AZ-800 Exam Alignment
AZ-800

Deploy and manage DNS and DHCP services: Configure AD-integrated DNS zones, understand SRV records, set up DHCP scopes and failover, and integrate DNS and DHCP to support Active Directory.

• Know why AD-integrated DNS zones are preferred over standard primary/secondary zones for AD environments
• Understand the role of SRV records in AD — domain controllers register these at startup to advertise their services
• Know DHCP scope, exclusion range, reservation, and option configuration
• Understand DHCP failover and its two modes: Hot Standby and Load Balance

Exam Tip: AZ-800 tests DNS heavily. Know that AD-integrated zones use multi-master replication (any DC can accept updates), replicate via AD replication (not zone transfers), and can use secure dynamic updates only. Also know that if SRV records are missing (e.g. after DNS corruption), re-register them with netlogon service restart or nltest /dsregdns.

🌐 Active Directory-Integrated DNS Zones

AD DS requires DNS to function. When you install the first domain controller, the AD DS setup wizard installs and configures DNS automatically. AD-integrated zones are the recommended zone type for all AD environments.

SRV Records — How Clients Find Domain Controllers

When a domain controller starts the NETLOGON service, it automatically registers SRV records in DNS. These records are how clients locate services in the domain:

🔌 DHCP Integration with Active Directory

DHCP servers in an AD environment must be authorised in Active Directory before they will serve IP addresses. This prevents rogue DHCP servers from handing out incorrect addresses.

DHCP Console — DC01.techcareers.local
|
IPv4

🔌 DHCP

🏠 DC01.techcareers.local

📱 IPv4

🎼 Scope [10.0.1.0]

🔄 Address Pool

⏳ Leases

⚡ Reservations

⚙️ Scope Options

⚙️ Server Options

Scope: London Workstations [10.0.1.0/24]

Setting	Value
Address Range	10.0.1.1 — 10.0.1.254
Exclusions	10.0.1.1 — 10.0.1.20 (servers/infrastructure)
Lease Duration	8 days
Option 003 Router	10.0.1.1
Option 006 DNS	10.0.1.10, 10.0.1.11 (DC01, DC02)
Option 015 DNS Domain	techcareers.local

# Create an AD-integrated DNS zone
Add-DnsServerPrimaryZone -Name 'techcareers.local' -ReplicationScope 'Domain' -DynamicUpdate 'Secure'

# Add a conditional forwarder
Add-DnsServerConditionalForwarderZone -Name 'partner.com' -MasterServers 8.8.8.8 -ReplicationScope 'Domain'

# Re-register SRV records after DNS issue
Restart-Service netlogon

# Authorise DHCP server in Active Directory
Add-DhcpServerInDC -DnsName 'DC01.techcareers.local' -IPAddress '10.0.1.10'

# Create a DHCP scope
Add-DhcpServerv4Scope -Name 'London-Workstations' -StartRange '10.0.1.21' -EndRange '10.0.1.254' -SubnetMask '255.255.255.0' -LeaseDuration '8.00:00:00'

# Configure scope options (router, DNS servers, DNS domain name)
Set-DhcpServerv4OptionValue -ScopeId '10.0.1.0' -Router '10.0.1.1' -DnsServer '10.0.1.10','10.0.1.11' -DnsDomain 'techcareers.local'

# Configure DHCP failover (Hot Standby)
Add-DhcpServerv4Failover -Name 'London-Failover' -ScopeId '10.0.1.0' -PartnerServer 'DC02.techcareers.local' -Mode 'HotStandby' -ServerRole 'Active'

💡 Best Practices

• Always use AD-integrated DNS zones — they provide multi-master updates, AD-replicated replication, and secure dynamic updates without requiring zone transfers
• Configure domain controllers as their own primary DNS server pointing to 127.0.0.1 or the DC’s own IP, with a secondary pointing to another DC
• Never point domain clients to external DNS servers (8.8.8.8) as their primary — they must resolve internal AD DNS records first
• Enable DHCP failover for every production scope — a single DHCP server outage will prevent new clients from getting IP addresses
• Use Load Balance mode (50/50 split) for DHCP failover when both DHCP servers are in the same site; use Hot Standby when they are in different sites
• Set DHCP Option 015 (DNS Domain Name) and Option 006 (DNS Servers) at scope level so clients automatically get the correct DNS configuration

🎓 Interview Q&A