Prepare Smarter for the AZ-801 Exam
Build your exam confidence with flexible preparation resources designed around the latest AZ-801 exam objectives. Practice at your own pace using PDF questions, online exam simulations, or desktop practice software.
You are remediating the firewall security risks to meet the security requirements.
What should you configure to reduce the risks?
Correct Answer: A
Firewall rules configured in a Group Policy Object cannot be modified by local server administrators
You are planning the deployment of Microsoft Sentinel.
Which type of Microsoft Sentinel data connector should you use to meet the security requirements?
Correct Answer: D
Detailed Explanation
Microsoft Defender for Identity is the Microsoft Sentinel data connector purpose-built to monitor on-premises Active Directory domain controllers and surface exactly the insecure-protocol activity described in the requirement, including sign-ins and authentication attempts that use legacy or unsigned protocols such as NTLMv1, SMBv1, and unsigned LDAP. Threat Intelligence - TAXII ingests external threat-intelligence indicator feeds rather than DC authentication telemetry, the Azure Active Directory connector reports on cloud/Microsoft Entra ID sign-in and audit events rather than on-premises AD DS domain controller traffic, and Microsoft Defender for Cloud focuses on cloud resource security posture rather than legacy-protocol detection against on-premises domain controllers.
Official Reference
Connect data from Microsoft Defender for Identity to Microsoft Sentinel — https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/microsoft-defender-for-identity
You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Windows Server and uses Azure Disk Encryption.
You need to identify which Azure key vault stores the encryption keys for VM1. The solution must minimize administrative effort.
Which PowerShell cmdlet should you run?
Correct Answer: C
Detailed Explanation
Running Get-AzVMDiskEncryptionStatus against VM1 returns the current Azure Disk Encryption status for its OS and data disks in a single call, including the key vault URL/resource ID where the encryption secrets are stored, so no separate lookup of encryption sets or key vault contents is needed. Get-AzKeyVaultKey and Get-AzDiskEncryptionSet both require you to already know which key vault or disk encryption set resource to query, and Get-AzKeyVault only enumerates key vaults in the subscription without tying any of them to VM1 specifically, so they involve more administrative effort.
Official Reference
Azure Disk Encryption for Windows VMs — https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-overview
You have a Site-to-Site VPN between an on-premises network and an Azure VPN gateway. BGP is disabled for the Site-to-Site VPN.
You have an Azure virtual network named Vnet1 that contains a subnet named Subnet1. Subnet1 contains a virtual machine named Server1.
You can connect to Server1 from the on-premises network.
You extend the address space of Vnet1. You add a subnet named Subnet2 to Vnet1. Subnet2 uses the extended address space. You deploy an Azure virtual machine named Server2 to Subnet2.
You cannot connect to Server2 from the on-premises network. Server1 can connect to Server2.
You need to ensure that you can connect to Subnet2 from the on-premises network.
What should you do?
Correct Answer: D
Detailed Explanation
With BGP disabled, the Site-to-Site connection relies on statically defined routes rather than dynamic route propagation, so when Subnet2 is added to Vnet1 ' s extended address space, Azure ' s side of the tunnel already knows about it (it ' s part of the connected VNet), but the on-premises routers have no route telling them that traffic destined for Subnet2 ' s range should be sent across the VPN tunnel. Server1 can reach Server2 because that traffic never leaves the Azure virtual network, but on-premises hosts have no path configured to the new subnet until the on-premises routing tables (and, if applicable, the local network gateway/VPN device configuration) are updated to include it. Adding another Site-to-Site tunnel, a private endpoint, or a user-defined route table in Subnet2 does not address the missing route on the on-premises side, which is the actual point of failure.
Official Reference
About VPN Gateway configuration settings – routing — https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings
You need to meet the technical requirements for User1.
To which group in contoso.com should you add User1?
Correct Answer: A
Detailed Explanation
Recovering deleted objects from the Active Directory Recycle Bin requires permission to restore objects from the Deleted Objects container, and among the four groups offered, Domain Admins is the built-in group whose members are granted this capability by default (the forest ' s Active Directory Recycle Bin feature is already enabled in this environment). Account Operators, Schema Admins, and Backup Operators do not carry the permissions needed to restore deleted objects from the Deleted Objects container by default, so Domain Admins is the appropriate group for User1 to meet this requirement while still limiting the elevated access to only what is needed for this task.
Official Reference
Restore deleted Active Directory objects — permissions required — https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/adac/introduction-to-active-directory-administrative-center-enhancements--level-100-#active-directory-recycle-bin