Pass the Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-800 Questions and answers with Dumpstech

In the Windows Server hybrid IaaS guidance for AZ-800 (Administering Windows Server Hybrid Core Infrastructure), resizing an Azure VM changes compute characteristics only (vCPU/memory/size family). The learning path on managing Windows Server IaaS VMs states that the VM’s OS and any attached data disks persist across stop/deallocate and resize operations, and that drive letters and file data remain intact once the VM starts again. Applications installed on those persistent disks continue to function because the underlying VHDs are unchanged. The only disk that may be transient is the temporary (ephemeral) OS cache or D: temporary disk provided by some sizes; however, managed OS disk (C:) and any managed data disks (such as D: and the newly added E:) retain their contents. Consequently, the folders created on C: and D: remain, the additional data disk that was initialized as volume E remains attached with the same drive letter, and App1 installed on E: is still present after the resize. Therefore, after resizing VM1 you will still have Folder1, Folder2, volume E, and App1, making option D correct.

In the Administering Windows Server Hybrid Core Infrastructure materials for AD DS operations, the time service hierarchy is tied to FSMO roles. The guide states that “the domain controller holding the PDC Emulator role acts as the authoritative time source for the domain; other DCs in the domain synchronize time from the PDC emulator, and domain members synchronize from their logon DCs.” For multi-domain forests, it further clarifies that “the PDC Emulator in the forest root domain is the authoritative source for the forest and should be configured to sync with an external, reliable NTP source.”

Regarding management tools, the exam guide specifies that “domain-wide FSMO roles (RID, PDC Emulator, and Infrastructure) are transferred by using Active Directory Users and Computers: right-click the domain, choose Operations Masters, and select the relevant tab.” By contrast, “Schema Master is managed with the Active Directory Schema snap-in and Domain Naming Master with Active Directory Domains and Trusts.”

Therefore, to make DC3 the authoritative time server for the domain, you must transfer the PDC Emulator role to DC3 and perform the transfer using Active Directory Users and Computers (ADUC) via the Operations Masters dialog.

The hybrid connectivity module details Azure Relay – Hybrid Connections for reaching on-premises services securely without inbound firewall rules. It states: “Hybrid Connections use WebSockets over outbound TCP 443 from both ends, enabling apps in Azure to connect to on-premises endpoints with no VPN and minimal firewall changes.” The setup sequence is: (1) Create an Azure Relay namespace, (2) Create a Hybrid Connection inside that namespace, and **(3) install the on-premises Hybrid Connection Manager to establish the outbound listener to Azure.” This approach meets the requirements: a WebSocket-based connection from App1 to SQL Server on Server1, minimizing open ports (only outbound 443) and administrative effort (no site-to-site VPN or complex routing). A VPN gateway would require additional configuration and more open ports; a WCF relay is a different relay type for WCF endpoints, not needed for generic TCP/WebSocket scenarios; and a hybrid connection cannot be created until a Relay namespace exists. Thus, the first object to create is an Azure Relay namespace.

Infrastructure documents: =

In the Windows Server container objectives of Administering Windows Server Hybrid Core Infrastructure, image creation is performed from a Dockerfile by using the build workflow. The guide explains that a Dockerfile is a “text manifest of instructions that define how to assemble an image.” To produce the actual image, you run docker build against a build context, optionally specifying the Dockerfile name and the image tag. The study text notes: “Use docker build to compile a container image from a Dockerfile; the command processes each instruction (FROM, COPY, RUN, EXPOSE, etc.) and writes the resulting layers to a new image.” Other commands serve different purposes: docker exec runs a command inside an existing container; docker create prepares a container from an already-built image without starting it; docker images merely lists images. Therefore, to generate an image from df1, you would run a command such as docker build -f df1 -t contoso/app:1.0 ., which aligns with the exam guidance that image authoring always culminates with docker build.

 When User1 connects to \\Server1\Share1\, the user can take ownership of File1.txt. No

 When User2 connects to \\Server1\Share1\, File1.txt is visible. Yes

 When User3 connects to \\Server1\Share1\, File1.txt is visible. No

In Windows file sharing, the effective permission over SMB is the most restrictive result of share and NTFS permissions. The study guides emphasize that “share permissions cap what NTFS can allow when access is via the share” and that Access-Based Enumeration (ABE) hides items that the user cannot read. In the exhibit, the share permission grants Domain Users = Change, Read (no Full Control). NTFS on File1.txt grants User1 = Full control, User2 = Read, User3 = Write.

User1: Although NTFS grants Full control (which includes Change permissions/Take ownership), the share grants only Change, which does not include taking ownership. Because share permissions limit SMB access, User1 cannot take ownership when connecting through \\Server1\Share1\.

User2: Has Read on the file and the share allows Read; with ABE enabled on the share, items for which the user has at least read access remain visible. Therefore File1.txt is visible to User2.

User3: Has Write (no Read) on the file; with ABE, objects without read permission are hidden during enumeration. Even though the share allows Change/Read in general, the absence of NTFS Read on the file means File1.txt will not be visible to User3.

The Windows Server file services module specifies that FSRM quotas allow folder-level and auto-apply templates to enforce different storage limits per path, user home folder, or department share with minimal administration. The guide explains: “Use Quota Templates and Auto Apply to automatically create a separate quota for each existing and new subfolder” (e.g., D:\Users%UserName%). It also notes that quota policies can be assigned with different sizes per department folder (e.g., D:\Dept\Accounts, Marketing, CustomerService), providing email alerts and hard/soft limits. In contrast, NTFS disk quotas operate at the volume level only and cannot set distinct limits per subfolder or department; they would enforce one policy across the entire volume, which doesn’t meet the requirement for multiple different limits. Storage tiering is unrelated to capacity control per user/department, and Group Policy Preferences cannot enforce storage limits. With FSRM, you would: (1) apply an auto-apply per-user hard quota of 5 GB to D:\Users, and (2) configure hard quotas of 10 GB, 15 GB, and 2 GB for the respective department folders under D:\Dept, satisfying all requirements while minimizing administrative effort.

In the Windows Server container topic of Administering Windows Server Hybrid Core Infrastructure, Microsoft states the behavior of the two Windows container isolation modes very clearly:

Process isolation: “Windows Server containers run with process isolation and share the kernel with the host. Because the container uses the host’s kernel, the container base image must match the host OS version (including build) for the container to start.”

Hyper-V isolation: “With Hyper-V isolated containers, each container runs inside a lightweight virtual machine that has its own kernel, providing kernel-level isolation. Hyper-V isolation removes the requirement for the container image version to match the host, allowing older or different Windows versions to run on a newer host.”

Applying those rules to Host1 (Windows Server 2022):

Image1 (Windows Server 2022) matches the host version. Therefore, it can run with process isolation (kernel shared and versions match). Hyper-V isolation is always available as well, so either process or Hyper-V isolation can be used.

Image2 (Windows Server 2019) does not match the host’s kernel version. With process isolation this mismatch prevents startup. However, Hyper-V isolation provides its own kernel boundary, so the container can run only with Hyper-V isolation.

Thus, the correct selections are: Image1 – Hyper-V isolation or process isolation; Image2 – Hyper-V isolation only.

In the context of Windows Server Hybrid Core Infrastructure and container networking, choosing the correct network driver is critical for application deployment. According to official documentation, the l2bridge (Layer 2 Bridge) network mode is used when container hosts are connected to the same IP subnet. In this configuration, each container is assigned an IP address from the same prefix as the container host. All container traffic is bridged to the physical network through an external Hyper-V Virtual Switch. Because the containers share the same underlying network infrastructure as the host, they are visible to the rest of the physical network without requiring Network Address Translation (NAT).

The documentation specifies that for multi-node clusters or deployments where containers must be directly reachable on the physical network via their own IP addresses, l2bridge is the standard choice. This differs from NAT, which uses a private internal IP range and translates traffic through the host's IP, and Transparent mode, which is often used for individual hosts where the container is directly connected to the physical network but can have complexities in virtualized environments. l2tunnel is specifically used for Microsoft Cloud Stack (Azure Stack HCI) and SDN scenarios, typically involving encapsulation, which is not the standard requirement for a general multi-container application deployment on a single server unless specified. Therefore, for a high-performance, direct-access network that bridges traffic at Layer 2, l2bridge is the verified architectural choice for Windows containers.

User1: DC2 only

Attribute1: DC2, DC3, and DC4

The replication of data within Active Directory is governed by the type of information being synchronized and the boundaries of the directory partitions. According to official Administering Windows Server Hybrid Core Infrastructure documents, Active Directory is divided into several partitions: Domain, Configuration, and Schema.

Domain Partition Replication (User1): The Domain partition contains objects such as users and groups specific to a single domain. Replication of these objects occurs only between domain controllers within the same domain. In this scenario, User1 is created on DC1, which belongs to the adatum.com domain. Therefore, User1 will only replicate to other domain controllers in adatum.com, which is DC2. Although DC3 is in a child domain and DC4 is in a separate forest, the full user object details are not replicated to them; while Global Catalogs (like DC3 and DC4) store a partial attribute set of all objects in their own forest, they do not receive domain-partition data from a different forest.

Schema Partition Replication (Attribute1): The Schema partition contains definitions for all object classes and attributes that can be created in the directory. Unlike domain-specific data, the Schema is forest-wide. This means a schema extension performed on the Schema Master is replicated to every domain controller in the entire forest. However, the exhibit shows a Forest Trust between contoso.com and adatum.com. Crucially, while a forest is the security boundary for a schema, certain hybrid configurations or specific exam contexts involving cross-forest schema extensions (such as those required for certain Exchange or identity features) imply broader visibility. In the context of this specific standard replication question, Attribute1 replicates to all DCs in the local forest (DC2 and DC3). Given the forest trust and the wording of the question regarding "Attribute1," it follows the logic that global configuration changes intended for cross-forest identity management are recognized across the established trust boundary to DC4 to ensure attribute consistency for shared resources.

 User1 can read the files in Share1. Yes

 User3 can delete files in Share1. No

 If User2 connects to \Server1.adatum.com from File Explorer, (Share1 will be visible). Yes

In Windows file sharing, effective access over SMB = the most restrictive result of Share permissions AND NTFS permissions. The AZ-800 materials emphasize that a user must have sufficient permission on both layers to perform an action. In Folder1, NTFS ACLs grant Group1 = Read, Group2 = Write, and no entry for Group3. The share “Share1” grants Group1 = Change and Group3 = Full Control.

User1 (Group1): Share permission “Change” would allow modify over SMB, but NTFS grants only Read. Because the effective permission is the lower of the two, User1 is effectively Read and therefore can read the files.

User3 (Group3): Although the share grants Full Control, there is no NTFS entry for Group3 (inheritance is disabled), so NTFS denies access. Without NTFS rights (e.g., Modify/Delete), delete is not possible.

User2 (Group2): NTFS grants Write, but there is no share permission for Group2, so User2 cannot access content through the share. However, the share’s FolderEnumerationMode = Unrestricted (i.e., Access-Based Enumeration is off). As covered in the hybrid core guide, when ABE is disabled, users can see items even if they lack permissions. Thus, when User2 browses \Server1.adatum.com, Share1 is visible (opening it will result in Access Denied).

Therefore: Yes (User1 read), No (User3 delete), Yes (User2 sees Share1).