Microsoft AZ-801 Exam Dumps & Practice Test Questions

Question 1:

You are managing a hybrid environment that includes on-premises Windows Server 2022 servers and Azure virtual machines. You need to configure Azure Arc to manage the on-premises servers from the Azure portal.

Which of the following is the first step you must perform?

A. Install the Azure Connected Machine agent on each server
B. Register the server with Windows Admin Center
C. Enable Azure Hybrid Benefit for the servers
D. Create an Azure Arc resource group

Correct answer: A

Explanation:

To onboard on-premises Windows Server machines to Azure Arc, the first step is to install the Azure Connected Machine agent on each server. This agent is essential for the server to be recognized by Azure Arc and managed from the Azure portal.

Azure Arc enables you to extend Azure management capabilities—such as policy enforcement, monitoring, security, and tagging—to resources outside of Azure. It allows you to bring your on-premises and multi-cloud servers under Azure governance.

The onboarding process begins by:

1. Installing the Azure Connected Machine agent.

2. Registering the server with Azure using a script that includes details like resource group and region.

3. After successful registration, the server appears in Azure as an Arc-enabled server.

Let's review the other options:

• B: Registering with Windows Admin Center is optional and used more for local management and integration—not a required first step for Azure Arc.

• C: Enabling Azure Hybrid Benefit relates to licensing and does not pertain to Azure Arc management.

• D: While you must choose a resource group during onboarding, simply creating one isn’t the starting step.

Therefore, the correct and initial action is to install the Azure Connected Machine agent, making A the right answer.

Question 2:

You are tasked with configuring Windows Server Update Services (WSUS) in a Windows Server 2022 environment to manage updates internally. You want to reduce internet bandwidth by ensuring only one server downloads updates from Microsoft.

Which WSUS topology should you implement?

A. Upstream and downstream server hierarchy
B. Standalone WSUS server
C. Client-side targeting
D. Multiple autonomous WSUS servers

Correct answer: A

Explanation:

To optimize bandwidth and centralize update management in a multi-server WSUS environment, the correct approach is to use an upstream and downstream WSUS server hierarchy. In this setup, a single upstream WSUS server downloads updates from Microsoft Update, while downstream servers receive updates from the upstream server instead of the internet.

This model minimizes external bandwidth usage and allows consistent update approval across all downstream servers. The downstream servers can be configured as replica servers (mirroring update approvals and settings from the upstream) or autonomous servers (with independent approval settings).

Let’s examine other options:

• B: A standalone WSUS server works for small environments but does not reduce bandwidth when multiple servers are involved.

• C: Client-side targeting helps categorize clients into groups for update policies but doesn’t affect server-to-server communication or bandwidth usage.

• D: Multiple autonomous WSUS servers operate independently and each downloads updates from Microsoft, which increases internet usage.

Thus, the upstream/downstream hierarchy is the most efficient topology when aiming to reduce external bandwidth and centralize update management, making A the correct answer.

Question 3:

Your organization uses Azure Backup to protect its Windows Server virtual machines. A junior admin accidentally deletes critical files. You need to restore the files from a previous backup without restoring the entire VM.

What type of restore should you perform?

A. File-level restore from a Recovery Services Vault
B. Snapshot restore
C. Full VM restore
D. Site Recovery failover

Correct answer: A

Explanation:

The most appropriate method to recover specific files without restoring the entire virtual machine is to perform a file-level restore from the Azure Recovery Services Vault.

Azure Backup allows you to back up virtual machines and access recovery points. When performing a file-level restore, you:

1. Navigate to the Recovery Services Vault in the Azure portal.

2. Select the backup item (VM).

3. Choose a recovery point and mount it as a virtual disk on a temporary VM.

4. Browse and copy the required files.

This method is fast and avoids unnecessary overhead, such as the downtime associated with full VM restoration.

Let’s evaluate the alternatives:

• B: Snapshot restores are typically used for disk-level recovery, not individual files.

• C: A full VM restore would bring back the entire virtual machine to a previous state, which is time-consuming and may overwrite newer changes.

• D: Site Recovery is a disaster recovery solution and involves replicating and failing over to a different location—overkill for restoring just a few files.

Therefore, the correct and efficient approach in this scenario is to use file-level restore from the Azure Recovery Services Vault, making A the right answer.

Question 4:

You are troubleshooting a line-of-business (LOB) application that is failing to spawn child processes on an Azure virtual machine named VM1, which runs Windows Server 2022.

What configuration should you adjust to allow the application to successfully create child processes?

A. Microsoft Defender Credential Guard
B. Microsoft Defender Application Control
C. Microsoft Defender SmartScreen
D. Exploit protection

Correct Answer: D

Explanation:

When a line-of-business (LOB) application is unable to create child processes, the issue often lies in a system-level security setting that restricts how applications interact with the operating system. In Windows Server environments, Exploit protection provides granular control over such behaviors and is the most relevant feature to examine in this case.

Exploit protection is a set of built-in Windows security mitigations designed to prevent vulnerabilities in software from being exploited by malicious actors. It offers both system-wide and per-application settings that can modify how software behaves, such as blocking dynamic code execution, preventing memory corruption exploits, or controlling whether an application can spawn child processes. This level of control is essential for hardening systems while allowing legitimate business applications to function properly.

Here's why the other options do not apply:

• A. Microsoft Defender Credential Guard is designed to protect credentials and secrets stored in memory by isolating them using virtualization-based security. It doesn’t influence application behavior or process creation.

• B. Microsoft Defender Application Control restricts which applications are allowed to run. It could block an application from executing altogether but doesn’t manage the ability to create child processes. It’s too broad and restrictive for solving this specific issue.

• C. Microsoft Defender SmartScreen focuses on web and file-based threats, primarily protecting against phishing or malicious downloads. It is irrelevant to the process creation model within an application.

Because Exploit protection allows precise configuration of execution behaviors and can be tailored to specific applications, it's the most appropriate tool for allowing a trusted app to generate child processes without compromising system security. By adjusting its settings for the specific LOB application, you can resolve the issue while maintaining a secure environment.

Question 5:

You manage a fleet of 100 Azure virtual machines running Windows Server. These VMs are integrated with Microsoft Defender for Cloud. You want to ensure that if Defender for Cloud detects the “Antimalware disabled in the virtual machine” alert, the affected VM is automatically powered off to prevent further risk.

Which feature should you use to automate this response?

A. Logic App
B. Workbook
C. Security Policy
D. Adaptive Network Hardening

Correct Answer: A

Explanation:

To automatically shut down a virtual machine when a specific security alert—such as “Antimalware disabled in the virtual machine”—is generated by Microsoft Defender for Cloud, the best solution is to use an Azure Logic App. Logic Apps are designed to automate workflows in response to events or conditions. In this scenario, the alert acts as the trigger that starts the automation.

With a Logic App, you can create a security workflow where:

1. The Logic App listens for Defender for Cloud alerts.

2. When a matching alert (e.g., Antimalware disabled) is detected, it triggers a predefined response.

3. The response action can be configured to call an Azure API or PowerShell script to shut down the VM automatically.

This automation helps enforce a proactive defense strategy by minimizing the window of vulnerability. Shutting down the VM ensures the system doesn't remain exposed to threats in a non-compliant state.

Let’s assess the other options:

• B. Workbook is used for interactive data visualization and dashboard creation. It’s valuable for monitoring and reporting but cannot trigger automated actions like shutting down VMs.

• C. Security Policy helps enforce compliance by defining required configurations. However, it does not offer real-time automated remediation like stopping a virtual machine.

• D. Adaptive Network Hardening recommends firewall and NSG rules to secure VMs based on observed traffic patterns. While it improves network security posture, it doesn’t offer alert-based automation.

In conclusion, Logic Apps allow you to react swiftly and automatically to Defender for Cloud alerts. By using them, you ensure faster containment of threats, such as when antimalware protection is disabled, thereby reducing risk and minimizing the need for manual intervention.

Question 5:

You are a Systems Administrator at an organization with several departments: Sales, Accounts, Research, and Production. All employees are licensed under Microsoft 365 E5, and each department has a dedicated Microsoft Team. Currently, users from any department can freely communicate with users from other departments through Microsoft Teams.

You are tasked with modifying the setup so that only members of the Research department can communicate with each other in Teams and are blocked from interacting with users in other departments. 

What configuration should you implement?

A. Set up a Teams Meeting policy
B. Create Information Barrier policies
C. Apply an App Protection policy
D. Configure Conference Bridges

Correct Answer: B

Explanation:

To enforce communication restrictions between users from different departments in Microsoft Teams, Information Barriers are the appropriate tool. Information Barrier (IB) policies are designed specifically to restrict communications between defined groups within an organization. This is particularly useful in environments where strict separation is necessary, such as between legal and finance teams or, in this case, between the Research team and others.

By configuring an Information Barrier policy that isolates the Research team, you ensure that members of this team can only initiate or receive communications with others in the same team. This includes restrictions on chat, calls, and collaborative actions in Microsoft Teams. Once configured, the system will enforce these rules automatically, maintaining organizational boundaries and supporting compliance with internal policies or regulatory requirements.

Let’s evaluate the other options:

• A (Teams Meeting policy): This controls meeting-related settings, such as who can present or join, but does not block communication between teams.

• C (App Protection policy): Primarily used for securing corporate data on mobile or BYOD devices. It doesn’t manage inter-user communication.

• D (Conference Bridges): These manage dial-in settings for Teams meetings and have no bearing on internal chat or collaboration permissions.

In conclusion, Information Barriers are the only solution among the options that provide the ability to restrict communication between defined user groups. This makes B the correct answer for meeting the requirement of isolating communication for the Research team.

Question 6:

Your organization uses Microsoft Teams, and you want to be immediately notified whenever a user creates a new Team using the "Create a Team" feature within the Teams application. What configuration should you apply?

A. Modify External Collaboration settings in Azure AD
B. Set up a supervision policy in the Compliance center
C. Create an eDiscovery Case
D. Configure an alert policy in the Compliance center

Correct Answer: D

Explanation:

To get notified when a new Team is created in Microsoft Teams, the most appropriate method is to set up an alert policy in the Microsoft 365 Security & Compliance Center. Alert policies allow administrators to track specific user or administrative activities across Microsoft 365 services and to receive real-time notifications when these events occur.

When configuring an alert policy, you can specify the activity to monitor—such as the creation of a Microsoft Team—and set conditions that trigger the alert. Once the policy is active, it will generate notifications to designated recipients whenever the specified action is detected. This makes it an ideal solution for keeping track of administrative actions like new Team creation.

Let’s review the incorrect options:

• A (External Collaboration settings): These settings control whether guests and external users can collaborate within your Microsoft 365 tenant. They do not provide monitoring or alerting capabilities.

• B (Supervision policy): Used for reviewing employee communications for compliance, such as monitoring chats or emails. It’s focused on content moderation, not administrative activity like team creation.

• C (eDiscovery Case): Designed for legal hold and investigation purposes. While it helps retrieve and analyze existing data, it does not offer proactive alerting functionality for new Teams creation.

Therefore, D is the correct answer. Alert policies provide a proactive and customizable solution to track and notify admins when users perform specific actions—such as creating new Teams—helping you maintain visibility and governance over your Microsoft 365 environment.

Question 7:

You manage an Azure virtual machine named VM1, which runs Windows Server. You want to encrypt its disk contents using Azure Disk Encryption. 

Which of the following must be in place before this encryption can be configured?

A. Customer Lockbox for Microsoft Azure
B. An Azure Key Vault
C. A BitLocker recovery key
D. Data-link layer encryption in Azure

Correct Answer: B

Explanation:

To successfully implement Azure Disk Encryption (ADE) on a Windows Server virtual machine in Azure, one of the key prerequisites is having Azure Key Vault properly configured. ADE uses BitLocker for Windows-based systems and DM-Crypt for Linux-based VMs to encrypt both the operating system and data disks. These technologies protect data at rest by ensuring the contents of the disks cannot be accessed by unauthorized users.

A core part of this encryption process is the management and protection of encryption keys. This is where Azure Key Vault plays a crucial role. It serves as a secure, centralized repository for storing cryptographic keys, secrets, and certificates. For ADE, the Key Vault stores the BitLocker keys needed to encrypt and decrypt the VM’s disks.

When you enable Azure Disk Encryption, you specify the Key Vault and the keys it should use. Without this vault, Azure cannot proceed with the encryption process, because there would be no secure place to store and manage the cryptographic material.

Let’s review the incorrect options:

• A. Customer Lockbox is a security feature that provides customers control over Microsoft support engineers’ access to data. While it enhances security and compliance, it is unrelated to disk encryption.

• C. A BitLocker recovery key is used for recovering access to a system that was encrypted using BitLocker, typically in on-prem scenarios. It’s useful after encryption but not a requirement before setting up ADE.

• D. Data-link layer encryption refers to encryption of data in transit over networks and doesn't play a role in disk-level encryption.

In summary, Azure Key Vault is essential for the encryption process because it securely stores the keys needed by ADE. This ensures the protection of sensitive data stored on your VM’s disks, making Option B the correct and necessary prerequisite for implementing Azure Disk Encryption.

Question 8:

Your Azure subscription has Microsoft Defender for Cloud enabled, and you manage 50 virtual machines running Windows Server. You want to ensure that any detected security threats or exploits on these VMs are automatically reported to Defender for Cloud. 

Which agent should you install on the VMs to achieve this?

A. Vulnerability assessment for machines
B. Microsoft Dependency agent
C. Log Analytics agent for Azure VMs
D. Guest Configuration agent

Correct Answer: C

Explanation:

To ensure that security events, threats, and system vulnerabilities detected on your virtual machines are effectively communicated to Microsoft Defender for Cloud, the most important requirement is the installation of the Log Analytics agent on each VM.

The Log Analytics agent (previously known as the OMS agent) is the main component that enables virtual machines to send telemetry data—including security logs, system performance metrics, and error reports—to Azure Monitor and Defender for Cloud. Once this agent is installed and connected to a Log Analytics workspace, it starts collecting and forwarding vital information related to the health and security of the VMs.

This data allows Defender for Cloud to:

• Monitor system behavior in real-time.

• Detect and raise alerts for potential security threats, including malware, unauthorized access attempts, and abnormal system changes.

• Provide administrators with recommendations to strengthen security posture.

Now let’s evaluate the other options:

• A. Vulnerability assessment for machines is a helpful tool to identify security flaws but it doesn’t forward threat data. It works at a higher-level assessment layer rather than handling continuous telemetry forwarding.

• B. Microsoft Dependency agent maps the interdependencies among services and applications. While useful for application insight, it doesn't send threat data to Defender for Cloud.

• D. Guest Configuration agent is primarily for managing and auditing configuration compliance, not for real-time threat detection or event forwarding.

To fully utilize Microsoft Defender for Cloud's advanced threat protection features, it is essential to have the Log Analytics agent installed and configured. This agent ensures that any detected vulnerabilities or exploits are captured and reported for analysis and action. Therefore, Option C is the correct answer, as it directly supports the collection and transmission of necessary security data to Defender for Cloud.

Question 9:

You are configuring Azure Disk Encryption on a Linux virtual machine. The encryption process is failing due to missing permissions. 

Which role must be assigned to the Key Vault to allow the encryption operation to succeed?

A. Reader
B. Contributor
C. Key Vault Contributor
D. Disk Encryption Reader

Correct Answer: C

Explanation:

When enabling Azure Disk Encryption (ADE) on a Linux virtual machine, or any VM in general, proper access permissions must be configured for the Key Vault involved in managing the encryption keys. If the process fails due to missing permissions, the likely issue is that the necessary Key Vault access policies have not been set correctly.

The required role in this scenario is Key Vault Contributor. This role allows the disk encryption process to access the Key Vault, perform key management operations such as retrieving keys, and ensure that encryption keys are properly linked to the virtual machine encryption process.

Azure Disk Encryption uses Azure Key Vault to store the secrets or encryption keys (for BitLocker or DM-Crypt) that are used to secure VM disks. Without the ability to read and write secrets in Key Vault, the encryption operation cannot complete. The Key Vault Contributor role ensures that the Azure Disk Encryption extension running on the VM has the necessary rights to interact with the Key Vault and store or retrieve the required secrets.

Let’s review the incorrect options:

• A. Reader grants view-only access to resources and is insufficient for performing encryption-related operations on Key Vaults.

• B. Contributor grants broad access to manage resources but does not provide specific rights to manage Key Vault contents such as secrets and keys unless scoped appropriately.

• D. Disk Encryption Reader is not a valid role required to configure encryption. It might imply read access but lacks the permissions needed to initiate and complete the encryption process.

In conclusion, the Key Vault Contributor role is essential for ADE to manage encryption keys in Key Vault. Without this role assignment, the VM will fail to complete the disk encryption process. Assigning this role ensures smooth operation and secure integration between Azure Disk Encryption and Key Vault, making Option C the correct answer.

Question 10:

You’re deploying a security solution in Azure to detect and respond to threats in real time. 

Which Defender for Cloud feature provides adaptive protection and prioritizes security alerts based on severity?

A. Azure Policy
B. Just-In-Time VM Access
C. Secure Score
D. Defender for Cloud’s Threat Detection

Correct Answer: D

Explanation:

To detect threats and respond dynamically within your Azure environment, Defender for Cloud’s Threat Detection is the feature specifically designed for this purpose. It offers adaptive threat protection, monitors activity in real-time, and generates alerts with severity ratings, allowing security teams to prioritize and address issues quickly.

This feature utilizes advanced analytics and machine learning to continuously assess telemetry from various resources including virtual machines, databases, storage, and applications. By leveraging Microsoft’s threat intelligence, Defender for Cloud can detect suspicious patterns such as unusual logins, privilege escalation, brute-force attacks, and malware behavior.

When a threat is detected, it triggers an alert that includes:

• Severity classification (high, medium, low)

• Description of the threat

• Recommended remediation actions

• Links to related resources and logs

These insights empower security teams to act quickly and mitigate potential breaches before they escalate.

Now, let’s evaluate the other options:

• A. Azure Policy is a governance tool used to enforce organizational standards and compliance, not for real-time threat detection or alerting.

• B. Just-In-Time VM Access is a helpful security feature that minimizes exposure by allowing controlled access to VMs, but it does not detect or alert on threats.

• C. Secure Score provides a numerical value indicating your security posture and offers recommendations, but it does not generate alerts or perform active threat detection.

Therefore, for real-time monitoring and intelligent threat management in Azure, Defender for Cloud’s Threat Detection is the most appropriate feature. It ensures rapid awareness of vulnerabilities and attacks, helping maintain a proactive and resilient cloud security posture. That makes Option D the correct choice.