Microsoft - AZ-801: Configuring Windows Server Hybrid Advanced Services

Sample Questions

• Minimize how long it takes to perform the migration.
• Minimize administrative effort.

Explanation:

First, we need to install the Web Deployment Tool (Web Deploy) on the source server (Server1). Web Deploy ca be used to export web deployment packages from Internet Information Services (IIS) and to pubslish these packages to a remote server. Web Deploy installs the MSDeploy.exe command-line utility.

The net start msdepsvc command starts the Web Deploy service.

The –verb:sync argument of the MSDeploy.exe command-line utility indicates that you want to replicate the source content on the destination server.

References:

Deploying Web Packages

Installing and Configuring Web Deploy on IIS 8.0 or Later

Explanation:

Azure Disk Encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. ADE encrypts the OS and data disks of Azure virtual machines (VMs) inside your VMs by using the DM-Crypt feature of Linux or the BitLocker feature of Windows. ADE is integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets, with the option to encrypt with a key encryption key (KEK).

Azure Disk Encryption (ADE) uses Azure Key Vault to store and manage encryption keys and secrets. Before enabling ADE, the VM (via its managed identity) must be authorized to access the Key Vault.

Specifically:

• The managed identity of VM1 needs permissions such as:
  • Get / list secrets
  • Get / wrap / unwrap keys
• Without these permissions, the encryption process cannot retrieve or store keys.

References:

Overview of managed disk encryption options

Create and configure a key vault for Azure Disk Encryption on a Windows VM

Explanation:

Storage Spaces Direct provides fault tolerance, often called "resiliency," for your data. Its implementation is similar to RAID, except distributed across servers and implemented in software.

As with RAID, there are a few different ways Storage Spaces can do this, which make different tradeoffs between fault tolerance, storage efficiency, and compute complexity. These broadly fall into two categories: "mirroring" and "parity," the latter sometimes called "erasure coding."

Dual parity

Dual parity implements Reed-Solomon error-correcting codes to keep two bitwise parity symbols, thereby providing the same fault tolerance as three-way mirroring (i.e. up to two failures at once), but with better storage efficiency. It most closely resembles RAID-6. To use dual parity, you need at least four hardware fault domains – with Storage Spaces Direct, that means four servers. At that scale, the storage efficiency is 50% – to store 2 TB of data, you need 4 TB of physical storage capacity.

The storage efficiency of dual parity increases the more hardware fault domains you have, from 50 percent up to 80 percent. For example, at seven (with Storage Spaces Direct, that means seven servers) the efficiency jumps to 66.7 percent – to store 4 TB of data, you need just 6 TB of physical storage capacity.

With fewer than 4 nodes, S2D cannot provide dual parity resilience. 16 nodes is the supported upper limit for an S2D cluster.

Reference: Fault tolerance and storage efficiency on Azure Local and Windows Server clusters

Explanation:

To install the first DC that runs the latest Windows Server version in an existing domain and forest, the machine where you run the installation needs connectivity to:

• The schema master to run adprep /forestprep.
• The infrastructure master to run adprep /domainprep.

To install the first DC in a domain where the forest schema is already extended, you only need connectivity to the infrastructure master.

To install or remove a domain in an existing forest, you need connectivity to the domain naming master.

To run adprep /forestprep, membership in the schema admins, enterprise admins, and domain admins groups is required.

To run adprep /domainprep, membership in the domain admins group is required.

Since Windows Server 2025 requires updates to the Active Directory schema, User1 requires membership in the schema admins, enterprise admins, and domain admins groups.

Note: A schema extension is NOT required when promoting a Windows Server 2022 server to a domain controller in a domain where domain controllers run Windows Server 2019.

References:

Upgrade domain controllers to a newer version of Windows Server

Active Directory Domain Services functional levels

Explanation:

The Azure Storage Mover service utilizes agents to perform the migration jobs you configure in the service. An agent is a virtual machine-based migration appliance that runs on a virtualization host. Ideally, your virtualization host is located as near as possible to the source storage to be migrated. Storage Mover can support multiple agents.

Because an agent is essentially a migration appliance, you interact with it through an agent-local administrative shell. The shell limits the operations you can perform on this machine, though network configuration and troubleshooting tasks are accessible.

Use of the agent in migrations is managed through Azure. Both Azure PowerShell and CLI are supported, and graphical interaction is available within the Azure portal. The agent is made available as a disk image compatible with either new Windows Hyper-V or VMware virtual machines (VMs).

Images for agent VMs are hosted on Microsoft Download Center as a zip file. Only Generation 1 VMs are supported. 

Reference: Deploy an Azure Storage Mover agent