 1, which directly reflects the product’s architecture and the documented exam objective requirements.