Microsoft AZ-800 Exam With Confidence Using Practice Dumps

In Azure File Sync architecture (covered in Administering Windows Server Hybrid Core Infrastructure under “Implement and manage storage solutions”), the fundamental design points are:

Sync group – “A sync group defines a sync topology. Each sync group contains exactly one cloud endpoint (an Azure file share) and one or more server endpoints.” A server endpoint is a folder on a registered Windows Server. A server can participate in multiple sync groups so long as the server endpoints are different paths.

Storage Sync Service – “The Storage Sync Service is the top-level resource that maintains server registrations and houses your sync groups.” A Windows Server registers to one Storage Sync Service at a time, and that service can contain many sync groups and many servers.

Applying these rules to the requirement:

You have three Azure file shares: newyorkfiles, seattlefiles, and companyfiles. Because each sync group maps to one cloud endpoint, you need one sync group per share ⇒ 3 sync groups.

FS1 must sync with newyorkfiles and companyfiles; FS2 must sync with seattlefiles and companyfiles. Since one Storage Sync Service can host multiple sync groups and multiple servers, and a server must be registered to a single service, the most efficient design is a single Storage Sync Service containing all three sync groups and both servers.

 When User1 connects to \\Server1\Share1\, the user can take ownership of File1.txt. No

 When User2 connects to \\Server1\Share1\, File1.txt is visible. Yes

 When User3 connects to \\Server1\Share1\, File1.txt is visible. No

In Windows file sharing, the effective permission over SMB is the most restrictive result of share and NTFS permissions. The study guides emphasize that “share permissions cap what NTFS can allow when access is via the share” and that Access-Based Enumeration (ABE) hides items that the user cannot read. In the exhibit, the share permission grants Domain Users = Change, Read (no Full Control). NTFS on File1.txt grants User1 = Full control, User2 = Read, User3 = Write.

User1: Although NTFS grants Full control (which includes Change permissions/Take ownership), the share grants only Change, which does not include taking ownership. Because share permissions limit SMB access, User1 cannot take ownership when connecting through \\Server1\Share1\.

User2: Has Read on the file and the share allows Read; with ABE enabled on the share, items for which the user has at least read access remain visible. Therefore File1.txt is visible to User2.

User3: Has Write (no Read) on the file; with ABE, objects without read permission are hidden during enumeration. Even though the share allows Change/Read in general, the absence of NTFS Read on the file means File1.txt will not be visible to User3.

The Administering Windows Server Hybrid Core Infrastructure content notes that Microsoft Entra Connect cloud sync uses lightweight agents and supports synchronizing specific OUs from multiple forests into a single tenant. The guide highlights that cloud sync “is designed for multi-forest or cross-organization scenarios and allows scoping to selected OUs and groups,” enabling granular onboarding of just the identities you need. The requirement says “the users in the Marketing OU (in Fabrikam’s forest) must have access to storage1.” Granting access to Azure Files using Entra-based authorization requires that those users exist in the same Entra tenant. Cloud sync enables importing only the Fabrikam Marketing OU into A. Datum’s tenant without establishing full trust for all users. Azure AD Connect in active or staging mode would target the A. Datum forest and isn’t intended for selectively bringing in a separate partner forest OU; AD FS is a federation solution and does not create tenant objects for ACLs on Azure resources like Azure Files. Therefore, implement Microsoft Entra Connect cloud sync and scope it to the Marketing OU to meet the requirement.