Examkin

All practice questions

1198 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 441Question →

VeloStream Telematics is designing a disaster recovery solution for its vehicle telemetry platform. The platform continuously writes unstructured metrics to a General Purpose v2 storage account in the East US region.

The architecture team defines the following disaster recovery requirements:
- During an outage in East US, the telemetry data must remain available for read-only analytical queries in a secondary region with a Recovery Time Objective (RTO) of less than 1515 minutes.
- To avoid unnecessary data loss due to replication lag, a write failover to the secondary region must only be initiated if the primary region outage is expected to exceed 44 hours.
- The solution must minimize overall storage costs.

Which configuration and failover strategy should you recommend?

Show answer & explanation

Answer: Configure the storage account with Read-Access Geo-Redundant Storage (RA-GRS). In the event of a primary region outage, immediately configure the analytics applications to read from the secondary endpoint. If the outage is confirmed to exceed 44 hours, initiate a customer-managed failover to make the secondary region the primary write endpoint.

Answer

Configure the storage account with Read-Access Geo-Redundant Storage (RA-GRS), redirecting read queries to the secondary endpoint during a primary outage, and initiating a customer-managed failover to the secondary region only if the outage exceeds 4 hours.
The correct option recommends configuring the storage account with Read-Access Geo-Redundant Storage (RA-GRS). RA-GRS replicates your data to a secondary region and provides a read-only endpoint. During an East US outage, analytical applications can read from this secondary endpoint immediately without triggering a failover, satisfying the 15-minute read RTO. If the outage is confirmed to exceed 4 hours, a customer-managed failover can be executed to promote the secondary region to the primary endpoint, which enables write operations by changing the storage account type to Locally Redundant Storage (LRS).

Step-by-Step Solution

1
Analyze read RTO requirement during a primary region outage.
Since read operations must be restored within 15 minutes of a primary outage, and write failover must not be triggered unless the outage lasts more than 4 hours, the data replication model must allow direct read access to the secondary region without triggering a failover.
This rules out standard Geo-Redundant Storage (GRS), which requires a failover before the secondary endpoint is readable.
2
Evaluate write capabilities of the secondary endpoint under normal and disaster recovery states.
Read-Access Geo-Redundant Storage (RA-GRS) provides read-only access to the secondary endpoint. It does not accept write operations directly. To restore write capabilities, a customer-managed failover must be initiated, which converts the storage account to Locally Redundant Storage (LRS) in the secondary region.
This rules out active-active architectures or direct writes to the secondary endpoint of RA-GRS without failover.
3
Evaluate the regional resilience capabilities of Zone-Redundant Storage (ZRS).
ZRS only replicates data synchronously across three availability zones within the primary region. It does not provide redundancy in a secondary region, failing the regional disaster recovery requirements.
This rules out ZRS as a regional disaster recovery solution.

Key Concept

Read-Access Geo-Redundant Storage (RA-GRS) provides read-only access to a secondary region without initiating a failover. To enable write operations on the secondary region during a primary outage, a customer-managed failover must be triggered, which changes the replication setting to LRS in the secondary region.
Question 442Question →

A financial services company is designing a subscription governance strategy. The security team must delegate permissions to a cloud operations team to manage network security groups (NSGs) and route tables within a production subscription. The operations team members change frequently, and their access must only be active during their scheduled shifts and automatically expire after eight hours. The design must prevent the operations team from modifying virtual networks or assigning permissions to other users. Additionally, any new resource group created within the subscription must automatically have a delete resource lock deployed to prevent accidental deletion. Which design should you recommend to meet these requirements while minimizing administrative overhead?

Show answer & explanation

Answer: Create a Microsoft Entra ID security group containing the operations team members. Use Microsoft Entra Privileged Identity Management (PIM) for Azure resources to configure the group with an eligible assignment to a custom Azure RBAC role at the subscription scope. Deploy an Azure Policy with a DeployIfNotExists effect at the subscription scope to apply the delete resource lock.

Answer

The correct design creates a Microsoft Entra ID security group, configures an eligible role assignment to a custom Azure RBAC role using PIM for Azure resources, and deploys an Azure Policy with a DeployIfNotExists effect at the subscription scope.
The correct answer combines all security and administrative requirements: using a Microsoft Entra ID group to scale identity administration, using PIM eligible assignments to enforce time-bounded shift access, and using an Azure Policy with a DeployIfNotExists effect to automatically deploy the required delete resource locks.

Step-by-Step Solution

1
Address team membership changes and administrative overhead.
Map the operations team to a Microsoft Entra ID security group instead of making individual user assignments.
Group-based assignment ensures that as team members join or leave, their access is managed dynamically by changing group membership without modifying resource assignments.
2
Address the shift-based and automatic expiration access requirement.
Configure an eligible role assignment using Microsoft Entra Privileged Identity Management (PIM) for Azure resources with a maximum activation duration of eight hours.
Eligible assignments require users to explicitly activate their roles, which can be configured to automatically expire after a set time limit.
3
Address the custom permission boundary.
Create a custom Azure RBAC role containing only the actions for Network Security Groups and Route Tables, excluding Virtual Network modifications and Role Assignments.
This adheres to the principle of least privilege, preventing unauthorized control plane modifications.
4
Address the automatic deployment of the delete resource lock on new resource groups.
Deploy an Azure Policy with a DeployIfNotExists effect targeted at the subscription scope.
Only a DeployIfNotExists policy can automatically create and apply dependent resources (such as resource locks) to newly provisioned resources if they do not exist.

Key Concept

Azure Subscription Governance using PIM, Custom RBAC roles, and DeployIfNotExists policies.
Question 443Question →

A company plans to migrate an on-premises database to Azure. The database workload requires SQL Server Agent jobs and cross-database queries. The disaster recovery (DR) solution must support automatic failover to a secondary Azure region with a recovery time objective (RTO) of less than 1 hour. After a failover, the application must connect to the database in the secondary region using the same connection string without requiring manual configuration changes. Which database solution and disaster recovery feature should you recommend?

Show answer & explanation

Answer: Azure SQL Managed Instance configured with a failover group

Answer

Azure SQL Managed Instance configured with a failover group
Azure SQL Managed Instance provides near-complete compatibility with the SQL Server database engine, including support for SQL Server Agent and cross-database queries. When configured with a failover group, it provides automatic failover capabilities and a single read-write listener endpoint. This listener endpoint ensures the application can connect to the primary instance in either region using the same connection string without manual configuration updates after a failover.

Step-by-Step Solution

1
Identify compatibility requirements
The application requires SQL Server Agent and cross-database queries, which are instance-level features not supported by Azure SQL Database (single database). This limits the choice to Azure SQL Managed Instance or SQL Server on Azure VMs.
Ensuring the selected database engine supports all legacy features is the first step in design.
2
Evaluate disaster recovery and endpoint routing requirements
The solution requires automatic failover and a single connection string (listener endpoint) across regions. Azure SQL Managed Instance failover groups provide a read-write listener that automatically updates its DNS record during a failover to point to the new primary instance.
This satisfies the RTO and connection string requirements without manual configuration changes.
3
Verify storage and performance constraints
SQL Server on Azure VMs using Standard HDD for transaction logs is rejected due to performance limitations, making Azure SQL Managed Instance with a failover group the optimal choice.
Transaction log drives require high IOPS/throughput typical of Premium SSD or Ultra Disk, not Standard HDD.

Key Concept

Selecting the correct Azure SQL deployment option based on legacy feature requirements and configuring failover groups for automatic multi-region DR with a single listener endpoint.
Estimated Time:1m 30s
Question 444Question →

A financial services corporation is architecting a real-time transaction processing platform. The core processing tier will run on Azure Virtual Machines. The platform has the following infrastructure requirements:
- A virtual machine uptime Service Level Agreement (SVA) of 99.99%.
- Under 1 millisecond network latency between the active virtual machine nodes in each cluster partition to support memory-mapped replication.
- Complete protection against a localized datacenter power or cooling failure.

Which design should you recommend to meet these requirements?

Show answer & explanation

Answer: Distribute the virtual machine instances across multiple Availability Zones using a Virtual Machine Scale Set in Flexible orchestration mode. Create a separate Proximity Placement Group for each Availability Zone and associate the virtual machines in each zone with their respective Proximity Placement Group.

Answer

Distribute the virtual machine instances across multiple Availability Zones using a Virtual Machine Scale Set in Flexible orchestration mode. Create a separate Proximity Placement Group for each Availability Zone and associate the virtual machines in each zone with their respective Proximity Placement Group.
Distributing the virtual machines across multiple Availability Zones provides the necessary 99.99% VM uptime SLA and zone-redundancy. Using a separate Proximity Placement Group (PPG) for each zone ensures that the virtual machines within each zone are colocated for ultra-low latency, while avoiding deployment allocation constraints that occur when stretching a single PPG across multiple zones.

Step-by-Step Solution

1
Determine the SLA requirement and select the correct placement structure.
To meet a 99.99% VM uptime SLA, the virtual machines must be distributed across two or more Availability Zones.
Azure provides a 99.99% VM uptime SLA only when VMs are deployed across multiple Availability Zones in the same region.
2
Address the low-latency requirement within each cluster partition.
A Proximity Placement Group (PPG) is required to group VMs closely together physically to achieve sub-millisecond network latency.
A PPG is a logical grouping capability used to make sure Azure compute resources are physically located close to each other.
3
Analyze constraints when combining Availability Zones and PPGs.
Creating a single PPG that spans multiple Availability Zones is not recommended and often fails because Azure cannot satisfy both physical zone separation (for high availability) and close physical proximity (for the PPG).
Stretching a single PPG across zones results in deployment allocation failures due to conflicting physical constraints.
4
Formulate the final design.
The optimal configuration is to deploy the virtual machines across multiple zones using a Virtual Machine Scale Set (VMSS) in Flexible orchestration mode, and deploy a separate PPG within each Availability Zone.
This configuration satisfies the 99.99% SLA, guarantees low latency within each zone, and avoids placement constraint errors.

Key Concept

Interaction between Azure Availability Zones, Proximity Placement Groups, and VMSS orchestration modes to balance high availability and low latency.
Question 445Question →

Match each Azure traffic routing and load balancing service to its appropriate architecture requirement.

Click a left item, then click its matching right item

Items

Global routing for HTTP(S) workloads with Anycast, SSL offloading, and web application firewall integration.
Global DNS-based routing for non-HTTP or multi-protocol endpoints requiring path/port independent redirection.
Regional routing for HTTP(S) workloads supporting URL path-based routing and cookie-based affinity.
Regional load balancing for non-HTTP TCP/UDP workloads requiring high-throughput and ultra-low latency.

Matches

Show answer & explanation

Answer

Global routing for HTTP(S) workloads with Anycast matches Azure Front Door; Global DNS-based routing matches Azure Traffic Manager; Regional routing for HTTP(S) workloads matches Azure Application Gateway; Regional load balancing for non-HTTP TCP/UDP workloads matches Azure Load Balancer.
The correct matches align each load balancing service with its specific scope (global or regional) and network layer (Layer 4 or Layer 7). Azure Front Door and Azure Traffic Manager handle global traffic at Layer 7 and DNS level respectively. Azure Application Gateway and Azure Load Balancer distribute regional traffic at Layer 7 and Layer 4 respectively.

Step-by-Step Solution

1
Identify the geographical scope for each requirement.
Requirements 1 and 2 are global; Requirements 3 and 4 are regional.
This narrows down choices between global load balancers (Azure Front Door, Azure Traffic Manager) and regional load balancers (Azure Application Gateway, Azure Load Balancer).
2
Identify the protocol layer (Layer 7 HTTP/S vs. Layer 4 TCP/UDP/DNS) for the global services.
Global HTTP(S) workloads needing SSL offloading match Azure Front Door; global DNS-based multi-protocol workloads match Azure Traffic Manager.
Azure Front Door is a Layer 7 Anycast service, whereas Azure Traffic Manager operates purely at the DNS level (Layer 4/DNS).
3
Identify the protocol layer for the regional services.
Regional HTTP(S) path-based routing matches Azure Application Gateway; regional TCP/UDP workloads match Azure Load Balancer.
Azure Application Gateway operates at Layer 7 (supporting URL-based routing), while Azure Load Balancer is a Layer 4 TCP/UDP distribution service.

Key Concept

Selecting Azure load balancing and traffic routing services based on protocol layer (Layer 4 vs. Layer 7) and geographic scope (global vs. regional).
Question 446Question →

An enterprise is designing a data storage and retention strategy for a new telemetry analytics application. The application will write data to an Azure Data Lake Storage Gen2 (ADLS Gen2) account.

The data requirements are structured as follows:

PeriodAccess Frequency & LatencyRetention & Immutability
**Days 11–1010**Frequently written and analyzed. Requires sub-second, low-latency access.Must be mutable for real-time updates.
**Days 1111–9090**Rarely accessed. Must remain online for occasional queries with a retrieval latency of less than 1010 seconds.Must be protected against deletion and modification.
**Days 9191–2,5552,555 (77 years)**Not accessed. Only kept for compliance audits. Retrieval latency of up to 1515 hours is acceptable.Must be protected against deletion and modification for the first 33 years (1,0951,095 days) from creation.

You need to configure a lifecycle management policy and immutability settings that satisfy these requirements while minimizing storage costs and avoiding early deletion fees.

Which of the following configuration options should you recommend? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Configure a container-level time-based retention policy with a duration of 1,0951,095 days and lock the policy.; Configure a lifecycle management policy to transition blobs to the Cool tier 1010 days after creation, to the Archive tier 9090 days after creation, and delete them after 2,5552,555 days.

Answer

To meet the storage, latency, and immutability requirements cost-effectively, configure a locked time-based retention policy for 1,0951,095 days at the container level, and implement a lifecycle management policy that transitions blobs to the Cool tier after 1010 days, to the Archive tier after 9090 days, and deletes them after 2,5552,555 days.
The correct configurations are to apply a locked container-level time-based retention policy for 1,0951,095 days and a lifecycle policy transitioning blobs to Cool at day 1010, Archive at day 9090, and deleting at day 2,5552,555. A locked time-based retention policy ensures that the compliance mandate for 33 years (1,0951,095 days) of immutability is met. Transitioning to Cool at day 1010 provides the required low-latency access for days 1111–9090. Because the blobs spend 8080 days in Cool before moving to Archive, this exceeds the Cool tier's 3030-day minimum retention requirement, avoiding any early deletion penalties.

Step-by-Step Solution

1
Analyze the latency and access requirements for the intermediate period (days 1111–9090).
The data must be queryable in less than 1010 seconds. This rules out the Archive tier since it requires hours to rehydrate. Both Cool and Cold tiers offer millisecond-level retrieval latencies.
To determine which online tiers are viable.
2
Calculate the duration the blobs will spend in the intermediate tier to avoid early deletion charges.
The blobs transition to the intermediate tier at day 1010 and to the Archive tier at day 9090, resulting in an intermediate duration of 8080 days. Cool tier has a 3030-day minimum retention, whereas Cold tier has a 9090-day minimum retention. Using Cold tier would trigger a 1010-day early deletion penalty (90−80=1090 - 80 = 10). Therefore, the Cool tier must be used.
To optimize costs by preventing early deletion charges.
3
Identify the mechanism to enforce the 33-year compliance requirement.
A locked time-based retention policy for 1,0951,095 days (33 years) provides immutable WORM storage. A legal hold cannot be configured with a duration and requires manual removal.
To fulfill the immutability requirements without operational overhead.

Key Concept

Azure Blob Storage lifecycle management tiering constraints, minimum retention periods for Cool and Cold tiers, and container-level immutable storage policies.
Question 447Question →

A smart grid utility provider is designing an analytical data platform on Azure to monitor electricity consumption. The platform must ingest real-time telemetry from 500,000 smart meters at a velocity of 10,000 events per second, totaling 12 TB of new data monthly. The architecture must satisfy the following requirements:
- The raw telemetry data must be stored in a data lake and remain highly available and resilient to regional datacenter outages.
- Data analysts must perform ad-hoc, exploratory SQL queries on years of historical Parquet files in the data lake without provisioning or paying for idle compute resources.
- External partners must be granted read access to the historical files securely, with the ability to revoke access immediately if needed.

Which two options should you recommend in the architectural design to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Azure Data Lake Storage Gen2 configured with Geo-Redundant Storage (GRS) to store the raw telemetry data.; A Serverless SQL pool in Azure Synapse Analytics to perform the ad-hoc exploratory queries on the historical Parquet files.

Answer

Configure Azure Data Lake Storage Gen2 with Geo-Redundant Storage (GRS) to ensure regional resilience, and use a Serverless SQL pool in Azure Synapse Analytics to query historical Parquet files on-demand without provisioning idle resources.
Configuring Azure Data Lake Storage Gen2 with Geo-Redundant Storage (GRS) satisfies the requirement for regional disaster resilience by replicating data to a secondary region. Implementing a Serverless SQL pool in Azure Synapse Analytics satisfies the requirement to run ad-hoc, exploratory SQL queries on Parquet files without provisioning or paying for idle compute, as it uses a pay-per-query model based on the volume of data processed.

Step-by-Step Solution

1
Analyze the storage redundancy requirement.
Locally Redundant Storage (LRS) only protects against local hardware failures within a single datacenter. To survive a regional outage, Geo-Redundant Storage (GRS) must be chosen.
Ensures that data is replicated to a secondary paired region for disaster recovery.
2
Analyze the query engine requirement.
A Dedicated SQL pool is a provisioned resource that incurs hourly compute costs regardless of active querying. A Serverless SQL pool charges only per query based on data processed, making it ideal for ad-hoc, intermittent exploration.
Satisfies the cost-efficiency constraint of avoiding payment for idle compute resources.
3
Verify security and access control practices.
Providing a long-lived ad-hoc SAS token is insecure because it cannot be revoked without rotating storage keys, which affects all other applications using those keys. Best practice dictates using stored access policies or short-lived tokens.
Ensures the ability to revoke external access immediately.

Key Concept

Selecting optimal Azure storage redundancy and Synapse SQL compute types based on availability and cost requirements.
Question 448Question →

An enterprise is designing a compute and logging architecture for a containerized order-processing application. The design must satisfy the following requirements:
- Host multiple microservices that scale dynamically based on the queue depth of an Azure Service Bus queue using Kubernetes Event-driven Autoscaling (KEDA).
- Minimize the administrative and operational overhead associated with managing cluster infrastructure and virtual machines.
- Separate log data into different geographical regions to comply with strict regional data residency regulations.

Which compute and monitoring configuration should you recommend?

Show answer & explanation

Answer: Azure Container Apps with regional environments, routing logs to regional Log Analytics workspaces

Answer

Azure Container Apps with regional environments, routing logs to regional Log Analytics workspaces
The correct option is the one proposing Azure Container Apps with regional environments and regional Log Analytics workspaces. Azure Container Apps is a serverless platform that supports KEDA-based event-driven scaling out of the box, fulfilling the scaling needs while minimizing cluster management overhead. Deploying regional environments and routing their logs to regional Log Analytics workspaces ensures compliance with data residency regulations by keeping logs within their respective geographic regions.

Step-by-Step Solution

1
Evaluate the compute options against the operational overhead and KEDA scaling requirements.
Azure Container Apps (ACA) and Azure Kubernetes Service (AKS) both support KEDA scaling natively. However, ACA is serverless and eliminates cluster management overhead, making it the preferred choice over AKS to minimize administrative effort.
The scenario requires minimizing administrative and operational overhead while scaling containers with KEDA.
2
Evaluate the compliance and logging architecture against data residency requirements.
Routing logs from regional environments to regional Log Analytics workspaces ensures that log data is kept within its respective geographical boundaries, meeting data residency compliance.
The scenario requires separating log data into different geographical regions.
3
Select the option that satisfies all criteria.
Azure Container Apps with regional environments combined with regional Log Analytics workspaces satisfies the KEDA, operational overhead, and regional compliance requirements.
This configuration balances serverless container hosting with compliant regional monitoring.

Key Concept

Selecting the appropriate container hosting platform in Azure based on management overhead, KEDA support, and designing compliant regional monitoring architectures.
Estimated Time:2m 0s
Question 449Question →

You are designing a backup and recovery solution for an Azure virtual machine that runs a critical middleware application. The virtual machine uses Premium SSD managed disks.

Your solution must satisfy the following technical requirements:
- Resilience: Backups must be recoverable even in the event of a complete disaster in the primary Azure region.
- Operational RTO: Any recovery of files or full virtual machines from backups created within the last 10 days must take less than 15 minutes.
- Retention: Backups must be kept for a total of 180 days to meet compliance regulations.
- Cost: Minimize overall storage and management costs.

Which backup vault type, storage redundancy, and policy configuration should you select to meet these requirements?

Show answer & explanation

Answer: A Recovery Services Vault configured with Geo-Redundant Storage (GRS), using an Enhanced backup policy with the instant restore retention set to 10 days and the vault retention set to 180 days.

Answer

A Recovery Services Vault configured with Geo-Redundant Storage (GRS), using an Enhanced backup policy with the instant restore retention set to 10 days and the vault retention set to 180 days.
The correct solution uses a Recovery Services Vault to back up the Azure Virtual Machine. The vault is configured with Geo-Redundant Storage (GRS) to satisfy the disaster recovery resilience requirement. Because the operational RTO requires recovering from local snapshots (instant restore) for up to 10 days, an Enhanced backup policy must be used since Standard backup policies limit instant restore retention to a maximum of 5 days. The remainder of the 180-day compliance retention is safely stored in the standard vault storage tier.

Step-by-Step Solution

1
Identify the vault type required for the workload.
Recovery Services Vault is selected because Backup Vaults do not support Azure Virtual Machine backup.
Azure Virtual Machines require a Recovery Services Vault for native backup agent integration and recovery operations.
2
Determine the required vault storage redundancy for the resilience requirement.
Geo-Redundant Storage (GRS) is selected.
GRS replicates backup data to a secondary region, satisfying the resilience requirement to survive a complete primary region disaster, whereas LRS keeps all data in a single datacenter.
3
Evaluate the backup policy tier based on the operational Recovery Time Objective (RTO).
Enhanced backup policy is selected.
To meet the 10-day instant restore requirement, an Enhanced backup policy is required since Standard backup policies only support a maximum of 5 days of instant restore (snapshot) retention. The rest of the 180 days of retention is cost-effectively stored in the vault storage tier.

Key Concept

Designing Azure Virtual Machine backups using Recovery Services Vaults and selecting Standard versus Enhanced backup policies to support snapshot-level retention requirements.
Question 450Question →

An enterprise is planning the deployment of an Azure landing zone. A team of fifteen external database consultants requires temporary administrative control over the resources in a production subscription to perform database schema updates. Security policy mandates that:

* Access must be granted on a temporary, just-in-time (JIT) basis.
* The administrative privilege must not exceed four hours per activation.
* All activation requests must be approved by an internal security lead.
* To maintain clean subscription-level access controls, privileges should not be assigned directly to individual consultant user accounts.

Which two configurations should you include in the privileged access and identity governance design? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the subscription Owner role settings in Microsoft Entra Privileged Identity Management (PIM) to require approval and set the maximum activation duration to four hours.; Assign eligibility for the subscription Owner role to a Microsoft Entra ID security group containing the external consultants' accounts.

Answer

To meet the requirements, configure the subscription Owner role settings in Privileged Identity Management to require approval and a maximum activation duration of four hours, and assign the eligibility for the Owner role to a Microsoft Entra ID security group containing the external consultants.
Configuring the role settings in Microsoft Entra Privileged Identity Management (PIM) ensures that the activation duration is capped at four hours and requires approval. Assigning this eligibility to a security group rather than individual users prevents administrative overhead and respects the organization's governance rules.

Step-by-Step Solution

1
Create a security group in Microsoft Entra ID and add the external consultants as members.
Consultant accounts are grouped together, allowing group-based assignment.
This avoids assigning roles directly to individual user accounts, meeting the governance requirements.
2
Configure the subscription Owner role settings in Privileged Identity Management (PIM) for Azure resources.
The role settings are modified to require approval and limit activation duration to four hours.
This enforces the required approval workflow and maximum duration constraints during activation.
3
Assign the Microsoft Entra ID security group as eligible for the Owner role in PIM for Azure resources.
Group members can now request activation of the Owner role when needed.
This implements the just-in-time (JIT) access model for the consultants.

Key Concept

Using group-based eligibility and role settings in Privileged Identity Management (PIM) to secure administrative access.
Question 451Question →

Contoso, Ltd. has an on-premises Active Directory Domain Services (AD DS) domain that synchronizes with a Microsoft Entra ID tenant. You are designing the identity security and hybrid authentication strategy for the organization. The design must meet the following requirements:
- Users must be able to authenticate to cloud applications even if the on-premises data center is offline.
- The security team must enforce multi-factor authentication (MFA) via Conditional Access policies for all users, but must ensure that administrators do not get locked out of the tenant in the event of a tenant-wide Entra ID MFA service outage.

Which two actions should you include in the design? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure Password Hash Synchronization (PHS) as the primary hybrid authentication method.; Create two dedicated emergency access accounts and exclude them from all Conditional Access policies.

Answer

Configure Password Hash Synchronization (PHS) as the primary hybrid authentication method, and create two dedicated emergency access accounts and exclude them from all Conditional Access policies.
Selecting Password Hash Synchronization (PHS) ensures cloud authentication continues even if the on-premises infrastructure is unavailable, satisfying the first requirement. Creating dedicated emergency access accounts and excluding them from all Conditional Access policies ensures that administrators can still sign in and manage the tenant during an MFA outage, preventing total lockout.

Step-by-Step Solution

1
Analyze the resiliency requirement for authentication when the on-premises data center is offline.
Identify that Password Hash Synchronization (PHS) allows Microsoft Entra ID to perform authentication directly in the cloud, removing any runtime dependency on on-premises AD DS.
This directly fulfills the requirement of enabling user authentication during on-premises outages.
2
Analyze the requirement to prevent administrator lockout during an Entra ID MFA service outage.
Identify that Microsoft Entra ID best practices dictate the creation of dedicated emergency access (break-glass) accounts that are excluded from all Conditional Access policies, including MFA.
This ensures that at least one administrative account can bypass Conditional Access blocks to access the tenant if the MFA service experiences an outage.

Key Concept

Designing a resilient hybrid identity authentication method (PHS) and a secure Conditional Access policy that avoids lockout via emergency access exclusions.
Estimated Time:1m 30s
Question 452Question →

A company is designing a high-availability storage solution in the Azure East US region. The solution will support a critical database application and has the following requirements:

1. The application's virtual machines run on Premium SSD managed disks. The disks must survive a zone failure within the primary region with zero data loss (RPO = 0).
2. The transaction logs are backed up to a standard General Purpose v2 storage account. These backups must survive a regional outage of the primary region.
3. The backup data must be readable in the secondary region at all times to allow a secondary reporting application to run audit reports without initiating a failover.

Which two storage configurations should you recommend to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Zone-redundant storage (ZRS) for the Premium SSD managed disks; Read-access geo-redundant storage (RA-GRS) for the backup storage account

Answer

The correct configurations are Zone-redundant storage (ZRS) for the Premium SSD managed disks and Read-access geo-redundant storage (RA-GRS) for the backup storage account.
To satisfy the first requirement, the Premium SSD managed disks must use Zone-redundant storage (ZRS) because it replicates data across three availability zones in the primary region, ensuring the application survives a zone failure with zero data loss. To satisfy the second and third requirements, the backup storage account must use Read-access geo-redundant storage (RA-GRS) because it replicates the data to a secondary region for disaster recovery and provides a read-only endpoint in the secondary region that is available at all times without initiating a failover.

Step-by-Step Solution

1
Analyze the virtual machine disk storage requirements.
The Premium SSD managed disks must survive a zone failure with zero data loss (RPO = 0). Locally-redundant storage (LRS) does not provide zone resilience, so Zone-redundant storage (ZRS) is required.
ZRS replicates managed disk data synchronously across three availability zones within the primary region.
2
Analyze the backup storage account requirements.
The backup storage account must survive a regional outage and allow read access in the secondary region at all times without failover.
Geo-zone-redundant storage (GZRS) and Geo-redundant storage (GRS) do not expose read access to the secondary region unless a failover is triggered. Adding the Read-Access option (RA-GRS or RA-GZRS) is necessary to allow the reporting application to read backups in the secondary region before failover.

Key Concept

Azure storage redundancy tiers and their capabilities regarding availability zone failure resilience, regional disaster recovery, and read access to secondary replica regions.
Estimated Time:2m 0s
Question 453Question →

An organization is designing a compute and monitoring solution for a new microservices-based application. The application will run in containers and must meet the following requirements:
- Support dynamic, event-driven scaling based on CPU utilization and Azure Service Bus queue depth.
- Minimize the administrative and operational overhead of the container infrastructure.
- Isolate log and telemetry data for two distinct departments (Finance and HR) into separate regulatory boundaries to satisfy strict data sovereignty requirements.

Which two configurations should you recommend in the design?

Select all that apply

Show answer & explanation

Answer: Azure Container Apps to host the microservices; Two distinct Azure Log Analytics workspaces, one for each department

Answer

The correct recommendations are to deploy Azure Container Apps to host the microservices and to create two distinct Azure Log Analytics workspaces (one for each department).
The design requires minimizing operational overhead while supporting event-driven scaling, which makes Azure Container Apps the ideal choice over Azure Kubernetes Service. Furthermore, because there is a strict requirement for regulatory boundaries and data sovereignty, deploying two separate Log Analytics workspaces is necessary to guarantee complete data segregation.

Step-by-Step Solution

1
Evaluate the container hosting requirements to minimize administrative effort and support event-driven scaling.
Identify Azure Container Apps as the optimal service because it offers a serverless container platform with built-in KEDA scaling, avoiding the infrastructure management overhead associated with Azure Kubernetes Service.
Azure Container Apps removes the need to manage Kubernetes APIs, control planes, or node pools while still supporting dynamic scaling from zero based on queue depth.
2
Evaluate the logging and compliance requirements for data sovereignty and isolation.
Identify that separate Azure Log Analytics workspaces are required for the Finance and HR departments.
A single workspace cannot guarantee the complete segregation of log data required by strict data sovereignty regulations, whereas separate workspaces provide distinct administrative and geographical boundaries.

Key Concept

Selecting serverless container services to reduce operational overhead while configuring separate monitoring workspaces to satisfy strict data sovereignty requirements.
Question 454Question →

An enterprise administrator needs to run a single containerized database maintenance script once per week. The container executes for approximately three minutes and then terminates. The solution must minimize deployment complexity and administrative overhead. Which Azure service should you recommend?

Show answer & explanation

Answer: Azure Container Instances

Answer

Azure Container Instances
The correct answer is Azure Container Instances because it provides a serverless platform to run isolated containers on demand with the lowest possible administrative effort. It does not require managing virtual machines, clustering, or application environments, and billing is based on the exact duration of the container's execution.

Step-by-Step Solution

1
Identify the workload requirements
The workload is a single, isolated container task that runs briefly on a weekly schedule.
Understanding the lifecycle and complexity of the container task determines the ideal hosting model.
2
Evaluate administrative overhead
Azure Container Instances requires zero cluster management, no environment creation, and minimal configuration compared to AKS or Container Apps.
The requirement specifies minimizing deployment complexity and administrative overhead.
3
Select the most cost-effective and simplest service
Azure Container Instances charges only for the exact CPU and memory resources consumed during the three-minute execution, with no idle costs.
ACI matches the requirement for transient workloads that do not need orchestration or continuous scaling.

Key Concept

Selecting the appropriate Azure container hosting service based on simplicity, scale, and administrative overhead.
Estimated Time:45s
Question 455Question →

An organization is establishing a new governance model for their Azure environment. They need to delegate administrative permissions for managing virtual networks to a network operations team while adhering to the principle of least privilege. You need to configure a custom RBAC role and a new Management Group structure. Arrange the steps in the correct order to configure and delegate these permissions, starting with establishing the scope boundary and ending with granting user access.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps is: 1) Create the new Management Group hierarchy, 2) Draft a custom role definition JSON file with the AssignableScopes set to the new Management Group ID, 3) Register the custom RBAC role, 4) Create a Microsoft Entra ID security group, and 5) Create a role assignment mapping the custom RBAC role to the security group at the Management Group scope.
The correct sequence begins by creating the target Management Group hierarchy to establish the scope boundary. This allows the Management Group's resource ID to be included in the AssignableScopes property of the custom role definition. Once drafted, the custom role is registered in Azure. Subsequently, a Microsoft Entra ID security group is created to house the users, adhering to identity management best practices. Finally, the custom role is assigned to the security group at the Management Group scope to delegate the permissions.

Step-by-Step Solution

1
Define the organizational scope boundary.
Management Group hierarchy is created.
The custom role definition requires an existing scope ID for its AssignableScopes property.
2
Define the permissions and scope limits.
Custom role definition JSON is drafted.
Permissions and scopes must be defined in a JSON template before registration.
3
Create the custom role in the tenant.
Custom RBAC role is created in the Azure tenant.
The role must be registered in Azure before it can be assigned to security principals.
4
Define the security principal group.
Microsoft Entra ID security group with members is created.
Assigning roles to groups rather than individual users is an Azure best practice for access management.
5
Assign the custom role to the security principal group.
Role assignment is applied at the Management Group scope.
This links the security principal, the role, and the scope to grant the permissions.

Key Concept

Configuring custom Azure RBAC roles within a Management Group hierarchy
Question 456Question →

You are designing the data storage solution for a global micro-mobility fleet management system that tracks 150,000150,000 active electric scooters. The scooters report status updates, including battery level and GPS coordinates, every 1010 seconds. The read-to-write ratio is 1:101:10 (write-heavy). The system must support multi-region write replication across East US, West Europe, and Southeast Asia to guarantee write latency below 10 ms10\text{ ms} globally. The solution must survive a complete regional outage without data loss or downtime. Which design configuration meets these requirements while preventing hot partitions and ensuring regional disaster resilience?

Show answer & explanation

Answer: Configure Azure Cosmos DB with multi-region writes enabled across East US, West Europe, and Southeast Asia, and set the partition key to the unique scooter identifier.

Answer

Configure Azure Cosmos DB with multi-region writes enabled across the target regions, using the unique scooter identifier as the partition key.
Configuring Azure Cosmos DB with multi-region writes enables active-active writes in East US, West Europe, and Southeast Asia, allowing the write-heavy client applications to achieve sub-10ms latency. The unique scooter identifier acts as a high-cardinality partition key, ensuring that writes and storage are uniformly distributed across logical partitions to prevent hot partitioning. In the event of a regional outage, Cosmos DB automatically routes traffic to other configured write regions, maintaining continuous availability.

Step-by-Step Solution

1
Analyze write performance and replication requirements.
Identify that a multi-region write configuration in Azure Cosmos DB is needed to support write-heavy telemetry updates across East US, West Europe, and Southeast Asia with sub-10ms latency.
Multi-region write capability allows write operations to be processed locally in each region, minimizing WAN latency.
2
Determine the partition key strategy to prevent hot partitioning.
Select the unique scooter identifier (high cardinality) instead of status (low cardinality).
High-cardinality keys distribute the write volume and storage evenly across physical partitions, preventing hot spots and rate-limiting.
3
Evaluate disaster recovery requirements.
Ensure regional failover mechanisms are in place via multi-region replication rather than relying on a single region or backups.
Cosmos DB automatically replicates data across all configured regions, allowing for zero-data-loss failover in the event of a regional disaster.

Key Concept

Partition key design, global replication, and high availability in Azure Cosmos DB.
Estimated Time:1m 30s
Question 457Question →

A company named OrbitCargo Systems is designing a disaster recovery strategy for its critical flight cargo tracking application. The application stores transaction logs in an Azure Block Blob storage account that is currently configured with Read-Access Geo-Redundant Storage (RA-GRS). The primary region is East US, and the secondary region is West US.

During a simulated primary region outage in East US, the operations team needs to ensure that the tracking application can continue to read existing logs and write new transaction logs with minimal downtime. The solution must ensure that once the primary region becomes healthy again, data redundancy is maintained.

Which two actions should you include in the design to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Initiate a customer-managed storage account failover to promote the secondary region to the new primary region.; Reconfigure the storage account to geo-redundant storage after the failover is complete to re-establish replication.

Answer

Initiating a customer-managed failover of the storage account and reconfiguring it to geo-redundant storage after the failover is complete.
Initiating a customer-managed failover changes the secondary endpoint to the primary endpoint, making it writeable. Once failover is complete, the storage account replication automatically reverts to locally redundant storage (LRS), meaning that re-establishing geo-redundancy (GRS or RA-GRS) is necessary to ensure disaster recovery capabilities are maintained.

Step-by-Step Solution

1
Evaluate write requirements during primary region outages.
Identify that the secondary endpoint of an RA-GRS account is read-only and cannot accept write operations directly.
To resolve this, a failover must be initiated to promote the secondary region to the primary writeable region.
2
Assess storage account state post-failover.
Note that Azure automatically changes the storage replication to LRS after a customer-managed failover.
Re-enabling GRS or RA-GRS is necessary to restore regional redundancy.

Key Concept

Azure Storage Account Failover Mechanics and Write Restrictions on Secondary Endpoints
Estimated Time:2m 0s
Question 458Question →

A financial services startup is preparing for an annual regulatory audit of its Azure production environment. A third-party compliance team consisting of five auditors needs temporary access to view configuration settings across all resources in a subscription. You must design an identity governance solution that allows the auditors to self-service their access only when needed, enforces multi-factor authentication (MFA) upon activation, and minimizes administrative overhead. Which of the following solutions should you recommend?

Show answer & explanation

Answer: Create a Microsoft Entra ID security group for the compliance team, and configure an eligible assignment for this group to the Reader role on the subscription using Privileged Identity Management (PIM) for Azure resources, requiring MFA on activation.

Answer

Create a Microsoft Entra ID security group for the compliance team, and configure an eligible assignment for this group to the Reader role on the subscription using Privileged Identity Management (PIM) for Azure resources, requiring MFA on activation.
The correct solution uses Microsoft Entra ID security groups combined with Privileged Identity Management (PIM) for Azure resources. Assigning role eligibility to a security group reduces administrative overhead compared to individual user assignments. Configuring the role as eligible ensures just-in-time (JIT) access, while PIM role settings enforce MFA when users activate the role.

Step-by-Step Solution

1
Group creation
A Microsoft Entra ID security group is created for the compliance team.
Grouping users minimizes administrative overhead compared to managing assignments individually.
2
PIM assignment
An eligible assignment is configured for the security group to the Reader role at the subscription level.
This implements just-in-time (JIT) access governance, allowing the group to activate the role only during audit windows.
3
Activation settings configuration
MFA is enabled under the PIM role settings for the Reader role activation.
This guarantees that users must perform multi-factor authentication whenever they request to activate their privileged access.

Key Concept

Privileged Identity Management (PIM) eligible assignments and security group scoping
Question 459Question →

An enterprise is designing a global traffic routing and failover strategy for workloads deployed in the East US and West Europe regions. The solution must support two distinct workloads:

1. A public-facing web application that requires Secure Sockets Layer (SSL) termination at the edge, URL path-based routing (mapping `/static/*` to Azure Storage and `/api/*` to regional application gateways), Web Application Firewall (WAF) integration, and a failover recovery time objective (RTO) of less than 30 seconds.
2. A database replication synchronization daemon that communicates using a custom TCP protocol over port 5432.

Which routing and failover architecture should you recommend to meet these requirements?

Show answer & explanation

Answer: Deploy Azure Front Door to route and load balance the web application using its Anycast-based routing and custom HTTP probes to achieve sub-30-second failover, and deploy Azure Traffic Manager to route the database synchronization daemon traffic over port 5432 using a nested performance routing method.

Answer

Deploy Azure Front Door to route and load balance the web application using its Anycast-based routing and custom HTTP probes to achieve sub-30-second failover, and deploy Azure Traffic Manager to route the database synchronization daemon traffic over port 5432 using a nested performance routing method.
The correct solution uses Azure Front Door for the web application and Azure Traffic Manager for the database synchronization daemon. Azure Front Door is an Anycast-based Layer 7 load balancer that supports SSL termination, path-based routing, and WAF integration. Because it routes traffic at the edge using Split TCP, failover is detected and executed almost instantly (within seconds) via health probes, meeting the sub-30-second RTO without relying on client-side DNS updates. Azure Traffic Manager is a DNS-based routing service that can route any TCP/UDP protocol (including database traffic on port 5432) because it only resolves the DNS query to the appropriate regional endpoint IP address.

Step-by-Step Solution

1
Analyze the protocol and layer requirements of each workload.
The web application requires Layer 7 capabilities (SSL termination, URL path-based routing, WAF), while the synchronization daemon requires Layer 4 custom TCP routing (port 5432).
Identifying the required OSI layers determines which Azure load balancing services are compatible.
2
Evaluate the global failover RTO constraint for the web application.
DNS-based failover is ruled out for the web application because client-side and resolver caching will exceed the 30-second RTO. Anycast-based routing (Front Door) must be used to achieve sub-30-second failover convergence.
Anycast routes traffic directly to the nearest edge location, allowing the edge proxy to dynamically redirect requests to the alternative healthy region immediately when a probe fails.
3
Evaluate the routing capability for the custom TCP synchronization daemon.
Front Door cannot route non-HTTP/HTTPS traffic. A Layer 4 or DNS-based routing solution is required. Azure Traffic Manager is suitable because it returns the IP address of the healthy region's synchronization daemon endpoint via DNS, allowing direct custom TCP communication.
Traffic Manager operates at the DNS layer and is protocol-agnostic, whereas Front Door only supports HTTP, HTTPS, and HTTP/2.
4
Combine the services into a unified architecture.
Deploy Azure Front Door for the web application and Azure Traffic Manager for the TCP synchronization daemon.
This hybrid approach leverages the specific Layer 7 benefits of Front Door for the web application and the protocol-agnostic nature of Traffic Manager for the custom TCP workload.

Key Concept

Selecting and combining Azure global routing services based on OSI layers and failover requirements.
Estimated Time:3m 0s
Question 460Question →

You are designing a backup solution for a critical production workload hosted on an Azure Virtual Machine. The virtual machine has the following configuration:

* Operating System: Windows Server 2025
* Disks: Multiple Premium SSD v2 managed disks
* Location: East US region

The backup solution must meet the following requirements:

* Backups must run daily.
* All backup data must be stored in a Recovery Services vault configured with Zone-Redundant Storage (ZRS).
* To meet a strict Recovery Time Objective (RTO) for operational recoveries, administrators must be able to perform instant file-level restores from local snapshots for any backup taken within the last 7 days.
* Backups must be retained in the vault for a minimum of 365 days.

You need to design the Azure Backup policy.

Which backup policy configuration should you recommend?

Show answer & explanation

Answer: An Enhanced backup policy with the instant restore retention set to 7 days

Answer

The correct configuration is an Enhanced backup policy with the instant restore retention set to 7 days, as it supports Premium SSD v2 managed disks and allows instant restore snapshots to be kept for up to 30 days.
An Enhanced backup policy is required because the virtual machine is configured with Premium SSD v2 managed disks, which are not supported by Standard backup policies. Additionally, Standard backup policies only support a maximum of 5 days of instant restore (snapshot) retention, whereas the requirement is 7 days. The Enhanced backup policy supports configuring the instant restore retention window for up to 30 days, satisfying the operational recovery requirements.

Step-by-Step Solution

1
Analyze the virtual machine disk configuration.
Identify that the virtual machine uses Premium SSD v2 managed disks.
Premium SSD v2 and Ultra Disks require the use of the Enhanced backup policy tier in Azure Backup.
2
Evaluate the operational restore RTO requirements.
Identify the need to support instant file-level restores from local snapshots for up to 7 days.
The instant restore retention window must be configured to at least 7 days. Standard backup policies only support a maximum of 5 days, while Enhanced policies support up to 30 days.
3
Select the policy type and configure the snapshot retention parameters.
Combine the requirements to select an Enhanced backup policy with the instant restore retention set to 7 days.
This configuration satisfies both the Premium SSD v2 disk support and the 7-day instant recovery timeline.

Key Concept

Design Azure Backup Solutions
Estimated Time:1m 30s
PreviousPage 23 / 60Next
All practice questions — Microsoft Azure Solutions Architect (AZ-305) | Examkin