AZ-801試験無料問題集「Microsoft Configuring Windows Server Hybrid Advanced Services 認定」
You have a Windows Server failover cluster named Cluster1 that has a cloud witness and the nodes shown in the following table.
Cluster1 has the roles shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Exhibit
Exhibit
Cluster1 has the roles shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Exhibit
Exhibit
正解：
Explanation:
Detailed Explanation
FS1 (File Server for general use) can run on any node that has the File Server role installed; Node4 has that role, so even though its cluster vote has been administratively set to 0 for quorum purposes, it remains a valid failover target and FS1 moves to it automatically when Node3 fails. DFS1 (DFS Namespace Server) in this deployment is hosted within the Site1 fault domain (Node1 and Node2), so when it is running on Node2 and Node2 fails, it does not automatically extend its ownership across the fault domain boundary to Node3 in Site2. Because Site1 remains intact and, together with the cloud witness, continues to hold cluster quorum, DFS1 stays available on Site1 even if the entire Site2 fault domain (Node3 and Node4) goes offline.
Official Reference
Configure cluster fault domain awareness (sites) - https://learn.microsoft.com/en-us/windows-server
/failover-clustering/manage-affinity-fault-domains
You have an Azure virtual machine named VM1 that runs Windows Server. You need to perform the following tasks on VM1:
* Configure Windows Defender Firewall to allow Remote Desktop connections.
* Configure where to store the logs of the virtual machine console.
Which two settings should you use? To answer, select the settings in the answer area. NOTE: Each correct selection is worth one point.
* Configure Windows Defender Firewall to allow Remote Desktop connections.
* Configure where to store the logs of the virtual machine console.
Which two settings should you use? To answer, select the settings in the answer area. NOTE: Each correct selection is worth one point.
正解：
Explanation:
CORRECTED ANSWER: Configure Windows Defender Firewall to allow RDP: Serial console. Configure where to store the logs of the virtual machine console: Boot diagnostics.
Detailed Explanation
When RDP access to an Azure VM is blocked because of a Windows Defender Firewall misconfiguration, the Serial console blade gives out-of-band access to the Windows Special Administration Console (SAC), from which an administrator can run netsh advfirewall commands to re-enable the Remote Desktop firewall rule without needing network connectivity to the VM. The location where the serial console output (and boot screenshots) are written to a storage account is configured on the Boot diagnostics blade, not the general- purpose Diagnostic settings blade, which instead routes platform metrics/logs to destinations like Log Analytics or Event Hubs and has no role in specifying storage for the VM ' s console log.
Official Reference
Azure boot diagnostics - https://learn.microsoft.com/en-us/azure/virtual-machines/boot-diagnostics
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant.
The AD DS domain contains a domain controller named DC1. DC1 does NOT have internet access.
You need to configure password security for on-premises users. The solution must meet the following requirements:
* Prevent the users from using known weak passwords.
* Prevent the users from using the company name in passwords.
What should you do? To answer, drag the appropriate configurations to the correct targets. Each configuration may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Exhibit
Exhibit
The AD DS domain contains a domain controller named DC1. DC1 does NOT have internet access.
You need to configure password security for on-premises users. The solution must meet the following requirements:
* Prevent the users from using known weak passwords.
* Prevent the users from using the company name in passwords.
What should you do? To answer, drag the appropriate configurations to the correct targets. Each configuration may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Exhibit
Exhibit
正解：
Explanation:
Detailed Explanation
Azure AD (Microsoft Entra) Password Protection uses a distributed on-premises architecture in which the DC agent service runs on every domain controller to evaluate password changes against the banned-password list, while a separate proxy service runs on a domain-joined member server (not a domain controller) and relays policy download requests from the DC agent to Microsoft Entra ID over the internet. Because DC1 has no internet access, this design lets DC1 obtain the banned-password list indirectly through the proxy, and both the global and any custom banned-password lists are defined centrally in the Azure AD / Microsoft Entra portal in the cloud. This meets both requirements of blocking known weak passwords and organization- specific terms like the company name without requiring internet connectivity on the domain controller itself.
Official Reference
Configure Microsoft Entra Password Protection on-premises - https://learn.microsoft.com/en-us/entra
/identity/authentication/concept-password-ban-bad-on-premises
You have a failover cluster named Cluster1 that has the following configurations:
* Number of nodes: 6
* Quorum: Dynamic quorum
* Witness: File share, Dynamic witness
What is the maximum number of nodes that can fail simultaneously while maintaining quorum?
* Number of nodes: 6
* Quorum: Dynamic quorum
* Witness: File share, Dynamic witness
What is the maximum number of nodes that can fail simultaneously while maintaining quorum?
正解：E
解答を投票する
解説: (GoShiken メンバーにのみ表示されます)
Your network contains an on-premises Active Directory Domain Services (AD DS) domain.
The domain contains the servers shown in the following table.
Server1 has the connection security rule as shown in the Server1 exhibit. (Click the Server1 tab.) Server2 has the connection security rule as shown in the Server2 exhibit. (Click the Server2 tab.) Server1 has the inbound firewall rules as shown in the Server1 inbound rules exhibit. (Click the Server1 inbound rules tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Exhibit
Exhibit
Exhibit
Exhibit
Exhibit
The domain contains the servers shown in the following table.
Server1 has the connection security rule as shown in the Server1 exhibit. (Click the Server1 tab.) Server2 has the connection security rule as shown in the Server2 exhibit. (Click the Server2 tab.) Server1 has the inbound firewall rules as shown in the Server1 inbound rules exhibit. (Click the Server1 inbound rules tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Exhibit
Exhibit
Exhibit
Exhibit
Exhibit
正解：
Explanation:
Detailed Explanation
Server1 ' s connection security rule requires inbound and outbound authentication using Computer (Kerberos V5) for the Domain profile, and its inbound firewall rules for File and Printer Sharing, including ICMPv4
/ICMPv6 Echo Request and SMB-In, are all enabled and set to allow. Because Server2 has an identical connection security rule using the same Computer (Kerberos V5) authentication, both servers can successfully negotiate the required IPsec security association, so Server2 can both ping Server1 and reach its file shares over SMB. Server3, which has no matching connection security rule in this scenario, cannot complete the mandatory IPsec authentication that Server1 ' s rule demands for all inbound and outbound traffic, so it is unable to connect to a file share on Server1 even though the underlying firewall rules would otherwise allow SMB traffic.
Official Reference
Create an authentication request rule (connection security rules) - https://learn.microsoft.com/en-us
/windows-server/security/windows-firewall/create-an-authentication-request-rule
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant by using password hash synchronization.
You have a Microsoft 365 subscription.
All devices are hybrid Azure AD-joined.
Users report that they must enter their password manually when accessing Microsoft 365 applications.
You need to reduce the number of times the users are prompted for their password when they access Microsoft 365 and Azure services.
What should you do?
You have a Microsoft 365 subscription.
All devices are hybrid Azure AD-joined.
Users report that they must enter their password manually when accessing Microsoft 365 applications.
You need to reduce the number of times the users are prompted for their password when they access Microsoft 365 and Azure services.
What should you do?
正解：B
解答を投票する
解説: (GoShiken メンバーにのみ表示されます)
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains the domains shown in the following table.
You are implementing Microsoft Defender for Identity sensors.
You need to install the sensors on the minimum number of domain controllers. The solution must ensure that Defender for Identity will detect all the security risks in both the domains.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Exhibit
Exhibit
Exhibit
You are implementing Microsoft Defender for Identity sensors.
You need to install the sensors on the minimum number of domain controllers. The solution must ensure that Defender for Identity will detect all the security risks in both the domains.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Exhibit
Exhibit
Exhibit
正解：
Explanation:
Detailed Explanation
Microsoft Defender for Identity sensors capture and analyze authentication and directory traffic locally on each domain controller, so full coverage of both the fabrikam.com and eu.fabrikam.com domains, including detection of risks that touch the read-only domain controllers, requires a sensor on every domain controller in the forest - DC1 through DC6 - rather than only the PDC emulators or infrastructure masters. During installation, each sensor is registered to the Defender for Identity workspace using the one-time access key that is generated and copied from the Microsoft Defender portal; after this initial registration, subsequent sensor-to-cloud communication is secured using certificates rather than the access key or an Azure AD account.
Official Reference
Deploy Microsoft Defender for Identity sensors - https://learn.microsoft.com/en-us/defender-for-identity/deploy/deploy-defender-identity
Your network contains an Active Directory Domain Services (AD DS) forest.
You need to deploy a Storage Spaces Direct converged infrastructure. The solution must meet the following requirements:
* Use an Ethernet fabric
* Eliminate the need for Data Center Bridging (DCB).
Which Remote Direct Memory Access (RDMA) networking technology should you implement?
You need to deploy a Storage Spaces Direct converged infrastructure. The solution must meet the following requirements:
* Use an Ethernet fabric
* Eliminate the need for Data Center Bridging (DCB).
Which Remote Direct Memory Access (RDMA) networking technology should you implement?
正解：B
解答を投票する
解説: (GoShiken メンバーにのみ表示されます)
You have an Azure subscription that contains a user named User! and the resources shown in the following table.
Used has a computer named Computed that runs Windows 11. User1 works from home and establishes a Point-to-Site (P2S) connection to GW1 to access AppSvr1.
You deploy the resources shown in the following table.
User1 cannot access AppSvr2.
You need to ensure that User1 can access AppSvr2.
What should you do?
Exhibit
Exhibit
Used has a computer named Computed that runs Windows 11. User1 works from home and establishes a Point-to-Site (P2S) connection to GW1 to access AppSvr1.
You deploy the resources shown in the following table.
User1 cannot access AppSvr2.
You need to ensure that User1 can access AppSvr2.
What should you do?
Exhibit
Exhibit
正解：D
解答を投票する
解説: (GoShiken メンバーにのみ表示されます)
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains domain controllers that run Windows Server 2016.
Vou build a new AD DS forest named nwtraders.com. The forest contains domain controllers that run Windows Server 2025.
You plan to perform a phased migration from contoso.com to nwtraders.com.
You perform the following actions:
* Migrate the users in contoso.com to nwtraders.com and enable slDHistory.
* Establish a two-way forest trust between contoso.com and nwtraders.com.
* Install the Active Directory Migration Tool (ADMT) in nwtraders.com.
Exhibit
Exhibit
Vou build a new AD DS forest named nwtraders.com. The forest contains domain controllers that run Windows Server 2025.
You plan to perform a phased migration from contoso.com to nwtraders.com.
You perform the following actions:
* Migrate the users in contoso.com to nwtraders.com and enable slDHistory.
* Establish a two-way forest trust between contoso.com and nwtraders.com.
* Install the Active Directory Migration Tool (ADMT) in nwtraders.com.
Exhibit
Exhibit
正解：
Explanation:
Detailed Explanation
Because sIDHistory was enabled during the migration, each migrated user ' s original contoso.com SID is preserved and carried into nwtraders.com, so existing access control entries on contoso.com resources continue to resolve correctly without requiring any permissions to be updated. ADMT supports migrating user passwords into the target domain through the Password Export Server (PES) component, so once password migration is configured, migrated users are able to sign in to nwtraders.com using the same password they used in contoso.com. ADMT is a directory-object migration tool and does not migrate local user profile data at all, so no particular source-domain controller OS version, let alone Windows Server 2025, is required for that unrelated task.
Official Reference
Background information for restructuring Active Directory domains between forests - https://learn.microsoft.
com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc739494(v=ws.10)
