Microsoft AZ-800 Dumps - Pass Administering Windows Server Hybrid Core Infrastructure Exam in 2026

The Windows Server DHCP role supports reservations that map a client's unique identifier (commonly the MAC address) to a specific IPv4 address inside the scope. The AZ-800 study material describes reservations as the mechanism to ''ensure that a particular device always receives the same IP address from the DHCP server while still being managed by DHCP.'' When a reservation exists, the DHCP server will always offer and lease the reserved address to that client and will not allocate that address to any other client. This meets scenarios such as networked printers, appliances, or servers that require a consistent IP but where you still want centralized lease management (lease tracking, option delivery, and centralized auditing). The content further contrasts reservations with exclusions and options: exclusions remove addresses from the pool and options deliver configuration parameters, neither of which guarantees a stable assignment to a given device. Therefore, creating one DHCP reservation per printer in Scope1 precisely satisfies the requirement that the printers are always assigned the same IP address.

The Azure File Sync section of the Administering Windows Server Hybrid Core Infrastructure materials states that a sync group defines the topology for synchronization and ''contains one cloud endpoint and one or more server endpoints.'' A cloud endpoint is an Azure file share associated with a Storage Sync Service. The guidance also notes that ''the Storage Sync Service and the storage account (file share) must reside in the same Azure region'' and that ''a single Azure file share can be the cloud endpoint for only one sync group.'' In the scenario, SyncA is in West US, so only file shares in West US (for example, storage1\share1 or storage2\share2) are eligible. However, regardless of how many eligible shares exist, the exam guide is explicit: each sync group supports a maximum of one cloud endpoint. Additional endpoints in the group must be server endpoints on Windows Server volumes. Therefore, the maximum number of cloud endpoints you can use with GroupA is 1, which directly reflects the product's architecture and the documented exam objective requirements.

Within the hybrid governance section of Administering Windows Server Hybrid Core Infrastructure, Microsoft specifies that Azure Arc--enabled servers are the mechanism to bring on-premises and multi-cloud servers under Azure control to apply Azure Policy (Guest Configuration) and Defender for Servers. The prerequisite is installing the Azure Connected Machine agent (Azure Arc agent) on each server: ''To manage servers with Azure Policy and configuration management, install the Connected Machine agent to onboard them to Azure Arc; once connected, you can assign Azure Policy guest configuration and monitor compliance just like Azure VMs.'' Hybrid Azure AD Join is unrelated to Azure Policy assignment; the Azure Monitor agent provides telemetry but does not onboard to Arc for policy governance; a hybrid runbook worker is for Automation runbooks, not for enforcing Azure Policy. Therefore, to ''use Azure Policy to enforce configuration management policies on the servers in Azure and on-premises,'' deploy the Azure Connected Machine agent to all servers to Arc-enable them and then assign the desired policies.

In Windows Admin Center (WAC), ''gateway access'' is controlled by the Allowed groups list on the gateway. The AZ-800 materials explain that membership in the local Administrators group on the WAC gateway still permits sign-in unless you explicitly scope access to specific groups in the Allowed groups list. The guidance further states that to restrict who can sign in to the WAC gateway, you must populate Allowed groups with one or more security groups (for example, a domain group) and remove broad principals (like BUILTIN\Users). Until you add at least one explicit group, existing administrators can continue to authenticate, which is why ''everyone'' appears able to sign in after only removing BUILTIN\Users. By adding a dedicated security group to Allowed groups, only members of that group can authenticate to the gateway UI; non-members are denied. Settings such as Performance profile or Require manage-as sessions to re-authenticate affect performance and remote management prompts, not gateway sign-in. Proxy bypass lists control outbound connectivity, not access control. Therefore, to prevent unauthorized sign-ins, configure Allowed groups with a specific security group and manage membership there.

In Administering Windows Server Hybrid Core Infrastructure, the operations that affect forest-wide naming contexts are tied to specific FSMO roles. The material explains that AD DS contains five FSMO roles---Schema Master, Domain Naming Master, RID Master, PDC Emulator, and Infrastructure Master---and each governs a unique set of authoritative changes. The course notes state:

''The Domain Naming Master is responsible for all changes to the forest namespace. This includes adding and removing domains and application directory partitions (also called application naming contexts). Because these operations change the forest-wide naming structure, the Domain Naming Master must be online and reachable to perform them.''

It further emphasizes:

''Creation or deletion of application partitions is a forest-scoped operation. Only the Domain Naming Master can process these updates to ensure single-master consistency of the forest's name context metadata.''

By contrast, the Schema Master controls schema updates, the RID Master allocates RID pools, the PDC Emulator provides time sync and password update precedence, and the Infrastructure Master maintains cross-domain reference updates. None of these roles can substitute for the Domain Naming Master when creating application partitions. Therefore, if DC1 (which holds the Domain naming master role) fails, you cannot create new application partitions until that role holder is restored or the role is transferred/seized to another domain controller.