[Feb 22, 2026] Pass Windows Server AZ-800 Exam With 310 Questions [Q139-Q158]

AZ-800 Microsoft

admin -

February 22, 2026

5/5 - (1 vote)

[Feb 22, 2026] Pass Windows Server AZ-800 Exam With 310 Questions

Ultimate Guide to Prepare Free Microsoft AZ-800 Exam Questions and Answer

NO.139 You have servers that run Windows Server 2022 as shown in the following table.

Server2 contains a .NET app named App1.
You need to establish a WebSocket connection from App1 to the SQL Server instance on Server!. The solution must meet the following requirements:
* Minimize the number of network ports that must be open on the on-premises network firewall.
* Minimize administrative effort.
What should you create first?

an Azure Relay namespace

an Azure VPN gateway

a WFC relay connection

a hybrid connection

NO.140 Which groups can you add to Group3 and Group5? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Explanation:

Reference:
https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory- security-groups
Topic 3, Datum Corporation
A Datum Corporation is a manufacturing company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
A Datum recently partnered with a company named Fabrikam, Inc.
Fabrikam is a manufacturing company that has a main office in Boston and a branch office in Orlando.
Both companies intend to collaborate on several joint projects.
The on-premises network of A. Datum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
The forest contains two domains named adatum.com and east.adatum.com and the domain controllers shown in the following table.

The on-premises network of Fabrikam contains an AD DS forest named fabrikam.com.
The forest contains two domains named fabrikam.com and south.fabrikam.com.
The fabrikam.com domain contains an organizational unit (OU) named Marketing.
The adatum.com domain contains the servers shown in the following table.

HyperV1 contains the virtual machines shown in the following table.

All the virtual machines on HyperV1 have only the default management tools installed.
SSPace1 contains the Storage Spaces virtual disks shown in the following table.

A Datum has an Azure subscription that contains a Microsoft Entra tenant. Microsoft Entra Connect is configured to sync the adatum.com forest with Microsoft Entra ID.
The subscription contains the virtual networks shown in the following table.

The subscription contains the Azure Private DNS zones shown in the following table.

The subscription contains the virtual machines shown in the following table.

All the servers are in a workgroup.
The subscription contains a storage account named storage1 that has a file share named share1.
A Datum plans to implement the following changes:
* Sync Data1 to share1.
* Configure an Azure runbook named Task1.
* Enable Microsoft Entra users to sign in to Server1.
* Create an Azure DNS Private Resolver that has the following configurations:
o Name: Private1
o Region: West US
o Virtual network: VNet1
o Inbound endpoint: SubnetB
* Enable users in the adatum.com domain to access the resources in the south.fabrikam.com domain.
A Datum identifies the following technical requirements:
* The data on SSPace1 must be available always.
* DC2 must become the schema master if DC1 fails.
* VMS must be configured to enable per-folder quotas.
* Trusts must allow access to only the required resources.
* The users in the Marketing OU must have access to storage!
* Azure Automanage must be used on all supported Azure virtual machines.
* A direct SSH session must be used to manage all the supported virtual machines on HyperV1.

NO.141 Drag and Drop Question
You have two on-premises servers named Server1 and Server2 that run Windows Server.
You have an Azure Storage account named storage1 that contains a file share named share1.
Server1 syncs with share1 by using Azure File Sync.
You need to configure Server2 to sync with share1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Explanation:
https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-server-registration
https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-server-endpoint- create?tabs=azure-portal

NO.142 You need to ensure that data availability on SSPace1 meets the technical requirements.
What is the maximum number of physical disks that can fail on each disk? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NO.143 SIMULATION
Task 1
You need to create a group-managed service account (gMSA) named gMSA1 and make gMSA1 available on SRV1.

See the solution of this Task below
Explanation:
To create a group-managed service account (gMSA) named gMSA1 and make it available on SRV1, you can follow these steps:
Step 1: Create the Key Distribution Services Root Key First, you need to create the KDS Root Key, which is required for the gMSA to function. You can do this with the following PowerShell command:
Add-KdsRootKey -EffectiveTime ((get-date).addhours(-10))
Note: The -EffectiveTime parameter is set to 10 hours in the past to ensure immediate effect.
Step 2: Create the gMSA Next, use the New-ADServiceAccount cmdlet to create the gMSA:
New-ADServiceAccount -Name gMSA1 -DNSHostName gmsa1.domain.com -PrincipalsAllowedToRetrieveManagedPassword SRV1$ Replace domain.com with your actual domain name.
Step 3: Install the gMSA on SRV1 Now, you need to install the gMSA on the server SRV1. Run the following command on SRV1:
Install-ADServiceAccount -Identity gMSA1
Step 4: Test the gMSA To ensure that the gMSA is installed correctly and ready for use, perform a test using:
Test-ADServiceAccount -Identity gMSA1
If the test returns True, the gMSA is correctly installed and ready for use on SRV1.
Step 5: Configure the Service to Use the gMSA Finally, configure the service that requires the gMSA to use gMSA1 by setting the service’s logon account to domain\gMSA1$ and leave the password field blank.
This will create and make the gMSA gMSA1 available on SRV1. Ensure that you have the necessary permissions and that SRV1 is properly joined to the domain before proceeding with these steps123.

NO.144 Task 4
You need to run a container that uses the mcrmicrosoft.com/windows/servercofe/iis image on SRV1. Port 80 on the container must be published to port 5001 on SRV1 and the container must run in the background See the solution of this Task below.

To run a container on SRV1 using the mcrmicrosoft.com/windows/servercofe/iis image, publish port 80 on the container to port 5001 on SRV1, and ensure it runs in the background, you can follow these steps:
Step 1: Pull the IIS Image First, pull the correct IIS image from the Microsoft Container Registry:
docker pull mcr.microsoft.com/windows/servercore/iis
Step 2: Run the Container Next, run the container with the required port mapping and ensure it runs in the background using the -d flag:
docker run -d -p 5001:80 –name iis_container mcr.microsoft.com/windows/servercore/iis This command will start a container named iis_container using the IIS image, map port 80 inside the container to port 5001 on SRV1, and run the container in detached mode.
Step 3: Verify the Container is Running To verify that the container is running and the port is published, use the following command:
docker ps
This will list all running containers and show the port mappings.
Step 4: Access the IIS Server You can now access the IIS server running in the container by navigating to
http://<SRV1_IP>:5001 in a web browser, where <SRV1_IP> is the IP address of SRV1.
Note: Ensure that Docker is installed on SRV1 and that the port 5001 is open on the firewall to allow incoming connections1.
By following these steps, you should be able to run the IIS container on SRV1 with the specified port mapping and have it running in the background. Please replace mcrmicrosoft.com/windows/servercofe/iis with the correct image name mcr.microsoft.com/windows/servercore/iis as shown in the commands above.

NO.145 Your network contains an Active Directory Domain Services (AD DS) domain named conioso.com.
You need to identify which server is the PDC emulator for the domain.
Solution: from Active Directory Users and Computers, you right-click contoso.com in the console tree, and then select Operations Master Does this meet the goal?

Yes

NO.146 Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. A two-way forest trust exists between the forests. Each forest contains a single domain. The domains contain the servers shown in the following table.

You need to configure resources based constrained delegation so that the users In contoso.com can use Windows Admin Center on Server) to connect to Server? How should you complete the command? To answer, select the appropriate options in the answer are a. NOTE: Each correct selection is worth one point.

Reference:
https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview
https://docs.microsoft.com/en-us/powershell/module/activedirectory/set-adcomputer?view=windowsserver2022-ps

NO.147 You have a server named Server1 that runs Windows Server. Server1 has the storage pools shown in the following table.

You plan to create a virtual disk named VDisk1 that will use storage tiers.
Which pools can you use to create VDisk1 ?

Pool2 and Pool3 only

Pool2 only

Pool1 only

Pool1, Pool2 and Pool3

Pool1 and Pool2 only

Pool1 and Pool3 only

Pool3 only

Storage tiering requires both standard HDDs and SSDs. We cannot use Pool1 because it does not have any SSDs.

NO.148 You have an Active Directory Domain Services (AD DS) domain that contains the member servers shown in the following table.

Server3 contains a data disk named Disk1 that has Data Deduplication installed. Disk1 contains the files shown in the following table.

Server3 fails.
You need to recover the files on Disk1.
Which files can you recover if you attach Disk1 to Server 1, and which files can you recover if you attach Disk1 to Server2? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Explanation:

NO.149 You have an Azure subscription that contains the storage accounts shown in the following table.

In the West US Azure region, you create a storage sync service named SyncA.
You plan to create a sync group named GroupA.
What is the maximum number of cloud endpoints you can use with GroupA?

NO.150 Your network contains two Active Directory forests and a domain trust as shown in the following exhibit.

The domain trust has the following configurations:
* Name: adatum.com
* Type: External
* Direction: One-way. outgoing
* Outgoing trust authentication level: Domain-wide authentication

The forests contain the network shares shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Explanation:

NO.151 Hotspot Question
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
The domain contains the users shown in the following table.

The domain has the Group Policy Objects (GPOs) shown in the following table.

The GPOs are configured as shown in the following table.

For each of the following statements, select Yes if the statement is true, Otherwise, select No.
NOTE: Each correct selection is worth one point.

NO.152 You have an Azure subscription and a computer named Computed that runs Windows 11.
From the Azure portal, you deploy a virtual machine named VM1 that runs Windows Server. You configure VM1 to use the default settings.
You need to ensure that you can connect to VM1 by using PowerShell remoting.
Which cmdlet should you run, and what should you use to run the cmdlet? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Explanation:

NO.153 Vou have an on-premises Active Directory Domain Services (AD DS} domain that syncs with an Azure Active Directory (Azure AD) tenant You have an on-premises web app named WebApp1 that only supports Kerberos authentication.
You need to ensure that users can access WebApp1 by using their Azure AD account. The solution must minimize administrative effort.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NO.154 SIMULATION
Task 5
you need to configure a Group Policy preference to ensure that users in the organizational unit (OU) named Server Admins have a shortcut to a folder named \srvi.contoso.comdata on their desktop when they sign in to the computers in the domain.

See the solution of this Task below
Explanation:
TASK 5
Objective:
Configure a Group Policy Preference to create a shortcut to \\srvi.contoso.com\data on the desktop of users in the Server Admins OU.
Step-by-Step Guide: Using Group Policy Preferences to Create a Desktop Shortcut
✅ Step 1: Open Group Policy Management Console (GPMC)
Log in to a DC or a management computer with RSAT installed.
Open Group Policy Management (gpmc.msc).
✅ Step 2: Create a New GPO
In the GPMC console, expand the forest and the domain (e.g., contoso.com).
Right-click the OU named Server Admins and select Create a GPO in this domain, and Link it here.
Name the GPO, e.g., Desktop Shortcut for Server Admins.
✅ Step 3: Edit the GPO
Right-click the newly created GPO and select Edit.
This opens the Group Policy Management Editor.
✅ Step 4: Navigate to User Preferences
In the editor, expand:
User Configuration > Preferences > Windows Settings > Shortcuts.
✅ Step 5: Create the Shortcut
Right-click Shortcuts and select New > Shortcut.
In the New Shortcut Properties window:
Action: Create
Name: Data Folder
Target Type: File System Object
Location: Desktop
Target Path: \\srvi.contoso.com\data
Optionally, set an icon or description if you want.
✅ Step 6: Configure Item-Level Targeting (Optional)
If you want to limit this shortcut strictly to specific users/groups, click the Common tab.
Check Item-level targeting and configure conditions (optional).
For this scenario, linking the GPO to the Server Admins OU is usually sufficient.
✅ Step 7: Close and Update
Close the editor.
In GPMC, ensure the GPO is linked to the Server Admins OU.
Force a Group Policy Update on client computers:
On a client computer:
gpupdate /force
Or wait for the next Group Policy refresh cycle.
✅ Step 8: Verify
Log in as a user in the Server Admins OU.
The shortcut to \\srvi.contoso.com\data should appear on the desktop.

NO.155 Hotspot Question
Your network contains an Azure Active Directory Domain Services (Azure AD DS) domain named contoso.com.
You need to configure a password policy for the local user accounts on the Azure virtual machines joined to contoso.com.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NO.156 Task 4
You need to run a container that uses the mcrmicrosoft.com/windows/servercofe/iis image on SRV1. Port 80 on the container must be published to port 5001 on SRV1 and the container must run in the background

See the solution of this Task below.
Explanation:
To run a container on SRV1 using the mcrmicrosoft.com/windows/servercofe/iis image, publish port 80 on the container to port 5001 on SRV1, and ensure it runs in the background, you can follow these steps:
Step 1: Pull the IIS Image First, pull the correct IIS image from the Microsoft Container Registry:
docker pull mcr.microsoft.com/windows/servercore/iis
Step 2: Run the Container Next, run the container with the required port mapping and ensure it runs in the background using the -d flag:
docker run -d -p 5001:80 –name iis_container mcr.microsoft.com/windows/servercore/iis This command will start a container named iis_container using the IIS image, map port 80 inside the container to port 5001 on SRV1, and run the container in detached mode.
Step 3: Verify the Container is Running To verify that the container is running and the port is published, use the following command:
docker ps
This will list all running containers and show the port mappings.
Step 4: Access the IIS Server You can now access the IIS server running in the container by navigating to
http://<SRV1_IP>:5001 in a web browser, where <SRV1_IP> is the IP address of SRV1.
Note: Ensure that Docker is installed on SRV1 and that the port 5001 is open on the firewall to allow incoming connections1.
By following these steps, you should be able to run the IIS container on SRV1 with the specified port mapping and have it running in the background. Please replace mcrmicrosoft.com/windows/servercofe/iis with the correct image name mcr.microsoft.com/windows/servercore/iis as shown in the commands above.

NO.157 You have a file server named Server1 that runs Windows Server and contains the volumes shown in the following table.

On which volumes can you use BitLocker Drive Encryption (BitLocker) and disk quotas? To answer select the appropriate options in the answer are a. NOTE Each correct selection is worth one point.

Reference:
https://docs.microsoft.com/en-us/windows-server/storage/refs/refs-overview

NO.158 You need to meet the technical requirements for VM2.
What should you do?

Implement shielded virtual machines.

Enable the Guest services integration service.

Implement Credential Guard.

Enable enhanced session mode.

This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more Information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements, if the case study has an All Information tab. note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview
Fabrikam, Inc. Is a manufacturing company that has a main office In New York and a branch office in Seattle.
On-premises Servers
The on-premises network contains servers that run Windows Server as shown in the following table.

DC1 hosts all the operation master roles.
WEB1 and WEB2 run an Internet Information Services (IIS) web app named Webapp1.
On-premises Network
The New York and Seattle offices are connected by using redundant WAN links.
The client computers in each office get IP addresses from their local DHCP server.
DHCP! contains a scope named Scope1 that has addresses for the New York office. DHCP2 contains a scope named Scope2 that has addresses for the Seattle office.
Group Policy Object (GPOs)
The cwp.fabrikam.com domain contains the organizational units (OUs) and custom Group Policy Objects (GPOs) shown in the following table.