Free AZ-801 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

To collect specific events (Event ID 1035) from Windows Application logs while minimizing data volume, you must filter at the source. The Azure Monitor Agent (AMA) uses Data Collection Rules (DCRs) to define which data to ingest. Within a DCR, you can apply an XPath query to filter for specific Event IDs before the data is transmitted to the Log Analytics workspace. This prevents the ingestion of unnecessary logs, thereby reducing storage costs. KQL is used for querying data already in the workspace, and WQL is for WMI; only XPath provides the granular source-side filtering required for Windows event logs in a DCR.

Microsoft Learn: Data Collection Rules in Azure Monitor. Section: "Filter events using XPath queries". Documentation on configuring the Azure Monitor Agent for specific event collection.

Microsoft Learn: Collect Windows event logs with Azure Monitor Agent. Details the use of XPath expressions (e.g., Application!*[System[(EventID=1035)]]) to limit log ingestion.

Microsoft Docs: Azure Monitor Agent overview. Technical specifications confirming AMA replaces the legacy Log Analytics agent and utilizes DCRs for efficient data routing and filtering.

W3C Recommendation: XML Path Language (XPath) Version 1.0. The underlying standard used by Windows Event Viewer and Azure Monitor DCRs for log selection.

The solution meets the goal. Microsoft Sentinel is built on a Log Analytics workspace. To collect data from an on-premises Windows Server, an agent must be installed on the server to forward logs to the workspace. The Log Analytics agent (also known as the Microsoft Monitoring Agent or MMA) is a supported method for this connection. The Windows Firewall data connector in Microsoft Sentinel relies on this agent to collect and forward the relevant firewall logs from the server. Therefore, installing the Log Analytics agent on Server1 is a correct and necessary step to enable log collection.

B. No: This is incorrect. Installing the Log Analytics agent is a valid and standard procedure for connecting on-premises Windows Servers to Microsoft Sentinel for log collection, as required by the Windows Firewall data connector.

1. Microsoft Learn | Microsoft Sentinel documentation. "Connect Windows Firewall to Microsoft Sentinel." This document explicitly states the prerequisites for the connector: "You can connect Windows Firewall logs from any Windows machine (physical or virtual

on-premises or in any cloud) that has the Log Analytics agent (MMA) or the Azure Monitor agent (AMA) installed." This confirms that installing the Log Analytics agent (MMA) is a valid solution.

2. Microsoft Learn | Azure Monitor documentation. "Log Analytics agent overview." This article details the agent's function: "The Log Analytics agent collects telemetry from Windows and Linux virtual machines from any cloud

on-premises machines

and those monitored by System Center Operations Manager and sends it to a Log Analytics workspace in Azure Monitor." This establishes the agent's role in connecting on-premises machines to the underlying platform used by Sentinel.

Add a custom domain name: By default, an Azure Web App is only accessible via [appname].azurewebsites.net. To enable the application (WebApp1) to accept and validate requests for the production URL (www.fabrikam.com), you must configure a custom domain name within the App Service settings. This binds the hostname to the resource.

Modify a DNS record: To actually direct internet traffic for www.fabrikam.com to the new Azure resource, you must update the authoritative DNS records (typically a CNAME record pointing to webapp1.azurewebsites.net or an A record pointing to the App Service IP). This resolves the domain name to the new Azure location for client connections.

Microsoft Learn - Map an existing custom DNS name to Azure App Service:

Section: "Overview" - "To use a custom domain... you must map the custom domain name to your app."

Section: "Map a CNAME record" - "A CNAME record maps a DNS name to another DNS name... creating a CNAME record that maps your custom domain to your app's default domain name."

URL: https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain

Microsoft Learn - Migration checklist when moving to Azure App Service:

Step: "Update DNS records to point to your App Service app."

URL: https://learn.microsoft.com/en-us/azure/app-service/manage-custom-dns-buy-domain

To perform a rolling upgrade with zero downtime, you must upgrade one node at a time. First, pause and drain the node (Suspend-ClusterNode) to live-migrate virtual machines to other nodes. Second, explicitly place the node in storage maintenance mode (Enable-StorageMaintenanceMode); this is a critical step for Storage Spaces Direct to prevent it from triggering massive data synchronization or repair jobs while the node is offline for the OS upgrade. Third, perform the upgrade to Windows Server 2025. After the upgrade and reboot, remove the node from storage maintenance mode to allow storage data to resync. Finally, resume the cluster node to allow it to host VMs again.

Microsoft Learn - Maintain servers in Azure Stack HCI and Windows Server: This documentation outlines the specific procedure for taking a server offline for maintenance in a Storage Spaces Direct environment, confirming the order of suspending the node, enabling storage maintenance mode, doing the work, disabling maintenance mode, and resuming the node.

Source: "Taking a server offline for maintenance"

URL: https://learn.microsoft.com/en-us/azure-stack/hci/manage/maintain-servers

Microsoft Learn - Cluster Operating System Rolling Upgrade: Describes the general process of pausing and draining nodes to ensure workloads remain available during the upgrade process.

Source: "Cluster Operating System Rolling Upgrade"

URL: https://learn.microsoft.com/en-us/windows-server/failover-clustering/cluster-operating-system-rolling-upgrade

The Storage Migration Service is the purpose-built tool in Windows Server for migrating file servers, including their files, shares, and configurations, from a source server to a destination server. It inventories data on old servers, transfers the data and configuration to new servers, and then optionally takes over the identity of the old server. This makes it the ideal solution for migrating an existing file share like Share1 to a new platform with minimal user disruption.

B. File Server Resource Manager (FSRM): FSRM is used for managing and classifying data on file servers, such as setting quotas or implementing file screens, not for migrating shares.

D. Storage Replica: Storage Replica is a disaster recovery technology used for replicating entire volumes between servers, not for a one-time migration of a specific share.

C. Server Manager: Server Manager is a general management console for Windows Server roles and features; it lacks the specialized, end-to-end workflow for migrating file shares.

1. Microsoft Learn. (2023). Storage Migration Service overview. "Storage Migration Service makes it easier to migrate storage to Windows Server... It provides a graphical tool that inventories data on Windows

Linux

and NetApp CIFS servers and then transfers the data and configuration to newer servers."

2. Microsoft Learn. (2023). File Server Resource Manager (FSRM) overview. "File Server Resource Manager (FSRM) is a suite of tools for Windows Server that enable you to manage and classify data stored on file servers."

3. Microsoft Learn. (2023). Storage Replica overview. "Storage Replica is Windows Server technology that enables replication of volumes between servers or clusters for disaster recovery."

Server1 (Request Mode): The "Request Inbound and Outbound" rule is permissive. It prefers security but does not enforce it. Therefore, Server1 can establish an IPsec tunnel with Server3 (which requires it) and Server2, but can also downgrade to standard TCP/IP to communicate with Server4 (which has no rules).

Server3 (Require Mode): The "Require Inbound and Outbound" rule is restrictive. Server3 sends a negotiation request (Main Mode/Quick Mode). Server1 and Server2 respond and establish the secure session. Server4, lacking any IPsec policy, ignores the negotiation or fails the handshake. Consequently, Server3 blocks traffic to/from Server4.

Microsoft Learn - Connection Security Rules: Rules that specify "Request" allow fallback to clear text, enabling communication with non-IPsec hosts. Rules that specify "Require" strictly enforce IPsec.

Source: Create an Authentication Exemption Rule (See "Request" vs "Require" behavior logic).

Microsoft Learn - IPsec Isolation: When Server isolation is implemented, servers in the "Boundary Zone" (Request mode) can talk to both "Secure Zone" (Require mode) and generic clients.

Source: Introduction to Server and Domain Isolation

To raise the Forest Functional Level (FFL) to Windows Server 2016, all Domain Controllers (DCs) in the forest must be running Windows Server 2016 or later. DC2 (Server 2022) and DC3 (Server 2019) already meet this requirement, but DC1 (Server 2012 R2) does not and prevents the raise.

To satisfy the requirements:

1. Move FSMO roles: DC1 currently holds all FSMO roles. To minimize downtime and unavailability of these roles during the upgrade process (which takes the server offline), they must be moved to a running DC (DC2) before work begins.
2. Upgrade DC1: Performing an in-place upgrade on DC1 updates its OS to a compliant version while preserving the identity and existence of the DC, ensuring there are still three domain controllers after the process.
3. Raise Functional Level: Once all DCs are at the required OS level, the functional level can be successfully raised.

Microsoft Learn. (2024). Upgrade Domain Controllers to Windows Server 2016. Retrieved from https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers

Relevant Section: "Prerequisites" and general upgrade procedures advise ensuring functional level requirements are met and recommending role transfers to maintain availability.

Microsoft Learn. (2024). Forest and Domain Functional Levels. Retrieved from https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels

Relevant Section: "Windows Server 2016: All domain controllers in the domain must be running Windows Server 2016 or newer."

The volume is already encrypted, so you must use Add-BitLockerKeyProtector to append a new protector. The command specifies the -ADAccountOrGroupProtector parameter with a computer account (CONTOSO\Server1$). When configuring a BitLocker volume to be unlocked by a specific service account or the computer account itself (common for non-OS data volumes that need to mount automatically without user interaction but bound to the machine identity), the -Service parameter is required. Enable-BitLockerAutoUnlock is incorrect because it does not support AD account parameters.

Microsoft Learn (PowerShell): Add-BitLockerKeyProtector

Confirming the syntax: Add-BitLockerKeyProtector [-MountPoint] [-ADAccountOrGroup] [-ADAccountOrGroupProtector] [-Service] ...

URL: https://learn.microsoft.com/en-us/powershell/module/bitlocker/add-bitlockerkeyprotector

Microsoft Learn (Operations): BitLocker Operations Guide

Discusses "Service-based" protectors for unlocking volumes on servers.

URL: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/operations-guide

First, the storage must be managed by the cluster, so you add the disk resource and then promote it by creating a Cluster Shared Volume (CSV). According to Microsoft best practices for CSVs, you must put the disk in maintenance mode (Suspend-ClusterResource) before modifying the volume with encryption to ensure exclusive access. Next, you enable BitLocker on the volume to encrypt the data. Finally, you update the BitLockerProtectorInfo property (using Set-ClusterParameter) with the key protector ID; this step is crucial for ensuring the Cluster service can retrieve the key and unlock the volume automatically across all nodes.

Microsoft Learn - BitLocker on Cluster Shared Volumes (CSV):

"When using BitLocker with volumes designated for a cluster... Put the resource into maintenance mode before enabling BitLocker."

This source confirms the necessity of maintenance mode specifically for CSVs.

Source: BitLocker: How to deploy on Windows Server 2012 and later (Section: BitLocker on Cluster Shared Volumes).

Microsoft Learn - PowerShell Cmdlets for Clustering:

Documentation for Set-ClusterParameter often uses BitLockerProtectorInfo in examples for configuring CSV encryption, confirming this is a post-encryption configuration step to store the recovery key ID in the cluster database.

Microsoft Technical Documentation - Failover Clustering:

The workflow is described as: Add Disk -> Add to CSV -> Suspend Resource (Maintenance) -> Enable BitLocker -> Resume Resource -> (Optional/Required per version) Update Cluster Parameter.

The goal is to ensure that the application App1 continues to run on Server2 after Server1 restarts. This behavior is known as "failback." The setting that controls this is on the Failover tab, labeled "Allow failback." The exhibit shows this is already set to "Prevent failback," which means the cluster will not automatically move App1 back to Server1 when it comes online.

The proposed solution is to increase the "Maximum failures in the specified period." This setting determines how many times the cluster will attempt to restart a role within a given timeframe before leaving it in a failed state. It has no effect on the failback policy. Therefore, the proposed solution does not address the stated goal.

A. Yes: This is incorrect. Modifying the "Maximum failures" setting does not control the failback behavior of a clustered role; it only affects the role's tolerance to repeated failures.

1. Microsoft Learn

Configure failover and failback for a clustered role: This document explicitly distinguishes between failover settings and failback settings. It states

"Failback is the process of returning a clustered role to its preferred node after the node is back online." It then details the "Prevent failback" option

which is already configured in the scenario. It separately describes the "Maximum failures" setting as controlling restart attempts

confirming it is unrelated to failback. (See sections: "Configure failback" and "Configure failover").

2. Microsoft Learn

Set-ClusterGroup: The documentation for the PowerShell cmdlet used to manage cluster roles shows distinct parameters for these settings. The -FailbackType parameter controls failback behavior (PreventFailback

AllowFailback

etc.)

while the -FailoverThreshold parameter corresponds to "Maximum failures in the specified period." This separation in the management tool confirms they are independent configurations. (See parameter descriptions for -FailbackType and -FailoverThreshold).

The Group Policy Object (GPO) applied to Server1 enforces the "Configure App Install Control" setting with the value "Allow apps from the Store only". This policy leverages Windows Defender SmartScreen to restrict application installations to only those sourced from the official Microsoft Store. Consequently, App1, which originates from the Microsoft Store, is permitted. App2 (from the Internet) and App3 (from a network share) are from sources other than the Microsoft Store and will be blocked by this policy.

B. App1 and App2 only: Incorrect. App2 is sourced from the internet, which is not the Microsoft Store, and will be blocked by the "Allow apps from the Store only" policy.

C. App1 and App3 only: Incorrect. App3 is sourced from a network share, which is not the Microsoft Store, and will be blocked by the "Allow apps from the Store only" policy.

D. App1, App2, and App3: Incorrect. The policy explicitly restricts installations to the Microsoft Store, therefore blocking App2 and App3.

1. Microsoft Learn. (2023). Manage app installation with Group Policy. This document details the "Configure App Install Control" Group Policy setting. It specifies that selecting "Allow apps from the Store only" restricts users to installing apps exclusively from the Microsoft Store.

Section: "Manage app installation with Group Policy"

Reference: The article describes the policy path Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer and the behavior of the "Allow apps from the Store only" option.

2. Microsoft Learn. (2023). Policy CSP - SmartScreen. This document describes the Mobile Device Management (MDM) policy equivalent to the GPO setting. The SmartScreenAppInstallControl policy with a value of msstore enforces the same restriction.

Section: "SmartScreenAppInstallControl"

Reference: The description for the msstore value states

"Allow apps from the Store only." This confirms the intended behavior of blocking apps from other sources like the internet or local shares.

3. Microsoft Learn. (2023). Windows Defender SmartScreen overview. This document provides context on how SmartScreen works to protect systems.

Section: "How Windows Defender SmartScreen helps to protect you"

Reference: The document explains that SmartScreen checks files downloaded from the internet against a list of reported malicious software sites and programs

and the "App Install Control" feature is an extension of this protection to control installation sources.

To enable replication for a Hyper-V cluster to Azure (specifically in a non-VMM scenario implied by "Hyper-V site"), the sequence is critical. First, Create an Azure Recovery Services vault to store metadata and backups. Second, Create a Hyper-V site within that vault; this acts as the logical container for your on-premises hosts. Third, Install and register Azure Site Recovery Providers on the Hyper-V hosts; during registration, you link the hosts to the vault and the specific Hyper-V site created earlier. Finally, Create and associate replication policies (defining RPO and retention) to the site before you can enable replication for individual VMs. The Azure Connected Machine agent is used for Azure Arc management, not the core ASR replication data flow.

Microsoft Learn: "Set up disaster recovery of on-premises Hyper-V VMs to Azure" - Section: Create a Recovery Services vault.

Confirms Step 1: "In the Azure portal... create a Recovery Services vault."

Microsoft Learn: "Set up disaster recovery of on-premises Hyper-V VMs to Azure" - Section: Set up the source environment.

Confirms Step 2 & 3: "To set up the source environment, you create a Hyper-V site... Then, you download and install the Azure Site Recovery Provider... on each host, and register the Hyper-V site in the vault."

Microsoft Learn: "Set up disaster recovery of on-premises Hyper-V VMs to Azure" - Section: Set up a replication policy.

Confirms Step 4: "Create a new policy... it's automatically associated with the specified Hyper-V site."

Microsoft Learn: "Prepare on-premises Hyper-V servers for disaster recovery to Azure" - Section: Prepare Infrastructure.

Confirms Sequence: Validates the workflow of Vault -> Site -> Provider -> Policy.

The Microsoft Azure Site Recovery Provider is a component that must be installed on each on-premises Hyper-V host whose virtual machines you intend to replicate to Azure. This provider coordinates and manages replication for all the VMs on that specific host. The scenario describes two Hyper-V hosts, Server1 and Server2, both containing VMs that need to be protected. Therefore, to enable replication for all VMs across both servers, the provider must be installed on each host, resulting in a minimum of two installations.

A: Installing only one provider would leave the virtual machines on the second Hyper-V host unprotected, as it would not be registered with the Recovery Services vault.

C: The provider is installed at the Hyper-V host level, not on each individual virtual machine. The number of VMs (five) is irrelevant to the provider count.

D: This number incorrectly sums the hosts and virtual machines. The provider is only required on the two Hyper-V hosts, not the VMs.

1. Microsoft Learn. (2024). Tutorial: Set up disaster recovery for Hyper-V VMs to Azure. In the "Prepare on-premises Hyper-V hosts" section

under Step 3 "Install the Provider

" the instruction states: "Run the installer on each Hyper-V host you want to register in the site." This confirms the per-host requirement.

2. Microsoft Learn. (2024). Replicate Hyper-V virtual machines (without VMM) to Azure. In the "Step 2: Prepare Hyper-V hosts" section

the documentation specifies: "Download and install the Microsoft Azure Site Recovery Provider on each Hyper-V host." This explicitly states the need for one provider per host.

3. Microsoft Learn. (2023). Hyper-V to Azure disaster recovery architecture. The architecture diagram and accompanying text under the "Architectural components" table describe the "Azure Site Recovery provider" as being installed on on-premises Hyper-V servers to enable registration and orchestration.

Scale-Out File Servers (SOFS) are designed for application data (like Hyper-V or SQL Server) and require Cluster Shared Volumes (CSV) to allow all nodes in the cluster to access the shared storage simultaneously (active-active).

File Servers for general use are traditional active-passive clusters typically used for standard file sharing (home folders, team shares) and support features like DFS Replication and Quotas. These servers do not support CSVs; instead, they rely on standard shared storage resources, typically a Logical Unit Number (LUN) presented as a "Physical Disk" resource within the cluster that fails over between nodes.

Microsoft Learn (Official Documentation): "Scale-Out File Server for application data overview"

Quote: "Scale-Out File Server requires Cluster Shared Volumes (CSV)... Clustered file servers that use the 'File Server for general use' option do not support Cluster Shared Volumes (CSV)."

Link: Scale-Out File Server for application data overview

Microsoft Learn: "Use Cluster Shared Volumes in a failover cluster"

Context: Confirms that CSVs are specifically architected for the Scale-Out File Server role and not the General Use role.

Link: Use Cluster Shared Volumes in a failover cluster

To perform an authoritative restore of SYSVOL using Distributed File System Replication (DFSR), you must designate the restored domain controller (DC1) as the primary member. This is achieved by modifying the msDFSR-Options attribute on the SYSVOL Subscription object of the domain controller.

1. Select Advanced Features: The SYSVOL Subscription object and the Attribute Editor tab are hidden by default. You must enable Advanced Features in the View menu of Active Directory Users and Computers (ADUC) on DC1 to locate the necessary object.
2. Modify msDFSR-Options: Navigate to the SYSVOL Subscription object under the DC1 computer account (Computer Object > DFSR-LocalSettings > Domain System Volume). Set the msDFSR-Options attribute to 1 to mark it as authoritative.
3. Connect to Network: Finally, connect DC1 to the network to initiate replication, forcing DC2 to synchronize from the authoritative DC1.

Microsoft Learn. (2024). Force authoritative and non-authoritative synchronization for DFSR-replicated SYSVOL (like "D4" for FRS). Retrieved from https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/force-authoritative-non-authoritative-synchronization (Refer to section: "How to perform an authoritative synchronization of DFSR-replicated SYSVOL").

Microsoft Learn. (2024). ms-DFSR-Options attribute. Retrieved from https://learn.microsoft.com/en-us/windows/win32/adschema/a-msdfsr-options

To onboard a large number of on-premises servers to Azure Arc using a script, a non-interactive authentication method is required. Creating a Microsoft Entra service principal is the standard and recommended first step for this at-scale scenario. The service principal acts as an identity for the script, allowing it to authenticate with Azure Resource Manager and register the servers without manual intervention. This approach adheres to the principle of least privilege by assigning the service principal only the specific permissions needed for onboarding (the "Azure Connected Machine Onboarding" role), and it minimizes administrative effort by automating the connection for all 500 servers.

A. Create a group managed service account (gMSA).

A gMSA is an Active Directory identity for services running on-premises. It is not used for authenticating to Azure to onboard servers to Azure Arc.

B. Download the Log Analytics workspace ID.

The workspace ID is required to configure the Azure Monitor Agent after the server is connected to Azure Arc. It is not the first step for the Arc onboarding process itself.

C. Generate a Log Analytics key.

The Log Analytics key is used with the workspace ID to authenticate the monitoring agent. This is a subsequent step after the server is successfully onboarded to Azure Arc.

1. Microsoft Learn

"Connect hybrid machines to Azure at scale." Under the "Prerequisites" section

it explicitly states: "To connect machines non-interactively using a service principal

you need to create a service principal to use to connect the machines to Azure." It then details the steps to create one and assign the required "Azure Connected Machine Onboarding" role. This confirms creating a service principal is the prerequisite for at-scale scripted onboarding.

2. Microsoft Learn

"Prerequisites for Azure Arc-enabled servers." In the "Service principal" section

it details the requirement: "If you're using a service principal to connect the machine

you must assign it the Azure Connected Machine Onboarding role." This reinforces that the service principal is the identity used for this task.

3. Microsoft Learn

"Enable VM insights overview." The "Prerequisites" section lists a Log Analytics workspace and the installation of the Azure Monitor Agent. This shows that configuring the connection to the workspace (which requires the ID and key) is part of enabling VM insights

a process that occurs on machines that are already managed

such as through Azure Arc.

Microsoft Defender for Cloud uses a vulnerability assessment solution to scan virtual machines for security vulnerabilities and potential exploits. When you enable this feature, Defender for Cloud deploys a scanner extension, such as the one for Microsoft Defender Vulnerability Management or Qualys, to the virtual machines. This extension actively scans the machine's operating system and installed applications for known vulnerabilities. The findings, including detected exploits, are then reported directly to Defender for Cloud for remediation and tracking. This is the most direct method to meet the specified requirement.

B. Microsoft Dependency agent: This agent is used by Azure Monitor for VMs to discover and map network dependencies between virtual machines; it does not scan for security exploits.

C. Log Analytics agent for Azure VMs: This agent collects security events and performance data from the guest OS. While it is a prerequisite for many Defender for Cloud features, it does not perform the active vulnerability scanning itself.

D. Guest Configuration agent: This agent is part of Azure Policy and is used to audit and enforce operating system and application settings for compliance, not to scan for software vulnerabilities.

---

1. Microsoft Learn | Defender for Cloud Documentation. "Find vulnerabilities and misconfigurations with Microsoft Defender Vulnerability Management." This document states

"The vulnerability scanner is powered by Microsoft Defender Vulnerability Management... The scanner is deployed through extensions to Azure virtual machines and Azure Arc-enabled machines." This directly links the vulnerability assessment capability to an extension.

2. Microsoft Learn | Defender for Cloud Documentation. "Enable vulnerability assessment for machines." This guide explains the process: "When you enable vulnerability assessment

Defender for Cloud prompts you to select a vulnerability assessment solution for your machines... Defender for Cloud automatically deploys the extension for your chosen solution on all supported machines in the subscription."

3. Microsoft Learn | Defender for Cloud Documentation. "Overview of agents used by Defender for Cloud." This page clarifies the distinct roles of various agents and extensions. It describes the "Vulnerability assessment extensions" as the component that "scans your machines for vulnerabilities" and differentiates it from the Log Analytics agent

Dependency agent

and Guest Configuration agent

whose purposes are data collection

dependency mapping

and policy compliance

respectively.

Statement 1 (Yes): Azure Storage Mover supports migrating SMB shares to Azure File Shares (SMB). Since storage1 is a Premium FileStorage account, it supports creating SMB file shares. Therefore, Share1 (SMB) can be migrated to azshare1 (configured as SMB).

Statement 2 (No): storage2 is a Standard StorageV2 account, which only supports SMB file shares (NFS file shares are restricted to the Premium FileStorage tier). Azure Storage Mover does not support migrating NFS sources to SMB targets (protocol mismatch). It requires the target to be an NFS Azure file share or a Blob container.

Statement 3 (Yes): Azure Storage Mover supports migrating NFS shares to Azure Blob Storage containers, specifically those with Hierarchical Namespace (HNS) enabled (Azure Data Lake Storage Gen2). azcont1 is in storage2 (HNS Enabled), making this a supported path.

Microsoft Learn, "Azure Storage Mover overview," Section: "Supported sources and targets". (Defines supported pairs: SMB->SMB File Share, NFS->NFS File Share, NFS->Blob/HNS).

Microsoft Learn, "NFS 4.1 file shares in Azure Files," Section: "Support". (States that NFS shares are only supported on the Premium FileStorage storage account kind).

Microsoft Learn, "Migrate to Azure Files using Azure Storage Mover," Section: "Prerequisites".

To configure an event subscription, the collector computer (the machine receiving the events) must have the Windows Event Collector service configured and running. In this scenario, Server1 is the collector because events are being forwarded to it.

The command wecutil qc (Windows Event Collector Utility Quick Config) is used specifically to configure the Windows Event Collector service. It performs the following actions:

1. Sets the Windows Event Collector service to start automatically (delayed start).
2. Starts the service.
3. Configures the Windows Firewall to allow the service to be accessed (if applicable).

The /q switch executes the command in "quiet" mode, suppressing confirmation prompts. The source computer (DC1) would require winrm qc, but the question specifically asks for the command to enable the Event Collector service, which resides solely on the collector.

Microsoft Learn. (2023). Use Windows Event Forwarding to help with intrusion detection. Retrieved from https://learn.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection

Relevance: Section "Configure the collector" explicitly states: "Run the following command on the collector computer: wecutil qc".

Microsoft Learn. (2023). wecutil. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wecutil

Relevance: Defines qc as the parameter to "Configures the Windows Event Collector service" and /q as "Quiet mode".

Microsoft Learn. (2021). Configure Advanced Audit Policy. Retrieved from https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/configure-advanced-audit-policy-planning

Relevance: Confirms the architectural distinction that the collector manages the subscription state via the Event Collector service.

On the source server (DHCP1), you must run Export-DhcpServer to save the DHCP configuration and lease data to a file. You must also run Remove-DhcpServerInDC to unauthorize the server in Active Directory, preventing it from servicing clients.

On the destination server (DHCP2), you must run Import-DhcpServer to load the configuration and lease data from the export file. Finally, you must run Add-DhcpServerInDC to authorize the new server in Active Directory, allowing it to start responding to DHCP requests.

Microsoft Learn (Official Documentation): Export-DhcpServer

"The Export-DhcpServer cmdlet exports the Dynamic Host Configuration Protocol (DHCP) server service configuration and lease data... to a specified file."

Source: https://learn.microsoft.com/en-us/powershell/module/dhcpserver/export-dhcpserver

Microsoft Learn (Official Documentation): Import-DhcpServer

"The Import-DhcpServer cmdlet imports the Dynamic Host Configuration Protocol (DHCP) server service configuration and lease data... from the specified file."

Source: https://learn.microsoft.com/en-us/powershell/module/dhcpserver/import-dhcpserver

Microsoft Learn (Official Documentation): Add-DhcpServerInDC

"The Add-DhcpServerInDC cmdlet adds the computer running the DHCP server service to the list of authorized Dynamic Host Configuration Protocol (DHCP) server services in the Active Directory (AD)."

Source: https://learn.microsoft.com/en-us/powershell/module/dhcpserver/add-dhcpserverindc

Microsoft Learn (Official Documentation): Remove-DhcpServerInDC

"The Remove-DhcpServerInDC cmdlet deletes the computer running the Dynamic Host Configuration Protocol (DHCP) server service from the list of authorized DHCP server services in the Active Directory (AD)."

Source: https://learn.microsoft.com/en-us/powershell/module/dhcpserver/remove-dhcpserverindc