All practice questions

Meridian Global Logistics is designing an identity security strategy for its hybrid cloud environment. The organization synchronizes its on-premises Active Directory Domain Services (AD DS) directory to Microsoft Entra ID using Password Hash Synchronization (PHS). You need to design an access control solution that meets the following security requirements:
- Enforce Multi-Factor Authentication (MFA) for administrative access to the Azure management portal.
- Ensure that administrators only assume privileged roles when performing administrative tasks, rather than having persistent access.
- Guarantee that emergency access (break-glass) accounts remain functional to prevent tenant lockout during an MFA system outage.

Which of the following designs should you recommend?

A regional healthcare provider is designing an identity and access management solution for its IT operations team, which manages Azure resources. The solution must meet the following requirements:
- Manage permissions at scale without administrative overhead when members join or leave the team.
- Ensure that administrators do not have persistent access to high-privilege roles, requiring them to request access only when performing active maintenance.
- Maintain a break-glass emergency access account that is guaranteed access to the tenant even during a Microsoft Entra ID authentication outage.

Which two configurations should you include in the design? (Select two.)

You are designing a backup solution for a pool of Azure Virtual Machines hosting a business application. The solution must meet the following requirements:
- Retain daily backups for $30$ days.
- Retain weekly backups for $3$ years and store them in the most cost-effective storage tier available.
- Ensure backup data is resilient against a zone outage within the primary region.

Which two configurations should you include in the backup design?

VeloStyle Retail is designing a disaster recovery and business continuity solution for its product catalog images, which are stored in a general-purpose v2 Azure Storage account in the East US region.

The solution must meet the following requirements:
- During a primary region outage, the application must maintain read access to the images from the secondary region (West US) with a Recovery Time Objective (RTO) of zero.
- The application must support writing new images once a failover to the secondary region is initiated.
- Regional resilience must be maximized, while keeping replication costs minimized compared to multi-zone cross-region setups.

Which two actions should you include in the design to meet these requirements? (Select TWO.)

An architect is designing a virtual network topology in Azure to support a hybrid cloud environment. The design includes a hub virtual network named `vnet-prod-hub` and a spoke virtual network named `vnet-prod-spoke`. The hub virtual network contains a virtual network gateway that connects to the company's on-premises office. A virtual network peering connection is established between `vnet-prod-hub` and `vnet-prod-spoke`. You need to ensure that virtual machines in `vnet-prod-spoke` can route their traffic to the on-premises office by using the virtual network gateway in `vnet-prod-hub`. What peering setting should you enable on the virtual network peering configuration in `vnet-prod-spoke`?

Your company has virtual machines deployed in an Azure Virtual Network subnet. The virtual machines must be allowed to retrieve secrets from Azure Key Vault and access files stored in Azure storage accounts. You need to configure a Network Security Group (NSG) to permit this outbound traffic. The design must minimize administrative overhead and avoid the configuration of individual IP addresses. Which two service tags should you include in the outbound security rules of the NSG?

An architect is evaluating Azure compute options for a web API. The solution must satisfy the following requirements:

- Process incoming HTTP requests that trigger complex calculations lasting up to $15$ minutes.
- Establish secure outbound communication to a backend database via a Private Endpoint inside an Azure Virtual Network (VNet).
- Automatically scale down to zero instances during idle periods to eliminate compute charges.
- Minimize administrative and infrastructure management overhead.

Which hosting option should the architect recommend?

A company is designing a storage solution using a General Purpose v2 storage account to store block blobs containing media files for a web application in the East US region. The storage solution must meet the following requirements:

* Provide resilience against the outage of a single datacenter zone within the primary region.
* Provide regional disaster recovery by replicating the data to a secondary region.
* Minimize costs by avoiding charges for read access to the secondary region, which is not required.

Which redundancy option should you select for the storage account?

An organization hosts a critical financial web application in the Canada Central region. The application architecture consists of the following components:

- Two web server virtual machines (`Web-VM1` and `Web-VM2`), each containing a single $127\text{ GB}$ Standard SSD disk with a write churn of $1.5\text{ MB/s}$ per disk.
- One database virtual machine (`DB-VM1`) running Microsoft SQL Server with a total VM write churn of $50\text{ MB/s}$. The virtual machine has three disks: an OS disk (Standard SSD, $2\text{ MB/s}$ write churn), a database data disk (Premium SSD v1, $14\text{ MB/s}$ write churn), and a transaction log disk (Premium SSD v1, $34\text{ MB/s}$ write churn).

The organization is designing a disaster recovery (DR) solution to the Canada East region. The design must meet the following objectives:

- A recovery time objective (RTO) of $2\text{ hours}$ for the entire application.
- A recovery point objective (RPO) of $4\text{ hours}$ for the web servers.
- A recovery point objective (RPO) of $10\text{ seconds}$ for the database server.

Which disaster recovery strategy should you recommend?

A digital marketing agency is designing an analytical data platform to query ad campaign click logs. The logs are uploaded daily as Parquet files to Azure Data Lake Storage (ADLS) Gen2, totaling $1.5\text{ TB}$ of new data per day. Analysts will run infrequent, ad-hoc exploratory T-SQL queries that must run directly against the storage account. The platform must survive a primary regional datacenter outage, minimize operational costs, and secure data access without utilizing long-lived access keys.

Which architecture should you recommend to meet these requirements?

A media streaming company is designing a container-based processing solution for transcribing audio files. The transcoder containers run as background tasks that can take up to 45 minutes to process large files. The solution must scale dynamically based on the number of audio files uploaded to Azure Blob Storage, scale to zero when no files are present, and minimize operational overhead. Which solution should you recommend?

An organization needs to design a secure administration path for its development workloads. Developers must be able to establish Remote Desktop Protocol (RDP) connections to virtual machines over the internet. The solution must restrict public internet exposure by ensuring the virtual machines do not have public IP addresses, and it must avoid the management overhead of client-based virtual private network (VPN) software. Which service should you recommend to meet these requirements?

An organization is designing a hub-and-spoke virtual network topology in Azure to host a multi-tier web application. The topology consists of the following components:

* A hub virtual network named `vnet-eus-hub` ($10.100.0.0/16$) hosting an Azure Firewall at IP address $10.100.10.4$.
* A production spoke virtual network named `vnet-eus-prod` ($10.101.0.0/16$) peered with the hub virtual network.
* Three subnets inside `vnet-eus-prod`:
* `subnet-web` ($10.101.1.0/24$)
* `subnet-app` ($10.101.2.0/24$)
* `subnet-db` ($10.101.3.0/24$)

The design must satisfy the following routing requirements:
1. All outbound internet traffic from `subnet-web` must be inspected by the Azure Firewall in the hub.
2. All traffic between `subnet-web` and `subnet-app` must be inspected by the Azure Firewall in the hub.
3. Traffic between `subnet-app` and `subnet-db` must bypass the Azure Firewall and remain local within `vnet-eus-prod` to minimize latency.
4. You must minimize administrative overhead and avoid configuring redundant route rules.

Which route table configuration should you implement to meet the requirements?

You are designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-prod` ($10.100.0.0/16$), contains an active Virtual Network Gateway connected to your on-premises datacenter. The spoke virtual network, `vnet-spoke-app` ($10.101.0.0/16$), contains your application workloads. You configure virtual network peering between `vnet-hub-prod` and `vnet-spoke-app`. You need to ensure that the resources in `vnet-spoke-app` can communicate with the on-premises datacenter by using the gateway in `vnet-hub-prod`. Which two configurations should you perform to meet these requirements?

An organization is designing the identity security and authentication strategy for its Microsoft Entra ID tenant. You need to match the business and security requirements to the correct Microsoft Entra ID or Conditional Access feature. Match each requirement on the left to its corresponding feature on the right.

A logistics company is designing a global shipment tracking system that will run on Azure Cosmos DB for NoSQL. The application must process real-time coordinate updates from 500,000 active delivery vehicles. The workload is highly write-heavy, with an expected write-to-read ratio of 95:5. The system must support global distribution across three Azure regions with a 99.999% availability SLA for both reads and writes, keeping write latency under 10 milliseconds. You need to design the Cosmos DB configuration and choose a partition key to prevent hot partitions while meeting the SLA. Which configuration should you recommend?

A financial services firm is designing the Azure storage architecture for two distinct workloads using Azure Blob Storage:

1. Workload A (Transaction Logs): Must be resilient to the failure of a datacenter within the primary region without data loss, must be replicated to a secondary region to protect against regional disasters, and does not require read access to the secondary region unless a failover is initiated.
2. Workload B (Reporting Data): Must be resilient to the failure of a datacenter within the primary region without data loss, must be replicated to a secondary region, and must allow reporting applications to read data from the secondary region without waiting for a failover to be initiated.

Which two redundancy options should you select to meet the requirements for Workload A and Workload B? (Select two.)

You are designing the serverless hosting infrastructure for an enterprise application that contains two distinct workloads:

* Workload 1: An HTTP-triggered API that processes incoming vendor requests. The API must access a backend database located in a secured Azure Virtual Network (VNet). The traffic is highly intermittent, with several hours of inactivity followed by unpredictable spikes. To minimize operating costs, the solution must scale to zero instances and incur no compute charges when idle.
* Workload 2: A queue-triggered background job that performs daily inventory synchronization. Each execution takes approximately 18 minutes to complete. The job must run on a serverless compute model that scales to zero when the queue is empty, and it must not experience timeout failures.

Which two hosting plans should you recommend to meet the requirements for both workloads? (Select two.)

An enterprise is designing a subscription governance and access control model for its Azure environment. The environment consists of three business units: Finance, Retail, and Logistics. Each business unit has separate development and production subscriptions.

The design must meet the following requirements:
- Enable central IT to enforce compliance policies across all subscriptions.
- Allow the security audit team to view resource configurations in all subscriptions without viewing data plane payloads.
- Allow business unit administrators to manage resources only within their respective subscriptions.
- Follow the principle of least privilege and minimize administrative overhead.

Which two actions should you include in the governance design? (Select TWO.)

An organization is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-core` (address space: $10.1.0.0/16$), hosts a central network virtual appliance (NVA) at IP address $10.1.1.4$ that provides firewall and inspection services. The spoke virtual network, `vnet-spoke-data` (address space: $10.2.0.0/16$), contains two subnets: `snet-db` ($10.2.1.0/24$) hosting database servers, and `snet-app` ($10.2.2.0/24$) hosting application servers. The networks are connected via virtual network peering.

The security policy requires that all outbound internet traffic from the database servers in `snet-db` must be inspected by the hub NVA. However, database servers must communicate directly with application servers in `snet-app` within the same virtual network without routing through the hub NVA, minimizing latency and transaction costs.

To achieve this configuration, a custom route table will be associated with the `snet-db` subnet. Which route configuration should be added to the route table?