Microsoft AZ-800 Based on Real Exam Environment

The Hyper-V networking section of the Administering Windows Server Hybrid Core Infrastructure material explains that Hyper-V provides three virtual switch types: External, Internal, and Private. It states: “An External switch is bound to a physical NIC and can optionally connect the management OS; an Internal switch connects VMs to each other and to the host only; a Private switch connects VMs to each other only (no host access).” The guide further clarifies limits on external switches: “A single physical adapter can be bound to only one External virtual switch at a time (unless using NIC Teaming). Additional External switches require additional physical adapters.”

In the exhibit, Server1 has a single NIC already bound to vSwitch3, and the tree shows ‘Microsoft Hyper-V Network Adapter’, indicating the management OS shares the adapter. Therefore, you cannot add another External switch with the lone NIC; you can still create Internal and Private switches.

Regarding host connectivity, the guide specifies: “The management OS can communicate with VMs attached to an Internal switch and to an External switch (when the management OS is connected). The host cannot communicate with VMs on a Private switch.” Consequently, Server1 can access network shares only from VMs on vSwitch2 (Internal) or vSwitch3 (External with management OS), but not from VMs on vSwitch1 (Private).

Infrastructure documents: =

In the Windows Server DNS guidance for hybrid core infrastructure, Microsoft specifies that forwarders send “all queries for names that the DNS server cannot resolve locally to a designated upstream server,” while conditional forwarders target “queries for a specific DNS domain to one or more authoritative DNS servers for that domain.” When a branch office DNS server must resolve a partner/remote domain hosted elsewhere in the organization and you cannot change the authoritative server, the recommended pattern is to configure a conditional forwarder on the branch server pointing to the remote authoritative server. For Internet name resolution, you configure a standard forwarder to the required recursive resolver IP.

Applied here: New York clients use Server2. To resolve contoso.com (hosted on Server1), create a conditional forwarder on Server2 for contoso.com that points to 10.1.1.1 (Server1). To meet the requirement to forward all other external lookups, configure a forwarder on Server2 to 131.107.100.200. This design avoids zone transfers or changes on Server1 and fulfills both name-resolution requirements with minimal administration.

 When User1 connects to \\Server1\Share1\, the user can take ownership of File1.txt. No

 When User2 connects to \\Server1\Share1\, File1.txt is visible. Yes

 When User3 connects to \\Server1\Share1\, File1.txt is visible. No

In Windows file sharing, the effective permission over SMB is the most restrictive result of share and NTFS permissions. The study guides emphasize that “share permissions cap what NTFS can allow when access is via the share” and that Access-Based Enumeration (ABE) hides items that the user cannot read. In the exhibit, the share permission grants Domain Users = Change, Read (no Full Control). NTFS on File1.txt grants User1 = Full control, User2 = Read, User3 = Write.

User1: Although NTFS grants Full control (which includes Change permissions/Take ownership), the share grants only Change, which does not include taking ownership. Because share permissions limit SMB access, User1 cannot take ownership when connecting through \\Server1\Share1\.

User2: Has Read on the file and the share allows Read; with ABE enabled on the share, items for which the user has at least read access remain visible. Therefore File1.txt is visible to User2.

User3: Has Write (no Read) on the file; with ABE, objects without read permission are hidden during enumeration. Even though the share allows Change/Read in general, the absence of NTFS Read on the file means File1.txt will not be visible to User3.

To ensure that all objects, specifically Computer1, can be used in Conditional Access (CA) policies, the environment must support device-based identity in the cloud. In a hybrid scenario, while user objects and security groups (like Group1 and Group2) can be synchronized through standard Azure AD Connect (Microsoft Entra Connect) synchronization cycles, computer objects require specific configuration to become "identifiable" by Conditional Access.

According to the official study guides for the AZ-800 exam, simply syncing a computer object does not make it a "Hybrid Azure AD joined" device. To enable Computer1 to be used as a target or a condition (e.g., "Require Hybrid Azure AD joined device") in a CA policy, you must run the Azure AD Connect wizard and select the Configure Hybrid Azure AD join task. This process configures a Service Connection Point (SCP) in your on-premises Active Directory, which allows Windows 10/11 devices like Computer1 to discover the Azure AD tenant and complete the registration process.

Furthermore, while group scopes (Universal vs. Domain Local) are often discussed in sync scenarios, Azure AD Connect by default synchronizes security groups regardless of their scope if they are within the synchronized Organizational Units (OUs). Therefore, the critical step to satisfy the requirement for "all objects"—especially the computer account—is enabling the Hybrid Join feature to establish a cloud-side device identity. This provides the necessary "device signal" that Conditional Access evaluates to grant or deny access.