Online Access Free AZ-801 Practice Test

You have an Azure subscription. The subscription contains 100 virtual machines that run Windows Server
2025.
You plan to implement data collection rules (OCRs) in Azure Monitor to collect Application logs and System logs from the virtual machines.
You need to filter the events collected based on custom criteria.
Which query language should you use?

• A.WQL
• B.XPath
• C.KQL
• D.LINQ

You have a Site-to-Site VPN between an on-premises network and an Azure VPN gateway. BGP is disabled for the Site-to-Site VPN.
You have an Azure virtual network named Vnet1 that contains a subnet named Subnet1. Subnet1 contains a virtual machine named Server1.
You can connect to Server1 from the on-premises network.
You extend the address space of Vnet1. You add a subnet named Subnet2 to Vnet1. Subnet2 uses the extended address space. You deploy an Azure virtual machine named Server2 to Subnet2.
You cannot connect to Server2 from the on-premises network. Server1 can connect to Server2.
You need to ensure that you can connect to Subnet2 from the on-premises network.
What should you do?

• A.Update the routing information on the on-premises routers.
• B.To Subnet2. add a route table that contains a user-defined route.
• C.Add a private endpoint to Subnet2.
• D.Add an additional Site-to-Site VPN between the on-premises network and Vnetl.

You have an Azure subscription that contains an Azure key vault named Vault1.
You plan to deploy a virtual machine named VM1 that will run Windows Server.
You need to enable encryption at host for VM1. The solution must use customer-managed keys.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Correct Answer:

Explanation:
CORRECTED ANSWER: 1. Create a disk encryption set and generate RSA keys. 2. Grant Vault1 the managed identity permission for the disk encryption set. 3. Create VM1 and associate the disks of the virtual machine with the disk encryption set.
Detailed Explanation
To enable encryption at host on a new Windows Server VM using a customer-managed key, you first create a disk encryption set that references (or generates) an RSA key in Vault1; creating the disk encryption set automatically provisions its own system-assigned managed identity, so no identity needs to be manually enabled on VM1 itself. You then grant that disk encryption set ' s managed identity the necessary key permissions on Vault1 (get, wrap key, unwrap key) so it is authorized to use the customer-managed key. Only after the encryption set is created and authorized do you create VM1, enable encryption at host, and associate its OS/data disks with the disk encryption set, which is what actually applies customer-managed-key encryption to the VM ' s disks and host cache/temp storage. Assigning the Virtual Machine Contributor role to a managed identity plays no part in this key-management workflow.
Official Reference
Enable end-to-end encryption using encryption at host - https://learn.microsoft.com/en-us/azure/virtual- machines/disks-enable-host-based-encryption-portal

You have an Azure virtual machine named VM1.
You enable Microsoft Defender SmartScreen on VM1.
You need to ensure that the SmartScreen messages displayed to users are logged.
What should you do?

• A.From the local Group Policy, modify the Advanced Audit Policy Configuration settings.
• B.From Event Viewer, enable the Debug log.
• C.From the Windows Security app. configure the Virus & threat protection settings.
• D.From a command prompt, run WinRM quickconfig.

You have an Azure Active Directory Domain Services (Azure AD DS) domain named aadds.contoso.com.
You have an Azure virtual network named Vnet1. Vnet1 contains two virtual machines named VM1 and VM2 that run Windows Server. VMI and VM2 are joined to aadds.contoso.com.
You create a new Azure virtual network named Vnet2. You add a new server named VM3 to Vnet2.
When you attempt to join VM3 to aadds.contoso.com, you get an error message that the domain cannot be found.
You need to ensure that you can join VM3 toaadds.contoso.com.

Correct Answer:

Explanation:
CORRECTED ANSWER: Network configuration: Configure virtual network peering between Vnet1 and Vnet2. DNS configuration: Add a custom DNS server to Vnet2.
Detailed Explanation
Microsoft Entra Domain Services deploys its domain controllers into a specific virtual network - here, Vnet1, where VM1 and VM2 already join successfully - so a VM in any other virtual network, such as Vnet2, first needs network-layer reachability to that VNet, which is established by configuring virtual network peering between Vnet1 and Vnet2. Peering alone does not fix name resolution, however: Microsoft ' s documented configuration for a peered VNet is to switch its DNS servers setting from Azure-provided DNS to custom DNS servers pointing at the managed domain ' s domain controller IP addresses, which is exactly what lets VM3 resolve and locate aadds.contoso.com. Simply adding a subnet to Vnet1, or linking Vnet2 to an Azure private DNS zone, does not by itself give VM3 a network path plus correct DNS resolution to the managed domain ' s actual domain controllers.
Official Reference
Tutorial: Configure virtual networking for Microsoft Entra Domain Services - https://learn.microsoft.com
/en-us/entra/identity/domain-services/tutorial-configure-networking