100+ Free Azure AZ-800 Practice Questions

Pass your Administering Windows Server Hybrid Core Infrastructure (AZ-800) exam on the first try — instant access, no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately

Not published Pass Rate

100+ Questions

100% Free

1 / 100

Question 1

Score: 0/0

You are deploying the first domain controller in a brand-new Active Directory forest on Windows Server 2022. Which PowerShell cmdlet promotes the server to a domain controller after the AD DS role is installed?

Add-ADDSDomainController

Install-ADDSForest

New-ADForest

Promote-ADDomainController

to track

2026 Statistics

Key Facts: Azure AZ-800 Exam

700/1000

Passing Score

Microsoft Learn

100 min

Exam Time

Microsoft Learn

US$165

Exam Fee (US)

Microsoft Learn

40-60 Q

Question Count

Microsoft Learn

30-35%

Largest Domain (AD DS hybrid)

Microsoft Learn skills measured

Sep 30, 2026

Retirement Date

Microsoft Learn (replaced by AZ-802)

AZ-800 is a 100-minute, ~40-60 question exam administered by Microsoft via Pearson VUE. It costs US$165 in the United States and uses a scaled passing score of 700/1000. Microsoft has announced the exam will RETIRE on September 30, 2026, with AZ-802 (Administering Windows Server Hybrid Core Infrastructure) replacing it on the Windows Server Hybrid Administrator Associate path; candidates testing in 2026 should plan accordingly. Skills measured cover AD DS in hybrid environments (30-35%), Windows Server hybrid management with Azure Arc (10-15%), virtual machines and containers (15-20%), on-premises and hybrid networking (15-20%), and storage and file services (15-20%).

Sample Azure AZ-800 Practice Questions

Try these sample questions to test your Azure AZ-800 exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1You are deploying the first domain controller in a brand-new Active Directory forest on Windows Server 2022. Which PowerShell cmdlet promotes the server to a domain controller after the AD DS role is installed?

A.Add-ADDSDomainController

B.Install-ADDSForest

C.New-ADForest

D.Promote-ADDomainController

Explanation: Install-ADDSForest is the supported cmdlet to install a brand-new forest, including the first domain in that forest, and to promote the server to its first domain controller. Add-ADDSDomainController joins an existing domain. New-ADForest is not a real cmdlet. Promote-ADDomainController does not exist; promotion is performed via the ADDSDeployment module cmdlets.

2Which FSMO role is responsible for maintaining the schema of an Active Directory forest and exists on only one domain controller in the entire forest?

A.Domain Naming Master

B.Schema Master

C.RID Master

D.Infrastructure Master

Explanation: The Schema Master is a forest-wide FSMO role and exists on exactly one domain controller per forest. Domain Naming Master is also forest-wide but governs adding/removing domains. RID Master and Infrastructure Master are domain-wide roles, present once per domain.

3Which two FSMO roles are forest-wide rather than domain-wide? (Choose the BEST answer.)

A.Schema Master and Domain Naming Master

B.RID Master and PDC Emulator

C.Infrastructure Master and Schema Master

D.PDC Emulator and Domain Naming Master

Explanation: Schema Master and Domain Naming Master are the two forest-wide FSMO roles, present only once per forest. RID Master, PDC Emulator, and Infrastructure Master are the three domain-wide roles, present once per domain.

4You need to allow users in forest A to access resources in forest B, while users in forest B should NOT be able to access resources in forest A. Which trust configuration meets this requirement?

A.Two-way external trust

B.One-way incoming forest trust from B to A

C.One-way outgoing forest trust from A to B

D.Realm trust

Explanation: From the perspective of forest A, the trust must be outgoing so that A trusts B's users to access A's resources. Wait — re-read: users in A access resources in B. That requires forest B to trust forest A, which from A's side is an outgoing trust direction allowing A's users to be authenticated by B. Microsoft documents this as a one-way outgoing trust from A to B. A two-way trust would also let B's users access A. A realm trust is for non-Windows Kerberos realms.

5In Active Directory Sites and Services, what does the inter-site replication cost value control?

A.The dollar cost charged for replication bandwidth

B.The path that the KCC selects for replication between sites when multiple links exist

C.The encryption strength used for replication

D.The compression ratio for replicated data

Explanation: The cost on a site link is an integer used by the Knowledge Consistency Checker (KCC) and Inter-Site Topology Generator (ISTG) to choose the lowest-cost path between sites. It does not represent monetary cost, encryption, or compression.

6A Group Policy Object is linked at both the domain level and an OU. The OU policy enforces password complexity ON, while the domain policy sets it OFF. With default processing, which setting wins for users in the OU?

A.Domain policy wins (always processed last at the OU level by inheritance)

B.OU policy wins because GPO processing follows L-S-D-OU and the closer OU is applied later

C.Both policies cancel out

D.The setting that was created first wins

Explanation: GPO processing order is Local, Site, Domain, OU (L-S-D-OU). Settings applied later overwrite earlier ones unless Enforced or Block Inheritance is used. The OU is closest to the user object, so its setting wins by default. Note: domain account password policy is a special case set via Default Domain Policy, but the question is about GPO precedence ordering.

7You want to enable hybrid identity so that on-premises Active Directory user accounts can sign in to Microsoft 365 with the SAME password they use on-premises, without deploying federation servers. Which Microsoft Entra Connect (Azure AD Connect) sign-in option is the SIMPLEST choice?

A.Federation with AD FS

B.Pass-through Authentication (PTA)

C.Password Hash Synchronization (PHS)

D.Seamless SSO only

Explanation: Password Hash Synchronization synchronizes a hash of a hash of the on-premises password to Microsoft Entra ID, allowing users to sign in with the same password without any additional infrastructure. PTA validates against on-prem AD but requires connector agents. AD FS is the most complex. Seamless SSO is an add-on, not a sign-in method.

8Which hybrid identity authentication method requires the deployed authentication agent on-premises to validate user passwords in real time against your on-premises Active Directory?

A.Password Hash Synchronization

B.Pass-through Authentication

C.Federation with AD FS

D.Cloud-only authentication

Explanation: Pass-through Authentication (PTA) installs a lightweight agent on-premises that validates passwords against AD in real time, so the password never leaves your environment. PHS synchronizes password hashes. Federation uses AD FS or third-party STS. Cloud-only does not use on-prem AD.

9To allow domain-joined Windows clients to silently sign in to Microsoft 365 without entering credentials, which feature must be enabled in Microsoft Entra Connect?

A.Seamless Single Sign-On (Seamless SSO)

B.Conditional Access

C.Privileged Identity Management

D.Password Writeback

Explanation: Seamless SSO automatically signs domain-joined users into Microsoft Entra ID using their Kerberos ticket from the on-premises domain. Conditional Access is a policy engine. PIM manages privileged role activation. Password Writeback writes cloud password changes back to on-prem AD.

10Users perform Microsoft Entra self-service password reset (SSPR) and you need that password change to update their on-premises Active Directory account. Which Entra Connect feature must be enabled?

A.Password Hash Sync

B.Password Writeback

C.Seamless SSO

D.Group Writeback

Explanation: Password Writeback synchronizes password changes made in Entra ID (such as via SSPR) back to the on-premises Active Directory account. PHS only sends hashes upward. Seamless SSO is a sign-in feature. Group Writeback writes cloud groups to AD DS.

About the Azure AZ-800 Exam

AZ-800 validates the skills required to administer Windows Server in hybrid environments that combine on-premises infrastructure with Microsoft Azure. Topics include deploying and managing Active Directory Domain Services in hybrid scenarios, configuring Windows Server in hybrid setups using Azure Arc, managing virtual machines and containers, implementing on-premises and hybrid networking, and managing storage and file services. Together with AZ-801, AZ-800 leads to the Microsoft Certified: Windows Server Hybrid Administrator Associate certification.

Assessment

Typically 40-60 questions, including multiple-choice, multiple-select, drag-and-drop, and case study items

Time Limit

100 minutes (plus brief intro and survey time, totaling about 120 minutes seat time)

Passing Score

700/1000 (Microsoft scaled score)

Exam Fee

US$165 (United States; varies by country) (Microsoft)

Azure AZ-800 Exam Content Outline

30-35%

Deploy and manage AD DS in on-premises and cloud environments

Active Directory Domain Services deployment, FSMO roles, AD trusts, sites and services, Group Policy, RODCs, gMSAs, AD Recycle Bin, Microsoft Entra Connect (Sync) and Cloud Sync, Password Hash Sync, Pass-through Authentication, Federation, Seamless SSO, password writeback, Microsoft Entra Domain Services.

10-15%

Manage Windows Servers and workloads in a hybrid environment

Azure Arc-enabled servers onboarding (Connected Machine agent, azcmagent), extensions, Run Command, Windows Admin Center, Azure Update Manager, Azure Policy guest configuration, hybrid management at scale.

15-20%

Manage virtual machines and containers

Hyper-V VM creation and configuration, Generation 1 vs 2, dynamic memory, integration services, Hyper-V Replica, failover clustering with CSV, virtual switches, NIC teaming and Switch Embedded Teaming, nested virtualization, Azure Site Recovery for on-prem to Azure DR, Windows containers.

15-20%

Implement and manage an on-premises and hybrid networking infrastructure

DHCP, DNS (including conditional forwarders), IP Address Management (IPAM), Branch Office Direct Printing, hybrid name resolution, BranchCache, network troubleshooting and connectivity to Azure.

15-20%

Manage Windows Server storage and file services

Storage Spaces Direct (S2D), SMB Multichannel and SMB over QUIC, DFS Namespaces, DFS Replication, Storage Replica, File Server Resource Manager (file screens, quotas), Data Deduplication, Storage Migration Service, Azure File Sync (cloud tiering, sync groups), MARS agent and Azure Backup.

How to Pass the Azure AZ-800 Exam

What You Need to Know

Passing score: 700/1000 (Microsoft scaled score)
Assessment: Typically 40-60 questions, including multiple-choice, multiple-select, drag-and-drop, and case study items
Time limit: 100 minutes (plus brief intro and survey time, totaling about 120 minutes seat time)
Exam fee: US$165 (United States; varies by country)

Keys to Passing

Complete 500+ practice questions
Score 80%+ consistently before scheduling
Focus on highest-weighted sections
Use our AI tutor for tough concepts

Azure AZ-800 Study Tips from Top Performers

1Spend the most study time on AD DS in hybrid environments because it is the largest single domain at 30-35% of the exam.

2Build a small hybrid lab with Hyper-V on Windows Server 2022, a domain controller, and a free Azure tier so you can practice Entra Connect, Azure Arc onboarding, and Azure File Sync end to end.

3Memorize the differences between Password Hash Sync, Pass-through Authentication, Federation, Seamless SSO, and password writeback, and know the supporting agents and required ports for each.

4Practice Azure Arc onboarding using azcmagent connect, including the Connected Machine Onboarding role and the outbound HTTPS endpoints required for registration.

5Drill Hyper-V topics: Generation 1 vs 2, Dynamic Memory, Hyper-V Replica intervals (30 sec, 5 min, 15 min), and the difference between External, Internal, and Private virtual switches.

6Know your storage options cold: Storage Spaces Direct minimums, SMB over QUIC (Datacenter: Azure Edition only), DFS Namespaces vs DFS Replication, Storage Replica topologies, and Azure File Sync cloud tiering.

7If you are testing close to September 30, 2026, decide whether to take AZ-800 before retirement or move to AZ-802 - reschedule rather than rush an unprepared attempt.

Frequently Asked Questions

When does AZ-800 retire and what replaces it?

Microsoft has announced that AZ-800 will retire on September 30, 2026. It is being replaced by AZ-802 (Administering Windows Server Hybrid Core Infrastructure) on the Microsoft Certified: Windows Server Hybrid Administrator Associate certification path. If you plan to test in late 2026, confirm the schedule on Microsoft Learn before booking.

What is the AZ-800 passing score?

The AZ-800 exam uses Microsoft's scaled scoring system with a passing score of 700 out of 1000. The exam typically delivers 40-60 questions and you have 100 minutes of test time (about 120 minutes total seat time including intro and survey).

How much does the AZ-800 exam cost?

The AZ-800 exam fee is US$165 in the United States. Prices vary by country and currency. Microsoft delivers the exam through Pearson VUE both in test centers and via online proctoring. Free renewal assessments on Microsoft Learn keep the credential active each year.

What domains does AZ-800 cover?

AZ-800 measures five skill areas: Deploy and manage AD DS in on-premises and cloud environments (30-35%), Manage Windows Servers and workloads in a hybrid environment with Azure Arc (10-15%), Manage virtual machines and containers (15-20%), Implement and manage on-premises and hybrid networking (15-20%), and Manage Windows Server storage and file services (15-20%).

Who should take AZ-800?

AZ-800 is aimed at Windows Server administrators who run on-premises and hybrid solutions integrated with Azure. Microsoft recommends 1-2 years of experience with Windows Server, including AD DS, Hyper-V, networking, storage, and PowerShell, plus familiarity with Azure services such as Arc, Azure Site Recovery, Azure File Sync, and Azure Backup.

How does AZ-800 relate to AZ-801?

AZ-800 (core infrastructure) and AZ-801 (advanced services) together earn the Windows Server Hybrid Administrator Associate certification. AZ-800 focuses on identity, compute, networking, and storage hybrid scenarios; AZ-801 focuses on advanced security, high availability, disaster recovery, and migration. Both are being refreshed as part of the September 30, 2026 transition.