Pass the Microsoft Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-800 Questions and answers with CertsForce

Microsoft Entra Connect (Azure AD Connect) reads the on-premises AD DS schema to determine which attributes are available for synchronization. The hybrid administrator guidance states that after extending AD with new/custom attributes, you must refresh the directory schema in Entra Connect so the sync engine recognizes the new attributes; only then can you include them in the synchronization rules (“Customize synchronization options”) for export to Microsoft Entra ID. Until a schema refresh occurs, queries from Azure (e.g., via Cloud Shell) will not surface those attributes because the connector does not know about them. Thus, the first step is to run “Refresh directory schema” in Microsoft Entra Connect; afterwards you can map/select the custom attributes in the sync rules and verify they flow to Microsoft Entra ID.

The Windows Server DHCP role supports reservations that map a client’s unique identifier (commonly the MAC address) to a specific IPv4 address inside the scope. The AZ-800 study material describes reservations as the mechanism to “ensure that a particular device always receives the same IP address from the DHCP server while still being managed by DHCP.” When a reservation exists, the DHCP server will always offer and lease the reserved address to that client and will not allocate that address to any other client. This meets scenarios such as networked printers, appliances, or servers that require a consistent IP but where you still want centralized lease management (lease tracking, option delivery, and centralized auditing). The content further contrasts reservations with exclusions and options: exclusions remove addresses from the pool and options deliver configuration parameters, neither of which guarantees a stable assignment to a given device. Therefore, creating one DHCP reservation per printer in Scope1 precisely satisfies the requirement that the printers are always assigned the same IP address.

According to the official documentation for Administering Windows Server Hybrid Core Infrastructure , using Windows Admin Center (WAC) within the Azure portal to manage virtual machines requires specific network pathing depending on the IP configuration of the target VM. For a virtual machine like VM1 that is configured with only a private IP address , the management traffic originat es from the browser on the administrator ' s local computer and must be able to reach that private IP address directly.

The primary requirement for this scenario is that the management PC must have access to the virtual network (VNet) that is connected to th e VM. As specified in the study guides, when managing a VM via its private IP, you must establish a hybrid connectivity solution such as a VPN connection (either Point-to-Site or Site-to-Site) or Azure ExpressRoute . This bridge allows the on-premises Windo ws 11 computer to route traffic into the Azure Virtual Network ' s private address space. Without this underlying network connectivity, the browser-based WAC gateway—which is hosted as an extension on the VM—cannot communicate with the portal interface.

Whil e Azure Bastion (Option A) provides secure RDP and SSH access, the Windows Admin Center extension specifically requires network-level routing from the client to the private IP for its portal-integrated management features. Network Security Group (NSG) rule s (Option C) are necessary to allow traffic on specific ports (like 443 for the WAC service), but they do not provide the routing necessary to cross the boundary between an on-premises network and an Azure VNet. Similarly, Private Endpoints (Option D) are intended for accessing Azure PaaS services rather than providing a management path for IaaS VMs. Therefore, configuring a VPN connection is the verified mandatory step to satisfy the connectivity requirements for WAC in this hybrid context.

An address exclusion in a DHCP scope simply removes one or more IP addresses (or a range) from the scope’s available lease pool so the DHCP server will never hand out those addresses to any client. The AZ-800/Windows Server Hybrid Core Infrastructure guidance explains: “Use exclusions to prevent specific addresses in a scope from being leased,” noting that exclusions are commonly used to protect addresses that are statically configured on devices or reserved for other purposes. Crucially, exclusions do not associate a particular address with a particular client; they only withhold those addresses from automatic allocation. If you created exclusions “for each printer,” the server would not lease those IPs at all, and the printers would not automatically receive them. To provide deterministic assignment while still using DHCP, you must configure DHCP reservations that bind each printer’s MAC address to its intended IP. Thus, exclusions alone do not meet the requirement that the printers are always assigned the same IP address by DHCP.

Disk1 (three-way mirror): 2 disks; Disk2 (parity): 1 disk

\In the Administering Windows Server Hybrid Core Infrastructure materials on Storage Spaces resiliency, Microsoft describes how each resiliency type determines simultaneous disk-failure tolerance. The guide explains that mirror spaces keep multiple copies of data: “Two-way mirror writes two copies and can sustain a single disk failure; three-way mirror writes three copies and can sustain the loss of any two disks without data loss.” It also differentiates parity spaces , which stripe data with parity information: “Parity provides capacity efficiency comparable to RAID-5 and tolerates a single disk failure (use dual parity to withstand two failures).”

Applying these to SSPace1:

Disk1 uses a three-way mirror across eight physical disks. By definition, a three-way mirror survives two concurrent disk failures and remains online, satisfying the “always available” requirement.

Disk2 is configured as parity across twelve ph ysical disks. Standard parity (single parity) is equivalent to RAID-5 and survives one disk failure ; only dual parity would allow two, but the configuration provided specifies parity (not dual parity).

Therefore, the maximum simultaneous physical disk fail ures while maintaining availability are 2 for Disk1 and 1 for Disk2 .

One possi ble solution to ensure that you can manage DC1 by using Windows Admin Center on SRV1 is to install Windows Admin Center on SRV1 and add DC1 as a managed server. Windows Admin Center is a web-based management tool that allows you to manage servers, clusters , Windows PCs, and Azure virtual machines (VMs) from a single interface. Here are the steps to install Windows Admin Center on SRV1 and add DC1 as a managed server:

On SRV1, open a web browser and go to the folder named \dc1.contoso.com\install. Download t he Windows Admin Center installer file (WindowsAdminCenter.msi) and save it to a local folder, such as C:\Temp.

Run the Windows Admin Center installer file and follow the installation wizard. You can choose to install Windows Admin Center as a desktop app or as a service. For more information on how to install Windows Admin Center, see Install Windows Admin Center.

After the installation is complete, launch Windows Admin Center from the Start menu or the desktop shortcut. If you installed Windows Admin Cent er as a service, you can access it from a web browser by using the URL https://localhost:6516 or https:// < SRV1 > :6516, where < SRV1 > is the name or IP address of SRV1.

On the Windows Admin Center dashboard, click Add to add a new connection. Select Server as the connection type and enter the name or IP address of DC1 in the Server name field. Optionally, you can specify the display name, description, and tags for the connection. Click Submit to add DC1 as a managed server.

On the Windows Admin Center dashboar d, you should see DC1 listed under the Servers section. Click on DC1 to open the server overview page. From here, you can manage various aspects of DC1, such as roles and features, certificates, devices, events, files, firewall, processes, registry, servic es, and more. For more information on how to use Windows Admin Center to manage servers, see Manage servers with Windows Admin Center.

Now, you can manage DC1 by using Windows Admin Center on SRV1. You can also add more servers or other types of connection s to Windows Admin Center and manage them from the same interface

The Administering Windows Server Hybrid Core Infrastructure guidance explains two Windows container isolation modes: process isolation (Windows Server containers) and Hyper-V isolation. With process isolation, containers share the host’s kernel , so they run as ordinary processes on the host. With Hyper-V isolation, each container runs inside a lightweight VM with its o wn kernel ; this provides a hard isolation boundary and prevents kernel sharing with other containers. The curriculum further notes that Linux containers on Windows require Hyper-V isolation because they cannot share the Windows kernel.

Applying these rules:

Container1 “must NOT share a kernel with other containers.” The only mode that prevents kernel sharing is Hyper-V isolation, so Container1 must use Hyper-V isolation.

Container2 is a Linux container. On a Windows Server container host, Linux containers are run via a utility VM and therefore require Hyper-V isolation.

Container3 is a Windows container that needs a static IP address. The networking modules describe that Windows containers can obtain static IPs when you use supported networks (for example, l2bridge/transparent) regardless of isolation mode; therefore a Windows workload like a database can run in either process or Hyper-V isolation, depending on the isolation/security you want.

Thus, the correct selections are: Hyper-V isolation only for Container1 and Container2, and Hyper-V isolation or process isolation for Container3.

 You can add User1 to Group1. Yes

 You can add User2 to Group3. No

 You can grant Group2 permissions to the resources in the fabrikam.com domain. No

The Administering Windows Server Hybrid Core Infrastructure materials describe how group scopes and forest trusts determine where y ou can add members and where you can assign permissions. For Domain Local groups: “Domain local groups are intended to secure resources in the local domain and can include accounts and groups from any trusted domains or forests .” With a two-way forest trus t between contoso.com and adatum.com , a user from east.contoso.com (User1) can therefore be added to Group1 , a domain local group in west.adatum.com → Yes .

For Universal groups, the guide states: “Universal groups are replicated to the global catalog and c an contain users and groups from any domain in the same forest ; they are designed for cross-domain (in-forest) membership.” Because User2 is in fabrikam.com (a different forest), they cannot be added to Group3 (a Universal group in east.contoso.com ) → No .

On assigning permissions across forests , the materials clarify: “A security principal can be granted access only where a trust exists with its account forest. Forest trusts are not transitive to other forests .” Since fabrikam.com trusts adatum.com but has no trust with contoso.com , you cannot grant Group2 (Universal in contoso.com ) permissions on fabrikam.com resources → No .