All practice questions

An organization hosts its production workloads on Azure Virtual Machines. You are designing an Azure Backup solution that must meet the following requirements:
- Technical recoveries of backups from the last $5$ days must achieve the lowest possible Recovery Time Objective (RTO) by restoring directly from local disk snapshots.
- Monthly backups must be retained for $3$ years ($36$ months) to satisfy regulatory auditing compliance.
- The backup data must remain accessible even in the event of an entire Azure region outage.

You deploy a Recovery Services vault configured with Geo-Redundant Storage (GRS). Which configuration should you recommend in the backup policy?

A financial services firm is designing the cloud database architecture for a new customer portal. The design must satisfy the following requirements:

* Automatically fail over to a secondary Azure region with no client connection string modifications.
* Restrict database access to private IP addresses within a specific virtual network, preventing all public internet access.
* Minimize administrative overhead for database operations and patching.

Which two features or configurations should you include in the design?

An enterprise is designing a subscription governance and access model for a new division. The division will use a dedicated Azure subscription under the corporate management group. You need to design an identity and access management solution that meets the following security and operational guidelines:

* Database administrators (DBAs) must be able to manage Azure SQL databases, but they should only have these privileges when active on-call or working on an assigned incident.
* Auditor accounts must be able to view all resource configurations across the subscription but must not be allowed to modify any settings.
* All administrative privileges must be audit-compliant, scalable, and follow the principle of least privilege.
* Virtual machine deployments must automatically have a monitoring agent installed without requiring manual intervention by developers.

Which of the following configuration options should you include in the design? (Select THREE.)

Tailwind Traders is designing a storage solution for critical database backups. The backups must be protected against a regional disaster. The recovery time objective (RTO) requires these backup files to be accessible for immediate restore operations at any time without rehydration delays. Which storage configuration should be selected to meet these requirements?

An organization is architecting a globally distributed storage solution using Azure Cosmos DB. The system must support four distinct application components, each with unique data access patterns, migration origins, and scaling requirements. The components must be highly resilient across multiple Azure regions, support sub-10ms read/write latencies, and minimize code changes during migration from legacy environments.

Match each application requirement on the left to the correct Azure Cosmos DB API on the right to align with the workloads.

You are designing a business continuity and disaster recovery solution for a suite of critical Azure Virtual Machines hosting an enterprise resource planning (ERP) application.

The solution must satisfy the following technical and compliance requirements:
1. Operational recovery: Must support instant recovery of VMs directly from local snapshots for any recovery points created within the last 14 days.
2. Compliance retention: Backups must be retained in vault storage for 365 days.
3. Regional resiliency: Backups must be replicated to a secondary paired region. Administrators must be able to perform test restores in the secondary region at any time, including when the primary region is fully operational.

Which vault type, storage redundancy, and backup policy configuration should you recommend?

An organization is designing the storage architecture for a line-of-business application migrating to Azure. The application has the following design requirements:
- The database backend requires disk storage capable of delivering sub-millisecond read/write latency for transaction logs.
- A shared configuration file repository must be accessible concurrently by multiple application servers using the SMB protocol and must remain operational during a zone-level outage.
- Access to the configuration files must be secured and easily revokable if credentials are compromised.

Which two storage configurations should you recommend to meet these requirements?

You are designing a backup solution for a fleet of Azure Virtual Machines running a business-critical enterprise resource planning (ERP) application.

The design must satisfy the following requirements:
- Restore operations for backups younger than 7 days must achieve the lowest possible Recovery Time Objective (RTO) by recovering directly from local snapshots (Instant Restore).
- Recovery points must be retained in a Recovery Services vault for 365 days to meet regulatory compliance.
- The solution must allow restoration to a paired secondary region at any time, even if the primary region is fully functional and online.

Which backup configuration should you recommend?

A financial services firm is designing a secure storage solution for a multi-tenant payment processing platform. Transaction logs are stored in an Azure Blob Storage container named `ledgers`. The solution must satisfy the following security and governance requirements:

- External compliance auditors require read access to the `ledgers` container for a single 8-hour audit window. If a security incident is detected, administrative access must be capable of immediately terminating the auditors' access without affecting other storage operations or rotating the master storage account keys.
- The internal security engineering team requires administrative access to manage the storage account settings and access policies. Their access must follow the principle of least privilege, utilizing Just-in-Time (JIT) access elevation and avoiding direct user assignments to ensure scalable governance.

Which two security controls should you recommend to meet these requirements?

A logistics enterprise is designing a secure storage solution for external supplier invoices stored in an Azure Blob Storage container named supplierinvoices within a storage account named logisticsdata. The solution must satisfy the following security and operational requirements:

- External auditors require read access to the container for a temporary 14-day audit window. The access must be immediately revocable at any time during the audit without affecting other applications or rotating the storage account access keys.
- Internal financial analysts require read and write access to the container. They must obtain access only on-demand and for a limited duration, utilizing administrative self-service activation. The administration of access must scale efficiently without managing individual user permissions.

Which two actions should you include in the design to meet the requirements?

A financial services company is designing a storage solution for external consultants who need to upload weekly reports to an Azure Blob Storage container named consultant-uploads. The design must satisfy the following requirements:
- The consultants must be granted write-only access to the container for a duration of 90 days.
- The consultants must not be required to authenticate using Microsoft Entra ID.
- The security team must be able to immediately revoke the access if a compliance violation is detected.
Which of the following access control strategies should you recommend to meet these requirements?

A company is planning to migrate an on-premises inventory application to Azure. The application database tier consists of three databases that frequently execute cross-database queries using three-part names. The databases also rely on SQL Server Agent for scheduled data-cleansing jobs. You need to design a relational data storage solution that supports these database features while minimizing the operational effort required to manage operating system patching and backups.

Which Azure SQL deployment option should you recommend?

An enterprise is designing the storage infrastructure for a new mission-critical transaction processing application deployed on Azure Virtual Machines. The architecture must satisfy the following requirements:

- The transaction log drive requires block storage that supports at least $5{}000$ IOPS and $200$ MB/s of throughput with sub-millisecond write latency.
- The transaction log storage must remain highly available and survive a physical datacenter (availability zone) outage within the primary Azure region without data loss.
- Application audit logs stored in Azure Blob Storage must be securely shared with external auditors via time-bound links that can be revoked immediately at any time without rotating the primary storage account keys or affecting other active signatures.

Which storage configuration should you recommend?

You are designing a high availability and disaster recovery (HA/DR) solution for an on-premises database that is migrating to Azure. The database relies on SQL Server Agent jobs and performs cross-database queries. The disaster recovery design must support automatic failover to a secondary region, a Recovery Time Objective (RTO) of 1 hour, and a single connection endpoint that redirects application traffic without requiring connection string modifications during a failover. Which solution should you recommend?

A medical records company is designing an Azure Storage solution for document uploads. The system requirements specify that all uploaded documents must be replicated synchronously across three distinct availability zones within the primary region to protect against a localized datacenter failure.

Which two redundancy options meet these requirements?

An enterprise is designing a secure identity governance and privileged access strategy for its Azure infrastructure. The solution must meet the following requirements:

* A team of 10 system administrators must be granted administrative privileges on Azure subscription resources only when performing specific maintenance windows, requiring justification and multi-factor authentication (MFA).
* Administrative permissions must be managed at scale, avoiding direct role assignments to individual users.
* A backup mechanism must be established to ensure administrative access to the tenant remains possible even if the primary authentication systems or Conditional Access policies fail, preventing tenant lockout.

Which two configuration steps should you include in the design? (Select two.)

You are designing a globally distributed data storage solution for an international supply chain tracking system. The system must ingest telemetry data from $2,000,000$ active tracking devices. The workload is write-heavy, consisting of $85\%$ writes and $15\%$ reads. The data must be accessible with sub-$10\text{ ms}$ read and write latencies globally. The architecture must guarantee $99.999\%$ write availability and support regional disaster recovery. You decide to use Azure Cosmos DB for NoSQL with multi-region writes enabled. Which configuration should you recommend to meet the requirements while preventing performance degradation and ensuring disaster resilience?

An organization is designing a storage solution for a medical imaging application that generates high-resolution files. The solution must meet the following requirements:
- Files must be immediately accessible via HTTP/HTTPS protocols.
- Files are frequently accessed during the first 30 days, after which they are rarely accessed but must remain available for retrieval within seconds.
- External medical partners must be granted temporary access to specific files. The organization must be able to immediately revoke all active external access links to a container if a security breach is suspected, without modifying the primary storage account keys.
- Data must be replicated to a secondary region to protect against regional disasters, but read access to the secondary region is not required under normal operations.

Which storage configuration should you recommend?

An enterprise is implementing a subscription governance strategy. You need to create a custom Azure RBAC role named 'VM Operator' that allows users to manage virtual machines but prevents them from modifying associated virtual networks. The role must be assignable across all subscriptions in a specific Management Group named 'Production-MG'.

Which sequence of steps should you perform to define, create, and assign this custom RBAC role?

You are designing a backup solution for production Azure Virtual Machines. The solution must meet the following requirements:
- Operational restores for failures occurring within the last few days must have a Recovery Time Objective (RTO) of under 10 minutes by utilizing the Instant Restore feature.
- The solution must minimize operational costs by using a standard backup policy rather than an enhanced backup policy.
- All backup data must remain within the primary region to comply with local data residency regulations.

What is the maximum retention period in days that can be configured for the instant recovery snapshots in the standard backup policy?