Examkin

All practice questions

1198 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 1Question →

Lumina Healthcare has an on-premises Active Directory Domain Services (AD DS) forest named internal.luminahealth.org. You are designing a hybrid identity solution to integrate the on-premises AD DS with a new Microsoft Entra ID tenant.

The solution must meet the following requirements:
- Users must be able to authenticate to cloud services using their on-premises passwords.
- Users must be able to authenticate to cloud services even during a complete on-premises internet connectivity outage.
- Users must be allowed to reset their passwords using Microsoft Entra Self-Service Password Reset (SSPR), and password changes must immediately sync back to on-premises.
- Multi-factor authentication (MFA) must be enforced for all admin accounts, but you must prevent accidental tenant lockout if the primary MFA service experiences an outage.

Which identity design meets all of these requirements?

Show answer & explanation

Answer: Configure Password Hash Synchronization (PHS) and enable Password Writeback in Microsoft Entra Connect. Implement a Conditional Access policy requiring MFA for all administrator roles, and exclude a designated emergency access account from this policy.

Answer

Configure Password Hash Synchronization (PHS) and enable Password Writeback in Microsoft Entra Connect, combined with a Conditional Access policy requiring MFA for administrative roles that excludes an emergency access account.
The correct option addresses all design constraints by utilizing Password Hash Synchronization (PHS) for resilient hybrid identity, enabling Password Writeback to support self-service password reset (SSPR), and excluding a break-glass account from the administrator multi-factor authentication (MFA) policy to prevent tenant lockout.

Step-by-Step Solution

1
Select the hybrid authentication sync method that maintains service availability during on-premises internet outages.
Password Hash Synchronization (PHS) is selected.
PHS validates credentials in the cloud directly, unlike AD FS or PTA which require real-time connectivity to the on-premises infrastructure.
2
Ensure password changes initiated in Microsoft Entra ID are replicated back to the on-premises Active Directory Domain Services.
Password Writeback is enabled.
This enables Microsoft Entra Self-Service Password Reset (SSPR) to write password updates back to the on-premises domain controllers immediately.
3
Apply a Conditional Access policy for administrative accounts with a lockout prevention mechanism.
Exclude a designated emergency access (break-glass) account from the MFA policy.
Failing to exclude an emergency account risks locking all admins out of the tenant if the MFA service is disrupted.

Key Concept

Selecting PHS for high availability hybrid identity authentication, enabling Password Writeback for SSPR, and configuring emergency access exclusions to prevent tenant lockout.
Question 2Question →

An enterprise architect is designing an identity and access management strategy for a multinational corporation. The strategy must incorporate Microsoft Entra ID hybrid authentication, identity protection, and granular access controls. Match each corporate security and technical requirement on the left to the most appropriate Microsoft Entra ID or Conditional Access feature on the right that satisfies the requirement.

Click a left item, then click its matching right item

Items

Authenticate users against on-premises Active Directory Domain Services (AD DS) without synchronizing password hashes or credentials to the cloud, and without deploying federated servers.
Enforce phishing-resistant multi-factor authentication (MFA) exclusively when accessing sensitive financial applications, while permitting standard push notifications for other cloud services.
Automatically require users to change their password using Self-Service Password Reset (SSPR) when their credentials are found to be compromised and leaked on public networks.
Allow external partner users to access internal resources only if their devices are marked as compliant within their home tenant, trusting the compliance state across directories.

Matches

Show answer & explanation

Answer

Match 'Authenticate users against on-premises Active Directory Domain Services (AD DS) without synchronizing password hashes...' to 'Microsoft Entra Pass-through Authentication (PTA)'; match 'Enforce phishing-resistant multi-factor authentication (MFA) exclusively...' to 'Conditional Access Authentication Strengths'; match 'Automatically require users to change their password...' to 'Microsoft Entra ID Protection User Risk Policy'; match 'Allow external partner users to access internal resources...' to 'Microsoft Entra External ID Cross-Tenant Access Settings'.
Pass-through Authentication (PTA) allows secure, on-premises credential validation without cloud password synchronization or ADFS. Conditional Access Authentication Strengths allow defining specific MFA methods like phishing-resistant authentication. Microsoft Entra ID Protection User Risk Policies handle long-term risks like leaked credentials and require password change remediation. Cross-Tenant Access Settings let resource tenants trust compliant devices managed by external Entra tenants.

Step-by-Step Solution

1
Analyze the authentication requirement that forbids credential sync and federated servers.
Identify that Password Hash Synchronization (PHS) syncs hashes and Active Directory Federation Services (AD FS) is a federated server infrastructure. Pass-through Authentication (PTA) fulfills the exact criteria by validating passwords against on-premises AD DS using a local agent.
To design the appropriate hybrid identity integration without storing credentials in the cloud or deploying federated infrastructure.
2
Determine the mechanism to enforce phishing-resistant MFA for specific applications.
Recall that Conditional Access authentication strengths allow policy enforcement of specific MFA methods (like FIDO2 security keys) per application, rather than applying a global or coarse MFA policy.
To enforce granular, application-specific authentication requirements.
3
Evaluate the remediation strategy for compromised/leaked credentials.
Identify leaked credentials as a user-level risk. A Microsoft Entra ID Protection User Risk Policy can detect this and trigger a secure password change through Self-Service Password Reset (SSPR) to transition the user back to a low-risk state.
To secure compromised accounts using automated risk-based policies.
4
Assess how to trust device compliance states from partner tenants.
Select cross-tenant access settings, which permit inbound trust configuration for external tenant multi-factor authentication and compliant devices.
To enable secure external collaboration without requiring partner devices to enroll in the local Intune tenant.

Key Concept

Microsoft Entra ID hybrid identity integration, advanced Conditional Access policies, risk-based access, and cross-tenant resource governance.
Estimated Time:3m 0s
Question 3Question →

A healthcare provider is deploying a new web application on Azure App Service. The compliance team mandates that web server logs must be retained for seven years in a WORM (Write Once, Read Many) state to meet regulatory audits. Additionally, the security operations center (SOC) requires real-time log streaming to an on-premises Security Information and Event Management (SIEM) system. Which log routing design should you recommend to meet these requirements?

Show answer & explanation

Answer: Configure a diagnostic setting on the App Service to stream logs to an Azure Event Hubs namespace for SIEM integration, and to an Azure Storage account with time-based retention policies in immutable storage for archival.

Answer

Configure a diagnostic setting on the App Service to stream logs to an Azure Event Hubs namespace for SIEM integration, and to an Azure Storage account with time-based retention policies in immutable storage for archival.
Routing logs to Azure Event Hubs ensures the real-time streaming requirement for the on-premises SIEM is met, while simultaneously routing to Azure Storage with time-based immutable policies satisfies the seven-year WORM archival requirement in a highly cost-efficient manner.

Step-by-Step Solution

1
Identify the real-time streaming requirement.
Azure Event Hubs is selected as the destination to stream log data to an external, on-premises SIEM in real-time.
Event Hubs acts as the ingestion point for large-scale, real-time log streaming to third-party or on-premises systems.
2
Address the WORM storage and retention requirement.
Azure Blob Storage with immutable storage (time-based retention) is selected for the 7-year archival period.
Immutable storage in Azure Storage accounts provides compliance-grade WORM storage at a highly cost-effective rate compared to active workspace ingestion.
3
Combine the routing mechanisms into a single design.
A diagnostic setting is defined on the App Service that routes logs to both destinations simultaneously.
Azure Monitor diagnostic settings support sending log data to multiple endpoints (Event Hubs, Storage Account, Log Analytics) at the same time.

Key Concept

Azure Monitor diagnostic settings enable routing log data to multiple destinations, including Event Hubs for real-time streaming and Storage Accounts for immutable, cost-effective compliance archiving.
Estimated Time:2m 0s
Question 4Question →

A financial services corporation is establishing a new multi-region environment under a single tenant. The environment is organized under a root-level management group named Enterprise-Core-MG. To comply with regulatory standards, the corporation must enforce two governance policies across all existing and future subscriptions:

1. A specific diagnostic setting must be automatically configured on all subscriptions to forward activity logs to a centralized Log Analytics workspace in the security subscription.
2. A delegated team of operations engineers must be granted the ability to create and manage virtual machines within all subscriptions, without allowing them to modify subscription-level access controls or delete the centralized logging configurations.

Which design configuration should you recommend to meet the requirements while minimizing administrative overhead?

Show answer & explanation

Answer: Deploy an Azure Policy definition with the deployIfNotExists effect at the Enterprise-Core-MG scope to configure the diagnostic settings. Create a Microsoft Entra ID security group, add the operations engineers to the group, and assign the Virtual Machine Contributor role to the group at the Enterprise-Core-MG scope.

Answer

Deploy an Azure Policy definition with the deployIfNotExists effect at the Enterprise-Core-MG scope to configure the diagnostic settings. Create a Microsoft Entra ID security group, add the operations engineers to the group, and assign the Virtual Machine Contributor role to the group at the Enterprise-Core-MG scope.
The correct configuration uses Azure Policy with the deployIfNotExists effect applied at the management group level, which ensures that all child subscriptions automatically configure the diagnostic settings. Additionally, it adheres to the principle of least privilege and simplifies management by assigning the Virtual Machine Contributor role to a Microsoft Entra ID security group at the management group level rather than directly to individual users.

Step-by-Step Solution

1
Define the compliance enforcement mechanism for diagnostic settings.
Identify that Azure Policy with the deployIfNotExists effect at the Enterprise-Core-MG scope ensures automatic remediation and configuration of diagnostic settings on all present and future subscriptions.
This automates compliance without blocking deployment workflows or requiring manual configuration.
2
Group operations engineers to manage identity efficiently.
Create a single Microsoft Entra ID security group containing the operations engineers.
Grouping identities reduces administrative overhead and enables scalable access control instead of managing individual role assignments.
3
Assign the Virtual Machine Contributor role to the security group at the management group scope.
The role assignment inherits down to all subscriptions within the management group, providing the operations team with permissions to manage virtual machines without owner-level privileges.
This satisfies the least privilege requirement and ensures the team cannot modify subscription-level access controls or delete central configuration resources.

Key Concept

Combining management group-scoped Azure Policy remediation with group-based RBAC assignments to achieve automated subscription compliance and delegated least-privilege administration.
Question 5Question →

Vespera Industries has an on-premises Active Directory Domain Services (AD DS) forest containing 3,100 users. The company is planning to implement a hybrid identity solution that integrates the on-premises environment with a single Microsoft Entra ID tenant.

The solution must meet the following requirements:
- Users must be able to sign in to Azure cloud services using their on-premises credentials.
- Cloud authentication must remain functional even if the on-premises domain controllers or network connectivity on-premises become completely unavailable.
- On-premises infrastructure footprint and management overhead must be minimized.

Which hybrid identity authentication method should Vespera Industries implement?

Show answer & explanation

Answer: Password Hash Synchronization (PHS)

Answer

Password Hash Synchronization (PHS)
Password Hash Synchronization (PHS) meets all the requirements. It synchronizes a hash of the user's password hash from on-premises AD DS to Microsoft Entra ID, allowing authentication to occur entirely within Microsoft Entra ID. Because the credentials are stored in the cloud, user sign-in remains functional even if the on-premises domain controllers or network connectivity are completely unavailable. PHS requires the least infrastructure footprint, running as part of the core synchronization process without needing additional servers or agents for authentication.

Step-by-Step Solution

1
Analyze the business continuity and availability requirements for cloud authentication.
Identify that the solution must support authentication even if on-premises domain controllers or network connectivity are offline.
This eliminates authentication methods that require real-time communication with the on-premises environment (such as Pass-through Authentication and Active Directory Federation Services).
2
Analyze the infrastructure footprint and management overhead requirements.
Determine that the solution must minimize the deployment of extra components, agents, and virtual machines.
This eliminates deploying AD DS domain controllers in Azure VMs, as well as complex federation infrastructures like Active Directory Federation Services (AD FS).
3
Select the synchronization and authentication method that stores credentials in the cloud and requires the minimum setup.
Select Password Hash Synchronization (PHS) as it validates credentials in Microsoft Entra ID and has the lowest operational overhead.
PHS meets the offline capability requirement because Microsoft Entra ID processes the logins, and it meets the minimal footprint requirement because it uses the standard sync configuration.

Key Concept

Selecting the appropriate hybrid identity authentication method (PHS vs. PTA vs. AD FS) based on business continuity and infrastructure overhead constraints.
Question 6Question →

An enterprise is designing a monitoring and log routing architecture for application workloads deployed across two Azure regions: East US and West US.

The design must meet the following requirements:
- Members of the East US operations team must only view logs for East US resources.
- Members of the West US operations team must only view logs for West US resources.
- A central security team must be able to query logs across both regions.
- Cross-region data egress costs for log ingestion must be minimized.
- All newly deployed resources in both regions must be automatically configured to route their diagnostic logs to the appropriate destination.
- Administrative governance and access management must follow Microsoft best practices.

Which log routing and access management strategy should you recommend?

Show answer & explanation

Answer: Deploy a Log Analytics workspace in East US and another in West US. Associate the regional operations teams with Microsoft Entra groups and assign each group the Reader role on its respective regional workspace. Assign the central security team's Entra group the Reader role on both workspaces. Use Azure Policy with a DeployIfNotExists effect to automatically configure diagnostic settings for new resources to point to their local regional workspace.

Answer

Deploy a Log Analytics workspace in each region, use Microsoft Entra groups to assign workspace-level Reader roles to the respective regional teams and the security team, and apply Azure Policy with a DeployIfNotExists effect to automate diagnostic settings configuration.
The correct strategy involves deploying separate regional workspaces to keep data transfer local, thereby minimizing cross-region egress costs. Administrative isolation is achieved by assigning regional teams workspace-level Reader permissions via Microsoft Entra groups, which aligns with identity governance best practices. The central security team can query logs across both workspaces. Lastly, the DeployIfNotExists policy effect is the correct choice to automate the configuration of diagnostic settings on newly deployed resources.

Step-by-Step Solution

1
Determine the workspace architecture and placement based on cost constraints.
Two regional Log Analytics workspaces (one in East US, one in West US) are required to ensure that logs are ingested within the same region, avoiding cross-region egress charges.
Log ingestion across regions incurs data transfer costs, which violates the requirement to minimize data egress costs.
2
Define the access control and administrative mapping using Microsoft Entra groups.
Regional teams are assigned Reader access to their respective workspaces using Entra groups to enforce regional isolation, while the central security group is assigned Reader access to both workspaces.
Microsoft best practices dictate assigning roles to groups rather than individuals to reduce administrative overhead and ensure scalable identity governance.
3
Select the policy effect that satisfies automatic compliance remediation.
An Azure Policy with the DeployIfNotExists effect is deployed to automatically configure diagnostic settings on newly created resources.
A DeployIfNotExists policy automatically remediates non-compliant resources by creating the diagnostic settings, whereas a Deny policy would reject the deployment outright.

Key Concept

Designing regional monitoring solutions that balance regional log isolation, data egress costs, Entra ID identity governance, and automated configuration using Azure Policy.
Question 7Question →

Gideon Robotics is designing a hybrid identity and multi-tenant collaboration solution. The company has an on-premises Active Directory Domain Services (AD DS) forest containing 4,500 users. Gideon Robotics recently acquired AeroDynamics Inc., which uses a separate Microsoft Entra ID tenant.

You need to design an identity solution that meets the following requirements:
- Authentication: Synchronize on-premises users to the primary Gideon Robotics Microsoft Entra ID tenant. The method must have the lowest on-premises footprint, require no inbound network ports, and support the detection of leaked credentials in the cloud.
- Self-Service: Enable synchronized users to reset their own passwords in the cloud, with the changes automatically writing back to the on-premises Active Directory domain.
- Business Continuity: Authentication services must remain operational in the event of an outage of the on-premises network or domain controllers.
- Multi-Tenant Collaboration: Allow users from the AeroDynamics tenant to access shared applications in the Gideon Robotics tenant using their existing credentials, while ensuring their devices meet compliance policies configured in their home tenant.

Which two components should you include in the design to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Password Hash Synchronization (PHS) with Microsoft Entra Self-Service Password Reset (SSPR) writeback enabled; Microsoft Entra B2B collaboration with cross-tenant access settings configured to trust compliant devices

Answer

Select Password Hash Synchronization (PHS) with SSPR writeback and Microsoft Entra B2B collaboration with cross-tenant access settings configured to trust compliant devices.
The correct solution uses Password Hash Synchronization (PHS) with SSPR writeback because PHS provides the lowest on-premises footprint, does not require inbound ports, and ensures business continuity by authenticating users in the cloud if the on-premises network is down. PHS also enables leaked credential detection in the cloud, while SSPR writeback satisfies the self-service capability. Additionally, Microsoft Entra B2B collaboration with cross-tenant access settings satisfies the multi-tenant collaboration requirements by allowing external users to authenticate using their home credentials while trusting their home tenant's device compliance status.

Step-by-Step Solution

1
Evaluate the authentication, on-premises footprint, and business continuity requirements.
Identify that Password Hash Synchronization (PHS) is the only hybrid sync method that requires zero inbound ports, has the lowest footprint, and allows authentication to proceed in the cloud during an on-premises network outage.
PHS copies password hashes to Microsoft Entra ID, allowing the cloud to handle login requests and check for leaked credentials natively.
2
Address the self-service password reset requirement.
Ensure Microsoft Entra Self-Service Password Reset (SSPR) with password writeback is enabled.
Password writeback ensures that password changes made by users in Microsoft Entra ID are written back to the on-premises Active Directory in real-time.
3
Address the multi-tenant collaboration and device compliance requirements.
Choose Microsoft Entra B2B collaboration and configure cross-tenant access settings to trust compliant devices from the AeroDynamics tenant.
Cross-tenant access settings allow the primary tenant to trust compliance states evaluated by the guest user's home tenant, preventing the need to register guest devices in the primary tenant.

Key Concept

Designing a secure, low-footprint hybrid identity and multi-tenant collaboration architecture using Password Hash Synchronization (PHS) and Microsoft Entra B2B cross-tenant trust settings.
Question 8Question →

A retail corporation plans to migrate an on-premises inventory management system to Microsoft Azure. The database tier has the following requirements:
- The system must run a specialized database monitoring agent directly on the database server's operating system, which requires local administrator privileges.
- The environment must support SQL Server Agent to run scheduled maintenance and data synchronization jobs.
- The administration team must minimize the operational overhead of manually managing operating system updates and SQL Server patches.
- The database storage must support high-performance transactions, with the ability to dynamically scale disk performance up to 80,00080,000 IOPS.

Which Azure SQL deployment option should you recommend?

Show answer & explanation

Answer: SQL Server on Azure Virtual Machines

Answer

SQL Server on Azure Virtual Machines
SQL Server on Azure Virtual Machines is correct because it provides full access to the underlying operating system, allowing the installation of custom monitoring agents with local administrator privileges. Automated patching overhead is minimized through the SQL Server IaaS Agent Extension.

Step-by-Step Solution

1
Identify the core operating system and application requirements.
The requirement for a local OS-level monitoring agent with administrative access rules out fully managed platform services.
Managed services like Azure SQL Database and Azure SQL Managed Instance abstract the underlying operating system and do not allow administrative logins or local agent installations.
2
Verify how the administrative patching overhead requirement can be met.
SQL Server on Azure Virtual Machines supports Automated Patching when registered with the SQL Server IaaS Agent Extension.
This minimizes the operational overhead of manual patching while still providing full OS-level control.
3
Evaluate storage performance capabilities for the chosen solution.
SQL Server on Azure VMs can be configured with Premium SSD v2 or Ultra Disk to support scaling up to 80,00080,000 IOPS.
This satisfies the high-performance transaction scaling requirements.

Key Concept

Selecting SQL Server on Azure VMs when local OS access or third-party agent installation is required, combined with IaaS extension for automated management.
Question 9Question →

You are designing an Azure migration strategy for several legacy databases. Match each workload scenario on the left with the correct Azure Cosmos DB API on the right to ensure the migration requires minimal application refactoring while meeting performance and architectural requirements.

Click a left item, then click its matching right item

Items

A telemetry ingestion application that processes high-frequency time-series data from IoT devices. The legacy database uses a wide-column storage model, and developers query it using CQL-based scripts that must be preserved.
A fraud-detection application that analyzes relationships between financial transactions, user accounts, and device fingerprints to find suspicious circular paths. The application requires complex multi-hop query traversals using vertices and edges.
An e-commerce product catalog that is being migrated from an on-premises database. It stores documents in BSON format, relies on nested arrays, and utilizes existing application drivers that communicate over port 27017.
A globally distributed user session state store that currently utilizes Azure Table Storage. The business requires migrating to a database that guarantees sub-10ms read and write latencies with a 99.999% availability SLA and dedicated throughput.

Matches

Show answer & explanation

Answer

Match the wide-column CQL telemetry application to Azure Cosmos DB for Apache Cassandra; match the graph-based fraud-detection application to Azure Cosmos DB for Apache Gremlin; match the BSON-based product catalog to Azure Cosmos DB for MongoDB; and match the low-latency Table Storage workload to Azure Cosmos DB for Table.
Matching each legacy system to its corresponding wire-compatible Azure Cosmos DB API allows developers to preserve client-side code, drivers, and query structures while gaining the benefits of a fully managed cloud database.

Step-by-Step Solution

1
Analyze the technical requirements of the first scenario (CQL and wide-column).
Identify that the Cassandra Query Language (CQL) and wide-column store map directly to the Cassandra API.
This minimizes development effort by allowing the reuse of existing Cassandra drivers and queries.
2
Analyze the technical requirements of the second scenario (vertices, edges, multi-hop traversals).
Identify that a property graph model utilizing TinkerPop/Gremlin maps directly to the Gremlin API.
Graph databases are optimized for traversing relationships between entities.
3
Analyze the technical requirements of the third scenario (BSON, port 27017, nested arrays).
Identify that these details describe MongoDB database communications, which map to the MongoDB API.
Cosmos DB for MongoDB supports the MongoDB wire protocol, allowing applications to connect using standard MongoDB client drivers.
4
Analyze the technical requirements of the fourth scenario (Azure Table Storage migration with sub-10ms latency and 99.999% SLA).
Identify that the Table API provides a drop-in replacement for Table Storage with premium performance guarantees.
Azure Cosmos DB for Table offers turnkey global distribution, dedicated throughput, and single-digit millisecond latency SLAs compared to standard Azure Table Storage.

Key Concept

Selecting the appropriate Azure Cosmos DB API based on legacy database systems, query APIs, protocols, and performance requirements.
Question 10Question →

A utility company is designing a serverless backend architecture to process smart meter telemetry and host a customer-facing billing API. The solution must meet the following requirements:

* Telemetry processing: Ingestion triggers a job that aggregates and stores data streams. Each execution takes up to 1515 minutes to complete.
* Billing API: Must support peak hourly traffic of 5,0005,000 requests, experience minimal latency during sudden scale-up (no cold starts), and require direct integration with an Azure Virtual Network (VNet).
* Operational overhead: Must be minimized.

Which two Azure hosting options should you recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Azure Container Apps Job to process the telemetry data.; Azure Functions on a Premium plan to host the billing API.

Answer

Azure Container Apps Job to process the telemetry data, and Azure Functions on a Premium plan to host the billing API.
The correct architecture uses Azure Container Apps Jobs for the long-running (1515-minute) telemetry processing job because it supports extended run-to-completion workloads without container management overhead. For the billing API, Azure Functions on a Premium plan is selected because it natively supports virtual network (VNet) integration, scales rapidly to handle peak demand, and uses pre-warmed instances to completely avoid cold start latencies, all while keeping management overhead low.

Step-by-Step Solution

1
Evaluate the telemetry processing requirement against Azure Functions timeout limits.
The telemetry processing execution takes up to 1515 minutes. Under the Azure Functions Consumption plan, the maximum execution timeout is capped at 1010 minutes (600600 seconds). Therefore, a Consumption plan cannot be used for this task.
To prevent jobs from failing due to hard timeout limits.
2
Select a serverless run-to-completion option for the 1515-minute job that minimizes overhead.
Azure Container Apps Jobs allow containerized batch tasks to execute for extended periods beyond 1010 minutes without managing VMs or Kubernetes infrastructure.
To satisfy the long-running processing requirement while minimizing operational overhead.
3
Evaluate the billing API hosting requirements for VNet integration, cold start mitigation, and operational overhead.
Azure Functions on a Premium plan provides VNet integration and pre-warmed instances to avoid cold starts. Azure Kubernetes Service (AKS) is rejected due to high operational management overhead.
To fulfill the latency and network isolation constraints of the customer-facing API.

Key Concept

Selecting serverless compute options based on execution limits, cold start constraints, network isolation, and operational overhead.
Estimated Time:2m 0s
Question 11Question →

A retail company plans to migrate its inventory reconciliation service to Azure Virtual Machines. The service must achieve a cumulative virtual machine uptime SLA of 99.99% and must be resilient against the failure of an entire datacenter.

Which virtual machine deployment configuration should you design to satisfy these requirements?

Show answer & explanation

Answer: Deploy the virtual machines across multiple Availability Zones in the same Azure region.

Answer

Deploy the virtual machines across multiple Availability Zones in the same Azure region.
Deploying virtual machines across multiple Availability Zones in the same Azure region guarantees a 99.99% uptime SLA for at least one instance. This architecture ensures that if a single datacenter or zone experiences an outage, instances in the remaining zones continue to operate, meeting both the high availability SLA and the zone-resilience requirement.

Step-by-Step Solution

1
Analyze the service's high availability SLA and resilience requirements.
The target SLA is 99.99% uptime for compute instances, and the architecture must survive a datacenter-level outage.
This establishes the minimum infrastructure boundaries required to design the compute deployment.
2
Evaluate the SLA guarantees of different Azure compute deployment models.
Single-zone Availability Sets provide 99.95% SLA. Multi-zone deployments (deploying VMs across two or more Availability Zones in a region) guarantee 99.99% SLA.
Matching the SLA requirements with Azure SLA documentation determines which architectural options are viable.
3
Assess the susceptibility of each configuration to datacenter failure.
Multi-zone placement distributes VMs across physically separate datacenters with independent power, cooling, and networking. Single-zone placements (including Availability Sets or single-zone Scale Sets) concentrate resources within a single zone.
This ensures the solution provides the necessary resilience to survive a localized datacenter disaster.

Key Concept

Azure Virtual Machine High Availability SLAs and Zonal Redundancy
Estimated Time:1m 30s
Question 12Question →

A fintech platform is designing the networking architecture for a single-region deployment in West US 3. The design must accommodate two distinct workloads:

1. An administrative web portal that requires SSL/TLS termination and URL path-based routing (routing `/api/*` to an API service and `/reports/*` to a reporting service).
2. A high-frequency transaction ingestion service that communicates over a custom TCP protocol on port 9000 and requires extremely low latency.

To ensure resilience, all entry-point load balancers must utilize zone-redundant public IP addresses. The virtual machines hosting the transaction ingestion service currently have Basic SKU public IP addresses assigned to their network interfaces.

Which two actions should you include in the network design to meet these requirements while preventing deployment validation errors?

Select all that apply

Show answer & explanation

Answer: Deploy Azure Application Gateway (Standard v2 SKU) to manage the web portal's path-based routing and SSL/TLS termination.; Upgrade the public IP addresses of the transaction ingestion VMs to Standard SKU, and place the VMs behind an Azure Standard Load Balancer.

Answer

Deploy Azure Application Gateway (Standard v2 SKU) for the web portal's path-based routing and SSL/TLS termination, and upgrade the transaction ingestion VMs' public IPs to Standard SKU before placing them behind an Azure Standard Load Balancer.
To satisfy the web portal requirements, Azure Application Gateway (Standard v2) is selected because it is a regional Layer 7 load balancer that supports SSL/TLS termination, URL path-based routing, and zone redundancy. To satisfy the ingestion service requirements, Azure Standard Load Balancer is selected because it is a regional Layer 4 load balancer that supports custom TCP traffic, low latency, and zone redundancy. Because the ingestion VMs have Basic SKU public IPs, they must be upgraded to Standard SKU public IPs to avoid validation errors, as Standard Load Balancer backend pools do not support Basic SKU resources.

Step-by-Step Solution

1
Analyze the requirements for the web portal workload.
The web portal requires SSL/TLS termination and Layer 7 URL-based routing (`/api/*` and `/reports/*`) in a single region (West US 3) with zone redundancy. Azure Application Gateway (Standard v2 SKU) satisfies all of these criteria.
Application Gateway is a regional Layer 7 load balancer that supports path-based routing, SSL termination, and zone-redundant public IP addresses.
2
Analyze the requirements for the transaction ingestion workload.
The ingestion service requires low-latency Layer 4 load balancing for custom TCP traffic on port 9000 in a single region with zone redundancy. Azure Standard Load Balancer satisfies these needs.
Standard Load Balancer operates at Layer 4, handles any TCP/UDP port with ultra-low latency, and supports zone redundancy.
3
Identify the resource compatibility constraints to prevent validation errors.
The backend VMs currently have Basic SKU public IPs. Placing them behind a Standard Load Balancer causes a validation error due to SKU mismatch. The public IPs must be upgraded to Standard SKU first.
Azure does not allow mixing Basic SKU and Standard SKU resources within the same load balancer configuration.

Key Concept

Designing a hybrid Layer 4 and Layer 7 load balancing architecture while adhering to SKU compatibility requirements and protocol constraints.
Question 13Question →

An enterprise is designing a high-availability infrastructure for a custom TCP-based application running on Azure Virtual Machines (VMs) in the West US 3 region. The VMs are currently configured with Basic SKU Public IP addresses. To meet SLA requirements, the load balancing solution must support Availability Zones. You plan to implement an Azure Load Balancer to distribute the incoming TCP traffic. Which of the following actions is required to design a valid load balancing configuration that supports Availability Zones?

Show answer & explanation

Answer: Deploy a Standard Load Balancer and upgrade the Public IP addresses of the virtual machines to Standard SKU.

Answer

Deploy a Standard Load Balancer and upgrade the Public IP addresses of the virtual machines to Standard SKU.
Deploying a Standard Load Balancer and upgrading the virtual machines' Public IP addresses to Standard SKU is the correct design. The Standard Load Balancer is required to utilize Availability Zones for high availability. In addition, Azure requires all network resources attached to a Standard Load Balancer backend pool to be of the Standard SKU, meaning the existing Basic SKU Public IPs on the VMs must be upgraded to Standard SKU to pass validation.

Step-by-Step Solution

1
Analyze the load balancing protocol and high-availability requirements.
The application requires Layer 4 TCP load balancing with support for Availability Zones.
This rules out HTTP-only load balancers like Application Gateway and restricts the selection to Azure Load Balancer SKUs that support Availability Zones.
2
Determine the appropriate Azure Load Balancer SKU based on zone support.
Azure Standard Load Balancer must be used.
Basic Load Balancer does not support Availability Zones, meaning only the Standard SKU can meet the zone-redundancy requirements.
3
Check compatibility between the backend virtual machines and the selected Load Balancer SKU.
The Basic SKU Public IPs on the virtual machines must be upgraded to Standard SKU.
Standard Load Balancer requires all backend resources to use Standard SKU IP configurations. Mixing Basic and Standard SKUs in the backend pool of a Standard Load Balancer causes validation failures.

Key Concept

SKU alignment and backend resource compatibility constraints in Azure Load Balancer designs
Question 14Question →

You are designing an identity solution for an organization. Match each business and technical requirement to the most appropriate Microsoft Entra ID hybrid or multi-tenant identity technology.

Click a left item, then click its matching right item

Items

Authenticate users on-premises using a local agent, ensuring that no password hashes are stored in the cloud.
Synchronize user accounts and their password hashes to the cloud to enable cloud-based authentication and offline resilience.
Enable external business partners to access corporate applications using their own corporate credentials.
Automatically provision and manage user accounts across multiple Microsoft Entra ID tenants within the same organization.

Matches

Show answer & explanation

Answer

The requirement for on-premises validation without cloud password hashes matches Pass-Through Authentication (PTA). The requirement for cloud-based authentication with offline resilience matches Password Hash Synchronization (PHS). The requirement for external partner access matches Microsoft Entra B2B collaboration. The requirement for automated multi-tenant user provisioning matches Cross-tenant synchronization.
The correct pairings align each scenario with its primary technical match: Pass-Through Authentication (PTA) validates credentials locally without storing hashes; Password Hash Synchronization (PHS) copies password hashes to Microsoft Entra ID to support offline cloud authentication; Microsoft Entra B2B collaboration allows external business partners to log in using their own credentials; and Cross-tenant synchronization automates user provisioning and lifecycle management across different Entra ID tenants in the same organization.

Step-by-Step Solution

1
Analyze the on-premises security policy requirement: no cloud password hashes and authentication via local agents.
Identify Pass-Through Authentication (PTA) as the solution because it forwards password validation requests to local agents.
PTA satisfies the constraint of not storing hashes in the cloud while retaining local control.
2
Analyze the business continuity requirement: authenticate in the cloud during on-premises outages.
Identify Password Hash Synchronization (PHS) as the solution because it stores password hashes in Microsoft Entra ID, enabling independent cloud authentication.
PHS allows authentication to succeed even if the on-premises domain controllers or agents are offline.
3
Analyze the external sharing requirement: allow business partners to log in with their own identities.
Identify Microsoft Entra B2B collaboration as the feature designed for external user access.
B2B collaboration enables guest users to use their corporate or social identities.
4
Analyze the multi-tenant automation requirement: automate provisioning across tenants inside the same organization.
Identify Cross-tenant synchronization as the direct service for synchronizing users across tenants.
Cross-tenant synchronization automates lifecycle management of B2B users across organization-owned tenants.

Key Concept

Azure Hybrid and Multi-Tenant Identity Integration Options
Question 15Question →

A software-as-a-service (SaaS) provider hosts multi-tenant workloads across isolated Azure resource groups within a single subscription. A team of five support engineers needs administrative access to manage database resources only within a specific client's resource group. You must design an access control solution that aligns with the principle of least privilege and Microsoft security best practices.

Which of the following approaches should you recommend to assign these permissions?

Show answer & explanation

Answer: Create a Microsoft Entra ID security group, add the support engineers to this group, and assign the SQL DB Contributor role to the group at the resource group scope.

Answer

Create a Microsoft Entra ID security group, add the support engineers to this group, and assign the SQL DB Contributor role to the group at the resource group scope.
Assigning the SQL DB Contributor role to a Microsoft Entra ID security group at the resource group scope enforces the principle of least privilege and follows scalable governance best practices. This ensures that permissions are scoped only to the specific client's resources and can be managed easily through group membership.

Step-by-Step Solution

1
Identify the resource scope and role required for the task.
The scope is the specific client's resource group, and the role is SQL DB Contributor.
Ensures the principle of least privilege is applied by restricting administrative access only to the database resources within the target resource group.
2
Determine the administrative identity structure.
A Microsoft Entra ID security group should contain the five support engineers.
Assigning roles to groups rather than individual users ensures scalability and reduces administrative overhead when engineers join or leave the team.

Key Concept

Assigning Azure RBAC roles to Microsoft Entra groups at the resource group scope for scalable governance and least privilege access control.
Question 16Question →

A company is designing a storage solution for a document management application. The documents must be stored in Azure Blob Storage.

The solution must meet the following requirements:
- If an entire Azure region suffers a major outage, the storage solution must remain resilient and prevent data loss.
- Access to the files must be granted to external vendors using Shared Access Signatures (SAS) that can be invalidated immediately if a security compromise is suspected.

Which two storage configurations should you recommend to meet the requirements?

Select all that apply

Show answer & explanation

Answer: Configure the storage account to use Geo-redundant storage (GRS).; Create a stored access policy on the container and associate it with the Shared Access Signatures (SAS).

Answer

Configure the storage account to use Geo-redundant storage (GRS) and create a stored access policy on the container to associate with the Shared Access Signatures (SAS).
To ensure protection against regional outages, the storage account must be configured with Geo-redundant storage (GRS), which replicates data to a secondary region. To allow immediate invalidation of Shared Access Signatures (SAS), you must use a stored access policy, which allows you to revoke or change the permissions of associated SAS tokens without modifying the storage account keys.

Step-by-Step Solution

1
Analyze the resiliency requirement for regional outages.
Locally redundant storage (LRS) is insufficient because it only replicates data within a single datacenter. Geo-redundant storage (GRS) must be selected to ensure data is copied to a secondary region, providing protection against a regional failure.
Choosing the correct storage redundancy tier ensures business continuity during regional disasters.
2
Analyze the security requirement for immediate SAS revocation.
Ad-hoc SAS URIs cannot be individually revoked without rotating the storage account keys (which affects all SAS tokens). Associating the SAS with a stored access policy allows the policy to be modified or deleted, instantly revoking all SAS tokens tied to that policy.
Stored access policies decouple the SAS token validation from account keys, allowing fine-grained and immediate access control revocation.

Key Concept

Azure storage redundancy options and secure access delegation via stored access policies.
Question 17Question →

You are designing an Azure Blob Storage solution for storing virtual machine backups. The solution must meet the following requirements:
- Ensure the backups remain available if a single datacenter in the primary region fails.
- Ensure backups can be retrieved within seconds if a restore is initiated.
- Minimize storage costs.

Which storage configuration should you recommend?

Show answer & explanation

Answer: Zone-redundant storage (ZRS) in the Cool access tier

Answer

Zone-redundant storage (ZRS) in the Cool access tier
Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones in the primary region, meeting the requirement to survive a single datacenter (zone) failure. The Cool access tier is cost-effective for storage that is not accessed frequently but requires immediate retrieval times, which matches the backup restoration requirements.

Step-by-Step Solution

1
Identify the resiliency requirement.
The solution must survive a single datacenter failure in the primary region.
Locally-redundant storage (LRS) is insufficient because it only replicates within a single datacenter. Zone-redundant storage (ZRS) or geo-redundant options are required.
2
Analyze retrieval time requirements.
The backups must be retrieved within seconds (sub-second retrieval).
This rules out the Archive access tier, which requires hours for data rehydration. The Hot or Cool tiers are appropriate.
3
Compare cost and redundancy options.
Zone-redundant storage (ZRS) in the Cool tier is selected.
ZRS meets the datacenter resilience requirement at a lower cost than geo-redundant options like RA-GRS, and the Cool tier provides immediate retrieval at a lower storage cost than the Hot tier.

Key Concept

Azure Storage Redundancy and Access Tiers
Question 18Question →

A company is developing a fleet management application. The application will store real-time telemetry from 50,000 delivery vehicles. The workload has a read/write ratio of 80% writes and 20% reads. The data must be distributed across three Azure regions to support global users, and the solution must avoid partition throttling while maintaining high availability. Which configuration should you recommend for the Azure Cosmos DB container?

Show answer & explanation

Answer: Use vehicleId as the partition key and enable multi-region replication.

Answer

Use vehicleId as the partition key and enable multi-region replication.
The correct option is to use vehicleId as the partition key and enable multi-region replication. vehicleId is a high-cardinality key that distributes writes evenly across logical partitions, while multi-region replication ensures low latency and high availability across the three target regions.

Step-by-Step Solution

1
Evaluate the partition key requirements based on the high write volume (80% writes).
Identify that a high-cardinality key is required to distribute writes evenly and avoid hot partitions.
Choosing a low-cardinality key like status or date would concentrate writes into a few partitions, leading to throttling.
2
Evaluate the replication and redundancy requirements for a global application in three regions.
Identify that multi-region replication is required to serve users globally.
Locally redundant storage (LRS) keeps data within a single datacenter facility and cannot support multi-region distribution.

Key Concept

Selecting high-cardinality partition keys and configuring appropriate global distribution in Azure Cosmos DB to prevent throttling and ensure high availability.
Question 19Question →

An organization is designing the storage infrastructure for a new containerized application workflow on Azure. The architecture must satisfy the following technical requirements:

- Provide a shared, POSIX-compliant file system for a cluster of Linux nodes that supports the NFS v4.1 protocol and can withstand the outage of a single Availability Zone within the primary Azure region.
- Provide block storage for a transaction-intensive database workload that requires consistent sub-millisecond disk write latencies.

Which two storage configurations should you recommend? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure Azure Files Premium tier with Zone-Redundant Storage (ZRS) and the NFS protocol for the shared file system; Configure Premium SSD v2 managed disks for the database workload

Answer

Configure Azure Files Premium tier with Zone-Redundant Storage (ZRS) using NFS, and configure Premium SSD v2 managed disks for the database workload.
Configuring Azure Files Premium tier with Zone-Redundant Storage (ZRS) using NFS provides a POSIX-compliant, zone-resilient shared file system that meets the Linux cluster requirements. Configuring Premium SSD v2 managed disks delivers the necessary low latency and high IOPS for transaction-intensive database workloads.

Step-by-Step Solution

1
Evaluate the shared file system requirements.
The file system must be POSIX-compliant, support NFS v4.1, and tolerate a zone outage. Azure Files Premium tier supports NFS v4.1 and can use Zone-Redundant Storage (ZRS) to meet these needs.
Standard tier Azure Files does not support NFS, and LRS does not survive zone outages.
2
Evaluate database storage requirements.
The database needs consistent sub-millisecond disk write latencies. Premium SSD v2 managed disks provide the required IOPS and low-latency metrics.
Standard HDD and Standard SSD disks cannot guarantee sub-millisecond latencies.
3
Verify security and protocol compatibility.
Reject SAS token authentication since NFS file shares in Azure Files rely on network-level security and POSIX permissions rather than SAS tokens, and long-lived SAS tokens introduce risk.
Ensures the recommended solution is technically feasible and secure.

Key Concept

Azure storage design matching performance, protocol (NFS/SMB), and resiliency (LRS/ZRS) requirements to appropriate disk and file service configurations.
Question 20Question →

An international logistics company is designing the data tier for a new transport management platform. The platform consists of two distinct subsystems:

* The tracking subsystem requires a database that supports cross-database queries, SQL Server Agent for scheduling route calculation jobs, and Common Language Runtime (CLR) integration. The solution must minimize operational overhead.
* The invoicing subsystem requires a single database that experiences highly variable traffic patterns, including long periods of zero activity. The solution must minimize compute costs during idle periods.

Which two Azure SQL services should you recommend to support the subsystems? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Azure SQL Managed Instance for the tracking subsystem; Azure SQL Database serverless for the invoicing subsystem

Answer

Azure SQL Managed Instance for the tracking subsystem, and Azure SQL Database serverless for the invoicing subsystem
The correct recommendations are Azure SQL Managed Instance for the tracking subsystem and Azure SQL Database serverless for the invoicing subsystem. Azure SQL Managed Instance supports instances requiring SQL Server Agent, CLR integration, and cross-database queries without the administrative overhead of managing virtual machines. Azure SQL Database serverless is ideal for a single database with unpredictable traffic and idle periods because it automatically scales compute resources and pauses during inactivity to reduce compute costs to zero.

Step-by-Step Solution

1
Analyze the requirements for the tracking subsystem.
The subsystem requires legacy compatibility features including SQL Server Agent, CLR integration, and cross-database queries, but specifies that operational overhead must be minimized.
This rules out Azure SQL Database single database (which lacks SQL Agent/CLR/cross-db query support) and makes SQL Server on Azure VMs less optimal than a PaaS solution due to higher operational overhead.
2
Select the optimal database service for the tracking subsystem.
Azure SQL Managed Instance is chosen.
Managed Instance provides near 100% compatibility with the SQL Server database engine, including SQL Agent, CLR, and cross-database queries, while running as a fully managed PaaS service.
3
Analyze the requirements for the invoicing subsystem.
The subsystem consists of a single database with highly variable traffic and periods of inactivity, requiring compute costs to be minimized during idle times.
This points to a serverless model where resources auto-scale and can be paused when not in use.
4
Select the optimal database service for the invoicing subsystem.
Azure SQL Database serverless is chosen.
Azure SQL Database serverless automatically scales compute and supports auto-pausing, billing only for storage when paused, which perfectly satisfies the cost optimization requirement for a single database.

Key Concept

Azure SQL service tier selection based on feature compatibility (SQL Agent, CLR, cross-database queries) and workload auto-scaling requirements.
Page 1 / 60Next