EN简体繁體
Sign in
Home / Microsoft / AZ-801
Microsoft · AZ-801

AZ-801 Exam Practice Questions

Configuring Windows Server Hybrid Advanced Services

AZ-801 English PDF practice questions: 326 questions in source order, with options supported by the source format, answers and available explanations. Access covers this exam only. One-time payment; no automatic renewal.

Exam overview

A legacy advanced Windows Server exam covering security, availability, recovery, migrations and troubleshooting.

The provider marks this exam or its associated credential as retired. Details here are historical.

Exam code
AZ-801
Official exam / credential
Configuring Windows Server Hybrid Advanced Services
Exam format
Proctored assessment; interactive items may be included
Historical exam languages
English, Japanese, Simplified Chinese, Korean, German, French, Spanish, Portuguese (Brazil), Traditional Chinese, Italian

Official exam languages and practice-question file languages are listed separately. Confirm the exam version and available languages when booking with the provider.

Official sources: Provider reference
Information checked: 2026-10-20

Supported languages

  • English
  • Simplified Chinese
Try before you buy

First 20 practice questions

326 total questions

Questions follow the source order. Expand each answer to see its explanation.

Disclaimer: All questions on ExamPico are compiled from internet sources and are provided for study reference only.

Question 16

Question#16Topic1

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two servers named Server1 and Server2 that run Windows
Server.
You need to ensure that you can use the Computer Management console to manage Server2. The solution must use the principle of least privilege.
Which two Windows Defender Firewall with Advanced Security rules should you enable on Server2? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

  1. A. the COM+ Network Access (DCOM-In) rule
  2. B. all the rules in the Remote Event Log Management group
  3. C. the Windows Management Instrumentation (WMI-In) rule
  4. D. the COM+ Remote Administration (DCOM-In) rule
  5. E. the Windows Management Instrumentation (DCOM-In) rule
Show answer and explanation

Answer

AB

Explanation

Remote Computer Management uses DCOM and remote event log access. Enable the COM+ Network Access (DCOM-In) rule and the Remote Event Log Management rule group on Server2 with least-privilege scope. See https://learn.microsoft.com/en-us/windows-server/administration/server-manager/configure-remote-management

Question 17

Question#17Topic1

You have a server that runs Windows Server. The server is configured to encrypt all incoming traffic by using a connection security rule.
You need to ensure that Server1 can respond to the unencrypted tracert commands initiated from computers on the same network.
What should you do from Windows Defender Firewall with Advanced Security?

  1. A. From the IPsec Settings, configure IPsec defaults.
  2. B. Create a new custom outbound rule that allows ICMPv4 protocol connections for all profiles.
  3. C. Change the Firewall state of the Private profile to Off.
  4. D. From the IPsec Settings, configure IPsec exemptions.
Show answer and explanation

Answer

D

Explanation

When IPsec encrypts all traffic, ICMP used by tracert is also protected. Configure IPsec exemptions (under Windows Defender Firewall IPsec Settings) to exclude ICMP from IPsec so tracert works while other traffic stays encrypted. See https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/configure-ipsec-settings

Question 18

Question#18Topic1

You have an Azure virtual machine named VM1.
You enable Microsoft Defender SmartScreen on VM1.
You need to ensure that the SmartScreen messages displayed to users are logged.
What should you do?

  1. A. From a command prompt, run WinRM quickconfig.
  2. B. From the local Group Policy, modify the Advanced Audit Policy Configuration settings.
  3. C. From Event Viewer, enable the Debug log.
  4. D. From the Windows Security app, configure the Virus & threat protection settings.
Show answer and explanation

Answer

C

Explanation

SmartScreen diagnostic events are written to the Microsoft-Windows-SmartScreen/Debug log. Enable that Debug log in Event Viewer to capture SmartScreen messages shown to users. See https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen

Question 19

Question#19Topic1

HOTSPOT -
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that runs Windows Server.
You run Get-BitLockerVolume -MountPoint C,D | fl *, which generates the following output.
Question illustration
Question illustration
You need to ensure that volume D will be unlocked automatically when Server1 restarts.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Question illustration

Show answer and explanation

Answer

AA

Explanation

The completed command is Add-BitLockerKeyProtector -MountPoint D: -ADAccountOrGroupProtector CONTOSO\Server1$ -Service, which adds the computer account of Server1 as a key protector so the data volume can be unlocked automatically after restart when the OS volume is prepared appropriately. See https://learn.microsoft.com/en-us/powershell/module/bitlocker/add-bitlockerkeyprotector

Question 20

Question#20Topic1

HOTSPOT -
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the accounts shown in the following table.
Question illustration
The domain is configured to store BitLocker recovery keys in Active Directory.
Admin1 and Admin2 perform the following configurations:
1. Admin1 turns on BitLocker Drive Encryption (BitLocker) for volume C on Server1.
2. Admin1 moves Server1 to OU1.
3. Admin2 turns on BitLocker for removable volume E on Server2.
4. Admin2 moves removable volume E from Server2 to Server1 and unlocks the volume.
On which Active Directory object can you view each BitLocker recovery key? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Question illustration

Show answer and explanation

Answer

EE

Explanation

BitLocker recovery passwords are stored on the computer object of the machine where encryption was enabled. Volume C was encrypted on Server1 before it was moved to OU1, so the key is on Server1. Removable volume E was encrypted on Server2 before it was moved to Server1, so that key remains on Server2. See https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/recovery-key-storage

Downloads and personal use

  • Purchase this exam question set separately with 1, 3, 6 or 12 months of download access.
  • After payment confirmation, your library shows the download link and exact expiry time.
  • Download again during your term. Purchase a new term after expiry.
  • PDFs are licensed for personal study only and must not be resold or shared publicly.
  • Files already saved to your device are not remotely deleted when access expires.
How to choose your certification