All practice questions

A financial services company is designing the deployment of a relational database on Azure to store sensitive transaction logs. The database has the following requirements:
- The database must be deployed directly into a private subnet of an Azure Virtual Network (VNet) with no public IP address or public endpoints allowed.
- The system must run scheduled maintenance and data archival scripts natively using SQL Server Agent.
- The administrative team wants to minimize OS-level management tasks, such as patching and backups.

Which database solution should you recommend?

You are designing an identity and access management solution for a company. Match each security requirement to the most appropriate Microsoft Entra ID or Conditional Access feature.

A media streaming company is planning to migrate its on-premises backend relational databases to Azure. The migration involves two systems:

* System 1: A legacy content management system that relies on SQL Server Agent for scheduling metadata updates, requires SQL Server Common Language Runtime (CLR) integration, and requires cross-database transactions.
* System 2: An on-demand user analytics database that experiences highly unpredictable traffic spikes but is completely idle during off-peak hours. This database must remain highly available even if an entire Azure Availability Zone within the region experiences an outage.

Which two database configurations should you include in the design to meet these requirements? (Select two.)

A financial technology company is planning the security model for an Azure Storage account that holds sensitive transaction logs. The design must satisfy the following security requirements:

* Developers must only obtain administrative access to the storage account during active troubleshooting sessions, with all access requests requiring approval and auditing.
* An external compliance auditor requires read-only access to a specific container for 90 days, with the ability to revoke this access immediately at any time without changing account keys.
* Internal applications must be granted read access to the transaction logs using a scalable role assignment model that minimizes administrative overhead.

Which two security controls should you recommend to meet these requirements?

A multinational media production company is restructuring its delegation of administrative privileges in Azure for temporary regional media production teams. The design must satisfy the following security and compliance requirements:
- External production managers must only be granted administrative access to their respective regional subscription resources for the duration of a project, not exceeding 90 days.
- Activation of administrative access must require multi-factor authentication (MFA) and approval from the internal IT Security Lead.
- All administrative roles must be assigned using groups rather than individual user assignments to facilitate scalable auditing.
- External managers must not possess permanent active standing privileges.

Which two actions should you include in the design to meet the requirements? (Select two.)

An organization named CloudCrest Logistics is designing a secure hybrid identity and access control solution using Microsoft Entra ID. The solution must support synchronization of user identities from their on-premises Active Directory Domain Services (AD DS) environment. The organization has the following requirements:
- Users must be able to sign in using their on-premises passwords, and authentication must occur on-premises to satisfy regulatory compliance. If the on-premises connection fails, users must temporarily be able to sign in via cloud-based authentication as a backup.
- Multi-factor authentication (MFA) must be enforced for all users accessing the Azure portal, except for a dedicated glass-breaker emergency access account which must be excluded to prevent tenant lockout.

Which two configurations should you include in the design?

A pharmaceutical research firm is deploying a multi-region clinical data analysis platform inside a single Microsoft Entra tenant. The platform utilizes multiple Azure subscriptions. You must design an administrative access and resource compliance framework to meet the following requirements:
- A group of external audit partners needs read-only access to a specific resource group containing data processing logs.
- Internal platform engineers need the ability to perform high-privilege operations at the subscription root for ad-hoc emergency troubleshooting, but this access must not be permanently active.
- To maintain security standards, all newly provisioned virtual machines must automatically have the dependency agent installed without blocking deployment or requiring engineer intervention.

Which of the following configurations represents the most appropriate strategy to implement these requirements?

You are designing the storage infrastructure for a hybrid application suite in Azure. The design must accommodate the following two data requirements:

1. Data Ingestion: An external service will write large volumes of telemetry data via REST APIs. This data must remain accessible even in the event of a complete Azure region outage.
2. Database Workspace: A transaction processing database hosted on Azure Virtual Machines requires high-throughput data volumes that can sustain at least $16,000$ IOPS and sub-millisecond latency.

Which two storage solutions should you recommend? (Select TWO).

Zephyr Logistics is designing a hybrid identity and multi-tenant collaboration solution. The company has an on-premises Active Directory Domain Services (AD DS) forest with $8{}200$ users. You are tasked with selecting the appropriate identity integration and collaboration technologies to satisfy the company's security, compliance, and availability requirements.

Match each business requirement on the left to the correct Microsoft Entra ID or hybrid identity technology on the right.

A healthcare organization is designing a shared storage solution to host sensitive patient records and medical imaging configuration files. The solution will support a clinical application running on multiple Azure Virtual Machines. The storage design must meet the following requirements:
- Allow simultaneous access from multiple Virtual Machines using the SMB protocol.
- Integrate with the organization's on-premises Active Directory Domain Services (AD DS) to enforce NTFS-grade access control lists (ACLs).
- Provide sub-millisecond latency for configuration file metadata operations.
- Ensure that the shared data remains available if a single datacenter zone within the primary Azure region goes offline.
- Ensure any external diagnostic services are granted access to specific files via a token that can be easily revoked immediately if compromised.

Which two actions should you include in the design? (Select two.)

An organization named Contoso Pharmaceuticals is designing an identity security strategy for its Microsoft Entra ID tenant. The organization requires that all users with administrative roles use multi-factor authentication (MFA) when accessing the Azure portal. The organization also needs to ensure that administrators are not permanently locked out of the tenant in the event of a Microsoft Entra ID MFA service outage. Which design strategy should the architect recommend?

A healthcare provider plans to share medical imaging files stored in an Azure Blob Storage container with an external research laboratory. The data sharing agreement specifies the following requirements:
- The laboratory must have read-only access for a duration of exactly 45 days.
- Access must be limited to the laboratory's public outbound IP address range.
- The provider must have the ability to revoke access immediately if a security breach is suspected, without regenerating the storage account keys or affecting other integrations.

Which access control method should you recommend to meet these requirements?

A global pharmaceutical corporation is designing an identity governance and privileged access solution to manage external clinical researchers who require temporary, administrative access to Azure Machine Learning workspaces in a production subscription. The researchers must only acquire permissions when active, and their access must be automatically re-evaluated monthly to ensure compliance with data protection laws. All administrative activities must require Multi-Factor Authentication (MFA), but the organization's break-glass emergency accounts must never be locked out by these requirements.

Which configuration should you recommend to meet these requirements with the least administrative overhead?

A company is designing a data analytics solution on Azure to support a team of data scientists who perform infrequent, ad-hoc exploratory queries on a $50\text{ TB}$ dataset stored in Azure Data Lake Storage Gen2. New data is loaded in batches every $6\text{ hours}$, adding approximately $500\text{ GB}$ daily. The exploratory queries must execute within $30\text{ seconds}$. The entire architecture must remain resilient to a regional disaster, ensuring that both data and analytical query capabilities can be restored or accessed in a secondary region. Additionally, all access to the data lake must be secure, easily revocable, and audit-compliant, avoiding long-lived static credentials. You need to design the solution while minimizing operational overhead and idle resource costs. Which storage and analytical query configuration should you recommend?

An enterprise is planning to grant a third-party auditing firm temporary read-only access to financial reports stored in an Azure Blob Storage container for 14 days. The access must be easily revocable at any time during this period without affecting other storage access methods. Additionally, internal security administrators require temporary elevated access to manage the storage account settings, but only when actively performing audit tasks. Which of the following security and access control configurations should you recommend to meet these requirements? (Select TWO.)

A company plans to migrate an on-premises inventory management database system to Azure. The system requires support for SQL Server Agent to run automated tasks and native cross-database queries. The database must remain highly available and survive the outage of an entire Azure availability zone. The company wants to minimize the administrative overhead of managing the underlying operating system, patching, and backups. Which Azure SQL deployment option should you choose?

An organization named Apex Global Finance is designing a secure identity and access management solution using Microsoft Entra ID. The solution must meet the following requirements:
- Require multi-factor authentication (MFA) for all standard administrative users.
- Ensure that administrators only hold privileged permissions when they are actively performing administrative tasks.
- Minimize the risk of a tenant lockout if there is a widespread outage of the Azure MFA service.

Which two of the following configurations should you include in the identity design? (Select TWO).

An enterprise is designing a subscription governance and access model for a new business unit. The unit will use three Azure subscriptions managed under a single parent management group named Corp-Unit-MG.

You must meet the following requirements:
1. Allow a team of database administrators (DBAs) to manage all Azure SQL databases across all three subscriptions.
2. Ensure that any new Azure SQL Database deployed in these subscriptions is automatically configured to send diagnostic logs to a central Log Analytics workspace, without blocking deployment or requiring manual configuration by the DBAs.
3. Minimize administrative overhead and adhere to the principle of least privilege.

Which solution should you recommend?

You are designing the data tier for a global telemetry platform that tracks $500,000$ container shipments. Sensor devices upload high-frequency environmental metrics to Azure Blob Storage, while metadata and real-time alerts are stored in an Azure Cosmos DB for NoSQL database. The system requirements are:

- Ensure sub-$10\text{ ms}$ write latencies for Cosmos DB across three regions (East US, West Europe, and East Asia) with a $99.999\%$ write availability SLA.
- Support regional failover without data loss for committed Cosmos DB transactions.
- Dynamically authorize device uploads to Azure Blob Storage securely, allowing token revocation if a device is compromised.
- Avoid performance bottlenecks or hot partitions in Cosmos DB during peak traffic.

Which database and storage configuration should you recommend?

An enterprise operates a multi-subscription Azure environment managed under a single root management group. You are designing a security and governance solution for a team of database administrators (DBAs) and a compliance auditing team.

The DBAs must be able to create and modify Azure SQL databases, but they must be prevented from deleting databases or altering SQL Server firewall rules. Their access must be limited to their 8-hour shifts, require manager approval, and scale automatically without manual role assignments when new DBAs join the team.

The compliance auditing team requires that all SQL servers automatically configure diagnostic logging to a centralized storage account without blocking database creation operations.

Which governance and access control configuration should you recommend?