Free Microsoft AZ-801 Practice Questions & Answers 2026 Part1

You are planning the deployment of Microsoft Sentinel. Which type of Microsoft Sentinel data connector should you use to meet the security requirements?

You have 100 Azure virtual machines that run Windows Server. The virtual machines are onboarded to Microsoft Defender for Cloud.You need to shut down a virtual machine automatically if Microsoft Defender for Cloud generates the "Antimalware disabled in the virtual machine" alert for the virtual machine.What should you use in Microsoft Defender for Cloud?

You are remediating the firewall security risks to meet the security requirements. What should you configure to reduce the risks?

You have a Microsoft Sentinel deployment and 100 Azure Arc-enabled on-premises servers. All the Azure Arc- enabled resources are in the same resource group.You need to onboard the servers to Microsoft Sentinel. The solution must minimize administrative effort.What should you use to onboard the servers to Microsoft Sentinel?

You have an Azure virtual machine named VM1 that runs Windows Server.You plan to deploy a new line-of-business (LOB) application to VM1.You need to ensure that the application can create child processes.What should you configure on VM1?

You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant by using password hash synchronization.You have a Microsoft 365 subscription.All devices are hybrid Azure AD-joined.Users report that they must enter their password manually when accessing Microsoft 365 applications.You need to reduce the number of times the users are prompted for their password when they access Microsoft 365 and Azure services.What should you do?

You have 100 Azure virtual machines that run Windows Server. The virtual machines are onboarded to Microsoft Defender for Cloud.You need to shut down a virtual machine automatically if Microsoft Defender for Cloud generates the "Antimalware disabled in the virtual machine" alert for thevirtual machine.What should you use in Microsoft Defender for Cloud?

You have a server named Server1 that runs Windows Server.You install a custom app named App1 that is accessed by using TCP port 52310.Users report that they cannot access App1.You confirm that App1 is running on Server1.You need to ensure that the users can access App1. The solution must only provide access to App1 on Server1.What should you do in Windows Defender Firewall with Advanced Security?

You have an Azure virtual machine named VM1 that runs Windows Server.You plan to deploy a new line-of-business (LOB) application to VM1.You need to ensure that the application can create child processes.What should you configure on VM1?

You have 100 Azure virtual machines that run Windows Server. The virtual machines are onboarded to Microsoft Defender for Cloud.You need to shut down a virtual machine automatically if Microsoft Defender for Cloud generates the "Antimalware disabled in the virtual machine" alert for the virtual machine.What should you use in Microsoft Defender for Cloud?

You are planning the deployment of Microsoft Sentinel.Which type of Microsoft Sentinel data connector should you use to meet the security requirements?

Your network contains an Active Directory Domain Services (AD DS) forest. The forest functional level is Windows Server 2012 R2. The forest contains the domains shown in the following table.You create a user named Admin1.You need to ensure that Admin1 can add a new domain controller that runs Windows Server 2022 to the east.contoso.com domain. The solution must follow the principle of least privilege.To which groups should you add Admin1?

Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that hosts an app named App1. App1 uses Active Directory authentication.You have a Microsoft Entra tenant that contains a user named User1.You deploy Microsoft Entra Connect sync and configure password synchronization.User1 fails to authenticate to App1.You need to ensure that User1can authenticate to App1.What should you do?

You need to meet the technical requirements for User1. To which group in contoso.com should you add User1?

Your company uses Storage Spaces Direct. You need to view the available storage in a Storage Space Direct storage pool. What should you use?

You have an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that runs Windows Server.You need to prevent the registration of specific COM objects on Server1.What should you use?

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains a user named User1.You deploy a read-only domain controller (RODC) named RODC1.You need to ensure that User1 is a local administrator on RODC1. The solution must use the principle of least privilege.What should you use?

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains a user named User1.You deploy a read-only domain controller (RODC) named RODC1.You need to ensure that User1 is a local administrator on RODC1. The solution must use the principle of least privilege.What should you use?

Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that hosts an app named App1. App1 uses Active Directory authentication.You have a Microsoft Entra tenant that contains a user named User1.You deploy Microsoft Entra Connect sync and configure password synchronization.User1 fails to authenticate to App1.You need to ensure that User1can authenticate to App1.What should you do?

You have an on-premises server that runs Windows Server and has the Web Server (IIS) server role installed. The server hosts a web app that connects to an on-premises Microsoft SQL Server database.You plan to migrate the web app to an Azure App Services web app. The database will remain on-premises.You need to ensure that the migrated web app can access the database.What should you configure in Azure?

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains a user named User1.You deploy a read-only domain controller (RODC) named RODC1.You need to ensure that User1 is a local administrator on RODC1. The solution must use the principle of least privilege.What should you use?

You have an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that runs Windows Server.You need to prevent the registration of specific COM objects on Server1.What should you use?

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains a user named User1.You deploy a read-only domain controller (RODC) named RODC1.You need to ensure that User1 is a local administrator on RODC1. The solution must use the principle of least privilege.What should you use?

You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains the resources shown in the following table.Sub1 has Microsoft Defender for Servers enabled. You are assigned the Contributor role for Sub1.You need to implement just-in-time (JIT) VM access for VM1.What should you do first?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a server named Server1 that runs Windows Server.You need to ensure that only specific applications can modify the data in protected folders on Server1.Solution: From App & browser control, you configure the Exploit protection settings.Does this meet the goal?

Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that hosts an app named App1. App1 uses Active Directory authentication.You have a Microsoft Entra tenant that contains a user named User1.You deploy Microsoft Entra Connect sync and configure password synchronization.User1 fails to authenticate to App1.You need to ensure that User1can authenticate to App1.What should you do?

You have two servers named Host1 and Host2 that run Windows Server and have the Hyper-V server role installed. Host2 is configured as a replica server.Host1 contains a virtual machine named VM1.You plan to use Hyper-V Replica to replicate VM1 to Host2.You need to ensure that you can restore a replica of VM1 to a specific state from the past eight hours.What should you do?

Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains a user named User1.You deploy a read-only domain controller (RODC) named RODC1.You need to ensure that User1 is a local administrator on RODC1. The solution must use the principle of least privilege.What should you use?

You have a server named Server1 that runs Windows Server.You install a custom app named App1 that is accessed by using TCP port 52310.Users report that they cannot access App1.You confirm that App1 is running on Server1.You need to ensure that the users can access App1. The solution must only provide access to App1 on Server1.What should you do in Windows Defender Firewall with Advanced Security?

You have a server named Server1 that runs Windows Server.You install a custom app named App1 that is accessed by using TCP port 52310.Users report that they cannot access App1.You confirm that App1 is running on Server1.You need to ensure that the users can access App1. The solution must only provide access to App1 on Server1.What should you do in Windows Defender Firewall with Advanced Security?

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two servers named Server1 and Server2 that run Windows Server.

You have 200 Azure virtual machines. You create a recovery plan in Azure Site Recovery to fail over all the virtual machines to an Azure region. The plan has three manual actions. You need to replace one of the manual actions with an automated process. What should you use?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that mightmeet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a server named Server1 that runs Windows Server.You need to ensure that only specific applications can modify the data in protected folders on Server1.Solution: From Virus & threat protection, you configure Tamper ProtectionDoes this meet the goal?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an on-premises server named Server1 that runs Windows Server.You have a Microsoft Sentinel instance.You add the Windows Firewall data connector in Microsoft Sentinel.You need to ensure that Microsoft Sentinel can collect Windows Firewall logs from Server1.Solution: You install the Microsoft Integration Runtime on Server1.Does this meet the goal?

You have an Azure subscription that contains a user named User1 and the resources shown in the following table.User1 has a computer named Computer1 that runs Windows 11. User1 works from home and establishes a Point-to-Site (P2S) connection to GW1 to access AppSvr1.You deploy the resources shown in the following table.User1 cannot access AppSvr2.You need to ensure that User1 can access AppSvr2.What should you do?

You have an Azure subscription that has Microsoft Defender for Cloud enabled. You have 50 Azure virtual machines that run Windows Server. You need to ensure that any security exploits detected on the virtual machines are forwarded to Defender for Cloud. Which extension should you enable on the virtual machines?

You have an Azure virtual machine named VM1 that runs Windows Server. You need to encrypt the contents of the disks on VM1 by using Azure Disk Encryption. What is a prerequisite for implementing Azure Disk Encryption?

Which of the following security policies would you configure from the Security Settings extension of the Local Group Policy Editor to control Encrypting File System, Data Protection, and BitLocker Drive Encryption?

You have a server that runs Windows Server 2025 Standard and has the Hyper-V role installed. You need to upgrade the server to Windows Server 2025 Datacenter. The solution must minimize downtime. What should you run?

Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that hosts an app named App1. App1 uses Active Directory authentication.You have a Microsoft Entra tenant that contains a user named User1.You deploy Microsoft Entra Connect sync and configure password synchronization.User1 fails to authenticate to App1.You need to ensure that User1can authenticate to App1.What should you do?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.Your network contains a single-domain Active Directory Domain Services (AD DS) forest named contoso.com. The functional level of the forest is Windows Server 2012 R2. All domain controllers run Windows Server 2012 R2.Sysvol replicates by using the File Replication Service (FRS).You plan to replace the existing domain controllers with new domain controllers that will run Windows Server 2022.You need to ensure that you can add the first domain controller that runs Windows Server 2022.Solution: You run the Active Directory Migration Tool (ADMT).Does this meet the goal?