Microsoft AZ-800 Exam Dumps

In the NPS/RADIUS section of Administering Windows Server Hybrid Core Infrastructure, a RADIUS client is defined as a network access server (NAS) such as a VPN server, wireless AP, or switch. The guide states: ''Each VPN server that forwards connection requests to NPS must be configured as a RADIUS client.'' User counts are irrelevant to the number of RADIUS clients; the determining factor is the number of NAS devices that send RADIUS messages to NPS. The table shows Boston: 2 VPN servers, Dallas: 2, Seattle: 4---for a total of 8 VPN servers. Therefore, to enforce policies for all remote connections through NPS1, you must add each of the eight VPN servers as a RADIUS client. Options reflecting user totals (180/188) are incorrect because users are authenticated via the NAS, not directly configured as clients in NPS.

In hybrid name-resolution designs covered in Administering Windows Server Hybrid Core Infrastructure, Azure Private DNS does not support zone transfers and therefore you cannot host it on, or pull it into, on-premises DNS by using stub or secondary zones. The guidance states that when on-premises clients must resolve names that live in an Azure Private DNS zone, the recommended pattern is to place a DNS forwarder in Azure (typically a Windows Server VM running the DNS role) that can directly query the Azure resolver from inside the virtual network. Then, on-premises Windows DNS servers are configured with a conditional forwarder that forwards queries for the private zone's suffix to the Azure DNS forwarder over the VPN/ExpressRoute connection.

This achieves the following:

Keeps the authoritative zone in Azure Private DNS while making it reachable from on-premises.

Avoids unsupported mechanisms (no AXFR/IXFR available from Azure Private DNS, so stub and secondary zones won't work).

Uses least privilege and minimal change on both sides: add a DNS VM in Azure (E) and create a conditional forwarder on DC1 for fabrikam.com pointing to that VM's private IP (A).

Options B and C require zone transfers, which are not available from Azure Private DNS, and D (changing VNet DNS servers) affects Azure VMs' resolver settings but does not enable on-premises resolution of the Azure-hosted private zone.

The AZ-800 objectives for securing Windows Server services with group Managed Service Accounts (gMSAs) specify a two-stage process: (1) Create the gMSA in AD DS, and (2) install (make usable) the gMSA on the member server that will run the service. The documentation outlines: first ensure a KDS root key is present (done), then on a domain controller run New-ADServiceAccount to create the gMSA, define SPNs as needed, and set PrincipalsAllowedToRetrieveManagedPassword to include the target server(s). Next, on each server that will use the account, install the account by running Install-ADServiceAccount, and then configure the Windows service to run under the gMSA (accountname$ with ''Service accounts'' logon). Running Install-ADServiceAccount on a DC is incorrect because the account must be installed on the workload host (Server1). Set-ADComputer is not required for gMSA deployment, and Get-ADServiceAccount merely queries objects and does not create or install them. Therefore, the correct actions are B (create the gMSA on DC1) and A (install the gMSA on Server1).

Topic 5, Labs

In the Windows Server hybrid curriculum for AZ-800, running Windows containers on a Windows Server host requires enabling the Containers feature and installing a container runtime, specifically the Docker (Moby) engine. The guide explains that Windows Server supports two isolation modes---process and Hyper-V isolation---but in both cases you still need a Docker-compatible runtime to pull images, create, and manage containers. The materials emphasize: container functionality isn't provided by Windows Admin Center or WSL; Admin Center is only a management tool and WSL targets Linux user-space scenarios, not Windows container runtime services. Likewise, the Hyper-V role is optional and only needed if you choose Hyper-V isolation for containers; it is not, by itself, sufficient to run containers. Therefore, the required installation to ''configure Server1 to run containers'' is the Docker engine (often referred to in Microsoft's docs as Docker/Moby), after which you can pull Windows base images and run Windows containers on the host. This aligns with the prescribed steps: enable Containers feature install Docker configure isolation as needed deploy containerized apps.