View Full Microsoft AZ-801 Exam Dumps and Practice Test Dumps

 

Question 321. Which Active Directory role controls updates to the domain naming information in a forest?

1. RID Master
2. PDC Emulator
3. Infrastructure Master
4. Domain Naming Master

Correct Answer: 4. Domain Naming Master

Explanation:

The Domain Naming Master is one of the five Flexible Single Master Operations roles in Active Directory. It is responsible for controlling changes to the domain namespace within an Active Directory forest, including adding or removing domains and application partitions when appropriate. Because domain naming operations affect the forest structure, this role helps ensure that conflicting changes are not made simultaneously by different domain controllers. The RID Master is responsible for allocating relative identifier pools, the PDC Emulator performs several important authentication and time-related functions, and the Infrastructure Master manages certain cross-domain object references. Therefore, the Domain Naming Master is the correct role for controlling forest domain naming changes.

Question 322. Which FSMO role allocates pools of relative IDs to domain controllers?

1. RID Master
2. Schema Master
3. Domain Naming Master
4. PDC Emulator

Correct Answer: 1. RID Master

Explanation:

The Relative ID, or RID, Master is responsible for allocating blocks of relative identifiers to domain controllers within a domain. When security principals such as users, computers, and groups are created, their security identifiers include a domain identifier and a unique RID. Domain controllers receive pools of RIDs from the RID Master so they can create security principals without requesting a new identifier for every object. The Schema Master manages forest-wide schema changes, the Domain Naming Master manages domain namespace changes, and the PDC Emulator performs several authentication, password, and time-related functions. Therefore, the RID Master is responsible for distributing RID pools.

Question 323. Which FSMO role is primarily responsible for forest-wide Active Directory schema changes?

1. Infrastructure Master
2. Schema Master
3. RID Master
4. PDC Emulator

Correct Answer: 2. Schema Master

Explanation:

The Schema Master is the FSMO role responsible for controlling changes to the Active Directory schema throughout the forest. The schema defines the classes of objects that can exist in Active Directory and the attributes associated with those objects. Applications that extend Active Directory, such as certain directory-aware enterprise products, may require schema modifications during installation. Because schema changes affect every domain in the forest, they are controlled through a single designated Schema Master. The RID Master handles identifier allocation, the Infrastructure Master manages certain cross-domain references, and the PDC Emulator handles several domain-level authentication and time functions. Therefore, Schema Master is the correct FSMO role.

Question 324. A read-only domain controller must be deployed at a remote branch office. Which feature helps protect credentials stored on the RODC?

1. Password Replication Policy
2. DHCP Reservation
3. DNS Forwarding
4. SMB Encryption

Correct Answer: 1. Password Replication Policy

Explanation:

Password Replication Policy, or PRP, controls which user and computer credentials are permitted to be cached on a Read-Only Domain Controller. This is especially important for branch-office deployments where physical security may be less controlled than in a central data center. Administrators can define accounts that are allowed or denied from being cached on the RODC. Limiting cached credentials can reduce the potential impact if the RODC is compromised. DHCP reservations provide predictable IP addresses, DNS forwarding directs DNS queries to another server, and SMB encryption protects file-sharing traffic. Therefore, Password Replication Policy is the feature used to control credential caching on an RODC.

Question 325. Which Active Directory feature allows a domain controller to be placed in a specific geographic network location?

1. Group Policy
2. AD Sites and Services
3. DNS Scavenging
4. FSRM

Correct Answer: 2. AD Sites and Services

Explanation:

Active Directory Sites and Services allows administrators to represent the physical and network topology of an organization within Active Directory. Sites generally correspond to locations or well-connected network segments and can contain subnets, domain controllers, and site links. Proper site configuration helps clients locate suitable domain controllers and helps Active Directory optimize replication traffic between locations. Group Policy manages configuration settings, DNS scavenging removes stale DNS records, and FSRM manages file-server storage policies. Therefore, when an administrator needs to associate domain controllers and network subnets with geographic or network locations, AD Sites and Services provides the required functionality.

Question 326. Which Active Directory object represents a network range associated with an AD site?

1. Site link
2. Domain
3. Subnet
4. OU

Correct Answer: 3. Subnet

Explanation:

In Active Directory Sites and Services, a subnet object represents an IP network range and can be associated with an Active Directory site. This association allows domain-joined computers to determine which AD site they belong to based on their IP address. Correct subnet configuration helps clients locate appropriate domain controllers and can influence authentication and replication behavior. A site link defines a logical connection between sites, a domain represents an administrative and directory boundary, and an OU is primarily used to organize objects and apply delegated administration or Group Policy. Therefore, the subnet object is the appropriate Active Directory object for representing a network range associated with an AD site.

Question 327. Which Active Directory feature allows administrators to specify the preferred domain controller for authentication based on network topology?

1. AD Sites and Services
2. FSRM
3. DHCP Failover
4. Storage Replica

Correct Answer: 1. AD Sites and Services

Explanation:

Active Directory Sites and Services helps domain clients identify domain controllers that are close to their network location. Administrators associate IP subnets with sites and place domain controllers into the corresponding sites. Active Directory can then use site information when locating domain controllers and selecting appropriate replication paths. This reduces unnecessary authentication traffic across slower WAN connections and helps optimize directory operations in geographically distributed environments. FSRM manages file-server policies, DHCP Failover provides DHCP service redundancy, and Storage Replica replicates storage volumes. Therefore, when the requirement involves selecting suitable domain controllers according to network topology, AD Sites and Services provides the necessary configuration framework.

Question 328. Which DNS feature forwards queries for a specific domain to designated DNS servers?

1. Root hints
2. Conditional forwarder
3. Stub zone
4. DNS scavenging

Correct Answer: 2. Conditional forwarder

Explanation:

A conditional forwarder allows a DNS server to forward queries for a specific DNS namespace to designated DNS servers. This is useful when organizations maintain multiple DNS namespaces or need one DNS infrastructure to resolve names from another organization or environment. Instead of forwarding all unresolved queries to the same external servers, administrators can define specific forwarding rules based on domain names. Root hints are used to help locate authoritative DNS servers for external namespaces, while stub zones contain information about authoritative name servers for a zone. DNS scavenging removes stale records. Therefore, a conditional forwarder is the appropriate feature for forwarding queries for a particular domain to specified DNS servers.

Question 329. Which DNS zone type contains only the records needed to identify authoritative DNS servers for another zone?

1. Primary zone
2. Secondary zone
3. Stub zone
4. Reverse lookup zone

Correct Answer: 3. Stub zone

Explanation:

A stub zone contains a limited set of DNS records that identify the authoritative name servers for another DNS zone. It does not contain the complete set of resource records for the destination zone. Instead, it maintains records such as the Start of Authority and name server information so that queries can be directed toward authoritative DNS servers. This can help organizations maintain accurate knowledge of where authoritative DNS information is hosted. A primary zone contains authoritative zone data, a secondary zone maintains a read-only copy of a zone, and a reverse lookup zone supports IP-to-name resolution. Therefore, a stub zone is the appropriate choice for maintaining authoritative server information.

Question 330. Which Group Policy setting can prevent users from applying a specific GPO to a selected security group?

1. Security filtering
2. Loopback processing
3. WMI filtering
4. Block Inheritance

Correct Answer: 1. Security filtering

Explanation:

Security filtering controls which users, computers, or security groups are permitted to apply a Group Policy Object. By modifying the security permissions associated with a GPO, administrators can restrict policy application to specific security principals. This is useful when a policy should apply to only a subset of users or computers within an OU or domain. Loopback processing changes how user settings are processed based on the computer they sign in to, WMI filtering applies policies according to WMI query results, and Block Inheritance affects whether policies from parent containers are inherited. Therefore, security filtering is the appropriate mechanism for controlling GPO application to selected security groups.

Question 331. Which Group Policy feature applies user configuration settings according to the computer where the user signs in?

1. Security filtering
2. Loopback processing
3. WMI filtering
4. Delegation

Correct Answer: 2. Loopback processing

Explanation:

Group Policy loopback processing allows administrators to apply user configuration settings based on the computer where the user logs on rather than relying only on the user’s normal OU location. This is useful for scenarios such as shared computers, kiosk systems, terminal servers, classrooms, and other environments where users should receive different settings depending on the computer being used. Loopback can operate in Merge or Replace mode depending on the desired policy-processing behavior. Security filtering controls which security principals can apply a GPO, WMI filtering evaluates system information, and delegation controls administrative permissions. Therefore, loopback processing is the feature designed for computer-based user policy application.

Question 332. Which Group Policy feature uses a WMI query to determine whether a GPO should apply?

1. Loopback processing
2. Security filtering
3. WMI filtering
4. Block Inheritance

Correct Answer: 3. WMI filtering

Explanation:

WMI filtering allows administrators to associate a WMI query with a Group Policy Object so that the GPO is applied only when the target computer meets the specified conditions. For example, administrators can create a query based on operating-system version, hardware characteristics, or other information exposed through Windows Management Instrumentation. This provides more granular targeting than simply linking a GPO to an OU. Security filtering controls access based on security principals, loopback changes user-policy processing based on the computer, and Block Inheritance controls policy inheritance from parent containers. Therefore, WMI filtering is the correct feature when policy application depends on a system characteristic returned by a WMI query.

Question 333. Which SMB security feature helps ensure that SMB messages have not been altered in transit?

1. SMB Signing
2. SMB Compression
3. SMB Direct
4. SMB Witness

Correct Answer: 1. SMB Signing

Explanation:

SMB Signing helps protect the integrity of SMB communications by attaching a digital signature to SMB messages. The receiving system can use the signature to verify that the message originated from the expected source and was not modified during transmission. This is different from SMB encryption, which is intended to protect the confidentiality of data transmitted through SMB. SMB Compression reduces the amount of data transferred, SMB Direct provides high-performance SMB communication using supported RDMA networking, and SMB Witness supports availability-related client notifications in clustered environments. Therefore, when the primary requirement is protection against modification of SMB messages during transit, SMB Signing is the appropriate feature.

Question 334. Which SMB feature protects file-sharing traffic from unauthorized network inspection?

1. SMB Signing
2. SMB Encryption
3. SMB Compression
4. SMB Witness

Correct Answer: 2. SMB Encryption

Explanation:

SMB Encryption protects the confidentiality of SMB traffic by encrypting data transmitted between SMB clients and servers. This is particularly useful when file-sharing communication crosses networks where administrators need to reduce the risk of unauthorized parties inspecting the contents of the traffic. SMB Signing serves a different purpose by helping protect message integrity and authentication. SMB Compression reduces network bandwidth consumption for compressible data, while SMB Witness supports availability and failover-related communication in suitable clustered environments. Therefore, when the requirement is to prevent unauthorized inspection of SMB file-sharing traffic, SMB Encryption is the appropriate security feature.

Question 335. Which Windows Server feature provides a centralized location for managing file-server quotas and file-screening policies?

1. Windows Admin Center
2. DHCP
3. File Server Resource Manager
4. DNS Manager

Correct Answer: 3. File Server Resource Manager

Explanation:

File Server Resource Manager, or FSRM, provides administrators with tools for controlling and monitoring storage usage on Windows file servers. It includes Quota Management for limiting storage consumption, File Screening Management for controlling prohibited file types, Storage Reports Management for generating usage reports, and classification capabilities for identifying files according to configured properties. Windows Admin Center can provide a broader management interface for Windows Server, but FSRM specifically provides the file-server policy functions described in the question. DHCP manages IP configuration, while DNS Manager manages DNS infrastructure. Therefore, FSRM is the Windows Server component designed to centrally manage file-server quotas and file-screening policies.

Question 336. Which Windows Server feature removes duplicate blocks of data to reduce storage consumption?

1. Storage Replica
2. Data Deduplication
3. DFS Namespace
4. FSRM

Correct Answer: 2. Data Deduplication

Explanation:

Windows Server Data Deduplication reduces storage consumption by identifying and removing redundant copies of data while preserving the logical files that users and applications access. Instead of storing identical blocks repeatedly, the system can retain a single copy and reference it from multiple locations. This can be especially beneficial on file servers containing many similar files or workloads with significant redundant data. Storage Replica creates replicated copies of volumes, DFS Namespace provides a logical namespace for distributed shares, and FSRM manages file-server policies. Therefore, Data Deduplication is the Windows Server technology specifically designed to reduce storage requirements by eliminating redundant data blocks.

Question 337. Which Windows Server backup component protects Active Directory and other critical operating-system configuration information?

1. System State
2. File History
3. Storage Replica
4. Data Deduplication

Correct Answer: 1. System State

Explanation:

A System State backup contains critical operating-system components required for recovering important Windows Server configuration information. On a domain controller, this includes Active Directory Domain Services database information, SYSVOL, the registry, and other system components required for directory-service recovery. System State backup is therefore an important part of an Active Directory disaster-recovery strategy. It is different from a normal file backup because its purpose is to protect operating-system and directory-service configuration data rather than simply user documents. Storage Replica replicates volumes, Data Deduplication reduces redundant storage, and File History is designed primarily for user-file protection. Therefore, System State is the appropriate backup component for critical Active Directory and system configuration data.

Question 338. Which PowerShell command executes a command remotely on one or more Windows computers?

1. Enter-PSSession
2. Invoke-Command
3. Get-Service
4. Get-Process

Correct Answer: 2. Invoke-Command

Explanation:

Invoke-Command is a PowerShell cmdlet used to execute commands or scripts on remote computers. It can target one or multiple systems and is particularly useful for centralized administration and automation. Administrators can specify computer names and execute commands remotely through PowerShell remoting, assuming the appropriate remoting configuration and permissions are available. Enter-PSSession instead creates an interactive remote PowerShell session where commands are entered directly against a remote computer. Get-Service retrieves service information, and Get-Process retrieves process information. Therefore, when the requirement is to run a command remotely against one or more Windows computers, Invoke-Command is the appropriate PowerShell cmdlet.

Question 339. Which PowerShell technology allows administrators to define the desired configuration state of Windows servers?

1. PowerShell DSC
2. Robocopy
3. Diskpart
4. Nslookup

Correct Answer: 1. PowerShell DSC

Explanation:

PowerShell Desired State Configuration, or DSC, is a declarative configuration-management technology that allows administrators to define how systems should be configured. Instead of manually performing every configuration task, administrators can describe the desired state, such as required Windows features, services, files, registry settings, or application configuration. DSC can then help bring supported systems into compliance with that defined state. This approach can improve consistency and reduce configuration drift across multiple servers. Robocopy is primarily a file-copy utility, Diskpart manages storage partitions, and Nslookup performs DNS queries. Therefore, PowerShell DSC is the technology intended for defining and maintaining desired Windows Server configuration states.

Question 340. Which Windows Server migration component inventories servers before a file-server migration?

1. Storage Replica
2. Storage Spaces Direct
3. Storage Migration Service
4. Data Deduplication

Correct Answer: 3. Storage Migration Service

Explanation:

Storage Migration Service helps administrators migrate file servers and their associated data, shares, and configuration information to newer Windows Server systems or supported Azure environments. A migration workflow can include discovering and inventorying the source server, transferring data and configuration, and performing a coordinated cutover to the destination system. Inventory information helps administrators understand the source environment before migration begins and identify the resources that need to be transferred. Storage Replica provides block-level volume replication, Storage Spaces Direct provides software-defined clustered storage, and Data Deduplication reduces redundant data. Therefore, Storage Migration Service is the appropriate Windows Server component for inventorying and migrating file-server environments.