Microsoft · AZ-801 · Associate

Configuring Windows Server Hybrid Advanced Services (AZ-801) — Practice Questions and Mock Exam

Name: Pass-IT
Author: Pass-IT

Prepare for AZ-801 with original practice questions and clear answer explanations. Ask Alex, your AI tutor, when you need more detail, use your results to identify topics to review, and practice your pacing with timed mock exams.

Start practicing AZ-801 free Buy AZ-801 access for $29.99

Buy AZ-801 access for $29.99 Start practicing AZ-801 free

50Mock exam questions

100minTime limit

700/ 1000Passing score

Checked against Microsoft · August 2026

Overview

About the exam

The AZ-801 certification validates advanced skills in securing, managing, and monitoring Windows Server environments in hybrid configurations. It covers Windows Server security, high availability and disaster recovery, server migration using Azure Migrate, monitoring with Azure Monitor, and troubleshooting across on-premises and Azure environments. This is one of two exams required for the Windows Server Hybrid Administrator Associate certification.

This certification is designed for senior Windows Server administrators who secure and optimize hybrid infrastructure. Candidates should already have the core infrastructure skills validated by AZ-800 and need experience with advanced security hardening, failover clustering, Azure Site Recovery, and enterprise monitoring solutions.

Try the practice preview

Try five AZ-801 questions

Try five practice questions from the app’s current Configuring Windows Server Hybrid Advanced Services question bank, with answers and explanations.

Secure Windows Server on-premises and hybrid infrastructures1 / 5

You need to ingest Windows Server security events into Microsoft Sentinel for SIEM analysis. Which component connects on-premises Windows servers to Microsoft Sentinel?

AlexFull explanation from Alex

Azure Monitor Agent (AMA) with Data Collection Rules (DCR) is the current method for ingesting Windows security events into Microsoft Sentinel from on-premises servers. AMA replaces the legacy Log Analytics agent and provides granular event filtering via DCRs. System Center Operations Manager is a monitoring platform, not a Sentinel connector. Microsoft Defender for Cloud agent provides security recommendations but is not the direct ingestion mechanism for Sentinel. Windows Event Forwarding collects events between Windows servers but does not connect directly to Sentinel. For on-premises servers, Azure Arc is required to deploy AMA and associate DCRs for Sentinel ingestion.

Sourcelearn.microsoft.com

Migrate servers and workloads2 / 5

True or False: Windows Server Migration Tools supports cross-subnet migrations starting with Windows Server 2012.

AlexFull explanation from Alex

Windows Server Migration Tools (WSMT) is a built-in feature that migrates server roles, features, OS settings, and data between servers. Starting with Windows Server 2012, WSMT supports cross-subnet migrations, enabling migration across different network boundaries. This is essential for organizations restructuring network topology during server upgrades. WSMT handles the complexity of transferring configuration and data across network segments, making it suitable for data center migrations and consolidation projects. The feature is installed via Add Roles and Features wizard or PowerShell.

Sourcelearn.microsoft.com

Monitor and troubleshoot Windows Server environments3 / 5

When troubleshooting an Azure Monitor Agent on a Windows Arc-enabled server that is not collecting performance counters, which configuration file should you verify contains CounterSet nodes?

AlexFull explanation from Alex

When troubleshooting Azure Monitor Agent on a Windows Arc-enabled server, the key configuration file is mcsconfig.lkg.xml at C:\Resources\Directory\AMADataStore\mcs\. This last-known-good configuration contains CounterSet nodes defining which performance counters are collected. If counters are missing, the DCR was not properly processed. On Azure VMs (non-Arc), the path differs: C:\WindowsAzure\Resources\AMADataStore.<VM-name>\mcs\. The other options (C:\ProgramData\AzureMonitor, C:\Program Files\Azure Monitor, C:\Windows\System32\AMAConfig) are fabricated paths that do not exist. Always verify this file exists and contains expected CounterSet definitions.

Sourcelearn.microsoft.com

Implement disaster recovery5 / 5

After a failover in Azure Site Recovery, what must you do to delete all available recovery points and finalize the failover?

AlexFull explanation from Alex

After an Azure Site Recovery failover, you must commit the failover to finalize it. Committing deletes all available recovery points and confirms the failed-over VM as the new production instance. Until committed, you can still change recovery points. 'Run a test failover' validates DR readiness without affecting production. 'Reprotect the VM' is performed after committing to enable failback replication. 'Run Complete Migration' is not an ASR failover action. Ref: learn.microsoft.com/azure/site-recovery/site-recovery-failover

Sourcelearn.microsoft.com

Create a free account

Question pool

363 practice questions

Use the Pass-IT question pool to practice for AZ-801. Mock exams are set to 50 questions in 100 minutes.

Pool details: AZ-801

Exam details checked against MicrosoftAugust 28, 2026

date of the last check against the official Microsoft source

Passing score700 / 1,000

as published by Microsoft

Objectives in the guide134 objectives listed in the official guide

across 5 domains in the official exam guide

Pool size363 questions

= The pool size is equivalent to 7 sets of 50 questions; this does not mean that each mock exam uses a separate set.

Recorded as checked against sources363 of 363

questions recorded as having their answer, options, and explanation checked against official Microsoft documentation

How questions are made →

Exam domains

What's on the exam

Securing Windows Server on-premises and hybrid infrastructures is the largest area at 25–30%, spanning OS hardening (Application Control, Credential Guard, SmartScreen, OSConfig, Windows LAPS), hybrid Active Directory hardening, Defender for Identity and Defender for Cloud, firewall and domain isolation, and BitLocker and Azure Disk Encryption. Migrating servers and workloads follows at 20–25%, then high availability and monitoring/troubleshooting at 15–20% each, and disaster recovery at 10–15%.

AZ-801 is the second half of the Windows Server Hybrid Administrator pair and its weighting shows it: nothing here is about standing a server up, everything is about keeping one alive, moving it, or locking it down. Migration being the second-largest domain is the surprise — Storage Migration Service, Azure Migrate and AD forest restructures are worth more of the exam than failover clustering.

Exam blueprint: AZ-801

Secure Windows Server on-premises and hybrid infrastructures25–30%

Secure Windows Server OS (Exploit Protection, Windows Defender Application Control, Credential Guard, SmartScreen, Group Policies, OSConfig, Windows LAPS), secure hybrid Active Directory (password policies, Entra Password Protection, protected users, RODC security, Defender for Identity, NTLM), remediate security issues with Azure services (Sentinel, Defender for Cloud/Servers), secure networking (Windows Defender Firewall, domain isolation, connection security rules, NSGs), and secure storage (BitLocker, Azure Disk Encryption)

≈ 14 h

Implement and manage Windows Server high availability15–20%

Implement Windows Server failover clusters (on-premises/hybrid/cloud, workgroup clusters, stretch clusters, S2D campus clusters, storage/quorum/network configuration, cluster-aware updating, Scale-Out File Servers, Azure witness), manage failover clustering (cluster-aware updating, node recovery/upgrade, workload failover, Windows Admin Center), and implement Storage Spaces Direct (S2D node upgrade, networking, configuration)

≈ 9 h

Implement disaster recovery10–15%

Manage backup and recovery for Windows Server (Azure Recovery Services Vault, Azure Backup Server, backup policies, VM recovery including encrypted VMs), implement disaster recovery with Azure Site Recovery (network mapping, on-premises/Azure VM configuration, recovery plans, replication), and protect VMs using Hyper-V replicas (host configuration, VM replication, failover)

≈ 6 h

Migrate servers and workloads20–25%

Migrate on-premises storage (Storage Migration Service, Azure file shares), migrate servers using Azure Migrate (appliance deployment, VM/physical server migration), migrate workloads from previous Windows Server versions (IIS, Hyper-V hosts, RDS, DHCP, print servers, in-place upgrade), migrate IIS workloads to Azure (Azure Migrate assessment, Web Apps, containers), and migrate AD forest to Windows Server 2025 (forest restructure, AD Migration Tool)

≈ 12 h

Monitor and troubleshoot Windows Server environments15–20%

Monitor using Windows Server tools and Azure services (Performance Monitor, Data Collector Sets, Windows Admin Center, System Insights, event logs, Azure Monitor DCRs/alerts, VM Insights), troubleshoot Windows Server issues (connectivity, name resolution, Windows Update, Time Service, deployment/booting failures, performance, VM/Arc extensions, disk encryption, storage), and troubleshoot Active Directory (AD recycle bin, DSRM, SYSVOL recovery, replication, hybrid auth/sync)

≈ 10 h

Format

Exam format and question types

The exam consists of 40–60 questions to be completed in approximately 100 minutes. Question types include multiple-choice, multiple-select, drag-and-drop, and hot area formats. Questions emphasize security hardening, disaster recovery configurations, and migration planning. Expect scenarios that require combining Azure services like Azure Migrate and Azure Site Recovery with on-premises Windows Server.

Question types: AZ-801

Multiple Choice48%

Select the single answer that best meets the question’s requirements.

Ordering12%

Arrange the steps in the sequence needed to complete the process.

Drag & Drop12%

Move items into the slots, groups, or sequence specified by the task.

Multiple Response10%

Select multiple answers. Follow the question’s instructions on how many to choose.

Dropdown10%

Choose options from dropdown menus to complete a statement or configuration.

True / False8%

Decide whether a statement is true or false, paying attention to its conditions and wording.

See Microsoft for official question-format information. The shares shown describe the Pass-IT practice pool; they do not establish the proportions on the official exam.

Planning

Preparing for AZ-801

Delivered via Pearson VUE online or at testing centers. Available in English, Japanese, Chinese, Korean, French, German, Spanish, and more. The certification is valid for 1 year with a free renewal assessment on Microsoft Learn. Microsoft has announced that AZ-800 and AZ-801 retire on 30 September 2026.

Preparation and logistics: AZ-801

Preparation

Illustrative study time30–75 h

illustrative planning range: 30 h with relevant experience to 75 h when starting out; your needs may fall outside this range

LevelAssociate

Taking and maintaining the certification

DeliveryPearson VUE online proctored or at authorized testing centers worldwide

Retake policy24-hour wait after the first attempt, 14 days between subsequent attempts, maximum 5 attempts per exam within a 12-month period

Certification validity1 year

Free renewal assessment on Microsoft Learn, available starting 6 months before expiration. Must be completed before the certification expires.

Official guideView on provider site

Study notes

Common pitfalls

Topics to review: AZ-801

01Server Hardening
Not understanding Windows Server security baselines, credential guard, and advanced threat protection configurations.
02Failover Clustering
Struggling with Windows Server Failover Clustering quorum models, witness configurations, and cluster-aware updating.
03Azure Site Recovery
Confusing Azure Site Recovery vs Azure Backup and not knowing replication, failover, and failback procedures for hybrid DR.
04Migration Planning
Overlooking Azure Migrate assessment and migration tool capabilities for physical and virtual server migrations.
05Monitoring Integration
Not configuring Azure Monitor Agent, Log Analytics workspaces, and Windows Admin Center for comprehensive hybrid monitoring.

Practice with questions and explanations in Pass-IT →

Questions

Frequently asked questions

How long is the Configuring Windows Server Hybrid Advanced Services exam?

The AZ-801 exam has 50 questions and a 100-minute time limit.

What is the passing score for Configuring Windows Server Hybrid Advanced Services?

The passing score for the AZ-801 exam is 700 / 1000.

Which pitfalls should I review when preparing for Configuring Windows Server Hybrid Advanced Services?

Topics to review include Server Hardening, Failover Clustering, Azure Site Recovery, Migration Planning, Monitoring Integration. Work through examples to check that you understand the distinctions and can explain your answer.

When does AZ-801 retire?

AZ-801 retires on 30 September 2026, the same day as AZ-800, and our catalog carries that date on both. No successor exam code is recorded for either of them.

Can you still renew the certification after AZ-801 retires?

The certification runs on a one-year cycle renewed through a free assessment on Microsoft Learn, which opens six months before your expiry date. Our catalog records the exams retiring and does not record the certification or its renewal assessment retiring with them, so the two dates are not the same thing. Your own expiry date sits on your Microsoft Learn transcript, and that is the one worth putting in a calendar.

Is there still a case for taking AZ-801?

Only if AZ-800 is already passed or realistically within reach, since the credential needs both exams and each carries a 50-hour budget. Sitting AZ-801 on its own before 30 September 2026 leaves you with a passed exam and no certification to show for it.

Should you take AZ-800 before AZ-801?

Microsoft sets no formal prerequisite, so either order can be booked. AZ-801 assumes the core infrastructure material that AZ-800 covers, which is why most people sit AZ-800 first. Going the other way usually shows up in the migration and hybrid identity scenarios.

How is AZ-801 weighted?

Securing Windows Server on-premises and hybrid infrastructures is the largest area at roughly 28%, and migrating servers and workloads is second at about 23%. Monitoring and troubleshooting takes near 20%, high availability around 17% and disaster recovery about 12%. Migration outweighing failover clustering is the part that surprises people who prepared for a pure availability exam.

One certification, 12 months

Practice for AZ-801

Focus your practice on one certification, or choose Pro to practice across all certifications.

Buy AZ-801 access for $29.99

Start a free practice sessionTry the first 20 questions without a card to see whether the practice suits you.

For eligible purchases: money-back guarantee if you fail your exam.

View guarantee terms →