All Practice Exams

133+ Free Azure AZ-800 Practice Questions

Prepare for the Administering Windows Server Hybrid Core Infrastructure (AZ-800) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
Not published Pass Rate
133+ Questions
100% Free
Same family resources

Explore More Microsoft Azure Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

2026 Statistics

Key Facts: Azure AZ-800 Exam

700/1000

Passing Score

Microsoft Learn

Jan 21, 2026

Objectives Last Updated

Microsoft Learn study guide

US$165

Exam Fee (US)

Microsoft Learn

5

Skill Areas Measured

Microsoft Learn skills measured

30-35%

Largest Domain (AD DS hybrid)

Microsoft Learn skills measured

Sep 30, 2026

Retirement Date

Microsoft Learn (replaced by AZ-802)

AZ-800 is a proctored exam administered by Microsoft via Pearson VUE; Microsoft does not publish an item count or an exact duration for it. It costs US$165 in the United States and uses a scaled passing score of 700/1000. Microsoft has announced that AZ-800 and AZ-801 retire on September 30, 2026; Exam AZ-802: Administering Windows Server replaces the two-exam route as Microsoft evolves and renames the existing certification to Microsoft Certified: Windows Server Administrator Associate. Skills measured cover AD DS in hybrid environments (30-35%), Windows Server hybrid management with Azure Arc (10-15%), virtual machines and containers (15-20%), on-premises and hybrid networking (15-20%), and storage and file services (15-20%).

Sample Azure AZ-800 Practice Questions

Try these sample questions to test your Azure AZ-800 exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 133+ question experience with AI tutoring.

1You are deploying the first domain controller in a brand-new Active Directory forest on Windows Server 2022. Which PowerShell cmdlet promotes the server to a domain controller after the AD DS role is installed?
A.Add-ADDSDomainController
B.Install-ADDSForest
C.New-ADForest
D.Promote-ADDomainController
Explanation: Install-ADDSForest is the supported cmdlet to install a brand-new forest, including the first domain in that forest, and to promote the server to its first domain controller. Add-ADDSDomainController joins an existing domain. New-ADForest is not a real cmdlet. Promote-ADDomainController does not exist; promotion is performed via the ADDSDeployment module cmdlets.
2Which FSMO role is responsible for maintaining the schema of an Active Directory forest and exists on only one domain controller in the entire forest?
A.Domain Naming Master
B.Schema Master
C.RID Master
D.Infrastructure Master
Explanation: The Schema Master is a forest-wide FSMO role and exists on exactly one domain controller per forest. Domain Naming Master is also forest-wide but governs adding/removing domains. RID Master and Infrastructure Master are domain-wide roles, present once per domain.
3Which two FSMO roles are forest-wide rather than domain-wide? (Choose the BEST answer.)
A.Schema Master and Domain Naming Master
B.RID Master and PDC Emulator
C.Infrastructure Master and Schema Master
D.PDC Emulator and Domain Naming Master
Explanation: Schema Master and Domain Naming Master are the two forest-wide FSMO roles, present only once per forest. RID Master, PDC Emulator, and Infrastructure Master are the three domain-wide roles, present once per domain.
4You need to allow users in forest A to sign in and access resources in forest B, while users in forest B must NOT be able to access resources in forest A. Which one-way trust configuration meets this requirement?
A.A two-way forest trust between forest A and forest B
B.A one-way trust in which forest B is the trusting forest and forest A is the trusted forest
C.A one-way trust in which forest A is the trusting forest and forest B is the trusted forest
D.A realm trust between forest A and a non-Windows Kerberos realm
Explanation: In a one-way trust, the users of the TRUSTED domain/forest can access resources in the TRUSTING domain/forest - not the reverse. To let A's users access B's resources while blocking B's users from A's resources, forest B must be the trusting forest and forest A the trusted forest (informally, 'B trusts A'). Making A the trusting forest would instead let B's users into A, the opposite of the requirement. A two-way trust would allow both directions to access each other, and a realm trust is used to interoperate with a non-Windows Kerberos realm, not another AD forest.
5In Active Directory Sites and Services, what does the inter-site replication cost value control?
A.The dollar cost charged for replication bandwidth
B.The path that the KCC selects for replication between sites when multiple links exist
C.The encryption strength used for replication
D.The compression ratio for replicated data
Explanation: The cost on a site link is an integer used by the Knowledge Consistency Checker (KCC) and Inter-Site Topology Generator (ISTG) to choose the lowest-cost path between sites. It does not represent monetary cost, encryption, or compression.
6A Group Policy Object is linked at both the domain level and an OU. The OU policy enforces password complexity ON, while the domain policy sets it OFF. With default processing, which setting wins for users in the OU?
A.Domain policy wins (always processed last at the OU level by inheritance)
B.OU policy wins because GPO processing follows L-S-D-OU and the closer OU is applied later
C.Both policies cancel out
D.The setting that was created first wins
Explanation: GPO processing order is Local, Site, Domain, OU (L-S-D-OU). Settings applied later overwrite earlier ones unless Enforced or Block Inheritance is used. The OU is closest to the user object, so its setting wins by default. Note: domain account password policy is a special case set via Default Domain Policy, but the question is about GPO precedence ordering.
7You want to enable hybrid identity so that on-premises Active Directory user accounts can sign in to Microsoft 365 with the SAME password they use on-premises, without deploying federation servers. Which Microsoft Entra Connect (Azure AD Connect) sign-in option is the SIMPLEST choice?
A.Federation with AD FS
B.Pass-through Authentication (PTA)
C.Password Hash Synchronization (PHS)
D.Seamless SSO only
Explanation: Password Hash Synchronization synchronizes a hash of a hash of the on-premises password to Microsoft Entra ID, allowing users to sign in with the same password without any additional infrastructure. PTA validates against on-prem AD but requires connector agents. AD FS is the most complex. Seamless SSO is an add-on, not a sign-in method.
8Which hybrid identity authentication method requires the deployed authentication agent on-premises to validate user passwords in real time against your on-premises Active Directory?
A.Password Hash Synchronization
B.Pass-through Authentication
C.Federation with AD FS
D.Cloud-only authentication
Explanation: Pass-through Authentication (PTA) installs a lightweight agent on-premises that validates passwords against AD in real time, so the password never leaves your environment. PHS synchronizes password hashes. Federation uses AD FS or third-party STS. Cloud-only does not use on-prem AD.
9To allow domain-joined Windows clients to silently sign in to Microsoft 365 without entering credentials, which feature must be enabled in Microsoft Entra Connect?
A.Seamless Single Sign-On (Seamless SSO)
B.Conditional Access
C.Privileged Identity Management
D.Password Writeback
Explanation: Seamless SSO automatically signs domain-joined users into Microsoft Entra ID using their Kerberos ticket from the on-premises domain. Conditional Access is a policy engine. PIM manages privileged role activation. Password Writeback writes cloud password changes back to on-prem AD.
10Users perform Microsoft Entra self-service password reset (SSPR) and you need that password change to update their on-premises Active Directory account. Which Entra Connect feature must be enabled?
A.Password Hash Sync
B.Password Writeback
C.Seamless SSO
D.Group Writeback
Explanation: Password Writeback synchronizes password changes made in Entra ID (such as via SSPR) back to the on-premises Active Directory account. PHS only sends hashes upward. Seamless SSO is a sign-in feature. Group Writeback writes cloud groups to AD DS.

About the Azure AZ-800 Exam

AZ-800 validates the skills required to administer Windows Server in hybrid environments that combine on-premises infrastructure with Microsoft Azure. Topics include deploying and managing Active Directory Domain Services in hybrid scenarios, configuring Windows Server in hybrid setups using Azure Arc, managing virtual machines and containers, implementing on-premises and hybrid networking, and managing storage and file services. Together with AZ-801, AZ-800 leads to the Microsoft Certified: Windows Server Hybrid Administrator Associate certification.

Assessment

Microsoft does not publish an AZ-800 item count and does not identify exam-specific question formats or item types in advance; the official exam sandbox demonstrates possible interface patterns only

Time Limit

Not published by Microsoft on the current exam page

Passing Score

700/1000 (Microsoft scaled score)

Exam Fee

US$165 (United States; varies by country) (Microsoft)

Azure AZ-800 Exam Content Outline

30-35%

Deploy and manage AD DS in on-premises and cloud environments

Active Directory Domain Services deployment, FSMO roles, AD trusts, sites and services, Group Policy, RODCs, gMSAs, AD Recycle Bin, Microsoft Entra Connect (Sync) and Cloud Sync, Password Hash Sync, Pass-through Authentication, Federation, Seamless SSO, password writeback, Microsoft Entra Domain Services.

10-15%

Manage Windows Servers and workloads in a hybrid environment

Azure Arc-enabled servers onboarding (Connected Machine agent, azcmagent), extensions, Run Command, Windows Admin Center, Azure Update Manager, Azure Policy guest configuration, hybrid management at scale.

15-20%

Manage virtual machines and containers

Hyper-V and guest VM management, Generation 1 vs 2, enhanced session mode, PowerShell Direct and SSH Direct, nested virtualization, VM memory, integration services, DDA, GPU partitioning, CPU groups and hypervisor scheduling, checkpoints, virtual hard disks, Hyper-V networking, NIC teaming and SET, guarded fabric and shielded VMs, Windows Server containers, WSL, container networking and AKS, plus Azure IaaS VM storage, capacity, availability sets and zones, JIT access and Azure Bastion.

15-20%

Implement and manage an on-premises and hybrid networking infrastructure

Integrating DNS with AD DS, DNS zones and records, forwarding and conditional forwarding, Azure Public DNS, Azure Private DNS and Azure DNS Private Resolver, Windows Server DNS policies, DNSSEC, IPAM, the DHCP server role, scopes, IP reservations, DHCP high availability, resolving hybrid IP addressing issues, the Remote Access role, site-to-site VPN, Azure Network Adapter, Azure Extended Network, NPAS, Web Application Proxy, Azure Relay, Microsoft Entra Private Access, and Microsoft Entra Application Proxy.

15-20%

Manage Windows Server storage and file services

Azure File Shares, Azure File Share permissions, Azure File Sync and cloud tiering, monitoring File Sync, migrating DFS to Azure File Sync, Windows Server file share access, FSRM quotas and file screens, BranchCache, DFS Namespaces and Replication, SMB over QUIC, SMB options, disks and volumes, file systems, Storage Spaces and Storage Spaces Direct, Storage Replica, Data Deduplication, SMB Direct, Storage QoS, and iSCSI.

How to Pass the Azure AZ-800 Exam

What You Need to Know

  • Passing score: 700/1000 (Microsoft scaled score)
  • Assessment: Microsoft does not publish an AZ-800 item count and does not identify exam-specific question formats or item types in advance; the official exam sandbox demonstrates possible interface patterns only
  • Time limit: Not published by Microsoft on the current exam page
  • Exam fee: US$165 (United States; varies by country)

Keys to Passing

  • Work through all 133 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

Azure AZ-800 Study Tips from Top Performers

1Spend the most study time on AD DS in hybrid environments because it is the largest single domain at 30-35% of the exam.
2Build a small hybrid lab with Hyper-V on Windows Server 2022, a domain controller, and a free Azure tier so you can practice Entra Connect, Azure Arc onboarding, and Azure File Sync end to end.
3Memorize the differences between Password Hash Sync, Pass-through Authentication, Federation, Seamless SSO, and password writeback, and know the supporting agents and required ports for each.
4Practice Azure Arc onboarding using azcmagent connect, including the Connected Machine Onboarding role and the outbound HTTPS endpoints required for registration.
5Drill Hyper-V topics: Generation 1 vs 2, Dynamic Memory, Hyper-V Replica intervals (30 sec, 5 min, 15 min), and the difference between External, Internal, and Private virtual switches.
6Know your storage options cold: Storage Spaces Direct minimums, SMB over QUIC server requirements (Windows Server 2022 Datacenter: Azure Edition or any edition of Windows Server 2025 or later), DFS Namespaces vs DFS Replication, Storage Replica topologies, and Azure File Sync cloud tiering.
7If you are testing close to September 30, 2026, decide whether to take AZ-800 before retirement or move to AZ-802 - reschedule rather than rush an unprepared attempt.

Frequently Asked Questions

When does AZ-800 retire and what replaces it?

Microsoft has announced that AZ-800 retires on September 30, 2026, at 5:00 PM Central Time, along with AZ-801. Exam AZ-802: Administering Windows Server replaces the two-exam route. Microsoft says it is evolving and renaming the existing Windows Server Hybrid Administrator certification to Microsoft Certified: Windows Server Administrator Associate, so current holders need no action and will see the new name after AZ-802 goes live.

What is the AZ-800 passing score?

The AZ-800 exam uses Microsoft’s scaled scoring system with a passing score of 700 out of 1000. A scaled 700 is not the same as answering 70 percent of the questions correctly. Microsoft does not publish an AZ-800 item count or exact duration and does not identify exam-specific question formats in advance; the official exam sandbox shows possible interface patterns only.

How much does the AZ-800 exam cost?

The AZ-800 exam fee is US$165 in the United States. Prices vary by country and currency. Microsoft delivers the exam through Pearson VUE both in test centers and via online proctoring. Free renewal assessments on Microsoft Learn keep the credential active each year.

What domains does AZ-800 cover?

AZ-800 measures five skill areas: Deploy and manage AD DS in on-premises and cloud environments (30-35%), Manage Windows Servers and workloads in a hybrid environment with Azure Arc (10-15%), Manage virtual machines and containers (15-20%), Implement and manage on-premises and hybrid networking (15-20%), and Manage Windows Server storage and file services (15-20%).

Who should take AZ-800?

AZ-800 is aimed at Windows Server administrators who run on-premises and hybrid solutions integrated with Azure. Microsoft's audience profile states you should have several years of experience with Windows Server operating systems, covering AD DS, Hyper-V, networking, storage, and PowerShell, plus familiarity with Windows Admin Center, Azure Arc, Azure Policy, Azure Monitor, Azure Update Manager, Microsoft Defender for Identity, and Microsoft Defender for Cloud.

How does AZ-800 relate to AZ-801?

AZ-800 (core infrastructure) and AZ-801 (advanced services) together earn the Windows Server Hybrid Administrator Associate certification. AZ-800 focuses on identity, compute, networking, and storage hybrid scenarios; AZ-801 focuses on advanced security, high availability, disaster recovery, and migration. Both are being refreshed as part of the September 30, 2026 transition.