All practice questions

1198 questions

All types1,198 Multiple choice617 Multiple select502 Matching65 Ordering14

An enterprise is designing virtual network routing for a spoke virtual network named `vnet-prod-spoke` (address space: $10.200.0.0/16$ ). The spoke VNet contains two subnets: `snet-app` ( $10.200.1.0/24$ ) and `snet-db` ( $10.200.2.0/24$ ). The spoke VNet is peered with a hub virtual network named `vnet-hub-weur` (address space: $10.100.0.0/16$ ), which hosts a Network Virtual Appliance (NVA) firewall at IP address $10.100.1.4$ .

You configure a route table named `rt-app` and associate it with the `snet-app` subnet to meet the following requirements:
- Requirement 1: All traffic to the on-premises network ( $172.16.0.0/12$ ) must be routed through the NVA firewall.
- Requirement 2: Traffic to other subnets within `vnet-prod-spoke` must route directly (not through the NVA) to minimize latency.
- Requirement 3: Traffic to the hub virtual network ( $10.100.0.0/16$ ) must be routed through the NVA firewall.

To implement this, you add the following user-defined routes to `rt-app`:
- `Route_Hub`: Prefix $10.100.0.0/16$ , Next hop: Virtual appliance ( $10.100.1.4$ )
- `Route_OnPrem`: Prefix $172.16.0.0/12$ , Next hop: Virtual appliance ( $10.100.1.4$ )
- `Route_Local`: Prefix $10.200.0.0/16$ , Next hop: Virtual appliance ( $10.100.1.4$ )

Which of the following statements correctly describe the impact of this configuration and the required action to satisfy the requirements? (Select TWO.)

Select all that apply

Traffic destined for snet-db is incorrectly routed to the NVA firewall because Route_Local matches the local virtual network prefix exactly, and User Defined Routes take precedence over default system routes with the same prefix.

Deleting Route_Local from the route table resolves the local communication failure, allowing the default system route for the virtual network to direct traffic directly between the subnets.

Traffic destined for snet-db is routed directly because Azure system routes for local virtual network traffic always take precedence over user-defined routes regardless of prefix matching.

To resolve the local communication failure while keeping Route_Local, you must configure virtual network peering to use remote gateways.

Show answer & explanation

Answer: Traffic destined for snet-db is incorrectly routed to the NVA firewall because Route_Local matches the local virtual network prefix exactly, and User Defined Routes take precedence over default system routes with the same prefix.; Deleting Route_Local from the route table resolves the local communication failure, allowing the default system route for the virtual network to direct traffic directly between the subnets.

Answer

Traffic destined for the database subnet is sent to the NVA firewall because the user-defined route has the same prefix as the default local route and overrides it. To resolve the issue, the user-defined route matching the local VNet prefix must be deleted.

The user-defined route matching the local virtual network address space exactly (

10.200.0.0/16

) overrides the default local system route because UDRs have higher precedence than system routes for identical prefixes. Removing this route resolves the issue, as the default system route will then correctly direct local subnet-to-subnet traffic directly.

Step-by-Step Solution

Identify the default system routes generated for the subnet.

A default local system route for

10.200.0.0/16

is created to route traffic within the virtual network directly.

To understand the baseline routing behavior before UDRs are applied.

Compare the user-defined Route_Local (

10.200.0.0/16

-> NVA) with the default local system route.

Both routes have the identical prefix

10.200.0.0/16

. In Azure, UDRs take precedence over system routes when prefixes match exactly.

To determine how Azure resolves conflicting routes of the same prefix length.

Determine the corrective action to meet the requirement of direct routing.

Deleting Route_Local allows the default local system route to handle local VNet traffic directly, while Route_Hub and Route_OnPrem continue to handle hub and on-premises traffic via the NVA.

To restore direct routing for local subnets without impacting other UDRs.

Key Concept

User-Defined Route precedence over default virtual network system routes of the same prefix length

Estimated Time:2m 0s

Question 542Question →

An enterprise is designing a subscription governance and access strategy for its multi-region Azure environment. The environment uses a management group hierarchy to segregate production and development workloads.

The design must satisfy the following requirements:
- A central security team must be able to view all resource configurations, including Network Security Groups (NSGs), across all subscriptions under the production management group.
- The members of the security team must only have read access when performing active audit tasks, and their access must be granted temporarily on-demand.
- New resource groups created in the production subscriptions must automatically be configured with a delete resource lock, without blocking the resource group creation process itself.

Which of the following configurations should you recommend in the governance design?

Configure an eligible role assignment for each individual security team member to the Reader role at the production management group level using Privileged Identity Management (PIM). Deploy an Azure Policy with the DeployIfNotExists effect at the production management group level to apply the delete resource locks.

Create a Microsoft Entra ID security group containing the security team members. Configure an eligible role assignment for the group to the Reader role at the production management group level using Privileged Identity Management (PIM). Deploy an Azure Policy with the DeployIfNotExists effect at the production management group level to apply the delete resource locks.

Create a Microsoft Entra ID security group containing the security team members. Configure a permanently active role assignment for the group to the Reader role at the production management group level. Deploy an Azure Policy with the DeployIfNotExists effect at the production management group level to apply the delete resource locks.

Create a Microsoft Entra ID security group containing the security team members. Configure an eligible role assignment for the group to the Reader role at the production management group level using Privileged Identity Management (PIM). Deploy an Azure Policy with the Deny effect at the production management group level to block the creation of resource groups that do not have the delete resource lock.

Show answer & explanation

Answer: Create a Microsoft Entra ID security group containing the security team members. Configure an eligible role assignment for the group to the Reader role at the production management group level using Privileged Identity Management (PIM). Deploy an Azure Policy with the DeployIfNotExists effect at the production management group level to apply the delete resource locks.

Answer

The correct configuration uses a Microsoft Entra ID security group to simplify role administration, rather than assigning permissions to individual users. To enforce the principle of least privilege and satisfy the requirement for temporary access during audits, the group is configured with an eligible Reader role assignment at the management group scope using Privileged Identity Management (PIM). To automatically apply delete resource locks without interrupting resource group deployments, an Azure Policy with the DeployIfNotExists effect is deployed, which remediates non-compliant resource groups post-deployment.

Step-by-Step Solution

Define the identity mapping strategy for the security team members.

Group all security team members into a Microsoft Entra ID security group.

Assigning roles to groups instead of individual users ensures administrative scalability and aligns with Azure identity best practices.

Configure the RBAC role assignment and scope.

Assign the group an eligible role assignment to the Reader role at the production management group level using Privileged Identity Management (PIM).

Reader permission provides read-only visibility into NSGs and other resources. Assigning it at the management group level ensures inheritance to all child subscriptions. The eligible assignment satisfies the requirement for temporary on-demand access.

Design the automated lock deployment mechanism.

Deploy an Azure Policy at the production management group level with a DeployIfNotExists effect targeting resource groups without a delete lock.

The DeployIfNotExists effect automatically creates the delete resource lock after the resource group is created, satisfying the requirement to enforce locks without blocking the initial deployment.

Key Concept

Designing subscription governance using Azure Policy, PIM, and RBAC groups.

Question 543Question →

A healthcare provider is designing a high-performance storage solution for medical imaging applications. The solution requires using Azure Premium Files (NFS) to store image files that demand low, sub-millisecond latencies. The storage configuration must remain available and survive the failure of a single physical datacenter (Availability Zone) within the primary Azure region. Which redundancy configuration should you recommend?

Zone-redundant storage (ZRS)

Locally-redundant storage (LRS)

Geo-redundant storage (GRS)

Geo-zone-redundant storage (GZRS)

Show answer & explanation

Answer: Zone-redundant storage (ZRS)

Answer

Zone-redundant storage (ZRS)

Zone-redundant storage (ZRS) synchronously replicates data across three Azure availability zones in the primary region, ensuring the storage remains available during a datacenter outage. Because Azure Premium Files only supports LRS and ZRS configurations, ZRS is the only option that meets the high availability requirement.

Step-by-Step Solution

Identify the storage tier and protocol requirements.

The application requires Azure Premium Files (NFS) to satisfy the sub-millisecond latency requirement.

This isolates the redundancy options to those supported by the Premium Files tier.

Determine the supported redundancy options for the Premium Files tier.

Premium Files only supports Locally-redundant storage (LRS) and Zone-redundant storage (ZRS).

Geo-redundant options (GRS and GZRS) are unsupported on the Premium Files tier.

Select the option that meets the high availability constraint.

Zone-redundant storage (ZRS) replicates data synchronously across three availability zones, surviving a single datacenter failure.

Locally-redundant storage (LRS) replicates data only within a single datacenter and cannot survive a zone outage.

Key Concept

Azure Storage redundancy options and constraints across different performance tiers

Question 544Question →

AeroSpace Tech Partners is designing a hybrid identity solution that integrates their on-premises Active Directory Domain Services (AD DS) with Microsoft Entra ID. The design must satisfy the following requirements:
- On-premises users must authenticate to cloud resources using their existing credentials.
- Cloud authentication must remain functional even if the on-premises datacenter experiences a complete network and power outage.
- The deployment of additional on-premises servers or agents for authentication must be avoided.
- All users must be prompted for multi-factor authentication (MFA) when accessing cloud applications.
- The organization must prevent administrative lockout in the event of an MFA service outage or misconfiguration.

Which identity authentication and Conditional Access design should you recommend?

Implement Pass-through Authentication (PTA) as the authentication method, and configure a Conditional Access policy that requires MFA for all users except for a dedicated emergency access account that is excluded from the policy.

Implement Password Hash Synchronization (PHS) as the authentication method, and configure a Conditional Access policy that requires MFA for all users, ensuring that no accounts are excluded to maintain maximum security and zero-trust alignment.

Implement Password Hash Synchronization (PHS) as the authentication method, and configure a Conditional Access policy that requires MFA for all users except for a dedicated emergency access account that is excluded from the policy.

Implement Password Hash Synchronization (PHS) as the authentication method. Configure a Conditional Access policy requiring MFA, and assign the emergency access account to a permanently active Global Administrator role using Privileged Identity Management (PIM).

Show answer & explanation

Answer: Implement Password Hash Synchronization (PHS) as the authentication method, and configure a Conditional Access policy that requires MFA for all users except for a dedicated emergency access account that is excluded from the policy.

Answer

The correct answer proposes Password Hash Synchronization (PHS) which satisfies the requirement to authenticate users in the cloud even if the on-premises network or datacenter experiences an outage, without deploying additional servers. It also correctly recommends excluding a dedicated emergency access account from the multi-factor authentication (MFA) Conditional Access policy, which is the standard Microsoft architecture guidance to prevent tenant lockout during MFA service failures.

Step-by-Step Solution

Determine the appropriate hybrid authentication method based on availability and infrastructure constraints.

Select Password Hash Synchronization (PHS) as the authentication method.

Unlike Pass-through Authentication (PTA) or federation, PHS processes authentication requests entirely in the cloud using synchronization, meaning cloud authentication remains fully functional if the on-premises datacenter experiences an outage. It also requires no additional on-premises agents or servers for authentication flow.

Identify the resilience best practices for administrator accounts in Microsoft Entra ID.

Determine that a dedicated emergency access ('break-glass') account must be created and excluded from Conditional Access MFA policies.

If a service failure affects multi-factor authentication (MFA), having an active, excluded administrator account prevents complete administrative lockout.

Combine the authentication mechanism and policy configuration into a unified architecture design.

Design the system to use PHS, and enforce MFA via Conditional Access with an exclusion for the emergency access account.

This configuration satisfies all availability, management overhead, and tenant safety requirements.

Key Concept

Designing hybrid identity authentication and resilient Conditional Access policies including emergency access exclusions.

Question 545Question →

A biotechnology firm is designing a secure identity governance strategy for its clinical trial data analysts who require temporary write access to multiple Azure Data Lake Storage Gen2 accounts. The access must be time-bound to a maximum of 4 hours per session, require multi-factor authentication (MFA) upon activation, be easily reviewed on a quarterly basis, and avoid individual role assignments to minimize administrative overhead. Which two of the following configuration options should you include in the design to meet these requirements?

Select all that apply

Create a role-assignable Microsoft Entra security group, assign the Storage Blob Data Contributor role to the group for the storage accounts, and configure the analysts as eligible members of the group in PIM for Groups.

Configure a Microsoft Entra access review targeted at the security group's membership and schedule it to recur quarterly.

Assign the Storage Blob Data Contributor role directly to each data analyst's user account, configuring the PIM assignments as permanently active.

Exclude the research analyst group from Multi-Factor Authentication requirements in Conditional Access to simplify the elevation process.

Show answer & explanation

Answer: Create a role-assignable Microsoft Entra security group, assign the Storage Blob Data Contributor role to the group for the storage accounts, and configure the analysts as eligible members of the group in PIM for Groups.; Configure a Microsoft Entra access review targeted at the security group's membership and schedule it to recur quarterly.

Answer

The correct configurations are to create a role-assignable Microsoft Entra security group with the required role and PIM for Groups eligibility, and to configure a quarterly access review on the group's membership.

To meet the requirements, you should create a role-assignable security group, assign the required role to it, and configure PIM for Groups to manage user eligibility with a 4-hour activation limit and MFA requirement. Additionally, a quarterly access review on the group's membership ensures governance compliance.

Step-by-Step Solution

Design a group-based access model to minimize administrative overhead.

A role-assignable Microsoft Entra security group is created, and the Storage Blob Data Contributor role is assigned to the group for the storage accounts.

This avoids direct user assignments and simplifies RBAC management.

Configure Privileged Identity Management (PIM) for Groups to handle JIT access and MFA.

The analysts are added as eligible members of the group in PIM, with a maximum activation duration of 4 hours and MFA enforced.

This ensures access is temporary (maximum of 4 hours) and secure.

Establish a recurring access review for ongoing compliance.

An Entra ID access review is configured for the group's membership, scheduled to recur quarterly.

This satisfies the governance requirement to verify the ongoing need for access.

Key Concept

Entra ID Governance, PIM for Groups, and Access Reviews

Question 546Question →

You are designing the hosting infrastructure for two new workloads in Azure:
- Workload 1: A lightweight microservice that processes HTTP requests and must scale down to zero instances to minimize costs during idle periods.
- Workload 2: A data processing job that executes triggered events and runs for up to $30$ minutes per execution.

Which of the following service plans should you recommend for these workloads? (Select TWO.)

Select all that apply

Azure Container Apps to host Workload 1

Azure Functions on a Premium plan to host Workload 2

Azure Kubernetes Service (AKS) to host Workload 1

Azure Functions on a Consumption plan to host Workload 2

Show answer & explanation

Answer: Azure Container Apps to host Workload 1; Azure Functions on a Premium plan to host Workload 2

Answer

Azure Container Apps to host Workload 1 and Azure Functions on a Premium plan to host Workload 2

Azure Container Apps is the ideal choice for Workload 1 because it allows simple containerized microservices to scale down to zero instances when idle, minimizing costs without the management complexity of a Kubernetes cluster. Azure Functions on a Premium plan is correct for Workload 2 because it supports execution durations of up to

30

minutes, whereas the Consumption plan has a maximum execution limit of

10

minutes.

Step-by-Step Solution

Analyze the scaling and operational requirements of Workload 1.

Workload 1 requires scaling to zero instances to minimize costs and low operational overhead. Azure Container Apps supports scaling to zero based on HTTP traffic without the cluster management overhead of Azure Kubernetes Service.

This identifies the most cost-effective and low-maintenance hosting option for the microservice.

Analyze the execution duration requirements of Workload 2.

Workload 2 runs for up to

30

minutes, which exceeds the

10

-minute maximum execution timeout of the Azure Functions Consumption plan. Azure Functions on a Premium plan supports execution durations of up to

30

minutes.

This ensures the selected plan supports the execution duration without experiencing timeout failures.

Key Concept

Selecting Azure compute and serverless hosting plans based on execution duration limits, scaling behavior, and operational overhead.

Question 547Question →

A research institute is designing an analytical data platform to explore genomic metadata stored in Azure Data Lake Storage (ADLS) Gen2. The solution must meet the following requirements:

* Volume: $15 \text{ TB}$ of genomics metadata files stored in CSV and Parquet formats.
* Velocity/Ingestion: New research datasets totaling $200 \text{ GB}$ are uploaded in a batch once per week.
* Query latency: Analytical queries are sporadic, executed by researchers on an ad-hoc basis, and can tolerate a latency of up to $10 \text{ seconds}$ .
* Resilience: The storage must remain available and suffer no data loss in the event of a physical datacenter outage within the primary region.
* Security: The query engine must authenticate to the storage account using dynamic, short-lived permissions without utilizing account keys or static credentials.

Which solution should you recommend to meet the requirements?

Query the files using Azure Synapse dedicated SQL pools, configure the ADLS Gen2 account to use zone-redundant storage (ZRS), and authenticate using Microsoft Entra ID pass-through.

Query the files using Azure Synapse serverless SQL pools, configure the ADLS Gen2 account to use locally redundant storage (LRS), and authenticate using Microsoft Entra ID pass-through.

Query the files using Azure Synapse serverless SQL pools, configure the ADLS Gen2 account to use zone-redundant storage (ZRS), and authenticate using Microsoft Entra ID pass-through.

Query the files using Azure Synapse serverless SQL pools, configure the ADLS Gen2 account to use zone-redundant storage (ZRS), and access the storage using a Shared Access Signature (SAS) token configured with a three-year expiration.

Show answer & explanation

Answer: Query the files using Azure Synapse serverless SQL pools, configure the ADLS Gen2 account to use zone-redundant storage (ZRS), and authenticate using Microsoft Entra ID pass-through.

Answer

Query the files using Azure Synapse serverless SQL pools, configure the ADLS Gen2 account to use zone-redundant storage (ZRS), and authenticate using Microsoft Entra ID pass-through.

Querying ad-hoc CSV and Parquet files in a data lake is best served by Azure Synapse serverless SQL pools because compute costs are incurred only for data processed by queries. Zone-redundant storage (ZRS) replicates data across three Availability Zones in the primary region, safeguarding against physical datacenter failures. Microsoft Entra ID pass-through provides secure, keyless authentication utilizing the user's security identity.

Step-by-Step Solution

Analyze the access pattern and cost requirements.

Since queries are sporadic and ad-hoc on files stored in ADLS Gen2, Azure Synapse serverless SQL pools should be chosen over dedicated SQL pools to avoid paying for idle compute resources.

Serverless SQL pools charge only per TB of data processed, minimizing costs for irregular query patterns.

Evaluate the resiliency requirement.

Select Zone-Redundant Storage (ZRS) for the ADLS Gen2 storage account.

ZRS replicates data synchronously across three availability zones in the primary region, ensuring availability during a physical datacenter failure, unlike LRS which is localized to a single datacenter.

Determine the authentication mechanism.

Choose Microsoft Entra ID pass-through authentication.

Microsoft Entra ID pass-through provides dynamic, role-based access control without hardcoded credentials or long-lived SAS tokens, satisfying the security requirements.

Key Concept

Selecting cost-effective query engines, secure authentication mechanisms, and resilient storage configurations for Azure analytical solutions.

Estimated Time:1m 30s

Question 548Question →

An organization is designing a high-availability architecture across the East US and West US regions. The design uses Azure Front Door to route client traffic to web applications and Azure Traffic Manager to route DNS requests for regional API gateways. The target Recovery Time Objective (RTO) for any endpoint failover event is less than 2 minutes. You need to configure the failover detection and routing parameters for both services to meet the RTO while minimizing false-positive failovers. Which two configurations should you recommend? (Select TWO.)

Select all that apply

For Azure Traffic Manager, set the DNS Time-to-Live (TTL) to 30 seconds, and configure the health probing interval to 10 seconds.

For Azure Front Door, configure health probes with an interval of 5 seconds using HTTP or HTTPS protocols to detect endpoint failures.

For Azure Traffic Manager, configure SSL termination and URL path-based routing rules to direct traffic to healthy endpoints based on the incoming request URI.

For Azure Front Door, configure health probes to use raw TCP ping probes on port 443 to monitor endpoint availability while reducing backend load.

Show answer & explanation

Answer: For Azure Traffic Manager, set the DNS Time-to-Live (TTL) to 30 seconds, and configure the health probing interval to 10 seconds.; For Azure Front Door, configure health probes with an interval of 5 seconds using HTTP or HTTPS protocols to detect endpoint failures.

Answer

The correct configuration is to set the Azure Traffic Manager DNS Time-to-Live (TTL) to 30 seconds and the health probing interval to 10 seconds, and to configure the Azure Front Door health probes with an interval of 5 seconds using HTTP or HTTPS protocols.

The correct strategy combines configuring Azure Traffic Manager with a low DNS TTL of 30 seconds and a 10-second probing interval to satisfy DNS propagation time constraints, and configuring Azure Front Door with short 5-second health probes using HTTP/HTTPS. These settings ensure that both DNS-based and application-level routing layers failover within the required 2-minute threshold.

Step-by-Step Solution

Analyze the recovery time objective (RTO) constraint.

The target RTO is less than 2 minutes, requiring both DNS caching and health probe intervals to react within this window.

Default TTL settings (300 seconds for Traffic Manager) would cause clients to cache outdated IP addresses for up to 5 minutes, violating the RTO.

Evaluate Azure Traffic Manager settings for fast failover.

Reducing DNS TTL to 30 seconds and setting the probing interval to 10 seconds allows Traffic Manager to detect failures and propagate DNS updates within 40 seconds.

This satisfies the RTO and utilizes the supported Fast Failover capability of Traffic Manager.

Evaluate Azure Front Door health probe requirements.

Front Door must use HTTP or HTTPS probes. Setting the interval to 5 seconds ensures failover detection happens in seconds.

Front Door is an application-layer service that does not support raw TCP health probes.

Eliminate unsupported configurations.

Eliminated SSL termination on Traffic Manager (DNS-only) and TCP ping on Front Door (unsupported).

This avoids architectural design errors where layer-4 DNS solutions are incorrectly assumed to have layer-7 application awareness.

Key Concept

Designing multi-region traffic routing requires configuring low DNS TTLs and fast health probe intervals to meet tight RTO targets, while respecting protocol limitations of DNS-based versus application-level routing services.

Question 549Question →

A financial services company is designing a storage solution for its document management platform using an Azure General Purpose v2 (GPv2) storage account. The platform has the following requirements:
- The data must remain highly available and survive the loss of an entire availability zone in the primary region.
- In the event of a regional disaster in the primary region, the platform must be able to read documents from a secondary paired region with a target Recovery Time Objective (RTO) of zero, without requiring a manual or managed storage failover.
- Cost and administrative overhead must be minimized.

Which redundancy configuration should you recommend for the storage account?

Read-access geo-zone-redundant storage (RA-GZRS)

Geo-zone-redundant storage (GZRS)

Read-access geo-redundant storage (RA-GRS)

Zone-redundant storage (ZRS)

Show answer & explanation

Answer: Read-access geo-zone-redundant storage (RA-GZRS)

Answer

Read-access geo-zone-redundant storage (RA-GZRS) is the correct choice because it replicates data across three availability zones in the primary region (protecting against zone outages) and provides read-only access to the secondary region endpoint without requiring a failover (ensuring a zero RTO for read operations).

Read-access geo-zone-redundant storage (RA-GZRS) replicates data synchronously across three Azure availability zones in the primary region, which allows the application to survive a zone outage. It also asynchronously replicates the data to a secondary paired region and exposes a read-only endpoint, allowing the application to read documents during a disaster without initiating a storage failover.

Step-by-Step Solution

Analyze the primary region high availability requirement.

The requirement to survive the loss of an entire availability zone in the primary region rules out Locally Redundant Storage (LRS) and Geo-Redundant Storage (GRS), which both use LRS within the primary region.

LRS replicates data within a single datacenter, making it vulnerable to zone-level failures.

Analyze the regional disaster recovery and RTO requirements.

The requirement to read data from a secondary region with an RTO of zero without a failover rules out standard GZRS and ZRS.

ZRS does not replicate to a secondary region, and GZRS requires a failover to make the secondary endpoint accessible.

Select the configuration that combines both zone redundancy and read-access geo-redundancy.

Read-access geo-zone-redundant storage (RA-GZRS) is selected.

RA-GZRS satisfies the zone survival requirement through primary ZRS replication and satisfies the zero-failover read requirement through read-access enablement in the secondary region.

Key Concept

Azure Storage Redundancy Tiers and Secondary Endpoint Access

Question 550Question →

GridPulse Analytics is designing a storage architecture for a smart-meter telemetry ingestion system. The system writes telemetry data to a general-purpose v2 storage account in the East US region. The storage architecture must meet the following requirements:
- Protect against a local availability zone failure in East US with zero downtime and zero data loss.
- In the event of a complete outage of the East US region, read access to the historical telemetry data must remain available with a Recovery Time Objective (RTO) of $0$ minutes.
- In the event of a complete outage of the East US region, write operations must be restored in the West US region with an RTO of less than $1$ hour and a Recovery Point Objective (RPO) of less than $15$ minutes.
- Cost must be minimized by avoiding redundant active-active compute environments for writes.

Which storage configuration and recovery strategy should you recommend?

Configure the storage account to use Read-Access Geo-Zone-Redundant Storage (RA-GZRS). Direct read operations to the secondary endpoint, and initiate a customer-managed account failover to restore write capabilities.

Configure the storage account to use Read-Access Geo-Redundant Storage (RA-GRS). Direct read operations to the secondary endpoint, and initiate a customer-managed account failover to restore write capabilities.

Configure the storage account to use Read-Access Geo-Zone-Redundant Storage (RA-GZRS). Direct read operations to the secondary endpoint, and redirect write operations to the secondary endpoint without initiating a failover.

Configure the storage account to use Geo-Zone-Redundant Storage (GZRS). Initiate a customer-managed account failover during a regional outage to restore both read and write capabilities.

Show answer & explanation

Answer: Configure the storage account to use Read-Access Geo-Zone-Redundant Storage (RA-GZRS). Direct read operations to the secondary endpoint, and initiate a customer-managed account failover to restore write capabilities.

Answer

The correct option addresses all requirements: Read-Access Geo-Zone-Redundant Storage (RA-GZRS) provides zone-redundant storage in the primary region, satisfying the zone outage protection requirement. It also provides read access to the secondary region at all times, satisfying the read Recovery Time Objective (RTO) of

0

minutes. To restore writes in the secondary region, initiating a customer-managed account failover elevates the secondary region to primary, enabling writes while staying within the

15

-minute Recovery Point Objective (RPO) and

1

-hour write RTO.

Step-by-Step Solution

Evaluate primary region high availability requirements.

Determined that Zone-Redundant Storage (ZRS) or Geo-Zone-Redundant Storage (GZRS/RA-GZRS) is required in the primary region to survive an availability zone failure with zero downtime and data loss.

Locally redundant storage (LRS) based options like GRS/RA-GRS only replicate data within a single datacenter, making them vulnerable to zone outages.

Evaluate read availability requirements for a regional outage.

Determined that read-access to the secondary region must be configured (RA-GRS or RA-GZRS) to achieve a read Recovery Time Objective (RTO) of

0

minutes.

Non-read-access options (GRS/GZRS) keep the secondary region offline for reads until a full failover completes, resulting in read downtime during the failover window.

Evaluate write recovery and failover behavior.

Determined that a customer-managed account failover must be initiated to allow write operations in the secondary region.

The secondary endpoint is read-only. Directing writes to the secondary endpoint without failover fails because the secondary region does not accept write operations until it is promoted to primary via failover.

Key Concept

Azure Storage account replication tiers (RA-GZRS vs GZRS/RA-GRS) and the mechanics of customer-managed account failover for disaster recovery.

Estimated Time:2m 0s

Question 551Question →

An organization is deploying an SAP HANA database on an Azure Virtual Machine utilizing Premium SSD v2 managed disks. You are designing an Azure Backup solution to meet the following requirements:
- Provide multiple backups per day to achieve a 4-hour Recovery Point Objective (RPO).
- Retain local snapshots for 12 days to support rapid, instant restore from disk snapshots to minimize Recovery Time Objective (RTO).
- Retain weekly backups for 365 days, ensuring they can be restored within 3 hours under standard recovery processes.
- Ensure backups are resilient against a primary region outage.

Which backup configuration should you recommend?

Configure a Recovery Services vault with Locally Redundant Storage (LRS). Implement an Enhanced backup policy with snapshot retention set to 12 days and vault-standard retention set to 365 days.

Configure a Recovery Services vault with Geo-redundant storage (GRS). Implement a Standard backup policy with snapshot retention set to 12 days and vault-standard retention set to 365 days.

Configure a Recovery Services vault with Geo-redundant storage (GRS). Implement an Enhanced backup policy with snapshot retention set to 12 days and vault-standard retention set to 365 days.

Configure a Recovery Services vault with Geo-redundant storage (GRS). Implement an Enhanced backup policy with snapshot retention set to 12 days, and configure a tiering policy to move the vault backups to the vault-archive tier after 14 days.

Show answer & explanation

Answer: Configure a Recovery Services vault with Geo-redundant storage (GRS). Implement an Enhanced backup policy with snapshot retention set to 12 days and vault-standard retention set to 365 days.

Answer

Configure a Recovery Services vault with Geo-redundant storage (GRS). Implement an Enhanced backup policy with snapshot retention set to 12 days and vault-standard retention set to 365 days.

The correct configuration uses a Recovery Services vault configured with Geo-redundant storage (GRS) and an Enhanced backup policy. The Enhanced backup policy is required because the database uses Premium SSD v2 managed disks, requires multiple daily backups (4-hour RPO), and needs to retain local snapshots for 12 days (Standard policies only support 1-5 days of instant restore). Retaining the vault backups in the standard tier guarantees that restore operations avoid the multi-hour rehydration latency associated with the vault-archive tier.

Step-by-Step Solution

Analyze workload and schedule compatibility.

The database uses Premium SSD v2 managed disks and requires multiple backups per day to meet a 4-hour RPO. Standard backup policies do not support Premium SSD v2 or multiple daily backups, meaning an Enhanced backup policy is required.

Enhanced backup policies are necessary for modern virtual machine features and frequent backup schedules.

Evaluate the instant restore snapshot retention requirement.

The RTO requirements specify keeping local snapshots for 12 days. Standard backup policies restrict instant restore retention to a maximum of 5 days, whereas Enhanced backup policies allow up to 30 days.

Verifies that the Enhanced policy configuration is required to support the 12-day local snapshot retention.

Determine storage redundancy and recovery latency constraints.

Geo-redundant storage (GRS) is required to ensure resilience against a primary region outage. To meet the 3-hour recovery SLA, the vault backups must remain in the vault-standard tier because moving them to the vault-archive tier introduces up to 15 hours of standard rehydration latency.

Selects the correct vault tier and redundancy type based on disaster recovery and RTO parameters.

Key Concept

Designing Azure Backup solutions using Enhanced backup policies to support Premium SSD v2, multiple daily backups, extended instant restore snapshot retention, and low-latency vault restore configurations.

Question 552Question →

An organization is designing a disaster recovery (DR) solution from the Azure North Europe region to the Azure West Europe region for a critical three-tier application.

The application workloads and performance metrics are:
- Web and Application Tiers: 4 VMs in total, each running on Standard SSDs. The write churn per VM is $3\text{ MB/s}$ . The required recovery point objective (RPO) is $1\text{ hour}$ , and the recovery time objective (RTO) is $4\text{ hours}$ .
- Database Tier: 2 VMs running SQL Server Enterprise Edition on Windows Server. Each VM has:
- 1 Premium SSD OS disk ( $4\text{ MB/s}$ write churn)
- 1 Premium SSD TempDB disk ( $30\text{ MB/s}$ write churn)
- 1 Premium SSD Data disk ( $22\text{ MB/s}$ write churn)
- 1 Premium SSD Transaction Log disk ( $35\text{ MB/s}$ write churn)
- The required RPO for the database tier is $10\text{ seconds}$ , and the RTO is $15\text{ minutes}$ .

Which two of the following strategies should you include in the disaster recovery design? (Select TWO).

Select all that apply

Replicate the Web and Application tier VMs to the target region using Azure Site Recovery.

Deploy SQL Server Always On Availability Groups with asynchronous commit replication to SQL Server VMs in the target region.

Replicate the database tier VMs to the target Azure region using Azure Site Recovery standard replication.

Configure Azure Traffic Manager to handle the real-time data replication of the database logs between the primary and target regions.

Show answer & explanation

Answer: Replicate the Web and Application tier VMs to the target region using Azure Site Recovery.; Deploy SQL Server Always On Availability Groups with asynchronous commit replication to SQL Server VMs in the target region.

Answer

Replicate the Web and Application tier VMs to the target region using Azure Site Recovery, and deploy SQL Server Always On Availability Groups with asynchronous commit replication to SQL Server VMs in the target region.

The correct strategy involves combining Azure Site Recovery for the Web and Application tiers with SQL Server Always On Availability Groups for the Database tier. Azure Site Recovery is optimal for standard VM-level replication because the Web and Application tiers have low write churn and flexible RPO/RTO objectives. For the database tier, the 10-second RPO and the high write churn (specifically the log disk at 35 MB/s, which exceeds the 20 MB/s standard ASR per-disk limit, and the total VM churn of 91 MB/s) require a native application-level replication solution. SQL Server Always On Availability Groups with asynchronous commit provides low-latency replication that meets the 10-second RPO without running into VM-level storage replication thresholds.

Step-by-Step Solution

Evaluate the disaster recovery requirements for the Web and Application tiers.

The Web/App tiers require a 1-hour RPO and 4-hour RTO, and have low write churn (3 MB/s per VM). Azure Site Recovery (ASR) is fully supported and meets these constraints.

ASR provides continuous replication for Azure VMs with a default RPO alert threshold of 15 minutes, which easily satisfies the 1-hour requirement.

Evaluate the database tier requirements against Azure Site Recovery limits.

The database VMs have a total write churn of 91 MB/s (OS: 4, TempDB: 30, Data: 22, Log: 35), and the log disk has 35 MB/s churn. Under standard ASR, write churn limits are 20 MB/s per Premium SSD and 40 MB/s per VM. Standard ASR cannot support this churn workload. Furthermore, ASR cannot consistently achieve a 10-second RPO.

Checking ASR constraints helps determine whether a VM-level replication or a native database replication strategy is required.

Determine the optimal replication strategy for the database tier.

SQL Server Always On Availability Groups with asynchronous commit replication should be configured between the primary region and SQL Server VMs in the target region.

Native SQL Server replication tools handle high transaction rates natively, bypass VM-level storage replication limits, and can achieve near-zero RPO, satisfying the 10-second RPO limit.

Key Concept

Disaster recovery design involves aligning workload metrics (such as write churn and RPO/RTO) with Azure service capabilities. While Azure Site Recovery is ideal for standard virtual machine workloads, native database replication techniques (like SQL Server Always On Availability Groups) must be used for databases with high write churn or extremely low RPO targets.

Question 553Question →

An environmental organization is designing a global weather monitoring system that collects data from thousands of atmospheric sensors. The sensors upload temperature and pressure metrics every $10$ seconds. The solution must meet the following requirements:
- Provide regional disaster resilience to ensure the system remains online if an Azure region experiences an outage.
- Minimize write latency for sensors located across North America, Europe, and Asia.
- Avoid hot partitions and ensure even distribution of write requests across logical partitions.

Which two configurations should you include in the design of the Azure Cosmos DB for NoSQL account? (Select TWO.)

Select all that apply

Enable multi-region writes and replicate the database across the target regions.

Use a composite partition key combining the SensorID and the hourly timestamp.

Configure a single write region and rely on Locally Redundant Storage (LRS) replication.

Select CountryCode as the partition key to group metrics by geographical area.

Show answer & explanation

Answer: Enable multi-region writes and replicate the database across the target regions.; Use a composite partition key combining the SensorID and the hourly timestamp.

Answer

To meet the requirements, you should enable multi-region writes with replication across target regions and use a high-cardinality partition key such as a composite key of SensorID and an hourly timestamp.

Enabling multi-region writes and replicating the database across the target regions minimizes write latency for globally distributed sensors and provides high availability during a regional outage. Using a composite partition key like SensorID combined with a timestamp provides high cardinality, distributing requests evenly across logical partitions and preventing hot partitions.

Step-by-Step Solution

Identify the geographical distribution and resilience requirements.

Since sensors are distributed across North America, Europe, and Asia, and the system must survive regional outages, multi-region writes must be enabled and the database replicated to the target regions.

This configuration provides local write endpoints to minimize write latency and ensures data availability if a single region fails.

Determine the optimal partition key design.

A high-cardinality key must be used to distribute writes evenly. A composite key combining SensorID and an hourly timestamp satisfies this requirement.

Using a low-cardinality key like country code would create hot partitions due to the high frequency of telemetry uploads from a single location.

Key Concept

Azure Cosmos DB global distribution, multi-region writes, and high-cardinality partition keys.

Question 554Question →

An enterprise is designing a container-based application on Azure that consists of a payment microservice and three operational microservices.

The design must satisfy the following requirements:
* Scale the compute resources dynamically based on message queue depth using KEDA, including scaling down to zero when idle.
* Minimize the administrative effort of managing container infrastructure, including OS patching, cluster upgrades, and node scaling.
* Route the console and system logs of the payment microservice to a dedicated regional Log Analytics workspace to meet compliance requirements.
* Route the logs of the operational microservices to a separate, shared Log Analytics workspace.
* Enable all microservices to communicate with each other securely over a private network.

Which architecture should you recommend?

Deploy the payment microservice and the operational microservices into separate Azure Container Apps environments integrated with different subnets of the same Azure Virtual Network. Configure each environment with its own Log Analytics workspace.

Deploy the payment microservice and the operational microservices into a single Azure Container Apps environment. Use Azure RBAC and Kusto Query Language (KQL) filters to restrict log access in a single shared Log Analytics workspace.

Deploy the payment microservice and the operational microservices into a single Azure Kubernetes Service (AKS) cluster using virtual nodes. Use Kubernetes namespaces and Azure Monitor Data Collection Rules (DCRs) to route logs to separate Log Analytics workspaces.

Deploy the payment microservice and the operational microservices as separate container groups in Azure Container Instances (ACI). Configure container group diagnostics to route logs to different Log Analytics workspaces.

Show answer & explanation

Answer: Deploy the payment microservice and the operational microservices into separate Azure Container Apps environments integrated with different subnets of the same Azure Virtual Network. Configure each environment with its own Log Analytics workspace.

Answer

Deploy the payment microservice and the operational microservices into separate Azure Container Apps environments integrated with different subnets of the same Azure Virtual Network, configuring each environment with its own Log Analytics workspace.

The correct solution uses Azure Container Apps to meet the need for serverless scaling (KEDA) to zero and minimal operational overhead. Since logging is configured at the Environment level in Azure Container Apps, routing logs to different Log Analytics workspaces requires deploying the services into two separate Container Apps environments. By integrating these environments into different subnets of the same virtual network, secure and private inter-service communication is achieved.

Step-by-Step Solution

Evaluate the scaling and operational overhead requirements.

Azure Container Apps (ACA) is identified as the optimal serverless option because it natively supports KEDA-based scale-to-zero and eliminates container infrastructure management (no VMs or cluster upgrades).

This filters out AKS due to high administrative effort and ACI due to lack of native event-driven KEDA scaling.

Evaluate the log segregation requirement.

Logging configuration in ACA is bound to the Container Apps Environment level. Therefore, microservices requiring separate Log Analytics workspaces must be deployed into separate ACA Environments.

This rules out deploying all services in a single ACA Environment with access control filters.

Evaluate secure private communication between separate environments.

Deploy the separate ACA environments into different subnets within the same Azure Virtual Network.

This allows the microservices to communicate securely over a private network boundary with minimal latency while keeping their log destinations separate.

Key Concept

Selecting and configuring serverless container hosting platforms in Azure to align scaling, management overhead, private networking, and compliance monitoring requirements.

Estimated Time:3m 0s

Question 555Question →

A transit authority is designing a containerized telemetry processing system to monitor municipal bus fleets across two geographical sectors. The system consists of multiple microservices that ingest GPS coordinates and engine diagnostics from an Azure IoT Hub.

The architecture must meet the following requirements:
- Support event-driven scaling using KEDA based on message queue depth.
- Minimize administrative effort and operational overhead for managing the underlying compute infrastructure.
- Satisfy strict regional compliance regulations by ensuring that telemetry logs from each sector are stored exclusively within their respective Azure regions and are not co-mingled.

Which infrastructure design should you recommend?

Deploy Azure Container Apps in each region, and configure a separate Log Analytics workspace in each region.

Deploy Azure Kubernetes Service (AKS) clusters in each region, and configure a separate Log Analytics workspace in each region.

Deploy Azure Container Apps in each region, and configure a single centralized Log Analytics workspace to aggregate logs from both regions.

Deploy Azure Kubernetes Service (AKS) clusters in each region, and configure a single centralized Log Analytics workspace to aggregate logs from both regions.

Show answer & explanation

Answer: Deploy Azure Container Apps in each region, and configure a separate Log Analytics workspace in each region.

Answer

Deploy Azure Container Apps in each region, and configure a separate Log Analytics workspace in each region.

The correct design uses Azure Container Apps because it natively supports KEDA-based scaling and minimizes operational and administrative overhead compared to managing full Kubernetes clusters. Additionally, deploying separate Log Analytics workspaces in each region satisfies the compliance requirement by ensuring data residency and preventing log co-mingling across different geographical jurisdictions.

Step-by-Step Solution

Evaluate the scaling and operational requirements for the compute platform.

Identify that Azure Container Apps supports event-driven scaling using KEDA natively and operates as a serverless platform, minimizing administrative overhead compared to Azure Kubernetes Service.

This addresses the requirement to support KEDA scaling while minimizing compute management effort.

Evaluate the compliance and logging requirements.

Determine that separate Log Analytics workspaces must be deployed in each region to ensure regional log isolation and compliance.

A single centralized workspace would co-mingle telemetry data from different sectors, violating the regional compliance constraints.

Combine the compute and logging evaluations to select the optimal design.

Select the combination of regional Azure Container Apps and separate regional Log Analytics workspaces.

This combined design satisfies both the low-administrative compute overhead constraint and the strict log isolation compliance mandate.

Key Concept

Designing serverless container workloads with regional data residency and compliance auditing.

Estimated Time:2m 30s

Question 556Question →

An organization deploys an Azure virtual network named `vnet-prod-eastus` with the address space $10.95.0.0/16$ . The virtual network contains three subnets:
* `snet-web` ( $10.95.1.0/24$ )
* `snet-db` ( $10.95.2.0/24$ )
* `snet-nva` ( $10.95.10.0/24$ ), which hosts a Network Virtual Appliance (NVA) at the IP address $10.95.10.4$ .

The organization intends to inspect all traffic from `snet-web` to `snet-db` using the NVA. An administrator creates a route table named `rt-prod-web`, associates it with `snet-web`, and adds a user-defined route (UDR) with the address prefix $10.95.0.0/16$ and the next hop pointing to the NVA.

After applying the route table, virtual machines in `snet-web` can no longer communicate with each other, and all intra-subnet traffic within `snet-web` fails.

What is the primary cause of this communication failure?

The next hop type of Virtual Appliance is not supported for destinations within the same virtual network.

The user-defined route overrides the default virtual network system route for the entire address space, redirecting local intra-subnet traffic to the NVA.

Azure system routes for local virtual network traffic always take precedence over user-defined routes, causing a routing loop.

The virtual network automatically creates a default system route of

10.95.1.0/24

for the subnet that takes precedence over the user-defined route.

Show answer & explanation

Answer: The user-defined route overrides the default virtual network system route for the entire address space, redirecting local intra-subnet traffic to the NVA.

Answer

The user-defined route overrides the default virtual network system route for the entire address space, redirecting local intra-subnet traffic to the NVA.

The correct answer explains that user-defined routes take precedence over default system routes when the destination prefixes match. The system route for local virtual network traffic is

10.95.0.0/16

('Virtual network'). By defining a UDR with the prefix

10.95.0.0/16

pointing to the NVA, all local traffic within the virtual network—including traffic between hosts in the same subnet (`snet-web`)—is redirected to the NVA. If the NVA cannot process or loop back this traffic, intra-subnet communication fails.

Step-by-Step Solution

Analyze the virtual network layout and system routes.

The virtual network `vnet-prod-eastus` has the prefix

10.95.0.0/16

, which creates a default Azure system route of

10.95.0.0/16

with next hop 'Virtual network'.

Understanding the default system routing behavior is necessary to evaluate how user-defined routes interact with it.

Evaluate the user-defined route (UDR) prefix and destination.

The UDR configures prefix

10.95.0.0/16

with next hop 'Virtual Appliance' (

10.95.10.4

This shows that the UDR prefix exactly matches the default virtual network system route.

Apply Azure route selection precedence rules.

For identical prefixes (

10.95.0.0/16

), the user-defined route (UDR) takes precedence over the system route. Consequently, all traffic within the VNet, including intra-subnet traffic in `snet-web`, is sent to the NVA, breaking local communication if the NVA is not configured to handle it.

Azure determines the next hop by looking for the longest prefix match, and if prefixes are equal, it prioritizes UDR over default system routes.

Key Concept

Azure route selection and precedence rules between User Defined Routes (UDR) and default system routes.

Question 557Question →

An enterprise implements a hub-and-spoke network topology in Azure. The topology contains a hub virtual network named `vnet-weur-hub` ( $10.10.0.0/16$ ) and a spoke virtual network named `vnet-weur-spoke` ( $10.20.0.0/16$ ). A network virtual appliance (NVA) is deployed in the hub at $10.10.1.4$ .

You need to configure routing for the subnets in `vnet-weur-spoke` to meet the following requirements:
1. All traffic destined for the internet must route through the NVA at $10.10.1.4$ .
2. All traffic destined for resources within `vnet-weur-spoke` must route directly between those resources.

Which two routes must be active in the effective routes of `vnet-weur-spoke` to meet these requirements? (Select two.)

Select all that apply

A user-defined route with the address prefix

0.0.0.0/0

and a next hop type of Virtual appliance pointing to

10.10.1.4

A system-defined route with the address prefix

10.20.0.0/16

and a next hop type of Virtual network.

A user-defined route with the address prefix

10.20.0.0/16

and a next hop type of Virtual appliance pointing to

10.10.1.4

A system-defined route with the address prefix

0.0.0.0/0

and a next hop type of Internet.

Show answer & explanation

Answer: A user-defined route with the address prefix $0.0.0.0/0$ and a next hop type of Virtual appliance pointing to $10.10.1.4$ .; A system-defined route with the address prefix $10.20.0.0/16$ and a next hop type of Virtual network.

Answer

A user-defined route with the address prefix

0.0.0.0/0

pointing to the virtual appliance at

10.10.1.4

as next hop, and the default system-defined route with the address prefix

10.20.0.0/16

pointing to the Virtual network.

The correct configurations include the user-defined route for

0.0.0.0/0

pointing to the firewall's IP address of

10.10.1.4

, which overrides the default internet path and routes all external traffic through the firewall. Additionally, the default system-defined route for the local virtual network prefix (

10.20.0.0/16

with next hop Virtual network) must remain the active route for internal traffic. Since Azure routing uses Longest Prefix Match (LPM), the local system route (

10.20.0.0/16

) takes precedence over the user-defined route (

0.0.0.0/0

) for any traffic destined within the spoke, allowing local traffic to bypass the firewall without requiring extra UDRs.

Step-by-Step Solution

Analyze the requirement for outbound internet traffic routing.

To route all outbound internet traffic (

0.0.0.0/0

) to the NVA at

10.10.1.4

, we must define a User-Defined Route (UDR) with prefix

0.0.0.0/0

and next hop Virtual appliance pointing to

10.10.1.4

. This overrides the default system route for internet traffic.

By default, Azure routes internet-bound traffic directly to the Internet. A UDR is required to override this default behavior.

Analyze the requirement for internal spoke-to-spoke traffic routing.

Traffic within `vnet-weur-spoke` (

10.20.0.0/16

) is handled by the default system route with the prefix

10.20.0.0/16

and next hop Virtual network.

Azure system routes automatically handle intra-VNet routing. Leaving this route active allows direct local communication without traversing the hub firewall.

Evaluate route precedence (Longest Prefix Match).

For local traffic (e.g., to

10.20.1.5

), Azure evaluates both routes:

10.20.0.0/16

(system route) and

0.0.0.0/0

(UDR). The system route is a longer prefix match, so it takes precedence.

Longest Prefix Match ensures that local traffic is routed locally, while all other traffic falls back to the

0.0.0.0/0

default route pointing to the firewall.

Key Concept

Azure virtual network routing uses User-Defined Routes (UDRs) to override default system routes. Azure selects routes based on the Longest Prefix Match (LPM) algorithm. A route for

0.0.0.0/0

redirects all non-local traffic to the specified next hop (NVA/firewall), while local traffic continues to route directly via the system route for the VNet's CIDR block.

Question 558Question →

An enterprise is designing a privileged access governance strategy for its Azure subscriptions. The strategy must meet the following requirements:
- A team of system engineers requires temporary, approved administrative access to manage virtual machines.
- Administrative permissions must be managed at a group level rather than assigned to individual user accounts to ensure scalable governance.
- To prevent tenant-wide lockout during a potential multi-factor authentication (MFA) service outage, emergency break-glass accounts must be maintained.

Which of the following designs should you recommend?

Configure Microsoft Entra ID Privileged Identity Management (PIM) for Groups using a role-assignable group where engineers are permanently active members, and exclude the emergency break-glass accounts from the Conditional Access policy that requires MFA.

Configure Microsoft Entra ID Privileged Identity Management (PIM) for Azure Resources to assign individual engineer user accounts directly as eligible for the Virtual Machine Contributor role, and exclude the emergency break-glass accounts from the Conditional Access policy that requires MFA.

Configure Microsoft Entra ID Privileged Identity Management (PIM) for Groups using a role-assignable group where engineers are eligible members, and exclude the emergency break-glass accounts from the Conditional Access policy that requires MFA.

Configure Microsoft Entra ID Privileged Identity Management (PIM) for Groups using a role-assignable group where engineers are eligible members, and include all accounts, including the emergency break-glass accounts, in the Conditional Access policy that requires MFA.

Show answer & explanation

Answer: Configure Microsoft Entra ID Privileged Identity Management (PIM) for Groups using a role-assignable group where engineers are eligible members, and exclude the emergency break-glass accounts from the Conditional Access policy that requires MFA.

Answer

The correct design utilizes Microsoft Entra ID PIM for Groups to grant JIT administrative privileges in a scalable, group-based manner. Additionally, it respects security best practices by excluding emergency break-glass accounts from the MFA Conditional Access policy to ensure resilience against service outages.

Step-by-Step Solution

Address the group-based governance requirement.

Identify that administrative privileges must be granted to an Entra ID group rather than assigning individual roles directly to user accounts.

Direct assignments to user accounts violate scalability best practices and complicate management.

Ensure privileged access is temporary and just-in-time (JIT).

Configure the group assignments using Microsoft Entra ID PIM for Groups, defining the engineers as eligible members rather than active members.

Active assignments grant standing access, whereas eligible assignments require JIT activation, which enforces approval and tracking.

Mitigate the risk of tenant lockout during MFA failure.

Exclude emergency break-glass accounts from the Conditional Access policy that enforces MFA for administrative access.

Excluding these accounts guarantees access to the tenant in emergency situations where the MFA provider is unavailable.

Key Concept

Designing secure, scalable administrative access using group-based PIM governance and resilient emergency access policies.

Estimated Time:1m 30s

Question 559Question →

A financial institution is designing the Azure compute infrastructure for two separate workloads:

- Workload 1: A core transaction processing system that runs steady-state, 24/7, requires physical isolation at the physical hardware level to meet regulatory compliance, and must be deployed across multiple availability zones to ensure zone-level high availability.
- Workload 2: A batch risk-modeling application that runs on weekends, is highly parallelizable, tolerant of interruptions, and must be deployed at the lowest possible cost.

Which two compute virtualization strategies should you recommend to meet these requirements? (Select two.)

Select all that apply

Deploy Workload 1 on Azure Dedicated Hosts allocated across multiple availability zones.

Deploy Workload 2 on Azure Spot Virtual Machines.

Deploy Workload 1 on Azure Reserved Virtual Machine Instances within a single availability zone.

Deploy Workload 1 on Azure Spot Virtual Machines deployed across multiple Azure Dedicated Hosts.

Show answer & explanation

Answer: Deploy Workload 1 on Azure Dedicated Hosts allocated across multiple availability zones.; Deploy Workload 2 on Azure Spot Virtual Machines.

Answer

Deploy Workload 1 on Azure Dedicated Hosts allocated across multiple availability zones, and deploy Workload 2 on Azure Spot Virtual Machines.

Deploying the core transaction processing system on Azure Dedicated Hosts across multiple availability zones satisfies both the physical hardware isolation requirement and the zone-level high availability requirement. Deploying the batch risk-modeling application on Azure Spot Virtual Machines leverages the cost-savings of unused Azure capacity for workloads that are highly tolerant of interruptions.

Step-by-Step Solution

Analyze the requirements for Workload 1.

Workload 1 requires 24/7 steady-state operation, zone-level high availability, and physical isolation at the hardware level.

This establishes that multi-tenant Azure virtual machines (even with Reserved Instances) and Spot VMs are ruled out, requiring dedicated physical hardware (Azure Dedicated Hosts) configured across multiple availability zones.

Analyze the requirements for Workload 2.

Workload 2 runs on weekends, is highly parallelizable, can handle interruptions, and must be highly cost-effective.

This aligns perfectly with Azure Spot VMs, which utilize excess Azure capacity at a significant discount with the trade-off of potential eviction.

Evaluate the proposed options against the findings.

The strategy of deploying Workload 1 on Dedicated Hosts across zones and Workload 2 on Spot VMs satisfies all constraints.

This completes the selection of the correct two options while discarding options that violate high availability, physical isolation, or workload stability constraints.

Key Concept

Azure compute virtualization strategies matching isolation, cost-efficiency, and availability SLA requirements.

Question 560Question →

An organization is designing the storage architecture for two new workloads:

1. Workload A: A containerized application that requires a shared file system using the NFS 4.1 protocol. The storage must provide sub-millisecond latency and survive the outage of a single datacenter (zone) in the primary region.
2. Workload B: A reporting application that stores historical log archives as blobs. The archives must remain available for read operations even during a complete outage of the primary Azure region, without administrator intervention or triggering a storage account failover.

Which two storage configurations should you recommend to meet these requirements?

Select all that apply

For Workload A, deploy a Premium Files share in a storage account configured with Zone-Redundant Storage (ZRS).

For Workload A, deploy a Premium Files share in a storage account configured with Locally-Redundant Storage (LRS).

For Workload B, deploy a General Purpose v2 (GPv2) storage account configured with Read-Access Geo-Redundant Storage (RA-GRS).

For Workload B, deploy a General Purpose v2 (GPv2) storage account configured with Geo-Redundant Storage (GRS).

Show answer & explanation

Answer: For Workload A, deploy a Premium Files share in a storage account configured with Zone-Redundant Storage (ZRS).; For Workload B, deploy a General Purpose v2 (GPv2) storage account configured with Read-Access Geo-Redundant Storage (RA-GRS).

Answer

For Workload A, use a Premium Files share with Zone-Redundant Storage (ZRS). For Workload B, use a General Purpose v2 (GPv2) storage account with Read-Access Geo-Redundant Storage (RA-GRS).

The correct configurations are: (1) For Workload A, a Premium Files share with Zone-Redundant Storage (ZRS) because Premium Files is required for NFS 4.1 and low-latency workloads, and ZRS provides resilience against a single zone/datacenter outage in the primary region. (2) For Workload B, a General Purpose v2 (GPv2) storage account with Read-Access Geo-Redundant Storage (RA-GRS) because it allows the application to read the backup data from the secondary region endpoint immediately during a primary region outage without requiring a storage failover.

Step-by-Step Solution

Analyze the requirements for Workload A.

Workload A requires NFS 4.1, sub-millisecond latency, and zone-level resilience.

NFS 4.1 is only supported on Premium Files in Azure. To survive a zone outage, the Premium Files account must use Zone-Redundant Storage (ZRS).

Analyze the requirements for Workload B.

Workload B requires read access to blob data in a secondary region during a primary region outage, without manual failover or admin intervention.

Standard Geo-Redundant Storage (GRS) replicates data to a secondary region but does not allow read access unless a failover is triggered. Read-Access Geo-Redundant Storage (RA-GRS) provides a read-only endpoint in the secondary region that is accessible at all times, including during a primary outage, satisfying the zero-intervention requirement.

Key Concept

Selecting appropriate Azure Storage tiers and redundancy configurations based on protocol support (NFS 4.1), latency expectations, zone-level resilience, and read-access availability in secondary regions during outages.

PreviousPage 28 / 60Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept