All practice questions

An enterprise is onboarding an external vendor to perform temporary maintenance on Azure Virtual Machines located in a production resource group. The maintenance window is 30 days. The design must enforce the principle of least privilege, require multi-factor authentication (MFA) and manager approval before accessing the resources, and automatically clean up access after the maintenance period. Which two configurations should you include in the identity governance and privileged access design?

Zenith Financial Services is designing an identity security strategy using Microsoft Entra ID. The design must meet specific access control requirements for various user roles and device states.

Match each business security requirement to the correct Microsoft Entra ID Conditional Access or authentication control.

An organization is designing the storage architecture for two Azure General Purpose v2 storage accounts with different business requirements:

* StorageAccount1: Stores machine learning models. The storage must survive a zone failure within the primary region and replicate to a secondary paired region to protect against a regional outage. Read access to the secondary region is not required.
* StorageAccount2: Stores static media assets. The storage must survive a zone failure within the primary region, replicate to a secondary region, and allow the application to read the media assets from the secondary region at any time without triggering a storage failover.

Which two redundancy options should you recommend to meet these requirements?

A healthcare provider plans to migrate a legacy patient records system to Azure. The system must run on dedicated physical servers that host only this provider's workloads to comply with strict regulatory isolation requirements. The workload is critical and cannot tolerate eviction or interruption. Which Azure compute virtualization solution should you recommend?

You are designing a routing solution for an Azure environment to meet corporate security compliance. The environment contains a virtual network named `vnet-prod-spoke` with an address space of $10.10.0.0/16$.

To ensure security inspection, all outbound traffic destined for the internet must be redirected to an on-premises VPN gateway, while virtual machines within `vnet-prod-spoke` must be able to communicate directly with one another.

You create a custom route table and associate it with the subnets in `vnet-prod-spoke`.

Which route configuration should you add to the route table to meet these requirements?

A financial services company is designing the storage infrastructure for a transaction auditing application in Azure. The application writes transaction logs to a standard General Purpose v2 (GPv2) storage account. The design must satisfy the following resilience requirements:

- Data must remain highly available even if an entire datacenter within the primary Azure region suffers a catastrophic power or cooling failure.
- In the event of a complete regional outage affecting the primary Azure region, the data must be recoverable from a secondary paired region.

Which two redundancy options should you recommend to meet these requirements?

A logistics company is designing a hosting solution for a new containerized web API. The API is packaged as a single Docker container. The workload must support scaling down to zero instances when idle to minimize costs, and the solution must require the lowest administrative overhead. Which service should you recommend?

An enterprise is designing a container-based ingestion and processing solution for healthcare telemetry data. The telemetry is ingested in two distinct geographical regions: East US and West US. The design must accommodate the following requirements:

- Workload 1: A lightweight microservice that processes telemetry messages from an Azure Service Bus queue. The workload must support event-driven scaling using KEDA, including scaling to zero instances when no messages are present, while minimizing infrastructure management overhead.
- Workload 2: A batch processing job that runs model training algorithms. The job requires custom access to the underlying Kubernetes API to orchestrate child pods across dedicated, physically isolated compute nodes.
- Logging: Container logs from the East US and West US regions must be kept strictly segregated within their respective geographical boundaries to comply with local healthcare privacy and data residency laws.

Which three design decisions should you recommend?

You are designing a backup solution for an Azure Virtual Machine hosting a critical line-of-business (LOB) application. The virtual machine is configured with Premium SSD v2 managed disks.

The backup solution must satisfy the following requirements:
- Recoveries from any backup created within the last $45$ days must achieve a recovery time objective (RTO) of under $5$ minutes by restoring directly from local snapshots.
- Backup data must be replicated to a secondary region to protect against regional outages.
- Daily backups must be retained for $90$ days, and monthly backups must be retained for $1$ year.
- The solution must minimize cost while meeting the technical capabilities of the storage and backup services.

Which backup configuration should you recommend to meet these requirements?

An online gaming company is architecting a storage backend for a global multiplayer game. The system must store real-time player matchmaking states in Azure Cosmos DB for NoSQL and deliver daily activity reports to customers via Azure Blob Storage.

The architecture must meet the following requirements:
- The Cosmos DB container must support a workload of 80% writes and 20% reads, achieving a 99.999% write availability SLA.
- The partition key for the matchmaking container must prevent hot partitions during peak tournament times when specific matchmaking pools experience massive spikes in active updates.
- Database backups must survive a regional disaster.
- Access to the daily activity reports in Blob Storage must be granted to client applications using Shared Access Signature (SAS) tokens that can be easily revoked in case of compromise without disrupting other services.

Which configuration should you recommend?

A retail corporation is designing an analytical data platform on Azure to analyze sales transactions. The solution must meet the following requirements:
- Ingest $100\text{ GB}$ of CSV and Parquet files daily into Azure Data Lake Storage Gen2 (ADLS Gen2), with a total historical volume of $50\text{ TB}$.
- Enable data analysts to perform ad-hoc exploratory queries directly on the data lake files without provisioning or managing pre-allocated compute resources.
- Protect the data against both localized zone failures and regional disasters.
- Provide external auditors with read-only access to a specific folder in the data lake for $30$ days, with the ability to immediately revoke access if necessary.

Which two options should you include in the recommendation to meet these requirements?

A global manufacturing company is designing an identity governance and access solution for its IT operations team. The team needs to occasionally perform security administrator tasks in Microsoft Entra ID. The solution must ensure that administrative permissions are not active by default, require multi-factor authentication (MFA) and a business justification to activate, and follow administrative best practices for scalability. Additionally, the company wants to ensure that their disaster recovery planning includes preventing tenant lockout for their break-glass accounts. Which of the following designs should you recommend to meet these requirements?

A digital health platform is designing a containerized microservice-based architecture to process patient data in two regions: North Europe (Ireland) and West Europe (Netherlands). The platform has the following requirements:
- The microservices must scale dynamically from zero based on HTTP traffic and message queue depth.
- You must minimize the administrative effort required to manage container orchestration, patching, and OS maintenance.
- For compliance and data sovereignty reasons, application log data from the Irish region must be strictly segregated at the data-plane level and stored within Ireland, while Netherlands log data must remain within the Netherlands.

Which two configurations should you recommend to meet the requirements? (Select two.)

A company is designing a high availability (HA) and disaster recovery (DR) solution for an on-premises relational database that is being migrated to Azure. The database workload has the following characteristics:
- It requires SQL Server Agent jobs for nightly data maintenance.
- It relies on cross-database queries between three distinct databases.

The DR design must satisfy the following requirements:
- In the event of a regional outage, failover to the secondary region must occur automatically with minimal data loss.
- The application connection strings must remain unchanged after a failover.
- Read-heavy analytics queries must be offloaded to the secondary region to avoid impacting transaction processing.

Which two configurations should you include in the design to meet the requirements? (Select two.)

An enterprise is designing a container-based application on Azure. The application consists of two workloads:

* Workload 1: An API gateway that requires custom Kubernetes Custom Resource Definitions (CRDs) and direct access to the Kubernetes control plane API.
* Workload 2: A queue processing service that scales dynamically based on the count of active messages in an Azure Service Bus queue.

The solution must minimize administrative overhead for Workload 2.

Which two services should you recommend? (Select two.)

A healthcare provider is designing an analytical data platform to analyze telemetry from patient monitoring devices. The platform must meet the following requirements:
- Ingest telemetry data at a rate of $15{}000$ events per second.
- Store raw events in Azure Data Lake Storage (ADLS) Gen2 in JSON format, with an expected annual volume of $100\text{ TB}$.
- Enable analysts to perform ad-hoc, exploratory queries on the raw JSON data with a latency of less than $10\text{ seconds}$.
- Provide regional disaster resilience for the stored data.
- Minimize administrative overhead and run-time costs.
Which two configurations should you include in the design? (Select two.)

A company plans to deploy a new public-facing web application on Azure Virtual Machines. The application will run steady-state, predictable workloads 24/7 and requires a guaranteed availability SLA of 99.99%. Which two virtual machine configurations or options should you select to meet these requirements while optimizing costs? (Select two.)

A LegalTech company is designing a document indexing and analysis solution on Azure. The architecture must satisfy the following requirements:
- Process uploaded PDF agreements using a custom containerized parser that dynamically scales from zero based on the number of messages in an Azure Storage queue.
- Provide a containerized HTTP API front-end to receive document upload metadata.
- Run all containers on a platform that minimizes operational and infrastructure management overhead.
- Support event-driven autoscaling using KEDA natively without managing virtual machine nodes or Kubernetes control planes.
- Ensure all components are deployed securely with private IP addresses within an Azure Virtual Network.

Which compute solution should you recommend for hosting the containerized parser?

NovaHealth Solutions is designing a disaster recovery strategy for its clinical intake application. The application writes transactional check-in records to an Azure Storage account. You need to recommend a storage replication and recovery strategy that meets the following requirements:

* During a primary region outage, existing records must be readable within 15 minutes.
* During a primary region outage, write capabilities for new records must be restored within 1 hour.
* Data loss (RPO) for both reads and writes must be less than 15 minutes.
* Costs must be minimized.

Which storage configuration and disaster recovery strategy should you recommend?

An enterprise designs a hub-and-spoke virtual network topology in Azure to connect cloud workloads with their on-premises datacenter. The hub virtual network, `vnet-hub-core` ($10.100.0.0/16$), contains an Azure Firewall deployed at $10.100.4.4$ and an ExpressRoute virtual network gateway. The spoke virtual network, `vnet-spoke-prod` ($10.110.0.0/16$), contains a subnet named `snet-app` ($10.110.1.0/24$). Virtual network peering is established between `vnet-hub-core` and `vnet-spoke-prod` with gateway transit enabled. The ExpressRoute gateway dynamically learns the on-premises database subnet prefix $172.20.100.0/24$ and the summary prefix $172.16.0.0/12$ via BGP. A custom Route Table is associated with `snet-app` and has gateway route propagation enabled. To ensure all traffic to the on-premises environment is inspected by the firewall, a User-Defined Route (UDR) is added with a destination prefix of $172.16.0.0/12$ and next hop address of $10.100.4.4$. During auditing, network administrators discover that traffic destined for the database servers at $172.20.100.50$ bypasses the Azure Firewall and is sent directly to the ExpressRoute gateway. Which of the following explains this behavior?