Microsoft Certified: Windows Server Hybrid Administrator Associate — Practice Set 1

Question 1

You need to deploy a domain controller to a branch office that has an unreliable WAN link and limited physical security. Which type of domain controller should you deploy?

Accepted Answer

A Read-Only Domain Controller (RODC) is specifically designed for branch office scenarios where physical security cannot be guaranteed and WAN connectivity is unreliable. RODCs host a read-only copy of the AD DS database, so if the RODC is compromised, no changes can be written back to the domain. Writable domain controllers should only be placed in physically secured locations. A global catalog server is a role that can be placed on any domain controller and does not address security concerns. A DNS-only configuration does not provide authentication services locally.

Question 2

Which FSMO role is responsible for maintaining a master list of unique security identifiers (SIDs) and ensuring that no two objects in the forest share the same SID?

Accepted Answer

The RID (Relative ID) Master allocates pools of relative identifiers to each domain controller, which are used to construct unique SIDs for new security principals. Without the RID Master being available, domain controllers will eventually exhaust their RID pool and be unable to create new accounts. The PDC Emulator handles time synchronization, password changes, and acts as the primary domain controller for legacy clients. The Infrastructure Master tracks cross-domain object references. The Schema Master controls modifications to the AD DS schema.

Question 3

Your organization has an on-premises AD DS environment and wants to synchronize identities to Microsoft Entra ID. The IT team wants to use password hash synchronization but also needs to monitor the health of the synchronization service and receive alerts if sync stops working. Which Microsoft Entra service should you deploy alongside Microsoft Entra Connect Sync?

Accepted Answer

Microsoft Entra Connect Health provides monitoring and alerting for the health of the identity synchronization infrastructure, including Microsoft Entra Connect Sync agents. It surfaces alerts when sync is failing, shows synchronization statistics, and provides usage analytics. Microsoft Entra Domain Services is a managed domain service that provides domain join and Group Policy without on-premises domain controllers. Microsoft Entra Cloud Sync is an alternative lightweight sync agent, not a monitoring solution. Microsoft Entra Private Access is a network access solution unrelated to identity sync health.

Question 4

You are configuring a multi-forest Active Directory environment. Two forests need to share resources. Which two trust types can be used to establish trust between two separate forests? Choose 2.

Accepted Answer

Forest trusts allow all domains in one forest to trust all domains in another forest transitively, and require both forests to be at Windows Server 2003 or higher functional level. External trusts create a non-transitive trust between a domain in one forest and a domain in another forest, useful when a full forest trust is not desired. Shortcut trusts are used within a forest to shorten the trust path between domains in separate trees. Realm trusts connect AD DS to a non-Windows Kerberos realm. Parent-child trusts are automatically created between parent and child domains within the same forest.

Question 5

A developer at your company needs to run a Windows service that authenticates to SQL Server and other network resources without requiring manual password management. The service must automatically rotate its password. Which service account type should you configure?

Accepted Answer

Group Managed Service Accounts (gMSAs) are the preferred choice for services that may run on multiple servers (such as load-balanced services) and require automatic password management by AD DS. Passwords are automatically rotated by the Key Distribution Service (KDS) and are complex, eliminating manual management. Standard user accounts require manual password rotation which creates security and operational risks. Standalone Managed Service Accounts (sMSAs) work similarly but are bound to a single server. Virtual accounts are local accounts used for services running on a single machine that do not need to access network resources.

Question 6

You want to manage an on-premises Windows Server using a browser-based interface without requiring a VPN connection from Azure. Which tool should you deploy?

Accepted Answer

Windows Admin Center is a browser-based management interface for Windows Server that can be deployed on-premises or as a gateway in Azure, enabling management of on-premises and hybrid servers. It can be installed on-premises and accessed via a browser, or deployed in Azure to manage servers registered with Azure Arc. Remote Desktop Services provides remote desktop access but is not a web-based management console. Azure Cloud Shell requires Azure resources and cannot directly manage on-premises servers without connectivity. PowerShell DSC is a configuration management tool, not a general management interface.

Question 7

You need to onboard 50 on-premises Windows Server machines to Azure Arc so that Azure Policy, Azure Monitor, and Azure Defender for Servers can be applied to them. What is the first step you must complete on each server?

Accepted Answer

The Azure Connected Machine Agent (also called the Azure Arc agent) must be installed on each on-premises server to register it with Azure Arc. Once installed, the server appears as an Azure Arc-enabled server resource in the Azure portal, enabling the application of Azure Policy, Azure Monitor, and Microsoft Defender for Servers. The Log Analytics agent collects telemetry but does not enable the full Arc management plane. The Hybrid Runbook Worker is an Azure Automation component that can run after the Arc agent is installed. Entra ID registration is for user devices and does not enroll servers into Azure Arc.

Question 8

You are running Hyper-V and need to allow a guest VM to use a physical GPU for graphics-intensive workloads while maintaining isolation from other VMs. Which Hyper-V feature should you configure?

Accepted Answer

Discrete Device Assignment (DDA) allows a guest VM to have direct, exclusive access to a physical PCIe device such as a GPU or NVMe SSD. The device is dismounted from the host and assigned to a single VM, providing near-native performance. GPU partitioning (GPU-P) is a newer feature in Windows Server 2022 that allows a single GPU to be shared among multiple VMs using virtualization-based partitioning. RemoteFX vGPU has been removed from newer Windows Server versions. Enhanced Session Mode improves remote desktop experience within Hyper-V but does not provide GPU passthrough.

Question 9

Your organization runs sensitive workloads on Hyper-V. You need to ensure that virtual machines are protected from the fabric administrators who manage the Hyper-V hosts — fabric admins must not be able to inspect or modify VM state. Which solution should you implement?

Accepted Answer

A guarded fabric consists of a Host Guardian Service (HGS) that attests to the health and identity of Hyper-V hosts (guarded hosts) and allows shielded VMs to start only on those attested hosts. Shielded VMs use Virtual TPM, BitLocker encryption, and encrypted state files — fabric administrators cannot inspect the VM memory, disk contents, or screenshots. BitLocker on host volumes protects data at rest but does not restrict fabric admin access to running VM state. Hyper-V replication is a disaster recovery feature and does not address insider threat from fabric admins. Storage Spaces Direct is a storage solution unrelated to VM isolation from admins.

Question 10

You need to prevent clients from receiving responses from unauthorized DNS servers and protect your internal DNS zone from DNS cache poisoning attacks. Which DNS security feature should you enable?

Accepted Answer

DNSSEC (Domain Name System Security Extensions) adds digital signatures to DNS records, enabling resolvers to verify that responses have not been tampered with and originate from the authoritative DNS server. This protects against cache poisoning attacks where an attacker injects false DNS records. DNS conditional forwarding directs queries for specific domains to specific DNS servers but provides no integrity protection. DNS policies allow you to manage traffic based on time of day, subnet, or query type but do not protect against cache poisoning. The DNS socket pool randomizes source ports to make spoofing harder but is not as robust as DNSSEC.

Question 11

Your organization needs to provide secure connectivity from an on-premises network to Azure virtual networks without deploying a dedicated physical VPN device. Which two solutions can you use that are built into Windows Server to establish this hybrid connectivity? Choose 2.

Accepted Answer

Azure Network Adapter is a feature in Windows Admin Center that deploys a point-to-site VPN connection from a single Windows Server directly to an Azure virtual network, useful for connecting individual servers. The Remote Access role in Windows Server can be configured as a site-to-site VPN gateway, connecting an on-premises network to Azure. Azure ExpressRoute is a dedicated private circuit provisioned through a connectivity provider, not a Windows Server feature. Azure Relay enables application-level connectivity through firewalls without opening inbound ports, but is not a network-level VPN solution. Azure Traffic Manager is a DNS-based load balancer for distributing traffic across global endpoints.

Question 12

Your company has multiple branch offices with slow WAN connections. Users in each branch frequently access the same files stored on a central file server. You want to reduce WAN bandwidth consumption by caching frequently accessed files locally at each branch. Which Windows Server technology should you implement?

Accepted Answer

BranchCache is a WAN bandwidth optimization feature that caches content from file shares (and web servers) at branch office locations. When a user at a branch downloads a file, the content is cached locally so subsequent requests by other branch users are served from the local cache rather than traversing the WAN. DFS Replication actively replicates folders to branch servers, which requires more configuration and may create consistency challenges. Storage Replica is a block-level synchronous or asynchronous replication feature for disaster recovery, not bandwidth optimization. Azure File Sync syncs files to Azure Files but is primarily for cloud tiering and centralization, not traditional WAN bandwidth savings between branches.

Question 13

You are planning to migrate a heavily accessed file share to Azure Files. Clients must continue to use the existing UNC path (\server\share) without any reconfiguration. Which Azure Files feature enables this transparent access pattern?

Accepted Answer

Azure File Sync with DFS Namespace integration allows you to replace the existing file server namespace with a DFS Namespace that points to an Azure File Sync-enabled server endpoint, allowing clients to continue using the same UNC path. DFS Namespaces abstract the underlying storage location so that if the endpoint changes, clients do not need to update their path. Azure File Sync with cloud tiering alone addresses capacity but does not preserve UNC paths transparently for a full migration scenario. SMB over QUIC is a connectivity protocol for Azure File Sync-enabled servers that works over the internet without a VPN. NFS with Azure NetApp Files is for Linux/Unix workloads and does not provide Windows SMB namespace continuity.

Question 14

You need to ensure that local administrator account passwords on all Windows Server machines are unique, complex, and automatically rotated. Which Microsoft solution should you implement?

Accepted Answer

Windows LAPS (Local Administrator Password Solution) automatically manages and rotates the password of a designated local administrator account on each machine. Passwords are stored in AD DS or Microsoft Entra ID, are unique per machine, and rotate on a configurable schedule — eliminating the risk of lateral movement attacks that exploit shared local admin passwords. Microsoft Entra Password Protection enforces custom banned password lists for domain user accounts, not local accounts. Credential Guard protects credential hashes in memory from extraction, not local admin password management. Authentication policy silos restrict which accounts can sign in to which devices but do not manage local account passwords.

Question 15

A penetration test revealed that attackers can extract NTLM credential hashes from the LSASS process memory on your domain controllers, enabling pass-the-hash attacks. Which Windows Defender feature should you enable to protect credential hashes stored in memory?

Accepted Answer

Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate the LSASS process in a protected container called Isolated LSA, preventing privileged code running in the OS from accessing credential hashes. This stops pass-the-hash and pass-the-ticket attacks even if an attacker gains admin access to the machine. Windows Defender Application Control prevents unauthorized code from running but does not protect credentials already in memory. Exploit Protection applies memory mitigations to individual processes but does not provide the hardware-based isolation of VBS. SmartScreen is a phishing and malicious file download protection feature, unrelated to in-memory credential protection.

Question 16

You are hardening domain controllers in your organization. Which three actions are recommended best practices for hardening domain controllers? Choose 3.

Accepted Answer

Domain controllers should have a minimal footprint — only the Domain Services role and required supporting roles should be installed to reduce the attack surface (A). Physical and network access to DCs must be tightly controlled, limiting which systems and accounts can reach them (C). Applying a security baseline via Group Policy enforces hardened settings such as audit policies, restricted logon rights, and protocol configurations (E). Protected Users is a security group for privileged user accounts that limits their authentication options, but adding DCs themselves to this group is not the correct application — Protected Users applies to user accounts, not computer accounts. Enabling broad remote desktop access for helpdesk staff directly contradicts DC hardening best practices as it expands the attack surface.

Question 17

You are configuring a two-node Windows Server Failover Cluster that has no shared storage. The cluster is deployed in a single datacenter with no Azure subscription. Which quorum witness type should you use to prevent a split-brain scenario?

Accepted Answer

For a two-node cluster without shared storage and no Azure subscription, a file share witness is the appropriate choice. A file share witness stores the quorum vote on a remote SMB share (typically on another server), providing the tie-breaking third vote needed to keep the cluster online if one node fails. A disk witness requires shared storage, which this cluster does not have. An Azure cloud witness requires an Azure subscription. Node majority without a witness would mean a two-node cluster has no tie-breaker — if either node loses connectivity to the other, neither node can form a majority, causing both nodes to stop the cluster workload.

Question 18

Your organization wants to deploy a highly available file server cluster across two sites separated by 50 km. Both sites have identical SANs and you need read/write access to the file share from both sites during normal operations, with automatic failover if one site goes offline. Which clustering feature meets these requirements?

Accepted Answer

A stretch cluster spans two sites and uses Storage Replica to synchronously replicate storage between them, enabling automatic failover with near-zero data loss. Storage Replica at the stretch cluster level keeps the replicated volume consistent so that if the primary site fails, the cluster can bring resources online at the secondary site using already-replicated data. A standard failover cluster with a disk witness is limited to a single site with shared storage. Hyper-V replication is VM-level asynchronous replication for disaster recovery, not a general-purpose file server HA solution. DFS Replication replicates file shares but is not cluster-aware and can have replication conflicts in multi-master scenarios.

Question 19

You are deploying Storage Spaces Direct (S2D) in a 4-node hyper-converged cluster. Which network technology should you use to provide low-latency, high-bandwidth storage traffic between nodes while offloading processing from the CPU?

Accepted Answer

Storage Spaces Direct requires RDMA (Remote Direct Memory Access) capable network adapters for optimal performance. RDMA allows data to be transferred directly between memory on different nodes without CPU involvement, drastically reducing latency and CPU overhead for storage traffic. RoCE (RDMA over Converged Ethernet) and iWARP are the two RDMA protocol implementations supported on Windows Server. iSCSI over 1 GbE would create a significant bottleneck and does not provide RDMA benefits. NFS is a file-level protocol designed for Unix/Linux environments, not suited for S2D inter-node storage communication. FCoE is a storage protocol that requires specialized switches and is not the recommended path for S2D.

Question 20

You need to protect an on-premises physical server by replicating it to Azure so that it can be failed over to an Azure VM in the event of a disaster. Which Azure service provides this capability?

Accepted Answer

Azure Site Recovery (ASR) is the disaster recovery service that continuously replicates on-premises physical servers, VMware VMs, and Hyper-V VMs to Azure. In the event of a disaster, you can fail over to Azure VMs within the defined RPO/RTO targets. Azure Backup provides backup and restore of data and VMs but is not designed for continuous replication and rapid failover. Azure Migrate is an assessment and migration tool for moving workloads to Azure permanently, not for disaster recovery. Azure Storage replication replicates storage account data across regions but does not orchestrate VM failover or workload recovery.

Question 21

You need to migrate file server data, including NTFS permissions and local user accounts, from an aging Windows Server 2012 R2 file server to a new Windows Server 2022 machine. The migration must complete with minimal downtime and the source server should be cut over to the new server seamlessly. Which tool is purpose-built for this scenario?

Accepted Answer

Storage Migration Service (SMS) is a Windows Server feature in Windows Admin Center specifically designed to migrate file servers. It inventories the source server, transfers files and NTFS permissions (including local user accounts and groups), validates the transfer, and then performs a cutover where the new server assumes the identity (name and IP address) of the old server, making the migration transparent to clients. Robocopy can copy files and permissions but cannot automate the identity cutover or migrate local accounts. Azure Migrate is designed for migrating workloads permanently to Azure, not for server-to-server on-premises migrations. DFS Replication is a replication service but does not handle identity cutover or local account migration.

Question 22

You are planning to migrate on-premises VMware VMs to Azure using Azure Migrate. Which two components must you deploy in the on-premises environment to enable assessment and agentless replication? Choose 2.

Accepted Answer

For agentless VMware migration with Azure Migrate, you deploy the Azure Migrate appliance (an OVA-based VM in your vCenter environment) which continuously discovers and assesses on-premises VMs. For agentless replication, a separate replication appliance is deployed that captures disk snapshots from vCenter APIs without requiring agents on each VM. The Site Recovery Mobility Service agent is required for agent-based (not agentless) migration and is not needed for the agentless workflow. The Log Analytics agent and Microsoft Monitoring Agent are monitoring tools not required for the migration workflow itself.

Question 23

Your organization is running Windows Server 2008 R2 domain controllers and needs to migrate to Windows Server 2025 Active Directory. The forest functional level is currently Windows Server 2008 R2. You want to perform the migration with zero downtime for users. Which is the correct sequence of steps?

Accepted Answer

The correct approach for an AD forest upgrade with zero downtime is to first promote new Windows Server 2025 domain controllers into the existing forest alongside the old Windows Server 2008 R2 DCs. Once the new DCs are replicating and stable, transfer (not seize) FSMO roles to the new DCs. After confirming replication health, raise the domain and forest functional levels to Windows Server 2016 or higher incrementally. Finally, decommission the old domain controllers. You cannot raise the functional level before all DCs support the new level, so old DCs must be removed first — but they should remain until the new DCs are ready. In-place upgrades of domain controllers are not supported between versions more than one generation apart and are generally not recommended for DCs.

Question 24

Users report intermittent connection failures to a Windows Server application. You need to capture detailed network performance metrics and CPU/memory counters on the server over a 48-hour period for later analysis. Which built-in Windows tool should you use?

Accepted Answer

Performance Monitor with a Data Collector Set allows you to define a set of performance counters (CPU, memory, network, disk I/O) and schedule them to run continuously over a defined period, saving results to a log file for later analysis. Data Collector Sets can run unattended over extended periods like 48 hours, making them ideal for intermittent issues. Task Manager provides a real-time snapshot but cannot log data over time. Resource Monitor provides real-time data and limited history but is not designed for extended logging sessions. Event Viewer captures event logs (errors, warnings, information events) but does not capture performance counter data.

Question 25

An Active Directory domain controller is no longer replicating changes to other domain controllers. Running `repadmin /showrepl` shows error 8606 (Insufficient attributes were given to create an object). The domain controller has been offline for more than the tombstone lifetime. What is the most appropriate recovery action?

Accepted Answer

When a domain controller has been offline longer than the tombstone lifetime (default 180 days), its AD database is considered lingering-object stale and it cannot be safely brought back into replication. Attempting to force replication would introduce lingering objects (deleted objects that should have been garbage-collected) to other domain controllers. The correct action is to force-demote the DC (using `/forceremoval` since standard demotion requires replication), then perform AD metadata cleanup using `ntdsutil` or `Active Directory Users and Computers` to remove the orphaned DC object from AD, and finally promote a new Windows Server to replace it. Running `repadmin /syncall` would propagate lingering objects. Restoring from a VSS snapshot on an isolated DC would reintroduce the tombstone problem and could corrupt the AD database if the snapshot is older than the tombstone lifetime. Using `ntdsutil` in DSRM is used for AD database repair, not for handling a DC that has exceeded the tombstone lifetime.

AZ-800 + AZ-801 — Windows Server Hybrid Administrator Associate