Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-800 Syllabus Exam Questions Answers

The AZ-800 materials discuss options for migrating on-premises workloads to Azure when IP address preservation is required and subnet overlaps exist across a Site-to-Site VPN. The guidance explains that Azure Extended Network allows you to “stretch an on-premises subnet into Azure so a VM can retain its original IP address after migration” and that it is specifically intended to “avoid renumbering during lift-and-shift scenarios where overlapping address space or application dependencies prevent changing IPs.” In contrast, services like VNet peering or Application Gateway do not solve overlapping address space or IP preservation for a VM, and NAT in a VNet translates traffic but does not allow the VM to keep its original IP address. The hybrid curriculum highlights that Extended Network “minimizes administrative effort by maintaining existing addressing and DNS records during migration,” which matches the requirement to migrate the on-premises VM to Azure without modifying the IP address and with minimal changes to the environment. Therefore, implementing Azure Extended Network before the migration is the correct and least-effort solution.

The Azure File Sync design guidance in Administering Windows Server Hybrid Core Infrastructure explains that a sync group defines one sync topology and is anchored by exactly one cloud endpoint (an Azure file share) . The material states: “Each sync group contains a single cloud endpoint… Additional Azure file shares must be plac ed in separate sync groups.” Consequently, after Group1 uses share1 as its cloud endpoint, share2 cannot be added to the same sync group , which makes the first statement No .

For server endpoints, the guide notes: “A server endpoint represents a specific pa th on a registered Windows Server… A server can host multiple server endpoints, including in the same sync group, provided paths don’t overlap (no parent/child or identical paths).” Because D:\Folder1 is already in Group1, adding E:\Folder2 from the same S erver1 is supported and non-overlapping, so the second statement is Yes .

Finally, multi-server synchronization is a core capability: “Multiple servers can be added as server endpoints to the same sync group to enable branch-to-branch and server-to-cloud sy nc; contents are merged in the Azure file share namespace.” Therefore, adding D:\Data from Server2 as another server endpoint in Group1 is fully supported, making the third statement Yes .

These rules satisfy the scenario: one cloud endpoint per sync group, multiple non-overlapping server endpoints (including multiple from the same server), and multi-server participation in the same group.

 Obtain and install a new certificate.

 Copy the certificate thumbprint.

 Run Windows Admin Center Setup and select Change.

According to the official study guides for Administering Windows Server Hybrid Core Infrastructure , maintaining the security of the Windows Admin Center (WAC) gateway is a critical administrative task, especially regarding SSL/TLS certificate management. When a certifi cate used by Windows Admin Center expires or needs to be replaced, the process follows a specific sequence to ensure service continuity and secure connectivity.

First, you must obtain and install a new certificate from a trusted Certificate Authority (CA). The certificate must be installed into the local machine ' s certificate store on the server where Windows Admin Center is running. Once installed, you must copy the certificate thumbprint . The thumbprint is a unique hexadecimal string that identifies the s pecific certificate; it is required by the WAC installer to bind the gateway service to the correct cryptographic object.

Finally, you must run Windows Admin Center Setup and select Change . Unlike standard web applications managed through Internet Informat ion Services (IIS), Windows Admin Center uses its own specialized installer logic to handle port bindings and certificate associations. By selecting the " Change " option in the setup wizard (accessible via Add/Remove Programs or the original .msi file), the administrator is prompted to enter the new certificate thumbprint. The installer then updates the HTTPS listener configuration to use the new certificate. Note that " Repair " or " Remove " are incorrect as they do not allow for the reconfiguration of the cer tificate binding, and WAC does not typically use the standard IIS Manager for its core gateway service binding.