最新的Microsoft Administering Windows Server Hybrid Core Infrastructure - AZ-800免費考試真題
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the users shown in following table.
You have a workgroup server named Server! that runs Windows Server and contains the local users shown in the following table.
You promote Server1 to the first domain controller in a new child domain named east.contoso.com. Wh ich users can sign in to Server1 locally?
You have a workgroup server named Server! that runs Windows Server and contains the local users shown in the following table.
You promote Server1 to the first domain controller in a new child domain named east.contoso.com. Wh ich users can sign in to Server1 locally?
正確答案: C
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD ) tenant You have several Windows 10 devices that are Azure AD hybrid-joined.
You need to ensure that when users sign in to the devices, they can use Windows Hello for Business.
Which optional feature should you select in Azure AD Connect?
You need to ensure that when users sign in to the devices, they can use Windows Hello for Business.
Which optional feature should you select in Azure AD Connect?
正確答案: D
說明：（僅 Fast2test 成員可見）
You have a Windows Server container host named Server1 and an Azure subscription.
You deploy an Azure container registry named Registry1 to the subscription.
On Server1, you create a container image named image1.
You need to store imager in Registry1.
Which command should you run on Server1 ? To answer, select the appropriate options in the answer area.
NOTE: Each correct selectio n is worth one point.
You deploy an Azure container registry named Registry1 to the subscription.
On Server1, you create a container image named image1.
You need to store imager in Registry1.
Which command should you run on Server1 ? To answer, select the appropriate options in the answer area.
NOTE: Each correct selectio n is worth one point.
正確答案:
Explanation:
In the Administering Windows Server Hybrid Core Infrastructure objectives for managing containers and Azure Container Registry (ACR), the documented workflow to publish a locally built container image to ACR is to use the Docker CLI and push the image to the registry's login server. The guidance states that you first authenticate to the registry, tag the local image with the fully qualified name of the registry, and then push it.
The canonical sequence is:
docker login < registryLoginServer > # docker tag < localImage > < registryLoginServer > / < repo > : < tag >
# docker push < registryLoginServer > / < repo > : < tag > .
Applying this to the scenario: the registry login server is registry1.azurecr.io and the image is image1, so you would tag and then docker push registry1.azurecr.io/image1:latest (or another tag). The push command uploads the image layers to the remote registry so the image is stored in ACR. By contrast, docker pull retrieves images from a registry, export/import deal with container/filesystem archives, and tools like azcopy
/xcopy/git are not used for publishing container images (azcopy/xcopy copy files/blobs; git manages source code, not OCI images). Therefore, the correct command pair for the hotspot is docker push to registry1.
azurecr.io/image1.
You have a Windows Server container host named Server1 that has a single disk.
On Server1, you plan to start the containers shown in the following table.
Which isolation mode can you use for each container? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
On Server1, you plan to start the containers shown in the following table.
Which isolation mode can you use for each container? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
正確答案:
Explanation:
The Administering Windows Server Hybrid Core Infrastructure guidance explains two Windows container isolation modes: process isolation (Windows Server containers) and Hyper-V isolation. With process isolation, containers share the host's kernel , so they run as ordinary processes on the host. With Hyper-V isolation, each container runs inside a lightweight VM with its o wn kernel ; this provides a hard isolation boundary and prevents kernel sharing with other containers. The curriculum further notes that Linux containers on Windows require Hyper-V isolation because they cannot share the Windows kernel.
Applying these rules:
* Container1 "must NOT share a kernel with other containers." The only mode that prevents kernel sharing is Hyper-V isolation, so Container1 must use Hyper-V isolation.
* Container2 is a Linux container. On a Windows Server container host, Linux containers are run via a utility VM and therefore require Hyper-V isolation.
* Container3 is a Windows container that needs a static IP address. The networking modules describe that Windows containers can obtain static IPs when you use supported networks (for example, l2bridge
/transparent) regardless of isolation mode; therefore a Windows workload like a database can run in either process or Hyper-V isolation, depending on the isolation/security you want.
Thus, the correct selections are: Hyper-V isolation only for Container1 and Container2, and Hyper-V isolation or process isolation for Container3.
You have an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.
You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least privilege.
To which group should you add the administrator?
You need to provide an administrator with the ability to manage Group Policy Objects (GPOs). The solution must use the principle of least privilege.
To which group should you add the administrator?
正確答案: B
說明：（僅 Fast2test 成員可見）
You need to implement a name resolution solution that meets the networking require ments. Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point
NOTE: Each correct selection is worth one point
正確答案: A,E
說明：（僅 Fast2test 成員可見）
You have a server named Server1 that runs Windows Server and contains three volumes named C, D, and E.
Files are stored on Server1 as shown in the following table.
For volume D, Data Deduplication is enabled and set to General purpose file server.
You perform the following actions:
* Move File1 to volume D.
* Copy File2 to volume D and name the copy File4.
* Move File3 to volume E
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
Files are stored on Server1 as shown in the following table.
For volume D, Data Deduplication is enabled and set to General purpose file server.
You perform the following actions:
* Move File1 to volume D.
* Copy File2 to volume D and name the copy File4.
* Move File3 to volume E
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
正確答案:
Explanation:
< File1 is deduplicated after the deduplication job runs. - YES
File3 is deduplicated after the deduplication job runs. - NO
File4 is deduplicated after the deduplication job runs. - NO
The Administering Windows Server Hybrid Core Infrastructure materials explain that Data Deduplication operates per-volume and only processes files on volumes where the role is enabled. The guide states that deduplication "is applied only to NTFS/ReFS volumes on which the Data Deduplication role is enabled," and that the General-purpose file server usage type applies default policies for typical data shares. It further specifies the file size limits: "Files smaller than 32 KB are not deduplicated; supported files are 32 KB up to multiple terabytes," and clarifies that optimization jobs process eligible files during scheduled runs.
Applying those rules:
* Volume D has Data Deduplication enabled (General-purpose). After moving File1 (500 KB) from C: to D:, it resides on a deduplicated volume and exceeds the minimum size threshold, so it will be deduplicated by the next optimization job.
* File3 (1 MB) is moved off the deduplicated volume (to E:), and dedup only affects enabled volumes; therefore it will not be deduplicated.
* File4 is a copy of File2 (10 KB) on D:. Because the file is smaller than the 32-KB minimum, it is not deduplicated even though it is on a deduplicated volume.
Thus the correct outcomes are YES for File1, NO for File3, and NO for File4.
You have a Windows Server container host named Server1.
You start the containers on Server1 as shown in the following table.
You need to validate the status of ProcessA and ProcessC.
Where can you verify that ProcessA and ProcessC are in a running state? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You start the containers on Server1 as shown in the following table.
You need to validate the status of ProcessA and ProcessC.
Where can you verify that ProcessA and ProcessC are in a running state? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
正確答案:
Explanation:
* ProcessA : All the containers and Server1
* ProcessB : Container3 and Server1 only
Comprehensive and Detailed Explanation with all Administering Windows Server Hybrid Core Infrastructure documents : = Understand ing the visibility of processes within Windows Server containers depends entirely on the isolation mode used: Windows Server isolation (Process isolation) or Hyper-V isolation . According to official documents for Administering Windows Server Hybrid Core In frastructure, these two modes determine how the container ' s kernel and processes interact with the host system.
* Windows Server Isolation (Process Isolation) : In this mode, containers share the same kernel as the host. Processes running inside the container are essentially standard processes on the host, albeit isolated through namespaces and resource controls. Consequently, a process running in a process- isolated container (like Container1 and Container2 in the exhibit) is visible from the host ' s Task Manag er or Get-Process command, as well as from other containers sharing the same host kernel.
Therefore, ProcessA can be verified as running from All the containers and Server1 .
* Hyper-V Isolation : This mode provides a more secure and isolated environment by ru nning each container inside its own highly optimized virtual machine (utility VM). Because each container has its own private kernel, the host cannot " see " the internal processes of the container, and containers cannot see into each other. Container3 uses Hyper-V isolation. Therefore, ProcessC is only visible to the internal operating system of Container3 and, at a management level, to Server1 (the host). It is invisible to other containers (Container1, 2, and 4) because they are separated by kernel-level boundaries. Thus, you can verify ProcessC on Container3 and Server1 only .
Your network contains a single-domain Active Directory Domain Services (AD DS) forest named conto.com.
The forest contains the servers shown in the following exhibit table.
You plan to install a line-of-business (LOB) application on Server1. The application will install a custom windows services.
A new corporate security policy states that all custom Windows services must ru n under the context of a group managed service account (gMSA). You deploy a root key.
You need to create, configure, and install the gMSA that will be used by the new application.
Which two actions should you perform? Each correct answer presents part of t he solution.
NOTE: Each correct selection is worth one point.
The forest contains the servers shown in the following exhibit table.
You plan to install a line-of-business (LOB) application on Server1. The application will install a custom windows services.
A new corporate security policy states that all custom Windows services must ru n under the context of a group managed service account (gMSA). You deploy a root key.
You need to create, configure, and install the gMSA that will be used by the new application.
Which two actions should you perform? Each correct answer presents part of t he solution.
NOTE: Each correct selection is worth one point.
正確答案: A,D
說明：（僅 Fast2test 成員可見）
Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. Contoso.com contains three child domains named amer.contoso.com, apac.contoso.com, and emea.contoso.com. Fabrikam.com contains a child domain named apac.fabrikam.com. A bidirectional forest trust exists between contoso.com and fabrikam.com.
You need to provide users in the contoso.com forest with access to the resources in the fabrikam.com forest.
The solution must meet the follo wing requirements:
* Users in contoso.com must only be added directly to groups in the contoso.com forest.
* Permissions to access the resources in fabrikam.com must only be granted directly to groups in the fabrikam.
com forest.
* The number of groups must be minimized.
Which type of groups should you use to organize the users and to assign permissions? To answer, drag the appropriate group types to the correct requirements. Each group type may be used once, more than once, or not at all. You may need to dr ag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
You need to provide users in the contoso.com forest with access to the resources in the fabrikam.com forest.
The solution must meet the follo wing requirements:
* Users in contoso.com must only be added directly to groups in the contoso.com forest.
* Permissions to access the resources in fabrikam.com must only be granted directly to groups in the fabrikam.
com forest.
* The number of groups must be minimized.
Which type of groups should you use to organize the users and to assign permissions? To answer, drag the appropriate group types to the correct requirements. Each group type may be used once, more than once, or not at all. You may need to dr ag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
正確答案:
Explanation:
The Windows Server hybrid core administration guidance describes the classic cross-forest/group nesting model as AGUDLP: "Accounts # Global (or Universal ) # Domain Local # Permissions." For resource access that spans forests, the documentation stresses two points: (1) Put user accounts into groups that exist only in the ir own forest , and (2) Grant ACL permissions only to groups that exist in the resource forest . It further explains that Universal groups are forest-wide and "can contain users and global groups from any domain in the same forest and can be used across fore st trusts," which minimizes the number of groups when users come from multiple child domains. By contrast, Domain Global groups are limited to membership from a single domain, which would require separate globals per child domain and thus more groups. For assigning permissions at the resource side, the guidance states that Domain Local groups are intended to "receive permissions on resources within their own domain and can contain members from trusted forests," which satisfies the requirement that permissions in fabrikam.com be granted only to groups in that forest. Therefore, to meet all constraints and minimize group count: place contoso.com users in a Universal group (in contoso.
com) and add that group to a Domain Local group (in fabrikam.com) that is granted the required permissions.
Task2
You need to ensure th at the Azure file share named share1 can sync to on-premises servers.
The required source files are located in a folder named \\dc1.contoso.com\install.
You do NOT need to specify the on-premises servers at this time.
You need to ensure th at the Azure file share named share1 can sync to on-premises servers.
The required source files are located in a folder named \\dc1.contoso.com\install.
You do NOT need to specify the on-premises servers at this time.
正確答案:
See the solution of this Task below.
Explanation:
One possible solution to ensure that the Azure file share named share1 can sync to on-premises servers is to use Azure File Sync. Azure File Sync allows you to centralize your file shares in Azure Files without giving up the flexibilit y, performance, and compatibility of an on-premises file server. It does this by transforming your Windows Servers into a quick cache of your Azure file share. You can use any protocol available on Windows Server to access your data locally (including SMB, NFS, and FTPS) and you can have as many caches as you need across the world1.
Here are the steps to configure Azure File Sync for the Azure file share named share1 and the source files located in a folder named \dc1.contoso.com\install:
On the Azure porta l, create a Storage Sync Service in the same region as your storage account that contains the Azure file share named share1. For more information on how to create a Storage Sync Service, see How to deploy Azure File Sync.
On the on-premises server that hos ts the folder named \dc1.contoso.com\install, install the Azure File Sync agent. For more information on how to install the Azure File Sync agent, see Install the Azure File Sync agent.
On the on-premises server, register the server with the Storage Sync S ervice that you created in the first step.
For more information on how to register a server with a Storage Sync Service, see Register/unregister a server with Storage Sync Service.
On the Azure portal, create a sync group that defines the sync topology for a set of files. In the sync group, select the Azure file share named share1 as the cloud endpoint and the folder named \dc1.contoso.com\install as the server endpoint. For more information on how to create a sync group, see Create a sync group and a cloud endpoint and Create a server endpoint.
Wait for the initial sync to complete. You can monitor the sync progress on the Azure portal or on the on- premises server. For more information on how to monitor sync progress, see [Monitor sync progress].
Once the i nitial sync is complete, you can add more on-premises servers to the same sync group to sync and cache the content locally. You can also enable cloud tiering to optimize the storage space on the on-premises servers by tiering infrequently accessed or older files to Azure Files.
Explanation:
One possible solution to ensure that the Azure file share named share1 can sync to on-premises servers is to use Azure File Sync. Azure File Sync allows you to centralize your file shares in Azure Files without giving up the flexibilit y, performance, and compatibility of an on-premises file server. It does this by transforming your Windows Servers into a quick cache of your Azure file share. You can use any protocol available on Windows Server to access your data locally (including SMB, NFS, and FTPS) and you can have as many caches as you need across the world1.
Here are the steps to configure Azure File Sync for the Azure file share named share1 and the source files located in a folder named \dc1.contoso.com\install:
On the Azure porta l, create a Storage Sync Service in the same region as your storage account that contains the Azure file share named share1. For more information on how to create a Storage Sync Service, see How to deploy Azure File Sync.
On the on-premises server that hos ts the folder named \dc1.contoso.com\install, install the Azure File Sync agent. For more information on how to install the Azure File Sync agent, see Install the Azure File Sync agent.
On the on-premises server, register the server with the Storage Sync S ervice that you created in the first step.
For more information on how to register a server with a Storage Sync Service, see Register/unregister a server with Storage Sync Service.
On the Azure portal, create a sync group that defines the sync topology for a set of files. In the sync group, select the Azure file share named share1 as the cloud endpoint and the folder named \dc1.contoso.com\install as the server endpoint. For more information on how to create a sync group, see Create a sync group and a cloud endpoint and Create a server endpoint.
Wait for the initial sync to complete. You can monitor the sync progress on the Azure portal or on the on- premises server. For more information on how to monitor sync progress, see [Monitor sync progress].
Once the i nitial sync is complete, you can add more on-premises servers to the same sync group to sync and cache the content locally. You can also enable cloud tiering to optimize the storage space on the on-premises servers by tiering infrequently accessed or older files to Azure Files.
You need to implement the planned change for Data1.
Which actions should you perform in sequence? To answer, drag the appropriate actions to the correct order.
Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Which actions should you perform in sequence? To answer, drag the appropriate actions to the correct order.
Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
正確答案:
Explanation:
Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains a user named User1 and the servers shown in the following table.
User1 is a member of the Protected Users security group.
User1 performs the following actions:
* From Se rver1, establishes a remote PowerShell session on Server2
* From the PowerShell session on Server2, attempts to access a resource on Backup1 The request to access the resource on 8ackup1 is denied.
You need to ensure that User1 can access the resources on Backup1 by using the PowerShell session on Server2. The solution must follow the principle of least privilege and minimize administrative effort.
What should you configure?
User1 is a member of the Protected Users security group.
User1 performs the following actions:
* From Se rver1, establishes a remote PowerShell session on Server2
* From the PowerShell session on Server2, attempts to access a resource on Backup1 The request to access the resource on 8ackup1 is denied.
You need to ensure that User1 can access the resources on Backup1 by using the PowerShell session on Server2. The solution must follow the principle of least privilege and minimize administrative effort.
What should you configure?
正確答案: D
說明：（僅 Fast2test 成員可見）