Microsoft · AZ-801 · Associate

Configuring Windows Server Hybrid Advanced Services (AZ-801) — Practice Questions and Mock Exam

Name: Pass-IT
Author: Pass-IT

Practice with realistic AZ-801 questions aligned to the exam objectives. Alex explains every answer, and your readiness score shows what to study next.

Start practicing AZ-801 free Buy AZ-801 access for $29.99

Buy AZ-801 access for $29.99 Start practicing AZ-801 free

One payment. Lifetime access to this certification.

Try 5 questions first →

50Questions

100minTime Limit

700/ 1000Pass Score

Checked against Microsoft · August 2026

Overview

About the exam

The AZ-801 certification validates advanced skills in securing, managing, and monitoring Windows Server environments in hybrid configurations. It covers Windows Server security, high availability and disaster recovery, server migration using Azure Migrate, monitoring with Azure Monitor, and troubleshooting across on-premises and Azure environments. This is one of two exams required for the Windows Server Hybrid Administrator Associate certification.

This certification is designed for senior Windows Server administrators who secure and optimize hybrid infrastructure. Candidates should already have the core infrastructure skills validated by AZ-800 and need experience with advanced security hardening, failover clustering, Azure Site Recovery, and enterprise monitoring solutions.

Exam domains

What's on the exam

Securing Windows Server on-premises and hybrid infrastructures is the largest area at 25–30%, spanning OS hardening (Application Control, Credential Guard, SmartScreen, OSConfig, Windows LAPS), hybrid Active Directory hardening, Defender for Identity and Defender for Cloud, firewall and domain isolation, and BitLocker and Azure Disk Encryption. Migrating servers and workloads follows at 20–25%, then high availability and monitoring/troubleshooting at 15–20% each, and disaster recovery at 10–15%.

AZ-801 is the second half of the Windows Server Hybrid Administrator pair and its weighting shows it: nothing here is about standing a server up, everything is about keeping one alive, moving it, or locking it down. Migration being the second-largest domain is the surprise — Storage Migration Service, Azure Migrate and AD forest restructures are worth more of the exam than failover clustering.

Exam blueprint: AZ-801

Secure Windows Server on-premises and hybrid infrastructures25–30%

Secure Windows Server OS (Exploit Protection, Windows Defender Application Control, Credential Guard, SmartScreen, Group Policies, OSConfig, Windows LAPS), secure hybrid Active Directory (password policies, Entra Password Protection, protected users, RODC security, Defender for Identity, NTLM), remediate security issues with Azure services (Sentinel, Defender for Cloud/Servers), secure networking (Windows Defender Firewall, domain isolation, connection security rules, NSGs), and secure storage (BitLocker, Azure Disk Encryption)

≈ 14 h

Implement and manage Windows Server high availability15–20%

Implement Windows Server failover clusters (on-premises/hybrid/cloud, workgroup clusters, stretch clusters, S2D campus clusters, storage/quorum/network configuration, cluster-aware updating, Scale-Out File Servers, Azure witness), manage failover clustering (cluster-aware updating, node recovery/upgrade, workload failover, Windows Admin Center), and implement Storage Spaces Direct (S2D node upgrade, networking, configuration)

≈ 9 h

Implement disaster recovery10–15%

Manage backup and recovery for Windows Server (Azure Recovery Services Vault, Azure Backup Server, backup policies, VM recovery including encrypted VMs), implement disaster recovery with Azure Site Recovery (network mapping, on-premises/Azure VM configuration, recovery plans, replication), and protect VMs using Hyper-V replicas (host configuration, VM replication, failover)

≈ 6 h

Migrate servers and workloads20–25%

Migrate on-premises storage (Storage Migration Service, Azure file shares), migrate servers using Azure Migrate (appliance deployment, VM/physical server migration), migrate workloads from previous Windows Server versions (IIS, Hyper-V hosts, RDS, DHCP, print servers, in-place upgrade), migrate IIS workloads to Azure (Azure Migrate assessment, Web Apps, containers), and migrate AD forest to Windows Server 2025 (forest restructure, AD Migration Tool)

≈ 12 h

Monitor and troubleshoot Windows Server environments15–20%

Monitor using Windows Server tools and Azure services (Performance Monitor, Data Collector Sets, Windows Admin Center, System Insights, event logs, Azure Monitor DCRs/alerts, VM Insights), troubleshoot Windows Server issues (connectivity, name resolution, Windows Update, Time Service, deployment/booting failures, performance, VM/Arc extensions, disk encryption, storage), and troubleshoot Active Directory (AD recycle bin, DSRM, SYSVOL recovery, replication, hybrid auth/sync)

≈ 10 h

Format

Exam format and question types

The exam consists of 40–60 questions to be completed in approximately 100 minutes. Question types include multiple-choice, multiple-select, drag-and-drop, and hot area formats. Questions emphasize security hardening, disaster recovery configurations, and migration planning. Expect scenarios that require combining Azure services like Azure Migrate and Azure Site Recovery with on-premises Windows Server.

Question types: AZ-801

Multiple Choice48%

Pick the single best answer from four or five options — the exam's bread and butter.

Ordering12%

Put the steps of a process into the correct sequence — typically deployment or troubleshooting workflows.

Drag & Drop12%

Drag items into the right slot, group or order — it tests whether you can apply a concept, not just recognise it.

Multiple Response10%

More than one answer is correct and you need all of them; the question tells you how many to pick.

Dropdown10%

Complete a statement or a configuration by picking from dropdown menus inside the text.

True / False8%

Judge a single statement as true or false — quick points, but the exact wording decides.

Microsoft confirms these question types — a percentage split is not published; the shares reflect our exam-aligned question pool.

Try it now

Try five AZ-801 questions

Five questions straight from our Configuring Windows Server Hybrid Advanced Services pool. Answer one — Alex explains the why.

Secure Windows Server on-premises and hybrid infrastructures1 / 5

You need to ingest Windows Server security events into Microsoft Sentinel for SIEM analysis. Which component connects on-premises Windows servers to Microsoft Sentinel?

AlexFull explanation from Alex

Azure Monitor Agent (AMA) with Data Collection Rules (DCR) is the current method for ingesting Windows security events into Microsoft Sentinel from on-premises servers. AMA replaces the legacy Log Analytics agent and provides granular event filtering via DCRs. System Center Operations Manager is a monitoring platform, not a Sentinel connector. Microsoft Defender for Cloud agent provides security recommendations but is not the direct ingestion mechanism for Sentinel. Windows Event Forwarding collects events between Windows servers but does not connect directly to Sentinel. For on-premises servers, Azure Arc is required to deploy AMA and associate DCRs for Sentinel ingestion.

Sourcelearn.microsoft.com

Migrate servers and workloads2 / 5

True or False: Windows Server Migration Tools supports cross-subnet migrations starting with Windows Server 2012.

AlexFull explanation from Alex

Windows Server Migration Tools (WSMT) is a built-in feature that migrates server roles, features, OS settings, and data between servers. Starting with Windows Server 2012, WSMT supports cross-subnet migrations, enabling migration across different network boundaries. This is essential for organizations restructuring network topology during server upgrades. WSMT handles the complexity of transferring configuration and data across network segments, making it suitable for data center migrations and consolidation projects. The feature is installed via Add Roles and Features wizard or PowerShell.

Sourcelearn.microsoft.com

Monitor and troubleshoot Windows Server environments3 / 5

When troubleshooting an Azure Monitor Agent on a Windows Arc-enabled server that is not collecting performance counters, which configuration file should you verify contains CounterSet nodes?

AlexFull explanation from Alex

When troubleshooting Azure Monitor Agent on a Windows Arc-enabled server, the key configuration file is mcsconfig.lkg.xml at C:\Resources\Directory\AMADataStore\mcs\. This last-known-good configuration contains CounterSet nodes defining which performance counters are collected. If counters are missing, the DCR was not properly processed. On Azure VMs (non-Arc), the path differs: C:\WindowsAzure\Resources\AMADataStore.<VM-name>\mcs\. The other options (C:\ProgramData\AzureMonitor, C:\Program Files\Azure Monitor, C:\Windows\System32\AMAConfig) are fabricated paths that do not exist. Always verify this file exists and contains expected CounterSet definitions.

Sourcelearn.microsoft.com

Implement disaster recovery5 / 5

After a failover in Azure Site Recovery, what must you do to delete all available recovery points and finalize the failover?

AlexFull explanation from Alex

After an Azure Site Recovery failover, you must commit the failover to finalize it. Committing deletes all available recovery points and confirms the failed-over VM as the new production instance. Until committed, you can still change recovery points. 'Run a test failover' validates DR readiness without affecting production. 'Reprotect the VM' is performed after committing to enable failback replication. 'Run Complete Migration' is not an ASR failover action. Ref: learn.microsoft.com/azure/site-recovery/site-recovery-failover

Sourcelearn.microsoft.com

Question pool

363 questions, built like the exam

The AZ-801 pool covers every exam domain and keeps growing with new questions. A mock exam asks 50 questions in one sitting, on the same 100-minute clock as the real thing.

Audit record: AZ-801

Spec check against MicrosoftAugust 28, 2026

last verified against the official Microsoft source

Pass mark700 / 1,000

as published by Microsoft

Blueprint coverage134 official objectives

across 5 domains, from the official exam guide

Pool size363 questions

= 7 full practice exams of 50 questions each — never the same question twice

Canonically validated363 of 363

each verified against official Microsoft documentation — answer, options and explanation, source cited

Methodology openly documented.How questions are made →

Planning

Preparing for AZ-801

How long you'll need depends on how much hands-on experience you bring. The rest is set by the vendor: how the exam is delivered, how soon you can retake it, and how long the credential stays valid.

Delivered via Pearson VUE online or at testing centers. Available in English, Japanese, Chinese, Korean, French, German, Spanish, and more. The certification is valid for 1 year with a free renewal assessment on Microsoft Learn. Microsoft has announced that AZ-800 and AZ-801 retire on 30 September 2026.

Your plan: AZ-801

Preparation

Study time30–75 h

typically around 30 h if you already work with this stack, around 75 h coming to it fresh

LevelAssociate

Exam day & after

DeliveryPearson VUE online proctored or at authorized testing centers worldwide

Retake policy24-hour wait after the first attempt, 14 days between subsequent attempts, maximum 5 attempts per exam within a 12-month period

Stays valid1 year

Free renewal assessment on Microsoft Learn, available starting 6 months before expiration. Must be completed before the certification expires.

Official guideView on vendor site

The hours are our own planning estimate — Microsoft publishes no preparation time for this exam. A starting point for your calendar, not a target.

Watch out

Common pitfalls

This advanced exam assumes mastery of AZ-800 content. Candidates who haven't completed AZ-800 preparation first often lack the foundational knowledge needed for these more complex hybrid security and migration scenarios.

Watch list: AZ-801

01Server Hardening
Not understanding Windows Server security baselines, credential guard, and advanced threat protection configurations.
02Failover Clustering
Struggling with Windows Server Failover Clustering quorum models, witness configurations, and cluster-aware updating.
03Azure Site Recovery
Confusing Azure Site Recovery vs Azure Backup and not knowing replication, failover, and failback procedures for hybrid DR.
04Migration Planning
Overlooking Azure Migrate assessment and migration tool capabilities for physical and virtual server migrations.
05Monitoring Integration
Not configuring Azure Monitor Agent, Log Analytics workspaces, and Windows Admin Center for comprehensive hybrid monitoring.

Pass-IT trains you on exactly these weak spots — adaptive & spaced →

Questions

Frequently asked questions

How long is the Configuring Windows Server Hybrid Advanced Services exam?

The AZ-801 exam has 50 questions and a 100-minute time limit.

What is the passing score for Configuring Windows Server Hybrid Advanced Services?

You need 700 / 1000 to pass the AZ-801 exam.

What are common mistakes on the Configuring Windows Server Hybrid Advanced Services exam?

Common pitfalls include: Server Hardening, Failover Clustering, Azure Site Recovery, Migration Planning, Monitoring Integration. Focus study time on these areas to avoid losing points.

When does AZ-801 retire?

AZ-801 retires on 30 September 2026, the same day as AZ-800, and our catalog carries that date on both. No successor exam code is recorded for either of them.

Can you still renew the certification after AZ-801 retires?

The certification runs on a one-year cycle renewed through a free assessment on Microsoft Learn, which opens six months before your expiry date. Our catalog records the exams retiring and does not record the certification or its renewal assessment retiring with them, so the two dates are not the same thing. Your own expiry date sits on your Microsoft Learn transcript, and that is the one worth putting in a calendar.

Is there still a case for taking AZ-801?

Only if AZ-800 is already passed or realistically within reach, since the credential needs both exams and each carries a 50-hour budget. Sitting AZ-801 on its own before 30 September 2026 leaves you with a passed exam and no certification to show for it.

Should you take AZ-800 before AZ-801?

Microsoft sets no formal prerequisite, so either order can be booked. AZ-801 assumes the core infrastructure material that AZ-800 covers, which is why most people sit AZ-800 first. Going the other way usually shows up in the migration and hybrid identity scenarios.

How is AZ-801 weighted?

Securing Windows Server on-premises and hybrid infrastructures is the largest area at roughly 28%, and migrating servers and workloads is second at about 23%. Monitoring and troubleshooting takes near 20%, high availability around 17% and disaster recovery about 12%. Migration outweighing failover clustering is the part that surprises people who prepared for a pure availability exam.

Pass-IT is an independent study tool, not affiliated with or endorsed by Microsoft; Microsoft and exam names are trademarks of their respective owners.

One certification. One payment.

Full AZ-801 access

Get the full question pool for this certification. Alex explains every answer, and your readiness score shows what to work on next.

Buy AZ-801 access for $29.99One payment. Lifetime access to this certification.

Take the free readiness check20 questions. No card. See what to study before you buy.

Reach 80% readiness and pass — or your money back.

How the score works →