[2025年03月13日] 無料Microsoft AZ-800試験問題と解答 [Q46-Q70]

[2025年03月13日] 無料Microsoft AZ-800試験問題と解答

検証済みAZ-800問題集と解答は最新AZ-800をダウンロード

Microsoft AZ-800認定試験は、ITの専門家がWindows Serverハイブリッドコアインフラストラクチャの管理に関する専門知識を実証する素晴らしい方法です。この認定は、世界中の雇用主によって認識されており、ITの専門家が競争力のある雇用市場で際立っているのを支援することができます。さらに、認定試験は、ITの専門家が自分のスキルと知識を向上させる絶好の機会を提供し、より良い雇用機会とより高い給与につながる可能性があります。

質問 # 46
Your network contains three Active Directory Domain Services (AD DS) forest as shown in the following exhibit.

The network contains the users shown in the following table.

The network contains the security groups shown in the following table.

For each of the following statements, select Yes if the statement is true, Otherwise, select No.
NOTE: Each correct selection is worth one point.

正解：

解説：

質問 # 47
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains three Active Directory sites named Site1, Site2, and Site3. Each site contains two domain controllers. The sites are connected by using DEFAULTIPSITELINK.
You open a new branch office that contains only client computers.
You need to ensure that the client computers in the new office are primarily authenticated by the domain controllers in Site1.
Solution: You configure the Try Next Closest Site Group Policy Object (GPO) setting in a GPO that is linked to Site1.
Does this meet the goal?

A. Yes
B. No

正解：A

質問 # 48
You create a new Azure subscription.
You plan to deploy Azure Active Directory Domain Services (Azure AD DS) and Azure virtual machines.
You need to ensure that the virtual machines can join Azure AD DS.
Which three actions should perform in sequence? To answer, move the appropriate actions from the list of action of the answer area and arrange them in the correct order.

正解：

解説：

1 - Create an Azure virtual network.
2 - Create an Azure AD DS instance.
3 - Modify the settings of the Azure virtual network.

質問 # 49
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a child domain named east.contoso.com.
in the contoso.com domain, you create two users named Admin1 and Admin2.
You need to ensure that the users can perform the following tasks:
* Admin1 can create and manage Active Directory sites.
* Admin2 can deploy domain controller to the easl.conloso.com domain.
The solution must use the principle of least privilege.
To which group should you add each user? To answer, select the appropriate options in the answer area.
NOTE Each correct selection is worth one point.

正解：

解説：

Reference:
https://docs.microsoft.com/en-us/windows-server/remote/remote-access/ras/multisite/configure/step-2-configure-the-multisite-infrastructure

質問 # 50
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the VPN servers shown in the following table.

You have a server named NPS1 that has Network Policy Server (NPS) installed. NPS1 has the following RADIUS clients:

VPN1, VPN2, and VPN3 use NPS1 for RADIUS authentication. All the users in contoso.com are allowed to establish VPN connections. For each of the following statements, select Yes If the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

正解：

解説：

質問 # 51
You have on-premises file servers that run Windows Server as shown in the following table.

You have the Azure file shares shown in the following table.

You add a Storage Sync Service named Sync1 and an Azure File Sync sync group named Group1. Group1 uses share1 as a cloud endpoint.
You register Server1 and Server2 with Sync1. You add D:\Folder1 from Server1 as a server endpoint in Group1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

正解：

解説：

Reference:
https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-planning

質問 # 52
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the domain controllers shown in the following table.

You need to configure DC3 to be the authoritative time server for the domain.
Which operations master role should you transfer to DC3, and which console should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

正解：

解説：

Explanation:

質問 # 53
Your network contains an Active Domain Services (AD DS) forest. The forest contains three domains. Each domain contains 10 domain controllers.
You plan to store a DNS zone in a custom active Directory partition.
You need to create the Active Directory partition for the zone. The partition replicate to only four of the domain controllers.
What should you use?

A. dnscmd.exe
B. Active Directory Sites and Services
C. Active Directory Administrator Center
D. DNS Manager

正解：C

質問 # 54
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the servers shown in the following table.

The domain contains the users shown in the following table.

On Server2. you run the Enable-PSRemoting cmdlet
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

正解：

解説：

Explanation:

質問 # 55
Task 9
You need to ensure that all the computers in the domain use DNSSEC to resolve names in the adatum.com zone.

正解：

解説：
See the solution of this Task below.
Explanation:
To ensure that all computers in the domain use DNSSEC to resolve names in the adatum.com zone, you'll need to configure both the DNS servers and the client computers. Here's how you can do it:
Step 1: Sign the adatum.com Zone First, you need to sign the adatum.com DNS zone. This can be done using the DNS Manager or PowerShell. Here's a PowerShell example:
Add-DnsServerSigningKey -ZoneName "adatum.com" -CryptoAlgorithm RsaSha256 Set-DnsServerDnsSecZoneSetting -ZoneName "adatum.com" -DenialOfExistence NSEC3 -NSEC3Parameters
1,0,10,""
This will add a signing key and configure DNSSEC for the zone with NSEC3 parameters.
Step 2: Configure DNS Servers Ensure that your DNS servers are configured to support DNSSEC. This includes setting up trust anchors for the zones that you want to validate and configuring the DNS servers to provide DNSSEC validation for DNS queries.
Step 3: Configure DNS Clients For DNSSEC validation to occur on the client side, the client computers must be configured to trust the DNS server's validation process. This typically involves configuring the client's DNS settings to point to a DNS server that supports DNSSEC.
Step 4: Validate Configuration You can validate that DNSSEC is working correctly by using tools like nslookup or dig to query DNS records and check for the presence of DNSSEC signatures in the responses.
Note: The exact steps may vary depending on your environment and the version of Windows Server you are using. Ensure that you have the appropriate administrative rights to make these changes and that you test the configuration in a controlled environment before deploying it domain-wide12.
By following these steps, you should be able to ensure that all computers in your domain use DNSSEC to resolve names in the adatum.com zone.

質問 # 56
You have an Azure subscription that contains the storage accounts shown in the following table.

In the West US Azure region, you create a storage sync service named SyncA.
You plan to create a sync group named GroupA.
What is the maximum number of cloud endpoints you can use with GroupA?

A. 0
B. 1
C. 2
D. 3

正解：B

質問 # 57
You have an on-premises server named Server 1 that runs Windows Server. Server 1 contains a file share named Share 1.
You have an Azure subscription.
You perform the following actions:
* Deploy Azure File Sync
* Install the Azure File Sync agent on Server1.
* Register Server1 with Azure File Sync
You need to ensure that you can add Share1 as an Azure File Sync server endpoint.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

正解：

解説：

Explanation:

質問 # 58
You have a server named Server1 that runs Windows Server. Server1 has the storage pools shown in the following table.

You plan to create a virtual disk named VDisk1 that will use storage tiers. Which pools can you use to create VDisk1 ?

A. Pool1 and Pool2 only
B. Pool, Pool2, and Pool3
C. Pool only
D. Pool2 and Pool3 only
E. Pool1 and Pool3 only
F. Pool 2only
G. Pool3 only

正解：D

解説：
Storage tiering requires both standard HDDs and SSDs. We cannot use Pool1 because it does not have any SSDs.

質問 # 59
You need to meet the security requirements for passwords.
Where should you configure the components for Azure AD Password Protection? lo answer, drag the appropriate components to the correct locations. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE Each correct selection is worth one point.

正解：

解説：

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises

質問 # 60
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with an Azure AD tenant. The tenant contains a group named Group1 and the users shown in the following table.

Domain/OU filtering in Azure AD Connect is configured as shown in the Filtering exhibit. (Click the Filtering tab.)

You review the Azure AD Connect configurations as shown in the Configure exhibit. (Click the Configure tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

正解：

解説：

質問 # 61
You have an Azure subscription that contains the virtual machines shown in the following table.

You plan to implement Azure Automanage for Windows Server.
You need to identify the operating system prerequisites.
Which virtual machines support Hotpatch, and which virtual machines support SMB over QUIC? To answer select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

正解：

解説：

Explanation

質問 # 62
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the offices shown in the following table.

You need to deploy a Network Policy Server (NPS) named NPS1 to enforce network access policies for all remote connections.
What is the minimum number of RADIUS clients that you should add to NPS1?

A. 0
B. 1
C. 2
D. 3
E. 4

正解：E

質問 # 63
Your network contains an Active Directory Domain Services (AD DS) domain named adatum.com. The domain contains a server named Server1 and the users shown in the following table.

Server1 contains a folder named D:\Folder1. The advanced security settings for Folder1 are configured as shown in the Permissions exhibit. (Click the Permissions tab.)

Folder1 is shared by using the following configurations:
The share permissions for Share1 are shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

正解：

解説：

質問 # 64
You have an on-premises server named Server1 that runs Windows Server. You have an Azure virtual network that contains an Azure virtual network gateway. You need to connect only Server1 to the Azure virtual network. What should you use?

A. an ExpressRoute circuit
B. a Site-to-SiteVPN
C. Azure Network Adapter
D. Azure Extended Network

正解：D

解説：
Reference:
https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/use-azure-network-adapter

質問 # 65
Your on-premises network contains an Active Directory Domain Services (AD DS) domain.
You plan to sync the domain with a Microsoft Entra tenant by using Microsoft Entra Connect cloud sync.
You need to meet the following requirements:
* Install the software required to sync the domain and Microsoft Entra ID.
* Enable password hash synchronization.
What should you install, and what should you use to enable password hash synchronization? To answer, select the appropriate options in the answer area.

正解：

解説：

Explanation:

質問 # 66
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains 10 servers that run Windows Server. The servers have static IP addresses.
You plan to use DHCP to assign IP addresses to the servers. You need to ensure that each server always receives the same IP address.
Which type of identifier should you use to create a DHCP reservation for each server?

A. MAC address
B. fully qualified domain name (FQDN)
C. universally unique identifier (UUID)
D. NetBIOS name

正解：A

質問 # 67
SIMULATION
Task 7
You need to monitor the security configuration of DC1 by using Microsoft Defender for Cloud.
The required source files are located in a folder named \\dc1.contoso.com\install.

正解：

解説：
See the solution of this Task below
Explanation:
One possible solution to monitor the security configuration of DC1 by using Microsoft Defender for Cloud is to use the Guest Configuration feature. Guest Configuration is a service that audits settings inside Linux and Windows virtual machines (VMs) to assess their compliance with your organization's security policies. You can use Guest Configuration to monitor the security baseline settings for Windows Server in the Microsoft Defender for Cloud portal by following these steps:
On DC1, open a web browser and go to the folder named \dc1.contoso.com\install. Download the Guest Configuration extension file (GuestConfiguration.msi) and save it to a local folder, such as C:\Temp.
Run the Guest Configuration extension file and follow the installation wizard. You can choose to install the extension for all users or only for the current user. For more information on how to install the Guest Configuration extension, see Install the Guest Configuration extension.
After the installation is complete, sign in to the Microsoft Defender for Cloud portal (2).
In the left pane, select Security Center and then Recommendations.
In the recommendations list, find and select Vulnerabilities in security configuration on your Windows machines should be remediated (powered by Guest Configuration).
In the Remediate Security Configurations page, you can see the compliance status of your Windows VMs, including DC1, based on the Azure Compute Benchmark. The Azure Compute Benchmark is a set of rules that define the desired configuration state of your VMs. You can also see the number of failed, passed, and skipped rules for each VM. For more information on the Azure Compute Benchmark, see Microsoft cloud security benchmark: Azure compute benchmark is now available.
To view the details of the security configuration of DC1, click on the VM name and then select View details. You can see the list of rules that apply to DC1 and their compliance status. You can also see the severity, description, and remediation steps for each rule. For example, you can see if DC1 has the latest security updates installed, if the firewall is enabled, if the password policy is enforced, and so on.
To monitor the security configuration of DC1 over time, you can use the Compliance over time chart, which shows the trend of compliance status for DC1 in the past 30 days. You can also use the Compliance breakdown chart, which shows the distribution of compliance status for DC1 by rule severity.
By using Guest Configuration, you can monitor the security configuration of DC1 by using Microsoft Defender for Cloud and ensure that it meets your organization's security standards. You can also use Guest Configuration to monitor the security configuration of other Windows and Linux VMs in your Azure environment.

質問 # 68
Your network contains the segments shown in the following table.

You have servers that run Windows Server and are configured as shown in the following table.

You deploy a server named Server4 that runs Windows Server and has a static IP address of 172.16.1.1. You connect Server4 to Segment1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

正解：

解説：

Explanation:
A screenshot of a computer Description automatically generated

質問 # 69
Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. Contoso.com contains three child domains named amer.contoso.com, apac.contoso.com, and emea.contoso.com. Fabrikam.com contains a child domain named apac.fabrikam.com. A bidirectional forest trust exists between contoso.com and fabrikam.com.
You need to provide users in the contoso.com forest with access to the resources in the fabrikam.com forest. The solution must meet the following requirements:
* Users in contoso.com must only be added directly to groups in the contoso.com forest.
* Permissions to access the resources in fabrikam.com must only be granted directly to groups in the fabrikam.com forest.
* The number of groups must be minimized.
Which type of groups should you use to organize the users and to assign permissions? To answer, drag the appropriate group types to the correct requirements. Each group type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.