All practice questions

An animation studio is migrating its core rendering pipeline to Azure. The pipeline consists of $150$ Linux-based virtual machines running rendering software.

The design requirements for the shared storage solution are as follows:
- Protocol & Compatibility: The rendering nodes require shared storage that supports NFS, POSIX-compliant file permissions, and hard links.
- Performance: The storage must support high-throughput parallel reads and writes, achieving sub-$10$ millisecond metadata operation latency.
- Availability: The storage solution must remain available even if a single physical datacenter (availability zone) in the primary Azure region experiences an outage.
- Administration: The storage solution must minimize the administrative overhead of managing OS-level clustering, virtual machines, or file system updates.

Which storage solution should you recommend in the design?

A maritime shipping enterprise is designing a secure ingestion pipeline for container telemetry logs stored in an Azure Blob Storage account named telemetrydata. External IoT gateway devices managed by a third-party vendor must upload telemetry files to a container named uploads. The security design must meet the following requirements:
- The gateway devices must only be allowed to write data to the container and must be blocked from reading, listing, or modifying existing data.
- The access credentials must expire after 90 days, and security administrators must have the ability to immediately revoke all outstanding access tokens in the event of a gateway breach without modifying storage account keys.
- All traffic to the storage account must be restricted to the vendor's dedicated public outbound IP range.

Which two actions should you include in the design?

A logistics company is designing the Azure storage infrastructure for a legacy fleet management application. The application will run on Azure Virtual Machines and has the following storage requirements:
- The virtual machine operating system and application binaries require persistent disk storage that supports sub-millisecond write latency.
- A shared file system is required to store application configuration files. The share must support the SMB 3.0 protocol, be accessible simultaneously by multiple virtual machines, and must survive a local datacenter zone outage.
- External partners need read-only access to specific PDF reports stored in Azure Blob Storage. This access must be granted via a Shared Access Signature (SAS) that can be easily revoked if compromised, without regenerating storage account keys.

Which two configurations should you include in the storage design? (Select TWO.)

Emberwood Manufacturing is designing a secure identity governance and access control solution for its Microsoft Entra ID tenant.

The company must satisfy the following administrative access requirements:
- Ensure that administrators can activate their privileged roles only when needed, for a maximum duration of 4 hours, and require multi-factor authentication (MFA) during activation.
- Prevent administrative lockout from the tenant in the event of a primary MFA service outage or misconfiguration.

Which two configurations should you include in the security design? (Choose two.)

You are designing a subscription governance and delegated administration solution for a new Azure landing zone. The solution must meet the following requirements:
- Establish a new management boundary for a dedicated business unit.
- Implement a custom Azure RBAC role named 'Resource Lock Manager' that allows managing resource locks but prevents deletion of any resources. This role must only be assignable within this new management boundary.
- Ensure that the operations team members can only active this role on-demand to align with the principle of least privilege.
- Use a Microsoft Entra ID group to minimize direct role assignments to individual users.

Which sequence of configuration steps should you perform to implement the solution?

AeroSpire Aerospace is designing a hybrid identity and access management solution for a new Microsoft Entra ID tenant that integrates with an on-premises Active Directory Domain Services (AD DS) forest. The solution must meet the following requirements:

- Users on corporate-joined devices must be automatically signed in without entering credentials.
- On-premises server infrastructure dependencies and operational overhead for identity federation must be minimized.
- All directory administrators must be prompted for multi-factor authentication (MFA) when accessing the Azure portal, using a Just-In-Time (JIT) administrative access workflow.
- In the event of a tenant-wide MFA service disruption, at least one administrative account must retain emergency access to the Azure portal.

Which of the following solutions should you recommend to meet the requirements?

A healthcare provider is designing the cloud architecture for a new clinical trials application. The application's database layer has the following technical and operational requirements:

* It must host two databases that require cross-database queries and transactions.
* It must use custom SQL Server Common Language Runtime (SQL CLR) assemblies to handle legacy data encryption methods.
* It must be deployed within a private subnet of an Azure Virtual Network to prevent any public internet exposure.
* It must minimize administrative overhead by eliminating operating system patching and manual backup tasks.
* It must remain operational and survive the failure of an entire Azure Availability Zone within the hosting region.

Which Azure SQL deployment option should you recommend?

An organization is designing a subscription governance model to allow network security administrators to manage network security rules across multiple subscriptions. To follow the principle of least privilege, the administrators must only be able to elevate their access on-demand using Just-In-Time (JIT) access. You need to configure this administrative model. In which order should you perform the configuration steps?

An organization is designing an identity governance and privileged access solution for external database administrators who require temporary access to manage an Azure SQL Managed Instance. The solution must meet the following requirements:
- Administrators must request access on-demand (just-in-time) for a duration of no more than 6 hours.
- Multi-factor authentication (MFA) must be enforced during the role activation process.
- The design must minimize administrative overhead and avoid assigning roles directly to individual user accounts.
- To prevent tenant lockout during a regional identity provider disruption, emergency break-glass accounts must be protected from being locked out by MFA policies.

Which configuration should you recommend to meet these requirements?

A retail business requires a daily ingestion pipeline to transfer $50\text{ GB}$ of operational log files from on-premises servers to Azure. The pipeline runs once every 24 hours. The storage solution must persist the logs in a hierarchical structure and guarantee data durability even during a regional datacenter disaster. Additionally, the data science team needs to perform infrequent, exploratory analysis directly on these files. Which two architectural choices should you make to meet these requirements? (Select two.)

Solaris Green Energy is designing an identity security strategy for its Microsoft Entra ID tenant. The design must enforce multi-factor authentication (MFA) for all administrative roles to protect resources from unauthorized access. To mitigate the risk of tenant lockout during an identity service outage or misconfiguration, the security team requires an emergency access plan.

Which of the following recommendations should you include in the identity design?

A smart grid utility provider is planning to migrate its relational data workloads to Azure. The migration includes the following two target databases:

* TelemetryDB stores real-time smart meter telemetry data and requires full access to the operating system's registry and local file system to run legacy hardware-interface drivers.
* BillingDB stores customer billing history and requires support for cross-database queries and SQL Server Agent jobs to automate end-of-month processing, but the operations team wants to eliminate operating system-level patching and management.

Which two Azure SQL deployment options should you recommend to host these databases? (Select two.)

An enterprise e-commerce platform is migrating its containerized workloads to Azure Kubernetes Service (AKS) running on Linux nodes. You are designing the storage architecture to meet the following requirements:

* A shared file share is required to store product catalog assets. It must be mounted directly by multiple concurrent Linux pods, support the NFS v4.1 protocol, provide zone redundancy, and deliver sub-millisecond latency for metadata operations.
* A stateful database container requires a persistent volume that supports at least $25,000$ IOPS and sub-millisecond write latency, and must remain available even if a single Azure availability zone suffers an outage.

Which two storage configurations should you include in your design? (Select TWO.)

A financial technology enterprise is designing a secure integration interface for a partner firm, Alpha Analytics, to retrieve historical transaction records stored in an Azure Blob Storage container named `tx-archive-2026`. The design must satisfy the following requirements:
- Alpha Analytics must have read-only access to the blobs.
- Access must be limited to a maximum duration of $48$ hours.
- Access must be restricted to Alpha Analytics' public outbound IP range ($203.0.113.0/24$).
- The enterprise must have the capability to immediately revoke access before the $48$-hour window expires, without rotating the storage account keys or affecting other services.

Which storage security and access control solution should you recommend?

An enterprise is designing a data analytics and integration platform on Azure to process and analyze financial transaction records. The platform must meet the following requirements:

- Historical Data: Store $150\text{ TB}$ of structured historical data in Parquet format. The storage solution must remain resilient against a regional datacenter outage.
- Daily Ingestion: Process $2\text{ TB}$ of new transaction records appended nightly. The batch integration pipeline runs for $3$ hours and requires support for complex transactional upsert operations.
- Ad-hoc Analytics: Allow data analysts to run occasional, unpredictable ad-hoc queries throughout the day. Each query typically scans up to $10\text{ TB}$ of data.
- Interactive Reporting: Serve a critical executive dashboard accessed concurrently by up to $100$ users between 09:00 and 11:00 daily. Dashboard queries require a guaranteed response latency of under $5$ seconds against a pre-aggregated $50\text{ GB}$ dataset.
- Cost Optimization: Minimize operational and compute costs, avoiding charges for idle resources when no queries are active.

Which architectural solution should you recommend?

A global retail company is planning its peak shopping season operations in Azure. The security architecture team needs to delegate temporary administrative access to the Site Reliability Engineering (SRE) team to manage Azure Kubernetes Service (AKS) clusters during maintenance windows. The design must ensure zero-standing administrative privileges, adhere to the principle of least administrative overhead for user management, and protect the tenant against lockouts.

Which of the following actions should you include in the identity governance and privileged access design? (Select TWO.)

A company is planning to migrate an on-premises SQL Server database to Azure. The database requires the use of SQL Server Agent to run scheduled maintenance tasks and relies on cross-database queries. The migration solution must also support automatic database backups with a retention period of up to 10 years.

Which two Azure SQL deployment options support these requirements? (Select two.)

A logistics company is designing a disaster recovery solution for an application database. The database is currently hosted on Azure SQL Managed Instance. The solution must meet the following requirements:
- Support automatic failover to a secondary region.
- Provide a single connection endpoint for read-write traffic and a separate endpoint that automatically routes read-only reporting queries to the secondary region.
- Keep the Recovery Point Objective (RPO) under 5 seconds.
- Ensure all replication traffic between the primary and secondary instances remains within a private network boundary.

Which solution should you recommend?

An enterprise is designing the security and access control architecture for an Azure Storage account named finstatements that will host sensitive monthly financial statements. The design must meet the following requirements:

* Internal auditors must be granted temporary Read access to the statements only when actively performing a quarterly audit. The activation of this access must require multi-factor authentication (MFA) and administrative approval.
* Auditor access must be managed at a group level to ensure scalable administration and avoid individual user-level assignments.
* An automated reporting service must have Read access to the statements using a Shared Access Signature (SAS) that expires in 180 days, but the SAS must be capable of being revoked immediately if compromised without affecting other storage operations.

Which two configurations should you include in the design? (Select two.)

An organization is designing a secure access and identity infrastructure using Microsoft Entra ID. The solution must enforce different access controls and verification methods depending on the context of the authentication attempt. Match each business or technical security requirement to the most appropriate Microsoft Entra ID or Conditional Access feature.