All practice questions

1198 questions

All types1,198 Multiple choice617 Multiple select502 Matching65 Ordering14

A company named Aetheris Biotech is designing an identity and access management solution for a new Microsoft Entra ID tenant that will integrate with their on-premises Active Directory Domain Services (AD DS) domain. The design must satisfy the following requirements:

- Users must sign in using their on-premises credentials.
- Authentication must succeed even if the on-premises data centers experience a complete power outage.
- Privileged administrators must only activate their roles for a maximum of 4 hours when performing tasks, avoiding persistent active assignments.
- A Conditional Access policy requiring Multi-Factor Authentication (MFA) must apply to all administrators, but must prevent tenant lockout if the MFA service is unavailable.

Which solution should you recommend?

Configure Password Hash Synchronization (PHS) as the hybrid authentication method. Use Microsoft Entra Privileged Identity Management (PIM) to configure administrative role assignments as active with a 4-hour expiration. Create a Conditional Access policy requiring MFA for all administrators, and exclude an emergency access account from this policy.

Configure Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO). Use Microsoft Entra Privileged Identity Management (PIM) to configure administrative role assignments as eligible. Create a Conditional Access policy requiring MFA for all administrators, and apply it to all administrator accounts without any exclusions.

Configure Password Hash Synchronization (PHS) as the hybrid authentication method. Use Microsoft Entra Privileged Identity Management (PIM) to configure administrative role assignments as eligible. Create a Conditional Access policy requiring MFA for all administrators, and exclude an emergency access account from this policy.

Configure Active Directory Federation Services (AD FS) as the hybrid identity solution. Use Microsoft Entra Privileged Identity Management (PIM) to configure administrative role assignments as eligible. Create a Conditional Access policy requiring MFA for all administrators, and exclude an emergency access account from this policy.

Show answer & explanation

Answer: Configure Password Hash Synchronization (PHS) as the hybrid authentication method. Use Microsoft Entra Privileged Identity Management (PIM) to configure administrative role assignments as eligible. Create a Conditional Access policy requiring MFA for all administrators, and exclude an emergency access account from this policy.

Answer

Configure Password Hash Synchronization (PHS) as the hybrid authentication method, configure administrative role assignments as eligible using Microsoft Entra Privileged Identity Management (PIM), and create a Conditional Access policy requiring MFA for all administrators while excluding an emergency access account.

The correct solution uses Password Hash Synchronization (PHS) because it copies a hash of the user's password to the cloud, allowing authentication to proceed even when the on-premises infrastructure is offline. By configuring roles as eligible in Microsoft Entra Privileged Identity Management (PIM), administrators must request and activate their roles on-demand (just-in-time), preventing persistent access. Finally, excluding an emergency access account from the MFA Conditional Access policy is a critical best practice that ensures tenant recovery and administration are possible if the MFA service is unavailable.

Step-by-Step Solution

Evaluate hybrid authentication options for offline resilience.

Identify Password Hash Synchronization (PHS) as the authentication method that allows authentication to continue in the cloud when the on-premises datacenter is completely offline.

Both Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) depend on active communication with on-premises servers or agents to process sign-ins.

Evaluate administrative role assignment strategy for least privilege.

Determine that administrative roles must be configured as eligible assignments in Privileged Identity Management (PIM).

Eligible assignments require administrators to explicitly activate their roles just-in-time, preventing persistent access, whereas active assignments grant immediate, continuous access.

Design the Conditional Access policy to prevent administrator lockout.

Exclude at least one emergency access account (break-glass account) from the Conditional Access policy requiring MFA.

Excluding an emergency access account ensures that administrators can still log in and manage the tenant if there is a wide-scale MFA service outage.

Key Concept

Designing resilient hybrid authentication and access governance using Password Hash Synchronization, PIM eligible assignments, and Conditional Access exclusions.

Estimated Time:2m 0s

Question 22Question →

An organization is migrating a high-performance Linux-based application to Azure Virtual Machines. The application requires a shared file system that supports POSIX-compliant file locks and the NFS protocol. The design requires that the storage solution must survive a single zone outage within an Azure region while maintaining high performance. Which storage solution should you recommend?

Premium Azure Files configured with Zone-Redundant Storage (ZRS) using the NFS protocol.

Standard Azure Files configured with Locally Redundant Storage (LRS) using the NFS protocol.

Premium SSD Managed Disks configured with Locally Redundant Storage (LRS) using Azure Shared Disks.

Azure Blob Storage configured with Zone-Redundant Storage (ZRS) using NFS v3.0, with inactive files moved to the Archive tier.

Show answer & explanation

Answer: Premium Azure Files configured with Zone-Redundant Storage (ZRS) using the NFS protocol.

Answer

Premium Azure Files configured with Zone-Redundant Storage (ZRS) using the NFS protocol.

Premium Azure Files configured with Zone-Redundant Storage (ZRS) using the NFS protocol is correct. Premium Azure Files natively supports NFS 4.1, which provides full POSIX-compliant locking. ZRS replicates data across three availability zones in the region, ensuring the storage survives a zone outage.

Step-by-Step Solution

Identify the protocol and locking requirements.

The application requires NFS and POSIX-compliant file locks. Premium Azure Files supports NFS 4.1, which meets this requirement.

Standard Azure Files does not support NFS, which eliminates options using that tier.

Determine the redundancy and performance requirements.

The solution must survive a zone outage (requiring Zone-Redundant Storage - ZRS) and maintain high performance (Premium tier).

This rules out options utilizing Locally Redundant Storage (LRS).

Evaluate the viability of lifecycle tiering.

Workloads with active file system access cannot use the Archive tier because the retrieval latency is too high.

This eliminates designs proposing Blob Storage with Archive tier lifecycle policies.

Key Concept

Selecting Azure Files Premium tier with ZRS for NFS and zone redundancy.

Question 23Question →

A logistics company is designing an administration model for its Azure landing zones. The environment has a Management Group hierarchy with a root group named "Logistics-Root" and child groups for different business units.

The company has two specific requirements:
1. A compliance team needs to audit and review resource configurations across all subscriptions under the "Logistics-Root" management group.
2. A network operations team needs to troubleshoot and modify route tables and network security groups inside the subscriptions, but only during scheduled maintenance windows, requiring multi-factor authentication (MFA) and administrator approval before access is granted.

To meet these requirements, which two configurations should you include in the administrative design?

Select all that apply

Assign the Reader role to a Microsoft Entra security group containing the compliance team members at the Logistics-Root management group level.

Assign the Network Contributor role as an eligible assignment to a Microsoft Entra security group for the network operations team using Privileged Identity Management (PIM).

Assign the Reader role directly to the individual Microsoft Entra ID user accounts of the compliance team members at the Logistics-Root management group level.

Assign the Network Contributor role as a permanently active assignment to the individual user accounts of the network operations team at the subscription scope.

Show answer & explanation

Answer: Assign the Reader role to a Microsoft Entra security group containing the compliance team members at the Logistics-Root management group level.; Assign the Network Contributor role as an eligible assignment to a Microsoft Entra security group for the network operations team using Privileged Identity Management (PIM).

Answer

Assign the Reader role to a Microsoft Entra security group containing the compliance team members at the Logistics-Root management group level, and assign the Network Contributor role as an eligible assignment to a Microsoft Entra security group for the network operations team using Privileged Identity Management (PIM).

Applying the principle of least privilege and scalable governance is achieved by assigning permissions to security groups rather than individual users. To audit configurations across all subscriptions, the compliance group requires the Reader role at the parent management group level. For temporary administrative access, configuring the network operations group as eligible for the Network Contributor role via Privileged Identity Management ensures that permissions are only activated when required, are time-bound, and require the necessary MFA and approval.

Step-by-Step Solution

Analyze the compliance team auditing requirements and scope.

Determine that the Reader role must be assigned at the root Management Group level ('Logistics-Root') so that permissions inherit down through all child subscriptions.

Scope inheritance in Azure RBAC ensures that policies and roles assigned at a higher management group level apply automatically to all resource containers below it.

Apply group-based governance for the compliance team role assignment.

Assign the Reader role to a Microsoft Entra security group instead of individual accounts.

Direct user assignment is hard to audit, violates least privilege and management practices, and increases administrative overhead.

Analyze the temporary administrative requirements for the network operations team.

Identify that the Network Contributor role is required, but access must be JIT, approved, and require MFA.

Privileged Identity Management (PIM) supports role activation based on approval, MFA verification, and time bounds.

Configure the network operations assignment as eligible in PIM.

Assign the Network Contributor role as an eligible assignment to the network operations security group rather than a permanently active direct assignment.

Eligible assignments enforce just-in-time authorization and require explicit activation, preserving the least privilege principle.

Key Concept

Azure RBAC, Subscription Governance, Group-Based Assignments, and Privileged Identity Management (PIM)

Question 24Question →

A healthcare provider plans to allow external clinical researchers to upload trial datasets to a specific Azure Blob Storage container. You need to design an access solution that meets the following requirements:
- The researchers must have write access for a maximum of 48 hours.
- You must be able to revoke access immediately if a security compromise is detected.
- The solution must minimize administrative effort.

Which two actions should you include in the design? (Select TWO.)

Select all that apply

Create a stored access policy on the blob container.

Generate a Shared Access Signature (SAS) token that references the stored access policy.

Generate an ad-hoc Shared Access Signature (SAS) token with a 48-hour lifetime directly on the container.

Assign the Storage Blob Data Contributor role directly to each researcher's individual guest user account.

Show answer & explanation

Answer: Create a stored access policy on the blob container.; Generate a Shared Access Signature (SAS) token that references the stored access policy.

Answer

To meet the security and revocation requirements with minimal administrative overhead, you must create a stored access policy on the blob container and generate a Shared Access Signature (SAS) token that references this policy.

To meet the requirement of immediate revocation, you must define a stored access policy on the blob container and then generate a Shared Access Signature (SAS) token that references this policy. If a compromise is detected, you can delete or modify the stored access policy, which immediately invalidates the SAS token without needing to rotate the storage account keys.

Step-by-Step Solution

Identify the revocation requirement.

Determine that ad-hoc SAS tokens cannot be revoked individually without rotating the master storage account keys.

Stored access policies enable granular control and immediate revocation of SAS tokens by modifying or deleting the policy.

Bind the access method to the policy.

Generate a service SAS token that inherits its parameters and validity from the stored access policy.

This guarantees that if the policy is removed or updated, the token is invalidated instantly.

Evaluate administrative overhead constraints.

Avoid direct RBAC role assignments to individual user accounts.

Direct assignments increase management complexity, violating Azure governance and least-privilege scaling best practices.

Key Concept

Delegating access to Azure Storage containers securely using Stored Access Policies to support revocation.

Estimated Time:1m 0s

Question 25Question →

Aetherius Aerospace has an on-premises Active Directory Domain Services (AD DS) forest integrated with a primary Microsoft Entra ID tenant. The company recently partnered with Quantum Labs, which operates its own separate Microsoft Entra ID tenant. You are designing a hybrid and multi-tenant identity solution to meet the following requirements:

- Aetherius Aerospace users must be able to authenticate to cloud services using their on-premises passwords, even if the on-premises datacenters or network links become completely unavailable.
- Aetherius Aerospace users must be able to reset their passwords using a self-service portal in the cloud, and the new passwords must immediately synchronize back to the on-premises AD DS.
- Quantum Labs users must be able to access shared applications in the Aetherius Aerospace tenant using their existing home credentials without creating duplicate accounts.
- To prevent tenant lockout during an identity provider outage, designated emergency access administrator accounts must be able to log in without being blocked by multi-factor authentication (MFA) requirements.

Which identity integration and access control design should you recommend?

Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback for Aetherius Aerospace users. Configure Microsoft Entra B2B collaboration to invite Quantum Labs users as guests. Apply a Conditional Access policy requiring multi-factor authentication (MFA) for administrative and external access, with an explicit exclusion for emergency access accounts.

Configure Microsoft Entra Connect with Pass-through Authentication (PTA) and Password Writeback for Aetherius Aerospace users. Configure Microsoft Entra B2B collaboration to invite Quantum Labs users as guests. Apply a Conditional Access policy requiring multi-factor authentication (MFA) for all administrative and external access, without excluding emergency access accounts.

Deploy Active Directory Federation Services (AD FS) for Aetherius Aerospace user authentication. Use Microsoft Entra B2B collaboration to invite Quantum Labs users as guests. Configure a Conditional Access policy requiring multi-factor authentication (MFA) for administrative access, and assign the tenant administrator roles directly to individual user accounts.

Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) but disable Password Writeback. Configure Microsoft Entra B2B collaboration to invite Quantum Labs users as guests. Configure Privileged Identity Management (PIM) to assign permanently active administrator roles to emergency access accounts.

Show answer & explanation

Answer: Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback for Aetherius Aerospace users. Configure Microsoft Entra B2B collaboration to invite Quantum Labs users as guests. Apply a Conditional Access policy requiring multi-factor authentication (MFA) for administrative and external access, with an explicit exclusion for emergency access accounts.

Answer

Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback for Aetherius Aerospace users, invite Quantum Labs users as guests via Entra B2B collaboration, and apply a Conditional Access policy requiring MFA for administrative and external access with an explicit exclusion for emergency access accounts.

The correct design uses Password Hash Synchronization (PHS) to ensure users can authenticate in the cloud during on-premises outages, and Password Writeback to support self-service password changes. It uses Microsoft Entra B2B to allow Quantum Labs users to authenticate with their home credentials, and it excludes emergency access accounts from MFA to prevent complete tenant lockout during an identity provider outage.

Step-by-Step Solution

Determine the synchronization and authentication mechanism for the primary tenant.

Select Password Hash Synchronization (PHS) with Password Writeback.

PHS allows authentication to occur entirely in the cloud, satisfying the business continuity requirement if the on-premises network or domain controllers are offline. Password Writeback is required to support cloud-initiated Self-Service Password Reset (SSPR) writing back to the on-premises directory.

Establish the collaboration model for multi-tenant access.

Configure Microsoft Entra B2B collaboration to invite the external tenant's users as guests.

This allows Quantum Labs users to authenticate using their existing home tenant credentials, eliminating the need to manage duplicate accounts or synchronize their passwords.

Configure the security policy and emergency access exclusions.

Deploy a Conditional Access policy requiring MFA for administrative and guest access, and add the emergency access accounts to the exclusion list.

Excluding emergency access (break-glass) accounts from the MFA policy ensures that administrators can access the tenant even during a global or regional MFA service outage.

Key Concept

Designing a secure, resilient hybrid and multi-tenant identity solution using Microsoft Entra Connect PHS, B2B collaboration, and Conditional Access with emergency exclusions.

Estimated Time:2m 0s

Question 26Question →

A global financial services firm operates a single-tenant Azure environment structured under a root management group named FinanceRoot. You are designing a delegated administration and governance strategy for a team of external security auditors. The auditors must be able to view policy compliance states and read the configurations of all Key Vaults and Storage Accounts across all current and future subscriptions. The design must adhere to the principle of least privilege, minimize administrative overhead, and ensure that the auditors only have access temporarily when actively performing an audit.

Which strategy should you recommend?

Create a Microsoft Entra security group. Assign the security group to a custom Azure RBAC role at the FinanceRoot management group scope, defining only the necessary read actions. Configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible members of the security group.

Configure Microsoft Entra Privileged Identity Management (PIM) for Azure Resources to assign the individual security auditors as eligible members of a custom Azure RBAC role at the FinanceRoot management group scope.

Create a Microsoft Entra security group. Assign the security group to a custom Azure RBAC role at the FinanceRoot management group scope. Configure Microsoft Entra Privileged Identity Management (PIM) for Groups to assign the auditors as permanently active members of the security group.

Create a Microsoft Entra security group. Assign the security group the Reader role on each individual Azure subscription. Implement an Azure Policy definition at the FinanceRoot management group scope with a Deny effect to prevent the security group from modifying any resources.

Show answer & explanation

Answer: Create a Microsoft Entra security group. Assign the security group to a custom Azure RBAC role at the FinanceRoot management group scope, defining only the necessary read actions. Configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible members of the security group.

Answer

The correct strategy is to create a Microsoft Entra security group, assign it to a custom Azure RBAC role at the root management group scope, and configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible members of the group.

The correct strategy combines management group scope inheritance, custom RBAC roles for least privilege, security groups for scalable identity administration, and PIM for Groups to enforce JIT access. Assigning the custom role at the FinanceRoot management group ensures automatic inheritance to all child subscriptions. Using a security group avoids direct user assignments, and configuring the auditors as eligible group members in PIM ensures that their access is temporary and must be explicitly activated.

Step-by-Step Solution

Define the scope and inheritance requirements for the auditing permissions.

Determine that assigning the custom role at the root management group (FinanceRoot) scope ensures automatic inheritance to all child subscriptions without administrative overhead.

Management groups provide a hierarchical structure that allows RBAC roles to inherit downward to all current and future child subscriptions.

Apply the principle of least privilege and administrative scaling for role assignment.

Create a custom Azure RBAC role with specific read-only actions for Key Vaults and Storage Accounts, and assign it to a Microsoft Entra security group rather than individual users.

Assigning roles to groups instead of individual users simplifies administration and ensures scalability.

Configure just-in-time (JIT) access to enforce temporary auditing sessions.

Implement Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible members of the security group, allowing them to activate membership only during audit windows.

PIM for Groups ensures that administrative permissions are not permanently active, mitigating security risks associated with standing access.

Key Concept

Azure RBAC, Management Group Inheritance, and Microsoft Entra PIM Integration

Question 27Question →

An enterprise stores large volumes of raw sensor data in Parquet format within an Azure Data Lake Storage Gen2 container. Members of the data engineering team need to run occasional, exploratory SQL queries to analyze the schema and contents of new files. They do not want to load the data into a database or keep compute clusters running when no queries are active.

Which Azure Synapse Analytics component is the most appropriate option to satisfy these requirements?

A serverless SQL pool

A dedicated SQL pool

Locally Redundant Storage (LRS)

A Shared Access Signature (SAS) token

Show answer & explanation

Answer: A serverless SQL pool

Answer

A serverless SQL pool

The correct option is a serverless SQL pool because it allows data engineers to query data in the data lake directly without loading it or provisioning a cluster. It charges per query based on data processed, aligning with the requirement to avoid idle compute costs.

Step-by-Step Solution

Analyze the requirements

Occasional, exploratory SQL queries directly on Parquet files in Azure Data Lake Storage Gen2 without provisioning persistent compute clusters.

This establishes that we need an on-demand query engine that charges based on usage rather than continuous provisioning.

Evaluate the capabilities of serverless SQL pools vs dedicated SQL pools in Azure Synapse Analytics

Serverless SQL pools run queries on-demand and scale compute automatically, charging only for data processed. Dedicated SQL pools require running clusters and data ingestion.

This helps identify the Synapse component that satisfies the requirement to minimize idle compute cost and query files directly.

Key Concept

Azure Synapse SQL Serverless vs Dedicated Pools

Question 28Question →

A healthcare organization is designing a cloud-based clinical trial platform. Patient health records are stored in an Azure Blob Storage container named `trials`. A third-party auditing firm requires read-only access to this container for a period of $120$ days. The security architecture must ensure that the access can be immediately revoked at any time without rotating the storage account access keys or impacting other applications. Additionally, all access requests must originate from the auditing firm's public IP range of $198.51.100.0/24$ .

Which access control strategy should you recommend to meet these requirements?

Create a stored access policy on the container, and then generate a service Shared Access Signature (SAS) token that references the policy and specifies the allowed IP address range.

Generate an ad-hoc service Shared Access Signature (SAS) token for the container with an expiry of

120

days and the IP address constraint.

Assign the Storage Blob Data Reader role directly to each auditor's Microsoft Entra ID user account and configure a storage firewall rule targeting the IP address range.

Create a Microsoft Entra ID group for the auditors, assign the Storage Blob Data Reader role to the group, and configure a Privileged Identity Management (PIM) active role assignment for the group.

Show answer & explanation

Answer: Create a stored access policy on the container, and then generate a service Shared Access Signature (SAS) token that references the policy and specifies the allowed IP address range.

Answer

Create a stored access policy on the container, and then generate a service Shared Access Signature (SAS) token that references the policy and specifies the allowed IP address range.

The correct option recommends creating a stored access policy on the container and generating a service SAS token referencing it. A stored access policy provides a way to manage SAS tokens on the server side, allowing revocation by simply deleting or modifying the policy without rotating the storage account keys. It also supports specifying IP address constraints directly in the SAS token parameters.

Step-by-Step Solution

Analyze the access scope and revocation requirements.

Identify that the access is limited to a single container for a specific duration, and must be immediately revokable without rotating the storage account keys.

This determines that an ad-hoc SAS token is unsuitable, and a mechanism linked to a stored access policy is required.

Compare SAS implementation options.

Confirm that a service SAS referencing a stored access policy allows revocation on the server side by deleting or updating the policy.

This meets the key requirement of revocation without rotating the primary or secondary storage account keys.

Apply additional network security controls to the SAS parameter definition.

Verify that the service SAS token can restrict access to the specific external IP address range.

This satisfies the requirement that all requests must originate from the auditing firm's public IP range.

Key Concept

Stored Access Policies and Shared Access Signatures

Question 29Question →

A healthcare organization is migrating an on-premises Electronic Health Record (EHR) system to Azure. The design requires configuring secure access to an Azure Storage account named ehrdata that contains sensitive patient medical images in a blob container.

The solution must meet the following security requirements:
- External partner radiologists must be granted temporary read-only access to the blob container for 7 days. This access must be immediately revocable at any time before the 7 days expire.
- Internal compliance auditors require access to review the data, and the configuration must enforce scalable access control using identity best practices.
- Security administrators must be able to rotate storage keys, but only during scheduled audit windows, requiring manager approval before they can perform this action.

Which three actions should you include in the storage security and access control design? (Select three.)

Select all that apply

Create a Stored Access Policy on the destination container, and generate a Shared Access Signature (SAS) token associated with that policy for the external radiologists.

Generate an ad-hoc Shared Access Signature (SAS) token directly on the container with a validity of 7 days for the external radiologists.

Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the internal auditors.

Assign the Storage Blob Data Reader role directly to the individual user accounts of each internal compliance auditor.

Configure Microsoft Entra Privileged Identity Management (PIM) to make the security administrators eligible for the Storage Account Key Operator Service Role, requiring approval to activate.

Configure Microsoft Entra Privileged Identity Management (PIM) to assign the Storage Account Key Operator Service Role as active to the security administrators.

Show answer & explanation

Answer: Create a Stored Access Policy on the destination container, and generate a Shared Access Signature (SAS) token associated with that policy for the external radiologists.; Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the internal auditors.; Configure Microsoft Entra Privileged Identity Management (PIM) to make the security administrators eligible for the Storage Account Key Operator Service Role, requiring approval to activate.

Answer

To secure the storage account, you should create a Stored Access Policy on the destination container and generate a associated SAS token; assign the Storage Blob Data Reader role to a Microsoft Entra ID security group rather than individual users; and configure Microsoft Entra PIM to make security administrators eligible for the Storage Account Key Operator Service Role with activation approval required.

The correct architecture leverages a Stored Access Policy to bind the SAS token lifetime and permissions, facilitating revocation at any time. It uses Microsoft Entra ID security groups for scalable role assignments to enforce governance. Finally, it implements Privileged Identity Management (PIM) with eligible role assignments to enforce just-in-time (JIT) administrative access requiring workflow approval.

Step-by-Step Solution

Address external partner access security

Create a Stored Access Policy on the container and generate an associated SAS token.

This configuration allows the organization to revoke the SAS token early by changing the stored policy constraints or deleting the policy, without impacting other integrations.

Address auditor access scalability

Create a security group in Microsoft Entra ID, add the auditors to the group, and assign the Storage Blob Data Reader role to the group.

Direct role assignments to individual users do not scale and make access governance auditing difficult.

Address administrator privilege escalation

Configure Privileged Identity Management (PIM) with eligible assignments for the Storage Account Key Operator Service Role, requiring approval.

Active assignments leave administrative privileges permanently active, which violates the principle of least privilege and just-in-time access.

Key Concept

Applying least privilege, scalability, and revocability to Azure Storage security.

Estimated Time:3m 0s

Question 30Question →

An organization is designing a relational data storage solution for a new patient scheduling portal. The database tier must support the following requirements:

* Run on a single database using a serverless compute model that automatically scales compute resources based on workload demand.
* Automatically pause the database during periods of inactivity to minimize costs.
* Ensure that database backups are resilient against a primary datacenter outage.

Which deployment option should you recommend?

Azure SQL Database serverless with Locally Redundant Storage (LRS) backup redundancy

Azure SQL Database serverless with Zone-Redundant Storage (ZRS) backup redundancy

Azure SQL Managed Instance with Locally Redundant Storage (LRS) backup redundancy

SQL Server on Azure Virtual Machines using Standard HDD for transaction logs

Show answer & explanation

Answer: Azure SQL Database serverless with Zone-Redundant Storage (ZRS) backup redundancy

Answer

Azure SQL Database serverless with Zone-Redundant Storage (ZRS) backup redundancy

The correct option is the one specifying Azure SQL Database serverless with Zone-Redundant Storage (ZRS) backup redundancy. Azure SQL Database serverless automatically scales compute for single databases and includes an auto-pause feature to optimize costs during inactive periods. Selecting ZRS replication for database backups ensures that the data is replicated across different availability zones, meeting the requirement to remain resilient against a primary datacenter outage.

Step-by-Step Solution

Analyze the database operational model requirements.

The solution requires a single database that supports auto-scaling and auto-pausing during periods of inactivity. This points directly to the serverless compute tier of Azure SQL Database, as Azure SQL Managed Instance and SQL Server on Azure VMs do not support auto-pausing.

To eliminate relational database deployment models that do not meet the primary cost and scalability requirements.

Evaluate backup redundancy options for disaster resilience.

The backups must survive a primary datacenter outage. Locally Redundant Storage (LRS) is insufficient because it replicates data within a single datacenter. Zone-Redundant Storage (ZRS) replicates data across three Azure availability zones within the region, providing resilience against datacenter failures.

To select the storage redundancy type that matches the organization's disaster recovery guidelines.

Cross-reference disk requirements and administrative limits.

SQL Server on Azure VMs is ruled out due to high management overhead, and using Standard HDD for transaction logs would cause severe performance bottlenecks.

To ensure no other options satisfy the constraints.

Key Concept

Selecting appropriate Azure SQL service tiers and storage redundancy configurations based on workload patterns and disaster recovery requirements.

Question 31Question →

A company is planning the storage architecture for a new application. The business requirements state that the data must be replicated synchronously across three separate availability zones within the primary region to ensure high availability. Which two Azure Storage replication options should you recommend to meet this requirement? (Select two.)

Select all that apply

Zone-redundant storage (ZRS)

Geo-zone-redundant storage (GZRS)

Locally redundant storage (LRS)

Geo-redundant storage (GRS)

Show answer & explanation

Answer: Zone-redundant storage (ZRS); Geo-zone-redundant storage (GZRS)

Answer

Zone-redundant storage (ZRS) and Geo-zone-redundant storage (GZRS)

The correct options are Zone-redundant storage (ZRS) and Geo-zone-redundant storage (GZRS). ZRS replicates data synchronously across three availability zones in the primary region. GZRS combines the high availability of ZRS in the primary region with asynchronous replication to a secondary region, meaning both options meet the requirement of synchronous zonal replication in the primary region.

Step-by-Step Solution

Analyze the primary region replication requirement.

The requirement specifies synchronous replication across three availability zones within the primary region.

This determines that the storage account replication tier must support zone-redundancy in the primary region.

Evaluate the replication behavior of each storage tier in the primary region.

Zone-redundant storage (ZRS) and Geo-zone-redundant storage (GZRS) both replicate data synchronously across three zones in the primary region. Locally redundant storage (LRS) and Geo-redundant storage (GRS) only replicate within a single zone/datacenter in the primary region.

Comparing the options isolates the two that satisfy the zone-redundancy requirement.

Key Concept

Azure Storage Zone Redundancy

Estimated Time:45s

Question 32Question →

A logistics corporation is designing a privileged identity architecture for its IT operations team. The team has 12 administrators who require the User Access Administrator role to manage permissions across several subscription groups. The design must ensure that these administrators do not have permanent administrative rights, must perform multi-factor authentication (MFA) to activate their privileges, and that the organization's break-glass accounts are never locked out of the tenant by conditional access policies. Which two configurations should you include in the identity design to meet these requirements?

Select all that apply

Create a Microsoft Entra ID security group for the IT operations team, and assign this group as eligible for the User Access Administrator role in Privileged Identity Management (PIM).

Create a Conditional Access policy requiring multi-factor authentication (MFA) for administrative role activation, and add the emergency break-glass accounts to the exclusion list of this policy.

Configure Privileged Identity Management (PIM) assignments as permanently active for each individual administrator to ensure direct and uninterrupted access.

Configure a Conditional Access policy that enforces multi-factor authentication (MFA) for all administrative role activations, ensuring no accounts are excluded to maintain a uniform security baseline.

Show answer & explanation

Answer: Create a Microsoft Entra ID security group for the IT operations team, and assign this group as eligible for the User Access Administrator role in Privileged Identity Management (PIM).; Create a Conditional Access policy requiring multi-factor authentication (MFA) for administrative role activation, and add the emergency break-glass accounts to the exclusion list of this policy.

Answer

The correct design includes configuring a Microsoft Entra ID group for the administrators, making that group eligible for the User Access Administrator role in Privileged Identity Management (PIM), and creating a Conditional Access policy requiring multi-factor authentication (MFA) for activation while excluding break-glass accounts.

The correct configurations ensure just-in-time access and robust recovery paths. Using a Microsoft Entra ID security group assigned as eligible for the User Access Administrator role in Privileged Identity Management (PIM) avoids direct user assignment and enforces the principle of least privilege. Requiring multi-factor authentication (MFA) for role activation secures the identity verification process, and explicitly excluding emergency break-glass accounts from this Conditional Access policy prevents administrative lockout during authentication service disruptions.

Step-by-Step Solution

Identify the group assignment strategy for administrative roles.

Create a Microsoft Entra ID security group containing the 12 administrators.

Assigning roles to groups instead of individual users is an Azure best practice that reduces administrative overhead and ensures scalability.

Determine the activation policy in Privileged Identity Management (PIM).

Assign the security group as eligible, not active, for the User Access Administrator role.

Eligible assignments support just-in-time (JIT) access, ensuring administrators do not hold standing privileges when they do not need them.

Enforce multi-factor authentication (MFA) for role activation while securing emergency access.

Apply a Conditional Access policy requiring MFA for role activation, and add emergency break-glass accounts to the policy's exclusion list.

This secures the activation path with MFA but prevents tenant lockout if there is an MFA system outage.

Key Concept

Privileged identity governance and emergency access design in Microsoft Entra ID

Estimated Time:2m 0s

Question 33Question →

An enterprise is designing a subscription governance and access management strategy for a new business unit's development workloads. The environment consists of multiple subscriptions grouped under a single Management Group. You need to delegate administrative access to a team of developers so they can manage Azure Virtual Machines and Azure App Services within these subscriptions. The solution must minimize administrative overhead when developers join or leave the team, prevent developers from permanently holding privileged roles, and adhere to the principle of least privilege. Which two actions should you include in the design? (Select two.)

Select all that apply

Configure eligible assignments for the Virtual Machine Contributor and Website Contributor roles to a Microsoft Entra ID security group at the Management Group scope using Microsoft Entra Privileged Identity Management (PIM).

Add the developers to a Microsoft Entra ID security group and assign the roles to the group rather than to individual user accounts.

Assign the Contributor role directly to the individual developer user accounts at the Management Group scope.

Configure permanently active Owner role assignments for the developer user accounts at the Subscription scope.

Show answer & explanation

Answer: Configure eligible assignments for the Virtual Machine Contributor and Website Contributor roles to a Microsoft Entra ID security group at the Management Group scope using Microsoft Entra Privileged Identity Management (PIM).; Add the developers to a Microsoft Entra ID security group and assign the roles to the group rather than to individual user accounts.

Answer

To meet the requirements, you should configure eligible assignments for the Virtual Machine Contributor and Website Contributor roles to a Microsoft Entra ID security group at the Management Group scope using Microsoft Entra Privileged Identity Management (PIM), and add the developers to the Microsoft Entra ID security group rather than assigning roles directly to individual user accounts.

The correct design uses a Microsoft Entra ID security group to minimize administrative overhead, and assigns the specific Virtual Machine Contributor and Website Contributor roles at the Management Group scope as eligible assignments using Microsoft Entra PIM. This setup ensures inheritance across all subscriptions, keeps roles scoped to only what is needed (least privilege), and enforces just-in-time (JIT) access activation so developers do not hold permissions permanently.

Step-by-Step Solution

Identify the required roles based on least privilege.

Virtual Machine Contributor and Website Contributor roles are selected instead of broad Contributor or Owner roles.

This limits developers' permissions to only managing Virtual Machines and App Services, satisfying the principle of least privilege.

Determine the identity assignment method to minimize administrative overhead.

A Microsoft Entra ID security group is created, and developers are added to this group.

Assigning permissions to a group simplifies management because membership changes are handled dynamically in Microsoft Entra ID rather than updating individual role assignments.

Establish just-in-time access and scope boundary.

Configure eligible assignments for the selected roles to the security group at the Management Group scope using Microsoft Entra PIM.

This ensures developers do not permanently hold privileged access (complying with PIM eligibility) and the permissions inherit down to all subscriptions within the Management Group.

Key Concept

Implementing scalable subscription governance using Microsoft Entra ID groups, Microsoft Entra PIM for just-in-time access, and least-privilege RBAC role assignments at the Management Group scope.

Estimated Time:2m 0s

Question 34Question →

An enterprise designs a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-eus-hub` ( $10.100.0.0/16$ ), contains an Azure Route Server in the `RouteServerSubnet` ( $10.100.1.0/24$ ) and a Network Virtual Appliance (NVA) at IP address $10.100.2.4$ in the subnet `snet-eus-nva` ( $10.100.2.0/24$ ). An ExpressRoute Gateway is deployed in the `GatewaySubnet` ( $10.100.0.0/24$ ) and connects to the corporate on-premises network ( $172.16.0.0/12$ ). The spoke virtual network, `vnet-eus-prod` ( $10.101.0.0/16$ ), contains a web tier subnet, `snet-prod-web` ( $10.101.10.0/24$ ), and a database tier subnet, `snet-prod-db` ( $10.101.20.0/24$ ). Virtual network peering is configured between `vnet-eus-hub` and `vnet-eus-prod` with "Allow gateway transit" enabled on the hub and "Use remote virtual network gateways or route server" enabled on the spoke. The Route Server is peered with the NVA. The NVA advertises a default route ( $0.0.0.0/0$ ) via BGP to the Route Server, while the ExpressRoute Gateway propagates the on-premises route ( $172.16.0.0/12$ ) via BGP. You must design a routing solution for the web tier subnet, `snet-prod-web`, that satisfies the following requirements:

- All internet-bound traffic must route through the NVA ( $10.100.2.4$ ) for security inspection.
- All traffic to the on-premises network ( $172.16.0.0/12$ ) must bypass the NVA and route directly to the ExpressRoute Gateway.
- All traffic to the database tier subnet (`snet-prod-db`) must remain local and bypass the NVA.
- All traffic to the hub management subnet, `snet-hub-mgmt` ( $10.100.3.0/24$ ), must bypass the NVA and route directly.
- All traffic to the private endpoints subnet in the hub, `snet-hub-pe` ( $10.100.50.0/24$ ), must route through the NVA.

Which route table configuration should you apply to `snet-prod-web` to meet these requirements with the least administrative effort?

Create a route table with a single User Defined Route (UDR) for

10.100.50.0/24

with the next hop set to Virtual Appliance and IP address

10.100.2.4

, and associate it with the subnet.

Create a route table with a User Defined Route (UDR) for

10.100.0.0/16

with the next hop set to Virtual Appliance and IP address

10.100.2.4

, and a second UDR for

10.100.3.0/24

with the next hop set to Virtual Network, and associate it with the subnet.

Disable gateway route propagation on the route table, and add three manual User Defined Routes (UDRs):

0.0.0.0/0

with next hop Virtual Appliance

10.100.2.4

172.16.0.0/12

with next hop Virtual Network Gateway, and

10.100.50.0/24

with next hop Virtual Appliance

10.100.2.4

, and associate it with the subnet.

Configure the virtual network peering between the hub and spoke to disable gateway transit, and create a route table with a User Defined Route (UDR) for

10.100.50.0/24

with the next hop set to Virtual Appliance and IP address

10.100.2.4

, and associate it with the subnet.

Show answer & explanation

Answer: Create a route table with a single User Defined Route (UDR) for $10.100.50.0/24$ with the next hop set to Virtual Appliance and IP address $10.100.2.4$ , and associate it with the subnet.

Answer

Create a route table with a single User Defined Route (UDR) for

10.100.50.0/24

with the next hop set to Virtual Appliance and IP address

10.100.2.4

, and associate it with the subnet.

The correct configuration is to create a route table with a single User Defined Route (UDR) for the private endpoints subnet (

10.100.50.0/24

) pointing to the NVA at

10.100.2.4

. Because the virtual network peering has gateway transit enabled on the hub and remote gateway usage enabled on the spoke, Azure Route Server dynamically propagates BGP routes to the spoke's subnets. As a result, the default route (

0.0.0.0/0

) from the NVA and the on-premises route (

172.16.0.0/12

) from the ExpressRoute Gateway are automatically populated in the routing table of the web tier subnet. Spoke-to-spoke traffic is handled by the local virtual network system route (

10.101.0.0/16

), and spoke-to-hub management traffic is handled by the peering system route (

10.100.0.0/16

). Therefore, only the private endpoint subnet (

10.100.50.0/24

) requires a UDR to override the peering system route via Longest Prefix Match (LPM).

Step-by-Step Solution

Analyze the dynamic route propagation configuration.

Since Azure Route Server is peered with the NVA and the ExpressRoute Gateway, and the VNet peering has gateway transit enabled, the spoke subnet automatically learns the default route (

0.0.0.0/0

) pointing to the NVA and the on-premises route (

172.16.0.0/12

) pointing to the Gateway.

This eliminates the need to manually configure UDRs for internet and corporate on-premises traffic, satisfying the first two requirements.

Evaluate the system routing for local and peering traffic.

Traffic within the spoke (

10.101.0.0/16

) uses the local system route. Traffic to the hub management subnet (

10.100.3.0/24

) matches the VNet Peering system route (

10.100.0.0/16

). Both routes bypass the NVA.

System routes handle these paths directly, satisfying the third and fourth requirements without manual intervention.

Configure routing for the private endpoints subnet to be inspected by the NVA.

Add a UDR for

10.100.50.0/24

with next hop Virtual Appliance

10.100.2.4

. The next hop IP

10.100.2.4

is resolved using the system's VNet Peering route (

10.100.0.0/16

) because it is more specific than the UDR itself.

This overrides the default peering system route for the private endpoints subnet due to Longest Prefix Match (LPM), while avoiding a recursive routing loop for the NVA's own IP.

Key Concept

Azure Route Server route propagation and User Defined Route (UDR) resolution priority

Estimated Time:3m 0s

Question 35Question →

A healthcare company is designing a container-based application on Azure to host a patient portal API. The application consists of several microservices that handle patient queries. The design must satisfy the following requirements:
- The microservices must scale down to zero instances when there is no incoming traffic to reduce costs.
- The application components must communicate privately and be isolated within an existing Azure virtual network.
- The solution must minimize administrative and infrastructure management overhead.
- Audit logs must be kept strictly isolated in their respective deployment regions to comply with data sovereignty regulations.

Which two configurations should you recommend?

Select all that apply

Host the microservices using Azure Container Apps.

Host the microservices on an Azure Kubernetes Service (AKS) cluster.

Deploy the container hosting environment as an internal Azure Container Apps environment.

Create a single centralized Log Analytics workspace in the primary region to collect logs from all environments.

Deploy the microservices as Azure Container Apps Jobs with manual scaling configured.

Show answer & explanation

Answer: Host the microservices using Azure Container Apps.; Deploy the container hosting environment as an internal Azure Container Apps environment.

Answer

To meet the requirements, you should recommend hosting the microservices using Azure Container Apps and deploying the container hosting environment as an internal Azure Container Apps environment.

Hosting the microservices using Azure Container Apps is correct because it provides serverless container hosting that natively scales down to zero instances when idle and minimizes operational overhead by eliminating Kubernetes cluster management. Deploying the container hosting environment as an internal Azure Container Apps environment is correct because it securely integrates the services directly into an existing Azure Virtual Network for isolated private communication.

Step-by-Step Solution

Evaluate compute hosting options based on operational overhead and scaling requirements.

Azure Container Apps is selected over Azure Kubernetes Service because it provides a serverless platform that scales to zero with minimal administrative overhead, satisfying the requirement to minimize infrastructure management.

Choosing Azure Container Apps eliminates the need to manage Kubernetes control planes and node pools while still providing scale-to-zero capabilities for microservices.

Determine the appropriate network deployment configuration for private communication.

An internal Azure Container Apps environment is selected to host the containerized services.

An internal environment ensures the container apps are deployed inside the existing virtual network and can only be accessed privately, satisfying the isolation and secure communication requirements.

Analyze compliance requirements regarding audit logs and data sovereignty.

Reject the option to centralize all regional logs into a single workspace, as regional data isolation is required.

To comply with data sovereignty regulations, logs must be kept isolated within their respective regions, requiring separate workspaces instead of a single centralized workspace.

Key Concept

Designing compute and networking architectures for containerized microservices in Azure using low-overhead services with virtual network integration.

Estimated Time:2m 0s

Question 36Question →

An enterprise is designing a hub-and-spoke network topology in Azure to host a multi-tier application. The hub virtual network, `vnet-eus-hub` (address space: $10.100.0.0/16$ ), contains an Azure Firewall deployed at the internal IP address $10.100.1.4$ . A peered spoke virtual network, `vnet-eus-prod` (address space: $10.101.0.0/16$ ), contains two subnets: `snet-web` ( $10.101.10.0/24$ ) and `snet-db` ( $10.101.20.0/24$ ).

The security team requires that:
1. All outbound internet traffic from `snet-web` must be inspected by the Azure Firewall.
2. All traffic between `snet-web` and `snet-db` must be inspected by the Azure Firewall.
3. Virtual machines within `snet-web` must be able to communicate directly with each other without traversing the firewall.

A network engineer creates a route table named `rt-web-routes`, defines the following user-defined routes (UDRs), and associates the route table with `snet-web`:
- Route 1: Address prefix $0.0.0.0/0$ with a next hop of Virtual Appliance ( $10.100.1.4$ )
- Route 2: Address prefix $10.101.0.0/16$ with a next hop of Virtual Appliance ( $10.100.1.4$ )

During testing, the engineer observes that virtual machines within `snet-web` are unable to communicate with each other.

Which configuration change should the engineer implement in the route table to restore intra-subnet connectivity within `snet-web` while maintaining all security requirements?

Change the next hop of Route 2 to Virtual Network.

Delete Route 2 from the route table.

Replace Route 2 with a new route for address prefix

10.101.20.0/24

and a next hop of Virtual Appliance (

10.100.1.4

Add a new route with address prefix

10.101.10.0/24

and a next hop of Virtual Appliance (

10.100.1.4

Show answer & explanation

Answer: Replace Route 2 with a new route for address prefix $10.101.20.0/24$ and a next hop of Virtual Appliance ( $10.100.1.4$ ).

Answer

Replace the broad virtual network route with a specific route for the database subnet address prefix (

10.101.20.0/24

) pointing to the firewall as the next hop.

Replacing the broad

10.101.0.0/16

route with a specific route for the database subnet (

10.101.20.0/24

) targeting the firewall (

10.100.1.4

) correctly routes database traffic to the firewall. Because there is no longer a UDR overriding the local

10.101.10.0/24

range, traffic within the web subnet falls back to the system-defined local route (

10.101.0.0/16

-> Virtual Network). Since the system route is a longer prefix match than the default route (

0.0.0.0/0

), intra-subnet traffic bypasses the firewall and remains local.

Step-by-Step Solution

Analyze the routing requirements and the current User-Defined Routes (UDRs) associated with the web subnet.

The current UDR (

10.101.0.0/16

with next hop

10.100.1.4

) is overriding the default system route for the entire virtual network, including the local subnet (

10.101.10.0/24

Because UDRs override system routes of the same prefix, all local traffic within the web subnet is being forwarded to the firewall, which breaks direct subnet communication.

Identify how to isolate the database subnet traffic from the local subnet traffic.

Define a more specific route targeting only the database subnet (

10.101.20.0/24

) with the next hop set to the firewall.

This satisfies the security requirement to inspect all database-bound traffic while removing the override on the local web subnet's IP range.

Verify how the remaining traffic types will be routed.

Intra-subnet web traffic (

10.101.10.0/24

) will match the system route (

10.101.0.0/16

-> Virtual Network) since it is more specific than the default route (

0.0.0.0/0

) and there is no overriding UDR. Outbound internet traffic will match the default route (

0.0.0.0/0

) and go to the firewall.

This meets all requirements: outbound traffic goes to the firewall, web-to-database traffic goes to the firewall, and intra-subnet web traffic remains local.

Key Concept

Azure User-Defined Routes (UDRs) override system-defined routes of the same prefix. Broader UDRs covering the entire VNet range will redirect intra-subnet traffic, which can break local communication. To prevent this, UDRs should target specific remote subnets rather than the entire VNet prefix, allowing local traffic to fall back to the system-defined local route.

Question 37Question →

Borealis Energy is designing a hybrid identity and access management solution. The company synchronizes its on-premises Active Directory Domain Services (AD DS) environment to Microsoft Entra ID.

The solution must meet the following requirements:
- Enforce on-premises security policies, such as log-on hours, during cloud authentication in real-time.
- Minimize on-premises infrastructure and eliminate the need for inbound firewall ports.
- Ensure that administrators are prompted for multi-factor authentication (MFA) when accessing cloud resources, while preventing tenant lockout during an identity system outage.

Which combination of authentication method and Conditional Access policy configuration should you recommend?

Pass-through Authentication (PTA) and a Conditional Access policy that requires MFA for all administrative directory roles and explicitly excludes a dedicated emergency access account.

Password Hash Synchronization (PHS) and a Conditional Access policy that requires MFA for all administrative directory roles and explicitly excludes a dedicated emergency access account.

Active Directory Federation Services (AD FS) and a Conditional Access policy that requires MFA for all administrative directory roles and explicitly excludes a dedicated emergency access account.

Pass-through Authentication (PTA) and a Conditional Access policy that requires MFA for all administrative directory roles without any exclusions, relying on emergency administrators to request access via Privileged Identity Management (PIM).

Show answer & explanation

Answer: Pass-through Authentication (PTA) and a Conditional Access policy that requires MFA for all administrative directory roles and explicitly excludes a dedicated emergency access account.

Answer

Pass-through Authentication (PTA) and a Conditional Access policy that requires MFA for all administrative directory roles and explicitly excludes a dedicated emergency access account.

Pass-through Authentication (PTA) validates user passwords directly against the on-premises Active Directory Domain Services, which enforces local security policies like logon hours in real-time. PTA achieves this via lightweight agents that establish outbound connections, meaning no inbound firewall ports are needed. Furthermore, excluding a dedicated emergency access account from the Conditional Access MFA policy ensures that administrators can access the tenant to perform recovery actions in the event of an authentication failure or external service outage.

Step-by-Step Solution

Evaluate the authentication method requirements.

Identify Pass-through Authentication (PTA) as the correct method because it evaluates on-premises AD DS policies (like log-on hours) in real-time, unlike Password Hash Synchronization (PHS), and does not require incoming network ports or heavy on-premises server footprint like Active Directory Federation Services (AD FS).

PTA leverages outbound-only connections from lightweight agents running on-premises to process login requests directly against the local domain controllers.

Evaluate the Conditional Access policy requirement to enforce MFA while protecting against tenant lockout.

Determine that the Conditional Access policy targeting administrative directory roles must contain an explicit exclusion for a dedicated emergency access (break-glass) account.

Omitting an exclusion for the emergency access account from strict MFA policies risks locking out administrators if there is an MFA service disruption or connectivity issue.

Key Concept

Selecting a hybrid identity authentication method to enforce local AD DS policies in real-time while using Conditional Access policies with exclusion groups to prevent administrative lockout.

Estimated Time:1m 30s

Question 38Question →

A logistics company runs a fleet tracking application in the West US 2 region. The application's architecture includes two front-end web server virtual machines named Web-01 and Web-02, and a backend SQL Server database hosted on a single virtual machine named DB-01.

Web-01 and Web-02 both run on Standard SSD disks, each experiencing a continuous write churn of $1.5\text{ MB/s}$ . DB-01 uses three Premium SSD v1 disks:
* OS Disk: $2\text{ MB/s}$ average write churn
* Data Disk: $12\text{ MB/s}$ average write churn
* Transaction Log Disk: $56\text{ MB/s}$ average write churn

You are designing a disaster recovery (DR) solution to the East US region. The solution must meet the following requirements:
* The web servers must have a Recovery Point Objective (RPO) of 1 hour and a Recovery Time Objective (RTO) of 2 hours.
* The database must have an RPO of less than 10 seconds and an RTO of 15 minutes.

Which disaster recovery design should you recommend?

Configure Azure Site Recovery to replicate Web-01, Web-02, and DB-01 to the target region, enabling the High Churn replication policy on DB-01's virtual machine configuration.

Configure Azure Site Recovery to replicate Web-01 and Web-02, and configure an Azure SQL Auto-Failover Group to automate database replication for the SQL Server instance on DB-01.

Configure Azure Site Recovery to replicate Web-01 and Web-02 to the target region, and deploy SQL Server Always On Availability Groups to replicate the database to a target virtual machine in East US.

Configure Azure Site Recovery to replicate Web-01 and Web-02, and configure DB-01's disks on Read-Access Geo-Redundant Storage (RA-GRS) to allow database write workloads to resume in the secondary region during failover.

Show answer & explanation

Answer: Configure Azure Site Recovery to replicate Web-01 and Web-02 to the target region, and deploy SQL Server Always On Availability Groups to replicate the database to a target virtual machine in East US.

Answer

Configure Azure Site Recovery to replicate the web servers (Web-01 and Web-02) to the target region, and deploy SQL Server Always On Availability Groups to replicate the database (DB-01) to a target virtual machine in the target region.

The correct design uses Azure Site Recovery to replicate the web tier virtual machines, while using SQL Server Always On Availability Groups to replicate the database tier. This is necessary because Azure Site Recovery has an absolute write churn limit of

54\text{ MB/s}

per Premium SSD v1 disk (even with High Churn enabled). DB-01's transaction log disk has a churn of

56\text{ MB/s}

, which exceeds this limit and would fail replication. Furthermore, block-level replication through Azure Site Recovery cannot guarantee the sub-10 second RPO required for the database tier, whereas native SQL Server Always On Availability Groups can.

Step-by-Step Solution

Analyze the web tier disaster recovery requirements and capabilities.

Web-01 and Web-02 have an RPO of 1 hour and RTO of 2 hours, with

1.5\text{ MB/s}

churn. This is well within standard Azure Site Recovery (ASR) limits (up to

8\text{ MB/s}

for Standard SSD, and typical RPO is minutes, RTO is under 2 hours). Thus, ASR is suitable for the web tier.

To ensure the web tier can fail over within the given RTO/RPO limits using block-level VM replication.

Evaluate the database tier VM disk write churn against Azure Site Recovery limits.

DB-01 has a transaction log disk experiencing

56\text{ MB/s}

write churn. Azure Site Recovery's maximum support limit for a Premium SSD v1 disk is

20\text{ MB/s}

(Standard replication) and

54\text{ MB/s}

(High Churn replication). Since

56\text{ MB/s} > 54\text{ MB/s}

, DB-01 cannot be replicated using ASR.

To determine if ASR can support the write-intensive log disk of the database VM.

Select the correct database replication method to meet the near-zero RPO and RTO requirements.

A sub-10 second RPO requires native database-level replication. Deploying SQL Server Always On Availability Groups to a target database VM in the destination region ensures database transactions are replicated asynchronously or synchronously with near-zero RPO, completely bypassing ASR's disk churn limitations.

To select a replication technology that satisfies the database's specific RPO/RTO goals and bypasses hypervisor-level storage limits.

Key Concept

Azure Site Recovery limits and hybrid database replication design patterns

Question 39Question →

OmniGene Diagnostics is designing a disaster recovery and business continuity solution for its genomic analysis application. The application writes raw gene sequencing data to an Azure Storage account. The solution must meet the following requirements:

- Protect data against a local datacenter (zone) outage in the primary region with zero data loss.
- Provide a Recovery Point Objective (RPO) of less than 15 minutes for regional outages.
- Provide a Recovery Time Objective (RTO) of less than 1 hour.
- Allow the secondary region application instance to read data immediately during a primary region outage without waiting for a failover.
- Support write operations in the secondary region if a prolonged primary region outage occurs.
- Minimize costs.

Which two configurations should you recommend to meet the requirements? (Select two.)

Select all that apply

Configure the storage account replication to use read-access geo-zone-redundant storage (RA-GZRS).

Configure the application in the secondary region to direct read requests to the secondary storage endpoint.

Configure the storage account replication to use read-access geo-redundant storage (RA-GRS).

Configure the application in the secondary region to write data directly to the secondary storage endpoint during a primary region outage without initiating a failover.

Show answer & explanation

Answer: Configure the storage account replication to use read-access geo-zone-redundant storage (RA-GZRS).; Configure the application in the secondary region to direct read requests to the secondary storage endpoint.

Answer

Configure the storage account replication to use read-access geo-zone-redundant storage (RA-GZRS), and configure the application in the secondary region to direct read requests to the secondary storage endpoint.

To satisfy the requirement of zero data loss during a local datacenter (zone) outage in the primary region, the solution must utilize zone-redundant storage in the primary region. This is provided by geo-zone-redundant storage configurations. Furthermore, to read data immediately in the secondary region during an outage without waiting for a failover, read-access must be explicitly enabled on the secondary storage replica (RA-GZRS), and the application must target the secondary storage endpoint.

Step-by-Step Solution

Determine the primary region redundancy requirement.

The requirement states that data must survive a local datacenter (zone) outage in the primary region with zero data loss. This requires zone-redundant storage (ZRS) replication in the primary region.

Locally redundant storage (LRS) places all replicas in a single datacenter, whereas ZRS replicates data across three zones to survive a zone outage.

Determine the geo-replication and read accessibility requirement.

The solution requires a secondary region copy with less than 15 minutes RPO, and the ability to read from the secondary region immediately during a primary outage without initiating failover. This necessitates Read-Access Geo-Zone-Redundant Storage (RA-GZRS).

Standard GZRS does not allow read access to the secondary region until a failover is initiated, whereas RA-GZRS exposes a read-only secondary endpoint.

Identify the application configuration required to use the secondary region replica.

The application connection string or configuration in the secondary region must be updated to target the storage account's secondary endpoint.

During a primary region outage, the primary endpoint is unavailable. The application must point to the secondary endpoint to perform read operations.

Key Concept

Designing Azure Storage replication using RA-GZRS to achieve zone-redundancy in the primary region and read-only secondary access before failover.

Question 40Question →

An organization is designing the routing configuration for a spoke virtual network named `vnet-spoke-prod` ( $172.16.0.0/16$ ) in Microsoft Azure. The virtual network contains a subnet named `snet-web` ( $172.16.1.0/24$ ).

`vnet-spoke-prod` is peered with a hub virtual network named `vnet-hub-prod` ( $10.100.0.0/16$ ). The hub virtual network contains an Azure Firewall instance with the private IP address $10.100.1.4$ .

You have the following requirements:
- All outbound traffic from `snet-web` to the internet must be routed through the Azure Firewall for security inspection.
- All traffic from `snet-web` to an external spoke virtual network named `vnet-spoke-corp` ( $192.168.0.0/16$ ) must be routed through the Azure Firewall.
- All internal traffic within `vnet-spoke-prod` must bypass the firewall and route directly between resources using default Azure routing.

Which two routes should you add to the route table associated with `snet-web` to meet these requirements?

Select all that apply

A route for

0.0.0.0/0

with a next hop type of Virtual appliance and next hop IP address of

10.100.1.4

A route for

192.168.0.0/16

with a next hop type of Virtual appliance and next hop IP address of

10.100.1.4

A route for

172.16.0.0/16

with a next hop type of Virtual appliance and next hop IP address of

10.100.1.4

A route for

172.16.1.0/24

with a next hop type of Virtual appliance and next hop IP address of

10.100.1.4

Show answer & explanation

Answer: A route for $0.0.0.0/0$ with a next hop type of Virtual appliance and next hop IP address of $10.100.1.4$ ; A route for $192.168.0.0/16$ with a next hop type of Virtual appliance and next hop IP address of $10.100.1.4$

Answer

To meet the requirements, you must add a route for 0.0.0.0/0 pointing to the Azure Firewall at 10.100.1.4, and a route for 192.168.0.0/16 pointing to the Azure Firewall at 10.100.1.4.

The route for 0.0.0.0/0 directs all outbound internet traffic to the firewall, while the route for 192.168.0.0/16 redirects traffic destined for the corporate spoke virtual network to the firewall. Since Azure routes traffic using the longest prefix match (LPM), local traffic destined for the 172.16.0.0/16 address space will match the default local system route (which is more specific than 0.0.0.0/0) and bypass the firewall, maintaining direct local communication.

Step-by-Step Solution

Configure the internet-bound route.

Add a route for 0.0.0.0/0 with a next hop of Virtual appliance pointing to 10.100.1.4.

This redirects all default traffic (internet-bound) to the firewall for inspection.

Configure the inter-spoke route to the corporate network.

Add a route for 192.168.0.0/16 with a next hop of Virtual appliance pointing to 10.100.1.4.

This ensures traffic destined for the corporate spoke VNet (192.168.0.0/16) is inspected by the firewall before transit.

Allow default local routing to handle intra-VNet traffic.

Do not add any user-defined routes for the local VNet address space 172.16.0.0/16 or subnet 172.16.1.0/24.

Azure automatically evaluates routing using the longest prefix match. The system route for the local VNet (172.16.0.0/16) is more specific than 0.0.0.0/0, ensuring local traffic bypasses the firewall and flows directly. Adding a local UDR would override this system route and break direct local connectivity.

Key Concept

Azure routes traffic using the longest prefix match (LPM) algorithm. System-defined routes for local virtual networks automatically prioritize direct routing over a default route (0.0.0.0/0) unless overridden by a more specific user-defined route (UDR). Overriding the local route space breaks internal communications.

Estimated Time:1m 30s

PreviousPage 2 / 60Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept