EN简体繁體
Sign in
Home / Microsoft / AZ-801
Microsoft · AZ-801

AZ-801 Exam Practice Questions

Configuring Windows Server Hybrid Advanced Services

AZ-801 English PDF practice questions: 326 questions in source order, with options supported by the source format, answers and available explanations. Access covers this exam only. One-time payment; no automatic renewal.

Exam overview

A legacy advanced Windows Server exam covering security, availability, recovery, migrations and troubleshooting.

The provider marks this exam or its associated credential as retired. Details here are historical.

Exam code
AZ-801
Official exam / credential
Configuring Windows Server Hybrid Advanced Services
Exam format
Proctored assessment; interactive items may be included
Historical exam languages
English, Japanese, Simplified Chinese, Korean, German, French, Spanish, Portuguese (Brazil), Traditional Chinese, Italian

Official exam languages and practice-question file languages are listed separately. Confirm the exam version and available languages when booking with the provider.

Official sources: Provider reference
Information checked: 2026-10-20

Supported languages

  • English
  • Simplified Chinese
Try before you buy

First 20 practice questions

326 total questions

Questions follow the source order. Expand each answer to see its explanation.

Disclaimer: All questions on ExamPico are compiled from internet sources and are provided for study reference only.

Question 11

Question#11Topic1

You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant by using password hash synchronization.
You have a Microsoft 365 subscription.
All devices are hybrid Azure AD-joined.
Users report that they must enter their password manually when accessing Microsoft 365 applications.
You need to reduce the number of times the users are prompted for their password when they access Microsoft 365 and Azure services.
What should you do?

  1. A. In Azure AD, configure a Conditional Access policy for the Microsoft Office 365 applications.
  2. B. In the DNS zone of the AD DS domain, create an autodiscover record.
  3. C. From Azure AD Connect, enable single sign-on (SSO).
  4. D. From Azure AD Connect, configure pass-through authentication.
Show answer and explanation

Answer

C

Explanation

With password hash sync and hybrid Azure AD-joined devices, enable Seamless SSO in Azure AD Connect so users get single sign-on to Microsoft 365 and Azure services without repeated password prompts. See https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso

Question 12

Question#12Topic1

You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You have 50 Azure virtual machines that run Windows Server.
You need to ensure that any security exploits detected on the virtual machines are forwarded to Defender for Cloud.
Which extension should you enable on the virtual machines?

  1. A. Vulnerability assessment for machines
  2. B. Microsoft Dependency agent
  3. C. Log Analytics agent for Azure VMs
  4. D. Guest Configuration agent
Show answer and explanation

Answer

A

Explanation

The Vulnerability assessment for machines extension (Microsoft Defender Vulnerability Management) scans VMs for software vulnerabilities and security misconfigurations and reports findings to Microsoft Defender for Cloud. See https://learn.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-vm

Question 13

Question#13Topic1

HOTSPOT -
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains the domains shown in the following table.
Question illustration
You are implementing Microsoft Defender for Identity sensors.
You need to install the sensors on the minimum number of domain controllers. The solution must ensure that Defender for Identity will detect all the security risks in both the domains.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Question illustration

Show answer and explanation

Answer

AC

Explanation

Defender for Identity requires at least one sensor per domain; install on the PDC emulator in each domain (DC1 and DC4) for minimum coverage. During sensor setup you provide the access key from the Defender for Identity portal, not a gMSA or cloud-only Azure AD user. See https://learn.microsoft.com/en-us/defender-for-identity/deploy/install-sensor

Question 14

Question#14Topic1

You have 10 servers that run Windows Server in a workgroup.
You need to configure the servers to encrypt all the network traffic between the servers. The solution must be as secure as possible.
Which authentication method should you configure in a connection security rule?

  1. A. NTLMv2
  2. B. pre-shared key
  3. C. Kerberos V5
  4. D. computer certificate
Show answer and explanation

Answer

D

Explanation

Workgroup servers cannot use Kerberos or NTLM domain authentication for IPsec. Computer certificate authentication is the strongest practical method for encrypting traffic between workgroup members. See https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods

Question 15

Question#15Topic1

You have an Azure virtual machine named VM1 that runs Windows Server.
You need to encrypt the contents of the disks on VM1 by using Azure Disk Encryption.
What is a prerequisite for implementing Azure Disk Encryption?

  1. A. Customer Lockbox for Microsoft Azure
  2. B. an Azure key vault
  3. C. a BitLocker recovery key
  4. D. data-link layer encryption in Azure
Show answer and explanation

Answer

B

Explanation

Azure Disk Encryption requires an Azure Key Vault in the same subscription and region to store the key encryption key (KEK) or BitLocker recovery secrets. See https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-overview

Downloads and personal use

  • Purchase this exam question set separately with 1, 3, 6 or 12 months of download access.
  • After payment confirmation, your library shows the download link and exact expiry time.
  • Download again during your term. Purchase a new term after expiry.
  • PDFs are licensed for personal study only and must not be resold or shared publicly.
  • Files already saved to your device are not remotely deleted when access expires.
How to choose your certification