You have a Web Application Proxy (WAP) server publishing an internal web app. You need to migrate to Microsoft Entra Application Proxy to take advantage of Entra Conditional Access. The app uses Kerberos authentication. What is the key difference in configuration?

WAP requires a connector, while Entra Application Proxy does not.

Entra Application Proxy does not support Kerberos authentication.

Entra Application Proxy requires the app to be registered in Entra ID, while WAP uses AD FS.

Entra Application Proxy uses Kerberos Constrained Delegation, while WAP uses AD FS delegation.

You have a Windows Server 2022 server configured with Network Policy Server (NPS). You need to enforce different network access policies for employees and contractors connecting via VPN. Both groups are in Active Directory. What should you do?

Use Group Policy to assign different VPN connection settings.

Configure the VPN server to use different authentication methods for each group.

Create two NPS network policies with conditions based on Active Directory groups.

Create two remote access policies in Routing and Remote Access.

A company has an on-premises web application that uses client certificate authentication. They want to publish it for remote users. They have an existing AD FS farm and want to keep authentication on-premises. What should you implement?

Microsoft Entra Application Proxy with certificate-based authentication.

Web Application Proxy with AD FS pre-authentication and certificate authentication.

DirectAccess with certificate authentication.

Microsoft Entra Private Access with certificate authentication.

You have an NPS server that authenticates VPN connections. You need to ensure that only users in a specific Active Directory group can connect, and you also need to log accounting data to a SQL database. You have configured the NPS policies and RADIUS accounting. However, users outside the group are still connecting. What is the most likely cause?

The SQL logging is interfering with policy evaluation.

The VPN server is not using NPS for authentication.

The users are in a different domain.

The NPS network policy is configured to allow all users because the condition is not set correctly.

Microsoft Certified:Windows Server Hybrid Administrator Associate

Domain 4Objective 3

Implement On-Premises and Hybrid Network Connectivity AZ-800 Practice Questions (Page 5)

Part of the Implement and manage an on-premises and hybrid networking infrastructure domain, which accounts for 15–20% of the AZ-800 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 2–4 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

9concepts

15–20%of the exam

9 Concepts in This Objective

Remote Access Role Configuration
Azure Network Adapter Deployment
Azure Extended Network Setup
Network Policy and Access Services Management
Web Application Proxy Implementation
Site-to-Site VPN Configuration
Azure Relay Setup
Microsoft Entra Private Access Deployment
Microsoft Entra Application Proxy Implementation

Questions 21–25

21expert · hard
You have a Web Application Proxy (WAP) server publishing an internal web app. You need to migrate to Microsoft Entra Application Proxy to take advantage of Entra Conditional Access. The app uses Kerberos authentication. What is the key difference in configuration?
Select an answer first
22foundation · easy
You need to extend an on-premises network to Azure by using Azure Network Adapter. Which Azure service is used to establish the connection?
Select an answer first
23application · medium
You have a Windows Server 2022 server configured with Network Policy Server (NPS). You need to enforce different network access policies for employees and contractors connecting via VPN. Both groups are in Active Directory. What should you do?
Select an answer first
24application · medium
A company has an on-premises web application that uses client certificate authentication. They want to publish it for remote users. They have an existing AD FS farm and want to keep authentication on-premises. What should you implement?
Select an answer first
25expert · hard
You have an NPS server that authenticates VPN connections. You need to ensure that only users in a specific Active Directory group can connect, and you also need to log accounting data to a SQL database. You have configured the NPS policies and RADIUS accounting. However, users outside the group are still connecting. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-800

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-800” is a trademark of its owner, used for identification only.

Implement On-Premises and Hybrid Network Connectivity AZ-800 Practice Questions (Page 5)

Questions 21–25

You have a Web Application Proxy (WAP) server publishing an internal web app. You need to migrate to Microsoft Entra Application Proxy to take advantage of Entra Conditional Access. The app uses Kerberos authentication. What is the key difference in configuration?

You need to extend an on-premises network to Azure by using Azure Network Adapter. Which Azure service is used to establish the connection?

You have a Windows Server 2022 server configured with Network Policy Server (NPS). You need to enforce different network access policies for employees and contractors connecting via VPN. Both groups are in Active Directory. What should you do?

A company has an on-premises web application that uses client certificate authentication. They want to publish it for remote users. They have an existing AD FS farm and want to keep authentication on-premises. What should you implement?

Keep studying — Implement and manage an on-premises and hybrid networking infrastructure