All practice questions

Novis Health has an Azure subscription hierarchy organized under a root management group named Novis-Root. Below Novis-Root, there are three management groups: Novis-Prod, Novis-Dev, and Novis-Shared. The company is designing a governance strategy for Azure Storage accounts. The strategy must meet the following compliance requirements:

* All storage accounts must restrict public network access.
* For resources in Novis-Prod, any attempt to deploy a storage account that allows public network access must be blocked.
* For resources in all other management groups under Novis-Root, storage accounts that allow public network access must be allowed to deploy but must be flagged as non-compliant in reports.

Which policy assignment strategy meets the requirements while minimizing administrative overhead?

You are designing an Azure Cosmos DB NoSQL API solution for a global telemetry tracking application. The workload consists of a 90:10 read/write ratio, with data ingested from devices globally. You need to ensure the system survives a regional outage to meet disaster recovery SLAs and scales efficiently without creating hot partitions.

Which two configurations should you recommend to meet these requirements?

An international logistics enterprise is designing the cloud architecture to host its core tracking and shipping application on Azure. The application's backend consists of three highly interdependent databases that perform cross-database transactions and rely on SQL Server Agent for scheduled ETL jobs. Additionally, the application requires SQL Server FILESTREAM to read and write unstructured shipping documents directly to the local file system. The proposed architecture must ensure these databases are deployed in a private network environment and support automatic failover with a recovery time objective (RTO) of under 10 seconds. Which Azure SQL deployment option should you recommend to meet these requirements?

A legal services firm is deploying a new application on Azure that uses a relational database. The design must accommodate the following requirements:

- The database must support cross-database queries and SQL Server Agent.
- The database must be highly available and resilient to zone outages.
- Administrative effort for managing the underlying operating system must be eliminated.

Which relational database solution and configuration should you recommend?

A global aviation logistics company is designing an identity governance and privileged access strategy for its Azure environment. The environment contains several subscriptions hosting flight scheduling applications.

The company has the following security requirements:
- External consultants must be granted the Contributor role on a subscription named Sub1 only when they are actively performing maintenance tasks.
- The access granted to external consultants must be automatically audited every 30 days, and any access not explicitly re-approved must be revoked.
- Emergency break-glass administrator accounts must remain functional even if there is an outage of the company's identity provider or primary multi-factor authentication (MFA) service.
- All administrator access assignments must follow the principle of least privilege and use group-based assignment where possible.

Which two configuration steps should you recommend to meet these requirements? (Select TWO.)

A company named AeroSpace Dynamics is designing a governance strategy for its Azure environment. The environment consists of multiple subscriptions under a single management group.

You must enforce the following compliance requirements:
1. All resource groups must have an Owner tag. If a resource group is created without this tag, the tag must be automatically added and set to a default value during resource group creation.
2. All Azure SQL databases must have vulnerability assessment configured. If a database is deployed without it, the vulnerability assessment settings must be deployed automatically.

You need to recommend the Azure Policy effects that will satisfy these requirements without blocking resource creation.

Which two policy effects should you recommend? (Select two.)

A company has $100\text{ GB}$ of transactional logs in CSV format stored in an Azure Data Lake Storage Gen2 (ADLS Gen2) account. You need to design an analytical query solution that meets the following requirements:
- Allows data analysts to run ad-hoc, exploratory T-SQL queries on the CSV files.
- Minimizes costs and administrative overhead by avoiding persistent compute resources.
- Ensures that the data remains available even if the primary Azure region suffers a complete outage.

Which two configurations should you recommend in your design?

You are designing a secure data storage solution in Azure. A partner organization requires read-only access to a specific Azure Blob Storage container for a period of 30 days. The security policy mandates that you must be able to revoke this access immediately if a security breach occurs, without rotating the storage account access keys.

Which of the following access control strategies should you recommend?

You are designing the storage architecture for a new high-performance financial ledger system hosted on Azure Linux Virtual Machines.

The system must satisfy the following requirements:
* Database transaction logs: Support up to $20{}000$ IOPS and $500\text{ MB/s}$ throughput with sub-millisecond latency. The storage solution must sustain a single availability zone outage without data loss.
* Shared configuration files: Multiple Linux VMs must concurrently access a POSIX-compliant shared file system over the NFS v4.1 protocol. This storage must also remain available during an availability zone outage.
* Historical audit logs: Store logs cost-effectively for $7$ years. They are rarely accessed, but when requested, they must be fully available for read operations within $10$ minutes.

Which TWO of the following configurations should you include in the storage design? (Select TWO)

An organization needs to grant a third-party audit application read-only access to an Azure Blob storage container for exactly 30 days. Security policies require that administrators must have the ability to immediately revoke this access at any time if a security compromise is suspected, without rotating the storage account keys or affecting other active integrations. Which access control strategy should you recommend?

A retail company is designing the network security architecture for a new containerized inventory application hosted on Azure Container Apps integrated with a virtual network named VNet1. The design must meet the following requirements:
- The application must securely retrieve secrets from an Azure Key Vault named KV1.
- KV1 must disable all public network access.
- The containerized application must resolve and connect to KV1 over a private IP address within VNet1.
- Administrative maintenance must be minimized.

Which two actions should you include in the design?

An international logistics enterprise is architecting an Azure Cosmos DB for NoSQL solution to track real-time container dispatch updates. The workload profile consists of 60% writes and 40% reads. Updates are generated by thousands of IoT sensors across three main hubs: East US, West US, and North Europe.

The architecture must satisfy the following criteria:
- Guarantee a write availability SLA of 99.999%.
- Maintain write response times under 10 ms at the 99th percentile by allowing writes to execute in the closest regional hub.
- Prevent performance bottlenecks (hot partitions) at busy shipping hubs during peak operating hours.
- Keep the local client consistency model at Session level.

Which two configurations should you recommend to meet these requirements? (Choose two.)

An organization plans to migrate a high-throughput transaction processing database to Azure Virtual Machines. The database transaction log files require high IOPS and consistently low latency. The database architecture must be resilient to the outage of a single datacenter within the primary Azure region. Which disk storage configuration should you recommend for the database transaction logs?

An insurance company plans to migrate an on-premises claims processing database system to Azure. The system has the following requirements:
- Runs scheduled ETL processing and database maintenance using SQL Server Agent jobs.
- Requires cross-database queries across two databases using three-part names.
- Must restrict database network traffic to a specific Azure Virtual Network (VNet) without exposing public endpoints.
- Must minimize administrative overhead for operating system patching and VM management.

Which Azure SQL deployment option should you recommend?

A retail company is designing a monitoring and log routing architecture for its Azure workloads. You need to match each monitoring requirement to its correct Azure Monitor destination or feature. Which destination or feature should you associate with each requirement?

An enterprise is designing a governance strategy for its Azure subscriptions. The security team requires that all newly created Azure Storage accounts must have their minimum TLS version configured to version 1.2. If a deployment request does not specify this version or sets it to a lower value, the configuration must be automatically updated to version 1.2 without blocking the deployment of the resource. Which Azure Policy configuration should you recommend to meet these requirements with the least administrative overhead?

An organization named Meridian Global Solutions plans to design a hybrid identity solution using Microsoft Entra ID. The organization has an on-premises Active Directory Domain Services (AD DS) forest. You need to recommend an identity architecture that meets the following requirements:
- Users must sign in to cloud resources using their on-premises credentials.
- Users' compromised credentials must be automatically detected and flagged on Microsoft Entra ID without depending on on-premises authentication infrastructure.
- All users assigned to highly privileged roles must be forced to use multi-factor authentication (MFA) to access the Azure portal.
- The risk of complete administrative lockout due to MFA service disruptions or misconfigured Conditional Access policies must be mitigated.
- The exposure of privileged roles must be minimized by requiring approval and just-in-time activation.

Which combination of hybrid authentication, Conditional Access configuration, and role assignment strategy should you recommend?

A smart-grid utility provider is designing an identity governance and privileged access solution to comply with regional energy infrastructure regulations. The company must allow an external security team consisting of five auditors to review the configuration of all Azure resources across three production subscriptions for a limited period of 30 days. The auditors require read-only access.

The solution must meet the following requirements:
- Ensure the auditors must request approval and perform multi-factor authentication (MFA) each time they access the subscriptions.
- Minimize administrative overhead when managing access for the five external auditors.
- Prevent administrative tenant lockout in the event of an MFA service outage.

Which solution should you recommend?

Solis Renewable Technologies has an on-premises Active Directory Domain Services (AD DS) forest with 5,400 users. The company is designing a hybrid identity solution to integrate with a new Microsoft Entra ID tenant.

The solution must satisfy the following requirements:
- Users must be able to sign in using their existing on-premises credentials.
- Users must be able to reset their own passwords on-premises via the cloud portal.
- Authentication must continue to function even if the network connection between the on-premises datacenter and Azure is temporarily lost.
- The infrastructure complexity and administrative overhead of the identity sync solution must be minimized.

Which hybrid identity synchronization and authentication design should you recommend?

A company is planning to migrate two relational database workloads to Azure. The workloads have the following requirements:

* Workload 1: A legacy database that relies on SQL Server Agent jobs, cross-database queries, and Common Language Runtime (CLR). The database administrators want to eliminate OS-level maintenance and automated backup infrastructure management.
* Workload 2: A new application database with highly variable, unpredictable read/write traffic that must automatically pause compute billing during inactive periods to minimize costs.

Which two Azure SQL options should you recommend? (Select two.)