AZ-800 Sample Questions & Answers

Microsoft Entra application proxy publishes on-premises web applications to remote users without a VPN. Users are pre-authenticated by Microsoft Entra ID, so Conditional Access policies such as MFA apply even when the back-end application doesn't support modern authentication; the private network connector installed on-premises makes only outbound connections and forwards requests to the app, which can use integrated Windows authentication through Kerberos constrained delegation. A point-to-site VPN would give the doctors' devices network-level access, Azure Bastion is for RDP/SSH to Azure VMs, and WAP with AD FS doesn't use Microsoft Entra ID as the identity provider.

In a JEA role capability file (.psrc), the VisibleCmdlets field lists the PowerShell cmdlets that users can run in the JEA session (optionally restricting their parameters and values). To allow starting, stopping, and restarting VMs, you would list Start-VM, Stop-VM, and Restart-VM in this field. VisibleExternalCommands is for executables and scripts outside PowerShell, RoleDefinitions belongs in the session configuration file (.pssc) where it maps users to role capabilities, and AllowedCommandlets isn't a valid field.

This statement is true. The Storage Sync Service and the Azure file share it syncs with must be in the same Azure region. While the on-premises servers (server endpoints) can be anywhere in the world, the Azure resources must be co-located in the same region for the sync group to be created.

Azure Policy's Guest Configuration feature is the ideal solution. You can create a custom Desired State Configuration (DSC) that defines the required state (antivirus service running). This configuration is then packaged and applied via an Azure Policy initiative. The policy can be set to not only audit for compliance but also to deploy a remediation task that automatically starts the service if it's found to be stopped. This provides a scalable, declarative way to enforce and remediate configuration drift across all Arc-enabled servers.

Discrete Device Assignment (DDA) passes an entire PCIe device, such as a GPU, through to a single virtual machine: the device is dismounted from the host by its PCI location path and assigned to the VM, which then uses the native driver with full access to the GPU. Each physical GPU can accelerate at most one VM, which matches the requirement for dedicated, exclusive access. GPU partitioning (GPU-P, Windows Server 2025) instead shares one GPU among multiple VMs, RemoteFX vGPU has been removed from Windows Server, and Enhanced Session Mode only improves the VMConnect experience.

The primary purpose of AD sites is twofold: 1) To control the replication topology, ensuring that replication traffic occurs efficiently over potentially slow or costly WAN links. 2) To enable clients to locate the nearest network services, most importantly domain controllers and Global Catalog servers, for authentication and queries. Correctly configured sites ensure clients in a branch office authenticate against a local DC instead of one across a slow WAN link, which directly addresses the user complaints.

Containers share the kernel of the system they run on, so Linux containers can't run directly on the Windows kernel. WSL 2 supplies a genuine Linux kernel that runs inside a lightweight utility VM; on Windows Server 2022 and 2025, wsl --install enables the required optional components, downloads the latest Linux kernel, and installs a distribution, and container engines running in WSL 2 run Linux containers on that kernel. Hyper-V is a hypervisor and doesn't provide a Linux kernel by itself, while Multipath I/O and Network Controller are unrelated to containers.

DFS Replication schedules and bandwidth throttling are configured per replication group, where they apply to all of the group's connections, or per connection, not per replicated folder. To prioritize the critical documents, keep them in a replication group whose schedule replicates at full bandwidth during business hours. Put the ISO files in a separate replication group whose schedule restricts replication to off-hours or throttles its bandwidth. File filters on a replicated folder only exclude matching files from replication, an FSRM file screen would block saving ISO files altogether, and Remote Differential Compression reduces the data sent for changed files but doesn't prioritize one set of folders over another.

Just-in-Time (JIT) VM access, a feature of Microsoft Defender for Cloud, is designed for this exact purpose. It works by locking down inbound traffic to your Azure VMs by default. When a user requests access, JIT evaluates the request against RBAC permissions and, if approved, configures the Network Security Group (NSG) to allow inbound traffic to the selected ports from the user's IP address for a specified amount of time. After the time expires, the NSG rules are restored, blocking access again.

Members of the 'Group Policy Creator Owners' group have permissions to create new GPOs in the domain. However, this group does not have permissions to link GPOs to any site, domain, or OU. Linking a GPO requires write permissions on the gPLink attribute of the target container (in this case, the 'Workstations' OU), which is typically held by Domain Admins or OU administrators. Therefore, the administrator can successfully create the GPO but will receive an 'Access Denied' error when attempting to link it.