You have a domain with a large number of users. You need to grant a set of users access to a file share. The users are in different OUs. You want to minimize the administrative effort for future changes. What should you do?

Create a universal group, add the users to it, and grant the universal group access to the share.

Grant each user direct access to the share.

Create a domain local group, add the users to it, and grant the domain local group access to the share.

Create a global group, add the users to it, and grant the global group access to the share.

Which of the following is a benefit of joining a Windows Server to Microsoft Entra ID?

The server can be managed as a domain controller in the cloud

Centralized management through Microsoft Intune

Automatic replication of the server's local user accounts to the cloud

The ability to use Group Policy from on-premises AD DS

You need to run a service that must be able to access network resources and be managed by an administrator without sharing credentials. Which type of service account should you use?

Standalone Managed Service Account (sMSA)

Group Managed Service Account (gMSA)

User account with 'Password never expires'

You have created a gMSA named svc-app in AD DS. You need to configure a Windows Server to use this gMSA for a service. You have already added the server's computer account to the gMSA's 'PrincipalsAllowedToRetrieveManagedPassword' attribute. What is the next step?

Create a service principal name (SPN) for the gMSA.

Add the gMSA to the local Administrators group.

Install the gMSA on the server by using the Install-ADServiceAccount cmdlet.

Microsoft Certified:Windows Server Hybrid Administrator Associate

Domain 1Objective 3

Create and Manage AD DS Security Principals AZ-800 Practice Questions (Page 2)

Part of the Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments domain, which accounts for 30–35% of the AZ-800 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 2–5 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

9concepts

30–35%of the exam

9 Concepts in This Objective

AD DS User Creation
AD DS Group Management
Multi-Domain User Management
Multi-Forest User Management
Service Account Types
Service Account Implementation
Join Windows Server to AD DS
Join Windows Server to Microsoft Entra Domain Services
Join Windows Server to Microsoft Entra

Questions 6–10

6expert · hard
You have a domain with a large number of users. You need to grant a set of users access to a file share. The users are in different OUs. You want to minimize the administrative effort for future changes. What should you do?
Select an answer first
7foundation · easy
When managing user accounts across multiple domains within a forest, which attribute is used to uniquely identify a user across the entire forest?
Select an answer first
8foundation · easy
Which of the following is a benefit of joining a Windows Server to Microsoft Entra ID?
Select an answer first
9foundation · easy
You need to run a service that must be able to access network resources and be managed by an administrator without sharing credentials. Which type of service account should you use?
Select an answer first
10application · medium
You have created a gMSA named svc-app in AD DS. You need to configure a Windows Server to use this gMSA for a service. You have already added the server's computer account to the gMSA's 'PrincipalsAllowedToRetrieveManagedPassword' attribute. What is the next step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-800

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-800” is a trademark of its owner, used for identification only.