Microsoft - AZ-800: Administering Windows Server Hybrid Core Infrastructure

Sample Questions

Explanation:

We should configure role based access control in IPAM.

Role based access control is comprised of roles, access scopes, and access policies:

• Roles: A role is a collection of IPAM operations. You can associate a role with a user or group in Windows using an access policy. Several built-in roles are provided, but you can also create customized roles to meet your business requirements.

• Access scopes: An access scope determines the objects that a user has access to. You can use access scopes to define administrative domains in IPAM. For example, you might create access scopes based on geographical location. By default, IPAM includes an access scope of Global. All other access scopes are subsets of the Global access scope. Users or groups that are assigned to the Global access scope have access to all objects in IPAM that are permitted by their assigned role.

• Access policies: An access policy combines a role with an access scope to assign permission to a user or group. For example, you might define an access policy for user1 with a role of IP Block Admin and an access scope of Global\Asia. Therefore, user1 will have permission to edit and delete IP address blocks that are associated to the Asia access scope. This user will not have permission to edit or delete any other IP address blocks in IPAM.

Reference: Access Control

Explanation:

Data Deduplication uses a post-processing strategy to optimize and maintain a volume's space efficiency.

Reference: Understanding Data Deduplication

• H: maps to \\server1\users\%UserName%
• G: maps to \\server1\%Department%

• Prevent users using more than 5GB of space on their H: drive.
• Prevent Accounts department users from using more than 10GB of space on the G: drive.
• Prevent Marketing department users from using more than 15GB of space on the G: drive.
• Prevent Customer Service department users from using more than 2GB of space on the G: drive.
• Minimize administrative effort.

Explanation:

File Server Resource Manager (FSRM) is a role service in Windows Server that enables you to manage and classify data stored on file servers. You can use FSRM to automatically classify files, perform tasks based on these classifications, set quotas on folders, and create reports monitoring storage usage.

On the Quota Management node of the File Server Resource Manager Microsoft® Management Console (MMC) snap-in, you can perform the following tasks:

• Create quotas to limit the space allowed for a volume or folder, and generate notifications when the quota limits are approached or exceeded.
• Generate auto apply quotas that apply to all existing subfolders in a volume or folder and to any subfolders that are created in the future.
• Define quota templates that can be easily applied to new volumes or folders and then used across an organization.

For example, you can:

• Place a 200 megabyte (MB) limit on users' personal server folders, with an email notification sent to you and the user when 180 MB of storage has been exceeded.
• Set a flexible 500 MB quota on a group's shared folder. When this storage limit is reached, all users in the group are notified by e-mail that the storage quota has been temporarily extended to 520 MB so that they can delete unnecessary files and comply with the preset 500 MB quota policy.
• Receive a notification when a temporary folder reaches 2 gigabytes (GB) of usage, yet not limit that folder's quota because it is necessary for a service running on your server.

References:

File Server Resource Manager (FSRM) overview

Quota Management

Explanation:

The following table shows the minimum virtual machine configuration version required to use some Hyper-V features.

Reference: Upgrade virtual machine version in Hyper-V on Windows or Windows Server

Explanation:

Windows containers offer two distinct modes of runtime isolation: process and Hyper-V isolation. Containers running under both isolation modes are created, managed, and function identically. They also produce and consume the same container images. The difference between the isolation modes is to what degree of isolation is created between the container, the host operating system, and all of the other containers running on that host.

Process Isolation

With process isolation, multiple container instances run concurrently on a given host with isolation provided through namespace, resource control, and other process isolation technologies. When running in this mode, containers share the same kernel with the host as well as each other. This is approximately the same as how Linux containers run.

Process isolation allows to display the running processes of a container using the docker top command on the container host or the Get-Process cmdlet on the container host or on any other running container.

Hyper-V isolation

This isolation mode offers enhanced security and broader compatibility between host and container versions. With Hyper-V isolation, multiple container instances run concurrently on a host; however, each container runs inside of a highly optimized virtual machine and effectively gets its own kernel. The presence of the virtual machine provides hardware-level isolation between each container as well as the container host.

Hyper-V isolation allows to display the running processes of a container using the docker top command on the container host. 

Reference: Isolation Modes