Examkin

Question

Difficulty: HardCompute Virtualization Solutions

A financial services firm is planning to migrate a core risk-modeling simulation workload to Azure. The application has the following requirements:
- Complete physical isolation at the hardware level for the underlying physical servers to meet strict compliance mandates.
- In-memory data protection during processing using hardware-based enclaves that support Intel Software Guard Extensions (SGX).
- An overall availability service level agreement (SLA) of 99.99% for the virtual machines.
- The workload runs continuously and cannot tolerate unexpected evictions or interruptions.

Which two of the following configurations should you include in the infrastructure design to meet the requirements? (Select TWO).

  1. Azure Dedicated Hosts using the DCsv3-Type1 host sizeAnswer
  2. A host group distributed across at least two Availability ZonesAnswer
  3. C
    Azure Functions deployed on a Consumption plan to run the simulations
  4. D
    Azure Spot Virtual Machines deployed within the dedicated host group
  5. E
    A host group with all Dedicated Hosts deployed in a single Availability Zone

Answer

To meet the requirements, the architecture must include Azure Dedicated Hosts using the DCsv3-Type1 host size and a host group distributed across at least two Availability Zones.
The correct design utilizes Azure Dedicated Hosts using the DCsv3-Type1 host size distributed across at least two Availability Zones. The DCsv3-Type1 host size supports DCsv3-series VMs, which provide the required physical isolation and hardware-enclave protection using Intel SGX. Distributing the hosts across at least two zones ensures the design meets the 99.99% virtual machine availability SLA.

Step-by-Step Solution

1
Identify the compute family that supports the security requirements.
The DCsv3-series virtual machines and DCsv3-Type1 Dedicated Hosts are selected.
Intel SGX-based confidential computing enclaves are supported on DCsv3-series VMs, whereas ECasv5 or other series do not support SGX enclaves.
2
Evaluate high availability and SLA constraints.
A Host Group distributed across at least two Availability Zones must be used.
Azure SLA for Dedicated Hosts requires spreading hosts across at least two zones to guarantee 99.99% VM connectivity.
3
Filter out solutions that introduce eviction risk or fail hardware isolation.
Spot VMs and Consumption-based Azure Functions are ruled out.
Spot VMs are prone to evictions and cannot run on Dedicated Hosts. Azure Functions Consumption plan lacks physical hardware isolation and has execution timeouts.

Key Concept

Designing high-availability and confidential compute solutions using Azure Dedicated Hosts and Intel SGX-enabled virtual machines.
Rate this question

Topics

Compute Virtualization Solutions

More questions from this topic