Question

Difficulty: MediumBlob, File, and Disk Storage Solutions

An enterprise is migrating a high-throughput transactional database workload to Azure Virtual Machines. The database storage architecture must satisfy the following requirements:
- The database transaction logs require consistent sub-millisecond write response times and high IOPS.
- The storage infrastructure must survive a localized datacenter (zone) failure within the primary region without data loss.
- Backup files containing database exports must be stored securely and made accessible to external auditors via a HTTPS URL for exactly seven days, with the capability to immediately revoke access if a security anomaly is detected.

Which storage and access configuration should you recommend to meet these requirements?

  1. Configure the transaction logs on Ultra Disk or Premium SSD v2 managed disks using Zone-Redundant Storage (ZRS). Store the backup files in an Azure Blob storage container with Zone-Redundant Storage (ZRS), and grant the auditors access using a Shared Access Signature (SAS) associated with a stored access policy.Answer
  2. B
    Configure the transaction logs on Standard SSD managed disks using Zone-Redundant Storage (ZRS). Store the backup files in an Azure Blob storage container with Zone-Redundant Storage (ZRS), and grant the auditors access using a Shared Access Signature (SAS) associated with a stored access policy.
  3. C
    Configure the transaction logs on Ultra Disk or Premium SSD v2 managed disks using Locally Redundant Storage (LRS). Store the backup files in an Azure Blob storage container with Locally Redundant Storage (LRS), and grant the auditors access using a Shared Access Signature (SAS) associated with a stored access policy.
  4. D
    Configure the transaction logs on Ultra Disk or Premium SSD v2 managed disks using Zone-Redundant Storage (ZRS). Store the backup files in an Azure Blob storage container with Zone-Redundant Storage (ZRS), and grant the auditors access using an ad-hoc Shared Access Signature (SAS) token configured with a seven-day expiration.

Answer

Configure the transaction logs on Ultra Disk or Premium SSD v2 managed disks using Zone-Redundant Storage (ZRS). Store the backup files in an Azure Blob storage container with Zone-Redundant Storage (ZRS), and grant the auditors access using a Shared Access Signature (SAS) associated with a stored access policy.
The correct configuration uses Ultra Disk or Premium SSD v2 managed disks with Zone-Redundant Storage (ZRS) for the transaction logs, meeting the sub-millisecond latency and zone-redundancy requirements. For the backup files, Azure Blob storage with Zone-Redundant Storage (ZRS) provides the necessary resilience, and utilizing a Shared Access Signature (SAS) linked to a stored access policy allows the access to be immediately revoked by modifying or deleting the policy.

Step-by-Step Solution

1
Analyze the performance requirements for the database transaction logs.
Identify that consistent sub-millisecond write response times and high IOPS require high-performance disk types such as Premium SSD v2 or Ultra Disk.
Standard SSD and Standard HDD tiers do not guarantee the low latency and high IOPS necessary for database logs.
2
Determine the redundancy requirements for both transaction logs and backup files.
Determine that Zone-Redundant Storage (ZRS) is required for both systems to survive a localized datacenter (zone) failure.
Locally Redundant Storage (LRS) replicates data only within a single datacenter, making it vulnerable to zone outages.
3
Evaluate the security and revocation requirements for the temporary backup access.
Select a Shared Access Signature (SAS) associated with a stored access policy.
An ad-hoc SAS cannot be revoked without rotating the storage account keys. Associating the SAS with a stored access policy allows immediate revocation by deleting or updating the policy.

Key Concept

Designing high-performance, zone-resilient disk storage and securing Azure Blob storage using revocable access methods (Stored Access Policies).
Rate this question