All practice questions

An organization is deploying a latency-sensitive public web API using Azure Functions. The API experiences unpredictable traffic spikes but must respond to all requests with minimal delay. The organization wants to use a serverless billing model that scales dynamically while completely avoiding latency spikes caused by cold starts. Which Azure Functions hosting plan should you recommend?

A healthtech company is designing a containerized genomic analysis system on Azure. The system has the following requirements:
- A front-end web portal and internal API microservices must scale dynamically based on HTTP traffic and queue-based events using KEDA.
- Background worker containers must process genomic sequences, taking up to 3 hours per execution. These workers must run to completion and automatically release resources when idle.
- The compute hosting solution must minimize administrative overhead and avoid managing container orchestrators.
- For compliance and data sovereignty, the application logs of the genomic background workers must be strictly segregated from the front-end portal logs, ensuring complete data isolation, separate lifecycle retention, and regional isolation.

Which three recommendations should you include in the solution?

A logistics company is designing a global traffic routing and high-availability architecture for its hybrid fleet management platform deployed in the East US and North Europe regions.

The platform includes two distinct workloads:
1. A web application that requires edge-based SSL/TLS termination, URL path-based routing, and immediate session failover.
2. A high-throughput telemetry ingestion endpoint that communicates over a custom TCP port $8883$ (MQTT) and must route clients to the lowest-latency active datacenter.

Which global routing configuration should you recommend to meet these requirements with the lowest operational complexity?

An energy utility company is designing an analytical platform to process smart meter readings. The platform receives approximately $10$ million telemetry payloads per day, which are consolidated and written as Parquet files every hour to an Azure Data Lake Storage (ADLS) Gen2 account. Analysts need to perform occasional, ad-hoc exploratory SQL queries on the historical Parquet data to identify usage anomalies. The solution must survive a primary region datacenter outage, minimize operational costs, and avoid the use of credentials with a lifetime exceeding $30$ days. Which analytical and storage configuration should you recommend?

A retail company is designing a container-based solution to process inventory updates from an Azure Service Bus queue. The application consists of a single containerized worker that must scale dynamically based on the number of messages in the queue, including scaling to zero when the queue is empty. Each message takes up to 12 minutes to process due to dependencies on legacy external systems. The company requires a solution that minimizes administrative overhead and infrastructure management. Which hosting option should you recommend for the containerized worker?

An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-weur-hub` ($10.10.0.0/16$), hosts a central network virtual appliance (NVA) at IP address $10.10.1.4$ to inspect outbound internet traffic. The spoke virtual network, `vnet-prod-spoke` ($10.20.0.0/16$), contains a subnet named `snet-prod-web` ($10.20.1.0/24$) that hosts web servers. You need to configure the routing so that all outbound internet traffic from `snet-prod-web` is routed through the NVA, while internal communication within the spoke virtual network remains uninterrupted. Which two configurations should you implement? (Select two.)

A logistics company is designing a container-based processing solution for IoT telematics data. The solution requires:
- A public-facing API that receives sensor telemetry, which must scale dynamically based on concurrent HTTP requests.
- A batch processing workload that aggregates telemetry data every evening, which takes between 15 and 45 minutes to execute.
- All workloads must run in a secure environment with no public internet access for the backend processing components.
- The design must minimize administrative and operational effort.

Which two compute configurations should you recommend? (Select two.)

You are designing a backup solution for an Azure Virtual Machine that hosts a critical database. The virtual machine has the following characteristics:
* Uses Standard Premium SSD managed disks.
* Requires backups to be retained in a vault for $180$ days.
* Requires the ability to perform instant recoveries (near-zero Recovery Time Objective (RTO)) using local snapshots for any recovery point from the last $7$ days.
* The backup data must be resilient against a zone outage in the primary region.

Which backup configuration should you recommend?

Aetherius Manufacturing plans to integrate its on-premises Active Directory Domain Services (AD DS) directory with a Microsoft Entra ID tenant.

You need to design the identity and access management architecture. The solution must satisfy the following requirements:
- Ensure that users can authenticate to cloud services using their on-premises passwords, even if the on-premises domain controllers are offline.
- Enforce multi-factor authentication (MFA) for all administrative sessions to the Azure portal, while ensuring that dedicated emergency-access accounts remain accessible in the event of an MFA service disruption.
- Minimize the administrative overhead and the physical server footprint required for the identity sync solution.

Which two configurations should you include in the design to meet the requirements? (Select two.)

SolisTransport is designing a disaster recovery and business continuity solution for its maritime cargo tracking system. The tracking system writes voyage telemetry logs to a general-purpose v2 storage account in the East US region.

The solution must meet the following requirements:
- Recovery Point Objective (RPO): Under 15 minutes.
- Recovery Time Objective (RTO) for reads: Near 0 minutes. The application must be able to read tracking data from a secondary region (West US) immediately during a primary region outage, without waiting for Microsoft to declare a disaster or initiate a failover.
- Write Availability: Write capability in the secondary region is only required if the outage is prolonged and a failover is officially declared.
- Cost Constraints: Minimize storage costs and avoid the overhead of zone redundancy in the primary region.

Which storage configuration and recovery strategy should you recommend?

A financial technology (fintech) corporation is designing a container-based credit scoring engine. The engine will run as regional microservices deployed in both the Azure North Europe and US East regions to process local credit profiles.

The design must satisfy the following requirements:
* The compute platform must automatically scale replicas based on CPU utilization and must scale down to zero replicas during off-peak hours to minimize idle costs.
* The administrative effort required to manage host operating systems, Kubernetes control planes, and orchestrator upgrades must be minimized.
* Container logs must be collected and segregated to comply with strict regional data sovereignty regulations, ensuring that European credit profile logs are never stored in or co-mingled with US-based logs.

Which solution should you recommend?

An organization is designing a privileged access and governance strategy for its Azure tenant. The strategy must enforce Multi-Factor Authentication (MFA) for all administrative roles using Microsoft Entra Privileged Identity Management (PIM) and Conditional Access policies, while ensuring that the organization does not get locked out of the tenant during an Entra ID MFA service outage.

Which of the following configurations should you recommend?

You need to configure a Network Security Group (NSG) to allow outbound traffic from an Azure virtual network subnet to Azure SQL Database instances. The solution must block all other traffic to the internet, minimize administrative effort, and avoid manual IP address management when Azure services update their IP address ranges. Which destination setting should you specify in the outbound security rule of the Network Security Group?

A logistics company is designing the data redundancy strategy for two different storage workloads in Azure:

1. Workload A (Configuration Files): Requires protection against zone failures within the primary region, and must also be replicated to a secondary region to protect against regional disasters. Read-only access to the secondary region is not required.
2. Workload B (User Profile Images): Must survive a regional outage, and the application must be able to retrieve these images from the secondary region at all times (including during a primary region outage) without waiting for a customer-initiated or Microsoft-initiated failover. Zone redundancy is not required in the primary region.

Which two redundancy options should you select to meet the requirements of each workload? (Select two.)

A financial services company is designing a global document-sharing platform. The architecture stores document metadata in Azure Cosmos DB for NoSQL and the PDF files in Azure Blob Storage. The system expects a $70:30$ read-to-write ratio, requires a $99.999\%$ read and write availability SLA, and must survive a regional datacenter outage. The PDF files must be accessible to external clients using temporary, revocable links. Which design combination should you recommend to meet these requirements?

An organization wants to delegate custom permissions to a development team. The team needs the ability to restart and manage virtual machines across all subscriptions nested under the 'R&D' management group. You must design a custom role that permits virtual machine management operations but explicitly prevents virtual network configuration modifications. The custom role must be scope-constrained so it can only be assigned to subscriptions under the 'R&D' management group. You need to create this custom role and assign it to the development team's Microsoft Entra ID group. Which sequence of actions should you perform?

A manufacturing company is designing an analytical data platform to monitor and analyze assembly line operations. The platform must meet the following requirements:
- Store $5$ TB of historical machine telemetry in CSV format.
- Ingest real-time sensor streams at a rate of $10,000$ events per second ($10$ MB/s).
- Perform real-time anomaly detection with a processing latency of less than $2$ seconds.
- Support ad-hoc exploratory SQL queries over the historical CSV data with execution times under $30$ seconds, without the operational overhead of a running cluster.
- Ensure the storage solution remains available if a primary zone within the Azure region experiences an outage.

Which two components should you include in the design to meet these requirements? (Select TWO.)

An enterprise is designing a secure hub-and-spoke network topology in Azure. The topology consists of the following components:

* A hub virtual network named `vnet-prod-hub` ($10.100.0.0/16$) containing:
* A subnet named `snet-nva` ($10.100.1.0/24$) that hosts a Network Virtual Appliance (NVA) at IP address $10.100.1.4$.
* A subnet named `GatewaySubnet` ($10.100.2.0/24$) that hosts an ExpressRoute Virtual Network Gateway.
* A peered spoke virtual network named `vnet-prod-spoke` ($10.200.0.0/16$) containing a subnet named `snet-app` ($10.200.1.0/24$).

The ExpressRoute gateway connects to an on-premises network ($192.168.0.0/16$). Virtual network peering is configured to allow gateway transit.

You need to design a routing solution that meets the following requirements:
1. All traffic from `snet-app` destined for the on-premises network must be inspected by the NVA.
2. All traffic from the on-premises network destined for `snet-app` must be inspected by the NVA.
3. The NVA must be able to forward inspected traffic to its final destination without routing loops or losing connectivity.

Which two configurations should you include in the design?

An enterprise is designing a multi-region disaster recovery and traffic routing architecture for several distinct workloads. Match each traffic routing and failover requirement to the most appropriate Azure service.

A digital media publishing company is designing a new platform on Azure to manage content delivery and media transformation. The platform has the following components:

* A set of front-end and back-end API microservices that experience highly variable HTTP traffic and must scale to zero instances during idle periods to minimize costs.
* A video-rendering service that requires deploying custom Kubernetes Custom Resource Definitions (CRDs) and custom operators to orchestrate rendering tasks.
* A background analytics worker that must process message queues and requires Event-Driven Autoscaling (KEDA) integration.

The design must minimize administrative overhead where possible.

Which two container hosting solutions should you recommend? (Select two.)