Microsoft · AZ-801
Validates your ability to secure Windows Server on-premises and hybrid infrastructures, implement high availability and disaster recovery, migrate servers and workloads to Azure, and monitor and troubleshoot Windows Server environments.
Questions
1376
Duration
120 minutes
Passing Score
700/1000
Difficulty
AssociateLast Updated
Jan 2026
Use this AZ-801 practice exam to prepare for Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ-801) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 1,376 questions for Microsoft AZ-801, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Secure Windows Server on-premises and hybrid infrastructures, Implement and manage Windows Server high availability, Implement disaster recovery, Migrate servers and workloads, and Monitor and troubleshoot Windows Server environments. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
AZ-801: Configuring Windows Server Hybrid Advanced Services validates advanced skills in managing Windows Server workloads across on-premises and hybrid cloud environments. The exam, last updated on October 6, 2025, assesses a candidate's ability to secure Windows Server infrastructures, implement high availability and disaster recovery solutions, migrate servers and workloads to Azure, and monitor and troubleshoot complex Windows Server environments. Candidates are expected to work fluently with tools including Windows Admin Center, PowerShell, Azure Arc, Azure Policy, Azure Monitor, Azure Update Manager, Microsoft Defender for Identity, Microsoft Defender for Cloud, and IaaS virtual machine administration.
This is one of two required exams—alongside AZ-800—to earn the Microsoft Certified: Windows Server Hybrid Administrator Associate credential. While AZ-800 focuses on core infrastructure tasks such as AD DS, networking, storage, and virtualization, AZ-801 concentrates on advanced services: hardening security postures using Azure Sentinel and Defender, engineering failover clusters with Storage Spaces Direct, orchestrating disaster recovery via Azure Site Recovery and Azure Backup, executing large-scale migrations using Azure Migrate and Storage Migration Service, and implementing comprehensive monitoring pipelines through Azure Monitor and System Insights.
AZ-801 is designed for experienced Windows Server administrators who are extending their on-premises expertise into hybrid Azure environments. Ideal candidates include Systems Administrators, Infrastructure Engineers, Cloud Infrastructure Architects, and IT Operations professionals who already manage Windows Server environments and want to formalize their Azure hybrid capabilities. Microsoft recommends several years of hands-on Windows Server experience before attempting this exam.
This exam is particularly suited for professionals whose organizations are actively migrating workloads to Azure or adopting a hybrid model, and who collaborate with cloud architects, security engineers, and DevOps teams. It is not recommended as an entry-level certification; candidates without prior AZ-800-level knowledge or equivalent practical experience will find the advanced security, clustering, and disaster recovery topics challenging.
There are no mandatory formal prerequisites to register for AZ-801; however, Microsoft strongly recommends several years of experience with Windows Server operating systems before attempting the exam. Candidates are also expected to have working knowledge of the topics covered in AZ-800 (Administering Windows Server Hybrid Core Infrastructure), including Active Directory Domain Services, hybrid networking, storage, and virtualization, even if they have not formally sat that exam.
Familiarity with Azure fundamentals—including Azure portal navigation, Azure Virtual Machines, Azure networking concepts, and Azure Active Directory (now Microsoft Entra ID)—is essential. Practical experience with PowerShell scripting, Windows Admin Center, and at least one Azure hybrid service such as Azure Arc or Azure Monitor will significantly aid exam preparation. Microsoft's official instructor-led course AZ-801T00: Configure Windows Server Hybrid Advanced Services is the aligned training resource.
AZ-801 is a proctored exam delivered through Pearson VUE, available both online and at test centers. The exam contains approximately 40–60 scored questions and must be completed within 120 minutes. Question types include multiple choice, multiple select, drag-and-drop, case studies, and scenario-based labs, consistent with Microsoft's standard associate-level exam formats. A score of 700 out of 1000 is required to pass. Scoring is not linear; questions are weighted based on difficulty and domain importance.
The exam is priced at approximately $165 USD, though pricing varies by country or region. It is available in English, Japanese, Chinese (Simplified), Korean, German, French, Spanish, Portuguese (Brazil), Chinese (Traditional), and Italian. Candidates taking a non-English version may request an additional 30 minutes. The certification earned upon passing both AZ-800 and AZ-801 must be renewed annually via a free online assessment on Microsoft Learn.
Earning the Microsoft Certified: Windows Server Hybrid Administrator Associate (by passing both AZ-800 and AZ-801) positions professionals for roles such as Windows Server Administrator, Hybrid Cloud Administrator, Infrastructure Engineer, and Systems Engineer in organizations running hybrid Azure environments. The credential is particularly valued in enterprises undergoing datacenter modernization or cloud migration projects where deep Windows Server and Azure integration expertise is required. Salary ranges for certified Windows Server hybrid administrators typically fall between $85,000 and $125,000 USD annually depending on geography, experience, and employer, with senior hybrid infrastructure roles in major markets reaching higher.
The Windows Server Hybrid Administrator Associate is Microsoft's dedicated credential bridging traditional on-premises Windows Server administration and Azure cloud operations—a combination increasingly in demand as organizations run mixed environments rather than committing fully to either model. Compared to the Azure Administrator Associate (AZ-104), this certification goes deeper on Windows Server-specific workloads, failover clustering, AD DS security, and Hyper-V, making it complementary rather than redundant. The certification renews annually via a free online assessment on Microsoft Learn, keeping credential holders current with platform updates.
5 sample questions with answers and explanations. Start a practice session to test yourself across all 1376 questions.
Preview — answers shown1. Cyberdyne Systems is planning their guest clustering deployment. Sarah Connor asks about the deployment scenarios. How many primary deployment models are available for Hyper-V guest failover clusters using shared virtual hard disks?
Explanation
There are two preferred deployment models for Hyper-V guest failover clusters using shared virtual hard disks. Scenario 1 uses Cluster Shared Volumes (CSVs) on block storage including clustered Storage Spaces, where all VM files including shared VHDX files are stored on a CSV configured as shared storage. Scenario 2 uses Scale-Out File Server with SMB 3.0 on file-based storage, where shared VHDX files are stored on an SMB file share with a separate Hyper-V failover cluster. These two models provide flexibility for different infrastructure requirements and storage architectures.
2. Black Mesa needs to check which domain controllers currently hold FSMO roles in their forest. Which PowerShell cmdlet will show them the Schema Master role location?
Explanation
Get-ADForest is the correct PowerShell cmdlet to determine which domain controller holds the Schema Master FSMO role. The Schema Master is a forest-level FSMO role, and Get-ADForest returns forest-wide information including the SchemaMaster and DomainNamingMaster role holders. Get-ADDomain returns domain-level FSMO roles (PDCEmulator, RIDMaster, InfrastructureMaster) but not forest-level roles like Schema Master. Get-ADObject can query specific Active Directory objects but is not the standard cmdlet for FSMO role identification. Get-ADReplicationSite provides information about Active Directory sites and replication but not FSMO role assignments.
3. Aperture Science wants to implement extended replication for additional disaster recovery protection. GLaDOS asks about the configuration limitations for extended replication compared to standard Hyper-V Replica. What are the replication frequency options available for extended replication?
Explanation
Extended replication supports only 5 minutes and 15 minutes replication frequencies, unlike standard replication which also supports 30 seconds. Additionally, the extended replication frequency must be equal to or greater than the initial replication frequency, not lower. For example, if your primary to replica replication is set to 5 minutes, the extended replication can be set to 5 or 15 minutes, but not 30 seconds. Extended replication also has other limitations such as not supporting application-consistent replication and not being able to change the authentication type from the initial replication setup.
4. Tyrell Corporation is deploying DNSSEC and needs to configure trust anchors on their client systems. The replicant manufacturing facility requires clients to validate DNS responses from their signed zones. Which DNSSEC resource records can serve as trust anchors to enable client validation? (Select two!)
Multiple correct answersExplanation
Trust anchors in DNSSEC can be either DNSKEY or DS resource records. DNSKEY records contain the public keys that clients use to validate signatures, while DS records contain delegation signer information that helps establish chains of trust between parent and child zones. Client computers use these trust anchor records to build trust chains and validate that DNS responses are authentic and haven't been tampered with. You must configure trust anchors from the zone on every domain DNS server to validate responses from that signed zone. RRSIG records contain signatures, NSEC/NSEC3 handle negative responses, and SOA records provide zone authority information, but only DNSKEY and DS records serve as trust anchors.
5. Stark Enterprises is planning their Kubernetes cluster deployment and their project manager needs to understand the high-level deployment steps. What is the correct sequence for creating a basic Kubernetes orchestration solution?
Explanation
The correct sequence for creating a Kubernetes orchestration solution is: 1) Create a Kubernetes master/control plane (typically on Linux using kubeadm), 2) Configure a pod networking solution (using CNI plugins like Flannel), 3) Join worker nodes to the cluster (both Linux and Windows nodes), and 4) Manage Kubernetes resources using kubectl to deploy and manage applications. This sequence ensures the core infrastructure is established before adding compute capacity and workloads.
Microsoft Dynamics 365 Supply Chain Management Functional Consultant Expert (MB-335)
MB-335 · 2039 questions
Microsoft Dynamics 365 Business Central Functional Consultant (MB-800)
MB-800 · 1899 questions
Microsoft Certified: Azure AI Engineer Associate (AI-102)
AI-102 · 1392 questions
Microsoft Dynamics 365 Finance Functional Consultant (MB-310)
MB-310 · 1299 questions
Microsoft 365 Certified: Fundamentals (MS-900)
MS-900 · 1201 questions
Microsoft Certified: Power Platform Functional Consultant Associate (PL-200)
PL-200 · 1120 questions
$17.99
One-time access to this exam