AZ-800: Administering Windows Server Hybrid Core Infrastructure

By Microsoft · Browse Mode
About the Exam

This exam is for Windows Server Hybrid Administrators who administer Windows Server as a workload in on-premises and hybrid environments. It covers Active Directory Domain Services, hybrid Windows Server management, virtual machines and containers, hybrid networking, and storage and file services. Passing demonstrates that you can deploy, implement, manage, and troubleshoot Windows Server across on-premises and Azure environments.

Exam Topics

  • Implementación y administración de Active Directory Domain Services (AD DS) en entornos locales y en la nube30–35%
  • Administración de cargas de trabajo y servidores de Windows en un entorno híbrido10–15%
  • Administración de máquinas virtuales y contenedores15–20%
  • Implementación y administración de una infraestructura de red local e híbrida15–20%
  • Administración de servicios de archivos y almacenamiento15–20%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated September 2, 2026 at 2:08 AM

Topic filter
Retired questions
Question sort
Questions per page

QuestionQ1

Implementación y administración de Active Directory Domain Services (AD DS) en entornos locales y en la nube

Your network has an on-premises Active Directory Domain Services (AD DS) domain. The domain includes a user named User1 and the servers shown in the following table.

Question Image

User1 belongs to the Protected Users security group.

User1 performs these actions:

  • From Server1, establishes a remote PowerShell session to Server2.
  • From the PowerShell session on Server2, tries to access a resource on Backup1.

The attempt to access the resource on Backup1 is denied.

You need to ensure that User1 can access the resources on Backup1 by using the PowerShell session on Server2. The solution must adhere to the principle of least privilege and minimize administrative effort.

What should you configure?

Explanation

Members of the Protected Users group cannot use CredSSP or Kerberos constrained or unconstrained delegation. A PowerShell session configuration that uses a RunAs credential runs commands on Server2 under a separate account; that account can receive only the required permissions on Backup1, while access to the endpoint can be limited to User1. This avoids delegating User1’s credentials and provides a least-privilege second-hop solution.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Implementación y administración de Active Directory Domain Services (AD DS) en entornos locales y en la nube

An Active Directory Domain Services (AD DS) domain contains a member server named Server1 that runs Windows Server.

You need to ensure that you can manage the domain password policies from Server1.

Which command should you run first on Server1?

Explanation

Domain password policies are configured through domain Group Policy Objects. The Group Policy Management Console provides the tools to manage and edit GPOs and must be installed on the Windows Server computer used for that administration.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Implementación y administración de Active Directory Domain Services (AD DS) en entornos locales y en la nube

Your on-premises network has a single-domain Active Directory Domain Services (AD DS) forest and an Azure AD tenant named contoso.com. The AD DS forest synchronizes with the Azure AD tenant by using Azure AD Connect.

You must ensure that forest users with a custom attribute of NoSync are excluded from synchronization.

How should you configure the Azure AD Connect cloudFiltered attribute, and which tool should you use?

Select
Attribute:
Tool:
Explanation

Azure AD Connect excludes an object from cloud synchronization when its cloudFiltered attribute evaluates to True. A custom synchronization rule that maps the NoSync condition to cloudFiltered=True is created or edited in Synchronization Rules Editor.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Administración de cargas de trabajo y servidores de Windows en un entorno híbrido

You have an Azure subscription named Sub1 linked to a Microsoft Entra tenant named contoso.com. Contoso.com includes the users in the following table.

Question Image

You deploy a virtual machine with these configurations:

  • Name: VM1
  • Resource group: RG1
  • Operating system: Windows Server
  • Login with Microsoft Entra ID: Enabled

The Azure role assignments are shown in the following table.

Question Image

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Yes or No
StatementsYesNo
User1 can sign in to VM1 by using their Microsoft Entra credentials.
User2 can sign in to VM1 by using their Microsoft Entra credentials.
User3 can sign in to VM1 by using their Microsoft Entra credentials.
Explanation

Virtual Machine Contributor permits VM management but does not authorize Microsoft Entra interactive sign-in. Virtual Machine User Login and Virtual Machine Administrator Login grant the required sign-in authorization at their assigned scope or any inherited lower scope. However, Microsoft Entra B2B guest users are not supported for Microsoft Entra sign-in to Windows Azure VMs, so User2 cannot sign in. User3’s subscription-level administrator-login role inherits to VM1.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Administración de máquinas virtuales y contenedores

You have a Windows Server 2022 container host named Host1 with the Subsystem for Linux installed and the container images shown in the following table.

Question Image

You need to deploy the images to Host1 while maximizing container isolation.

Which images can run using process isolation, and which can run using Hyper-V isolation?

Select
Process isolation:
Hyper-V isolation:
Explanation

Process-isolated containers share the host kernel and require compatible host and container OS versions; Windows Server 2022 supports process isolation for the Windows Server 2022 image, not the older Windows Server images. Hyper-V isolation gives each container its own kernel/VM boundary, supporting the older Windows images and the Linux workload when the Linux subsystem is installed.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home