AZ-801 Sample Questions & Answers

A hospital is migrating its on-premises Hyper-V virtual machines to Azure using Azure Migrate. The migration team has deployed the Azure Migrate appliance and completed the discovery and assessment phase. They are now ready to begin replication. Due to HIPAA compliance, all data must be encrypted in transit from the on-premises datacenter to Azure. Which statement about encryption during the Azure Migrate replication process is true?

An IT administrator is managing a Windows Server failover cluster and needs to apply monthly Windows security updates to all cluster nodes with minimal downtime for the clustered roles. The administrator wants to automate this process. Which TWO of the following solutions are the most appropriate for this task? (Select TWO).

Case Study: Quantum Health Systems Hybrid Infrastructure Security Hardening

Company Background:
Quantum Health Systems (QHS) is a large healthcare provider subject to strict HIPAA regulations. They operate a hybrid environment with a significant on-premises footprint of Windows Server 2016 and 2019 servers, and a growing number of Windows Server 2022 VMs in Azure. Their on-premises Active Directory domain, qhs.local, is synchronized with a Microsoft Entra ID tenant using Azure AD Connect.

Current Situation:
A recent security audit revealed several vulnerabilities. The primary concern is the potential for pass-the-hash and other credential theft attacks against privileged accounts. The audit also highlighted inconsistent security baselines across the server fleet and a lack of visibility into advanced threats targeting Active Directory. On-premises servers are not currently managed or monitored directly from Azure, except for identity synchronization.

Technical Requirements:

1. Implement a solution to isolate Local Security Authority Subsystem Service (LSASS) processes for privileged accounts to prevent credential dumping. This solution must be hardware-assisted.
2. Onboard all on-premises servers to Azure for centralized security management and threat detection without deploying new gateway servers.
3. Deploy a cloud-native service to detect and investigate advanced attacks and malicious insider activities directed at the on-premises AD DS controllers.
4. Enforce a consistent, Microsoft-recommended security baseline across all servers, both on-premises and in Azure, and report on compliance.

Goal:
Select the optimal combination of Microsoft technologies to meet all four technical requirements for hardening the QHS hybrid environment.

A financial firm is migrating its on-premises Internet Information Services (IIS) web applications to Azure. The primary goal is to move to a Platform-as-a-Service (PaaS) offering to reduce infrastructure management overhead. The applications are a mix of ASP.NET and ASP.NET Core. The migration team needs to perform an initial assessment to determine compatibility with Azure App Service and get migration recommendations. Which tool is specifically designed for this purpose?

An administrator is managing a two-node Hyper-V failover cluster running on Windows Server 2022. Both nodes are part of a Storage Spaces Direct (S2D) configuration. Node1 unexpectedly crashes and will not reboot. The administrator needs to recover the cluster to a healthy state by replacing the failed node. What is the correct high-level sequence of steps to replace Node1?

A systems administrator is reviewing the performance of a file server using Performance Monitor. They notice that the '% Idle Time' counter for the physical disk hosting the user data is consistently below 10%, and the 'Avg. Disk Queue Length' is frequently spiking above 3. What is the most likely issue affecting the server?

You are tasked with hardening a fleet of Windows Server 2022 machines. A key requirement is to prevent unauthorized code execution. You decide to implement Windows Defender Application Control (WDAC). You create a baseline policy in audit mode to gather information about applications running in the environment. After a week, you analyze the logs and are ready to create an enforcement policy. Which PowerShell cmdlet is used to finalize one or more WDAC policy XML files into a single binary file that can be deployed?

A retail company is planning to migrate its entire Active Directory infrastructure from a Windows Server 2012 R2 forest to a new, clean Windows Server 2022 forest. The project requires migrating all user accounts, security groups (including memberships), and computer accounts. The team will use the Active Directory Migration Tool (ADMT). What is a critical dependency that must be established between the source and target forests for ADMT to function correctly and migrate security principals with their SID history?

A hybrid cloud engineer is configuring Hyper-V Replica between a primary site and a disaster recovery site for a critical virtual machine. The engineer needs to ensure that if a disaster occurs, the failover process is as fast as possible and maintains application consistency. The VM is running a VSS-aware application like SQL Server. Which Hyper-V Replica setting should be configured to meet these requirements?

A consultant is deploying Network ATC on a new four-node Azure Stack HCI cluster to simplify host networking configuration. The goal is to configure the physical network adapters for both management and compute traffic using a single intent. The adapters are named 'pNIC1' and 'pNIC2' on all nodes. Which of the following is the correct PowerShell command to create a network intent that uses both adapters for management and compute workloads?