Free AZ-800 sample questions

Correct answer: Production Checkpoint

Production checkpoints use the Volume Shadow Copy Service (VSS) inside a Windows guest (File System Freeze on Linux) to create a data-consistent, application-consistent point-in-time image of the VM without capturing memory state, which is appropriate for production workloads and backup scenarios. Standard checkpoints capture the VM's disks together with its memory state, so applications are restored mid-operation; they're intended for development and test and aren't application-consistent. Production is the default checkpoint type (Set-VM -CheckpointType Production, ProductionOnly, Standard, or Disabled). 'Recovery' checkpoints are created internally by backup applications such as DPM rather than chosen by the administrator, and 'Application-Aware Checkpoint' isn't a Hyper-V checkpoint type.

Correct answer: A three-way mirror space.

For a performance-sensitive database workload that must survive two simultaneous drive failures, use a three-way mirror space. Microsoft recommends mirroring for all workloads and parity for sequential workloads such as archival. A three-way mirror keeps three copies of the data, tolerates two drive failures, and requires at least five physical disks (twelve are available). Mirror-accelerated parity combines mirror and parity in one ReFS volume, but in Windows Server it's supported only on Storage Spaces Direct and recommended only for archival and backup workloads. Dual parity also tolerates two failures but has much lower random-write performance, and a simple space has no resiliency.

Correct answer: `Test-NetConnection -ComputerName -Port 53`

The first step in troubleshooting a conditional forwarder is to verify network connectivity from the on-premises DNS server to the target resolver on the required port. The `Test-NetConnection` cmdlet is the correct tool for this. It will confirm whether the on-premises DNS server can reach the Azure DNS Private Resolver over port 53 (DNS). If this test fails, the issue is likely a firewall rule, a network security group (NSG) in Azure, or a routing problem over the VPN/ExpressRoute connection.

Correct answer: Microsoft Entra Application Proxy

Microsoft Entra application proxy publishes on-premises web applications to remote users without a VPN. Users are pre-authenticated by Microsoft Entra ID, so Conditional Access policies such as MFA apply even when the back-end application doesn't support modern authentication; the private network connector installed on-premises makes only outbound connections and forwards requests to the app, which can use integrated Windows authentication through Kerberos constrained delegation. A point-to-site VPN would give the doctors' devices network-level access, Azure Bastion is for RDP/SSH to Azure VMs, and WAP with AD FS doesn't use Microsoft Entra ID as the identity provider.

Correct answer: VisibleCmdlets

In a JEA role capability file (.psrc), the `VisibleCmdlets` field lists the PowerShell cmdlets that users can run in the JEA session (optionally restricting their parameters and values). To allow starting, stopping, and restarting VMs, you would list `Start-VM`, `Stop-VM`, and `Restart-VM` in this field. `VisibleExternalCommands` is for executables and scripts outside PowerShell, `RoleDefinitions` belongs in the session configuration file (.pssc) where it maps users to role capabilities, and `AllowedCommandlets` isn't a valid field.

Correct answer: True

This statement is true. The Storage Sync Service and the Azure file share it syncs with must be in the same Azure region. While the on-premises servers (server endpoints) can be anywhere in the world, the Azure resources must be co-located in the same region for the sync group to be created.

Correct answer: Azure Policy with a Guest Configuration policy assignment.

Azure Policy's Guest Configuration feature is the ideal solution. You can create a custom Desired State Configuration (DSC) that defines the required state (antivirus service running). This configuration is then packaged and applied via an Azure Policy initiative. The policy can be set to not only audit for compliance but also to deploy a remediation task that automatically starts the service if it's found to be stopped. This provides a scalable, declarative way to enforce and remediate configuration drift across all Arc-enabled servers.

Correct answer: Discrete Device Assignment (DDA)

Discrete Device Assignment (DDA) passes an entire PCIe device, such as a GPU, through to a single virtual machine: the device is dismounted from the host by its PCI location path and assigned to the VM, which then uses the native driver with full access to the GPU. Each physical GPU can accelerate at most one VM, which matches the requirement for dedicated, exclusive access. GPU partitioning (GPU-P, Windows Server 2025) instead shares one GPU among multiple VMs, RemoteFX vGPU has been removed from Windows Server, and Enhanced Session Mode only improves the VMConnect experience.

Correct answer: To control and optimize replication traffic and locate the nearest services like domain controllers.

The primary purpose of AD sites is twofold: 1) To control the replication topology, ensuring that replication traffic occurs efficiently over potentially slow or costly WAN links. 2) To enable clients to locate the nearest network services, most importantly domain controllers and Global Catalog servers, for authentication and queries. Correctly configured sites ensure clients in a branch office authenticate against a local DC instead of one across a slow WAN link, which directly addresses the user complaints.

Correct answer: Windows Subsystem for Linux (WSL)

Containers share the kernel of the system they run on, so Linux containers can't run directly on the Windows kernel. WSL 2 supplies a genuine Linux kernel that runs inside a lightweight utility VM; on Windows Server 2022 and 2025, `wsl --install` enables the required optional components, downloads the latest Linux kernel, and installs a distribution, and container engines running in WSL 2 run Linux containers on that kernel. Hyper-V is a hypervisor and doesn't provide a Linux kernel by itself, while Multipath I/O and Network Controller are unrelated to containers.