Microsoft AZ-800 Exam Dumps

Within the hybrid governance section of Administering Windows Server Hybrid Core Infrastructure, Microsoft specifies that Azure Arc--enabled servers are the mechanism to bring on-premises and multi-cloud servers under Azure control to apply Azure Policy (Guest Configuration) and Defender for Servers. The prerequisite is installing the Azure Connected Machine agent (Azure Arc agent) on each server: ''To manage servers with Azure Policy and configuration management, install the Connected Machine agent to onboard them to Azure Arc; once connected, you can assign Azure Policy guest configuration and monitor compliance just like Azure VMs.'' Hybrid Azure AD Join is unrelated to Azure Policy assignment; the Azure Monitor agent provides telemetry but does not onboard to Arc for policy governance; a hybrid runbook worker is for Automation runbooks, not for enforcing Azure Policy. Therefore, to ''use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises,'' deploy the Azure Connected Machine agent to all servers to Arc-enable them and then assign the desired policies.

The AZ-800 materials explain that enabling Microsoft Entra (Azure AD) sign-in to Windows Server running as an Azure VM is done by deploying the Azure AD Login for Windows VM extension. The study guide states that ''for Azure VMs, Microsoft Entra sign-in is enabled by installing the AADLoginForWindows extension; once installed, Entra users and groups granted 'Virtual Machine User/Login' roles can sign in using Entra credentials.'' The required operation is performed from Azure PowerShell with Set-AzVMExtension, providing the publisher Microsoft.Azure.ActiveDirectory, type AADLoginForWindows, and the target VM. Other options are not applicable: Set-AzVM changes VM properties but does not install extensions; New-ADComputer and Add-ADComputerServiceAccount are AD DS cmdlets unrelated to enabling Entra login on an Azure VM. Therefore, to meet the plan ''Enable Microsoft Entra users to sign in to Server1,'' you must run Set-AzVMExtension to install the AAD Login extension on Server1.

The AZ-800 objectives for securing Windows Server services with group Managed Service Accounts (gMSAs) specify a two-stage process: (1) Create the gMSA in AD DS, and (2) install (make usable) the gMSA on the member server that will run the service. The documentation outlines: first ensure a KDS root key is present (done), then on a domain controller run New-ADServiceAccount to create the gMSA, define SPNs as needed, and set PrincipalsAllowedToRetrieveManagedPassword to include the target server(s). Next, on each server that will use the account, install the account by running Install-ADServiceAccount, and then configure the Windows service to run under the gMSA (accountname$ with ''Service accounts'' logon). Running Install-ADServiceAccount on a DC is incorrect because the account must be installed on the workload host (Server1). Set-ADComputer is not required for gMSA deployment, and Get-ADServiceAccount merely queries objects and does not create or install them. Therefore, the correct actions are B (create the gMSA on DC1) and A (install the gMSA on Server1).

Objective:

Configure the DHCP server SRV1 to lease IP addresses only to computers with MAC addresses starting with AABB in a specific range.

Step-by-Step Guide

Step 1: Open DHCP Management Console

Log in to SRV1 with Domain Admin or DHCP Admin privileges.

Open DHCP Manager:

Press Windows + R, type dhcpmgmt.msc, and press Enter.

Step 2: Create a New DHCP Scope

In the DHCP console, expand SRV1.

Right-click IPv4 and select New Scope.

The New Scope Wizard opens.

Step 3: Configure the Scope

Name:

Enter a name (e.g., MAC-Filtered Scope).

Click Next.

IP Address Range:

Start IP: 192.168.1.190

End IP: 192.168.1.200

Subnet mask: as appropriate (e.g., 255.255.255.0).

Click Next.

Add Exclusions:

None needed unless you want to reserve certain addresses.

Click Next.

Lease Duration:

Set as needed, default is usually fine.

Click Next.

Configure DHCP Options:

You can skip or configure as needed (gateway, DNS, etc.).

Click Next.

Activate Scope:

Click Yes to activate it.

Step 4: Configure MAC Address Filtering (Allow List)

In the DHCP console, expand the scope you created.

Right-click Filters under the scope and choose New Filter.

Enter the MAC address pattern to match devices with MAC addresses starting with AABB:

MAC Address: AABB*

Description: e.g., Allow devices starting with AABB.

Click Add.

Step 5: Enable Allow Filters

Right-click Filters under the scope and select Enable.

Ensure that only devices matching the AABB pattern will receive leases.

Step 6: Test and Verify

Use a test client with a MAC address starting with AABB to ensure it receives an IP address in the 192.168.1.190--192.168.1.200 range.

Use ipconfig /renew on the client, or check the DHCP leases in the Address Leases section.