AZ 800
Administering Windows Server Hybrid
Core Infrastructure
Latest Mock Exam
2025
©2025
, Section 1: Deploying and Managing Active Directory Domain Services
(AD DS)
Question 1 (Multiple Choice)
When integrating on‑premises Active Directory with Azure Active
Directory in a hybrid environment, which tool is recommended for
synchronizing user identities?
A) Active Directory Federation Services (AD FS)
B) Azure AD Connect
C) Microsoft Identity Manager (MIM)
D) Direct LDAP over Internet
Correct ANS:
B) Azure AD Connect
Rationale:
Azure AD Connect is the recommended tool for synchronizing
on‑premises AD with Azure AD. It supports password hash
synchronization, pass‑through authentication, and even federation
scenarios—ensuring a seamless hybrid identity experience.
---
Question 2 (Fill-in-the-Blank)
In a hybrid AD DS deployment, enabling password hash synchronization
to support single sign‑on is achieved using __________.
Correct ANS:
Azure AD Connect
Rationale:
Azure AD Connect enables password hash sync, ensuring that users can
sign in seamlessly whether they are on‑premises or accessing
cloud‑based resources.
©2025
,---
Question 3 (True/False)
True or False: Active Directory Federation Services (AD FS) is mandatory
to achieve single sign‑on in a hybrid environment.
Correct ANS:
False
Rationale:
Single sign‑on can be achieved with Azure AD Connect’s Seamless SSO
option without necessarily deploying AD FS. AD FS is an option when
more advanced federation scenarios are required, but it is not mandatory
in all hybrid setups.
---
Question 4 (Multiple Response)
Select all methods used to integrate on‑premises Active Directory with
Azure AD in a hybrid identity scenario:
- A) Azure AD Connect with Password Hash Synchronization
- B) Azure AD Connect with Pass‑Through Authentication
- C) Active Directory Federation Services (AD FS)
- D) Direct LDAP queries over the public Internet
Correct ANSs:
A, B, C
Rationale:
Azure AD Connect supports multiple integration methods (password hash
sync, pass‑through authentication, and optionally AD FS federation) to
meet diverse hybrid identity needs. Direct LDAP queries over the Internet
are not a recommended integration method.
©2025
, ---
Question 5 (Multiple Choice)
Which Azure service provides managed domain services (e.g., LDAP and
Kerberos) in the cloud for legacy applications that cannot authenticate
directly against Azure AD?
A) Azure AD Connect Health
B) Azure AD Domain Services (Azure AD DS)
C) Azure Active Directory Identity Protection
D) Microsoft Intune
Correct ANS:
B) Azure AD Domain Services (Azure AD DS)
Rationale:
Azure AD DS delivers managed domain services such as LDAP, Kerberos,
and group policy for legacy applications. This enables a seamless cloud
experience for applications that rely on traditional directory protocols.
---
Question 6 (Fill-in-the-Blank)
To improve fault tolerance and high availability for cloud‑based domain
controllers, organizations deploy them across multiple __________
within an Azure region.
Correct ANS:
Availability Zones
Rationale:
Deploying domain controllers across multiple Availability Zones enhances
resilience by ensuring that if one zone experiences an outage, the
remaining domain controllers can continue to authenticate users.
---
©2025
Administering Windows Server Hybrid
Core Infrastructure
Latest Mock Exam
2025
©2025
, Section 1: Deploying and Managing Active Directory Domain Services
(AD DS)
Question 1 (Multiple Choice)
When integrating on‑premises Active Directory with Azure Active
Directory in a hybrid environment, which tool is recommended for
synchronizing user identities?
A) Active Directory Federation Services (AD FS)
B) Azure AD Connect
C) Microsoft Identity Manager (MIM)
D) Direct LDAP over Internet
Correct ANS:
B) Azure AD Connect
Rationale:
Azure AD Connect is the recommended tool for synchronizing
on‑premises AD with Azure AD. It supports password hash
synchronization, pass‑through authentication, and even federation
scenarios—ensuring a seamless hybrid identity experience.
---
Question 2 (Fill-in-the-Blank)
In a hybrid AD DS deployment, enabling password hash synchronization
to support single sign‑on is achieved using __________.
Correct ANS:
Azure AD Connect
Rationale:
Azure AD Connect enables password hash sync, ensuring that users can
sign in seamlessly whether they are on‑premises or accessing
cloud‑based resources.
©2025
,---
Question 3 (True/False)
True or False: Active Directory Federation Services (AD FS) is mandatory
to achieve single sign‑on in a hybrid environment.
Correct ANS:
False
Rationale:
Single sign‑on can be achieved with Azure AD Connect’s Seamless SSO
option without necessarily deploying AD FS. AD FS is an option when
more advanced federation scenarios are required, but it is not mandatory
in all hybrid setups.
---
Question 4 (Multiple Response)
Select all methods used to integrate on‑premises Active Directory with
Azure AD in a hybrid identity scenario:
- A) Azure AD Connect with Password Hash Synchronization
- B) Azure AD Connect with Pass‑Through Authentication
- C) Active Directory Federation Services (AD FS)
- D) Direct LDAP queries over the public Internet
Correct ANSs:
A, B, C
Rationale:
Azure AD Connect supports multiple integration methods (password hash
sync, pass‑through authentication, and optionally AD FS federation) to
meet diverse hybrid identity needs. Direct LDAP queries over the Internet
are not a recommended integration method.
©2025
, ---
Question 5 (Multiple Choice)
Which Azure service provides managed domain services (e.g., LDAP and
Kerberos) in the cloud for legacy applications that cannot authenticate
directly against Azure AD?
A) Azure AD Connect Health
B) Azure AD Domain Services (Azure AD DS)
C) Azure Active Directory Identity Protection
D) Microsoft Intune
Correct ANS:
B) Azure AD Domain Services (Azure AD DS)
Rationale:
Azure AD DS delivers managed domain services such as LDAP, Kerberos,
and group policy for legacy applications. This enables a seamless cloud
experience for applications that rely on traditional directory protocols.
---
Question 6 (Fill-in-the-Blank)
To improve fault tolerance and high availability for cloud‑based domain
controllers, organizations deploy them across multiple __________
within an Azure region.
Correct ANS:
Availability Zones
Rationale:
Deploying domain controllers across multiple Availability Zones enhances
resilience by ensuring that if one zone experiences an outage, the
remaining domain controllers can continue to authenticate users.
---
©2025
