AZ-800 Microsoft Administering Windows Server Hybrid Core Infrastructure Free Practice Exam Questions (2026 Updated)

The Hyper-V networking section of the Administering Windows Server Hybrid Core Infrastructure material explains that Hyper-V provides three virtual switch types: External, Internal, and Private. It states: “An External switch is bound to a physical NIC and can optionally connect the management OS; an Internal switch connects VMs to each other and to the host only; a Private switch connects VMs to each other only (no host access).” The guide further clarifies limits on external switches: “A single physical adapter can be bound to only one External virtual switch at a time (unless using NIC Teaming). Additional External switches require additional physical adapters.”

In the exhibit, Server1 has a single NIC already bound to vSwitch3, and the tree shows ‘Microsoft Hyper-V Network Adapter’, indicating the management OS shares the adapter. Therefore, you cannot add another External switch with the lone NIC; you can still create Internal and Private switches.

Regarding host connectivity, the guide specifies: “The management OS can communicate with VMs attached to an Internal switch and to an External switch (when the management OS is connected). The host cannot communicate with VMs on a Private switch.” Consequently, Server1 can access network shares only from VMs on vSwitch2 (Internal) or vSwitch3 (External with management OS), but not from VMs on vSwitch1 (Private).

In Windows Admin Center (WAC), “gateway access” is controlled by the Allowed groups list on the gateway. The AZ-800 materials explain that membership in the local Administrators group on the WAC gateway still permits sign-in unless you explicitly scope access to specific groups in the Allowed groups list. The guidance further states that to restrict who can sign in to the WAC gateway, you must populate Allowed groups with one or more security groups (for example, a domain group) and remove broad principals (like BUILTIN\Users). Until you add at least one explicit group, existing administrators can continue to authenticate, which is why “everyone” appears able to sign in after only removing BUILTIN\Users. By adding a dedicated security group to Allowed groups, only members of that group can authenticate to the gateway UI; non-members are denied. Settings such as Performance profile or Require manage-as sessions to re-authenticate affect performance and remote management prompts, not gateway sign-in. Proxy bypass lists control outbound connectivity, not access control. Therefore, to prevent unauthorized sign-ins, configure Allowed groups with a specific security group and manage membership there.

In Windows Server container deployments, the isolation mode determines kernel compatibility between the host and the container image. The Administering Windows Server Hybrid Core Infrastructure materials explain that Windows Server containers using process isolation share the host kernel and therefore require the container image to match the host’s OS version/build. The guide contrasts this with Hyper-V isolation, stating that each container runs inside a lightweight utility VM: “Hyper-V isolated containers do not share the host kernel; they provide a separate kernel instance, allowing containers built on a different Windows build (or earlier Windows Server version) to run on a newer host.”

Because Host1 is Windows Server 2022 and image1 is based on Windows Server 2019, process isolation would fail due to the version mismatch. The documented remediation is to start the container with Hyper-V isolation, which decouples the container from the host’s kernel requirements. The study guide shows this operationally with Docker: “Use docker run … --isolation=hyperv when the container base image version differs from the host.”

Therefore, to successfully start the container on Host1, you must use the Docker CLI with Hyper-V isolation:

Docker run -d --isolation=hyperv image1.

The hybrid connectivity chapter explains Azure Relay (Hybrid Connections/WebSockets) as a service that lets on-premises apps be securely exposed without opening inbound firewall ports. The server initiates an outbound connection to Azure Relay, and Internet clients connect to Azure Relay, which relays traffic over WebSockets to the on-premises listener. The guide emphasizes: “Azure Relay enables exposing services behind firewalls without inbound port openings, supporting WebSockets for bidirectional communication.” Alternatives either require inbound exposure or additional infrastructure: ARR (reverse proxy) and Web Application Proxy run on-premises and would need inbound ports. Azure Application Gateway can proxy HTTP(S) and supports WebSockets pass-through, but to reach an on-prem server you’d typically need VPN/ExpressRoute and corresponding inbound allowances. Since the requirement is to minimize inbound ports on Firewall1 while supporting WebSockets, Azure Relay is the correct solution.

In the Windows Server hybrid curriculum for AZ-800, running Windows containers on a Windows Server host requires enabling the Containers feature and installing a container runtime, specifically the Docker (Moby) engine. The guide explains that Windows Server supports two isolation modes—process and Hyper-V isolation—but in both cases you still need a Docker-compatible runtime to pull images, create, and manage containers. The materials emphasize: container functionality isn’t provided by Windows Admin Center or WSL; Admin Center is only a management tool and WSL targets Linux user-space scenarios, not Windows container runtime services. Likewise, the Hyper-V role is optional and only needed if you choose Hyper-V isolation for containers; it is not, by itself, sufficient to run containers. Therefore, the required installation to “configure Server1 to run containers” is the Docker engine (often referred to in Microsoft’s docs as Docker/Moby), after which you can pull Windows base images and run Windows containers on the host. This aligns with the prescribed steps: enable Containers feature → install Docker → configure isolation as needed → deploy containerized apps.

In the Administering Windows Server Hybrid Core Infrastructure guidance on trusts, Microsoft clarifies that a one-way outgoing trust from the local domain means the local domain trusts the specified external domain; therefore, “security principals from the trusted (specified) domain can be authenticated to access resources in the trusting (local) domain.” Furthermore, external trusts are non-transitive and scoped only to the two domains that participate in the trust; they do not flow through to other domains or forests. The materials also state that parent–child trusts inside a forest are two-way and transitive, allowing authentication to cross between parent and child domains, but this transitivity does not extend across an external trust to another forest.

Applying these rules:

The external one-way outgoing trust is configured on east.contoso.com → adatum.com. Thus, east.contoso.com trusts adatum.com, allowing users from adatum.com to be granted access to resources in east.contoso.com. Therefore, User1 (adatum.com) can be assigned permissions on Share3 (east.contoso.com) ⇒ Yes.

User2 (contoso.com) attempting to access Share1 (adatum.com) relies on a path that would require trust from adatum.com to contoso.com or a transitive hop through east.contoso.com. Because the trust is external and non-transitive, and there’s no trust from adatum.com to contoso.com, permissions cannot be assigned ⇒ No.

User3 (east.contoso.com) to Share1 (adatum.com) would require adatum.com to trust east.contoso.com. The configured direction is the opposite (east → adatum, outgoing), so east users are not trusted by adatum ⇒ No.

Linking Try Next Closest Site to Site1 applies the policy to computers in Site1, not to the branch clients in the new office. The WSHCI materials stress that GPO scope (site, domain, or OU) determines which computers receive the setting, but does not alter how site membership is computed. The client’s site is still determined exclusively by its IP subnet as published in Active Directory Sites and Services. The documentation summarizes: “Site membership is calculated by matching the client’s IP to a defined AD subnet; if no match exists, DC Locator cannot assign the client to that site.” The Try Next Closest Site option only affects fallback when there is no DC in the client’s site; it does not force authentication against a specific target site. Because the branch office contains only clients (no DCs) and the question’s goal is for those clients to authenticate primarily with Site1, simply configuring the policy in Site1 does nothing for clients that are not members of Site1. Thus, this solution does not meet the stated goal.

In a forest trust, the default setting “Forest-wide authentication” allows all authenticated users from the trusted forest to be authenticated to any resource in the trusting forest. The AZ-800 materials explain that to limit who can authenticate across a forest trust, you must switch the trust to Selective authentication and then grant the Allowed to authenticate permission on the specific computer objects to the groups you choose. The guide states that with selective authentication, “accounts from the trusted forest are not permitted to authenticate to computers in the trusting forest unless they have been explicitly granted the Allowed to authenticate permission on those computers.” This approach is designed for scenarios with multiple domains/large forests where you must restrict access to a subset of servers. By contrast, SID filtering mitigates SID-history misuse and does not control who may authenticate. Changing to an external trust would remove transitivity and is unnecessary. Adding the group to the local Users group would not prevent other fabrikam users from authenticating as long as forest-wide authentication is enabled. Therefore, the first step is to enable Selective authentication on the contoso↔fabrikam forest trust; next, you would grant Allowed to authenticate on Server1 to fabrikam\Group1.

In a disaggregated deployment (separate Hyper-V compute cluster and Scale-Out File Server storage cluster), Storage Quality of Service (Storage QoS) is implemented with centralized policies that are defined on the SOFS and applied to VM virtual disks from the Hyper-V side. The Administering Windows Server Hybrid Core Infrastructure materials describe centralized Storage QoS as follows: “In a SOFS-based deployment, you create Storage QoS policies on the Scale-Out File Server. Policies define minimum and maximum IOPS/throughput and are stored on the cluster so they can be referenced by any VM using CSV shares exposed by the SOFS.” The guide further states: “To apply a Storage QoS policy to a virtual hard disk, use the Hyper-V cmdlet to set the VHD attachment and reference the policy by name or ID. The policy then governs I/O for that disk regardless of which Hyper-V host the VM runs on.”

Accordingly, on the SOFS cluster, you run New-StorageQosPolicy to create the centralized policy (for example, with MinimumIops, MaximumIops, or bandwidth constraints). On the Hyper-V cluster, you attach or update the VM disk to consume that policy using Set-VMHardDiskDrive (for example, -QoSPolicyID or -QoSPolicyName). The Set-VMSan cmdlet pertains to Hyper-V Virtual SAN configuration and is not used for Storage QoS. This pattern ensures you can control and cap bandwidth usage between the SOFS storage and the Hyper-V compute clusters while maintaining consistent, cluster-wide enforcement.

The course content distinguishes site management from FSMO role administration. Active Directory Sites and Services is used to manage sites, subnets, site links, replication topology, and server objects (NTDS Settings), not domain or forest operations master roles. The documentation explains that FSMO roles are either forest-wide (Schema, Domain Naming) or domain-wide (RID, PDC, Infrastructure) and are exposed via ADUC (domain roles), Active Directory Domains and Trusts (Domain Naming), and Active Directory Schema (Schema), or by command-line tools like NETDOM and NTDSUTIL. Right-clicking Default-First-Site-Name and opening Properties shows site-level configuration (e.g., inter-site transports, licensing, location metadata) but does not display FSMO role holders. Consequently, the proposed action does not meet the goal of identifying the PDC Emulator. To meet the goal, use ADUC → Operations Masters, netdom query fsmo, or ntdsutil roles as laid out in the administration guide.

When creating users with Active Directory Administrative Center (ADAC), the New User workflow highlights the required attributes with indicators. The Administering Windows Server Hybrid Core Infrastructure materials note that ADAC uses a modern schema-driven form in which “Full name (CN)” and “User UPN logon” are the minimum required identity fields to create the object in the directory. The wizard auto-generates the sAMAccountName from the UPN by default (you can edit it), but sAMAccountName isn’t required to be manually entered to complete creation. Likewise, Password can be deferred depending on your provisioning pattern (for example, creating a disabled or pre-staged account or enforcing “User must change password at next logon”), and fields such as Profile path and First name are optional profile details. The guide explains that ADAC “derives the RDN from Full name” and relies on UPN as the primary modern logon attribute in Azure AD-connected/hybrid scenarios, ensuring uniqueness within the UPN suffix. Therefore, to successfully create User1 using ADAC without additional, non-mandatory properties, you must provide Full name and User UPN logon.

The Administering Windows Server Hybrid Core Infrastructure materials state the placement and provisioning requirements for IP Address Management (IPAM). Specifically:

“The IPAM server must be installed on a domain member computer. You cannot install the IPAM server feature on a domain controller.”

“IPAM manages and discovers domain controllers, DHCP servers, and DNS servers in the domain. Servers in a workgroup are not supported as managed servers.”

“When you choose Group Policy–based provisioning, IPAM creates and links GPOs that configure the required settings on managed DC/DHCP/DNS servers so that IPAM can perform inventory, event collection, and address space management.”

Applying these rules:

Server2 is a domain-joined Windows Server Core member with no conflicting roles, satisfying the guidance to avoid installing IPAM on a DC and aligning with the recommendation to place IPAM on a dedicated member server. DC1 is a domain controller (and DNS), so it must not host IPAM. Server1 (DHCP) could host IPAM but best practice is to use a dedicated server. Server3 is in a workgroup, so it cannot host IPAM or be managed by it.

For GPO-based provisioning and server discovery, the managed servers that must be provisioned are the infrastructure role holders: DC1 (AD DS/DNS) and Server1 (DHCP). These are exactly the servers IPAM discovers and manages via the created GPOs.

In the Administering Windows Server Hybrid Core Infrastructure guidance for name resolution with Azure Private DNS, Microsoft describes the split-horizon scenario where you host contoso.com both as a Public DNS zone and as an Azure Private DNS zone linked to a virtual network. The documentation explains that Azure Private DNS “is resolvable only from within the VNet” and that the special Azure DNS virtual IP 168.63.129.16 is the target used by workloads inside the VNet to resolve private zone records. For hybrid resolution from on-premises, the guidance states that you deploy a DNS forwarder/proxy VM in the VNet (a Windows Server DNS role is acceptable) and configure it with a conditional forwarder for the private zone that forwards to 168.63.129.16. Then, on the on-premises DNS servers, you create a conditional forwarder for the same zone that points to the DNS forwarder VM in Azure across the Site-to-Site VPN. This pattern ensures on-premises queries for contoso.com resolve the private zone records via Azure, while public Internet clients continue to use the public DNS zone. Consequently:

On VNet1, VM1 (DNS server) must forward contoso.com queries to 168.63.129.16.

On the on-premises DNS, configure a conditional forwarder for contoso.com to VM1.Setting VNet DNS to the Azure-provided IP is unnecessary (it’s the default for Azure VMs) and forwarding to the public zone would bypass the private zone, which is not desired.

In Windows Server container scenarios, a containerized workload authenticates to Active Directory by using a group Managed Service Account (gMSA) referenced by a credential spec (CredSpec) JSON. The AZ-800 materials explain that gMSAs require the Key Distribution Service (KDS) root key once per forest before any gMSA passwords can be generated and rotated. Therefore, the first step is to create the KDS root key. Next, you create the gMSA and define who is allowed to retrieve its managed password. For workgroup (non–domain-joined) container hosts, you cannot authorize the host’s computer account (because none exists), so you typically create a standard domain user (or group) and assign it in PrincipalsAllowedToRetrieveManagedPassword when creating the gMSA—this is called out in the hybrid core infrastructure guidance for container hosts. Finally, because Server1 is in a workgroup, you cannot run New-CredentialSpec on that host. The guidance states that the CredSpec file must be created on a domain-joined management machine (with AD tools), then copied to the workgroup host where containers are launched with --security-opt "credentialspec=...". Steps such as running New-CredentialSpec or other tooling directly on Server1—or granting broader rights than necessary—violate least-privilege and do not work in a workgroup configuration.

Modify the trust on: DC2

Modify the permissions for the: Computer object of SRV1

In an Active Directory Domain Services (AD DS) environment involving multiple forests and external trusts, managing granular access across domain boundaries is achieved through Selective Authentication. According to official documents for Administering Windows Server Hybrid Core Infrastructure, there are two primary authentication settings for a trust: Domain-wide authentication and Selective authentication.

When you need to restrict users from a trusted forest (contoso.com) so they can only access specific resources in the trusting forest (adatum.com), you must configure the trust to use Selective Authentication. This configuration must be performed in the resource domain (the trusting domain). Based on the provided table, DC2 is the domain controller for adatum.com, which is where the shared resources (SRV1) reside. Therefore, you must modify the trust properties on DC2 to enable Selective Authentication for the incoming trust from contoso.com.

Once Selective Authentication is enabled, Windows does not automatically grant the "Authenticated Users" SID to the user's access token for resources in the local domain. Instead, administrators must explicitly grant the Allowed to Authenticate permission on the specific resource's computer object. In this scenario, since the requirement is to restrict access specifically to resources on SRV1, you must modify the security permissions on the Computer object of SRV1 in Active Directory Users and Computers. By granting the contoso.com users (or a group containing them) this permission, they can successfully authenticate against SRV1 while being blocked from all other servers in the adatum.com forest. This satisfies the requirement to prevent access to any other resources while maintaining the ability of adatum.com users to access contoso.com (as the 2-way trust remains intact).

To ensure that all computers in the domain use DNSSEC to resolve names in the adatum.com zone, you’ll need to configure both the DNS servers and the client computers. Here’s how you can do it:

Step 1: Sign the adatum.com Zone First, you need to sign the adatum.com DNS zone. This can be done using the DNS Manager or PowerShell. Here’s a PowerShell example:

Add-DnsServerSigningKey -ZoneName "adatum.com" -CryptoAlgorithm RsaSha256

Set-DnsServerDnsSecZoneSetting -ZoneName "adatum.com" -DenialOfExistence NSEC3 -NSEC3Parameters 1,0,10,""

This will add a signing key and configure DNSSEC for the zone with NSEC3 parameters.

Step 2: Configure DNS Servers Ensure that your DNS servers are configured to support DNSSEC. This includes setting up trust anchors for the zones that you want to validate and configuring the DNS servers to provide DNSSEC validation for DNS queries.

Step 3: Configure DNS Clients For DNSSEC validation to occur on the client side, the client computers must be configured to trust the DNS server’s validation process. This typically involves configuring the client’s DNS settings to point to a DNS server that supports DNSSEC.

Step 4: Validate Configuration You can validate that DNSSEC is working correctly by using tools like nslookup or dig to query DNS records and check for the presence of DNSSEC signatures in the responses.

Note: The exact steps may vary depending on your environment and the version of Windows Server you are using. Ensure that you have the appropriate administrative rights to make these changes and that you test the configuration in a controlled environment before deploying it domain-wide12.

By following these steps, you should be able to ensure that all computers in your domain use DNSSEC to resolve names in the adatum.com zone.