All practice questions

Solas Renewable Energy is designing an identity and access management solution for its Microsoft Entra ID tenant. The solution must meet the following requirements:

- Enforce multi-factor authentication (MFA) for all users assigned to privileged administrator roles when they access the Azure portal.
- Prevent administrative users from being permanently assigned to privileged roles, requiring them to activate roles on demand.
- Ensure that the tenant remains accessible to administrators even during a widespread Microsoft Entra MFA service outage.

Which of the following configurations should you include in the design? (Select TWO.)

An automotive manufacturing corporation is designing a container-based telemetry and diagnostics platform on Azure. The platform will be deployed across two European regions. The design must meet the following requirements:
- A set of internal REST APIs must process incoming vehicle diagnostics data.
- A background analytics engine must process messages from an Azure Service Bus queue and scale to zero when no messages are present.
- A third-party security agent must run as a privileged DaemonSet on every container host node to inspect kernel-level system calls.
- Telemetry and logs collected from the workloads in each region must be isolated and stored only within that specific region to meet strict local data residency compliance.

You need to recommend the container hosting and monitoring architecture.

Which solution should you recommend?

A manufacturing company is designing a container-based quality control system on Azure. The system will run image classification models on images uploaded by factory cameras. The workloads have the following requirements:
- Scale up rapidly in response to a sudden influx of images uploaded to an Azure Blob Storage container.
- Scale down to zero when there are no images to process to minimize idle compute costs.
- Support event-driven scaling using KEDA without requiring the team to manage Kubernetes APIs, node pools, or cluster upgrades.

Which compute solution should you recommend?

An organization is designing a serverless backend for an enterprise batch import system. The system must process files uploaded to an Azure Blob Storage container. The architectural design must satisfy the following technical constraints:

- Execution Time: The file processing logic is single-threaded and can take up to 15 minutes to complete for large payloads.
- Network Isolation: The compute resource must securely access an Azure SQL Database and storage accounts via private endpoints within an Azure Virtual Network (VNet).
- Cost Efficiency: The compute resource must automatically scale down to zero instances when there are no files to process, ensuring zero billing during idle periods.
- Operational Overhead: Minimize administrative overhead by avoiding the need to configure, build, or deploy custom Docker container images or manage container registries.

Which Azure compute hosting option should you recommend to meet these requirements?

Verdant Power Solutions is designing a business continuity solution for an application that processes wind turbine telemetry data. The application continuously writes transactional log files to an Azure Storage account.

The solution must satisfy the following requirements:
- Recovery Point Objective (RPO): Less than $15$ minutes.
- Recovery Time Objective (RTO): Less than $30$ minutes.
- Read availability: Telemetry data must remain readable from a secondary region during a primary region outage.
- Write availability: Write capabilities must be restored in the secondary region within the RTO during a primary region outage.
- Cost: Storage costs must be minimized.

Which storage redundancy configuration and disaster recovery procedure should you recommend?

Your company has an on-premises datacenter connected to an Azure Virtual Network (VNet) via a site-to-site VPN. You are designing a secure private access solution for a business-critical application running on virtual machines in the VNet. The application needs to connect to an Azure SQL Database. You must meet the following requirements:
- The Azure SQL Database must not accept connections from the public internet.
- The virtual machines must access the database using private IP addresses.
- On-premises database administrators must be able to manage the database using private IP addresses.
- On-premises DNS servers must resolve the database FQDN to its private IP address.
- Administrative overhead for security rule maintenance and DNS routing must be minimized.

Which network security design should you recommend?

A media streaming company hosting its application in the Azure North Europe region wants to design a disaster recovery (DR) solution to the West Europe region. The application runs on two Azure virtual machines (VMs):

- `vm-web`: A web server VM with one Standard SSD disk that has a write churn rate of $3\text{ MB/s}$.
- `vm-db`: A SQL Server database VM with two Premium SSD disks: a data disk with a write churn rate of $12\text{ MB/s}$ and a log disk with a write churn rate of $25\text{ MB/s}$.

The disaster recovery solution must achieve a Recovery Point Objective (RPO) of 2 hours and a Recovery Time Objective (RTO) of 4 hours.

Which disaster recovery configuration should you recommend to meet these requirements?

Your company has an Azure environment with a hub virtual network named `vnet-hub-prod` ($10.10.0.0/16$) that contains a Virtual Network Gateway, and a spoke virtual network named `vnet-spoke-app` ($10.20.0.0/16$). You configure Virtual Network Peering between `vnet-hub-prod` and `vnet-spoke-app`. You need to ensure that virtual machines in `vnet-spoke-app` can access your on-premises network through the gateway in `vnet-hub-prod`. Which two configuration settings should you select? (Select two.)

A telecommunications provider is designing an analytical data platform to process and query call detail record (CDR) log files. The platform must meet the following requirements:
- Ingest $50\text{ GB}$ of CDR files daily at a peak velocity of $200$ files per minute.
- Store the raw logs cost-effectively in Azure Data Lake Storage Gen2 (ADLS Gen2).
- Enable analysts to run ad-hoc, exploratory SQL queries directly on the raw files with a query latency of under $15\text{ seconds}$.
- Orchestrate a weekly batch transformation job that aggregates the CDR data, which typically takes $25\text{ minutes}$ to run.
Which of the following Azure components should you include in the design to meet these requirements? (Select TWO.)

An energy utility company is designing a smart grid monitoring platform on Azure. The system will ingest real-time telemetry from 10 million smart meters globally. The architecture has the following requirements:

* Raw telemetry payloads must be stored in an Azure Storage account. The storage account must survive a regional outage.
* A third-party auditing application must be granted temporary read-only access to the raw payloads for a maximum of 2 hours, with the ability to revoke access immediately if credentials are leaked.
* Metadata and event indexing records must be stored in Azure Cosmos DB for NoSQL. The database must sustain a write-heavy ingestion rate (90% writes, 10% reads) and achieve $99.999\%$ write availability.
* Telemetry records in Cosmos DB contain `meterId` (unique per meter), `readingDate` (daily format), `postalCode` (geographic region), and `usageValue`. Queries typically filter by `meterId` and `readingDate`.

You need to recommend the partition key for Azure Cosmos DB, the redundancy configuration for the storage account, and the security configuration for the auditing application.

Which combination should you recommend?

A digital banking platform is designing a storage solution for historical transaction records. The data will be stored in an Azure General Purpose v2 (GPv2) storage account. The platform's disaster recovery and high availability policies dictate the following constraints:

* The data must remain accessible even if a single datacenter in the primary region experiences a complete power outage.
* In the event of a major regional disaster affecting the primary region, the data must be recoverable in a secondary paired region.

Which two redundancy options satisfy these requirements? (Select two.)

A company has virtual machines (VMs) deployed in a subnet of an Azure virtual network. The VMs must securely access Azure Storage accounts. The design must block all general outbound internet traffic, prevent the need to manually update rules when Azure Storage IP addresses change, and minimize administrative overhead. Which two configurations should you include in the network security design?

An enterprise is designing a subscription governance model to manage resources across multiple departments. You need to implement a management group hierarchy and delegate resource access using a custom Azure RBAC role. The solution must ensure that administrative access is inherited across all department subscriptions and adheres to the principle of least privilege.

Which sequence of steps should you perform?

A healthcare provider is designing a container-based claims processing application on Azure. The application has the following design requirements:

* A REST API microservice must receive claims and scale out rapidly during peak business hours, and scale down to zero instances during periods of inactivity.
* A background reporting workload must execute containerized jobs that process large datasets on a scheduled basis, with each job taking up to 45 minutes to complete.
* The overall solution must minimize administrative and infrastructure management overhead.

Which two Azure container hosting solutions should you recommend to meet these requirements? (Choose two.)

An enterprise is designing a serverless and containerized architecture for a financial reconciliation platform. The system requires hosting two workloads with distinct execution behaviors and networking constraints:

* Workload 1: An API gateway helper that intercepts and validates inbound transactions. It experiences unpredictable, highly spiked traffic (from 0 to thousands of concurrent requests) with long periods of complete inactivity. To access protected on-premises ledger databases, this workload requires integration with an Azure Virtual Network (VNet). Minimizing idle infrastructure costs is critical.
* Workload 2: A batch reconciliation job that runs once daily. The job retrieves transaction logs, executes complex audit rules, and typically runs for 40 minutes. It must also run within a private subnet to securely communicate with back-end databases, and the team wants to minimize operational overhead.

Which two of the following Azure compute solutions should you recommend to support these workloads? (Select TWO.)

A global maritime logistics enterprise is designing a disaster recovery (DR) solution to replicate workloads from Azure North Europe to West Europe. The tracking architecture consists of two main virtual machines:

- `vm-track1`: Hosts the cargo tracking API and contains a Standard SSD OS disk with a write churn of $1\text{ MB/s}$ and a Premium SSD data disk with a write churn of $8\text{ MB/s}$ (total VM churn of $9\text{ MB/s}$).
- `vm-db1`: Hosts a high-transaction PostgreSQL database and contains a Premium SSD OS disk with a write churn of $2\text{ MB/s}$ and two Premium SSD data disks: Data Disk 1 with a write churn of $15\text{ MB/s}$ and Data Disk 2 with a write churn of $22\text{ MB/s}$ (total VM churn of $39\text{ MB/s}$).

The DR solution must guarantee a Recovery Point Objective (RPO) of $10\text{ minutes}$ and a Recovery Time Objective (RTO) of $1\text{ hour}$ for both workloads.

Which two actions should you include in the disaster recovery design to meet the requirements?

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-core` ($10.10.0.0/16$), hosts an Azure Firewall at $10.10.4.4$ and an ExpressRoute Virtual Network Gateway. The ExpressRoute gateway connects to the on-premises network ($192.168.0.0/16$) and receives a default route ($0.0.0.0/0$) via BGP to force-tunnel all internet traffic to the on-premises security appliance. A spoke virtual network, `vnet-prod-spoke` ($10.20.0.0/16$), hosts a web application in `snet-web` ($10.20.1.0/24$) and a database in `snet-db` ($10.20.2.0/24$). You need to design a routing solution for `snet-web` to meet the following requirements:
- All traffic to other spoke virtual networks (which use the $10.0.0.0/8$ address space) and the on-premises network must be routed through the Azure Firewall.
- Web servers in `snet-web` must communicate directly with the database in `snet-db` without passing through the Azure Firewall to minimize latency.
- All internet-bound traffic must be forced to the on-premises network via the ExpressRoute gateway.

Which route table configuration should you associate with `snet-web`?

A company is designing a data storage solution for a medical telemetry application. The application writes telemetry logs directly to an Azure Blob Storage General Purpose v2 (GPv2) account.

The logs must be managed according to the following requirements:
- For the first $30$ days after creation, logs must be immediately readable with sub-second latency to support real-time dashboards.
- Between day $31$ and day $90$, logs are rarely accessed but must remain online and readable within $10$ minutes for ad-hoc audit queries.
- After $90$ days, logs must be retained for compliance for a total of $3$ years ($1,095$ days) from creation. A retrieval latency of up to $15$ hours is acceptable for compliance queries.
- The lifecycle management strategy must minimize total storage costs.

You need to design a lifecycle management policy that meets these requirements while avoiding early deletion charges. Which lifecycle action sequence should you recommend?

You are designing a network security solution for an Azure virtual network. A subnet named Subnet1 contains 30 Azure virtual machines that need to retrieve cryptographic keys from Azure Key Vault. You must allow these virtual machines to make outbound connections to Azure Key Vault while blocking all other outbound access to the public internet. The solution must minimize the administrative effort required to maintain network security rules. Which of the following should you recommend including in the design?

Match each traffic routing and failover requirement with the most appropriate Azure load balancing or traffic routing service configuration. Each service configuration may be used once, more than once, or not at all.