Free Preparation Discussions
MENU
Microsoft AZ-800 Exam Questions
Free Microsoft AZ-800 Exam Actual Questions
Note: Premium Questions for AZ-800 were last updated On Sep. 08, 2026 (see below)
SIMULATION
Task 3
You need to create 3 user named Admin1 in contoso.com. Admin1 must be able to back up and restore files on SRV1. The solution must use principle of the least privilege.
TASK 3
Objective:
Create a user named Admin1 in contoso.com.
Admin1 must be able to back up and restore files on SRV1.
Follow the principle of least privilege.
Step-by-Step Guide
Step 1: Create the User Account
Log in to a Domain Controller (e.g., DC1) with appropriate admin rights.
Open Active Directory Users and Computers (dsa.msc).
In the contoso.com domain:
Right-click the Users container or another OU where you want to create the account.
Select New > User.
Enter the following:
First name: Admin1
User logon name: Admin1
Click Next and set a password (ensure it meets the domain's password policy).
Configure password options (e.g., User must change password at next logon, if required).
Click Finish.
Step 2: Grant Backup and Restore Rights on SRV1
By default, Backup Operators have the ability to back up and restore files (without giving full admin rights).
Log in to SRV1 (the target server).
Open Computer Management (compmgmt.msc).
In the left pane, expand:
System Tools > Local Users and Groups > Groups.
Find and double-click the Backup Operators group.
Click Add.
In the Select Users, Computers, Service Accounts, or Groups window:
Type Admin1.
Click Check Names to resolve the user.
Click OK to add Admin1 to the group.
Click OK again to close the Backup Operators group properties.
Step 3: Verify Access
Log in as Admin1 on SRV1 and test performing backup and restore operations using tools like Windows Server Backup.
Since Backup Operators can back up and restore data but do not have full administrative privileges, this follows the least privilege principle.
Additional Notes
If you prefer using PowerShell, you can add the user to the group like this on SRV1:
Add-LocalGroupMember -Group 'Backup Operators' -Member 'contoso\Admin1'
You need to meet the technical requirements for the site links. Which users can perform the required tasks?
The AZ-800 content covering Active Directory Sites and Services clarifies that site, subnet, and site-link objects live in the Configuration partition. The guides emphasize that administration of the Configuration naming context is restricted to Enterprise Admins and to Domain Admins of the forest-root domain. In the context of changing replication topology parameters---such as editing the replication schedule on site links---the documentation notes: ''Only Enterprise Admins or administrators in the forest-root Domain Admins group have default permissions to modify site and site-link objects,'' because these objects affect replication forest-wide.
Applying this to the scenario:
Contoso\Admin1 (Enterprise Admins) has forest-wide rights to modify site links.
Contoso\Admin2 (Domain Admins in contoso.com, the forest-root domain) also has the required rights to change site-link schedules.
Canada\Admin3 (Domain Admins in canada.contoso.com) does not have default permissions in the Configuration partition for forest-wide site-link administration.
Thus, to meet the technical requirement to change all site links to a 30-minute schedule, the users who can perform the task are Admin1 and Admin2.
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
You need to identify which server is the PDC emulator for the domain.
Solution: From a command prompt, you run netdom.exe query fsmo.
Does this meet the goal?
Within the Manage AD DS operations master roles (FSMO) section of the AZ-800 materials, Microsoft documents multiple supported methods to identify role holders. The guidance states that the command-line utility NETDOM can enumerate all FSMO roles with: netdom query fsmo. The output lists the Schema Master, Domain Naming Master, RID Master, PDC Emulator, and Infrastructure Master, each with the current role holder's FQDN. The course notes emphasize that this method is fast, non-interactive, and does not require specific MMC snap-ins, making it suitable for both Server Core and remote administration scenarios. Because the command returns the PDC Emulator holder explicitly in its results, running netdom.exe query fsmo does meet the goal of identifying which server is the PDC Emulator for the domain. This aligns with best practices for quick verification of FSMO placement during operations such as time service verification, password update convergence checks, or when planning FSMO transfers and seizures.
SIMULATION
Task 2
You plan to promote a domain controller named DC3 in a site in Seattle.
You need to ensure that DC3 only replicates with DC1 and DC2 between 8 pm and 6 AM.
TASK 2
Objective: Configure DC3 to replicate with DC1 and DC2 only between 8:00 PM and 6:00 AM.
Step-by-Step Guide: Replication Scheduling for DC3
Step 1: Promote DC3 to a Domain Controller (if not already done)
Use Server Manager or PowerShell to install the Active Directory Domain Services role and promote the server as a domain controller.
Example PowerShell command to install the AD DS role:
powershell
Copy
Install-WindowsFeature AD-Domain-Services
To promote:
powershell
Copy
Install-ADDSDomainController -DomainName 'contoso.com'
Step 2: Open Active Directory Sites and Services
Log in to DC3 or another DC with administrative tools.
Open Active Directory Sites and Services (dssite.msc).
Step 3: Locate the Site
In the left pane, expand the Sites container and find the site that contains DC3.
Expand the site to find Servers.
Under Servers, select DC3.
Step 4: Configure Replication Connection Objects
Expand DC3 and click on NTDS Settings.
In the right pane, you'll see connection objects to other domain controllers (these represent replication partners).
Step 5: Adjust the Replication Schedule for Each Connection
For each connection object to DC1 and DC2:
Right-click the connection object and select Properties.
Click the Change Schedule button.
Step 6: Set the Replication Schedule
In the schedule window, you'll see a grid of hours.
Clear all hours except the time window of 8 PM to 6 AM (in 1-hour blocks).
Select 8 PM to 6 AM (10 hours total) for all days.
Click OK to save.
Step 7: Verify and Document
Ensure that both connection objects (to DC1 and DC2) have the updated schedule.
Document your configuration as part of your environment's change control.
You have a server named Server1 that hosts Windows containers. You plan to deploy an application that will have multiple containers. Each container will be You need to create a Docker network that supports the deployment of the application. Which type of network should you create?
In the context of Windows Server Hybrid Core Infrastructure and container networking, choosing the correct network driver is critical for application deployment. According to official documentation, the l2bridge (Layer 2 Bridge) network mode is used when container hosts are connected to the same IP subnet. In this configuration, each container is assigned an IP address from the same prefix as the container host. All container traffic is bridged to the physical network through an external Hyper-V Virtual Switch. Because the containers share the same underlying network infrastructure as the host, they are visible to the rest of the physical network without requiring Network Address Translation (NAT).
The documentation specifies that for multi-node clusters or deployments where containers must be directly reachable on the physical network via their own IP addresses, l2bridge is the standard choice. This differs from NAT, which uses a private internal IP range and translates traffic through the host's IP, and Transparent mode, which is often used for individual hosts where the container is directly connected to the physical network but can have complexities in virtualized environments. l2tunnel is specifically used for Microsoft Cloud Stack (Azure Stack HCI) and SDN scenarios, typically involving encapsulation, which is not the standard requirement for a general multi-container application deployment on a single server unless specified. Therefore, for a high-performance, direct-access network that bridges traffic at Layer 2, l2bridge is the verified architectural choice for Windows containers.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Kimberly Morgan
5 days agoElizabeth Nelson
10 days agoAndrew Martinez
1 month agoSusan Cooper
1 month agoMatthew Thompson
2 months agoAshley Murphy
2 months agoTiffany Garcia
3 months agoAnthony Lee
3 months agoFrank Young
4 months agoMelissa Ramirez
5 months agoJoseph Torres
4 months agoMelissa Roberts
4 months agoMichael Cook
4 months agoJeffrey Hernandez
4 months agoHeather Sanchez
4 months agoJenifer
5 months agoStephaine
5 months agoMiesha
6 months agoKallie
6 months agoMalcolm
6 months agoVirgilio
6 months agoLauna
7 months agoEmmanuel
7 months agoMaile
7 months agoMari
7 months agoMica
8 months agoStefanie
8 months agoBrinda
8 months agoFiliberto
8 months agoZena
9 months agoThaddeus
9 months agoZona
9 months agoAlyce
9 months agoAlishia
10 months agoCyril
10 months agoJustine
10 months agoJohanna
10 months agoBobbie
11 months agoBette
11 months agoJacquelyne
11 months agoSteffanie
11 months agoAvery
12 months agoJesus
12 months agoSherell
12 months agoRikki
1 year agoKasandra
1 year agoBernardine
1 year agoDorothea
1 year agoVicky
1 year agoLang
1 year agoNan
1 year agoStanton
1 year agoLavina
1 year agoIzetta
1 year agoShawna
1 year agoVallie
2 years agoAngelyn
2 years agoShaun
2 years agoBillye
2 years agoSharan
2 years agoAlberto
2 years agoTeddy
2 years agoBrande
2 years agoEvangelina
2 years agoJerry
2 years agoTitus
2 years agoJulene
2 years agoCharlene
2 years agoMalcolm
2 years agoWeldon
2 years agoSelma
2 years agoBuddy
2 years agoAlfred
2 years agoJesusita
2 years agoAnnabelle
2 years agoNell
2 years agoCammy
2 years agoZona
2 years agoPaulina
2 years agoBrock
2 years agoNohemi
2 years agoGlory
2 years agoRoselle
2 years agoStevie
2 years agoClaudia
2 years agoAlecia
2 years agoCecilia
2 years agoXochitl
2 years agoKenny
2 years ago