AZ-801 Practice Test

Question 26

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains three servers named Server1, Server2, and Server3 that run Windows Server. All the servers are on the same network and have network connectivity. On Server1, Windows Defender Firewall has a connection security rule that has the following settings: • Rule Type: Server-to-server • Endpoint 1: Any IP address • Endpoint 2: Any IP address • Requirements: Require authentication for inbound connections and request authentication for outbound connections • Authentication Method: Computer (Kerberos V5) • Profile: Domain, Private, Public • Name: Rule1 Server2 has no connection security rules. On Server3, Windows Defender Firewall has a connection security rule that has the following settings: • Rule Type: Server-to-server • Endpoint 1: Any IP address • Endpoint 2: Any IP address • Requirements: Request authentication for inbound and outbound connections • Authentication Method: Computer (Kerberos V5) • Profile: Domain, Private, Public • Name: Rule1 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 27

Your network contains an Active Directory Domain Services (AD DS) forest. The forest functional level is Windows Server 2012 R2. The forest contains the domains shown in the following table. You create a user named Admin1. You need to ensure that Admin1 can add a new domain controller that runs Windows Server 2022 to the east.contoso.com domain. The solution must follow the principle of least privilege. To which groups should you add Admin1?

1. EAST\Domain Admins only
2. CONTOSO\Enterprise Admins only
3. CONTOSO\Schema Admins and EAST\Domain Admins
4. CONTOSO\Enterprise Admins and CONTOSO\Schema Admins

Question 28

You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains the resources shown in the following table. Sub1 has Microsoft Defender for Servers enabled. You are assigned the Contributor role for Sub1. You need to implement just-in-time (JIT) VM access for VM1. What should you do first?

1. Create a network security group (NSG).
2. Enable enhanced security in Microsoft Defender for Cloud.
3. Request the Owner role for Sub1.
4. Create an application security group.

Question 29

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains an organizational unit (OU) named OU1. OU1 contains servers that run sensitive workloads. You plan to add connection security rules that meet the following requirements: • The servers in OU1 must only accept connections from domain-joined • The servers in OU1 must only be able to communicate with domain-joined You create a Group Policy Object (GPO) named GPO1 and link GPO1 to contoso.com. You need to configure a connection security rule in GPO1 by using Windows Defender Firewall with Advanced Security. How should you configure the rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 30

You have a Windows Server 2022 failover cluster named Cluster that contains the Cluster Shared Volumes (CSV) shown in the following table. All the nodes in Cluster1 have BitLocker Drive Encryption (BitLocker) installed. You need to use PowerShell to enable BitLocker on Volume1. In which order should you run the commands? To answer, drag the appropriate commands to the correct order. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.