Free Microsoft AZ-801 Exam Dumps Questions & Answers

Your network contains an Active Directory Domain Services (AD DS) domain that has a Windows Server
2012 R2 forest and domain functional level. The domain contains the domain controllers shown in the following table.
You need to ensure that you can deploy a new domain controller that runs Windows Server 2025. The solution must minimize administrative effort.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Exhibit

• A.  Remove DC2 and DC3.
• B.  Raise the forest and domain functional level to Windows Server 2025.
• C.  Raise the forest and domain functional level to Windows Server 2016.
• D.  Upgrade DC1, DC2, and CO to Windows Server 2025.
• E.  Remove DC 1.

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains an organizational unit (OU) named 0U1.0U1 contains servers that run sensitive workloads.
You plan to add connection security rules that meet the following requirements:
* The servers in OU 1 must only accept connections from domain-joined
* The servers in OU 1 must only be able to communicate with domain-joined You create a Group Policy Object (GPO) named GP01 and link GP01 to contoso.com.
You need to configure a connection security rule in GP01 by using Windows Defender Firewall with Advanced Security.
How should you configure the rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
CORRECTED ANSWER: Rule Type: Isolation. Requirements: Require authentication for inbound and outbound connections. Authentication Method: Computer (Kerberos V5).
Detailed Explanation
Restricting a set of servers so that they only accept inbound connections from, and only initiate outbound connections to, other domain-joined computers is the classic domain/server Isolation scenario, so the rule type is Isolation, not Tunnel (which secures gateway-to-gateway traffic) or Authentication exemption (which excludes hosts from having to authenticate). Because both requirements state the servers must " only " communicate with domain-joined systems in either direction - with no allowed fallback to unauthenticated traffic - the Requirements setting must be " Require authentication for inbound and outbound connections " rather than the softer inbound-required/outbound-requested default. Since every server and client involved is already domain-joined, Computer (Kerberos V5) is the appropriate authentication method, avoiding the certificate/PKI overhead that is only needed to extend trust to non-domain-joined devices.
Official Reference
Restrict server access to only trusted, domain-joined devices - https://learn.microsoft.com/en-us/windows
/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices

You have a single-domain Active Directory Domain Services (AD DS) forest named contoso.com that contains two domain controllers named DC1 and DC2. DC1 and DC2 run Windows Server.
You plan to perform an authoritative restore of SYSVOL on DC1.
You isolate DC1 and restore DC1 from a backup.
You need to ensure that SYSVOL on DC1 replicates to DC2.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Exhibit

Correct Answer:

Explanation:
Detailed Explanation
After an authoritative restore of SYSVOL is performed on an isolated DC1, the msDFSR-Options attribute on DC1 ' s own SYSVOL Subscription object must be set to mark DC1 ' s restored SYSVOL as authoritative before DC1 is ever reconnected to the network, because DFS Replication begins reconciling content as soon as replication partners can communicate. This attribute change is made locally on DC1 (using Advanced Features in Active Directory Users and Computers or ADSI Edit) while DC1 is still isolated, not on DC2, since the goal is to force DC2 to accept DC1 ' s restored content rather than the reverse. Only once that flag is set should DC1 be connected to the network so that DFS Replication propagates the authoritative SYSVOL to DC2.
Official Reference
Perform an authoritative or nonauthoritative synchronization of DFSR-replicated SYSVOL - https://learn.
microsoft.com/en-us/troubleshoot/windows-server/group-policy/dfsr-sysvol-authoritative-non-authoritative- restore

You have three servers named Server1, Server2, Server3 that run Windows Server and have the Hyper-V server role installed.
You plan to create a hyper-converged cluster to host Hyper-V virtual machines.
You need to ensure that you can store virtual machines in Storage Spaces Direct.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Exhibit
Exhibit

Correct Answer:

Explanation:
Detailed Explanation
Deploying a Storage Spaces Direct hyper-converged cluster follows a fixed sequence: first the Failover Clustering feature is used to create and validate the cluster across Server1, Server2, and Server3; only after the cluster exists can Storage Spaces Direct be enabled on it (which pools the local/shared disks across the nodes into a single software-defined storage pool); and volumes (which back the Cluster Shared Volumes used to store the Hyper-V virtual machines) are created from that pool afterward. Actions like creating a DFS namespace, a Scale-Out File Server role, or a file share are unrelated to hosting VM storage on S2D volumes and are not part of this sequence.
Official Reference
Deploy Storage Spaces Direct - https://learn.microsoft.com/en-us/windows-server/storage/storage-spaces
/deploy-storage-spaces-direct

You have a failover cluster named Cluster1 that contains the nodes shown in the following table.
A File Server for general use cluster role named HAFS is configured as shown in the General exhibit (Click the General tab.)

Exhibit

Exhibit
Exhibit

Correct Answer:

Explanation:
Detailed Explanation
The General tab of the HAFS role ' s properties lists its Preferred Owners in priority order - Node1 first, then Node3 - with Node2 not configured as a preferred owner. Because Node1 is the highest-priority preferred owner, the role comes online on Node1 whenever the cluster (re)starts and no failover has occurred. When an administrator moves the role using Best Possible Node, Failover Clustering selects the next-highest-priority available node from that same preferred-owners list rather than an unlisted node, which is Node3, so the role fails over there. Node2 is excluded from HAFS ' s list of owners for this role, so it is not offered as a valid destination and a manual Move > Select Node action targeting Node2 does not succeed.
Official Reference
Failover behavior on clusters of three or more nodes - https://learn.microsoft.com/en-us/troubleshoot
/windows-server/high-availability/groups-fail-logic-three-more-cluster-node-members