Changed AZ-800 Exam Questions

In the Administering Windows Server Hybrid Core Infrastructure materials for managing hybrid servers with Azure Arc, Microsoft describes two primary, supported ways to deliver Desired State Configuration at scale: Azure Automation State Configuration and Azure Policy Guest Configuration. For large fleets of Arc-enabled servers, the guidance emphasizes that Guest Configuration uses DSC resources and content that is packaged and then assigned by Azure Policy, removing the need to stand up or manage a pull server. The study content explains that Guest Configuration “audits and (with remediation) configures the inside of machines using DSC resources” and that you deliver it by creating or using a policy definition that references your guest configuration package, so compliance and remediation happen through policy assignment. This approach is highlighted as the lowest-overhead method for Arc servers because policy assignments can be targeted to subscriptions, resource groups, or Arc-enabled machines, providing uniform roll-out and governance with minimal administration.

The same materials note that Automation State Configuration requires onboarding nodes to an Automation account and managing configurations there, which adds extra setup for non-Azure VMs. In contrast, with Arc + Guest Configuration, the DSC content is stored/referenced in the Azure Policy definition and enforced by the Guest Configuration extension, enabling you to apply and remediate configurations at scale with Azure Policy, which best meets the requirement to minimize administrative effort across 500 Arc-enabled Windows Server machines joined to the on-premises domain.

In Windows Server container deployments, the isolation mode determines kernel compatibility between the host and the container image. The Administering Windows Server Hybrid Core Infrastructure materials explain that Windows Server containers using process isolation share the host kernel and therefore require the container image to match the host’s OS version/build. The guide contrasts this with Hyper-V isolation, stating that each container runs inside a lightweight utility VM: “Hyper-V isolated containers do not share the host kernel; they provide a separate kernel instance, allowing containers built on a different Windows build (or earlier Windows Server version) to run on a newer host.”

Because Host1 is Windows Server 2022 and image1 is based on Windows Server 2019, process isolation would fail due to the version mismatch. The documented remediation is to start the container with Hyper-V isolation, which decouples the container from the host’s kernel requirements. The study guide shows this operationally with Docker: “Use docker run … --isolation=hyperv when the container base image version differs from the host.”

Therefore, to successfully start the container on Host1, you must use the Docker CLI with Hyper-V isolation:

Docker run -d --isolation=hyperv image1.

Within the Manage AD DS operations master roles (FSMO) section of the AZ-800 materials, Microsoft documents multiple supported methods to identify role holders. The guidance states that the command-line utility NETDOM can enumerate all FSMO roles with: netdom query fsmo. The output lists the Schema Master, Domain Naming Master, RID Master, PDC Emulator, and Infrastructure Master, each with the current role holder’s FQDN. The course notes emphasize that this method is fast, non-interactive, and does not require specific MMC snap-ins, making it suitable for both Server Core and remote administration scenarios. Because the command returns the PDC Emulator holder explicitly in its results, running netdom.exe query fsmo does meet the goal of identifying which server is the PDC Emulator for the domain. This aligns with best practices for quick verification of FSMO placement during operations such as time service verification, password update convergence checks, or when planning FSMO transfers and seizures.

The Administering Windows Server Hybrid Core Infrastructure learning path explains that onboarding Windows Server machines to Azure Monitor hinges on a Log Analytics workspace as the data store for logs and metrics, and an agent on the machine to collect and send data. The guide states that “Azure Monitor collects telemetry from Windows Server machines into a Log Analytics workspace,” and that for current deployments you should “install the Azure Monitor agent (AMA) on each computer and associate it with a workspace.” It further notes that “the AMA replaces the legacy Log Analytics agent” and “uses data collection rules (DCRs) to define which data to collect and to which Log Analytics workspace to send it.” Storage accounts, SQL databases, or analytics gateways are not required to onboard a standalone Windows Server to Azure Monitor. Likewise, Device Health Attestation is unrelated to Azure Monitor onboarding.

In short, to monitor an on-premises Windows Server from Azure you create a Log Analytics workspace in the subscription and install the Azure Monitor agent on the server. (In practice, you then configure a DCR to route data from the AMA to the workspace, but no additional Azure resources like SQL or Blob/Azure Files are needed for basic monitoring.)