Examkin

All practice questions

1198 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 661Question →

Zenith Financial Services is designing the identity security and authentication strategy for its Microsoft Entra ID tenant. The organization requires that all administrator roles use Multi-Factor Authentication (MFA). To prevent total tenant lockout during a regional authentication outage, the security team requires the creation of two emergency access accounts.

Which design decision should you recommend to meet these requirements?

Show answer & explanation

Answer: Configure a Conditional Access policy that requires MFA for all administrator roles, exclude the emergency access accounts from the policy, and assign the administrator roles to users as eligible in Microsoft Entra Privileged Identity Management (PIM).

Answer

Configure a Conditional Access policy that requires MFA for all administrator roles, exclude the emergency access accounts from the policy, and assign the administrator roles to users as eligible in Microsoft Entra Privileged Identity Management (PIM).
The correct solution involves configuring a Microsoft Entra Conditional Access policy that mandates Multi-Factor Authentication (MFA) for administrative roles, while explicitly excluding the designated emergency access accounts. To maintain security best practices, administrative permissions should be assigned as eligible via Privileged Identity Management (PIM) rather than permanently active. This ensures just-in-time activation and minimizes the standing privilege attack surface.

Step-by-Step Solution

1
Evaluate the requirement for enforcing administrative MFA while avoiding lockout.
Identify that a Conditional Access policy must target administrative roles to enforce MFA, but must also contain an explicit exclusion rule for emergency (break-glass) accounts.
Omitting exclusions for emergency access accounts risks permanent tenant lockout if Microsoft Entra MFA is unavailable or misconfigured.
2
Determine the optimal administrative role assignment strategy.
Recommend Microsoft Entra Privileged Identity Management (PIM) with 'eligible' role assignments rather than permanent activation.
Eligible assignments support the principle of least privilege by requiring just-in-time activation and justification.
3
Assess the hybrid authentication options.
Reject AD FS deployment as a solution for cloud-based lockout.
AD FS introduces heavy infrastructure overhead, and cloud-only emergency accounts should not depend on on-premises components anyway.

Key Concept

Conditional Access policies should enforce MFA for administrative accounts while excluding cloud-only emergency access accounts to prevent tenant lockout, complemented by PIM for just-in-time role activation.
Question 662Question →

A healthcare technology company is designing a secure cloud-native application on Azure to process patient data. The application requires two primary workloads:

* A front-end REST API that handles user requests, runs continuously, and scales dynamically based on incoming HTTP request volume.
* A background processing component that executes complex medical image analysis tasks. Each analysis task takes between 15 to 45 minutes to complete, must run in its own isolated container environment, and must scale down to zero when no tasks are in the queue.

You need to recommend a compute solution for the application. The design must minimize administrative and operational overhead.

Which two compute options should you recommend?

Select all that apply

Show answer & explanation

Answer: Azure Container Apps to host the front-end REST API; Azure Container Apps jobs to host the background medical image analysis tasks

Answer

Azure Container Apps to host the front-end REST API, and Azure Container Apps jobs to host the background medical image analysis tasks
The correct recommendation uses Azure Container Apps for the front-end REST API and Azure Container Apps jobs for the background medical image analysis. Azure Container Apps handles continuous HTTP-triggered workloads with automatic scaling and zero cluster management. Azure Container Apps jobs are designed for run-to-completion, event-triggered execution (such as processing from a queue) and support long-running processes up to multiple hours, which easily accommodates the 15 to 45-minute medical image analysis tasks while scaling down to zero when idle and minimizing management overhead.

Step-by-Step Solution

1
Analyze the REST API workload requirements.
The API runs continuously, scales based on HTTP requests, and needs minimal management. Azure Container Apps (ACA) provides serverless container hosting that scales on HTTP traffic and requires very low administrative overhead.
This establishes the best service for the web/API component.
2
Analyze the background image analysis workload requirements.
The background tasks are run-to-completion jobs that take 15 to 45 minutes. This exceeds the 10-minute timeout of serverless options like Azure Functions Consumption plans. Azure Container Apps jobs support longer executions, run containers in isolation, scale to zero, and have low overhead.
This establishes the best service for the long-running batch job component.
3
Evaluate the design constraints for operational efficiency.
Azure Kubernetes Service (AKS) meets the technical capability but introduces high management overhead (cluster upgrades, node pools), violating the 'minimize administrative effort' constraint. Therefore, AKS is ruled out.
This filters out viable but operationally heavy alternatives.

Key Concept

Azure Container Apps and Jobs vs. AKS and Serverless Functions
Question 663Question →

StreamPulse Media is designing a disaster recovery and business continuity solution for video assets stored in Azure Blob Storage. The solution must meet the following requirements:
- Video files uploaded to a container named 'ingest' in the East US region must be copied to a container named 'archive' in the West US 2 region within 15 minutes of upload.
- The destination container in West US 2 must support immediate read and write operations, even while the East US region is fully online.
- Costs must be minimized by avoiding geo-redundant storage replication for all other containers in the storage accounts.

Which two actions should you include in the design?

Select all that apply

Show answer & explanation

Answer: Configure Azure Blob Storage object replication from the source container in East US to the destination container in West US 2.; Create the source and destination storage accounts using Locally Redundant Storage (LRS).

Answer

Configure Azure Blob Storage object replication from the source container in East US to the destination container in West US 2, and create the source and destination storage accounts using Locally Redundant Storage (LRS).
Object replication is the correct choice because it natively replicates block blobs at the container level between different storage accounts in different regions. This allows the destination container in West US 2 to remain read/write enabled even when the source region is online. Combined with Locally Redundant Storage (LRS) for the storage accounts, this minimizes storage costs by avoiding geo-replication for the rest of the storage account data.

Step-by-Step Solution

1
Analyze the requirements for container-level cross-region copying and immediate read/write access.
Identify that standard geo-redundant storage (GRS/RA-GRS) replication does not allow writing to the secondary region under normal operations and replicates the entire account.
A replication mechanism that supports active read/write in both regions at the container level is required.
2
Select the appropriate native replication feature.
Azure Blob Storage object replication supports block blob replication at the container level between different storage accounts.
This allows the destination container to remain read/write active while avoiding replication of other containers in the source account.
3
Determine the lowest cost storage configuration for the accounts.
Configure both source and destination storage accounts with Locally Redundant Storage (LRS).
Since replication is handled at the object/container layer, geo-redundancy at the storage account level is not required, minimizing overall cost.

Key Concept

Azure Blob Storage Object Replication permits granular container-level replication across storage accounts in different regions, keeping the target writeable, whereas geo-redundant options (like RA-GRS) are account-wide and read-only in the secondary region.
Question 664Question →

A retail chain is designing a data analytics solution to analyze customer purchase history logs. The logs are uploaded nightly as CSV files to Azure Storage and total approximately 10 GB10\text{ GB} per day. The data analysts require the ability to run ad-hoc T-SQL queries directly against these CSV files to identify shopping trends. The queries are run infrequently, primarily during business hours. The solution must minimize operational overhead, avoid costs for idle compute resources, and ensure the storage tier survives a primary datacenter outage.

Which of the following database and storage configurations should you recommend?

Show answer & explanation

Answer: Azure Synapse Analytics serverless SQL pool querying data stored in Geo-Redundant Storage (GRS)

Answer

Azure Synapse Analytics serverless SQL pool querying data stored in Geo-Redundant Storage (GRS)
A serverless SQL pool in Azure Synapse Analytics is the ideal cost-effective choice for ad-hoc exploration of CSV files in storage, as users are billed only for data processed and there is no active cluster footprint or idle compute cost. Geo-Redundant Storage (GRS) provides durability against a primary datacenter outage by replicating the data to a secondary region.

Step-by-Step Solution

1
Analyze the query and resource requirements
Infrequent ad-hoc queries against CSV files with zero idle compute costs require a serverless query engine such as Synapse serverless SQL pools.
Dedicated compute models incur ongoing execution costs when no queries are running, whereas serverless models only bill per TB of data processed.
2
Analyze the resiliency requirements
Survival of a primary datacenter outage requires geo-replication.
Locally Redundant Storage (LRS) is confined to a single datacenter, so Geo-Redundant Storage (GRS) is required to ensure data survivability in another region.
3
Combine query and resiliency components to form the optimal recommendation
Azure Synapse Analytics serverless SQL pool combined with Geo-Redundant Storage (GRS).
This configuration meets all requirements for query format, cost efficiency, low operational overhead, and regional resilience.

Key Concept

Selecting the appropriate Azure Synapse query model and storage redundancy level for ad-hoc analytical workloads.
Estimated Time:1m 30s
Question 665Question →

An enterprise is designing a secure network architecture in Azure for a processing workload. The architecture contains:

- A subnet named Subnet-Workload hosting several Virtual Machines (VMs) that do not have public IP addresses.
- An Azure Storage account containing critical data that the VMs must access.
- An Azure SQL Database that the VMs must query.

The design must satisfy the following security and administrative constraints:
- Direct administrative RDP/SSH access to the VMs must be provided securely without provisioning public IPs on the VMs, utilizing a fully managed PaaS solution.
- All database and storage traffic from the VMs must utilize private IP addresses within the virtual network and bypass the public internet.
- Network security rules must restrict outbound traffic from Subnet-Workload to only allowed Azure services with minimal maintenance overhead.
- Virtual network routing must not disrupt default traffic flow within the virtual network.

Which two solutions should you include in the architecture? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy Azure Bastion in a dedicated subnet named AzureBastionSubnet to manage VM access.; Deploy Private Endpoints for the Azure SQL Database and the Azure Storage account in the virtual network.

Answer

Deploy Azure Bastion in a dedicated subnet named AzureBastionSubnet to manage VM access, and deploy Private Endpoints for the Azure SQL Database and the Azure Storage account in the virtual network.
Deploying Azure Bastion in a dedicated subnet enables secure administrative access via RDP and SSH directly from the Azure portal over TLS, eliminating the need for public IPs on the workload VMs. Deploying Private Endpoints for the Azure SQL Database and the Azure Storage account assigns private IP addresses from the virtual network to these services, securing the traffic on Microsoft's backbone network and eliminating exposure to the public internet.

Step-by-Step Solution

1
Evaluate the administrative access requirement to determine the most secure, low-overhead solution.
Azure Bastion is identified as the optimal fully managed PaaS solution to provide RDP/SSH access without public IPs.
This satisfies the constraint of secure administrative access without public IP addresses and with minimal effort.
2
Determine the secure private access mechanism for Azure SQL Database and Azure Storage.
Private Endpoints are selected to assign private IP addresses to these services within the virtual network.
This ensures all data traffic is kept off the public internet and conforms to the private access requirement.
3
Analyze the network security group requirements for service traffic.
Service Tags should be used instead of manually defined public IP address ranges.
Using individual IP rules increases operational complexity and violates the constraint of minimal maintenance overhead.
4
Verify routing requirements to ensure internal connectivity is preserved.
Default system routing is maintained without introducing overlapping custom user-defined routes that block local traffic.
This avoids breaking internal communications within the virtual network.

Key Concept

Designing secure administrative access and private access to Azure resources using Azure Bastion and Private Endpoints, while avoiding administrative overhead in routing and network security groups.
Estimated Time:2m 30s
Question 666Question →

You are designing the network security for an Azure solution. A group of virtual machines in an Azure virtual network subnet must be permitted to make outbound connections to Azure Key Vault. You need to define a rule in a Network Security Group (NSG) to allow this traffic. The solution must minimize administrative overhead and avoid the need to manually maintain changing IP address ranges. What should you specify as the destination in the NSG outbound rule?

Show answer & explanation

Answer: The AzureKeyVault Service Tag

Answer

The AzureKeyVault Service Tag
The AzureKeyVault Service Tag is a system-defined identifier that represents the public IP address prefixes for the Azure Key Vault service. Using a Service Tag in the Network Security Group (NSG) outbound rule allows the virtual machines to connect to Key Vault securely while delegating the updates and maintenance of the IP address ranges entirely to Azure, fulfilling the requirement to minimize administrative overhead.

Step-by-Step Solution

1
Identify the destination resource and communication requirements.
The destination is Azure Key Vault, an Azure PaaS service, and the traffic is outbound from Azure virtual machines.
This establishes the scope of the network rule needed within the Network Security Group (NSG).
2
Evaluate configuration methods against the constraint of minimizing administrative overhead and avoiding manual IP management.
Using individual IP ranges or routing changes introduces manual maintenance overhead and potential service disruption when IPs change. Service Tags are managed by Microsoft and dynamically update.
This determines that a Service Tag is the optimal mechanism to satisfy the security requirements with low administrative effort.
3
Select the correct Service Tag for the destination service.
The AzureKeyVault Service Tag represents the IP address prefixes for the Azure Key Vault service.
Specifying this Service Tag as the destination in the outbound NSG rule allows the required traffic securely and dynamically.

Key Concept

Azure Network Security Group Service Tags simplify NSG rule creation by representing groups of IP address prefixes from helper Azure services, managed automatically by Microsoft.
Question 667Question →

An enterprise is designing an Azure network infrastructure. The topology includes a hub virtual network named `vnet-weur-hub` (10.10.0.0/1610.10.0.0/16) peered with a spoke virtual network named `vnet-weur-spoke1` (10.20.0.0/1610.20.0.0/16). An active Network Virtual Appliance (NVA) is deployed in the hub virtual network in `snet-nva` (10.10.2.0/2410.10.2.0/24) with the private IP address 10.10.2.410.10.2.4.

The spoke virtual network `vnet-weur-spoke1` contains the following subnets:
* `snet-web` (10.20.1.0/2410.20.1.0/24) hosting front-end web servers.
* `snet-db` (10.20.2.0/2410.20.2.0/24) hosting database servers.

To inspect all inter-subnet traffic within the spoke, a network engineer associates a route table with `snet-web` containing a user-defined route (UDR) for 10.20.0.0/1610.20.0.0/16 pointing to the NVA at 10.10.2.410.10.2.4. However, this configuration prevents the web servers within `snet-web` from communicating with each other, breaking the application.

You need to restore communication between the web servers in `snet-web` while ensuring that all traffic from `snet-web` to `snet-db` (and any future subnets added to `vnet-weur-spoke1`) is routed through the NVA at 10.10.2.410.10.2.4. The design must minimize administrative overhead.

Which configuration should you add to the route table associated with `snet-web` to resolve the communication issue?

Show answer & explanation

Answer: Add a user-defined route for 10.20.1.0/2410.20.1.0/24 with the next hop type set to Virtual network.

Answer

Add a user-defined route for the local subnet prefix (10.20.1.0/2410.20.1.0/24) pointing to the Virtual network next hop type.
Adding a route for the local subnet prefix (10.20.1.0/2410.20.1.0/24) with a next hop type of Virtual network is correct because it uses the Longest Prefix Match (LPM) algorithm to override the broader 10.20.0.0/1610.20.0.0/16 UDR for local traffic only. This restores communication within the subnet while continuing to route traffic destined for other subnets (such as the database subnet) to the NVA. It also satisfies the administrative requirement because any future subnets created in the spoke VNet will automatically match the broader 10.20.0.0/1610.20.0.0/16 route and route to the NVA without needing manual route table modifications.

Step-by-Step Solution

1
Analyze the routing conflict in the route table.
The current user-defined route for 10.20.0.0/1610.20.0.0/16 pointing to the NVA overrides the default VnetLocal system route (10.20.0.0/1610.20.0.0/16 -> Virtual network) because they share the same prefix length, forcing all traffic (including intra-subnet traffic) to the NVA.
By default, Azure routes traffic within a VNet locally. When a UDR with the exact same prefix length is applied, it overrides this system route, sending all traffic matching that prefix to the NVA, which cannot hair-pin the traffic back to the same subnet.
2
Apply the Longest Prefix Match (LPM) rule.
A route with a more specific prefix (e.g., 10.20.1.0/2410.20.1.0/24) will take precedence over a route with a broader prefix (e.g., 10.20.0.0/1610.20.0.0/16).
Azure's routing decision is based first on the prefix length. The route with the longest prefix matches first.
3
Configure the local subnet override.
Adding a route for 10.20.1.0/2410.20.1.0/24 with the next hop set to Virtual network ensures that traffic within `snet-web` matches the /24 route and uses Azure's default local routing.
This restores intra-subnet communication while leaving the /16 route active for all other subnets within the VNet.
4
Evaluate administrative overhead.
Future subnets (e.g., 10.20.3.0/2410.20.3.0/24) will automatically fall under the 10.20.0.0/1610.20.0.0/16 route and route to the NVA without requiring manual route updates.
This satisfies the requirement to minimize administrative overhead as the network scales.

Key Concept

Azure routing precedence, specifically how User-Defined Routes (UDRs) interact with default system routes and the application of Longest Prefix Match (LPM) to override broad routing policies without increasing administrative overhead.
Question 668Question →

A retail company is designing an online order fulfillment system on Azure. The system will consist of several containerized microservices that communicate via an Azure Service Bus queue. The system must scale dynamically based on the number of active messages in the queue. The operations team wants to minimize the administrative effort required to manage the container infrastructure and has no experience with Kubernetes administration. Which service should you recommend?

Show answer & explanation

Answer: Azure Container Apps

Answer

Azure Container Apps
Azure Container Apps is the correct service because it is a serverless container platform that allows running microservices and background tasks without managing complex infrastructure. It includes built-in support for KEDA, which allows automatic event-driven scaling based on Azure Service Bus queue metrics, satisfying the scaling requirement with minimum administrative effort.

Step-by-Step Solution

1
Analyze the business and technical requirements of the scenario.
The requirements specify containerized microservices, dynamic scaling based on Azure Service Bus queue metrics, minimal administrative effort, and no Kubernetes administrative experience.
Identifying constraints helps filter out services that introduce excessive operational overhead or lack required features.
2
Evaluate the suitability of Azure container hosting options against the requirements.
Azure Container Apps natively supports scaling from zero based on queue length via built-in KEDA integration without requiring server or orchestrator management. Azure Kubernetes Service (AKS) requires management overhead, Azure Container Instances (ACI) lacks native queue-based autoscaling, and Azure Functions has execution timeouts and is not optimal for standard containerized microservices.
Comparing features against the constraints ensures the recommended solution aligns with Microsoft Best Practices.
3
Select the option that matches all requirements with the lowest administrative overhead.
Azure Container Apps satisfies all conditions.
Azure Container Apps is designed for microservices scaling on event triggers without requiring Kubernetes expertise.

Key Concept

Selecting the appropriate Azure container hosting service based on scaling requirements and administrative overhead.
Estimated Time:1m 30s
Question 669Question →

An organization is designing a hybrid identity and security strategy for Microsoft Entra ID. You need to match each technical requirement to the most appropriate Microsoft Entra ID authentication method or Conditional Access control. Match each requirement on the left to the correct feature on the right.

Click a left item, then click its matching right item

Items

Authenticate users against on-premises Active Directory in real-time without hosting Federation servers or syncing password hashes to the cloud.
Require multi-factor authentication (MFA) only when Microsoft Entra ID detects unusual properties during the token request process.
Force users to change their password when threat intelligence indicates that their credentials have been compromised.
Prevent cloud app access from corporate-owned laptops that are not registered and flagged as healthy in Microsoft Intune.

Matches

Show answer & explanation

Answer

To satisfy the requirements, pair Pass-through Authentication (PTA) with the local AD real-time authentication requirement; pair Sign-in risk policy with the anomaly detection requirement; pair User risk policy with the compromised credentials password change requirement; and pair the device compliance grant control with the Intune health verification requirement.
The correct pairings ensure that on-premises verification is handled by Pass-through Authentication without copying password hashes, session anomalies trigger Sign-in risk, credential leakage triggers User risk for password changes, and device health checked by Intune is validated via the device compliance grant control.

Step-by-Step Solution

1
Analyze the hybrid authentication requirements.
Identify that local AD validation without AD FS or password hash synchronization maps specifically to Pass-through Authentication (PTA).
PTA utilizes an on-premises agent to check credentials, satisfying the constraint of not synchronizing password hashes and avoiding AD FS complexity.
2
Evaluate the risk-based and device security requirements.
Distinguish between sign-in anomalies (Sign-in risk), identity compromise (User risk), and Intune device status (Device compliance state).
Sign-in risk handles real-time request anomalies; User risk handles compromised credentials; Device compliance checks Intune status.

Key Concept

Matching business authentication and access requirements to Entra ID hybrid authentication and Conditional Access capabilities.
Question 670Question →

An advertising technology company hosts a real-time bidding application on Azure virtual machines (VMs) in the East US region. The application architecture consists of three front-end web server VMs and one PostgreSQL database VM. The database VM has a single Premium SSD data disk with a continuous write churn of 25 MB/s25\text{ MB/s}. The front-end VMs have minimal disk write activity. You are designing a disaster recovery solution to the West US region. The solution must meet a Recovery Point Objective (RPO) of 15 minutes15\text{ minutes} and a Recovery Time Objective (RTO) of 1 hour1\text{ hour}. Which replication strategy should you recommend to meet the requirements?

Show answer & explanation

Answer: Replicate the front-end VMs using Azure Site Recovery. Replicate the database VM using PostgreSQL native streaming replication to a target VM in the West US region.

Answer

Replicate the front-end VMs using Azure Site Recovery, and replicate the database VM using PostgreSQL native streaming replication to a target VM in the West US region.
The correct strategy is to replicate the front-end VMs using Azure Site Recovery and replicate the database VM using PostgreSQL native streaming replication. This is because Azure Site Recovery limits block-level write replication churn to a maximum of 20 MB/s20\text{ MB/s} per Premium SSD disk under the High Churn configuration. Because the database disk exhibits a continuous write churn of 25 MB/s25\text{ MB/s}, utilizing Azure Site Recovery for the database VM is unsupported. Native streaming replication handles the database replication, while Azure Site Recovery is perfectly suited to meet the 15 minute15\text{ minute} RPO and 1 hour1\text{ hour} RTO for the low-churn front-end VMs.

Step-by-Step Solution

1
Analyze the write churn requirements of the workload components against Azure Site Recovery limits.
The database VM disk write churn is 25 MB/s25\text{ MB/s}, which exceeds the maximum supported threshold of 20 MB/s20\text{ MB/s} per Premium SSD disk for Azure Site Recovery (even with the High Churn policy enabled).
This establishes that the database VM cannot be replicated using Azure Site Recovery.
2
Evaluate replication alternatives for the database VM that can meet the 15 minute15\text{ minute} RPO and 1 hour1\text{ hour} RTO.
PostgreSQL native streaming replication can continuously replicate transaction logs to a target VM in the secondary region, meeting both the RPO and RTO constraints.
Database-level replication bypasses disk-level block replication limits imposed by virtual machine replication tools.
3
Determine the optimal disaster recovery mechanism for the front-end web server VMs.
Replicate the front-end VMs using Azure Site Recovery, which easily handles their low churn and meets the low RPO/RTO goals.
Using Azure Site Recovery for the application tier ensures rapid failover orchestration and matches the target RTO.

Key Concept

Azure Site Recovery limits and hybrid disaster recovery design
Question 671Question →

An organization is designing a shared storage solution on Azure for a medical imaging application called MediSync. The application requires access via the SMB protocol and demands sub-millisecond storage latency for all read and write operations. Additionally, the storage solution must remain fully operational even if a single physical datacenter within the primary Azure region suffers a power outage. Which storage account tier and redundancy configuration should you recommend?

Show answer & explanation

Answer: Premium tier configured with Zone-Redundant Storage (ZRS)

Answer

Premium tier configured with Zone-Redundant Storage (ZRS)
The correct option is the Premium tier configured with Zone-Redundant Storage (ZRS). The Premium tier is required because Azure Files requires SSD storage to deliver sub-millisecond latency. Zone-Redundant Storage (ZRS) replicates data synchronously across three availability zones within the primary region, ensuring the share remains available during a datacenter outage.

Step-by-Step Solution

1
Determine the required performance tier
Premium tier is selected
The application requires sub-millisecond latency, which is only supported by Premium Azure Files (SSD-backed) rather than Standard Azure Files (HDD-backed).
2
Evaluate the resiliency requirement against zone failure
Zone-Redundant Storage (ZRS) is required
To survive a physical datacenter outage within the primary region, data must be replicated across separate Availability Zones, which requires ZRS.
3
Verify replication capability for the selected tier
Premium tier with ZRS is a valid configuration
Azure Premium Files only supports LRS and ZRS. Geo-redundant storage (GRS/GZRS) is not supported for Premium file shares.

Key Concept

Azure Files tier and redundancy constraints
Question 672Question →

A logistics company hosts a maritime cargo tracking application on Azure virtual machines in the East US region. The application architecture consists of the following components:

* `VM-App`: Runs the application front-end and middle-tier. It contains three Standard SSD disks, with a maximum write churn of 3 MB/s3\text{ MB/s} per disk and a total VM write churn of 8 MB/s8\text{ MB/s}.
* `VM-DB`: Runs a Microsoft SQL Server database. It contains four Premium SSD disks. The transaction log disk experiences a continuous write churn of 22 MB/s22\text{ MB/s}, and the total VM write churn is 38 MB/s38\text{ MB/s}.

You need to design a disaster recovery (DR) solution to the West US region that meets the following requirements:

* A Recovery Point Objective (RPO) of 1515 minutes or less
* A Recovery Time Objective (RTO) of 22 hours or less

Which of the following replication strategies should you recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Replicate VM-App to the West US region using Azure Site Recovery.; Implement SQL Server Always On Availability Groups to replicate the databases on VM-DB to a destination VM in the West US region.

Answer

Replicate the application server using Azure Site Recovery, and implement SQL Server Always On Availability Groups for the database server.
The correct replication strategy uses Azure Site Recovery for the application tier VM-App, which has low disk churn (3 MB/s per disk) well within ASR limits. For the database tier VM-DB, since the write churn on the log disk (22 MB/s) exceeds ASR's disk-level limits, the database must be replicated natively using SQL Server Always On Availability Groups.

Step-by-Step Solution

1
Analyze the write churn metrics of the application server virtual machine (VM-App).
The write churn on VM-App is 3 MB/s per disk, and the total VM churn is 8 MB/s. Both values are within the standard limits of Azure Site Recovery (8 MB/s per Standard SSD disk).
To determine if Azure Site Recovery is a viable solution for replication of the application tier.
2
Analyze the write churn metrics of the database server virtual machine (VM-DB).
The log disk write churn is 22 MB/s, which exceeds the Azure Site Recovery limit for Premium SSD (10 MB/s per disk for standard, and 20 MB/s for high-churn replication).
To evaluate if VM-DB can be replicated using Azure Site Recovery without exceeding supported capacity limits.
3
Select replication options that satisfy both the churn limits and the 15-minute RPO / 2-hour RTO requirements.
Recommend replication via Azure Site Recovery for VM-App, and native database-level replication via SQL Server Always On Availability Groups to West US for the SQL Server workload on VM-DB.
To ensure that both tiers are replicated using supported mechanisms that meet business continuity objectives.

Key Concept

Azure Site Recovery limits require separating high-churn database workloads into native application-level replication mechanisms like SQL Server Always On Availability Groups.
Question 673Question →

A gaming company is designing a global multiplayer matchmaking and lobby service on Azure. The system will store active game lobby metadata and player session states. The service will be deployed in North Europe and West Europe to support players in both regions, with a workload of 70% reads and 30% writes. The solution must meet the following requirements:
- Guarantee zero data loss (RPO = 0) in the event of a regional outage.
- Ensure write requests are distributed uniformly to prevent performance bottlenecks.
- Minimize read latency for players in both regions.

Which two configurations should you include in the database design?

Select all that apply

Show answer & explanation

Answer: Configure the Azure Cosmos DB account to use a single write region in North Europe, a read region in West Europe, and set the default consistency level to Strong.; Select a composite partition key combining the LobbyId and PlayerId for the session container.

Answer

To meet the requirements, the database design must configure the Azure Cosmos DB account to use a single write region in North Europe with a read region in West Europe and the default consistency level set to Strong, and select a composite partition key combining the LobbyId and PlayerId for the session container.
To achieve zero data loss (RPO = 0) during a regional outage, the account must be configured with a single write region and Strong consistency. Strong consistency ensures synchronous replication across regions before write operations are acknowledged. Selecting a composite partition key combining LobbyId and PlayerId ensures high cardinality, which distributes write operations evenly across physical partitions and avoids hot partition bottlenecks.

Step-by-Step Solution

1
Identify the consistency level and replication requirements for RPO = 0.
Strong consistency is required to ensure writes are committed in both regions synchronously.
Strong consistency guarantees no data loss (RPO = 0) but is not compatible with multi-region writes, so a single write region must be selected.
2
Analyze partition key cardinality requirements to prevent hot partitions.
A composite partition key combining LobbyId and PlayerId provides high cardinality.
Using low-cardinality keys like RegionName would group all data into very few partitions, whereas a composite key distributes write throughput evenly.

Key Concept

Azure Cosmos DB multi-region replication, consistency levels, and partition key strategy.
Question 674Question →

A digital health platform hosts its applications across multiple Azure subscriptions organized under a single management group. To maintain compliance with healthcare regulations, you need to design a subscription governance and access control strategy that meets the following requirements:

* A team of external compliance auditors needs to view all resource configurations across all subscriptions. The members of this auditing team change on a monthly basis.
* Any new subscription added to the management group must automatically deploy Azure Monitor diagnostic settings to a central storage account.
* The lead security engineer needs the ability to manage role assignments but should only have this permission when performing scheduled security audits.

Which design strategy should you recommend?

Show answer & explanation

Answer: Assign the Reader role to a Microsoft Entra ID security group containing the external auditors at the management group scope. Deploy an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings on new subscriptions. Assign the User Access Administrator role as eligible in Privileged Identity Management (PIM) for the lead security engineer.

Answer

Assign the Reader role to a Microsoft Entra ID security group containing the external auditors at the management group scope. Deploy an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings on new subscriptions. Assign the User Access Administrator role as eligible in Privileged Identity Management (PIM) for the lead security engineer.
The correct strategy uses an Entra ID security group at the management group level to simplify auditor access management via inheritance. It uses the DeployIfNotExists policy effect to automatically remediate non-compliant subscriptions by deploying the required diagnostic settings. Finally, it uses eligible PIM assignments to enforce the principle of least privilege for administrative tasks.

Step-by-Step Solution

1
Address the access requirements for the rotating auditing team.
Create a Microsoft Entra ID security group, add the auditors to the group, and assign the Reader role to the group at the management group scope.
This utilizes Azure RBAC group-based inheritance, allowing you to manage membership updates within a single group rather than re-configuring role assignments across individual subscriptions.
2
Ensure compliance settings are automatically deployed to new subscriptions.
Create and assign an Azure Policy with the DeployIfNotExists effect.
A DeployIfNotExists policy automatically deploys the required diagnostic settings configuration if it is missing, satisfying the requirement for automated remediation.
3
Secure administrative capabilities for the lead security engineer.
Configure Privileged Identity Management (PIM) with the User Access Administrator role assigned as eligible.
Making the assignment eligible ensures the engineer can request just-in-time access only when performing audits, preventing persistent administrative privilege.

Key Concept

Azure subscription governance, resource inheritance, policy-driven remediation, and just-in-time administrative access.
Estimated Time:1m 30s
Question 675Question →

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-weur-hub` (address space: 10.100.0.0/1610.100.0.0/16), contains a subnet `snet-firewall` (10.100.1.0/2410.100.1.0/24) hosting a firewall Network Virtual Appliance (NVA) at IP address 10.100.1.410.100.1.4. Another subnet in the hub, `snet-shared` (10.100.2.0/2410.100.2.0/24), hosts a shared DNS server at IP address 10.100.2.1010.100.2.10.

The spoke virtual network, `vnet-weur-prod-app` (address space: 10.110.0.0/1610.110.0.0/16), is connected to `vnet-weur-hub` using virtual network peering with default settings. Inside `vnet-weur-prod-app`, there are two subnets: `snet-web` (10.110.10.0/2410.110.10.0/24) hosting web servers and `snet-db` (10.110.20.0/2410.110.20.0/24) hosting database servers (including a database server at 10.110.20.510.110.20.5).

To enforce security, a route table named `rt-snet-web` is associated with `snet-web` and configured with the following user-defined routes (UDRs):
- Route 1: Address prefix 0.0.0.0/00.0.0.0/0, Next hop type: Virtual appliance, Next hop IP address: 10.100.1.410.100.1.4
- Route 2: Address prefix 10.0.0.0/810.0.0.0/8, Next hop type: Virtual appliance, Next hop IP address: 10.100.1.410.100.1.4

What is the routing behavior for outbound traffic originating from a web server in `snet-web` (10.110.10.510.110.10.5) destined for the database server (10.110.20.510.110.20.5) and the DNS server (10.100.2.1010.100.2.10)?

Show answer & explanation

Answer: Traffic to both the database server and the DNS server bypasses the firewall NVA.

Answer

Traffic to both the database server and the DNS server bypasses the firewall NVA.
The correct answer is that traffic to both the database server and the DNS server bypasses the firewall NVA. This occurs because Azure selects routes based on the longest prefix match (LPM) algorithm first. The destination IP of the database server (10.110.20.510.110.20.5) matches the system route 10.110.0.0/1610.110.0.0/16 (next hop: Virtual Network) and the UDR 10.0.0.0/810.0.0.0/8 (next hop: Virtual Appliance). The prefix length of 1616 is longer than 88, so the system route wins, keeping traffic direct. Similarly, the destination IP of the DNS server (10.100.2.1010.100.2.10) matches the peering system route 10.100.0.0/1610.100.0.0/16 (next hop: VNet Peering) and the UDR 10.0.0.0/810.0.0.0/8. The prefix length of 1616 is longer than 88, so the peering system route wins, bypassing the firewall NVA.

Step-by-Step Solution

1
Evaluate the destination IP address for the database server and compare matching route prefixes.
For the database server at 10.110.20.510.110.20.5, the matching routes are the local system route 10.110.0.0/1610.110.0.0/16 (next hop: Virtual Network) and the UDR 10.0.0.0/810.0.0.0/8 (next hop: Virtual Appliance).
Azure routing uses the longest prefix match (LPM) algorithm to determine the winning route.
2
Select the winning route for the database server destination.
The local system route 10.110.0.0/1610.110.0.0/16 has a longer prefix length (1616) than the UDR 10.0.0.0/810.0.0.0/8 (88). Therefore, the system route is selected, keeping the traffic direct and bypassing the NVA.
A more specific prefix (longer subnet mask) takes precedence over a less specific prefix.
3
Evaluate the destination IP address for the DNS server and compare matching route prefixes.
For the DNS server at 10.100.2.1010.100.2.10, the matching routes are the peering system route 10.100.0.0/1610.100.0.0/16 (next hop: VNet Peering) and the UDR 10.0.0.0/810.0.0.0/8 (next hop: Virtual Appliance).
LPM must be applied to determine if the peering route or the UDR is selected.
4
Select the winning route for the DNS server destination.
The peering system route 10.100.0.0/1610.100.0.0/16 has a longer prefix length (1616) than the UDR 10.0.0.0/810.0.0.0/8 (88). Therefore, the peering route is selected, causing traffic to bypass the NVA.
Like the local route, the peering system route is more specific than the UDR.

Key Concept

Azure Virtual Network routing uses the longest prefix match algorithm to select routes. User-defined routes only override system routes of the exact same prefix length; a more specific system route will always take precedence over a broader user-defined route.
Question 676Question →

You are designing the hosting infrastructure for a new reporting solution in Azure that consists of two distinct workloads:

* Workload 1: A REST API frontend that receives metadata and writes it to a database. It experiences highly unpredictable, infrequent traffic spikes. Minimizing idle costs is a critical requirement, and the hosting environment must scale to zero when there is no traffic.
* Workload 2: A PDF generation engine triggered by queue messages. The report generation process can take up to 20 minutes to complete. The service must access an image library hosted on an on-premises server connected via an Azure Virtual Network.

You need to select the compute options that meet the requirements while minimizing both administrative overhead and cost.

Which hosting configuration should you recommend?

Show answer & explanation

Answer: Workload 1 hosted on Azure Functions (Consumption plan); Workload 2 hosted on Azure Functions (Premium plan)

Answer

Workload 1 hosted on Azure Functions (Consumption plan); Workload 2 hosted on Azure Functions (Premium plan)
The configuration using the Consumption plan for the REST API frontend and the Premium plan for the PDF generation engine meets all constraints. The REST API frontend requires scaling to zero to minimize idle costs during periods of no traffic, which is a native feature of the Azure Functions Consumption plan. The PDF generation engine requires an execution time of up to 20 minutes and virtual network connectivity; the Premium plan supports virtual network integration and has a maximum execution limit of 30 minutes (or can be configured to be unbounded), making it the ideal choice while maintaining low administrative overhead.

Step-by-Step Solution

1
Analyze the requirements for Workload 1.
Workload 1 requires scaling to zero to minimize idle costs due to infrequent and unpredictable traffic.
Azure Functions Consumption plan is serverless and scales to zero, charging only for active executions, which fits this requirement.
2
Analyze the requirements for Workload 2.
Workload 2 requires a timeout threshold of at least 20 minutes and virtual network integration to access the on-premises file server.
Azure Functions Premium plan supports virtual network integration and offers configurable execution timeouts of up to 30 minutes (or unbounded), satisfying both requirements.
3
Evaluate the administrative overhead of the options.
Using Azure Functions (Premium plan) for Workload 2 offers a fully managed platform as a service (PaaS) with low administrative overhead compared to containers hosted on Azure Kubernetes Service (AKS).
Azure Kubernetes Service requires managing cluster nodes, upgrades, and complex networking, which increases administrative overhead.

Key Concept

Selecting Azure serverless hosting plans based on execution limits, virtual network integration, and scaling-to-zero capabilities.
Question 677Question →

A multinational retail company is designing a container-based processing backend for an e-commerce platform that operates in both the United States (US) and the European Union (EU). The application has the following design requirements:

* Scale container instances dynamically from zero based on queue metrics using Kubernetes Event-driven Autoscaling (KEDA).
* Utilize Dapr for simplified service-to-service communication between microservices.
* Minimize administrative effort and operational overhead for managing the underlying host infrastructure.
* Comply with strict regulatory data residency laws that require log data for EU and US transactions to be isolated within their respective regions, preventing any cross-region consolidation.

Which infrastructure design should you recommend for the container hosting and logging?

Show answer & explanation

Answer: Deploy the microservices to Azure Container Apps, and configure two separate regional Log Analytics workspaces (one in the US and one in the EU) to collect the logs.

Answer

Deploying the microservices to Azure Container Apps and configuring two separate regional Log Analytics workspaces (one in the US and one in the EU) satisfies all compute and compliance requirements.
Deploying the microservices to Azure Container Apps and configuring two separate regional Log Analytics workspaces is correct. Azure Container Apps is a serverless platform that supports microservice features like KEDA scaling and Dapr out of the box with minimal management overhead. Configuring two separate regional workspaces ensures that data is stored locally within each region, satisfying strict compliance regulations regarding physical log isolation.

Step-by-Step Solution

1
Assess the compute requirements for KEDA, Dapr, and operational effort.
Azure Container Apps natively supports KEDA scaling and Dapr integration, and operates as a serverless service with less administrative effort than Azure Kubernetes Service.
Azure Container Apps abstracts the underlying Kubernetes cluster management while still providing enterprise container capabilities.
2
Evaluate the compliance requirements for log data residency.
Separate Log Analytics workspaces are required in the United States and the European Union regions to ensure physical data isolation.
A single centralized workspace would consolidate the log data across regions, violating the physical data residency boundary requirement.
3
Select the option that matches the optimal compute and logging configuration.
The configuration using Azure Container Apps with two separate regional workspaces satisfies all design constraints.
It achieves serverless container execution with native microservices features and respects regulatory boundaries.

Key Concept

Evaluating Azure container hosting services and regional log workspace boundaries to meet performance and regulatory requirements.
Question 678Question →

An enterprise is planning to migrate a core transaction processing database to Azure. The database has the following requirements:
- Hardware isolation: The workloads must run on dedicated physical hardware that is not shared with other tenants.
- Availability: The compute tier must guarantee a 99.99% uptime SLA.
- Workload profile: The database requires high-memory capacity and low-latency storage access.

Which compute virtualization solution should you recommend to meet these requirements?

Show answer & explanation

Answer: Deploy Azure Dedicated Hosts across at least two Availability Zones, and configure a Virtual Machine Scale Set in Flexible orchestration mode using Esv5-series Virtual Machines.

Answer

Deploy Azure Dedicated Hosts across at least two Availability Zones, and configure a Virtual Machine Scale Set in Flexible orchestration mode using Esv5-series Virtual Machines.
Deploying Azure Dedicated Hosts across at least two Availability Zones and using Esv5-series VMs in a Flexible orchestration VM Scale Set meets all requirements. Azure Dedicated Hosts fulfill the hardware isolation requirement. Spreading hosts across multiple zones satisfies the 99.99% SLA requirement. Esv5-series VMs provide the memory-optimized resources required for transaction processing databases.

Step-by-Step Solution

1
Analyze compliance and hardware isolation requirements.
Azure Dedicated Hosts are identified as the necessary compute resource since they provide physical servers dedicated to a single Azure subscription.
Regulatory compliance forbids sharing physical hardware with other tenants.
2
Determine the high availability (SLA) deployment strategy.
Determine that the Dedicated Hosts must be distributed across at least two Availability Zones in the target region.
Azure SLA requires at least two hosts deployed across two zones (or fault domains) to guarantee a 99.99% uptime SLA for the virtual machines.
3
Select the correct VM series based on the database profile.
Select Esv5-series Virtual Machines.
Esv5-series VMs are memory-optimized and support premium storage, which meets the high-memory and low-latency storage demands of the database.

Key Concept

Designing compute virtualization solutions with Azure Dedicated Hosts and VM Scale Sets to meet compliance, high availability, and specific workload profile requirements.
Question 679Question →

You are designing the serverless compute architecture for a reporting system that consists of two distinct workloads:

* Workload 1: A data processing service that runs in response to file uploads. Each execution takes up to 25 minutes to complete. The service requires access to an Azure Files share.
* Workload 2: A microservice that processes messages from an Azure Service Bus queue. The service must scale down to zero instances when no messages are present in the queue, and must scale out rapidly during peak loads. The application has no existing Kubernetes configuration, and you must minimize operational and infrastructure overhead.

Which two compute configurations should you recommend?

Select all that apply

Show answer & explanation

Answer: For Workload 1, deploy an Azure Container Apps Job.; For Workload 2, deploy an Azure Container App.

Answer

Deploy an Azure Container Apps Job for Workload 1 and an Azure Container App for Workload 2.
The correct architecture uses an Azure Container Apps Job for Workload 1 and an Azure Container App for Workload 2. An Azure Container Apps Job is designed for run-to-completion containerized tasks, supports execution times beyond 10 minutes (up to 24 hours), and supports mounting Azure Files shares. An Azure Container App is designed for microservices, supports scaling to zero based on Service Bus queue length via KEDA, and provides a serverless model that minimizes operational overhead, avoiding the infrastructure management required by Azure Kubernetes Service (AKS).

Step-by-Step Solution

1
Analyze Workload 1 execution duration and storage requirements.
Workload 1 runs for up to 25 minutes and requires an Azure Files share mount. Azure Functions on a Consumption plan has a strict 10-minute timeout limit and cannot host this workload.
This rules out standard Consumption plan serverless functions and requires a compute solution that supports longer runtimes and file share integration.
2
Select the correct compute option for Workload 1.
An Azure Container Apps Job is selected. Container Apps Jobs run containers to completion, support execution times of up to 24 hours, and support mounting Azure Files shares.
This configuration meets all requirements of Workload 1 with minimal administrative overhead.
3
Analyze Workload 2 scaling and operational overhead constraints.
Workload 2 must scale to zero when idle, scale out rapidly under load, and minimize operational overhead. There is no existing Kubernetes investment.
This excludes Azure Kubernetes Service (AKS) because AKS introduces significant administrative overhead for managing Kubernetes infrastructure.
4
Select the correct compute option for Workload 2.
An Azure Container App is selected. Azure Container Apps are fully managed, scale to zero using KEDA based on queue length, and avoid the infrastructure overhead of AKS.
This matches all scale-to-zero and low-overhead requirements for a queue-based containerized microservice.

Key Concept

Azure serverless and container hosting options require matching workload runtime limits, storage integrations, and scaling requirements to the appropriate service while minimizing operational overhead.
Question 680Question →

An enterprise deploys an application that uploads telemetry data to a General-purpose v2 (GPv2) storage account. The telemetry files must be managed according to the following requirements:

- Telemetry files are actively analyzed for the first 30 days and require sub-second access.
- Between 30 and 90 days, the files are accessed occasionally for reporting. Sub-second access is still required, but storage costs must be minimized.
- After 90 days, the files are retained solely for compliance auditing. Retrieval latency can be up to 15 hours.
- All telemetry files must be permanently deleted after 365 days.

You need to design an Azure Blob Storage lifecycle management policy to meet these requirements while minimizing costs.

Which two actions should you include in the lifecycle management policy? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Transition blobs to the Cool tier 30 days after creation.; Transition blobs to the Archive tier 90 days after creation.

Answer

Include the actions to transition blobs to the Cool tier 30 days after creation, and transition blobs to the Archive tier 90 days after creation.
Transitioning to the Cool tier after 30 days reduces storage costs while maintaining sub-second latency for occasional reports. Transitioning to the Archive tier after 90 days offers the lowest cost for long-term audit logs that can tolerate hours of retrieval latency.

Step-by-Step Solution

1
Analyze the active analysis phase requirements.
Telemetry files require Hot tier placement initially to support active analysis with sub-second latency for the first 30 days.
Hot tier provides the lowest access cost and sub-second latency, ideal for active analysis.
2
Evaluate the 30-to-90-day reporting phase requirements.
Transition the files to the Cool tier after 30 days.
Cool tier offers lower storage costs than Hot tier while maintaining sub-second retrieval latency, which is required for reporting.
3
Evaluate the post-90-day compliance auditing phase requirements.
Transition the files to the Archive tier after 90 days.
The Archive tier offers the lowest storage costs. The retrieval latency of up to 15 hours is acceptable for compliance audits that do not require immediate access.

Key Concept

Azure Blob Storage Lifecycle Management Tiers and Latency
Estimated Time:1m 30s
PreviousPage 34 / 60Next
All practice questions — Microsoft Azure Solutions Architect (AZ-305) | Examkin