AZ-800 Practice Questions

In Azure AD Connect–based hybrid identity, object filtering can be enforced with the built-in cloudFiltered metaverse flag. The Administering Windows Server Hybrid Core Infrastructure materials explain that “cloudFiltered is a Boolean in the metaverse that determines whether an object is eligible for export to Azure AD; when set to True, the connector space object is ex cluded from synchronization to Azure A

D.  

Because you need to exclude any user whose custom attribute eq uals NoSync , you create an inbound rule targeting user objects, add the scoping filter on that custom attribute, and then set cloudFiltered = True (constant). This is done with the Synchronization Rules Editor , not ADSI Edit or the Azure AD Connect wizard, since the wizard doesn’t author custom attribute flows and ADSI Edit doesn’t manage sync rules.

In the AZ-800 materials on “Manage and maintain Windows Server IaaS virtual machines,” the Serial Console requirement is called out clearly: the VM must have Boot diagnostics enabled so Azure can capture the console and provide an interactive text console during boot and runtime. The guidance explains that enabling Boot diagnostics (either managed or with a storage account) stores the console output and screen shots that the Serial Console relies on. Guest-level diagnostics or a managed identity are not prerequisites for Serial Console access.

Access control to the Serial Console is governed by Azure RBA

C.  

Therefore, to let user1@contoso.com use the Serial Console while meeting least-privilege objectives, enable Boot diagnostics on the VM (here, with a custom storage account, which satisfies the boot diagnostics requirement) and assign the Virtual Machine Administrator Login role to User1.

To deploy a n ew primary DNS zone named fabrikam.com to DC1 and sign the zone, you can follow these steps:

Step 1: Create the Primary DNS Zone Use the Add-DnsServerPrimaryZone PowerShell command to create the primary zone:

Add-DnsServerPrimaryZone -Name " fabrikam.com " -ZoneFile " fabrikam.com.dns " -DynamicUpdate Secure

This command creates a primary zone for fabrikam.com with a DNS file named fabrikam.com.dns and allows secure dynamic updates.

Step 2: Sign the Zone To sign the zone, you can use the DNS Manager or Windows PowerShell. Here’s how to sign the zone using PowerShell:

Add-DnsServerSigningKey -ZoneName " fabrikam.com " -Type KeySigningKey -CryptoAlgorithm RsaSha256

Set-DnsServerDnsSecZoneSetting -ZoneName " fabrikam.com " -DenialOfExistence NSEC3 -NSEC3Parameters 1,0 ,10, " "

These commands add a signing key to the zone and set DNSSEC settings with NSEC3 parameters.

Step 3: Publish the Signed Zone After signing the zone, ensure that it is published and available for DNS queries. You can verify the zone signing status usi ng the following command:

Get-DnsServerZone -Name " fabrikam.com "

Note: Ensure that you have the appropriate permissions to perform these actions on DC1 and that the DNS Server role is installed and properly configured. Also, replace " fabrikam.com.dns " with the actual path to your DNS file if it’s different12.

By following these steps, you should be able to deploy and sign the new primary DNS zone fabrikam.com on DC1.

TASK 4

???? Objective:

Enforce a minimum password lengt h of 12 characters for members of the BranchAdmins group only.

Step-by-Step Guide: Fine-Grained Password Policy (FGPP)

✅ Step 1: Verify Forest Functional Level

Fine-grained password policies require the forest functional level to be at least Windows Serv er 2008.

On a DC, open Active Directory Domains and Trusts (domain.msc).

Right-click the domain and select Raise Forest Functional Level to verify.

If it’s lower, consider raising it (requires caution and planning).

✅ Step 2: Open the Active Directory Administrative Center (ADAC)

On a DC or management server, open ADAC:

Press Windows + R, type dsac.exe, and hit Enter.

✅ Step 3: Create a Fine-Grained Password Policy

In ADAC, in the left pane, expand the domain (e.g., contoso.com) and click System > Pas sword Settings Container.

In the right pane, right-click and select New > Password Settings.

✅ Step 4: Configure the Password Policy

Name: e.g., BranchAdminsPSO.

Precedence: e.g., 1 (lower number = higher priority).

Minimum password length: 12.

Configure other settings as required (leave them at default if not specified).

In Directly Applies To, click Add.

Search for and select the BranchAdmins group.

Click OK.

✅ Step 5: Confirm and Apply

Click OK to create the policy.

It’s now linked directly to the Bran chAdmins group, affecting only its members.

✅ Step 6: Verify the Policy

You can use PowerShell to confirm that the PSO is applied:

Get-ADUserResultantPasswordPolicy -Identity " username "

Replace " username " with a user from the BranchAdmins group. The output will show the minimum password length (should be 12).