AZ-800 Exam Dumps - Administering Windows Server Hybrid Core Infrastructure

The Administering Windows Server Hybrid Core Infrastructure materials for Azure File Sync explain that a cloud endpoint in a sync group must be an Azure file share and that “the storage account that contains the Azure file share must be in the same Azure region as the Storage Sync Service.” The guide also clarifies supported account types: “Azure File Sync supports Azure Files in general-purpose v2 (StorageV2) accounts for Standard performance and FileStorage accounts for Premium performance; BlockBlobStorage accounts are not supported for Azure Files.” Additionally, only storage accounts that contain Azure file shares can be selected for cloud endpoints; blob containers (used by Block Blob) are not applicable to Azure File Sync.

Applying these requirements to the table:

storage1 (East US, StorageV2) → valid region and account kind, and it has share1 (an Azure file share) → eligible.

storage3 (East US, FileStorage) → valid region and supported Premium account kind, with share3 → eligible.

storage2 (East US, BlockBlobStorage) → Block Blob only, no Azure Files share → ineligible.

storage4 (Central US, StorageV2) → has a file share but is not in the same region as the Storage Sync Service (Synd in East US) → ineligible.

Therefore, when creating the sync group in Synd (East US), you can use storage1 and storage3, and the only valid cloud endpoints you can specify are share1 and share3.

Step 2: Import the AD FS certificate to Server2.

Step 3: Run the Web Application Proxy Configuration Wizard.

In Administering Windows Server Hybrid Core Infrastructure, the Web Application Proxy (WAP) component is documented as a role service of the Remote Access role and is deployed on an edge or perimeter server to publish AD FS and other web apps. The guide states that before configuring WAP, you must install the Remote Access role with the Web Application Proxy role service on the proxy server. It further explains that WAP must establish trust with the existing AD FS farm by using the AD FS service communications certificate: “Import the federation service SSL certificate (with private key) on the proxy server and place it in the local computer’s personal store.” After the certificate is present, you run the Web Application Proxy Configuration Wizard to “specify the Federation Service name, provide AD FS credentials, and complete the trust and configuration.” The materials also clarify that you do not install the AD FS role on the proxy and Microsoft Application Request Routing (ARR) is not required for WAP. The AD FS Configuration Wizard applies to federation servers, not proxies. Therefore, the minimal and correct sequence on Server2 is: Install Remote Access (WAP) → Import the AD FS cert → Run the Web Application Proxy Configuration Wizard, which configures the trust and enables publishing of the AD FS endpoint.

Infrastructure documents: =

In the Windows Server DNS guidance for hybrid core infrastructure, Microsoft specifies that forwarders send “all queries for names that the DNS server cannot resolve locally to a designated upstream server,” while conditional forwarders target “queries for a specific DNS domain to one or more authoritative DNS servers for that domain.” When a branch office DNS server must resolve a partner/remote domain hosted elsewhere in the organization and you cannot change the authoritative server, the recommended pattern is to configure a conditional forwarder on the branch server pointing to the remote authoritative server. For Internet name resolution, you configure a standard forwarder to the required recursive resolver IP.

Applied here: New York clients use Server2. To resolve contoso.com (hosted on Server1), create a conditional forwarder on Server2 for contoso.com that points to 10.1.1.1 (Server1). To meet the requirement to forward all other external lookups, configure a forwarder on Server2 to 131.107.100.200. This design avoids zone transfers or changes on Server1 and fulfills both name-resolution requirements with minimal administration.

In the Administering Windows Server Hybrid Core Infrastructure materials for DFS, Microsoft explains that a DFS Namespace presents a virtual tree of folders, and each folder can have one or more folder targets. A folder target is simply “a UNC path to a shared folder that contains the actual data.” The guide emphasizes that folder targets do not need the DFS Namespaces role installed; the role is only required on namespace servers that host the namespace itself. Likewise, DFS Replication (DFSR) is optional—you enable it only when you want to keep the contents of multiple folder targets synchronized. The text states that “any SMB share on any Windows server (or cluster) can be used as a folder target,” and that “DFSR is used to replicate the data between folder targets but is not a prerequisite for configuring a target.”

Applying this to the scenario: you are creating a domain-based namespace \\contoso.com\Public and a folder Finance. The namespace servers must have the DFS Namespaces role (e.g., Server1/Server3), but folder targets for Finance can reside on any server hosting an SMB share, regardless of whether the DFS Namespaces or DFS Replication roles are installed. Therefore, Server1, Server2, Server3, and Server4 can all be configured as folder targets for the Finance folder.

In the Administering Windows Server Hybrid Core Infrastructure materials (AZ-800), the prescribed sequence for enabling VM domain-join to Azure Active Directory Domain Services (Azure AD DS) is to first prepare networking, then deploy the managed domain, and finally point DNS to that domain. The guide explains that Azure AD DS is a managed domain and that you must deploy it into a virtual network: “Azure AD DS provides domain join, group policy, and LDAP/NTLM/Kerberos without deploying domain controllers. The managed domain is associated with an Azure virtual network.” It further directs that VMs can only discover and join the managed domain when the VNet’s DNS points to the Azure AD DS IPs: “To enable name resolution for domain join, configure the virtual network DNS servers to the IP addresses of the Azure AD DS managed domain.”

Therefore, the correct, exam-aligned order is:

Create an Azure virtual network (the target network/subnet into which the managed domain will be placed).

Create an Azure AD DS instance (the managed domain is deployed into that VNet and provides two IP addresses).

Modify the settings of the Azure virtual network to use those IP addresses as custom DNS servers so that new or existing Azure VMs in that VNet can locate and join the domain. Installing the AD DS role or running its wizard is not required for Azure AD DS, and Azure AD Connect is optional for identity sync but not required for VM join.

Disk1 (three-way mirror): 2 disks; Disk2 (parity): 1 disk

\In the Administering Windows Server Hybrid Core Infrastructure materials on Storage Spaces resiliency, Microsoft describes how each resiliency type determines simultaneous disk-failure tolerance. The guide explains that mirror spaces keep multiple copies of data: “Two-way mirror writes two copies and can sustain a single disk failure; three-way mirror writes three copies and can sustain the loss of any two disks without data loss.” It also differentiates parity spaces, which stripe data with parity information: “Parity provides capacity efficiency comparable to RAID-5 and tolerates a single disk failure (use dual parity to withstand two failures).”

Applying these to SSPace1:

Disk1 uses a three-way mirror across eight physical disks. By definition, a three-way mirror survives two concurrent disk failures and remains online, satisfying the “always available” requirement.

Disk2 is configured as parity across twelve physical disks. Standard parity (single parity) is equivalent to RAID-5 and survives one disk failure; only dual parity would allow two, but the configuration provided specifies parity (not dual parity).

Therefore, the maximum simultaneous physical disk failures while maintaining availability are 2 for Disk1 and 1 for Disk2.

The exam materials state that Azure Automation runbooks can be authored in PowerShell and Python (along with Graphical and PowerShell Workflow where noted). The module on “Automate management in hybrid environments” specifies: “Runbooks support PowerShell for Windows-based automation and Python for cross-platform scenarios.” It further explains that these languages integrate with Automation Accounts, modules/packages, credentials, and managed identities to run tasks on Azure or hybrid resources through the Hybrid Runbook Worker. Languages such as Java, JavaScript, or Bicep are not runbook languages (Bicep is used for ARM template deployments, not runbook execution). Accordingly, Task1 can be implemented in PowerShell and Python.