EnglishDeutschFrançaisEspañolPortuguês

Microsoft · AZ-800 · Associate

Administering Windows Server Hybrid Core Infrastructure (AZ-800) — Practice Questions and Mock Exam

Practice with realistic AZ-800 questions aligned to the exam objectives. Alex explains every answer, and your readiness score shows what to study next.

Start practicing AZ-800 freeBuy AZ-800 access for $29.99
Buy AZ-800 access for $29.99Start practicing AZ-800 free

One payment. Lifetime access to this certification.

Try 5 questions first →
50Questions
100minTime Limit
700/ 1000Pass Score

Checked against Microsoft · August 2026

Overview

About the exam

The AZ-800 certification validates skills in deploying and managing Windows Server core infrastructure in on-premises and hybrid environments. It covers Active Directory Domain Services, DNS, DHCP, Group Policy, Hyper-V, Windows Server storage, and Azure hybrid integration including Azure Arc, Azure File Sync, and Azure Backup. This is one of two exams required for the Windows Server Hybrid Administrator Associate certification.

This certification is designed for experienced Windows Server administrators who manage hybrid environments spanning on-premises datacenters and Azure. Candidates should have strong experience with Windows Server 2019/2022, Active Directory, and networking, plus familiarity with integrating on-premises infrastructure with Azure services.

Exam domains

What's on the exam

Active Directory Domain Services dominates at 30–35%: domain controllers on-premises and in Azure, read-only domain controllers and FSMO roles, trusts, sites and replication, security principals and service accounts, hybrid identity through Entra Connect Sync and Cloud Sync, and Group Policy. The other four areas land in narrow bands — virtual machines and containers, hybrid networking, and storage and file services at 15–20% each, hybrid server management at 10–15%.

The shape says this is an identity exam with a server-administration exam wrapped around it: a third of the questions sit in AD DS alone, and hybrid identity is inside that domain rather than beside it. The smallest area, remote and Azure-based management, is also the one that supplies the tooling the other domains assume you already use — Windows Admin Center, Azure Arc, Azure Update Manager.

Exam blueprint: AZ-800

Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments30–35%

Deploy and manage AD DS domain controllers (on-premises, Azure, RODCs, FSMO roles), configure multi-site/multi-domain/multi-forest environments (trusts, sites, replication), create and manage AD DS security principals (users, groups, service accounts), implement and manage hybrid identities (Entra Connect Sync/Cloud Sync, Entra Domain Services, staged rollout), and manage Windows Server using Group Policies

≈ 17 h
Manage Windows Servers and workloads in a hybrid environment10–15%

Configure remote management (Windows Admin Center, PowerShell remoting, JEA, SSH, RDP) and manage servers using Azure services (Azure Arc, Azure Machine Configuration, VM extensions, Azure Update Manager, Azure Automation)

≈ 6 h
Manage virtual machines and containers15–20%

Manage Hyper-V and guest VMs (Enhanced session mode, nested virtualization, VM memory, integration services, checkpoints, virtual hard disks, network adapters, guarded fabric/shielded VMs), create and manage containers (Windows Server container host, Linux containers, container images, networking, AKS on Windows Server), and manage Windows Server VMs on Azure (storage, capacity, availability, JIT access, Bastion)

≈ 9 h
Implement and manage an on-premises and hybrid networking infrastructure15–20%

Implement name resolution (DNS with AD DS, zones/records, forwarding, Azure DNS integration, DNS policies, DNSSEC), manage IP addressing (IPAM, DHCP, scopes, reservations, high availability), and implement network connectivity (Remote Access, Azure Network Adapter, VPN, Azure Relay, Entra Private Access, Application Proxy)

≈ 9 h
Manage storage and file services15–20%

Configure and manage Azure Files (file shares, permissions, Azure File Sync, DFS migration), Windows Server file shares (access, FSRM, BranchCache, DFS, SMB over QUIC), and Windows Server storage (disks/volumes, Storage Spaces, Storage Replica, Data Deduplication, SMB direct, Storage QoS, iSCSI)

≈ 10 h

Format

Exam format and question types

The exam consists of 40–60 questions to be completed in approximately 100 minutes. Question types include multiple-choice, multiple-select, drag-and-drop, and hot area formats. Questions test both traditional Windows Server administration and hybrid integration with Azure services. Expect PowerShell commands for server management and Azure Arc onboarding scenarios throughout the exam.

Question types: AZ-800

Multiple Choice48%

Pick the single best answer from four or five options — the exam's bread and butter.

Ordering12%

Put the steps of a process into the correct sequence — typically deployment or troubleshooting workflows.

Drag & Drop12%

Drag items into the right slot, group or order — it tests whether you can apply a concept, not just recognise it.

Multiple Response10%

More than one answer is correct and you need all of them; the question tells you how many to pick.

Dropdown10%

Complete a statement or a configuration by picking from dropdown menus inside the text.

True / False8%

Judge a single statement as true or false — quick points, but the exact wording decides.

Microsoft confirms these question types — a percentage split is not published; the shares reflect our exam-aligned question pool.

Try it now

Try five AZ-800 questions

Five questions straight from our Administering Windows Server Hybrid Core Infrastructure pool. Answer one — Alex explains the why.

Manage virtual machines and containers1 / 5

You are configuring Windows Server Failover Clustering for a two-node Hyper-V cluster. Which quorum configuration is recommended for a two-node cluster?

AlexFull explanation from Alex

For a two-node cluster, Microsoft recommends using a witness (file share or cloud witness) to establish quorum. With only two nodes, losing one means no majority exists without a tiebreaker. A file share witness adds a third vote, enabling the cluster to survive a single node failure (Microsoft Learn: quorum witness). 'Node and Disk Majority' requires shared storage and uses a disk witness—valid but not the recommended default. 'No majority: disk only' is a legacy model with no fault tolerance. 'Node majority only' requires an odd number of nodes (3+) and cannot provide resilience with two nodes. Every production cluster should use a witness.

Sourcelearn.microsoft.com

Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments2 / 5

When a GPO link is set to Enforced, the GPO settings can still be blocked by the Block Inheritance property on a child OU.

AlexFull explanation from Alex

Per Microsoft docs, an Enforced GPO link overrides Block Inheritance—always. When a GPO link is set to Enforced, its settings apply to all child containers regardless of whether Block Inheritance is enabled. This is by design so critical policies (security baselines, compliance mandates) cannot be bypassed by lower-level administrators. The statement is False because the entire purpose of Enforced is to prevent Block Inheritance from filtering it out. GPO processing follows LSDOU order (Local → Site → Domain → OU), and these override mechanisms provide precise control over policy application hierarchy.

Sourcelearn.microsoft.com

Implement and manage an on-premises and hybrid networking infrastructure3 / 5

Which tool in the DNS Server console allows you to configure DNS server-level forwarders that handle queries the local server cannot resolve?

AlexFull explanation from Alex

DNS server-level forwarders are configured via the Forwarders tab in DNS server Properties (Microsoft Learn). In DNS Manager, right-click the server → Properties → Forwarders tab. Server-level forwarders handle all queries the server cannot resolve locally. The resolution flow is: local zones → forwarders → root hints (fallback if forwarders fail). Conditional forwarders (configured separately as zones) forward only queries for specific domains. Multiple forwarders can be added for redundancy. This is distinct from root hints configuration, which is on a separate tab in the same Properties dialog.

Sourcelearn.microsoft.com

Manage Windows Servers and workloads in a hybrid environment4 / 5

Windows Admin Center in the Azure portal connects to Arc-enabled servers without requiring any inbound firewall ports. How does this connection work?

AlexFull explanation from Alex

Windows Admin Center in Azure connects to Arc-enabled servers via the Arc agent's outbound HTTPS connection, which establishes a reverse proxy session with the Azure Arc service — no inbound firewall ports required. The Arc agent initiates an outbound connection to Azure, and the service tunnels management traffic back through this channel. Why other options are wrong: VPN/ExpressRoute is not used — the connection works over standard outbound HTTPS. WinRM is not forwarded directly over port 443 to the Azure portal — the traffic is proxied through the Arc service. Azure Relay is not used, and RDP port 3389 is not involved — this is a management channel, not an RDP session. This design eliminates inbound port requirements, reducing the attack surface. (Ref: learn.microsoft.com/azure/azure-arc/servers/manage-vm-extensions-portal)

Sourcelearn.microsoft.com

Manage storage and file services5 / 5

Which Windows Server feature provides file-level replication between servers using Remote Differential Compression (RDC) to transfer only changed portions of files?

AlexFull explanation from Alex

DFS Replication (DFS-R) provides multi-master, file-level replication using Remote Differential Compression (RDC). RDC divides files into blocks and transfers only changed blocks, minimizing WAN bandwidth. Supports replication schedules, bandwidth throttling, and conflict resolution (last-writer-wins). Used for branch office file sync and SYSVOL replication. Why others are wrong: Azure File Sync is a cloud-tiering service—does not use RDC. Storage Replica provides block-level replication for disaster recovery, not file-level RDC. BranchCache caches content locally—a caching optimization, not replication. Ref: learn.microsoft.com/windows-server/storage/dfs-replication/dfsr-faq.

Sourcelearn.microsoft.com

Question pool

306 questions, built like the exam

Every domain of the AZ-800 exam has enough questions in the pool to practice it in depth. A mock exam asks 50 questions in one sitting, on the same 100-minute clock as the real thing.

Audit record: AZ-800

Spec check against MicrosoftAugust 28, 2026

last verified against the official Microsoft source

Pass mark700 / 1,000

as published by Microsoft

Blueprint coverage117 official objectives

across 5 domains, from the official exam guide

Pool size306 questions

= 6 full practice exams of 50 questions each — never the same question twice

Domain coverageall 5 domains at official weight

Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments 88 · Manage Windows Servers and workloads in a hybrid environment 31 · Manage virtual machines and containers 52 · Implement and manage an on-premises and hybrid networking infrastructure 57 · Manage storage and file services 78

Canonically validated306 of 306

each verified against official Microsoft documentation — answer, options and explanation, source cited

Methodology openly documented.How questions are made →

Planning

Preparing for AZ-800

How long you'll need depends on how much hands-on experience you bring. The rest is set by the vendor: how the exam is delivered, how soon you can retake it, and how long the credential stays valid.

Delivered via Pearson VUE online or at testing centers. Available in English, Japanese, Chinese (Simplified), German, French, Spanish, and Portuguese (Brazil). The certification is valid for 1 year with a free renewal assessment on Microsoft Learn. Microsoft has announced that AZ-800 and AZ-801 retire on 30 September 2026.

Your plan: AZ-800

Preparation

Study time30–75 h

typically around 30 h if you already work with this stack, around 75 h coming to it fresh

LevelAssociate

Exam day & after

DeliveryPearson VUE online proctored or at authorized testing centers worldwide
Retake policy24-hour wait after the first attempt, 14 days between subsequent attempts, maximum 5 attempts per exam within a 12-month period
Stays valid1 year

Free renewal assessment on Microsoft Learn, available starting 6 months before expiration. Must be completed before the certification expires.

Official guideView on vendor site

The hours are our own planning estimate — Microsoft publishes no preparation time for this exam. A starting point for your calendar, not a target.

Watch out

Common pitfalls

This exam bridges on-premises Windows Server with Azure hybrid services. Candidates who only know traditional infrastructure or only cloud often struggle with questions that test both environments together.

Watch list: AZ-800

  1. 01AD DS Design

    Not understanding multi-domain, multi-forest Active Directory designs including trust relationships and sites configuration.

  2. 02Azure Arc Integration

    Struggling with Azure Arc-enabled servers setup, policies, and how they extend Azure management to on-premises infrastructure.

  3. 03Storage Spaces Direct

    Confusing Storage Spaces Direct (S2D) configurations, volume creation, and failover clustering for hyper-converged scenarios.

  4. 04Group Policy

    Overlooking GPO inheritance, blocking, enforcement, and WMI filtering details that are frequently tested.

  5. 05DNS Configuration

    Not mastering conditional forwarders, stub zones, and DNS integration between on-premises and Azure Private DNS zones.

Pass-IT trains you on exactly these weak spots — adaptive & spaced →

Questions

Frequently asked questions

How long is the Administering Windows Server Hybrid Core Infrastructure exam?

The AZ-800 exam has 50 questions and a 100-minute time limit.

What is the passing score for Administering Windows Server Hybrid Core Infrastructure?

You need 700 / 1000 to pass the AZ-800 exam.

What are common mistakes on the Administering Windows Server Hybrid Core Infrastructure exam?

Common pitfalls include: AD DS Design, Azure Arc Integration, Storage Spaces Direct, Group Policy, DNS Configuration. Focus study time on these areas to avoid losing points.

When does AZ-800 retire?

Microsoft retires AZ-800 and AZ-801 together on 30 September 2026, and our catalog carries that date on both pages. It records no successor exam code for either of them.

What happens to your AZ-800 certification once the exam retires?

The certification is valid for one year from the day you pass, and Microsoft renews it through a free assessment on Microsoft Learn that opens six months before your expiry date. Our catalog records the retirement of the exams and does not record the certification or its renewal assessment retiring with them. That distinction decides whether an existing credential can still be renewed, so the date to plan against is the expiry date on your own Microsoft Learn transcript.

Is AZ-800 still worth sitting before it retires?

AZ-800 alone does not produce a certification, because the Windows Server Hybrid Administrator Associate credential needs AZ-801 as well, and each exam carries a 50-hour budget. The real question is therefore whether 100 hours fits before 30 September 2026, and if it does not, those hours buy more in an exam that is not already dated.

Do you need AZ-801 as well as AZ-800?

Yes, for the certification. AZ-800 and AZ-801 are the two exams that together produce the Windows Server Hybrid Administrator Associate credential, and neither is a prerequisite for the other. AZ-800 covers standing the infrastructure up, while AZ-801 covers securing, migrating and monitoring it.

Which AZ-800 topics carry the most marks?

Active Directory Domain Services is the dominant area at roughly a third of the exam, with storage and file services near 19% and virtual machines and containers and hybrid networking around 18% each. Hybrid server management is the smallest at about 12%. Microsoft publishes these as bands rather than fixed numbers, so treat them as proportions and not as a scoring formula.

Pass-IT is an independent study tool, not affiliated with or endorsed by Microsoft; Microsoft and exam names are trademarks of their respective owners.

One certification. One payment.

Full AZ-800 access

Get the full question pool for this certification. Alex explains every answer, and your readiness score shows what to work on next.

Buy AZ-800 access for $29.99One payment. Lifetime access to this certification.
Take the free readiness check20 questions. No card. See what to study before you buy.

Reach 80% readiness and pass — or your money back.

How the score works →

Related guides

and AZ-801 Retire Sept 30: Switch to AZ-802?

Related certifications

Administering Information Security in Microsoft 365Administering Microsoft Azure SQL SolutionsAdministering Windows ServerCollaboration Communications Systems EngineerAll Microsoft certifications →