.png&w=3840&q=75)
Question bank
Windows Server Hybrid Admin (Core)
41 Windows Server Hybrid Admin (Core) questions with the correct answer and a written explanation, organised across 5 exam domains.
- 41 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments
15 questions in this domain
- Question 1Single Choice
Which MMC snap-in is used to manage Active Directory sites, subnets, and the replication topology?
- AActive Directory Sites and ServicesCorrect answer
- BActive Directory Users and Computers
- CActive Directory Domains and Trusts
- DActive Directory Administrative Center
Why this is the answer
Active Directory Sites and Services manages sites, subnets, and replication topology. The other consoles manage objects, domains, or AD administrative tasks.
- Question 2Multiple Select
Which of the following are valid Active Directory Domain Services directory partitions? (Choose all that apply.)
- ASchema partitionCorrect answer
- BConfiguration partitionCorrect answer
- CDomain partitionCorrect answer
- DSYSVOL partition
Why this is the answer
Schema, configuration, and domain partitions are valid AD DS directory partitions; application partitions also exist. SYSVOL is a replicated folder, not a partition.
- Question 3Interactive
A server is prepared with the AD DS role. Examine the script in the code block. What AD DS component is created when you run it?
- AA new forest root domainCorrect answer
- BA child domain
- CAn additional domain controller in an existing domain
- DA read-only domain controller
Why this is the answer
Install-ADDSForest creates a new forest root domain. Child domains, replica domain controllers, and RODCs require different installation parameters.
- Question 4Single Choice
What is the default tombstone lifetime for Active Directory objects on Windows Server?
- A30 days
- B60 days
- C180 daysCorrect answer
- D365 days
Why this is the answer
The default tombstone lifetime is 180 days. This period is used by replication to ensure deletions are replicated before tombstones are removed.
- Question 5Multiple Select
Which two Active Directory FSMO roles are forest-wide? (Choose all that apply.)
- ASchema MasterCorrect answer
- BDomain Naming MasterCorrect answer
- CRID Master
- DPDC Emulator
Why this is the answer
Schema Master and Domain Naming Master are forest-wide roles. RID Master, PDC Emulator, and Infrastructure Master are domain-wide roles.
- Question 6Interactive
The PowerShell command in the code block is executed in the contoso.com domain. Which FSMO role is transferred?
- ASchema MasterCorrect answer
- BDomain Naming Master
- CRID Master
- DPDC Emulator
Why this is the answer
The OperationMasterRole value SchemaMaster moves the schema master to DC01. Other roles are moved with different values.
- Question 7Single Choice
Where are AD-integrated DNS zones such as ForestDNSZones stored?
- AApplication partitionCorrect answer
- BSchema partition
- CConfiguration partition
- DDomain partition
Why this is the answer
AD-integrated DNS zones are stored in application partitions. The other partition types serve schema, configuration, or domain data.
- Question 8Multiple Select
Which administrative tasks are performed by using Active Directory Sites and Services? (Choose all that apply.)
- ACreate and manage AD DS sitesCorrect answer
- BLink sites and configure replication costCorrect answer
- CAssign subnets to sitesCorrect answer
- DCreate DNS zones
Why this is the answer
Sites and Services controls sites, subnets, and site links. DNS zone management is performed by DNS Manager or PowerShell.
- Question 9Interactive
The code block contains a diagnostic command. Which AD DS subsystem does it test?
- AActive Directory replicationCorrect answer
- BDNS zone transfer
- CGroup Policy application
- DKerberos authentication
Why this is the answer
dcdiag /test:replications validates Active Directory replication between domain controllers. It does not test DNS, GPO, or Kerberos.
- Question 10Single Choice
Which FSMO role is responsible for assigning RID pools to domain controllers?
- ARID MasterCorrect answer
- BSchema Master
- CPDC Emulator
- DInfrastructure Master
Why this is the answer
The RID Master distributes RID pools to domain controllers. The schema, PDC, and infrastructure roles perform different functions.
- Question 11Multiple Select
Which characteristics apply to a Read-Only Domain Controller? (Choose all that apply.)
- AThe Active Directory database is read-only on the RODC.Correct answer
- BAn RODC can be placed in locations with lower physical security.Correct answer
- CPassword hashes are not cached for all users by default.Correct answer
- DAn RODC should be used as the schema master in the forest.
Why this is the answer
RODCs hold read-only databases, are suited to branch offices, and use a password replication policy. RODCs do not host FSMO roles.
- Question 12Interactive
The PowerShell command in the code block will add a domain controller to an existing contoso.com domain. Which account type should be provided in the credential prompt?
- ADomain Admins for contoso.comCorrect answer
- BLocal Administrator on the target server
- CGuest account from contoso.com
- DBackup Operators group
Why this is the answer
Domain administrator credentials are required to promote a new domain controller. Local admin, guest, or backup operator credentials are not sufficient.
- Question 13Single Choice
What is the default name of the first site created when a new Active Directory forest is installed?
- ADefault-First-Site-NameCorrect answer
- BDefault-Site-Name
- CFirst-Site-Name
- DSite-1
Why this is the answer
The first site in a new forest is named Default-First-Site-Name. Later, administrators can rename it if required.
- Question 14Multiple Select
You are promoting a new domain controller in an existing domain. Which prerequisites are required? (Choose all that apply.)
- ADNS resolution can locate an existing domain controllerCorrect answer
- BCredentials with domain administrator rights are availableCorrect answer
- CThe new server can reach a writable domain controllerCorrect answer
- DThe schema master role has been transferred to the new server
Why this is the answer
Adding a domain controller requires DNS access, domain admin rights, and reachability to a writable DC. The schema master does not need to move.
- Question 15Interactive
The PowerShell command in the code block is run in an Active Directory domain. What object will it create?
- AOrganizational UnitCorrect answer
- BDistribution group
- CSecurity group
- DAD site
Why this is the answer
New-ADOrganizationalUnit creates an OU container. Groups and sites are created by using different Active Directory cmdlets.
Implement and manage an on-premises and hybrid networking infrastructure
8 questions in this domain
- Question 16Single Choice
Which network component in Windows Server forwards IP packets between different subnets and can perform network address translation?
- AIP routerCorrect answer
- BLayer 2 switch
- CNetwork bridge
- DPacket filter
Why this is the answer
A router operates at Layer 3 and forwards IP packets between subnets. NAT is commonly implemented on routers to translate private and public addresses.
- Question 17Multiple Select
Which two functions are provided by a DHCP server in a Windows Server network environment?
- AAssigns IP addresses to clientsCorrect answer
- BRegisters DNS records for clientsCorrect answer
- CBlocks unwanted network traffic
- DEncrypts network communications
Why this is the answer
DHCP servers dynamically assign IP addresses and can register client DNS records. Packet filtering and encryption are provided by firewalls or IPsec, not DHCP.
- Question 18Interactive
Review the PowerShell output in the code block. What IP address is currently assigned to the network adapter?
- AIP address 10.10.0.25Correct answer
- BIP address 10.10.0.1
- CIP address 192.168.1.10
- DIP address 172.16.0.25
Why this is the answer
The Format-Table output shows the Ethernet0 adapter has IPv4 address 10.10.0.25. The other values in the output represent different network elements.
- Question 19Single Choice
Which DNS record type is used to resolve a host name to an IPv6 address in Windows Server DNS?
- AAAAA recordCorrect answer
- BA record
- CCNAME record
- DPTR record
Why this is the answer
IPv6 host addresses are stored in AAAA DNS records. A records are for IPv4, CNAME records are aliases, and PTR records handle reverse lookups.
- Question 20Multiple Select
Which two tools can an administrator use to view and configure network adapters on Windows Server?
- ANetwork Connections (ncpa.cpl)Correct answer
- BPowerShell Get-NetAdapter cmdletCorrect answer
- CActive Directory Users and Computers
- DDisk Management console
Why this is the answer
Network Connections provides a GUI for adapters, and Get-NetAdapter is the PowerShell cmdlet for viewing and configuring adapter settings. The other tools are unrelated.
- Question 21Interactive
The command in the code block configures a network interface. What IP address is set by this command?
- AIP address 192.168.1.50Correct answer
- BIP address 192.168.1.1
- CIP address 192.168.1.0
- DSubnet mask 255.255.255.0
Why this is the answer
New-NetIPAddress assigns the IP address specified by the -IPAddress parameter. Therefore, the Ethernet0 interface receives 192.168.1.50.
- Question 22Single Choice
Which network service translates fully qualified domain names into IP addresses on Windows Server networks?
- ADomain Name System (DNS)Correct answer
- BDynamic Host Configuration Protocol (DHCP)
- CWindows Deployment Services (WDS)
- DRemote Authentication Dial-In User Service (RADIUS)
Why this is the answer
DNS resolves human-friendly names to IP addresses. DHCP assigns addresses, WDS deploys images, and RADIUS authenticates network access.
- Question 23Multiple Select
Which two address elements are essential when configuring a static IPv4 address for local subnet communication?
- AIP addressCorrect answer
- BSubnet maskCorrect answer
- CDefault gateway
- DDNS server
Why this is the answer
A static IPv4 address must include the IP address and subnet mask. Default gateway and DNS server are often added but are not required for local subnet communication.
Manage Windows Servers and workloads in a hybrid environment
4 questions in this domain
- Question 24Single Choice
Your organization uses both on-premises Windows Servers and Azure virtual machines. You need a centralized way to manage these servers as Azure resources without migrating them. Which service should you use?
- AAzure ArcCorrect answer
- BAzure Migrate
- CAzure Site Recovery
- DWindows Admin Center
Why this is the answer
Azure Arc enables existing Windows Servers outside Azure to be represented as Azure resources. This allows governance such as Azure Policy and RBAC through the Azure portal. The other options do not provide this capability.
- Question 25Multiple Select
Which two options are valid management tools for Windows Server workloads in a hybrid environment?
- AAzure ArcCorrect answer
- BWindows Admin CenterCorrect answer
- CAzure Cognitive Services
- DAzure DevOps
Why this is the answer
Azure Arc provides management and governance for Windows Server workloads outside Azure. Windows Admin Center is a browser-based management console for Windows Servers. Azure Cognitive Services and Azure DevOps are not server management tools.
- Question 26Interactive
An administrator runs the PowerShell script shown in the code block. What Azure service is being used to manage the on-premises Windows Server?
- AAzure ArcCorrect answer
- BAzure Automation
- CAzure Update Management
- DAzure Monitor
Why this is the answer
The New-AzConnectedMachine cmdlet is part of the Azure Connected Machine module and is used to register an on-premises Windows Server with Azure Arc.
- Question 27Single Choice
An organization has an on-premises Active Directory Domain Services (AD DS) environment and Windows Server workloads that need Azure Active Directory (Azure AD) capabilities. Which identity configuration should be implemented for those servers?
- AHybrid Azure AD joinCorrect answer
- BStandard domain join
- CAzure AD B2B
- DResource forest trust
Why this is the answer
Hybrid Azure AD join registers on-premises domain-joined servers with Azure AD, enabling single sign-on and Conditional Access. A standard domain join alone does not create Azure AD device identity.
Manage storage and file services
8 questions in this domain
- Question 28Single Choice
Which Windows Server feature creates storage pools from physical disks to provide software-defined storage?
- AStorage SpacesCorrect answer
- BStorage Replica
- CData Deduplication
- DFailover Clustering
Why this is the answer
Storage Spaces lets you pool physical storage and create virtual disks with resiliency. Storage Replica is for replication, Data Deduplication reduces data footprint, and Failover Clustering is for high availability.
- Question 29Multiple Select
Which of the following are included in the File and iSCSI Services role? Select all that apply.
- AFile ServerCorrect answer
- BDFS NamespacesCorrect answer
- CDNS Server
- DiSCSI Target ServerCorrect answer
Why this is the answer
File and iSCSI Services includes File Server, DFS Namespaces, DFS Replication, File Server Resource Manager, NFS, and iSCSI Target Server. DNS Server is a separate role, not part of this role.
- Question 30Interactive
Review the PowerShell cmdlet in the code block. What is the primary purpose of this command?
- ACreate a new SMB file shareCorrect answer
- BDelete an existing SMB file share
- CSet NTFS permissions on the folder
- DCreate a DFS namespace
Why this is the answer
The New-SmbShare cmdlet creates a new SMB file share. It does not delete shares, modify NTFS permissions, or create DFS namespaces.
- Question 31Single Choice
Which Windows Server feature reduces storage costs by identifying and removing duplicate data at the block level?
- AData DeduplicationCorrect answer
- BStorage Replica
- CBitLocker
- DVolume Shadow Copy
Why this is the answer
Data Deduplication finds duplicated chunks and stores a single copy. Storage Replica replicates data, BitLocker encrypts, and Volume Shadow Copy creates snapshots.
- Question 32Multiple Select
Which features are supported by SMB 3.1.1 in Windows Server? Select all that apply.
- ASMB EncryptionCorrect answer
- BSMB MultichannelCorrect answer
- CSMB Direct over RDMACorrect answer
- DFTP tunneling
Why this is the answer
SMB 3.1.1 includes SMB Encryption, SMB Multichannel, and SMB Direct over RDMA. FTP tunneling is not an SMB feature.
- Question 33Interactive
Look at the PowerShell cmdlet in the code block. What is the purpose of this command?
- AList all SMB shares on the serverCorrect answer
- BCreate a new SMB share
- CDelete an SMB share
- DSet SMB share permissions
Why this is the answer
The Get-SmbShare cmdlet retrieves SMB shares. The Where-Object filter limits the output to shares named DataShare, but the overall purpose is to list SMB shares.
- Question 34Single Choice
Which protocol is primarily used by Windows Server to provide file sharing over a network?
- ASMBCorrect answer
- BNFS
- CHTTP
- DFTP
Why this is the answer
Windows Server uses SMB, Server Message Block, as the primary protocol for file sharing. NFS, HTTP, and FTP are also supported but are not the default file-sharing protocol.
- Question 35Multiple Select
Which of the following are valid resiliency types for Storage Spaces virtual disks? Select all that apply.
- ASimpleCorrect answer
- BMirrorCorrect answer
- CParityCorrect answer
- DConcatenated
Why this is the answer
Storage Spaces supports Simple, Mirror, and Parity resiliency types. Concatenated is not a Storage Spaces resiliency type.
Manage virtual machines and containers
6 questions in this domain
- Question 36Single Choice
What is the default isolation mode used by Windows containers on a Windows Server host?
- AProcess isolationCorrect answer
- BHyper-V isolation
- CVirtual Machine isolation
- DKernel isolation
Why this is the answer
By default, Windows containers use process isolation, in which the container shares the host kernel and processes are separated by namespaces.
- Question 37Multiple Select
Which two essential components must be installed or present on a Windows Server host to run Windows containers?
- AContainer hostCorrect answer
- BContainer imageCorrect answer
- CContainer registry
- DContainer orchestrator
Why this is the answer
A container host runs the container engine, and a container image supplies the application and OS files. A registry stores images, and an orchestrator is optional.
- Question 38Interactive
When a Windows Server administrator runs the command in the code block, what information is returned?
- AIDs and names of running containersCorrect answer
- BPulled images and their sizes
- CStopped containers and exit codes
- DContainer host configuration details
Why this is the answer
docker ps lists the IDs, names, and status of containers currently running on the host. It does not display images, stopped containers, or host configuration details.
- Question 39Single Choice
Besides the Containers feature, what additional Windows Server role is required to run Hyper-V isolated Windows containers?
- AHyper-V roleCorrect answer
- BFailover Clustering
- CNetwork Policy and Access Services
- DWindows Deployment Services
Why this is the answer
Hyper-V isolation requires the Hyper-V role, which supplies the lightweight VM boundary used to isolate each Windows container.
- Question 40Multiple Select
Which two base operating system images are most commonly used by administrators when creating Windows Server containers?
- AWindows Server CoreCorrect answer
- BNano ServerCorrect answer
- CWindows 11 Pro
- DAzure Linux
Why this is the answer
Microsoft provides Windows Server Core and Nano Server as the base images most commonly used to build Windows Server containers.
- Question 41Interactive
What action does the command shown in the code block perform on a Windows Server host?
- ADownloads the Windows Server Core container imageCorrect answer
- BStarts a new Windows Server Core container
- CDeletes a local Windows Server Core image
- DShows metadata about a Windows Server Core image
Why this is the answer
docker pull downloads a container image from a registry to the local host, making it available for running containers.
Frequently asked questions
Everything about the Windows Server Hybrid Admin (Core) question bank and how to use it.